@bounded-sh/client 0.0.104 → 0.0.106

package/dist/{index-DKkAO0g-.mjs → index-nVYK3QUO.mjs}

@@ -1,4 +1,4 @@
-import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, onSessionCleared, deriveUserIdentityFromIdToken, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, init as init$2, deriveUserIdentityFromIdToken, onSessionCleared, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 function walletContextFromClaims(claims, baseUrl, expectedAppId, tenantOrigin) {
@@ -190,6 +190,36 @@ function setPlatform(adapter) {
 function getPlatform() {
     return _platform;
 }
+// ---------------------------------------------------------------------------
+// Mobile / Android detection helpers
+// ---------------------------------------------------------------------------
+/**
+ * Detect mobile device even when Chrome "Request Desktop Site" is active.
+ *
+ * Desktop mode on Android strips "Android" and "Mobile" from the UA, leaving
+ * something like "Linux x86_64 …". The fallback detects this by looking for
+ * touch capability + small viewport + a UA that doesn't belong to a known
+ * desktop OS (ChromeOS, Windows, macOS).
+ */
+function detectMobile() {
+    const ua = _platform.getUserAgent();
+    if (/Android|iPhone|iPad|iPod/i.test(ua))
+        return true;
+    if (typeof navigator !== 'undefined' && typeof window !== 'undefined') {
+        const hasTouch = navigator.maxTouchPoints > 0;
+        // Macs don't have touch screens, so "Macintosh" + touch = iOS desktop mode
+        // (also catches iPadOS 13+ which always reports as Macintosh)
+        if (/Macintosh/i.test(ua) && hasTouch)
+            return true;
+        // Android desktop mode: Linux UA + touch + small viewport, excluding
+        // known desktop OSes (ChromeOS, Windows, macOS)
+        const isSmallViewport = window.innerWidth <= 1024;
+        const isDesktopOS = /CrOS|Windows|Macintosh/i.test(ua);
+        if (hasTouch && isSmallViewport && !isDesktopOS)
+            return true;
+    }
+    return false;
+}
 
 /**
  * OffchainAuthProvider wraps a real auth provider (Turnkey, Phantom, ...) for the
@@ -5016,9 +5046,18 @@ const OIDC_NO_WALLET = 'This session has no Turnkey wallet. Sign in again to pro
 // same tab (redirect + popup, or two popups) each own a distinct record, so a second
 // attempt cannot clobber the first's verifier/state/redirectUri.
 const PKCE_STORE_PREFIX = 'bounded.oidc.pkce';
+const STATE_PREFIX = 'bounded.';
+const LOGIN_TIMEOUT_MS = 10 * 60000;
+const CALLBACK_PARAMS = ['code', 'state', 'error', 'error_description', 'iss'];
 function pkceKey(state) {
     return `${PKCE_STORE_PREFIX}.${state}`;
 }
+function removeAttempt(state) {
+    try {
+        sessionStorage.removeItem(pkceKey(state));
+    }
+    catch ( /* Storage may have been disabled mid-login. */_a) { /* Storage may have been disabled mid-login. */ }
+}
 const ISSUER_SESSION_KIND_KEY = 'bounded_issuer_session_kind';
 // Active session store (Web on web, RN on React Native) — selected by config,
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
@@ -5127,6 +5166,165 @@ async function makePkce() {
 function randomState() {
     return b64url(getPlatform().getRandomBytes(16));
 }
+let pendingCompletion;
+let loginReturnError;
+/** The last OAuth return failure in this initialization, or null. Initialization
+ * remains usable so the UI can display this error and offer a fresh sign-in. */
+function getLoginReturnError() {
+    return (loginReturnError === null || loginReturnError === void 0 ? void 0 : loginReturnError.generation) === getInitializationGeneration() ? loginReturnError.error : null;
+}
+// A hosted page can contain both an app bundle and the platform widget's SDK.
+// They share one code exchange, while adopting the session in their own registries.
+const COMPLETIONS = Symbol.for('bounded.oidc.completions');
+function cleanCallbackUrl(url) {
+    const clean = new URL(url);
+    for (const key of CALLBACK_PARAMS)
+        clean.searchParams.delete(key);
+    return clean;
+}
+async function validateAttempt(pkce, callback) {
+    const cfg = await getConfig();
+    if (!pkce || typeof pkce.verifier !== 'string' || !pkce.verifier ||
+        pkce.appId !== cfg.appId || pkce.issuer !== await issuerBase()) {
+        throw new Error('Login belongs to a different app or auth server. Start sign-in again.');
+    }
+    if (!Number.isFinite(pkce.createdAt) || Date.now() - pkce.createdAt > LOGIN_TIMEOUT_MS || pkce.createdAt > Date.now()) {
+        throw new Error('Login expired. Start sign-in again.');
+    }
+    if (callback && (cleanCallbackUrl(callback).href !== cleanCallbackUrl(new URL(pkce.redirectUri)).href ||
+        (callback.searchParams.has('iss') && callback.searchParams.get('iss') !== pkce.issuer))) {
+        throw new Error('Login returned to a different address or from a different auth server. Start sign-in again.');
+    }
+}
+// The receiver acknowledges only after checking origin, window and state. An
+// absent/disconnected opener must never leave a popup claiming success.
