@bounded-sh/client 0.0.104 → 0.0.106

package/dist/{index.native-CNW3iAoP.js → index.native-BpcNwWQX.js}

@@ -4830,9 +4830,18 @@ const OIDC_NO_WALLET = 'This session has no Turnkey wallet. Sign in again to pro
 // same tab (redirect + popup, or two popups) each own a distinct record, so a second
 // attempt cannot clobber the first's verifier/state/redirectUri.
 const PKCE_STORE_PREFIX = 'bounded.oidc.pkce';
+const STATE_PREFIX = 'bounded.';
+const LOGIN_TIMEOUT_MS = 10 * 60000;
+const CALLBACK_PARAMS = ['code', 'state', 'error', 'error_description', 'iss'];
 function pkceKey(state) {
     return `${PKCE_STORE_PREFIX}.${state}`;
 }
+function removeAttempt(state) {
+    try {
+        sessionStorage.removeItem(pkceKey(state));
+    }
+    catch ( /* Storage may have been disabled mid-login. */_a) { /* Storage may have been disabled mid-login. */ }
+}
 const ISSUER_SESSION_KIND_KEY = 'bounded_issuer_session_kind';
 // Active session store (Web on web, RN on React Native) — selected by config,
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
@@ -4941,6 +4950,165 @@ async function makePkce() {
 function randomState() {
     return b64url(getPlatform().getRandomBytes(16));
 }
+let pendingCompletion;
+let loginReturnError;
+/** The last OAuth return failure in this initialization, or null. Initialization
+ * remains usable so the UI can display this error and offer a fresh sign-in. */
+function getLoginReturnError() {
+    return (loginReturnError === null || loginReturnError === void 0 ? void 0 : loginReturnError.generation) === getInitializationGeneration() ? loginReturnError.error : null;
+}
+// A hosted page can contain both an app bundle and the platform widget's SDK.
+// They share one code exchange, while adopting the session in their own registries.
+const COMPLETIONS = Symbol.for('bounded.oidc.completions');
+function cleanCallbackUrl(url) {
+    const clean = new URL(url);
+    for (const key of CALLBACK_PARAMS)
+        clean.searchParams.delete(key);
+    return clean;
+}
+async function validateAttempt(pkce, callback) {
+    const cfg = await core.getConfig();
+    if (!pkce || typeof pkce.verifier !== 'string' || !pkce.verifier ||
+        pkce.appId !== cfg.appId || pkce.issuer !== await issuerBase()) {
+        throw new Error('Login belongs to a different app or auth server. Start sign-in again.');
+    }
+    if (!Number.isFinite(pkce.createdAt) || Date.now() - pkce.createdAt > LOGIN_TIMEOUT_MS || pkce.createdAt > Date.now()) {
+        throw new Error('Login expired. Start sign-in again.');
+    }
+    if (callback && (cleanCallbackUrl(callback).href !== cleanCallbackUrl(new URL(pkce.redirectUri)).href ||
+        (callback.searchParams.has('iss') && callback.searchParams.get('iss') !== pkce.issuer))) {
+        throw new Error('Login returned to a different address or from a different auth server. Start sign-in again.');
+    }
+}
+// The receiver acknowledges only after checking origin, window and state. An
+// absent/disconnected opener must never leave a popup claiming success.
