@bounded-sh/client 0.0.104 → 0.0.106

package/dist/{index-DTBxbfUl.js → index-ok-Nn6DV.js}

@@ -211,6 +211,36 @@ function setPlatform(adapter) {
 function getPlatform() {
     return _platform;
 }
+// ---------------------------------------------------------------------------
+// Mobile / Android detection helpers
+// ---------------------------------------------------------------------------
+/**
+ * Detect mobile device even when Chrome "Request Desktop Site" is active.
+ *
+ * Desktop mode on Android strips "Android" and "Mobile" from the UA, leaving
+ * something like "Linux x86_64 …". The fallback detects this by looking for
+ * touch capability + small viewport + a UA that doesn't belong to a known
+ * desktop OS (ChromeOS, Windows, macOS).
+ */
+function detectMobile() {
+    const ua = _platform.getUserAgent();
+    if (/Android|iPhone|iPad|iPod/i.test(ua))
+        return true;
+    if (typeof navigator !== 'undefined' && typeof window !== 'undefined') {
+        const hasTouch = navigator.maxTouchPoints > 0;
+        // Macs don't have touch screens, so "Macintosh" + touch = iOS desktop mode
+        // (also catches iPadOS 13+ which always reports as Macintosh)
+        if (/Macintosh/i.test(ua) && hasTouch)
+            return true;
+        // Android desktop mode: Linux UA + touch + small viewport, excluding
+        // known desktop OSes (ChromeOS, Windows, macOS)
+        const isSmallViewport = window.innerWidth <= 1024;
+        const isDesktopOS = /CrOS|Windows|Macintosh/i.test(ua);
+        if (hasTouch && isSmallViewport && !isDesktopOS)
+            return true;
+    }
+    return false;
+}
 
 /**
  * OffchainAuthProvider wraps a real auth provider (Turnkey, Phantom, ...) for the
@@ -5037,9 +5067,18 @@ const OIDC_NO_WALLET = 'This session has no Turnkey wallet. Sign in again to pro
 // same tab (redirect + popup, or two popups) each own a distinct record, so a second
 // attempt cannot clobber the first's verifier/state/redirectUri.
 const PKCE_STORE_PREFIX = 'bounded.oidc.pkce';
+const STATE_PREFIX = 'bounded.';
+const LOGIN_TIMEOUT_MS = 10 * 60000;
+const CALLBACK_PARAMS = ['code', 'state', 'error', 'error_description', 'iss'];
 function pkceKey(state) {
     return `${PKCE_STORE_PREFIX}.${state}`;
 }
+function removeAttempt(state) {
+    try {
+        sessionStorage.removeItem(pkceKey(state));
+    }
+    catch ( /* Storage may have been disabled mid-login. */_a) { /* Storage may have been disabled mid-login. */ }
+}
 const ISSUER_SESSION_KIND_KEY = 'bounded_issuer_session_kind';
 // Active session store (Web on web, RN on React Native) — selected by config,
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
@@ -5148,6 +5187,165 @@ async function makePkce() {
 function randomState() {
     return b64url(getPlatform().getRandomBytes(16));
 }
+let pendingCompletion;
+let loginReturnError;
+/** The last OAuth return failure in this initialization, or null. Initialization
+ * remains usable so the UI can display this error and offer a fresh sign-in. */
+function getLoginReturnError() {
+    return (loginReturnError === null || loginReturnError === void 0 ? void 0 : loginReturnError.generation) === getInitializationGeneration() ? loginReturnError.error : null;
+}
+// A hosted page can contain both an app bundle and the platform widget's SDK.
+// They share one code exchange, while adopting the session in their own registries.
+const COMPLETIONS = Symbol.for('bounded.oidc.completions');
+function cleanCallbackUrl(url) {
+    const clean = new URL(url);
+    for (const key of CALLBACK_PARAMS)
+        clean.searchParams.delete(key);
+    return clean;
+}
+async function validateAttempt(pkce, callback) {
+    const cfg = await core.getConfig();
+    if (!pkce || typeof pkce.verifier !== 'string' || !pkce.verifier ||
+        pkce.appId !== cfg.appId || pkce.issuer !== await issuerBase()) {
+        throw new Error('Login belongs to a different app or auth server. Start sign-in again.');
+    }
+    if (!Number.isFinite(pkce.createdAt) || Date.now() - pkce.createdAt > LOGIN_TIMEOUT_MS || pkce.createdAt > Date.now()) {
+        throw new Error('Login expired. Start sign-in again.');
+    }
+    if (callback && (cleanCallbackUrl(callback).href !== cleanCallbackUrl(new URL(pkce.redirectUri)).href ||
+        (callback.searchParams.has('iss') && callback.searchParams.get('iss') !== pkce.issuer))) {
+        throw new Error('Login returned to a different address or from a different auth server. Start sign-in again.');
+    }
+}
+// The receiver acknowledges only after checking origin, window and state. An
+// absent/disconnected opener must never leave a popup claiming success.