+async function handOffPopup(url, state) {
+    const cfg = await getConfig();
+    const issuer = await issuerBase();
+    const opener = window.opener;
+    if (!opener || opener === window || opener.closed) {
+        throw new Error('The original sign-in window is unavailable. Close this window and sign in again in the original tab.');
+    }
+    return new Promise((resolve, reject) => {
+        const cleanup = () => { clearTimeout(timer); window.removeEventListener('message', onMessage); };
+        const onMessage = (event) => {
+            var _a;
+            if (event.source !== opener || event.origin !== url.origin ||
+                ((_a = event.data) === null || _a === void 0 ? void 0 : _a.type) !== 'bounded-oidc-accepted' || event.data.state !== state)
+                return;
+            cleanup();
+            try {
+                window.close();
+            }
+            catch ( /* The opener also closes its own popup handle. */_b) { /* The opener also closes its own popup handle. */ }
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error('Could not reach the original sign-in tab. Close this window and start sign-in again.'));
+        }, 10000);
+        window.addEventListener('message', onMessage);
+        try {
+            opener.postMessage({ type: 'bounded-oidc-code', state, code: url.searchParams.get('code'),
+                error: url.searchParams.get('error'), errorDescription: url.searchParams.get('error_description'),
+                callbackUrl: url.href, appId: cfg.appId, issuer }, url.origin);
+        }
+        catch (error) {
+            cleanup();
+            reject(error);
+        }
+    });
+}
+async function finishLoginReturn(url, state) {
+    try {
+        if (!/^bounded\.(popup|redirect)\.[A-Za-z0-9_-]{22}$/.test(state)) {
+            throw new Error('Invalid login state. Start sign-in again.');
+        }
+        if (state.startsWith('bounded.popup.')) {
+            await handOffPopup(url, state);
+            return { handled: true, user: null };
+        }
+        const raw = sessionStorage.getItem(pkceKey(state));
+        if (!raw)
+            throw new Error('Missing login attempt. Start sign-in again in this tab.');
+        const pkce = JSON.parse(raw);
+        if (pkce.state !== state)
+            throw new Error('OAuth state mismatch. Start sign-in again.');
+        await validateAttempt(pkce, url);
+        const error = url.searchParams.get('error');
+        if (error)
+            throw new Error(url.searchParams.get('error_description') || `Login failed: ${error}`);
+        const user = await exchangeCode(url.searchParams.get('code'), pkce);
+        return { handled: true, user, idToken: sessionManager().getIdToken() };
+    }
+    finally {
+        removeAttempt(state);
+        const clean = cleanCallbackUrl(url);
+        if (window.location.href === url.href) {
+            window.history.replaceState(window.history.state, document.title, clean.pathname + clean.search + clean.hash);
+        }
+    }
+}
+/** Internal initialization step. Unrelated OAuth callbacks are left untouched. */
+function completePendingLogin() {
+    if (!hasDOM$2())
+        return Promise.resolve({ handled: false, user: null });
+    const url = new URL(window.location.href);
+    const state = url.searchParams.get('state');
+    if (!(state === null || state === void 0 ? void 0 : state.startsWith(STATE_PREFIX)) || (!url.searchParams.get('code') && !url.searchParams.get('error'))) {
+        return Promise.resolve({ handled: false, user: null });
+    }
+    const generation = getInitializationGeneration();
+    if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.href) === url.href && pendingCompletion.generation === generation)
+        return pendingCompletion.promise;
+    const promise = finishSharedLoginReturn(url, state).catch((error) => {
+        loginReturnError = { generation, error: error instanceof Error ? error : new Error(String(error)) };
+        throw loginReturnError.error;
+    }).finally(() => {
+        if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.promise) === promise)
+            pendingCompletion = undefined;
+    });
+    pendingCompletion = { href: url.href, generation, promise };
+    return promise;
+}
+async function finishSharedLoginReturn(url, state) {
+    var _a;
+    var _b;
+    const cfg = await getConfig();
+    const issuer = await issuerBase();
+    if (state.startsWith('bounded.redirect.')) {
+        const raw = sessionStorage.getItem(pkceKey(state));
+        // A second SDK configured for another app/issuer on this page does not own
+        // this return. Leave its URL and proof available to the initiating app.
