@bounded-sh/client 0.0.111 → 0.0.112-ux-audit.2

package/dist/{index-B9__gwTi.mjs → index-D3kdhCpH.mjs}

@@ -1,4 +1,4 @@
-import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, init as init$2, deriveUserIdentityFromIdToken, onSessionCleared, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, deriveUserIdentityFromIdToken, init as init$2, onSessionCleared, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 function walletContextFromClaims(claims, baseUrl, expectedAppId, tenantOrigin) {
@@ -35,6 +35,13 @@ function walletOperationGuard() {
             throw new Error('wallet_session_changed');
     };
 }
+function walletLoginGuard(signal) {
+    const generation = ++loginGeneration;
+    return () => {
+        if ((signal === null || signal === void 0 ? void 0 : signal.aborted) || generation !== loginGeneration)
+            throw new Error('wallet_login_cancelled');
+    };
+}
 // This realm owns one active SDK session and one retained signer frame.
 let activeWalletState;
 function setWalletSessionState(key, state) { activeWalletState = { key, state }; }
@@ -256,8 +263,9 @@ class OffchainAuthProvider {
     async logout() {
         await this.wrappedProvider.logout();
     }
-    async restoreSession() {
-        const user = await this.wrappedProvider.restoreSession();
+    async restoreSession(beforeCommit) {
+        const provider = this.wrappedProvider;
+        const user = await provider.restoreSession(beforeCommit);
         if (user) {
             return Object.assign(Object.assign({}, user), { provider: this });
         }
@@ -5511,7 +5519,8 @@ async function loginWithRedirect(opts) {
         return runNativeLogin(opts);
     if (!hasDOM$2())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
-    const { url, pkce } = await buildAuthorize(opts);
+    const { url, pkce } = await untilAborted(buildAuthorize(opts), opts.signal);
+    throwIfCancelled(opts.signal);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
@@ -5540,9 +5549,29 @@ async function completeLoginFromRedirect() {
         throw error;
     return result.user;
 }
+function throwIfCancelled(signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted)
+        throw new Error('cancelled');
+}
+async function untilAborted(work, signal) {
+    if (!signal)
+        return work;
+    throwIfCancelled(signal);
+    let onAbort;
+    try {
+        return await Promise.race([work, new Promise((_, reject) => {
+                onAbort = () => reject(new Error('cancelled'));
+                signal.addEventListener('abort', onAbort, { once: true });
+            })]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
  *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
+    throwIfCancelled(opts.signal);
     if (!hasDOM$2())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
@@ -5560,7 +5589,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts, 'popup');
+        authorization = await untilAborted(buildAuthorize(opts, 'popup'), opts.signal);
     }
     catch (error) {
         try {
@@ -5577,6 +5606,7 @@ async function loginWithPopup(opts) {
     // window with no listener or watchdog attached.
     let expectedOrigin;
     try {
+        throwIfCancelled(opts.signal);
         expectedOrigin = new URL(pkce.redirectUri).origin;
         sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
     }
@@ -5608,20 +5638,42 @@ async function loginWithPopup(opts) {
     setAuthLoading(true); // reflect "signing in…" while the popup is open
     try {
         return await new Promise((resolve, reject) => {
+            var _a, _b;
             let settled = false;
+            let handedOff = false;
+            let committing = false;
             let timer;
             let navigationTimer;
             let completionTimer;
             const cleanup = () => {
-                settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
                 clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
                 removeAttempt(pkce.state);
             };
+            const finish = (error, user) => {
+                var _a;
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.removeEventListener('abort', onAbort);
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_b) { /* ignore */ }
+                if (error)
+                    reject(error);
+                else
+                    resolve(user);
+            };
+            // Provider adoption commits synchronously after its final guard. An auth
+            // listener dismissing the card there cannot cancel an already signed-in user.