+async function handOffPopup(url, state) {
+    const cfg = await core.getConfig();
+    const issuer = await issuerBase();
+    const opener = window.opener;
+    if (!opener || opener === window || opener.closed) {
+        throw new Error('The original sign-in window is unavailable. Close this window and sign in again in the original tab.');
+    }
+    return new Promise((resolve, reject) => {
+        const cleanup = () => { clearTimeout(timer); window.removeEventListener('message', onMessage); };
+        const onMessage = (event) => {
+            var _a;
+            if (event.source !== opener || event.origin !== url.origin ||
+                ((_a = event.data) === null || _a === void 0 ? void 0 : _a.type) !== 'bounded-oidc-accepted' || event.data.state !== state)
+                return;
+            cleanup();
+            try {
+                window.close();
+            }
+            catch ( /* The opener also closes its own popup handle. */_b) { /* The opener also closes its own popup handle. */ }
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error('Could not reach the original sign-in tab. Close this window and start sign-in again.'));
+        }, 10000);
+        window.addEventListener('message', onMessage);
+        try {
+            opener.postMessage({ type: 'bounded-oidc-code', state, code: url.searchParams.get('code'),
+                error: url.searchParams.get('error'), errorDescription: url.searchParams.get('error_description'),
+                callbackUrl: url.href, appId: cfg.appId, issuer }, url.origin);
+        }
+        catch (error) {
+            cleanup();
+            reject(error);
+        }
+    });
+}
+async function finishLoginReturn(url, state) {
+    try {
+        if (!/^bounded\.(popup|redirect)\.[A-Za-z0-9_-]{22}$/.test(state)) {
+            throw new Error('Invalid login state. Start sign-in again.');
+        }
+        if (state.startsWith('bounded.popup.')) {
+            await handOffPopup(url, state);
+            return { handled: true, user: null };
+        }
+        const raw = sessionStorage.getItem(pkceKey(state));
+        if (!raw)
+            throw new Error('Missing login attempt. Start sign-in again in this tab.');
+        const pkce = JSON.parse(raw);
+        if (pkce.state !== state)
+            throw new Error('OAuth state mismatch. Start sign-in again.');
+        await validateAttempt(pkce, url);
+        const error = url.searchParams.get('error');
+        if (error)
+            throw new Error(url.searchParams.get('error_description') || `Login failed: ${error}`);
+        const user = await exchangeCode(url.searchParams.get('code'), pkce);
+        return { handled: true, user, idToken: sessionManager().getIdToken() };
+    }
+    finally {
+        removeAttempt(state);
+        const clean = cleanCallbackUrl(url);
+        if (window.location.href === url.href) {
+            window.history.replaceState(window.history.state, document.title, clean.pathname + clean.search + clean.hash);
+        }
+    }
+}
+/** Internal initialization step. Unrelated OAuth callbacks are left untouched. */
+function completePendingLogin() {
+    if (!hasDOM$2())
+        return Promise.resolve({ handled: false, user: null });
+    const url = new URL(window.location.href);
+    const state = url.searchParams.get('state');
+    if (!(state === null || state === void 0 ? void 0 : state.startsWith(STATE_PREFIX)) || (!url.searchParams.get('code') && !url.searchParams.get('error'))) {
+        return Promise.resolve({ handled: false, user: null });
+    }
+    const generation = getInitializationGeneration();
+    if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.href) === url.href && pendingCompletion.generation === generation)
+        return pendingCompletion.promise;
+    const promise = finishSharedLoginReturn(url, state).catch((error) => {
+        loginReturnError = { generation, error: error instanceof Error ? error : new Error(String(error)) };
+        throw loginReturnError.error;
+    }).finally(() => {
+        if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.promise) === promise)
+            pendingCompletion = undefined;
+    });
+    pendingCompletion = { href: url.href, generation, promise };
+    return promise;
+}
+async function finishSharedLoginReturn(url, state) {
+    var _a;
+    var _b;
+    const cfg = await core.getConfig();
+    const issuer = await issuerBase();
+    if (state.startsWith('bounded.redirect.')) {
+        const raw = sessionStorage.getItem(pkceKey(state));
+        // A second SDK configured for another app/issuer on this page does not own
+        // this return. Leave its URL and proof available to the initiating app.