+        try {
+            const attempt = raw && JSON.parse(raw);
+            if (attempt && (attempt.appId !== cfg.appId || attempt.issuer !== issuer))
+                return { handled: false, user: null };
+        }
+        catch ( /* The owning completion reports malformed attempt data. */_c) { /* The owning completion reports malformed attempt data. */ }
+    }
+    const shared = (_a = (_b = window)[COMPLETIONS]) !== null && _a !== void 0 ? _a : (_b[COMPLETIONS] = new Map());
+    const key = JSON.stringify([url.href, cfg.appId, issuer]);
+    const existing = shared.get(key);
+    if (!existing) {
+        const completion = finishLoginReturn(url, state);
+        shared.set(key, completion);
+        return completion;
+    }
+    const generation = getInitializationGeneration();
+    const result = await existing;
+    if (result.user) {
+        if (!result.idToken || sessionManager().getIdToken() !== result.idToken) {
+            throw new Error('The completed login session has changed. Start sign-in again.');
+        }
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc',
+            user: Object.assign(Object.assign({}, result.user), { provider: oidcProviderSingleton }), beforeCommit: () => {
+                if (generation !== getInitializationGeneration())
+                    throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+            } });
+    }
+    return result;
+}
 function normalizeMethod(value) {
     const normalized = String(value || '').trim().toLowerCase();
     return /^[a-z0-9_-]{1,40}$/.test(normalized) ? normalized : null;
@@ -5169,7 +5367,8 @@ function appendHostedLoginHints(params, opts) {
 // native (expo-web-browser) path. The caller decides where the PkceState lives
 // (web → sessionStorage across the full-page redirect; native → in-memory across
 // the awaited browser session).
-async function buildAuthorize(opts) {
+async function buildAuthorize(opts, mode = 'redirect') {
+    loginReturnError = undefined;
     const cfg = await getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
@@ -5178,15 +5377,23 @@ async function buildAuthorize(opts) {
     const redirectUri = opts.redirectUri || (hasDOM$2() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
+    if (hasDOM$2()) {
+        const redirect = new URL(redirectUri);
+        if (redirect.origin !== window.location.origin || redirect.hash || CALLBACK_PARAMS.some((key) => redirect.searchParams.has(key))) {
+            throw new Error('redirectUri must be on this app origin, without a fragment or OAuth callback parameters.');
+        }
+    }
     const { verifier, challenge } = await makePkce();
-    const state = randomState();
+    const state = `${STATE_PREFIX}${mode}.${randomState()}`;
     const base = await issuerBase();
     const params = new URLSearchParams({
         client_id: cfg.appId, redirect_uri: redirectUri, response_type: 'code', scope: 'openid profile email',
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
+    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: {
+            verifier, state, redirectUri, appId: cfg.appId, issuer: base, createdAt: Date.now(),
+        } };
 }
 // Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
 // expo-web-browser driver vs. the web full-page-redirect/popup driver.
@@ -5235,8 +5442,7 @@ function parseCallbackParams(callbackUrl) {
 }
 // Full native login: open the hosted page in the system auth session, await the
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
-// as web. Returns the signed-in User (native completes inline — there's no separate
-// completeLoginFromRedirect() round-trip the way the web full-page redirect needs).
+// as web. Returns the signed-in User inline; web redirects complete on the next init().
 async function runNativeLogin(opts) {
     var _a, _b;
     const { url, pkce } = await buildAuthorize(opts);
@@ -5263,7 +5469,7 @@ async function runNativeLogin(opts) {
         if (!returnedState || returnedState !== pkce.state) {
             throw new Error('OAuth state mismatch — possible CSRF; aborting');
         }
-        return await exchangeCode(code, pkce.verifier, pkce.redirectUri);
+        return await exchangeCode(code, pkce);
     }
     finally {
         setAuthLoading(false);
@@ -5272,7 +5478,7 @@ async function runNativeLogin(opts) {
 /** Start hosted login (Google / Apple / email / hosted phone). Works on WEB and REACT NATIVE.
  *
  *  WEB: navigates the whole page to the hosted Bounded login and resolves (void) as the page
- *  unloads; on return to `redirectUri?code=...` you call completeLoginFromRedirect().
+ *  unloads; init() completes the return to redirectUri automatically.
  *
  *  REACT NATIVE: opens the hosted page via expo-web-browser, awaits the https universal-link
  *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
@@ -5290,63 +5496,32 @@ async function loginWithRedirect(opts) {
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
     sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
-    setAuthLoading(true); // reflect "signing in…" right up to navigation; the return page's
-    window.location.href = url; // completeLoginFromRedirect() keeps it true until the user resolves.