+            const onAbort = () => { if (!committing)
+                finish(new Error('cancelled')); };
             const onMsg = async (ev) => {
-                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                if (settled || handedOff || ev.origin !== expectedOrigin || ev.source !== popup)
                     return;
                 const d = ev.data;
                 if (!d || d.type !== 'bounded-oidc-code' ||
@@ -5635,35 +5687,30 @@ async function loginWithPopup(opts) {
                     return;
                 if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
                     return;
+                handedOff = true;
                 cleanup();
                 try {
+                    throwIfCancelled(opts.signal);
                     await validateAttempt(pkce, new URL(d.callbackUrl));
+                    throwIfCancelled(opts.signal);
                     popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
                     if (d.error)
                         throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
-                    const user = await exchangeCode(d.code, pkce);
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_a) { /* ignore */ }
-                    resolve(user);
+                    const user = await exchangeCode(d.code, pkce, opts.signal, () => { committing = true; });
+                    finish(undefined, user);
                 }
                 catch (e) {
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_b) { /* ignore */ }
-                    reject(e);
+                    finish(e);
                 }
             };
+            (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.addEventListener('abort', onAbort, { once: true });
+            if ((_b = opts.signal) === null || _b === void 0 ? void 0 : _b.aborted) {
+                onAbort();
+                return;
+            }
             window.addEventListener('message', onMsg);
             completionTimer = setTimeout(() => {
-                cleanup();
-                try {
-                    popup.close();
-                }
-                catch ( /* ignore */_a) { /* ignore */ }
-                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+                finish(new Error('Login expired or its popup disconnected. Start sign-in again.'));
             }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
@@ -5684,23 +5731,18 @@ async function loginWithPopup(opts) {
             const NAVIGATION_RECHECK_MS = 2000;
             const navigationStartedAt = Date.now();
             const checkNavigation = () => {
-                if (settled || popup.closed)
+                if (settled || handedOff || popup.closed)
                     return;
                 try {
                     if (popup.location.href === 'about:blank') {
                         if (Date.now() - navigationStartedAt >= NAVIGATION_GRACE_MS) {
-                            cleanup();
-                            try {
-                                popup.close();
-                            }
-                            catch ( /* ignore */_a) { /* ignore */ }
-                            reject(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
+                            finish(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
                             return;
                         }
                         navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
                     }
                 }
-                catch ( /* cross-origin hosted auth loaded normally */_b) { /* cross-origin hosted auth loaded normally */ }
+                catch ( /* cross-origin hosted auth loaded normally */_a) { /* cross-origin hosted auth loaded normally */ }
             };
             navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
             // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
@@ -5710,10 +5752,8 @@ async function loginWithPopup(opts) {
             timer = setInterval(() => {
                 if (popup.closed) {
                     clearInterval(timer);
-                    setTimeout(() => { if (!settled) {
-                        cleanup();
-                        reject(new Error('Login window closed'));
-                    } }, 500);
+                    setTimeout(() => { if (!settled && !handedOff)
+                        finish(new Error('Login window closed')); }, 500);
                 }
             }, 500);
         });
@@ -5727,20 +5767,21 @@ async function loginWithPopup(opts) {
 // Turnkey-native login path (authMode:"turnkey"), which mints the session server-side
 // after Turnkey verifies the email OTP - there is no OIDC code to exchange. Wiring is
 // identical to exchangeCode's tail so the realtime worker cannot tell them apart.
-async function establishInlineSession(data, beforeCommit, beforeStore) {
+async function establishInlineSession(data, beforeCommit, beforeStore, onCommitting) {
     const base = await issuerBase();
+    beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();
     const idToken = tokenField(data, 'id_token', 'idToken');
     if (!idToken)
         throw new Error('No id_token in the inline session response');
     const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
     const refreshToken = boundedRefreshTokenField(data);
     const user = userFromIdToken(idToken);
-    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, () => { });
+    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, () => { beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit(); });
     // Adopt the OIDC provider on EVERY session surface - including core's signing
     // pointer (getConfig().authProvider), which this path used to skip, leaving
     // onchain writes routed through a previous (e.g. logged-out wallet) provider.