+        try {
+            const attempt = raw && JSON.parse(raw);
+            if (attempt && (attempt.appId !== cfg.appId || attempt.issuer !== issuer))
+                return { handled: false, user: null };
+        }
+        catch ( /* The owning completion reports malformed attempt data. */_c) { /* The owning completion reports malformed attempt data. */ }
+    }
+    const shared = (_a = (_b = window)[COMPLETIONS]) !== null && _a !== void 0 ? _a : (_b[COMPLETIONS] = new Map());
+    const key = JSON.stringify([url.href, cfg.appId, issuer]);
+    const existing = shared.get(key);
+    if (!existing) {
+        const completion = finishLoginReturn(url, state);
+        shared.set(key, completion);
+        return completion;
+    }
+    const generation = getInitializationGeneration();
+    const result = await existing;
+    if (result.user) {
+        if (!result.idToken || sessionManager().getIdToken() !== result.idToken) {
+            throw new Error('The completed login session has changed. Start sign-in again.');
+        }
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc',
+            user: Object.assign(Object.assign({}, result.user), { provider: oidcProviderSingleton }), beforeCommit: () => {
+                if (generation !== getInitializationGeneration())
+                    throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+            } });
+    }
+    return result;
+}
 function normalizeMethod(value) {
     const normalized = String(value || '').trim().toLowerCase();
     return /^[a-z0-9_-]{1,40}$/.test(normalized) ? normalized : null;
@@ -5190,7 +5388,8 @@ function appendHostedLoginHints(params, opts) {
 // native (expo-web-browser) path. The caller decides where the PkceState lives
 // (web → sessionStorage across the full-page redirect; native → in-memory across
 // the awaited browser session).
-async function buildAuthorize(opts) {
+async function buildAuthorize(opts, mode = 'redirect') {
+    loginReturnError = undefined;
     const cfg = await core.getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
@@ -5199,15 +5398,23 @@ async function buildAuthorize(opts) {
     const redirectUri = opts.redirectUri || (hasDOM$2() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
+    if (hasDOM$2()) {
+        const redirect = new URL(redirectUri);
+        if (redirect.origin !== window.location.origin || redirect.hash || CALLBACK_PARAMS.some((key) => redirect.searchParams.has(key))) {
+            throw new Error('redirectUri must be on this app origin, without a fragment or OAuth callback parameters.');
+        }
+    }
     const { verifier, challenge } = await makePkce();
-    const state = randomState();
+    const state = `${STATE_PREFIX}${mode}.${randomState()}`;
     const base = await issuerBase();
     const params = new URLSearchParams({
         client_id: cfg.appId, redirect_uri: redirectUri, response_type: 'code', scope: 'openid profile email',
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
+    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: {
+            verifier, state, redirectUri, appId: cfg.appId, issuer: base, createdAt: Date.now(),
+        } };
 }
 // Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
 // expo-web-browser driver vs. the web full-page-redirect/popup driver.
@@ -5256,8 +5463,7 @@ function parseCallbackParams(callbackUrl) {
 }
 // Full native login: open the hosted page in the system auth session, await the
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
-// as web. Returns the signed-in User (native completes inline — there's no separate
-// completeLoginFromRedirect() round-trip the way the web full-page redirect needs).
+// as web. Returns the signed-in User inline; web redirects complete on the next init().
 async function runNativeLogin(opts) {
     var _a, _b;
     const { url, pkce } = await buildAuthorize(opts);
@@ -5284,7 +5490,7 @@ async function runNativeLogin(opts) {
         if (!returnedState || returnedState !== pkce.state) {
             throw new Error('OAuth state mismatch — possible CSRF; aborting');
         }
-        return await exchangeCode(code, pkce.verifier, pkce.redirectUri);
+        return await exchangeCode(code, pkce);
     }
     finally {
         setAuthLoading(false);
@@ -5293,7 +5499,7 @@ async function runNativeLogin(opts) {
 /** Start hosted login (Google / Apple / email / hosted phone). Works on WEB and REACT NATIVE.