-}
-/** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
- *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
- *
- *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
- *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
- *  page to finish from. Calling it on RN is harmless. */
-async function completeLoginFromRedirect() {
-    if (!hasDOM$2())
-        return null;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const returnedState = url.searchParams.get('state');
-    if (!code)
-        return null;
-    // POPUP path: if we're the redirect_uri page running INSIDE the loginWithPopup() window,
-    // hand the code to the opener and close — no separate completeLoginInPopup() call needed.
-    // The opener is the same app/origin, so post to our own origin (the opener's message
-    // handler checks ev.origin === redirect_uri origin). One call now finishes BOTH flows.
-    if (window.opener && window.opener !== window) {
-        try {
-            window.opener.postMessage({ type: 'bounded-oidc-code', code, state: returnedState }, window.location.origin);
-        }
-        catch ( /* ignore */_a) { /* ignore */ }
-        try {
-            window.close();
-        }
-        catch ( /* ignore */_b) { /* ignore */ }
-        return null;
-    }
+    // This promise represents dispatch, not authentication on the next page.
+    // Browsers can cancel navigation (for example at beforeunload) without firing
+    // pageshow. Never leave this document's SDK loading after dispatch settles.
     setAuthLoading(true);
     try {
-        // Read back the exact record THIS attempt wrote, keyed by the state the issuer
-        // returned, so a concurrent login's record is never consumed by mistake.
-        const raw = returnedState ? sessionStorage.getItem(pkceKey(returnedState)) : null;
-        if (!raw)
-            throw new Error('Missing PKCE state — start login with loginWithRedirect()');
-        const pkce = JSON.parse(raw);
-        if (!returnedState || returnedState !== pkce.state)
-            throw new Error('OAuth state mismatch — possible CSRF; aborting');
-        const user = await exchangeCode(code, pkce.verifier, pkce.redirectUri);
-        sessionStorage.removeItem(pkceKey(returnedState));
-        // Strip code/state from the URL so a reload doesn't re-exchange (codes are single-use anyway).
-        url.searchParams.delete('code');
-        url.searchParams.delete('state');
-        window.history.replaceState({}, document.title, url.pathname + url.search + url.hash);
-        return user;
+        window.location.href = url;
+    }
+    catch (error) {
+        removeAttempt(pkce.state);
+        throw error;
     }
     finally {
         setAuthLoading(false);
     }
 }
+/** Optional explicit completion. Normal apps only await init(), which already finishes login.
+ * Concurrent calls share one exchange. Returns null when no Bounded return is present. */
+async function completeLoginFromRedirect() {
+    const result = await completePendingLogin();
+    const error = getLoginReturnError();
+    if (error)
+        throw error;
+    return result.user;
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
- *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
+ *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
     if (!hasDOM$2())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
@@ -5365,7 +5540,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts);
+        authorization = await buildAuthorize(opts, 'popup');
     }
     catch (error) {
         try {
@@ -5400,6 +5575,7 @@ async function loginWithPopup(opts) {
             popup.location.href = url;
         }
         catch (_d) {
+            removeAttempt(pkce.state);
             try {
                 popup.close();
             }
@@ -5415,17 +5591,21 @@ async function loginWithPopup(opts) {
             let settled = false;
             let timer;
             let navigationTimer;
+            let completionTimer;
             const cleanup = () => {
                 settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
+                clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
+                removeAttempt(pkce.state);
             };
             const onMsg = async (ev) => {
-                if (ev.origin !== expectedOrigin)
-                    return; // only trust the redirect_uri origin
+                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                    return;
                 const d = ev.data;
-                if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
+                if (!d || d.type !== 'bounded-oidc-code' ||
+                    (typeof d.code !== 'string' && typeof d.error !== 'string'))
                     return;
                 // Validate state BEFORE tearing down this listener, against the record THIS
                 // attempt captured in the closure (`pkce`), not a shared sessionStorage reread.
@@ -5433,10 +5613,15 @@ async function loginWithPopup(opts) {
                 // stay registered for our own code, instead of cleaning up on another's message.
