@bounded-sh/client 0.0.111 → 0.0.112-ux-audit.2

package/dist/{index-BghQ8jX0.js → index-DJeEMevo.js}

@@ -56,6 +56,13 @@ function walletOperationGuard() {
             throw new Error('wallet_session_changed');
     };
 }
+function walletLoginGuard(signal) {
+    const generation = ++loginGeneration;
+    return () => {
+        if ((signal === null || signal === void 0 ? void 0 : signal.aborted) || generation !== loginGeneration)
+            throw new Error('wallet_login_cancelled');
+    };
+}
 // This realm owns one active SDK session and one retained signer frame.
 let activeWalletState;
 function setWalletSessionState(key, state) { activeWalletState = { key, state }; }
@@ -277,8 +284,9 @@ class OffchainAuthProvider {
     async logout() {
         await this.wrappedProvider.logout();
     }
-    async restoreSession() {
-        const user = await this.wrappedProvider.restoreSession();
+    async restoreSession(beforeCommit) {
+        const provider = this.wrappedProvider;
+        const user = await provider.restoreSession(beforeCommit);
         if (user) {
             return Object.assign(Object.assign({}, user), { provider: this });
         }
@@ -5532,7 +5540,8 @@ async function loginWithRedirect(opts) {
         return runNativeLogin(opts);
     if (!hasDOM$2())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
-    const { url, pkce } = await buildAuthorize(opts);
+    const { url, pkce } = await untilAborted(buildAuthorize(opts), opts.signal);
+    throwIfCancelled(opts.signal);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
@@ -5561,9 +5570,29 @@ async function completeLoginFromRedirect() {
         throw error;
     return result.user;
 }
+function throwIfCancelled(signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted)
+        throw new Error('cancelled');
+}
+async function untilAborted(work, signal) {
+    if (!signal)
+        return work;
+    throwIfCancelled(signal);
+    let onAbort;
+    try {
+        return await Promise.race([work, new Promise((_, reject) => {
+                onAbort = () => reject(new Error('cancelled'));
+                signal.addEventListener('abort', onAbort, { once: true });
+            })]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
  *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
+    throwIfCancelled(opts.signal);
     if (!hasDOM$2())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
@@ -5581,7 +5610,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts, 'popup');
+        authorization = await untilAborted(buildAuthorize(opts, 'popup'), opts.signal);
     }
     catch (error) {
         try {
@@ -5598,6 +5627,7 @@ async function loginWithPopup(opts) {
     // window with no listener or watchdog attached.
     let expectedOrigin;
     try {
+        throwIfCancelled(opts.signal);
         expectedOrigin = new URL(pkce.redirectUri).origin;
         sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
     }
@@ -5629,20 +5659,42 @@ async function loginWithPopup(opts) {
     setAuthLoading(true); // reflect "signing in…" while the popup is open
     try {
         return await new Promise((resolve, reject) => {
+            var _a, _b;
             let settled = false;
+            let handedOff = false;
+            let committing = false;
             let timer;
             let navigationTimer;
             let completionTimer;
             const cleanup = () => {
-                settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
                 clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
                 removeAttempt(pkce.state);
             };
+            const finish = (error, user) => {
+                var _a;
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.removeEventListener('abort', onAbort);
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_b) { /* ignore */ }
+                if (error)
+                    reject(error);
+                else
+                    resolve(user);
+            };
+            // Provider adoption commits synchronously after its final guard. An auth
+            // listener dismissing the card there cannot cancel an already signed-in user.
