@bounded-sh/client 0.0.110 → 0.0.112-ux-audit.1

package/dist/{index-Cs5nPIzA.js → index-Brdwqgqs.js}

@@ -277,8 +277,9 @@ class OffchainAuthProvider {
     async logout() {
         await this.wrappedProvider.logout();
     }
-    async restoreSession() {
-        const user = await this.wrappedProvider.restoreSession();
+    async restoreSession(beforeCommit) {
+        const provider = this.wrappedProvider;
+        const user = await provider.restoreSession(beforeCommit);
         if (user) {
             return Object.assign(Object.assign({}, user), { provider: this });
         }
@@ -779,15 +780,35 @@ function resolveSolanaWalletStandardChain(network, context) {
                 `Expected one of: solana_devnet, solana_mainnet.`);
     }
 }
+/**
+ * The platform RPC endpoint for a supported Solana network, or null when the
+ * network is missing or unsupported. Used when the app passes no rpcUrl.
+ */
+function defaultSolanaRpcUrl(network) {
+    switch (network) {
+        case "solana_mainnet":
+            return SOLANA_MAINNET_RPC_URL;
+        case "solana_devnet":
+            return SOLANA_DEVNET_RPC_URL;
+        default:
+            return null;
+    }
+}
+/**
+ * An explicit rpcUrl always wins. Otherwise the platform RPC for the configured
+ * network is used. With neither, fail closed.
+ */
 function resolveSolanaRpcUrl(explicitRpcUrl, network, context) {
+    var _a;
     if (network != null && network !== "" && !isSupportedSolanaRpcNetwork(network)) {
         throw new Error(`${context} does not support Solana network "${network}". ` +
             `Expected one of: solana_devnet, solana_mainnet.`);
     }
-    const rpcUrl = normalizeSolanaRpcUrl(explicitRpcUrl);
+    const rpcUrl = (_a = normalizeSolanaRpcUrl(explicitRpcUrl)) !== null && _a !== void 0 ? _a : defaultSolanaRpcUrl(network);
     if (rpcUrl)
         return rpcUrl;
-    throw new Error(`${context} requires an explicit Solana RPC URL. Pass config.rpcUrl before signing or submitting onchain transactions.`);
+    throw new Error(`${context} requires a Solana network. Set init({ chain: "solana_mainnet" | "solana_devnet" }) ` +
+        `or pass config.rpcUrl before signing or submitting onchain transactions.`);
 }
 
 var __classPrivateFieldGet = (undefined && undefined.__classPrivateFieldGet) || function (receiver, state, kind, f) {
@@ -5512,7 +5533,8 @@ async function loginWithRedirect(opts) {
         return runNativeLogin(opts);
     if (!hasDOM$2())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
-    const { url, pkce } = await buildAuthorize(opts);
+    const { url, pkce } = await untilAborted(buildAuthorize(opts), opts.signal);
+    throwIfCancelled(opts.signal);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
@@ -5541,9 +5563,29 @@ async function completeLoginFromRedirect() {
         throw error;
     return result.user;
 }
+function throwIfCancelled(signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted)
+        throw new Error('cancelled');
+}
+async function untilAborted(work, signal) {
+    if (!signal)
+        return work;
+    throwIfCancelled(signal);
+    let onAbort;
+    try {
+        return await Promise.race([work, new Promise((_, reject) => {
+                onAbort = () => reject(new Error('cancelled'));
+                signal.addEventListener('abort', onAbort, { once: true });
+            })]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
  *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
+    throwIfCancelled(opts.signal);
     if (!hasDOM$2())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
@@ -5561,7 +5603,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts, 'popup');
+        authorization = await untilAborted(buildAuthorize(opts, 'popup'), opts.signal);
     }
     catch (error) {
         try {
@@ -5578,6 +5620,7 @@ async function loginWithPopup(opts) {
     // window with no listener or watchdog attached.