                 if (d.state !== pkce.state)
                     return;
+                if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
+                    return;
                 cleanup();
                 try {
-                    const user = await exchangeCode(d.code, pkce.verifier, pkce.redirectUri);
-                    sessionStorage.removeItem(pkceKey(pkce.state));
+                    await validateAttempt(pkce, new URL(d.callbackUrl));
+                    popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
+                    if (d.error)
+                        throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
+                    const user = await exchangeCode(d.code, pkce);
                     try {
                         popup.close();
                     }
@@ -5444,10 +5629,22 @@ async function loginWithPopup(opts) {
                     resolve(user);
                 }
                 catch (e) {
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
                     reject(e);
                 }
             };
             window.addEventListener('message', onMsg);
+            completionTimer = setTimeout(() => {
+                cleanup();
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_a) { /* ignore */ }
+                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+            }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
             // authorize URL. The old code then waited forever because the popup was
@@ -5505,25 +5702,6 @@ async function loginWithPopup(opts) {
         setAuthLoading(false);
     }
 }
-/** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
- *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
-function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$2() || !window.opener)
-        return;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const state = url.searchParams.get('state');
-    if (!code)
-        return;
-    try {
-        window.opener.postMessage({ type: 'bounded-oidc-code', code, state }, openerOrigin);
-    }
-    catch ( /* ignore */_a) { /* ignore */ }
-    try {
-        window.close();
-    }
-    catch ( /* ignore */_b) { /* ignore */ }
-}
 // Establish a Bounded session from a server-minted inline-session response (the same
 // { idToken, accessToken, refreshToken } shape as /session/refresh). Used by the
 // Turnkey-native login path (authMode:"turnkey"), which mints the session server-side
@@ -5566,14 +5744,20 @@ async function inlineAuthEndpoint() {
     const cfg = await getConfig();
     return { base: await issuerBase(), appId: cfg.appId };
 }
-async function exchangeCode(code, verifier, redirectUri) {
-    const cfg = await getConfig();
-    const base = await issuerBase();
+async function exchangeCode(code, pkce) {
+    const generation = getInitializationGeneration();
+    const beforeCommit = () => {
+        if (generation !== getInitializationGeneration())
+            throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+    };
+    await validateAttempt(pkce);
+    beforeCommit();
+    const base = pkce.issuer;
     // OIDC token endpoint: application/x-www-form-urlencoded (the standard). Public client (no
     // secret) authenticated by PKCE. The code is single-use + short-TTL on the server.
     const body = new URLSearchParams({
-        grant_type: 'authorization_code', code, redirect_uri: redirectUri,
-        client_id: cfg.appId, code_verifier: verifier,
+        grant_type: 'authorization_code', code, redirect_uri: pkce.redirectUri,
+        client_id: pkce.appId, code_verifier: pkce.verifier,
     });
     let res;
     try {
@@ -5597,10 +5781,20 @@ async function exchangeCode(code, verifier, redirectUri) {
     const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
     const refreshToken = boundedRefreshTokenField(data);
     const user = userFromIdToken(idToken);
-    await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base);
+    // Reinitialization while the request was in flight must not install this
+    // app's result under a different app's session manager/configuration.
+    beforeCommit();
+    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, beforeCommit);
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
-    await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user });
+    try {
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+    }
+    catch (error) {
+        if (typeof rollback === 'function')
+            await rollback();
+        throw error;
+    }
     // OIDC login does establish the issuer's Better Auth browser cookie. Record
     // that fact separately from the provider name so logout clears the cookie
     // and returns through the registered app origin. Stamped AFTER the adoption
@@ -5966,7 +6160,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-DA2dPFXt.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-DEchcb2r.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6008,7 +6202,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BGeNaoEY.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-DNZA1IJ9.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6021,7 +6215,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-BPkcFSQX.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-pI1JMr7g.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6046,7 +6240,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-BiWPelOD.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-CF1zahC4.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6108,7 +6302,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-BiWPelOD.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-CF1zahC4.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6279,7 +6473,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-BGeNaoEY.mjs');
+            await import('./injected-wallet-provider-DNZA1IJ9.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6382,7 +6576,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await import('./injected-wallet-provider-BGeNaoEY.mjs');
+    const { InjectedWalletProvider } = await import('./injected-wallet-provider-DNZA1IJ9.mjs');
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -6635,13 +6829,14 @@ var index = /*#__PURE__*/Object.freeze({
     WalletConfigError: WalletConfigError,
     clearIncompatibleSession: clearIncompatibleSession,
     completeLoginFromRedirect: completeLoginFromRedirect,
-    completeLoginInPopup: completeLoginInPopup,
+    completePendingLogin: completePendingLogin,
     ensureSharedWalletLoginReady: ensureSharedWalletLoginReady,
     ensureWalletLoginReady: ensureWalletLoginReady,
     getAuthProvider: getAuthProvider,
     getConfiguredSolanaNetwork: getConfiguredSolanaNetwork,
     getCurrentAuthMethod: getCurrentAuthMethod,
     getInitConfig: getInitConfig,
+    getLoginReturnError: getLoginReturnError,
     isEmailRequired: isEmailRequired,
     isWalletLoginDisabled: isWalletLoginDisabled,
     isWalletLoginEnabled: isWalletLoginEnabled,
@@ -6718,6 +6913,10 @@ let authLoadingListeners = [];
 let initCompleted = false;
 let isAuthLoading = false;
 let authReadyPromise = null;
+let initializingConfig = null;
+let initializationGeneration = 0;
+/** Internal guard for a login result arriving after the app reconfigured the SDK. */
+function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
 async function initialize(newConfig) {
@@ -6742,7 +6941,20 @@ async function initialize(newConfig) {
         // Get auth provider first
         authProviderInstance = await getAuthProvider(newConfig);
         // Initialize config with auth provider
-        await init$1(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
+        await init$2(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
+        // A return establishes its own provider/session, or hands off a popup.