+            const onAbort = () => { if (!committing)
+                finish(new Error('cancelled')); };
             const onMsg = async (ev) => {
-                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                if (settled || handedOff || ev.origin !== expectedOrigin || ev.source !== popup)
                     return;
                 const d = ev.data;
                 if (!d || d.type !== 'bounded-oidc-code' ||
@@ -5656,35 +5708,30 @@ async function loginWithPopup(opts) {
                     return;
                 if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
                     return;
+                handedOff = true;
                 cleanup();
                 try {
+                    throwIfCancelled(opts.signal);
                     await validateAttempt(pkce, new URL(d.callbackUrl));
+                    throwIfCancelled(opts.signal);
                     popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
                     if (d.error)
                         throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
-                    const user = await exchangeCode(d.code, pkce);
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_a) { /* ignore */ }
-                    resolve(user);
+                    const user = await exchangeCode(d.code, pkce, opts.signal, () => { committing = true; });
+                    finish(undefined, user);
                 }
                 catch (e) {
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_b) { /* ignore */ }
-                    reject(e);
+                    finish(e);
                 }
             };
+            (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.addEventListener('abort', onAbort, { once: true });
+            if ((_b = opts.signal) === null || _b === void 0 ? void 0 : _b.aborted) {
+                onAbort();
+                return;
+            }
             window.addEventListener('message', onMsg);
             completionTimer = setTimeout(() => {
-                cleanup();
-                try {
-                    popup.close();
-                }
-                catch ( /* ignore */_a) { /* ignore */ }
-                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+                finish(new Error('Login expired or its popup disconnected. Start sign-in again.'));
             }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
@@ -5705,23 +5752,18 @@ async function loginWithPopup(opts) {
             const NAVIGATION_RECHECK_MS = 2000;
             const navigationStartedAt = Date.now();
             const checkNavigation = () => {
-                if (settled || popup.closed)
+                if (settled || handedOff || popup.closed)
                     return;
                 try {
                     if (popup.location.href === 'about:blank') {
                         if (Date.now() - navigationStartedAt >= NAVIGATION_GRACE_MS) {
-                            cleanup();
-                            try {
-                                popup.close();
-                            }
-                            catch ( /* ignore */_a) { /* ignore */ }
-                            reject(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
+                            finish(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
                             return;
                         }
                         navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
                     }
                 }
-                catch ( /* cross-origin hosted auth loaded normally */_b) { /* cross-origin hosted auth loaded normally */ }
+                catch ( /* cross-origin hosted auth loaded normally */_a) { /* cross-origin hosted auth loaded normally */ }
             };
             navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
             // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
@@ -5731,10 +5773,8 @@ async function loginWithPopup(opts) {
             timer = setInterval(() => {
                 if (popup.closed) {
                     clearInterval(timer);
-                    setTimeout(() => { if (!settled) {
-                        cleanup();
-                        reject(new Error('Login window closed'));
-                    } }, 500);
+                    setTimeout(() => { if (!settled && !handedOff)
+                        finish(new Error('Login window closed')); }, 500);
                 }
             }, 500);
         });
@@ -5748,20 +5788,21 @@ async function loginWithPopup(opts) {
 // Turnkey-native login path (authMode:"turnkey"), which mints the session server-side
 // after Turnkey verifies the email OTP - there is no OIDC code to exchange. Wiring is
 // identical to exchangeCode's tail so the realtime worker cannot tell them apart.
-async function establishInlineSession(data, beforeCommit, beforeStore) {
+async function establishInlineSession(data, beforeCommit, beforeStore, onCommitting) {
     const base = await issuerBase();
+    beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();
     const idToken = tokenField(data, 'id_token', 'idToken');
     if (!idToken)
         throw new Error('No id_token in the inline session response');
     const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
     const refreshToken = boundedRefreshTokenField(data);
     const user = userFromIdToken(idToken);
-    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, () => { });
+    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, () => { beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit(); });
     // Adopt the OIDC provider on EVERY session surface - including core's signing
     // pointer (getConfig().authProvider), which this path used to skip, leaving
     // onchain writes routed through a previous (e.g. logged-out wallet) provider.