     let expectedOrigin;
     try {
+        throwIfCancelled(opts.signal);
         expectedOrigin = new URL(pkce.redirectUri).origin;
         sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
     }
@@ -5609,20 +5652,42 @@ async function loginWithPopup(opts) {
     setAuthLoading(true); // reflect "signing in…" while the popup is open
     try {
         return await new Promise((resolve, reject) => {
+            var _a, _b;
             let settled = false;
+            let handedOff = false;
+            let committing = false;
             let timer;
             let navigationTimer;
             let completionTimer;
             const cleanup = () => {
-                settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
                 clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
                 removeAttempt(pkce.state);
             };
+            const finish = (error, user) => {
+                var _a;
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.removeEventListener('abort', onAbort);
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_b) { /* ignore */ }
+                if (error)
+                    reject(error);
+                else
+                    resolve(user);
+            };
+            // Provider adoption commits synchronously after its final guard. An auth
+            // listener dismissing the card there cannot cancel an already signed-in user.
+            const onAbort = () => { if (!committing)
+                finish(new Error('cancelled')); };
             const onMsg = async (ev) => {
-                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                if (settled || handedOff || ev.origin !== expectedOrigin || ev.source !== popup)
                     return;
                 const d = ev.data;
                 if (!d || d.type !== 'bounded-oidc-code' ||
@@ -5636,35 +5701,30 @@ async function loginWithPopup(opts) {
                     return;
                 if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
                     return;
+                handedOff = true;
                 cleanup();
                 try {
+                    throwIfCancelled(opts.signal);
                     await validateAttempt(pkce, new URL(d.callbackUrl));
+                    throwIfCancelled(opts.signal);
                     popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
                     if (d.error)
                         throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
-                    const user = await exchangeCode(d.code, pkce);
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_a) { /* ignore */ }
-                    resolve(user);
+                    const user = await exchangeCode(d.code, pkce, opts.signal, () => { committing = true; });
+                    finish(undefined, user);
                 }
                 catch (e) {
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_b) { /* ignore */ }
-                    reject(e);
+                    finish(e);
                 }
             };
+            (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.addEventListener('abort', onAbort, { once: true });
+            if ((_b = opts.signal) === null || _b === void 0 ? void 0 : _b.aborted) {
+                onAbort();
+                return;
+            }
             window.addEventListener('message', onMsg);
             completionTimer = setTimeout(() => {
-                cleanup();
-                try {
-                    popup.close();
-                }
-                catch ( /* ignore */_a) { /* ignore */ }
-                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+                finish(new Error('Login expired or its popup disconnected. Start sign-in again.'));
             }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
@@ -5685,23 +5745,18 @@ async function loginWithPopup(opts) {
             const NAVIGATION_RECHECK_MS = 2000;
             const navigationStartedAt = Date.now();
             const checkNavigation = () => {
-                if (settled || popup.closed)
+                if (settled || handedOff || popup.closed)
                     return;
                 try {
                     if (popup.location.href === 'about:blank') {
                         if (Date.now() - navigationStartedAt >= NAVIGATION_GRACE_MS) {
-                            cleanup();
-                            try {
-                                popup.close();
-                            }
-                            catch ( /* ignore */_a) { /* ignore */ }
-                            reject(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
+                            finish(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
                             return;
                         }
                         navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
                     }
                 }
-                catch ( /* cross-origin hosted auth loaded normally */_b) { /* cross-origin hosted auth loaded normally */ }
+                catch ( /* cross-origin hosted auth loaded normally */_a) { /* cross-origin hosted auth loaded normally */ }
             };
             navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
             // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
@@ -5711,10 +5766,8 @@ async function loginWithPopup(opts) {
             timer = setInterval(() => {
                 if (popup.closed) {
                     clearInterval(timer);
-                    setTimeout(() => { if (!settled) {
-                        cleanup();
-                        reject(new Error('Login window closed'));
-                    } }, 500);
+                    setTimeout(() => { if (!settled && !handedOff)
+                        finish(new Error('Login window closed')); }, 500);
                 }
             }, 500);
         });