+        // Restoring the old provider afterwards would overwrite the new login.
+        try {
+            if ((await completePendingLogin()).handled) {
+                initCompleted = true;
+                return;
+            }
+        }
+        catch (_a) {
+            // A cancelled/failed return is a login failure, not a broken SDK.
+            // The completion layer keeps it in getLoginReturnError(); restore
+            // any existing session and leave sign-in/readiness usable for retry.
+        }
         // Now that core is initialized, update the auth method on the config
         const authMethod = getCurrentAuthMethod();
         if (authMethod) {
@@ -6774,7 +6986,42 @@ async function initialize(newConfig) {
         setAuthLoading(false);
     }
 }
-function init(newConfig) {
+// Compare data options by value, but preserve identity for callbacks and class
+// instances such as providers. Comparing only app/endpoints would silently drop
+// a concurrent change to wallet policy or provider configuration.
+function sameConfigValue(a, b, seen = new WeakMap()) {
+    var _a;
+    if (Object.is(a, b))
+        return true;
+    if (!a || !b || typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    if (Array.isArray(a) && a.length !== b.length)
+        return false;
+    if (!Array.isArray(a)) {
+        for (const value of [a, b]) {
+            const prototype = Object.getPrototypeOf(value);
+            if (prototype !== null && ((_a = prototype.constructor) === null || _a === void 0 ? void 0 : _a.name) !== 'Object')
+                return false;
+        }
+    }
+    if (seen.has(a))
+        return seen.get(a) === b;
+    seen.set(a, b);
+    const left = Object.keys(a), right = Object.keys(b);
+    return left.length === right.length && left.every((key) => Object.prototype.hasOwnProperty.call(b, key)
+        && sameConfigValue(a[key], b[key], seen));
+}
+function init$1(newConfig) {
+    if (initializingConfig) {
+        if (sameConfigValue(initializingConfig, newConfig)) {
+            return authReadyPromise;
+        }
+        return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
+    }
+    initializingConfig = Object.assign({}, newConfig);
+    initializationGeneration++;
     let resolveReady;
     let rejectReady;
     const ready = new Promise((resolve, reject) => {
@@ -6785,7 +7032,7 @@ function init(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(newConfig).then(resolveReady, rejectReady);
+    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -6908,6 +7155,38 @@ function setAuthProviderInstance(provider) {
     authProviderInstance = provider;
 }
 
+/** The text OpenApps templates carried where an app id belongs. Never a real id. */
+const APP_ID_PLACEHOLDER = 'REPLACE_WITH_MAIN_APP_ID';
+const NETWORKS = new Set(['bounded', 'bounded-staging', 'bounded-production']);
+// Bounded hosting states which app a page is: `<meta name="bounded-app-id">`
+// and `<meta name="bounded-network">`, first in <head> of every page it serves,
+// so the first tag of each name is the host's (docs/app-identity.md). Outside a
+// browser there is no page to read.
+function pageMeta(name) {
+    var _a, _b;
+    if (typeof document === 'undefined' || typeof document.querySelector !== 'function')
+        return undefined;
+    const value = (_b = (_a = document.querySelector(`meta[name="${name}"]`)) === null || _a === void 0 ? void 0 : _a.getAttribute('content')) === null || _b === void 0 ? void 0 : _b.trim();
+    return value || undefined;
+}
+/**
+ * The configuration init() runs with. An explicit appId keeps the call exactly
+ * as written. Without one (or with the template placeholder), a page served by
+ * Bounded supplies its app id, and its network unless the call names one, so
+ * code in any framework can call init() without carrying an id in its source.
+ */
+function withHostedIdentity(config) {
+    if (config.appId && config.appId !== APP_ID_PLACEHOLDER)
+        return config;
+    const appId = pageMeta('bounded-app-id');
+    if (!appId || appId === APP_ID_PLACEHOLDER) {
+        throw new Error('No app ID provided. Pass init({ appId }), or serve this page from Bounded hosting, '
+            + 'which states it in <meta name="bounded-app-id">.');
+    }
+    const network = config.network === undefined ? pageMeta('bounded-network') : undefined;
+    return Object.assign(Object.assign(Object.assign({}, config), { appId }), (network && NETWORKS.has(network) ? { network: network } : {}));
+}
+
 // bounded-widget-ownership.ts - per-open ownership generation for the singleton
 // login/signing modal (bounded-widget-modal.ts).