     try {
-        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit: () => { beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit(); onCommitting === null || onCommitting === void 0 ? void 0 : onCommitting(); } });
     }
     catch (error) {
         if (typeof rollback === 'function')
@@ -5764,9 +5805,10 @@ async function inlineAuthEndpoint() {
     const cfg = await getConfig();
     return { base: await issuerBase(), appId: cfg.appId };
 }
-async function exchangeCode(code, pkce) {
+async function exchangeCode(code, pkce, signal, onCommitting) {
     const generation = getInitializationGeneration();
     const beforeCommit = () => {
+        throwIfCancelled(signal);
         if (generation !== getInitializationGeneration())
             throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
     };
@@ -5782,7 +5824,7 @@ async function exchangeCode(code, pkce) {
     let res;
     try {
         res = await fetch(`${base}/api/auth/oauth2/token`, {
-            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(),
+            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(), signal,
         });
     }
     catch (err) {
@@ -5808,7 +5850,7 @@ async function exchangeCode(code, pkce) {
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
     try {
-        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit: () => { beforeCommit(); onCommitting === null || onCommitting === void 0 ? void 0 : onCommitting(); } });
     }
     catch (error) {
         if (typeof rollback === 'function')
@@ -5877,6 +5919,31 @@ function idTokenIsGuest(idToken, expectedAddress) {
 function storedSessionIsGuest() {
     return idTokenIsGuest(getStoredIdToken());
 }
+/** Internal: select a cross-tab restore from bearer claims, never global hints. */
+function storedSessionAuthMethod(config) {
+    try {
+        const token = getStoredIdToken();
+        if (!token)
+            return null;
+        let payload = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        payload += '='.repeat((4 - payload.length % 4) % 4);
+        const claims = JSON.parse(getPlatform().atob(payload));
+        const method = claims.is_anonymous === true ? 'guest'
+            : claims['custom:walletProvider'] === 'turnkey' || claims.email ? 'email'
+                : claims['custom:evmWalletAddress'] ? 'evm-wallet'
+                    : claims['custom:walletAddress'] ? 'phantom' : 'email';
+        if (config.authMethod != null && canonicalWalletAuthMethod(config.authMethod) !== method)
+            return null;
+        if (method === 'evm-wallet' && config.authMethod !== 'evm-wallet')
+            return null;
+        if (method === 'phantom' && (isWalletLoginDisabled(config) || isEmailRequired(config)))
+            return null;
+        return method;
+    }
+    catch (_a) {
+        return null;
+    }
+}
 /**
  * Pick the provider used for an ordinary `init({ appId })` restore.
  *
@@ -6138,9 +6205,10 @@ function optionalProviderError(method) {
         `loginWithRedirect(...) for Bounded Auth, signInAnonymously() for guests, ` +
         `or install/import an explicit wallet-provider entry once your app opts into "${method}".`);
 }
-async function getAuthProvider(config) {
+async function getAuthProvider(config, fromStorage = false) {
     var _a;
-    const nextProviderConfigKey = config ? authProviderConfigKey(config) : null;
+    const requestedAuthMethod = config ? (fromStorage ? storedSessionAuthMethod(config) : authMethodForInit(config)) : null;
+    const nextProviderConfigKey = config ? authProviderConfigKey(Object.assign(Object.assign({}, config), { authMethod: requestedAuthMethod })) : null;
     if (currentAuthProvider && (!config || currentAuthProviderConfigKey === nextProviderConfigKey)) {
         return currentAuthProvider;
     }
@@ -6155,7 +6223,8 @@ async function getAuthProvider(config) {
     initConfig = config;
     // Keep what the app actually wrote for error text; everything else runs on
     // the canonical method so exactly one string reaches storage and the issuer.
