@bounded-sh/client 0.0.111 → 0.0.112-ux-audit.2

package/dist/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-BghQ8jX0.js');
+var index = require('./index-DJeEMevo.js');
 var core = require('@bounded-sh/core');
 require('react');
 

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { ag as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, af as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, ae as BUILD_REVIEW_CAPABILITY_SCHEMA, a7 as BuildsApiError, ad as FAILURE_REASONS, a9 as NON_TERMINAL_STATES, a1 as OffchainAuthProvider, ac as PARK_REASONS, a2 as PrivyExpoProvider, ab as RUN_STATES, aa as TERMINAL_STATES, W as WalletConfigError, Q as apps, a6 as builds, I as completeLoginFromRedirect, a4 as connectBroadcast, a5 as connectServiceSession, o as defaultInjectedEvmProvider, f as defaultInjectedProvider, F as ensureSharedWalletLoginReady, M as ensureSignedIn, E as ensureWalletLoginReady, w as getAuthLoading, A as getAuthProvider, q as getCurrentUser, Y as getIdToken, J as getLoginReturnError, S as getOrCreateTurnkeyWallet, g as getPlatform, V as getTurnkeyWalletRecoveryUrl, U as getTurnkeyWalletSessionState, p as init, y as login, K as loginWithPopup, C as loginWithPrivy, H as loginWithRedirect, D as loginWithWallet, z as logout, a8 as mediaAgentTools, v as onAuthLoadingChanged, u as onAuthStateChanged, Z as onramp, _ as onrampQuote, $ as onrampStatus, L as openBoundedWidget, T as openTurnkeyKeyExport, G as preloadWalletLogin, a3 as requestEip6963Providers, a0 as setPlatform, B as signInAnonymously, R as signSolanaMessageViaTurnkey, X as startTurnkeyEmailLogin, N as useAuth, P as useBuildRun, O as useQuery, x as waitForAuthReady } from './index-B9__gwTi.mjs';
+export { ag as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, af as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, ae as BUILD_REVIEW_CAPABILITY_SCHEMA, a7 as BuildsApiError, ad as FAILURE_REASONS, a9 as NON_TERMINAL_STATES, a1 as OffchainAuthProvider, ac as PARK_REASONS, a2 as PrivyExpoProvider, ab as RUN_STATES, aa as TERMINAL_STATES, W as WalletConfigError, Q as apps, a6 as builds, I as completeLoginFromRedirect, a4 as connectBroadcast, a5 as connectServiceSession, o as defaultInjectedEvmProvider, f as defaultInjectedProvider, F as ensureSharedWalletLoginReady, M as ensureSignedIn, E as ensureWalletLoginReady, w as getAuthLoading, A as getAuthProvider, q as getCurrentUser, Y as getIdToken, J as getLoginReturnError, S as getOrCreateTurnkeyWallet, g as getPlatform, V as getTurnkeyWalletRecoveryUrl, U as getTurnkeyWalletSessionState, p as init, y as login, K as loginWithPopup, C as loginWithPrivy, H as loginWithRedirect, D as loginWithWallet, z as logout, a8 as mediaAgentTools, v as onAuthLoadingChanged, u as onAuthStateChanged, Z as onramp, _ as onrampQuote, $ as onrampStatus, L as openBoundedWidget, T as openTurnkeyKeyExport, G as preloadWalletLogin, a3 as requestEip6963Providers, a0 as setPlatform, B as signInAnonymously, R as signSolanaMessageViaTurnkey, X as startTurnkeyEmailLogin, N as useAuth, P as useBuildRun, O as useQuery, x as waitForAuthReady } from './index-D3kdhCpH.mjs';
 export * from '@bounded-sh/core';
 export { AppTokenExchangeError, BoundedDeclineError, DECLINE_EVENT_NAME, RATE_LIMIT_EVENT_NAME, ScopedClientReadOnlyError, aggregate, clearAppTokenCache, count, createAppTokenAuthHeaders, createClient, deriveDecline, dispatchDeclineEvent, dispatchRateLimitEvent, docId, exchangeAppToken, get, getConfig, getFiles, getMany, queryAggregate, reconcileSetResult, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe, waitForSetResult } from '@bounded-sh/core';
 import 'react';

package/dist/{index.native-BHjpXkKQ.mjs → index.native-CAH_ks0s.mjs}

@@ -1,4 +1,4 @@