  *
  *  WEB: navigates the whole page to the hosted Bounded login and resolves (void) as the page
- *  unloads; on return to `redirectUri?code=...` you call completeLoginFromRedirect().
+ *  unloads; init() completes the return to redirectUri automatically.
  *
  *  REACT NATIVE: opens the hosted page via expo-web-browser, awaits the https universal-link
  *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
@@ -5311,63 +5517,32 @@ async function loginWithRedirect(opts) {
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
     sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
-    setAuthLoading(true); // reflect "signing in…" right up to navigation; the return page's
-    window.location.href = url; // completeLoginFromRedirect() keeps it true until the user resolves.
-}
-/** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
- *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
- *
- *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
- *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
- *  page to finish from. Calling it on RN is harmless. */
-async function completeLoginFromRedirect() {
-    if (!hasDOM$2())
-        return null;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const returnedState = url.searchParams.get('state');
-    if (!code)
-        return null;
-    // POPUP path: if we're the redirect_uri page running INSIDE the loginWithPopup() window,
-    // hand the code to the opener and close — no separate completeLoginInPopup() call needed.
-    // The opener is the same app/origin, so post to our own origin (the opener's message
-    // handler checks ev.origin === redirect_uri origin). One call now finishes BOTH flows.
-    if (window.opener && window.opener !== window) {
-        try {
-            window.opener.postMessage({ type: 'bounded-oidc-code', code, state: returnedState }, window.location.origin);
-        }
-        catch ( /* ignore */_a) { /* ignore */ }
-        try {
-            window.close();
-        }
-        catch ( /* ignore */_b) { /* ignore */ }
-        return null;
-    }
+    // This promise represents dispatch, not authentication on the next page.
+    // Browsers can cancel navigation (for example at beforeunload) without firing
+    // pageshow. Never leave this document's SDK loading after dispatch settles.
     setAuthLoading(true);
     try {
-        // Read back the exact record THIS attempt wrote, keyed by the state the issuer
-        // returned, so a concurrent login's record is never consumed by mistake.
-        const raw = returnedState ? sessionStorage.getItem(pkceKey(returnedState)) : null;
-        if (!raw)
-            throw new Error('Missing PKCE state — start login with loginWithRedirect()');
-        const pkce = JSON.parse(raw);
-        if (!returnedState || returnedState !== pkce.state)
-            throw new Error('OAuth state mismatch — possible CSRF; aborting');
-        const user = await exchangeCode(code, pkce.verifier, pkce.redirectUri);
-        sessionStorage.removeItem(pkceKey(returnedState));
-        // Strip code/state from the URL so a reload doesn't re-exchange (codes are single-use anyway).
-        url.searchParams.delete('code');
-        url.searchParams.delete('state');
-        window.history.replaceState({}, document.title, url.pathname + url.search + url.hash);
-        return user;
+        window.location.href = url;
+    }
+    catch (error) {
+        removeAttempt(pkce.state);
+        throw error;
     }
     finally {
         setAuthLoading(false);
     }
 }
+/** Optional explicit completion. Normal apps only await init(), which already finishes login.
+ * Concurrent calls share one exchange. Returns null when no Bounded return is present. */
+async function completeLoginFromRedirect() {
+    const result = await completePendingLogin();
+    const error = getLoginReturnError();
+    if (error)
+        throw error;
+    return result.user;
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
- *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
+ *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
     if (!hasDOM$2())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
@@ -5386,7 +5561,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts);
+        authorization = await buildAuthorize(opts, 'popup');
     }
     catch (error) {
         try {
@@ -5421,6 +5596,7 @@ async function loginWithPopup(opts) {
             popup.location.href = url;
         }
         catch (_d) {
+            removeAttempt(pkce.state);
             try {
                 popup.close();
             }
@@ -5436,17 +5612,21 @@ async function loginWithPopup(opts) {
             let settled = false;
             let timer;
             let navigationTimer;
+            let completionTimer;
             const cleanup = () => {
                 settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
+                clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
+                removeAttempt(pkce.state);
             };
             const onMsg = async (ev) => {
-                if (ev.origin !== expectedOrigin)
-                    return; // only trust the redirect_uri origin
+                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                    return;
                 const d = ev.data;
-                if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
+                if (!d || d.type !== 'bounded-oidc-code' ||
+                    (typeof d.code !== 'string' && typeof d.error !== 'string'))
                     return;
                 // Validate state BEFORE tearing down this listener, against the record THIS
                 // attempt captured in the closure (`pkce`), not a shared sessionStorage reread.