-    const requestedAuthMethod = authMethodForInit(config);
+    if (!requestedAuthMethod)
+        throw new Error('The stored session is incompatible with this app authentication configuration.');
     const authMethod = canonicalWalletAuthMethod(requestedAuthMethod);
     const rpcUrl = normalizeSolanaRpcUrl(config.rpcUrl);
     const configuredNetwork = getConfiguredSolanaNetwork(config);
@@ -6180,7 +6249,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-BfBvF_4M.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-C7RXLVd9.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6222,7 +6291,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BlzA0J_V.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-0SSONh1d.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6235,7 +6304,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-CIeCSOPL.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-BtyG1HOX.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6260,7 +6329,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-Bm_yqQF6.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-2J4fnTX5.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6322,7 +6391,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-Bm_yqQF6.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-2J4fnTX5.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6493,7 +6562,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-BlzA0J_V.mjs');
+            await import('./injected-wallet-provider-0SSONh1d.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6596,7 +6665,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await import('./injected-wallet-provider-BlzA0J_V.mjs');
+    const { InjectedWalletProvider } = await import('./injected-wallet-provider-0SSONh1d.mjs');
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -6868,7 +6937,8 @@ var index = /*#__PURE__*/Object.freeze({
     logout: logout$1,
     preloadWalletLogin: preloadWalletLogin,
     resolveAuthMode: resolveAuthMode,
-    signInAnonymously: signInAnonymously
+    signInAnonymously: signInAnonymously,
+    storedSessionAuthMethod: storedSessionAuthMethod
 });
 
 /**
@@ -6946,12 +7016,80 @@ let isAuthLoading = false;
 let authReadyPromise = null;
 let initializingConfig = null;
 let initializationGeneration = 0;
+let initializedConfig = null;
+let storageBridgeRegistered = false;
+let observedIdToken = null;
+let observedIssuer = null;
+// Storage events carry no authority. Re-read the active manager's app/issuer
+// namespace, then use the ordinary initializer/provider restore and listeners.
+function registerStorageBridge() {
+    if (storageBridgeRegistered || !getPlatform().hasDOM || typeof window === 'undefined')
+        return;
+    storageBridgeRegistered = true;
+    window.addEventListener('storage', (event) => {
+        if (event.storageArea !== window.localStorage || !initializedConfig)
+            return;
+        void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
+    });
+}
+async function syncStoredSession() {
+    const config = initializedConfig;
+    if (!config)
+        return;
+    const token = WebSessionManager.getIdToken();
+    const issuer = WebSessionManager.getIssuer();
+    if (token === observedIdToken && issuer === observedIssuer)
+        return;
+    observedIdToken = token;
+    observedIssuer = issuer;
+    const generation = ++initializationGeneration;
+    // Hide the former principal while the replacement is validated. This also
+    // reconnects live reads through the existing auth-state change path.
+    setCurrentUser(null);
+    if (authReadyPromise)
+        await authReadyPromise.catch(() => { });
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const record = await WebSessionManager.readSessionWithGeneration();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    if (!record)
+        return;
+    const normalize = (url) => (url || '').replace(/\/+$/, '');
+    const resolvedConfig = await getConfig();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const allowedIssuers = [normalize(resolvedConfig.humanAuthApiUrl || 'https://auth.bounded.sh'), normalize(resolvedConfig.authApiUrl)].filter(Boolean);
+    // A legacy shared blob can belong to another app. Never restore or clear
+    // that app's credential; the current app remains signed out.