-import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, onSessionCleared, deriveUserIdentityFromIdToken, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, init as init$1, deriveUserIdentityFromIdToken, onSessionCleared, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 function walletContextFromClaims(claims, baseUrl, expectedAppId, tenantOrigin) {
@@ -215,8 +215,9 @@ class OffchainAuthProvider {
     async logout() {
         await this.wrappedProvider.logout();
     }
-    async restoreSession() {
-        const user = await this.wrappedProvider.restoreSession();
+    async restoreSession(beforeCommit) {
+        const provider = this.wrappedProvider;
+        const user = await provider.restoreSession(beforeCommit);
         if (user) {
             return Object.assign(Object.assign({}, user), { provider: this });
         }
@@ -5276,7 +5277,8 @@ async function loginWithRedirect(opts) {
         return runNativeLogin(opts);
     if (!hasDOM$1())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
-    const { url, pkce } = await buildAuthorize(opts);
+    const { url, pkce } = await untilAborted(buildAuthorize(opts), opts.signal);
+    throwIfCancelled(opts.signal);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
@@ -5305,9 +5307,29 @@ async function completeLoginFromRedirect() {
         throw error;
     return result.user;
 }
+function throwIfCancelled(signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted)
+        throw new Error('cancelled');
+}
+async function untilAborted(work, signal) {
+    if (!signal)
+        return work;
+    throwIfCancelled(signal);
+    let onAbort;
+    try {
+        return await Promise.race([work, new Promise((_, reject) => {
+                onAbort = () => reject(new Error('cancelled'));
+                signal.addEventListener('abort', onAbort, { once: true });
+            })]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
  *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
+    throwIfCancelled(opts.signal);
     if (!hasDOM$1())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
@@ -5325,7 +5347,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts, 'popup');
+        authorization = await untilAborted(buildAuthorize(opts, 'popup'), opts.signal);
     }
     catch (error) {
         try {
@@ -5342,6 +5364,7 @@ async function loginWithPopup(opts) {
     // window with no listener or watchdog attached.
     let expectedOrigin;
     try {
+        throwIfCancelled(opts.signal);
         expectedOrigin = new URL(pkce.redirectUri).origin;
         sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
     }
@@ -5373,20 +5396,42 @@ async function loginWithPopup(opts) {
     setAuthLoading(true); // reflect "signing in…" while the popup is open
     try {
         return await new Promise((resolve, reject) => {
+            var _a, _b;
             let settled = false;
+            let handedOff = false;
+            let committing = false;
             let timer;
             let navigationTimer;
             let completionTimer;
             const cleanup = () => {
-                settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
                 clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
                 removeAttempt(pkce.state);
             };
+            const finish = (error, user) => {
+                var _a;
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.removeEventListener('abort', onAbort);
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_b) { /* ignore */ }
+                if (error)
+                    reject(error);
+                else
+                    resolve(user);
+            };
+            // Provider adoption commits synchronously after its final guard. An auth
+            // listener dismissing the card there cannot cancel an already signed-in user.