@@ -5454,10 +5634,15 @@ async function loginWithPopup(opts) {
                 // stay registered for our own code, instead of cleaning up on another's message.
                 if (d.state !== pkce.state)
                     return;
+                if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
+                    return;
                 cleanup();
                 try {
-                    const user = await exchangeCode(d.code, pkce.verifier, pkce.redirectUri);
-                    sessionStorage.removeItem(pkceKey(pkce.state));
+                    await validateAttempt(pkce, new URL(d.callbackUrl));
+                    popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
+                    if (d.error)
+                        throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
+                    const user = await exchangeCode(d.code, pkce);
                     try {
                         popup.close();
                     }
@@ -5465,10 +5650,22 @@ async function loginWithPopup(opts) {
                     resolve(user);
                 }
                 catch (e) {
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
                     reject(e);
                 }
             };
             window.addEventListener('message', onMsg);
+            completionTimer = setTimeout(() => {
+                cleanup();
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_a) { /* ignore */ }
+                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+            }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
             // authorize URL. The old code then waited forever because the popup was
@@ -5526,25 +5723,6 @@ async function loginWithPopup(opts) {
         setAuthLoading(false);
     }
 }
-/** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
- *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
-function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$2() || !window.opener)
-        return;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const state = url.searchParams.get('state');
-    if (!code)
-        return;
-    try {
-        window.opener.postMessage({ type: 'bounded-oidc-code', code, state }, openerOrigin);
-    }
-    catch ( /* ignore */_a) { /* ignore */ }
-    try {
-        window.close();
-    }
-    catch ( /* ignore */_b) { /* ignore */ }
-}
 // Establish a Bounded session from a server-minted inline-session response (the same
 // { idToken, accessToken, refreshToken } shape as /session/refresh). Used by the
 // Turnkey-native login path (authMode:"turnkey"), which mints the session server-side
@@ -5587,14 +5765,20 @@ async function inlineAuthEndpoint() {
     const cfg = await core.getConfig();
     return { base: await issuerBase(), appId: cfg.appId };
 }
-async function exchangeCode(code, verifier, redirectUri) {
-    const cfg = await core.getConfig();
-    const base = await issuerBase();
+async function exchangeCode(code, pkce) {
+    const generation = getInitializationGeneration();
+    const beforeCommit = () => {
+        if (generation !== getInitializationGeneration())
+            throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+    };
+    await validateAttempt(pkce);
+    beforeCommit();
+    const base = pkce.issuer;
     // OIDC token endpoint: application/x-www-form-urlencoded (the standard). Public client (no
     // secret) authenticated by PKCE. The code is single-use + short-TTL on the server.
     const body = new URLSearchParams({
-        grant_type: 'authorization_code', code, redirect_uri: redirectUri,
-        client_id: cfg.appId, code_verifier: verifier,
+        grant_type: 'authorization_code', code, redirect_uri: pkce.redirectUri,
+        client_id: pkce.appId, code_verifier: pkce.verifier,
     });
     let res;
     try {
@@ -5618,10 +5802,20 @@ async function exchangeCode(code, verifier, redirectUri) {
     const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
     const refreshToken = boundedRefreshTokenField(data);
     const user = userFromIdToken(idToken);
-    await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base);
+    // Reinitialization while the request was in flight must not install this
+    // app's result under a different app's session manager/configuration.