     try {
-        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit: () => { beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit(); onCommitting === null || onCommitting === void 0 ? void 0 : onCommitting(); } });
     }
     catch (error) {
         if (typeof rollback === 'function')
@@ -5785,9 +5826,10 @@ async function inlineAuthEndpoint() {
     const cfg = await core.getConfig();
     return { base: await issuerBase(), appId: cfg.appId };
 }
-async function exchangeCode(code, pkce) {
+async function exchangeCode(code, pkce, signal, onCommitting) {
     const generation = getInitializationGeneration();
     const beforeCommit = () => {
+        throwIfCancelled(signal);
         if (generation !== getInitializationGeneration())
             throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
     };
@@ -5803,7 +5845,7 @@ async function exchangeCode(code, pkce) {
     let res;
     try {
         res = await fetch(`${base}/api/auth/oauth2/token`, {
-            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(),
+            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(), signal,
         });
     }
     catch (err) {
@@ -5829,7 +5871,7 @@ async function exchangeCode(code, pkce) {
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
     try {
-        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit: () => { beforeCommit(); onCommitting === null || onCommitting === void 0 ? void 0 : onCommitting(); } });
     }
     catch (error) {
         if (typeof rollback === 'function')
@@ -5898,6 +5940,31 @@ function idTokenIsGuest(idToken, expectedAddress) {
 function storedSessionIsGuest() {
     return idTokenIsGuest(getStoredIdToken());
 }
+/** Internal: select a cross-tab restore from bearer claims, never global hints. */
+function storedSessionAuthMethod(config) {
+    try {
+        const token = getStoredIdToken();
+        if (!token)
+            return null;
+        let payload = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        payload += '='.repeat((4 - payload.length % 4) % 4);
+        const claims = JSON.parse(getPlatform().atob(payload));
+        const method = claims.is_anonymous === true ? 'guest'
+            : claims['custom:walletProvider'] === 'turnkey' || claims.email ? 'email'
+                : claims['custom:evmWalletAddress'] ? 'evm-wallet'
+                    : claims['custom:walletAddress'] ? 'phantom' : 'email';
+        if (config.authMethod != null && canonicalWalletAuthMethod(config.authMethod) !== method)
+            return null;
+        if (method === 'evm-wallet' && config.authMethod !== 'evm-wallet')
+            return null;
+        if (method === 'phantom' && (isWalletLoginDisabled(config) || isEmailRequired(config)))
+            return null;
+        return method;
+    }
+    catch (_a) {
+        return null;
+    }
+}
 /**
  * Pick the provider used for an ordinary `init({ appId })` restore.
  *
@@ -6159,9 +6226,10 @@ function optionalProviderError(method) {
         `loginWithRedirect(...) for Bounded Auth, signInAnonymously() for guests, ` +
         `or install/import an explicit wallet-provider entry once your app opts into "${method}".`);
 }
-async function getAuthProvider(config) {
+async function getAuthProvider(config, fromStorage = false) {
     var _a;
-    const nextProviderConfigKey = config ? authProviderConfigKey(config) : null;
+    const requestedAuthMethod = config ? (fromStorage ? storedSessionAuthMethod(config) : authMethodForInit(config)) : null;
+    const nextProviderConfigKey = config ? authProviderConfigKey(Object.assign(Object.assign({}, config), { authMethod: requestedAuthMethod })) : null;
     if (currentAuthProvider && (!config || currentAuthProviderConfigKey === nextProviderConfigKey)) {
         return currentAuthProvider;
     }
@@ -6176,7 +6244,8 @@ async function getAuthProvider(config) {
     initConfig = config;
     // Keep what the app actually wrote for error text; everything else runs on
     // the canonical method so exactly one string reaches storage and the issuer.
-    const requestedAuthMethod = authMethodForInit(config);
+    if (!requestedAuthMethod)
+        throw new Error('The stored session is incompatible with this app authentication configuration.');
     const authMethod = canonicalWalletAuthMethod(requestedAuthMethod);
     const rpcUrl = normalizeSolanaRpcUrl(config.rpcUrl);
     const configuredNetwork = getConfiguredSolanaNetwork(config);
@@ -6201,7 +6270,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-DxS2WYxM.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-53sA5_i2.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6243,7 +6312,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-Cfb4ayCP.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BEYwsn6M.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6256,7 +6325,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-Ckb85p6a.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-IlkuKffc.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6281,7 +6350,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DDBXeHoo.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-00KkSNpE.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6343,7 +6412,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DDBXeHoo.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-00KkSNpE.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6514,7 +6583,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-Cfb4ayCP.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-BEYwsn6M.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6617,7 +6686,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-Cfb4ayCP.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BEYwsn6M.js'); });
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -6889,7 +6958,8 @@ var index = /*#__PURE__*/Object.freeze({
     logout: logout$1,
     preloadWalletLogin: preloadWalletLogin,
     resolveAuthMode: resolveAuthMode,
-    signInAnonymously: signInAnonymously
+    signInAnonymously: signInAnonymously,
+    storedSessionAuthMethod: storedSessionAuthMethod
 });
 
 /**
@@ -6967,12 +7037,80 @@ let isAuthLoading = false;
 let authReadyPromise = null;
 let initializingConfig = null;
 let initializationGeneration = 0;
+let initializedConfig = null;
+let storageBridgeRegistered = false;
+let observedIdToken = null;
+let observedIssuer = null;
+// Storage events carry no authority. Re-read the active manager's app/issuer
+// namespace, then use the ordinary initializer/provider restore and listeners.