@@ -5765,9 +5818,10 @@ async function inlineAuthEndpoint() {
     const cfg = await core.getConfig();
     return { base: await issuerBase(), appId: cfg.appId };
 }
-async function exchangeCode(code, pkce) {
+async function exchangeCode(code, pkce, signal, onCommitting) {
     const generation = getInitializationGeneration();
     const beforeCommit = () => {
+        throwIfCancelled(signal);
         if (generation !== getInitializationGeneration())
             throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
     };
@@ -5783,7 +5837,7 @@ async function exchangeCode(code, pkce) {
     let res;
     try {
         res = await fetch(`${base}/api/auth/oauth2/token`, {
-            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(),
+            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(), signal,
         });
     }
     catch (err) {
@@ -5809,7 +5863,7 @@ async function exchangeCode(code, pkce) {
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
     try {
-        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit: () => { beforeCommit(); onCommitting === null || onCommitting === void 0 ? void 0 : onCommitting(); } });
     }
     catch (error) {
         if (typeof rollback === 'function')
@@ -5878,6 +5932,31 @@ function idTokenIsGuest(idToken, expectedAddress) {
 function storedSessionIsGuest() {
     return idTokenIsGuest(getStoredIdToken());
 }
+/** Internal: select a cross-tab restore from bearer claims, never global hints. */
+function storedSessionAuthMethod(config) {
+    try {
+        const token = getStoredIdToken();
+        if (!token)
+            return null;
+        let payload = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        payload += '='.repeat((4 - payload.length % 4) % 4);
+        const claims = JSON.parse(getPlatform().atob(payload));
+        const method = claims.is_anonymous === true ? 'guest'
+            : claims['custom:walletProvider'] === 'turnkey' || claims.email ? 'email'
+                : claims['custom:evmWalletAddress'] ? 'evm-wallet'
+                    : claims['custom:walletAddress'] ? 'phantom' : 'email';
+        if (config.authMethod != null && canonicalWalletAuthMethod(config.authMethod) !== method)
+            return null;
+        if (method === 'evm-wallet' && config.authMethod !== 'evm-wallet')
+            return null;
+        if (method === 'phantom' && (isWalletLoginDisabled(config) || isEmailRequired(config)))
+            return null;
+        return method;
+    }
+    catch (_a) {
+        return null;
+    }
+}
 /**
  * Pick the provider used for an ordinary `init({ appId })` restore.
  *
@@ -6139,9 +6218,10 @@ function optionalProviderError(method) {
         `loginWithRedirect(...) for Bounded Auth, signInAnonymously() for guests, ` +
         `or install/import an explicit wallet-provider entry once your app opts into "${method}".`);
 }
-async function getAuthProvider(config) {
+async function getAuthProvider(config, fromStorage = false) {
     var _a;
-    const nextProviderConfigKey = config ? authProviderConfigKey(config) : null;
+    const requestedAuthMethod = config ? (fromStorage ? storedSessionAuthMethod(config) : authMethodForInit(config)) : null;
+    const nextProviderConfigKey = config ? authProviderConfigKey(Object.assign(Object.assign({}, config), { authMethod: requestedAuthMethod })) : null;
     if (currentAuthProvider && (!config || currentAuthProviderConfigKey === nextProviderConfigKey)) {
         return currentAuthProvider;
     }
@@ -6156,7 +6236,8 @@ async function getAuthProvider(config) {
     initConfig = config;
     // Keep what the app actually wrote for error text; everything else runs on
     // the canonical method so exactly one string reaches storage and the issuer.
-    const requestedAuthMethod = authMethodForInit(config);
+    if (!requestedAuthMethod)
+        throw new Error('The stored session is incompatible with this app authentication configuration.');
     const authMethod = canonicalWalletAuthMethod(requestedAuthMethod);
     const rpcUrl = normalizeSolanaRpcUrl(config.rpcUrl);
     const configuredNetwork = getConfiguredSolanaNetwork(config);
@@ -6181,7 +6262,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-T-Go_9h9.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CG5cxOj0.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6223,7 +6304,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CgHOrtmj.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-LTnqoaYD.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6236,7 +6317,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CMl0Fyxk.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CwOGXCDt.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6261,7 +6342,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BDhwvzem.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Dtl1J-2F.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6323,7 +6404,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BDhwvzem.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Dtl1J-2F.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6494,7 +6575,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-CgHOrtmj.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-LTnqoaYD.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6597,7 +6678,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CgHOrtmj.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-LTnqoaYD.js'); });
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -6869,9 +6950,21 @@ var index = /*#__PURE__*/Object.freeze({
     logout: logout$1,
     preloadWalletLogin: preloadWalletLogin,
     resolveAuthMode: resolveAuthMode,
-    signInAnonymously: signInAnonymously
+    signInAnonymously: signInAnonymously,
+    storedSessionAuthMethod: storedSessionAuthMethod
 });
 
+/**
+ * An explicit rpcUrl wins; otherwise a Solana chain gets the platform RPC so
+ * every onchain path (wallet signing, submission, reconcile) has one.