+    beforeCommit();
+    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, beforeCommit);
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
-    await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user });
+    try {
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+    }
+    catch (error) {
+        if (typeof rollback === 'function')
+            await rollback();
+        throw error;
+    }
     // OIDC login does establish the issuer's Better Auth browser cookie. Record
     // that fact separately from the provider name so logout clears the cookie
     // and returns through the registered app origin. Stamped AFTER the adoption
@@ -5987,7 +6181,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-aMa0EDuc.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-C_0SoVG4.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6029,7 +6223,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-oWtACL_7.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CEtgcsQl.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6042,7 +6236,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-B8PWHQdb.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-C3Z2c4Yl.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6067,7 +6261,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Ca50pehK.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DPZRPch_.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6129,7 +6323,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Ca50pehK.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DPZRPch_.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6300,7 +6494,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-oWtACL_7.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-CEtgcsQl.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6403,7 +6597,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-oWtACL_7.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CEtgcsQl.js'); });
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -6656,13 +6850,14 @@ var index = /*#__PURE__*/Object.freeze({
     WalletConfigError: WalletConfigError,
     clearIncompatibleSession: clearIncompatibleSession,
     completeLoginFromRedirect: completeLoginFromRedirect,
-    completeLoginInPopup: completeLoginInPopup,
+    completePendingLogin: completePendingLogin,
     ensureSharedWalletLoginReady: ensureSharedWalletLoginReady,
     ensureWalletLoginReady: ensureWalletLoginReady,
     getAuthProvider: getAuthProvider,
     getConfiguredSolanaNetwork: getConfiguredSolanaNetwork,
     getCurrentAuthMethod: getCurrentAuthMethod,
     getInitConfig: getInitConfig,
+    getLoginReturnError: getLoginReturnError,
     isEmailRequired: isEmailRequired,
     isWalletLoginDisabled: isWalletLoginDisabled,
     isWalletLoginEnabled: isWalletLoginEnabled,
@@ -6739,6 +6934,10 @@ let authLoadingListeners = [];
 let initCompleted = false;
 let isAuthLoading = false;
 let authReadyPromise = null;
+let initializingConfig = null;
+let initializationGeneration = 0;
+/** Internal guard for a login result arriving after the app reconfigured the SDK. */
+function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
 async function initialize(newConfig) {
@@ -6764,6 +6963,19 @@ async function initialize(newConfig) {
         authProviderInstance = await getAuthProvider(newConfig);
         // Initialize config with auth provider
         await core.init(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
+        // A return establishes its own provider/session, or hands off a popup.
+        // Restoring the old provider afterwards would overwrite the new login.
+        try {
+            if ((await completePendingLogin()).handled) {
+                initCompleted = true;
+                return;
+            }
+        }
+        catch (_a) {
+            // A cancelled/failed return is a login failure, not a broken SDK.
+            // The completion layer keeps it in getLoginReturnError(); restore
+            // any existing session and leave sign-in/readiness usable for retry.
+        }
         // Now that core is initialized, update the auth method on the config
         const authMethod = getCurrentAuthMethod();
         if (authMethod) {
@@ -6795,7 +7007,42 @@ async function initialize(newConfig) {
         setAuthLoading(false);
     }
 }
-function init(newConfig) {
+// Compare data options by value, but preserve identity for callbacks and class
+// instances such as providers. Comparing only app/endpoints would silently drop
+// a concurrent change to wallet policy or provider configuration.
+function sameConfigValue(a, b, seen = new WeakMap()) {
+    var _a;
+    if (Object.is(a, b))
+        return true;
+    if (!a || !b || typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    if (Array.isArray(a) && a.length !== b.length)
+        return false;
+    if (!Array.isArray(a)) {
+        for (const value of [a, b]) {
+            const prototype = Object.getPrototypeOf(value);
+            if (prototype !== null && ((_a = prototype.constructor) === null || _a === void 0 ? void 0 : _a.name) !== 'Object')
+                return false;
+        }
+    }
+    if (seen.has(a))
+        return seen.get(a) === b;
+    seen.set(a, b);
+    const left = Object.keys(a), right = Object.keys(b);
+    return left.length === right.length && left.every((key) => Object.prototype.hasOwnProperty.call(b, key)
+        && sameConfigValue(a[key], b[key], seen));
+}
+function init$1(newConfig) {
+    if (initializingConfig) {
+        if (sameConfigValue(initializingConfig, newConfig)) {
+            return authReadyPromise;
+        }
+        return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
+    }
+    initializingConfig = Object.assign({}, newConfig);
+    initializationGeneration++;
     let resolveReady;
     let rejectReady;
     const ready = new Promise((resolve, reject) => {
@@ -6806,7 +7053,7 @@ function init(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(newConfig).then(resolveReady, rejectReady);
+    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -6929,6 +7176,38 @@ function setAuthProviderInstance(provider) {
     authProviderInstance = provider;
 }
 
+/** The text OpenApps templates carried where an app id belongs. Never a real id. */
+const APP_ID_PLACEHOLDER = 'REPLACE_WITH_MAIN_APP_ID';
+const NETWORKS = new Set(['bounded', 'bounded-staging', 'bounded-production']);
+// Bounded hosting states which app a page is: `<meta name="bounded-app-id">`
+// and `<meta name="bounded-network">`, first in <head> of every page it serves,
+// so the first tag of each name is the host's (docs/app-identity.md). Outside a
+// browser there is no page to read.