+function registerStorageBridge() {
+    if (storageBridgeRegistered || !getPlatform().hasDOM || typeof window === 'undefined')
+        return;
+    storageBridgeRegistered = true;
+    window.addEventListener('storage', (event) => {
+        if (event.storageArea !== window.localStorage || !initializedConfig)
+            return;
+        void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
+    });
+}
+async function syncStoredSession() {
+    const config = initializedConfig;
+    if (!config)
+        return;
+    const token = core.WebSessionManager.getIdToken();
+    const issuer = core.WebSessionManager.getIssuer();
+    if (token === observedIdToken && issuer === observedIssuer)
+        return;
+    observedIdToken = token;
+    observedIssuer = issuer;
+    const generation = ++initializationGeneration;
+    // Hide the former principal while the replacement is validated. This also
+    // reconnects live reads through the existing auth-state change path.
+    setCurrentUser(null);
+    if (authReadyPromise)
+        await authReadyPromise.catch(() => { });
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const record = await core.WebSessionManager.readSessionWithGeneration();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    if (!record)
+        return;
+    const normalize = (url) => (url || '').replace(/\/+$/, '');
+    const resolvedConfig = await core.getConfig();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const allowedIssuers = [normalize(resolvedConfig.humanAuthApiUrl || 'https://auth.bounded.sh'), normalize(resolvedConfig.authApiUrl)].filter(Boolean);
+    // A legacy shared blob can belong to another app. Never restore or clear
+    // that app's credential; the current app remains signed out.
+    if ((record.appId && record.appId !== config.appId)
+        || (record.issuer && !allowedIssuers.includes(normalize(record.issuer))))
+        return;
+    if (!storedSessionAuthMethod(config))
+        return;
+    const restored = startInitialization(config, true);
+    const restoreGeneration = initializationGeneration;
+    try {
+        await restored;
+    }
+    catch (error) {
+        if (restoreGeneration === initializationGeneration && core.WebSessionManager.getIdToken())
+            throw error;
+    }
+}
 /** Internal guard for a login result arriving after the app reconfigured the SDK. */
 function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
-async function initialize(requestedConfig) {
+async function initialize(requestedConfig, fromStorage) {
     const newConfig = withDefaultSolanaRpcUrl(requestedConfig);
+    const generation = initializationGeneration;
+    const validateStorage = fromStorage ? core.WebSessionManager.captureSessionEstablishment() : undefined;
+    const beforeCommit = () => {
+        if (generation !== initializationGeneration)
+            throw new Error('Session restore was superseded.');
+        validateStorage === null || validateStorage === void 0 ? void 0 : validateStorage();
+    };
     // Mark auth as loading for the ENTIRE init/restore window so consumers render
     // a neutral/loading state instead of the signed-out UI while we rehydrate the
     // session — otherwise getCurrentUser() is null + loading is false during the
@@ -6991,8 +7129,9 @@ async function initialize(requestedConfig) {
         // onAuthStateChanged never fired, and every consumer UI went on showing a
         // connected wallet for a session the server no longer knew about.
         registerSessionClearedBridge();
+        registerStorageBridge();
         // Get auth provider first
-        authProviderInstance = await getAuthProvider(newConfig);
+        authProviderInstance = await getAuthProvider(newConfig, fromStorage);
         // Initialize config with auth provider
         await core.init(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
         // A return establishes its own provider/session, or hands off a popup.