+    if ((record.appId && record.appId !== config.appId)
+        || (record.issuer && !allowedIssuers.includes(normalize(record.issuer))))
+        return;
+    if (!storedSessionAuthMethod(config))
+        return;
+    const restored = startInitialization(config, true);
+    const restoreGeneration = initializationGeneration;
+    try {
+        await restored;
+    }
+    catch (error) {
+        if (restoreGeneration === initializationGeneration && WebSessionManager.getIdToken())
+            throw error;
+    }
+}
 /** Internal guard for a login result arriving after the app reconfigured the SDK. */
 function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
-async function initialize(requestedConfig) {
+async function initialize(requestedConfig, fromStorage) {
     const newConfig = withDefaultSolanaRpcUrl(requestedConfig);
+    const generation = initializationGeneration;
+    const validateStorage = fromStorage ? WebSessionManager.captureSessionEstablishment() : undefined;
+    const beforeCommit = () => {
+        if (generation !== initializationGeneration)
+            throw new Error('Session restore was superseded.');
+        validateStorage === null || validateStorage === void 0 ? void 0 : validateStorage();
+    };
     // Mark auth as loading for the ENTIRE init/restore window so consumers render
     // a neutral/loading state instead of the signed-out UI while we rehydrate the
     // session — otherwise getCurrentUser() is null + loading is false during the
@@ -6970,8 +7108,9 @@ async function initialize(requestedConfig) {
         // onAuthStateChanged never fired, and every consumer UI went on showing a
         // connected wallet for a session the server no longer knew about.
         registerSessionClearedBridge();
+        registerStorageBridge();
         // Get auth provider first
-        authProviderInstance = await getAuthProvider(newConfig);
+        authProviderInstance = await getAuthProvider(newConfig, fromStorage);
         // Initialize config with auth provider
         await init$2(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
         // A return establishes its own provider/session, or hands off a popup.
@@ -6996,7 +7135,8 @@ async function initialize(requestedConfig) {
         // Wait for restoreSession to complete
         // The appId check is done in SessionManager.getSession which is called by restoreSession
         // If there's an appId mismatch, the session will be cleared and restoreSession will return null
-        let user = await authProviderInstance.restoreSession();
+        let user = await authProviderInstance.restoreSession(beforeCommit);
+        beforeCommit();
         // If a session exists but was created before auth method tracking (legacy session),
         // clear it to avoid mismatches when the app switches auth methods (e.g. email → phantom)
         //
@@ -7004,9 +7144,10 @@ async function initialize(requestedConfig) {
         // unawaited call would return a Promise (always truthy) — nulling the user
         // unconditionally AND letting setCurrentUser run while the old credential
         // was still in storage.
-        if (user && await clearIncompatibleSession()) {
+        if (user && !fromStorage && await clearIncompatibleSession()) {
             user = null;
         }
+        beforeCommit();
         setCurrentUser(user);
         // Mark init as completed
         initCompleted = true;
@@ -7046,13 +7187,17 @@ function sameConfigValue(a, b, seen = new WeakMap()) {
         && sameConfigValue(a[key], b[key], seen));
 }
 function init$1(newConfig) {
+    return startInitialization(newConfig, false);
+}
+function startInitialization(newConfig, fromStorage) {
     if (initializingConfig) {
         if (sameConfigValue(initializingConfig, newConfig)) {
             return authReadyPromise;
         }
         return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
     }
-    initializingConfig = Object.assign({}, newConfig);
+    initializedConfig = Object.assign({}, newConfig);
+    initializingConfig = initializedConfig;
     initializationGeneration++;
     let resolveReady;
     let rejectReady;
@@ -7064,7 +7209,7 @@ function init$1(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
+    void initialize(initializingConfig, fromStorage).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -7137,6 +7282,13 @@ function userPrincipalKey(user) {
 }
 // Update the currentUser and notify listeners
 function setCurrentUser(user) {
+    observedIdToken = getCurrentIdToken();
+    try {
+        observedIssuer = getActiveSessionManager().getIssuer();
+    }
+    catch (_a) {
+        observedIssuer = null;
+    }