+ */
+function withDefaultSolanaRpcUrl(config) {
+    var _a;
+    if (normalizeSolanaRpcUrl(config.rpcUrl))
+        return config;
+    const rpcUrl = defaultSolanaRpcUrl((_a = config.chain) === null || _a === void 0 ? void 0 : _a.trim());
+    return rpcUrl ? Object.assign(Object.assign({}, config), { rpcUrl }) : config;
+}
 /**
  * Subscribed once per process, not per init(): re-registering on every init would
  * stack duplicate handlers on repeated initialization.
@@ -6936,11 +7029,80 @@ let isAuthLoading = false;
 let authReadyPromise = null;
 let initializingConfig = null;
 let initializationGeneration = 0;
+let initializedConfig = null;
+let storageBridgeRegistered = false;
+let observedIdToken = null;
+let observedIssuer = null;
+// Storage events carry no authority. Re-read the active manager's app/issuer
+// namespace, then use the ordinary initializer/provider restore and listeners.
+function registerStorageBridge() {
+    if (storageBridgeRegistered || !getPlatform().hasDOM || typeof window === 'undefined')
+        return;
+    storageBridgeRegistered = true;
+    window.addEventListener('storage', (event) => {
+        if (event.storageArea !== window.localStorage || !initializedConfig)
+            return;
+        void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
+    });
+}
+async function syncStoredSession() {
+    const config = initializedConfig;
+    if (!config)
+        return;
+    const token = core.WebSessionManager.getIdToken();
+    const issuer = core.WebSessionManager.getIssuer();
+    if (token === observedIdToken && issuer === observedIssuer)
+        return;
+    observedIdToken = token;
+    observedIssuer = issuer;
+    const generation = ++initializationGeneration;
+    // Hide the former principal while the replacement is validated. This also
+    // reconnects live reads through the existing auth-state change path.
+    setCurrentUser(null);
+    if (authReadyPromise)
+        await authReadyPromise.catch(() => { });
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const record = await core.WebSessionManager.readSessionWithGeneration();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    if (!record)
+        return;
+    const normalize = (url) => (url || '').replace(/\/+$/, '');
+    const resolvedConfig = await core.getConfig();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const allowedIssuers = [normalize(resolvedConfig.humanAuthApiUrl || 'https://auth.bounded.sh'), normalize(resolvedConfig.authApiUrl)].filter(Boolean);
+    // A legacy shared blob can belong to another app. Never restore or clear
+    // that app's credential; the current app remains signed out.
+    if ((record.appId && record.appId !== config.appId)
+        || (record.issuer && !allowedIssuers.includes(normalize(record.issuer))))
+        return;
+    if (!storedSessionAuthMethod(config))
+        return;
+    const restored = startInitialization(config, true);
+    const restoreGeneration = initializationGeneration;
+    try {
+        await restored;
+    }
+    catch (error) {
+        if (restoreGeneration === initializationGeneration && core.WebSessionManager.getIdToken())
+            throw error;
+    }
+}
 /** Internal guard for a login result arriving after the app reconfigured the SDK. */
 function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
-async function initialize(newConfig) {
+async function initialize(requestedConfig, fromStorage) {
+    const newConfig = withDefaultSolanaRpcUrl(requestedConfig);
+    const generation = initializationGeneration;
+    const validateStorage = fromStorage ? core.WebSessionManager.captureSessionEstablishment() : undefined;
+    const beforeCommit = () => {
+        if (generation !== initializationGeneration)
+            throw new Error('Session restore was superseded.');
+        validateStorage === null || validateStorage === void 0 ? void 0 : validateStorage();
+    };
     // Mark auth as loading for the ENTIRE init/restore window so consumers render
     // a neutral/loading state instead of the signed-out UI while we rehydrate the
     // session — otherwise getCurrentUser() is null + loading is false during the
@@ -6959,8 +7121,9 @@ async function initialize(newConfig) {
         // onAuthStateChanged never fired, and every consumer UI went on showing a
         // connected wallet for a session the server no longer knew about.