+function pageMeta(name) {
+    var _a, _b;
+    if (typeof document === 'undefined' || typeof document.querySelector !== 'function')
+        return undefined;
+    const value = (_b = (_a = document.querySelector(`meta[name="${name}"]`)) === null || _a === void 0 ? void 0 : _a.getAttribute('content')) === null || _b === void 0 ? void 0 : _b.trim();
+    return value || undefined;
+}
+/**
+ * The configuration init() runs with. An explicit appId keeps the call exactly
+ * as written. Without one (or with the template placeholder), a page served by
+ * Bounded supplies its app id, and its network unless the call names one, so
+ * code in any framework can call init() without carrying an id in its source.
+ */
+function withHostedIdentity(config) {
+    if (config.appId && config.appId !== APP_ID_PLACEHOLDER)
+        return config;
+    const appId = pageMeta('bounded-app-id');
+    if (!appId || appId === APP_ID_PLACEHOLDER) {
+        throw new Error('No app ID provided. Pass init({ appId }), or serve this page from Bounded hosting, '
+            + 'which states it in <meta name="bounded-app-id">.');
+    }
+    const network = config.network === undefined ? pageMeta('bounded-network') : undefined;
+    return Object.assign(Object.assign(Object.assign({}, config), { appId }), (network && NETWORKS.has(network) ? { network: network } : {}));
+}
+
 // bounded-widget-ownership.ts - per-open ownership generation for the singleton
 // login/signing modal (bounded-widget-modal.ts).
 //
@@ -7533,7 +7812,7 @@ function runOtpFrame(run) {
 //     Backpack) via loginWithWallet(), run ENTIRELY on the app page (injected
 //     providers only exist there, never inside a cross-origin frame).
 //
-// Redirect stays available as the popup-blocked fallback (loginWithRedirect).
+// Mobile uses a full-page redirect; desktop keeps a popup with redirect fallback.
 // The same modal is reused for Turnkey wallet signing, so login -> first
 // signature is one continuous surface.
 // Palette + type ladder mirror the hosted auth page (login-page.ts): dark editorial
@@ -7776,6 +8055,16 @@ async function prepareAndOpen(opts, pending) {
     var _a, _b, _c, _d, _e, _f;
     // Imported lazily to avoid a static cycle with the auth index barrel.
     const authApi = await untilCancelled(Promise.resolve().then(function () { return index; }), pending);
+    const hostedLogin = (options) => {
+        if (detectMobile())
+            return authApi.loginWithRedirect(options);
+        // Invoke immediately inside the click handler to retain popup activation.
+        return authApi.loginWithPopup(options).catch((error) => {
+            if (shouldFallbackToRedirect(error))
+                return authApi.loginWithRedirect(options);
+            throw error;
+        });
+    };
     // BEFORE any side effect. Registering the mobile wallet from an empty config
     // would take the chainless mainnet default, and that registration cannot be
     // withdrawn - so opening the widget before init() would pin the page to the
@@ -7869,6 +8158,7 @@ async function prepareAndOpen(opts, pending) {
     // asserts rather than fixing a bug - which is exactly why it is worth keeping.
     pendingOpens.delete(pending);
     return new Promise((resolve, reject) => {
+        var _a;
         // Per-open ownership generation (DS3-0402): a later open bumps the modal's
         // generation, so this open's token stops matching and all of its callbacks
         // (backdrop, success, cancel, and the async view swap) no-op instead of
@@ -8087,23 +8377,20 @@ async function prepareAndOpen(opts, pending) {
                         loginHint: input.value,
                         redirectUri: opts.redirectUri,
                     };
-                    authApi
+                    hostedLogin(emailOpts)
                         // A hosted login that RESOLVES minted a real session, so it settles
                         // the card even if another lane has since taken it - dropping it
                         // would leave the app signed in behind a widget that says it is not.