 //
@@ -7512,7 +7791,7 @@ function runOtpFrame(run) {
 //     Backpack) via loginWithWallet(), run ENTIRELY on the app page (injected
 //     providers only exist there, never inside a cross-origin frame).
 //
-// Redirect stays available as the popup-blocked fallback (loginWithRedirect).
+// Mobile uses a full-page redirect; desktop keeps a popup with redirect fallback.
 // The same modal is reused for Turnkey wallet signing, so login -> first
 // signature is one continuous surface.
 // Palette + type ladder mirror the hosted auth page (login-page.ts): dark editorial
@@ -7755,6 +8034,16 @@ async function prepareAndOpen(opts, pending) {
     var _a, _b, _c, _d, _e, _f;
     // Imported lazily to avoid a static cycle with the auth index barrel.
     const authApi = await untilCancelled(Promise.resolve().then(function () { return index; }), pending);
+    const hostedLogin = (options) => {
+        if (detectMobile())
+            return authApi.loginWithRedirect(options);
+        // Invoke immediately inside the click handler to retain popup activation.
+        return authApi.loginWithPopup(options).catch((error) => {
+            if (shouldFallbackToRedirect(error))
+                return authApi.loginWithRedirect(options);
+            throw error;
+        });
+    };
     // BEFORE any side effect. Registering the mobile wallet from an empty config
     // would take the chainless mainnet default, and that registration cannot be
     // withdrawn - so opening the widget before init() would pin the page to the
@@ -7848,6 +8137,7 @@ async function prepareAndOpen(opts, pending) {
     // asserts rather than fixing a bug - which is exactly why it is worth keeping.
     pendingOpens.delete(pending);
     return new Promise((resolve, reject) => {
+        var _a;
         // Per-open ownership generation (DS3-0402): a later open bumps the modal's
         // generation, so this open's token stops matching and all of its callbacks
         // (backdrop, success, cancel, and the async view swap) no-op instead of
@@ -8066,23 +8356,20 @@ async function prepareAndOpen(opts, pending) {
                         loginHint: input.value,
                         redirectUri: opts.redirectUri,
                     };
-                    authApi
+                    hostedLogin(emailOpts)
                         // A hosted login that RESOLVES minted a real session, so it settles
                         // the card even if another lane has since taken it - dropping it
                         // would leave the app signed in behind a widget that says it is not.
                         // Only the failure path belongs to one attempt's UI.
-                        .loginWithPopup(emailOpts)
-                        .then((u) => { settleAttempt(attempt); succeed(u); })
-                        .catch((err) => {
-                        // Popup unavailable: same-tab redirect instead. It resolves with
-                        // nothing when it is about to navigate, so the only thing that
-                        // comes back here is a REJECTION - which must still reach the
-                        // handler below, or the lane stays locked with nothing running.
-                        if (shouldFallbackToRedirect(err)) {
-                            return authApi.loginWithRedirect(emailOpts).then((u) => { if (u)
-                                succeed(u); });
+                        .then((u) => {
+                        if (u) {
+                            settleAttempt(attempt);
+                            succeed(u);
+                        }
+                        else if (settleAttempt(attempt)) {
+                            submit.disabled = false;
+                            submit.textContent = "Continue";
                         }
-                        throw err;
                     })
                         .catch((err) => {
                         if (!settleAttempt(attempt))
@@ -8119,15 +8406,16 @@ async function prepareAndOpen(opts, pending) {
                     }
                     setBusy(b, "Opening secure sign-in\u2026");
                     const socialOpts = { provider: method, redirectUri: opts.redirectUri };
-                    authApi
-                        .loginWithPopup(socialOpts)
-                        .then((u) => { settleAttempt(attempt); succeed(u); })
-                        .catch((err) => {
-                        if (shouldFallbackToRedirect(err)) {
-                            return authApi.loginWithRedirect(socialOpts).then((u) => { if (u)
-                                succeed(u); });
+                    hostedLogin(socialOpts)
+                        .then((u) => {
+                        if (u) {
+                            settleAttempt(attempt);