         registerSessionClearedBridge();
+        registerStorageBridge();
         // Get auth provider first
-        authProviderInstance = await getAuthProvider(newConfig);
+        authProviderInstance = await getAuthProvider(newConfig, fromStorage);
         // Initialize config with auth provider
         await core.init(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
         // A return establishes its own provider/session, or hands off a popup.
@@ -6985,7 +7148,8 @@ async function initialize(newConfig) {
         // Wait for restoreSession to complete
         // The appId check is done in SessionManager.getSession which is called by restoreSession
         // If there's an appId mismatch, the session will be cleared and restoreSession will return null
-        let user = await authProviderInstance.restoreSession();
+        let user = await authProviderInstance.restoreSession(beforeCommit);
+        beforeCommit();
         // If a session exists but was created before auth method tracking (legacy session),
         // clear it to avoid mismatches when the app switches auth methods (e.g. email → phantom)
         //
@@ -6993,9 +7157,10 @@ async function initialize(newConfig) {
         // unawaited call would return a Promise (always truthy) — nulling the user
         // unconditionally AND letting setCurrentUser run while the old credential
         // was still in storage.
-        if (user && await clearIncompatibleSession()) {
+        if (user && !fromStorage && await clearIncompatibleSession()) {
             user = null;
         }
+        beforeCommit();
         setCurrentUser(user);
         // Mark init as completed
         initCompleted = true;
@@ -7035,13 +7200,17 @@ function sameConfigValue(a, b, seen = new WeakMap()) {
         && sameConfigValue(a[key], b[key], seen));
 }
 function init$1(newConfig) {
+    return startInitialization(newConfig, false);
+}
+function startInitialization(newConfig, fromStorage) {
     if (initializingConfig) {
         if (sameConfigValue(initializingConfig, newConfig)) {
             return authReadyPromise;
         }
         return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
     }
-    initializingConfig = Object.assign({}, newConfig);
+    initializedConfig = Object.assign({}, newConfig);
+    initializingConfig = initializedConfig;
     initializationGeneration++;
     let resolveReady;
     let rejectReady;
@@ -7053,7 +7222,7 @@ function init$1(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
+    void initialize(initializingConfig, fromStorage).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -7126,6 +7295,13 @@ function userPrincipalKey(user) {
 }
 // Update the currentUser and notify listeners
 function setCurrentUser(user) {
+    observedIdToken = getCurrentIdToken();
+    try {
+        observedIssuer = core.getActiveSessionManager().getIssuer();
+    }
+    catch (_a) {
+        observedIssuer = null;
+    }
     // Enrich with the universal identity fields (id/email) derived from the
     // active session's idToken — central chokepoint so every provider's user
     // object gains { id, address, email } without each construction site
@@ -8073,7 +8249,8 @@ async function prepareAndOpen(opts, pending) {
             return authApi.loginWithRedirect(options);
         // Invoke immediately inside the click handler to retain popup activation.