@@ -7017,7 +7156,8 @@ async function initialize(requestedConfig) {
         // Wait for restoreSession to complete
         // The appId check is done in SessionManager.getSession which is called by restoreSession
         // If there's an appId mismatch, the session will be cleared and restoreSession will return null
-        let user = await authProviderInstance.restoreSession();
+        let user = await authProviderInstance.restoreSession(beforeCommit);
+        beforeCommit();
         // If a session exists but was created before auth method tracking (legacy session),
         // clear it to avoid mismatches when the app switches auth methods (e.g. email → phantom)
         //
@@ -7025,9 +7165,10 @@ async function initialize(requestedConfig) {
         // unawaited call would return a Promise (always truthy) — nulling the user
         // unconditionally AND letting setCurrentUser run while the old credential
         // was still in storage.
-        if (user && await clearIncompatibleSession()) {
+        if (user && !fromStorage && await clearIncompatibleSession()) {
             user = null;
         }
+        beforeCommit();
         setCurrentUser(user);
         // Mark init as completed
         initCompleted = true;
@@ -7067,13 +7208,17 @@ function sameConfigValue(a, b, seen = new WeakMap()) {
         && sameConfigValue(a[key], b[key], seen));
 }
 function init$1(newConfig) {
+    return startInitialization(newConfig, false);
+}
+function startInitialization(newConfig, fromStorage) {
     if (initializingConfig) {
         if (sameConfigValue(initializingConfig, newConfig)) {
             return authReadyPromise;
         }
         return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
     }
-    initializingConfig = Object.assign({}, newConfig);
+    initializedConfig = Object.assign({}, newConfig);
+    initializingConfig = initializedConfig;
     initializationGeneration++;
     let resolveReady;
     let rejectReady;
@@ -7085,7 +7230,7 @@ function init$1(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
+    void initialize(initializingConfig, fromStorage).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -7158,6 +7303,13 @@ function userPrincipalKey(user) {
 }
 // Update the currentUser and notify listeners
 function setCurrentUser(user) {
+    observedIdToken = getCurrentIdToken();
+    try {
+        observedIssuer = core.getActiveSessionManager().getIssuer();
+    }
+    catch (_a) {
+        observedIssuer = null;
+    }
     // Enrich with the universal identity fields (id/email) derived from the
     // active session's idToken — central chokepoint so every provider's user
     // object gains { id, address, email } without each construction site
@@ -7703,10 +7855,18 @@ async function startTurnkeyEmailLogin(email) {
     if (!hasDOM$1()) {
         throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
     }
+    const generation = getInitializationGeneration();
+    const walletGuard = walletOperationGuard();
+    const assertContext = () => {
+        walletGuard();
+        if (generation !== getInitializationGeneration())
+            throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+    };
     const trimmed = email.trim();
     if (!trimmed)
         throw new Error('Enter your email to continue.');
     const { base, appId } = await inlineAuthEndpoint();
+    assertContext();
     if (!appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
     const res = await fetch(`${base}/wallet/turnkey/auth/init`, {
@@ -7718,6 +7878,7 @@ async function startTurnkeyEmailLogin(email) {
     if (!res.ok || !data || typeof data.otpId !== 'string' || typeof data.otpEncryptionTargetBundle !== 'string') {
         throw new Error(String((data && data.error) || 'Could not send a code. Please try again.'));
     }
+    assertContext();
     const otpId = data.otpId;
     const otpEncryptionTargetBundle = data.otpEncryptionTargetBundle;
     // A tenant-origin login always gets a ceremony id; without one the OTP frame refuses to run
@@ -7733,14 +7894,20 @@ async function startTurnkeyEmailLogin(email) {
         : undefined;
     return {
         email: trimmed, frameUrl, signerOrigin,
-        run(iframe, _signal) {
+        run(iframe, signal) {
+            try {
+                assertContext();
+            }
+            catch (error) {
+                return Promise.reject(error);
+            }
             if (!ceremonyId) {
                 return Promise.reject(new Error('This app is not configured for in-frame wallet login. Please try again.'));
             }
-            const run = { iframe, base, signerOrigin, appId, email: trimmed, otpId, otpEncryptionTargetBundle, ceremonyId };
+            const run = { iframe, base, signerOrigin, appId, email: trimmed, otpId, otpEncryptionTargetBundle, ceremonyId, generation };
             // BSA-2026-004: the login code is typed only in /wallet/turnkey/otp-frame.