+                            succeed(u);
+                        }
+                        else if (settleAttempt(attempt)) {
+                            b.disabled = false;
+                            setLabel(b, method);
                         }
-                        throw err;
                     })
                         .catch((err) => {
                         if (!settleAttempt(attempt))
@@ -8391,7 +8679,7 @@ async function prepareAndOpen(opts, pending) {
                     fitPanelToContent(m);
             });
         };
-        swap(renderChoose());
+        swap(renderChoose((_a = authApi.getLoginReturnError()) === null || _a === void 0 ? void 0 : _a.message));
         showModal(m);
     });
 }
@@ -10685,5 +10973,21 @@ async function connectServiceSession(ticket, options) {
     }
 }
 
-export { onrampStatus as $, getAuthProvider as A, signInAnonymously as B, loginWithPrivy as C, loginWithWallet as D, ensureWalletLoginReady as E, ensureSharedWalletLoginReady as F, preloadWalletLogin as G, loginWithRedirect as H, completeLoginFromRedirect as I, loginWithPopup as J, completeLoginInPopup as K, openBoundedWidget as L, ensureSignedIn as M, useAuth as N, useQuery as O, useBuildRun as P, apps as Q, signSolanaMessageViaTurnkey as R, getOrCreateTurnkeyWallet as S, openTurnkeyKeyExport as T, getTurnkeyWalletSessionState as U, getTurnkeyWalletRecoveryUrl as V, WalletConfigError as W, startTurnkeyEmailLogin as X, getIdToken as Y, onramp as Z, onrampQuote as _, signMessageWithTurnkey as a, setPlatform as a0, OffchainAuthProvider as a1, PrivyExpoProvider as a2, requestEip6963Providers as a3, connectBroadcast as a4, connectServiceSession as a5, builds as a6, BuildsApiError as a7, mediaAgentTools as a8, NON_TERMINAL_STATES as a9, TERMINAL_STATES as aa, RUN_STATES as ab, PARK_REASONS as ac, FAILURE_REASONS as ad, BUILD_REVIEW_CAPABILITY_SCHEMA as ae, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as af, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as ag, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, defaultInjectedProvider as f, getPlatform as g, hasTurnkeyWallet as h, firstStandardWalletProvider as i, setAuthLoading as j, bufferExports as k, setStoredAuthMethod as l, confirmAndCheckTransaction as m, normalizeSolanaRpcUrl as n, defaultInjectedEvmProvider as o, init as p, getCurrentUser as q, resolveSolanaRpcUrl as r, setCurrentUser as s, transactionHasSignature as t, onAuthStateChanged as u, onAuthLoadingChanged as v, getAuthLoading as w, waitForAuthReady as x, login as y, logout as z };
-//# sourceMappingURL=index-DKkAO0g-.mjs.map
+/**
+ * Initialize the SDK. A page served by Bounded already states which app it is,
+ * so `init()` there needs no `appId`; pass one to run anywhere else (another
+ * host, local development). An explicit `appId` is used exactly as given.
+ */
+function init(config = {}) {
+    let resolved;
+    try {
+        resolved = withHostedIdentity(config);
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    return init$1(resolved);
+}
+
+export { onrampStatus as $, getAuthProvider as A, signInAnonymously as B, loginWithPrivy as C, loginWithWallet as D, ensureWalletLoginReady as E, ensureSharedWalletLoginReady as F, preloadWalletLogin as G, loginWithRedirect as H, completeLoginFromRedirect as I, getLoginReturnError as J, loginWithPopup as K, openBoundedWidget as L, ensureSignedIn as M, useAuth as N, useQuery as O, useBuildRun as P, apps as Q, signSolanaMessageViaTurnkey as R, getOrCreateTurnkeyWallet as S, openTurnkeyKeyExport as T, getTurnkeyWalletSessionState as U, getTurnkeyWalletRecoveryUrl as V, WalletConfigError as W, startTurnkeyEmailLogin as X, getIdToken as Y, onramp as Z, onrampQuote as _, signMessageWithTurnkey as a, setPlatform as a0, OffchainAuthProvider as a1, PrivyExpoProvider as a2, requestEip6963Providers as a3, connectBroadcast as a4, connectServiceSession as a5, builds as a6, BuildsApiError as a7, mediaAgentTools as a8, NON_TERMINAL_STATES as a9, TERMINAL_STATES as aa, RUN_STATES as ab, PARK_REASONS as ac, FAILURE_REASONS as ad, BUILD_REVIEW_CAPABILITY_SCHEMA as ae, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as af, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as ag, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, defaultInjectedProvider as f, getPlatform as g, hasTurnkeyWallet as h, firstStandardWalletProvider as i, setAuthLoading as j, bufferExports as k, setStoredAuthMethod as l, confirmAndCheckTransaction as m, normalizeSolanaRpcUrl as n, defaultInjectedEvmProvider as o, init as p, getCurrentUser as q, resolveSolanaRpcUrl as r, setCurrentUser as s, transactionHasSignature as t, onAuthStateChanged as u, onAuthLoadingChanged as v, getAuthLoading as w, waitForAuthReady as x, login as y, logout as z };
+//# sourceMappingURL=index-nVYK3QUO.mjs.map