         return authApi.loginWithPopup(options).catch((error) => {
-            if (shouldFallbackToRedirect(error))
+            var _a;
+            if (!((_a = options.signal) === null || _a === void 0 ? void 0 : _a.aborted) && shouldFallbackToRedirect(error))
                 return authApi.loginWithRedirect(options);
             throw error;
         });
@@ -8211,6 +8388,12 @@ async function prepareAndOpen(opts, pending) {
         let activeAttempt = 0;
         let abortScopedLogin = null;
         let abortGesture = null;
+        const startHostedLogin = (options) => {
+            const controller = new AbortController();
+            const abort = () => controller.abort();
+            abortScopedLogin = abort;
+            return hostedLogin(Object.assign(Object.assign({}, options), { signal: controller.signal }));
+        };
         /** Reject a gesture promise already waiting on a view that is going away. */
         const abortPendingGesture = () => {
             const abort = abortGesture;
@@ -8236,6 +8419,7 @@ async function prepareAndOpen(opts, pending) {
             if (!attemptIsCurrent(id))
                 return false;
             activeAttempt = 0;
+            abortScopedLogin = null;
             return true;
         };
         /** Take the card back (Back, a lane switch, settling the modal). Deliberately
@@ -8390,7 +8574,7 @@ async function prepareAndOpen(opts, pending) {
                         loginHint: input.value,
                         redirectUri: opts.redirectUri,
                     };
-                    hostedLogin(emailOpts)
+                    startHostedLogin(emailOpts)
                         // A hosted login that RESOLVES minted a real session, so it settles
                         // the card even if another lane has since taken it - dropping it
                         // would leave the app signed in behind a widget that says it is not.
@@ -8440,7 +8624,7 @@ async function prepareAndOpen(opts, pending) {
                     }
                     setBusy(b, "Opening secure sign-in\u2026");
                     const socialOpts = { provider: method, redirectUri: opts.redirectUri };
-                    hostedLogin(socialOpts)
+                    startHostedLogin(socialOpts)
                         .then((u) => {
                         if (u) {
                             settleAttempt(attempt);
@@ -10452,7 +10636,7 @@ class PrivyExpoProvider {
         if (isLegacyTx) {
             const legacyTx = transaction;
             if (!legacyTx.recentBlockhash) {
-                const rpcUrl = this.getRpcUrl();
+                const rpcUrl = await this.getRpcUrl();
                 const connection = new Connection(rpcUrl, 'confirmed');
                 const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
                 legacyTx.recentBlockhash = blockhash;
@@ -10465,7 +10649,7 @@ class PrivyExpoProvider {
         else {
             const versionedTx = transaction;
             if (!versionedTx.message.recentBlockhash) {
-                const rpcUrl = this.getRpcUrl();
+                const rpcUrl = await this.getRpcUrl();
                 const connection = new Connection(rpcUrl, 'confirmed');
                 const { blockhash } = await connection.getLatestBlockhash('confirmed');
                 versionedTx.message.recentBlockhash = blockhash;
@@ -10485,7 +10669,7 @@ class PrivyExpoProvider {
         await this.ensureReady();
         const { Connection, PublicKey } = await import('@solana/web3.js');
         const wallet = await this.getWalletOrThrow('submitting this transaction');
-        const rpcUrl = this.getRpcUrl();
+        const rpcUrl = await this.getRpcUrl();
         const connection = new Connection(rpcUrl, 'confirmed');
         // Ensure blockhash.
         // DS3-0414: a Solana signature covers the compiled message (recentBlockhash
@@ -10512,8 +10696,9 @@ class PrivyExpoProvider {
         const { signature } = await this.signAndSubmitInternal(transaction, wallet, connection);
         return signature;
     }
-    async restoreSession() {
+    async restoreSession(beforeCommit) {
         const session = await core.getActiveSessionManager().getSession();
+        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();
         if (session) {
             this.authenticatedAddress = session.address;
             return { provider: this, address: session.address };
@@ -10586,8 +10771,12 @@ class PrivyExpoProvider {
         const txInfo = await confirmAndCheckTransaction(connection, signature);
         return { signature, txInfo };
     }
-    getRpcUrl(network) {
-        return resolveSolanaRpcUrl(this.networkUrl, network, "Privy Expo Solana transaction");
+    // The constructor rpcUrl wins, then init()'s rpcUrl, then the platform RPC
+    // for init()'s chain.
+    async getRpcUrl() {
+        var _a;
+        const config = await core.getConfig();
+        return resolveSolanaRpcUrl((_a = this.networkUrl) !== null && _a !== void 0 ? _a : config.rpcUrl, isSupportedSolanaRpcNetwork(config.chain) ? config.chain : null, "Privy Expo Solana transaction");
     }
     async ensureReady(timeoutMs = 15000) {
         if (!this.privyMethods) {
@@ -11094,4 +11283,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index-Cs5nPIzA.js.map
+//# sourceMappingURL=index-Brdwqgqs.js.map