+async function handOffPopup(url, state) {
+    const cfg = await core.getConfig();
+    const issuer = await issuerBase();
+    const opener = window.opener;
+    if (!opener || opener === window || opener.closed) {
+        throw new Error('The original sign-in window is unavailable. Close this window and sign in again in the original tab.');
+    }
+    return new Promise((resolve, reject) => {
+        const cleanup = () => { clearTimeout(timer); window.removeEventListener('message', onMessage); };
+        const onMessage = (event) => {
+            var _a;
+            if (event.source !== opener || event.origin !== url.origin ||
+                ((_a = event.data) === null || _a === void 0 ? void 0 : _a.type) !== 'bounded-oidc-accepted' || event.data.state !== state)
+                return;
+            cleanup();
+            try {
+                window.close();
+            }
+            catch ( /* The opener also closes its own popup handle. */_b) { /* The opener also closes its own popup handle. */ }
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error('Could not reach the original sign-in tab. Close this window and start sign-in again.'));
+        }, 10000);
+        window.addEventListener('message', onMessage);
+        try {
+            opener.postMessage({ type: 'bounded-oidc-code', state, code: url.searchParams.get('code'),
+                error: url.searchParams.get('error'), errorDescription: url.searchParams.get('error_description'),
+                callbackUrl: url.href, appId: cfg.appId, issuer }, url.origin);
+        }
+        catch (error) {
+            cleanup();
+            reject(error);
+        }
+    });
+}
+async function finishLoginReturn(url, state) {
+    try {
+        if (!/^bounded\.(popup|redirect)\.[A-Za-z0-9_-]{22}$/.test(state)) {
+            throw new Error('Invalid login state. Start sign-in again.');
+        }
+        if (state.startsWith('bounded.popup.')) {
+            await handOffPopup(url, state);
+            return { handled: true, user: null };
+        }
+        const raw = sessionStorage.getItem(pkceKey(state));
+        if (!raw)
+            throw new Error('Missing login attempt. Start sign-in again in this tab.');
+        const pkce = JSON.parse(raw);
+        if (pkce.state !== state)
+            throw new Error('OAuth state mismatch. Start sign-in again.');
+        await validateAttempt(pkce, url);
+        const error = url.searchParams.get('error');
+        if (error)
+            throw new Error(url.searchParams.get('error_description') || `Login failed: ${error}`);
+        const user = await exchangeCode(url.searchParams.get('code'), pkce);
+        return { handled: true, user, idToken: sessionManager().getIdToken() };
+    }
+    finally {
+        removeAttempt(state);
+        const clean = cleanCallbackUrl(url);
+        if (window.location.href === url.href) {
+            window.history.replaceState(window.history.state, document.title, clean.pathname + clean.search + clean.hash);
+        }
+    }
+}
+/** Internal initialization step. Unrelated OAuth callbacks are left untouched. */
+function completePendingLogin() {
+    if (!hasDOM$1())
+        return Promise.resolve({ handled: false, user: null });
+    const url = new URL(window.location.href);
+    const state = url.searchParams.get('state');
+    if (!(state === null || state === void 0 ? void 0 : state.startsWith(STATE_PREFIX)) || (!url.searchParams.get('code') && !url.searchParams.get('error'))) {
+        return Promise.resolve({ handled: false, user: null });
+    }
+    const generation = getInitializationGeneration();
+    if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.href) === url.href && pendingCompletion.generation === generation)
+        return pendingCompletion.promise;
+    const promise = finishSharedLoginReturn(url, state).catch((error) => {
+        loginReturnError = { generation, error: error instanceof Error ? error : new Error(String(error)) };
+        throw loginReturnError.error;
+    }).finally(() => {
+        if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.promise) === promise)
+            pendingCompletion = undefined;
+    });
+    pendingCompletion = { href: url.href, generation, promise };
+    return promise;
+}
+async function finishSharedLoginReturn(url, state) {
+    var _a;
+    var _b;
+    const cfg = await core.getConfig();
+    const issuer = await issuerBase();
+    if (state.startsWith('bounded.redirect.')) {
+        const raw = sessionStorage.getItem(pkceKey(state));
+        // A second SDK configured for another app/issuer on this page does not own
+        // this return. Leave its URL and proof available to the initiating app.