     // Enrich with the universal identity fields (id/email) derived from the
     // active session's idToken — central chokepoint so every provider's user
     // object gains { id, address, email } without each construction site
@@ -7682,10 +7834,18 @@ async function startTurnkeyEmailLogin(email) {
     if (!hasDOM$1()) {
         throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
     }
+    const generation = getInitializationGeneration();
+    const walletGuard = walletOperationGuard();
+    const assertContext = () => {
+        walletGuard();
+        if (generation !== getInitializationGeneration())
+            throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+    };
     const trimmed = email.trim();
     if (!trimmed)
         throw new Error('Enter your email to continue.');
     const { base, appId } = await inlineAuthEndpoint();
+    assertContext();
     if (!appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
     const res = await fetch(`${base}/wallet/turnkey/auth/init`, {
@@ -7697,6 +7857,7 @@ async function startTurnkeyEmailLogin(email) {
     if (!res.ok || !data || typeof data.otpId !== 'string' || typeof data.otpEncryptionTargetBundle !== 'string') {
         throw new Error(String((data && data.error) || 'Could not send a code. Please try again.'));
     }
+    assertContext();
     const otpId = data.otpId;
     const otpEncryptionTargetBundle = data.otpEncryptionTargetBundle;
     // A tenant-origin login always gets a ceremony id; without one the OTP frame refuses to run
@@ -7712,14 +7873,20 @@ async function startTurnkeyEmailLogin(email) {
         : undefined;
     return {
         email: trimmed, frameUrl, signerOrigin,
-        run(iframe, _signal) {
+        run(iframe, signal) {
+            try {
+                assertContext();
+            }
+            catch (error) {
+                return Promise.reject(error);
+            }
             if (!ceremonyId) {
                 return Promise.reject(new Error('This app is not configured for in-frame wallet login. Please try again.'));
             }
-            const run = { iframe, base, signerOrigin, appId, email: trimmed, otpId, otpEncryptionTargetBundle, ceremonyId };
+            const run = { iframe, base, signerOrigin, appId, email: trimmed, otpId, otpEncryptionTargetBundle, ceremonyId, generation };
             // BSA-2026-004: the login code is typed only in /wallet/turnkey/otp-frame.
             // The scoped signer URL is for post-login signing, not OTP entry.
-            return runOtpFrame(run);
+            return runOtpFrame(run, signal);
         },
     };
 }
@@ -7728,7 +7895,7 @@ async function startTurnkeyEmailLogin(email) {
 //   frame 'result' {session} -> we establish the inline session and resolve the User.
 // When the frame asks for the signing-session authorization ('need-authorization') we mint a
 // createWallet action authorization on THIS (registered) origin and post it in - never a key.
-function runOtpFrame(run) {
+function runOtpFrame(run, signal) {
     const tenantOrigin = window.location.origin;
     const url = `${run.base.replace(/\/$/, '')}/wallet/turnkey/otp-frame`
         + `?appId=${encodeURIComponent(run.appId)}`
@@ -7738,13 +7905,48 @@ function runOtpFrame(run) {
     return new Promise((resolve, reject) => {
         let settled = false;
         let started = false;
-        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); window.clearTimeout(timer); };
+        let receivingResult = false;
+        let committing = false;
+        const walletGuard = walletLoginGuard(signal);
+        const beforeCommit = () => {
+            if (settled)
+                throw new Error('wallet_login_cancelled');
+            walletGuard();
+            if (run.generation !== getInitializationGeneration())
+                throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+        };
+        const finish = (error, user) => {
+            if (settled)
+                return;
+            settled = true;
+            window.removeEventListener('message', onMsg);
+            window.clearTimeout(timer);
+            signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', onAbort);
+            if (error) {
+                // Destroy the expired frame's code/key realm as well as its parent listener.
+                run.iframe.src = 'about:blank';
+                reject(error);
+            }
+            else
+                resolve(user);
+        };
+        const onAbort = () => { if (!committing)
+            finish(new Error('cancelled')); };
         const onMsg = async (event) => {
             if (settled)
                 return;
             // Trust ONLY the signer origin and the frame's own window.