                         // Only the failure path belongs to one attempt's UI.
-                        .loginWithPopup(emailOpts)
-                        .then((u) => { settleAttempt(attempt); succeed(u); })
-                        .catch((err) => {
-                        // Popup unavailable: same-tab redirect instead. It resolves with
-                        // nothing when it is about to navigate, so the only thing that
-                        // comes back here is a REJECTION - which must still reach the
-                        // handler below, or the lane stays locked with nothing running.
-                        if (shouldFallbackToRedirect(err)) {
-                            return authApi.loginWithRedirect(emailOpts).then((u) => { if (u)
-                                succeed(u); });
+                        .then((u) => {
+                        if (u) {
+                            settleAttempt(attempt);
+                            succeed(u);
+                        }
+                        else if (settleAttempt(attempt)) {
+                            submit.disabled = false;
+                            submit.textContent = "Continue";
                         }
-                        throw err;
                     })
                         .catch((err) => {
                         if (!settleAttempt(attempt))
@@ -8140,15 +8427,16 @@ async function prepareAndOpen(opts, pending) {
                     }
                     setBusy(b, "Opening secure sign-in\u2026");
                     const socialOpts = { provider: method, redirectUri: opts.redirectUri };
-                    authApi
-                        .loginWithPopup(socialOpts)
-                        .then((u) => { settleAttempt(attempt); succeed(u); })
-                        .catch((err) => {
-                        if (shouldFallbackToRedirect(err)) {
-                            return authApi.loginWithRedirect(socialOpts).then((u) => { if (u)
-                                succeed(u); });
+                    hostedLogin(socialOpts)
+                        .then((u) => {
+                        if (u) {
+                            settleAttempt(attempt);
+                            succeed(u);
+                        }
+                        else if (settleAttempt(attempt)) {
+                            b.disabled = false;
+                            setLabel(b, method);
                         }
-                        throw err;
                     })
                         .catch((err) => {
                         if (!settleAttempt(attempt))
@@ -8412,7 +8700,7 @@ async function prepareAndOpen(opts, pending) {
                     fitPanelToContent(m);
             });
         };
-        swap(renderChoose());
+        swap(renderChoose((_a = authApi.getLoginReturnError()) === null || _a === void 0 ? void 0 : _a.message));
         showModal(m);
     });
 }
@@ -10706,6 +10994,22 @@ async function connectServiceSession(ticket, options) {
     }
 }
 
+/**
+ * Initialize the SDK. A page served by Bounded already states which app it is,
+ * so `init()` there needs no `appId`; pass one to run anywhere else (another
+ * host, local development). An explicit `appId` is used exactly as given.
+ */
+function init(config = {}) {
+    let resolved;
+    try {
+        resolved = withHostedIdentity(config);
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    return init$1(resolved);
+}
+
 exports.BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA;
 exports.BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA;
 exports.BUILD_REVIEW_CAPABILITY_SCHEMA = BUILD_REVIEW_CAPABILITY_SCHEMA;
@@ -10723,7 +11027,6 @@ exports.bs58 = bs58;
 exports.bufferExports = bufferExports;
 exports.builds = builds;
 exports.completeLoginFromRedirect = completeLoginFromRedirect;
-exports.completeLoginInPopup = completeLoginInPopup;
 exports.confirmAndCheckTransaction = confirmAndCheckTransaction;
 exports.connectBroadcast = connectBroadcast;
 exports.connectServiceSession = connectServiceSession;
@@ -10737,6 +11040,7 @@ exports.getAuthLoading = getAuthLoading;
 exports.getAuthProvider = getAuthProvider;
 exports.getCurrentUser = getCurrentUser;
 exports.getIdToken = getIdToken;
+exports.getLoginReturnError = getLoginReturnError;
 exports.getOrCreateTurnkeyWallet = getOrCreateTurnkeyWallet;
 exports.getPlatform = getPlatform;
 exports.getTurnkeyWalletRecoveryUrl = getTurnkeyWalletRecoveryUrl;
@@ -10777,4 +11081,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index-DTBxbfUl.js.map
+//# sourceMappingURL=index-ok-Nn6DV.js.map