             // The scoped signer URL is for post-login signing, not OTP entry.
-            return runOtpFrame(run);
+            return runOtpFrame(run, signal);
         },
     };
 }
@@ -7749,7 +7916,7 @@ async function startTurnkeyEmailLogin(email) {
 //   frame 'result' {session} -> we establish the inline session and resolve the User.
 // When the frame asks for the signing-session authorization ('need-authorization') we mint a
 // createWallet action authorization on THIS (registered) origin and post it in - never a key.
-function runOtpFrame(run) {
+function runOtpFrame(run, signal) {
     const tenantOrigin = window.location.origin;
     const url = `${run.base.replace(/\/$/, '')}/wallet/turnkey/otp-frame`
         + `?appId=${encodeURIComponent(run.appId)}`
@@ -7759,13 +7926,48 @@ function runOtpFrame(run) {
     return new Promise((resolve, reject) => {
         let settled = false;
         let started = false;
-        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); window.clearTimeout(timer); };
+        let receivingResult = false;
+        let committing = false;
+        const walletGuard = walletLoginGuard(signal);
+        const beforeCommit = () => {
+            if (settled)
+                throw new Error('wallet_login_cancelled');
+            walletGuard();
+            if (run.generation !== getInitializationGeneration())
+                throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+        };
+        const finish = (error, user) => {
+            if (settled)
+                return;
+            settled = true;
+            window.removeEventListener('message', onMsg);
+            window.clearTimeout(timer);
+            signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', onAbort);
+            if (error) {
+                // Destroy the expired frame's code/key realm as well as its parent listener.
+                run.iframe.src = 'about:blank';
+                reject(error);
+            }
+            else
+                resolve(user);
+        };
+        const onAbort = () => { if (!committing)
+            finish(new Error('cancelled')); };
         const onMsg = async (event) => {
             if (settled)
                 return;
             // Trust ONLY the signer origin and the frame's own window.
             if (event.origin !== run.signerOrigin || event.source !== run.iframe.contentWindow)
                 return;
+            if (!committing) {
+                try {
+                    beforeCommit();
+                }
+                catch (error) {
+                    finish(error instanceof Error ? error : new Error(String(error)));
+                    return;
+                }
+            }
             const d = event.data;
             if (!d || typeof d !== 'object')
                 return;
@@ -7808,40 +8010,56 @@ function runOtpFrame(run) {
                 return;
             }
             if (d.type === 'bounded:otp:result') {
+                if (receivingResult)
+                    return;
+                receivingResult = true;
                 if (d.ok && d.session && typeof d.session === 'object') {
                     try {
-                        const user = await establishInlineSession(d.session);
-                        cleanup();
-                        resolve(user);
+                        const user = await establishInlineSession(d.session, beforeCommit, undefined, () => { committing = true; });
+                        finish(undefined, user);
                     }
                     catch (error) {
-                        cleanup();
-                        reject(error instanceof Error ? error : new Error(String(error)));
+                        finish(error instanceof Error ? error : new Error(String(error)));
                     }
                     return;
                 }
-                cleanup();
-                reject(new Error(String((d && d.error) || 'Invalid or expired code.')));
+                finish(new Error(String((d && d.error) || 'Invalid or expired code.')));
                 return;
             }
             // 'bounded:otp:registered' is advisory; login does not depend on it.
         };
         const post = (msg) => {
             var _a;
+            if (settled)
+                return;
+            if (!committing) {
+                try {
+                    beforeCommit();
+                }
+                catch (_b) {
+                    return;
+                }
+            }
             try {
                 (_a = run.iframe.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage(msg, run.signerOrigin);
             }
-            catch ( /* frame gone */_b) { /* frame gone */ }
+            catch ( /* frame gone */_c) { /* frame gone */ }
         };
         window.addEventListener('message', onMsg);
         // 3 minutes: the human must read the email and type the code. A frame that never reports is a
         // failed login the user can retry.