+        try {
+            const attempt = raw && JSON.parse(raw);
+            if (attempt && (attempt.appId !== cfg.appId || attempt.issuer !== issuer))
+                return { handled: false, user: null };
+        }
+        catch ( /* The owning completion reports malformed attempt data. */_c) { /* The owning completion reports malformed attempt data. */ }
+    }
+    const shared = (_a = (_b = window)[COMPLETIONS]) !== null && _a !== void 0 ? _a : (_b[COMPLETIONS] = new Map());
+    const key = JSON.stringify([url.href, cfg.appId, issuer]);
+    const existing = shared.get(key);
+    if (!existing) {
+        const completion = finishLoginReturn(url, state);
+        shared.set(key, completion);
+        return completion;
+    }
+    const generation = getInitializationGeneration();
+    const result = await existing;
+    if (result.user) {
+        if (!result.idToken || sessionManager().getIdToken() !== result.idToken) {
+            throw new Error('The completed login session has changed. Start sign-in again.');
+        }
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc',
+            user: Object.assign(Object.assign({}, result.user), { provider: oidcProviderSingleton }), beforeCommit: () => {
+                if (generation !== getInitializationGeneration())
+                    throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+            } });
+    }
+    return result;
+}
 function normalizeMethod(value) {
     const normalized = String(value || '').trim().toLowerCase();
     return /^[a-z0-9_-]{1,40}$/.test(normalized) ? normalized : null;
@@ -4983,7 +5151,8 @@ function appendHostedLoginHints(params, opts) {
 // native (expo-web-browser) path. The caller decides where the PkceState lives
 // (web → sessionStorage across the full-page redirect; native → in-memory across
 // the awaited browser session).
-async function buildAuthorize(opts) {
+async function buildAuthorize(opts, mode = 'redirect') {
+    loginReturnError = undefined;
     const cfg = await core.getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
@@ -4992,15 +5161,23 @@ async function buildAuthorize(opts) {
     const redirectUri = opts.redirectUri || (hasDOM$1() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
+    if (hasDOM$1()) {
+        const redirect = new URL(redirectUri);
+        if (redirect.origin !== window.location.origin || redirect.hash || CALLBACK_PARAMS.some((key) => redirect.searchParams.has(key))) {
+            throw new Error('redirectUri must be on this app origin, without a fragment or OAuth callback parameters.');
+        }
+    }
     const { verifier, challenge } = await makePkce();
-    const state = randomState();
+    const state = `${STATE_PREFIX}${mode}.${randomState()}`;
     const base = await issuerBase();
     const params = new URLSearchParams({
         client_id: cfg.appId, redirect_uri: redirectUri, response_type: 'code', scope: 'openid profile email',
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
+    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: {
+            verifier, state, redirectUri, appId: cfg.appId, issuer: base, createdAt: Date.now(),
+        } };
 }
 // Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
 // expo-web-browser driver vs. the web full-page-redirect/popup driver.
@@ -5049,8 +5226,7 @@ function parseCallbackParams(callbackUrl) {
 }
 // Full native login: open the hosted page in the system auth session, await the
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
-// as web. Returns the signed-in User (native completes inline — there's no separate
-// completeLoginFromRedirect() round-trip the way the web full-page redirect needs).
+// as web. Returns the signed-in User inline; web redirects complete on the next init().
 async function runNativeLogin(opts) {
     var _a, _b;
     const { url, pkce } = await buildAuthorize(opts);
@@ -5077,7 +5253,7 @@ async function runNativeLogin(opts) {
         if (!returnedState || returnedState !== pkce.state) {
             throw new Error('OAuth state mismatch — possible CSRF; aborting');
         }
-        return await exchangeCode(code, pkce.verifier, pkce.redirectUri);
+        return await exchangeCode(code, pkce);
     }
     finally {
         setAuthLoading(false);
@@ -5086,7 +5262,7 @@ async function runNativeLogin(opts) {
 /** Start hosted login (Google / Apple / email / hosted phone). Works on WEB and REACT NATIVE.
  *
  *  WEB: navigates the whole page to the hosted Bounded login and resolves (void) as the page
- *  unloads; on return to `redirectUri?code=...` you call completeLoginFromRedirect().
+ *  unloads; init() completes the return to redirectUri automatically.