             if (event.origin !== run.signerOrigin || event.source !== run.iframe.contentWindow)
                 return;
+            if (!committing) {
+                try {
+                    beforeCommit();
+                }
+                catch (error) {
+                    finish(error instanceof Error ? error : new Error(String(error)));
+                    return;
+                }
+            }
             const d = event.data;
             if (!d || typeof d !== 'object')
                 return;
@@ -7787,40 +7989,56 @@ function runOtpFrame(run) {
                 return;
             }
             if (d.type === 'bounded:otp:result') {
+                if (receivingResult)
+                    return;
+                receivingResult = true;
                 if (d.ok && d.session && typeof d.session === 'object') {
                     try {
-                        const user = await establishInlineSession(d.session);
-                        cleanup();
-                        resolve(user);
+                        const user = await establishInlineSession(d.session, beforeCommit, undefined, () => { committing = true; });
+                        finish(undefined, user);
                     }
                     catch (error) {
-                        cleanup();
-                        reject(error instanceof Error ? error : new Error(String(error)));
+                        finish(error instanceof Error ? error : new Error(String(error)));
                     }
                     return;
                 }
-                cleanup();
-                reject(new Error(String((d && d.error) || 'Invalid or expired code.')));
+                finish(new Error(String((d && d.error) || 'Invalid or expired code.')));
                 return;
             }
             // 'bounded:otp:registered' is advisory; login does not depend on it.
         };
         const post = (msg) => {
             var _a;
+            if (settled)
+                return;
+            if (!committing) {
+                try {
+                    beforeCommit();
+                }
+                catch (_b) {
+                    return;
+                }
+            }
             try {
                 (_a = run.iframe.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage(msg, run.signerOrigin);
             }
-            catch ( /* frame gone */_b) { /* frame gone */ }
+            catch ( /* frame gone */_c) { /* frame gone */ }
         };
         window.addEventListener('message', onMsg);
         // 3 minutes: the human must read the email and type the code. A frame that never reports is a
         // failed login the user can retry.
         const timer = window.setTimeout(() => {
-            if (settled)
-                return;
-            cleanup();
-            reject(new Error('The sign-in code entry timed out. Please try again.'));
+            if (!committing)
+                finish(new Error('The sign-in code entry timed out. Please try again.'));
         }, 3 * 60 * 1000);
+        signal === null || signal === void 0 ? void 0 : signal.addEventListener('abort', onAbort, { once: true });
+        try {
+            beforeCommit();
+        }
+        catch (error) {
+            finish(error instanceof Error ? error : new Error(String(error)));
+            return;
+        }
         run.iframe.src = url;
     });
 }
@@ -8084,7 +8302,8 @@ async function prepareAndOpen(opts, pending) {
             return authApi.loginWithRedirect(options);
         // Invoke immediately inside the click handler to retain popup activation.
         return authApi.loginWithPopup(options).catch((error) => {
-            if (shouldFallbackToRedirect(error))
+            var _a;
+            if (!((_a = options.signal) === null || _a === void 0 ? void 0 : _a.aborted) && shouldFallbackToRedirect(error))
                 return authApi.loginWithRedirect(options);
             throw error;
         });
@@ -8222,6 +8441,12 @@ async function prepareAndOpen(opts, pending) {
         let activeAttempt = 0;
         let abortScopedLogin = null;
         let abortGesture = null;
+        const startHostedLogin = (options) => {
+            const controller = new AbortController();
+            const abort = () => controller.abort();
+            abortScopedLogin = abort;
+            return hostedLogin(Object.assign(Object.assign({}, options), { signal: controller.signal }));
+        };
         /** Reject a gesture promise already waiting on a view that is going away. */
         const abortPendingGesture = () => {
             const abort = abortGesture;
@@ -8247,6 +8472,7 @@ async function prepareAndOpen(opts, pending) {
             if (!attemptIsCurrent(id))
                 return false;
             activeAttempt = 0;
+            abortScopedLogin = null;
             return true;
         };
         /** Take the card back (Back, a lane switch, settling the modal). Deliberately
@@ -8401,7 +8627,7 @@ async function prepareAndOpen(opts, pending) {
                         loginHint: input.value,
                         redirectUri: opts.redirectUri,
                     };
-                    hostedLogin(emailOpts)
+                    startHostedLogin(emailOpts)
                         // A hosted login that RESOLVES minted a real session, so it settles
                         // the card even if another lane has since taken it - dropping it
                         // would leave the app signed in behind a widget that says it is not.