         const timer = window.setTimeout(() => {
-            if (settled)
-                return;
-            cleanup();
-            reject(new Error('The sign-in code entry timed out. Please try again.'));
+            if (!committing)
+                finish(new Error('The sign-in code entry timed out. Please try again.'));
         }, 3 * 60 * 1000);
+        signal === null || signal === void 0 ? void 0 : signal.addEventListener('abort', onAbort, { once: true });
+        try {
+            beforeCommit();
+        }
+        catch (error) {
+            finish(error instanceof Error ? error : new Error(String(error)));
+            return;
+        }
         run.iframe.src = url;
     });
 }
@@ -8105,7 +8323,8 @@ async function prepareAndOpen(opts, pending) {
             return authApi.loginWithRedirect(options);
         // Invoke immediately inside the click handler to retain popup activation.
         return authApi.loginWithPopup(options).catch((error) => {
-            if (shouldFallbackToRedirect(error))
+            var _a;
+            if (!((_a = options.signal) === null || _a === void 0 ? void 0 : _a.aborted) && shouldFallbackToRedirect(error))
                 return authApi.loginWithRedirect(options);
             throw error;
         });
@@ -8243,6 +8462,12 @@ async function prepareAndOpen(opts, pending) {
         let activeAttempt = 0;
         let abortScopedLogin = null;
         let abortGesture = null;
+        const startHostedLogin = (options) => {
+            const controller = new AbortController();
+            const abort = () => controller.abort();
+            abortScopedLogin = abort;
+            return hostedLogin(Object.assign(Object.assign({}, options), { signal: controller.signal }));
+        };
         /** Reject a gesture promise already waiting on a view that is going away. */
         const abortPendingGesture = () => {
             const abort = abortGesture;
@@ -8268,6 +8493,7 @@ async function prepareAndOpen(opts, pending) {
             if (!attemptIsCurrent(id))
                 return false;
             activeAttempt = 0;
+            abortScopedLogin = null;
             return true;
         };
         /** Take the card back (Back, a lane switch, settling the modal). Deliberately
@@ -8422,7 +8648,7 @@ async function prepareAndOpen(opts, pending) {
                         loginHint: input.value,
                         redirectUri: opts.redirectUri,
                     };
-                    hostedLogin(emailOpts)
+                    startHostedLogin(emailOpts)
                         // A hosted login that RESOLVES minted a real session, so it settles
                         // the card even if another lane has since taken it - dropping it
                         // would leave the app signed in behind a widget that says it is not.
@@ -8472,7 +8698,7 @@ async function prepareAndOpen(opts, pending) {
                     }
                     setBusy(b, "Opening secure sign-in\u2026");
                     const socialOpts = { provider: method, redirectUri: opts.redirectUri };
-                    hostedLogin(socialOpts)
+                    startHostedLogin(socialOpts)
                         .then((u) => {
                         if (u) {
                             settleAttempt(attempt);
@@ -8722,14 +8948,16 @@ async function prepareAndOpen(opts, pending) {
                 setErr(BUSY_MSG);
                 return card;
             }
-            back.addEventListener("click", () => { settleAttempt(attempt); invalidateAttempts(); swap(renderChoose()); });
+            back.addEventListener("click", () => { invalidateAttempts(); swap(renderChoose()); });
+            const controller = new AbortController();
+            abortScopedLogin = () => controller.abort();
             handle
-                .run(frame)
+                .run(frame, controller.signal)
                 .then((u) => { settleAttempt(attempt); succeed(u); })
                 .catch((err) => {
                 if (!settleAttempt(attempt))
                     return;
-                setErr(errText(err));
+                swap(renderChoose(errText(err)));
             });
             return card;
         };
@@ -10544,8 +10772,9 @@ class PrivyExpoProvider {
         const { signature } = await this.signAndSubmitInternal(transaction, wallet, connection);
         return signature;
     }
-    async restoreSession() {
+    async restoreSession(beforeCommit) {
         const session = await core.getActiveSessionManager().getSession();
+        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();
         if (session) {
             this.authenticatedAddress = session.address;
             return { provider: this, address: session.address };
@@ -11130,4 +11359,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index-BghQ8jX0.js.map
+//# sourceMappingURL=index-DJeEMevo.js.map