  *
  *  REACT NATIVE: opens the hosted page via expo-web-browser, awaits the https universal-link
  *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
@@ -5104,63 +5280,32 @@ async function loginWithRedirect(opts) {
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
     sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
-    setAuthLoading(true); // reflect "signing in…" right up to navigation; the return page's
-    window.location.href = url; // completeLoginFromRedirect() keeps it true until the user resolves.
-}
-/** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
- *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
- *
- *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
- *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
- *  page to finish from. Calling it on RN is harmless. */
-async function completeLoginFromRedirect() {
-    if (!hasDOM$1())
-        return null;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const returnedState = url.searchParams.get('state');
-    if (!code)
-        return null;
-    // POPUP path: if we're the redirect_uri page running INSIDE the loginWithPopup() window,
-    // hand the code to the opener and close — no separate completeLoginInPopup() call needed.
-    // The opener is the same app/origin, so post to our own origin (the opener's message
-    // handler checks ev.origin === redirect_uri origin). One call now finishes BOTH flows.
-    if (window.opener && window.opener !== window) {
-        try {
-            window.opener.postMessage({ type: 'bounded-oidc-code', code, state: returnedState }, window.location.origin);
-        }
-        catch ( /* ignore */_a) { /* ignore */ }
-        try {
-            window.close();
-        }
-        catch ( /* ignore */_b) { /* ignore */ }
-        return null;
-    }
+    // This promise represents dispatch, not authentication on the next page.
+    // Browsers can cancel navigation (for example at beforeunload) without firing
+    // pageshow. Never leave this document's SDK loading after dispatch settles.
     setAuthLoading(true);
     try {
-        // Read back the exact record THIS attempt wrote, keyed by the state the issuer
-        // returned, so a concurrent login's record is never consumed by mistake.
-        const raw = returnedState ? sessionStorage.getItem(pkceKey(returnedState)) : null;
-        if (!raw)
-            throw new Error('Missing PKCE state — start login with loginWithRedirect()');
-        const pkce = JSON.parse(raw);
-        if (!returnedState || returnedState !== pkce.state)
-            throw new Error('OAuth state mismatch — possible CSRF; aborting');
-        const user = await exchangeCode(code, pkce.verifier, pkce.redirectUri);
-        sessionStorage.removeItem(pkceKey(returnedState));
-        // Strip code/state from the URL so a reload doesn't re-exchange (codes are single-use anyway).
-        url.searchParams.delete('code');
-        url.searchParams.delete('state');
-        window.history.replaceState({}, document.title, url.pathname + url.search + url.hash);
-        return user;
+        window.location.href = url;
+    }
+    catch (error) {
+        removeAttempt(pkce.state);
+        throw error;
     }
     finally {
         setAuthLoading(false);
     }
 }
+/** Optional explicit completion. Normal apps only await init(), which already finishes login.
+ * Concurrent calls share one exchange. Returns null when no Bounded return is present. */
+async function completeLoginFromRedirect() {
+    const result = await completePendingLogin();
+    const error = getLoginReturnError();
+    if (error)
+        throw error;
+    return result.user;
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
- *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
+ *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
     if (!hasDOM$1())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
@@ -5179,7 +5324,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts);
+        authorization = await buildAuthorize(opts, 'popup');
     }
     catch (error) {
         try {
@@ -5214,6 +5359,7 @@ async function loginWithPopup(opts) {
             popup.location.href = url;
         }
         catch (_d) {
+            removeAttempt(pkce.state);
             try {
                 popup.close();
             }
@@ -5229,17 +5375,21 @@ async function loginWithPopup(opts) {
             let settled = false;
             let timer;
             let navigationTimer;
+            let completionTimer;
             const cleanup = () => {
                 settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
+                clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
+                removeAttempt(pkce.state);
             };
             const onMsg = async (ev) => {
-                if (ev.origin !== expectedOrigin)
-                    return; // only trust the redirect_uri origin
+                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                    return;
                 const d = ev.data;
-                if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
+                if (!d || d.type !== 'bounded-oidc-code' ||
+                    (typeof d.code !== 'string' && typeof d.error !== 'string'))
                     return;
                 // Validate state BEFORE tearing down this listener, against the record THIS
                 // attempt captured in the closure (`pkce`), not a shared sessionStorage reread.