@@ -8451,7 +8677,7 @@ async function prepareAndOpen(opts, pending) {
                     }
                     setBusy(b, "Opening secure sign-in\u2026");
                     const socialOpts = { provider: method, redirectUri: opts.redirectUri };
-                    hostedLogin(socialOpts)
+                    startHostedLogin(socialOpts)
                         .then((u) => {
                         if (u) {
                             settleAttempt(attempt);
@@ -8701,14 +8927,16 @@ async function prepareAndOpen(opts, pending) {
                 setErr(BUSY_MSG);
                 return card;
             }
-            back.addEventListener("click", () => { settleAttempt(attempt); invalidateAttempts(); swap(renderChoose()); });
+            back.addEventListener("click", () => { invalidateAttempts(); swap(renderChoose()); });
+            const controller = new AbortController();
+            abortScopedLogin = () => controller.abort();
             handle
-                .run(frame)
+                .run(frame, controller.signal)
                 .then((u) => { settleAttempt(attempt); succeed(u); })
                 .catch((err) => {
                 if (!settleAttempt(attempt))
                     return;
-                setErr(errText(err));
+                swap(renderChoose(errText(err)));
             });
             return card;
         };
@@ -10523,8 +10751,9 @@ class PrivyExpoProvider {
         const { signature } = await this.signAndSubmitInternal(transaction, wallet, connection);
         return signature;
     }
-    async restoreSession() {
+    async restoreSession(beforeCommit) {
         const session = await getActiveSessionManager().getSession();
+        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();
         if (session) {
             this.authenticatedAddress = session.address;
             return { provider: this, address: session.address };
@@ -11039,4 +11268,4 @@ function init(config = {}) {
 }
 
 export { onrampStatus as $, getAuthProvider as A, signInAnonymously as B, loginWithPrivy as C, loginWithWallet as D, ensureWalletLoginReady as E, ensureSharedWalletLoginReady as F, preloadWalletLogin as G, loginWithRedirect as H, completeLoginFromRedirect as I, getLoginReturnError as J, loginWithPopup as K, openBoundedWidget as L, ensureSignedIn as M, useAuth as N, useQuery as O, useBuildRun as P, apps as Q, signSolanaMessageViaTurnkey as R, getOrCreateTurnkeyWallet as S, openTurnkeyKeyExport as T, getTurnkeyWalletSessionState as U, getTurnkeyWalletRecoveryUrl as V, WalletConfigError as W, startTurnkeyEmailLogin as X, getIdToken as Y, onramp as Z, onrampQuote as _, signMessageWithTurnkey as a, setPlatform as a0, OffchainAuthProvider as a1, PrivyExpoProvider as a2, requestEip6963Providers as a3, connectBroadcast as a4, connectServiceSession as a5, builds as a6, BuildsApiError as a7, mediaAgentTools as a8, NON_TERMINAL_STATES as a9, TERMINAL_STATES as aa, RUN_STATES as ab, PARK_REASONS as ac, FAILURE_REASONS as ad, BUILD_REVIEW_CAPABILITY_SCHEMA as ae, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as af, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as ag, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, defaultInjectedProvider as f, getPlatform as g, hasTurnkeyWallet as h, firstStandardWalletProvider as i, setAuthLoading as j, bufferExports as k, setStoredAuthMethod as l, confirmAndCheckTransaction as m, normalizeSolanaRpcUrl as n, defaultInjectedEvmProvider as o, init as p, getCurrentUser as q, resolveSolanaRpcUrl as r, setCurrentUser as s, transactionHasSignature as t, onAuthStateChanged as u, onAuthLoadingChanged as v, getAuthLoading as w, waitForAuthReady as x, login as y, logout as z };
-//# sourceMappingURL=index-B9__gwTi.mjs.map
+//# sourceMappingURL=index-D3kdhCpH.mjs.map