@@ -5247,10 +5397,15 @@ async function loginWithPopup(opts) {
                 // stay registered for our own code, instead of cleaning up on another's message.
                 if (d.state !== pkce.state)
                     return;
+                if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
+                    return;
                 cleanup();
                 try {
-                    const user = await exchangeCode(d.code, pkce.verifier, pkce.redirectUri);
-                    sessionStorage.removeItem(pkceKey(pkce.state));
+                    await validateAttempt(pkce, new URL(d.callbackUrl));
+                    popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
+                    if (d.error)
+                        throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
+                    const user = await exchangeCode(d.code, pkce);
                     try {
                         popup.close();
                     }
@@ -5258,10 +5413,22 @@ async function loginWithPopup(opts) {
                     resolve(user);
                 }
                 catch (e) {
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
                     reject(e);
                 }
             };
             window.addEventListener('message', onMsg);
+            completionTimer = setTimeout(() => {
+                cleanup();
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_a) { /* ignore */ }
+                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+            }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
             // authorize URL. The old code then waited forever because the popup was
@@ -5319,33 +5486,20 @@ async function loginWithPopup(opts) {
         setAuthLoading(false);
     }
 }
-/** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
- *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
-function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$1() || !window.opener)
-        return;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const state = url.searchParams.get('state');
-    if (!code)
-        return;
-    try {
-        window.opener.postMessage({ type: 'bounded-oidc-code', code, state }, openerOrigin);
-    }
-    catch ( /* ignore */_a) { /* ignore */ }
-    try {
-        window.close();
-    }
-    catch ( /* ignore */_b) { /* ignore */ }
-}
-async function exchangeCode(code, verifier, redirectUri) {
-    const cfg = await core.getConfig();
-    const base = await issuerBase();
+async function exchangeCode(code, pkce) {
+    const generation = getInitializationGeneration();
+    const beforeCommit = () => {
+        if (generation !== getInitializationGeneration())
+            throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+    };
+    await validateAttempt(pkce);
+    beforeCommit();
+    const base = pkce.issuer;
     // OIDC token endpoint: application/x-www-form-urlencoded (the standard). Public client (no
     // secret) authenticated by PKCE. The code is single-use + short-TTL on the server.
     const body = new URLSearchParams({
-        grant_type: 'authorization_code', code, redirect_uri: redirectUri,
-        client_id: cfg.appId, code_verifier: verifier,
+        grant_type: 'authorization_code', code, redirect_uri: pkce.redirectUri,
+        client_id: pkce.appId, code_verifier: pkce.verifier,
     });
     let res;
     try {
@@ -5369,10 +5523,20 @@ async function exchangeCode(code, verifier, redirectUri) {
     const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
     const refreshToken = boundedRefreshTokenField(data);
     const user = userFromIdToken(idToken);
-    await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base);
+    // Reinitialization while the request was in flight must not install this
+    // app's result under a different app's session manager/configuration.
+    beforeCommit();
+    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, beforeCommit);
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
-    await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user });
+    try {
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+    }
+    catch (error) {
+        if (typeof rollback === 'function')
+            await rollback();
+        throw error;
+    }
     // OIDC login does establish the issuer's Better Auth browser cookie. Record
     // that fact separately from the provider name so logout clears the cookie
     // and returns through the registered app origin. Stamped AFTER the adoption
@@ -5723,7 +5887,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CGhDN-8d.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-Czo-xM6n.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -5765,7 +5929,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-FY9JLEPR.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-C7Q0haGY.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -5778,7 +5942,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-Cym2uENX.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-_UNpc_hM.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -5803,7 +5967,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BT9JPOpp.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DJ5nCGjq.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -5865,7 +6029,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BT9JPOpp.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DJ5nCGjq.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6036,7 +6200,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-FY9JLEPR.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-C7Q0haGY.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6319,6 +6483,10 @@ let authLoadingListeners = [];
 let initCompleted = false;
 let isAuthLoading = false;
 let authReadyPromise = null;
+let initializingConfig = null;
+let initializationGeneration = 0;
+/** Internal guard for a login result arriving after the app reconfigured the SDK. */
+function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
 async function initialize(newConfig) {
@@ -6344,6 +6512,19 @@ async function initialize(newConfig) {
         authProviderInstance = await getAuthProvider(newConfig);
         // Initialize config with auth provider
         await core.init(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
+        // A return establishes its own provider/session, or hands off a popup.
+        // Restoring the old provider afterwards would overwrite the new login.
+        try {
+            if ((await completePendingLogin()).handled) {
+                initCompleted = true;
+                return;
+            }
+        }
+        catch (_a) {
+            // A cancelled/failed return is a login failure, not a broken SDK.
+            // The completion layer keeps it in getLoginReturnError(); restore
+            // any existing session and leave sign-in/readiness usable for retry.
+        }
         // Now that core is initialized, update the auth method on the config
         const authMethod = getCurrentAuthMethod();
         if (authMethod) {
@@ -6375,7 +6556,42 @@ async function initialize(newConfig) {
         setAuthLoading(false);
     }
 }
+// Compare data options by value, but preserve identity for callbacks and class
+// instances such as providers. Comparing only app/endpoints would silently drop
+// a concurrent change to wallet policy or provider configuration.
+function sameConfigValue(a, b, seen = new WeakMap()) {
+    var _a;
+    if (Object.is(a, b))
+        return true;
+    if (!a || !b || typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    if (Array.isArray(a) && a.length !== b.length)
+        return false;
+    if (!Array.isArray(a)) {
+        for (const value of [a, b]) {
+            const prototype = Object.getPrototypeOf(value);
+            if (prototype !== null && ((_a = prototype.constructor) === null || _a === void 0 ? void 0 : _a.name) !== 'Object')
+                return false;
+        }
+    }
+    if (seen.has(a))
+        return seen.get(a) === b;
+    seen.set(a, b);
+    const left = Object.keys(a), right = Object.keys(b);
+    return left.length === right.length && left.every((key) => Object.prototype.hasOwnProperty.call(b, key)
+        && sameConfigValue(a[key], b[key], seen));
+}
 function init(newConfig) {
+    if (initializingConfig) {
+        if (sameConfigValue(initializingConfig, newConfig)) {
+            return authReadyPromise;
+        }
+        return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
+    }
+    initializingConfig = Object.assign({}, newConfig);
+    initializationGeneration++;
     let resolveReady;
     let rejectReady;
     const ready = new Promise((resolve, reject) => {
@@ -6386,7 +6602,7 @@ function init(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(newConfig).then(resolveReady, rejectReady);
+    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -8380,12 +8596,12 @@ exports.bs58 = bs58;
 exports.bufferExports = bufferExports;
 exports.builds = builds;
 exports.completeLoginFromRedirect = completeLoginFromRedirect;
-exports.completeLoginInPopup = completeLoginInPopup;
 exports.confirmAndCheckTransaction = confirmAndCheckTransaction;
 exports.getAuthLoading = getAuthLoading;
 exports.getAuthProvider = getAuthProvider;
 exports.getCurrentUser = getCurrentUser;
 exports.getIdToken = getIdToken;
+exports.getLoginReturnError = getLoginReturnError;
 exports.getPlatform = getPlatform;
 exports.getWallets = getWallets;
 exports.hasTurnkeyWallet = hasTurnkeyWallet;
@@ -8420,4 +8636,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index.native-CNW3iAoP.js.map
+//# sourceMappingURL=index.native-BpcNwWQX.js.map