+            const onAbort = () => { if (!committing)
+                finish(new Error('cancelled')); };
             const onMsg = async (ev) => {
-                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                if (settled || handedOff || ev.origin !== expectedOrigin || ev.source !== popup)
                     return;
                 const d = ev.data;
                 if (!d || d.type !== 'bounded-oidc-code' ||
@@ -5400,35 +5445,30 @@ async function loginWithPopup(opts) {
                     return;
                 if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
                     return;
+                handedOff = true;
                 cleanup();
                 try {
+                    throwIfCancelled(opts.signal);
                     await validateAttempt(pkce, new URL(d.callbackUrl));
+                    throwIfCancelled(opts.signal);
                     popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
                     if (d.error)
                         throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
-                    const user = await exchangeCode(d.code, pkce);
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_a) { /* ignore */ }
-                    resolve(user);
+                    const user = await exchangeCode(d.code, pkce, opts.signal, () => { committing = true; });
+                    finish(undefined, user);
                 }
                 catch (e) {
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_b) { /* ignore */ }
-                    reject(e);
+                    finish(e);
                 }
             };
+            (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.addEventListener('abort', onAbort, { once: true });
+            if ((_b = opts.signal) === null || _b === void 0 ? void 0 : _b.aborted) {
+                onAbort();
+                return;
+            }
             window.addEventListener('message', onMsg);
             completionTimer = setTimeout(() => {
-                cleanup();
-                try {
-                    popup.close();
-                }
-                catch ( /* ignore */_a) { /* ignore */ }
-                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+                finish(new Error('Login expired or its popup disconnected. Start sign-in again.'));
             }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
@@ -5449,23 +5489,18 @@ async function loginWithPopup(opts) {
             const NAVIGATION_RECHECK_MS = 2000;
             const navigationStartedAt = Date.now();
             const checkNavigation = () => {
-                if (settled || popup.closed)
+                if (settled || handedOff || popup.closed)
                     return;
                 try {
                     if (popup.location.href === 'about:blank') {
                         if (Date.now() - navigationStartedAt >= NAVIGATION_GRACE_MS) {
-                            cleanup();
-                            try {
-                                popup.close();
-                            }
-                            catch ( /* ignore */_a) { /* ignore */ }
-                            reject(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
+                            finish(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
                             return;
                         }
                         navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
                     }
                 }
-                catch ( /* cross-origin hosted auth loaded normally */_b) { /* cross-origin hosted auth loaded normally */ }
+                catch ( /* cross-origin hosted auth loaded normally */_a) { /* cross-origin hosted auth loaded normally */ }
             };
             navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
             // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
@@ -5475,10 +5510,8 @@ async function loginWithPopup(opts) {
             timer = setInterval(() => {
                 if (popup.closed) {
                     clearInterval(timer);
-                    setTimeout(() => { if (!settled) {
-                        cleanup();
-                        reject(new Error('Login window closed'));
-                    } }, 500);
+                    setTimeout(() => { if (!settled && !handedOff)
+                        finish(new Error('Login window closed')); }, 500);
                 }
             }, 500);
         });
@@ -5487,9 +5520,10 @@ async function loginWithPopup(opts) {
         setAuthLoading(false);
     }
 }
-async function exchangeCode(code, pkce) {
+async function exchangeCode(code, pkce, signal, onCommitting) {
     const generation = getInitializationGeneration();
     const beforeCommit = () => {
+        throwIfCancelled(signal);
         if (generation !== getInitializationGeneration())
             throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
     };
@@ -5505,7 +5539,7 @@ async function exchangeCode(code, pkce) {
     let res;
     try {
         res = await fetch(`${base}/api/auth/oauth2/token`, {
-            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(),
+            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(), signal,
         });
     }
     catch (err) {
@@ -5531,7 +5565,7 @@ async function exchangeCode(code, pkce) {
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
     try {
-        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit: () => { beforeCommit(); onCommitting === null || onCommitting === void 0 ? void 0 : onCommitting(); } });
     }
     catch (error) {
         if (typeof rollback === 'function')
@@ -5600,6 +5634,31 @@ function idTokenIsGuest(idToken, expectedAddress) {
 function storedSessionIsGuest() {
     return idTokenIsGuest(getStoredIdToken());
 }
+/** Internal: select a cross-tab restore from bearer claims, never global hints. */
+function storedSessionAuthMethod(config) {
+    try {
+        const token = getStoredIdToken();
+        if (!token)
+            return null;
+        let payload = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        payload += '='.repeat((4 - payload.length % 4) % 4);
+        const claims = JSON.parse(getPlatform().atob(payload));
+        const method = claims.is_anonymous === true ? 'guest'
+            : claims['custom:walletProvider'] === 'turnkey' || claims.email ? 'email'
+                : claims['custom:evmWalletAddress'] ? 'evm-wallet'
+                    : claims['custom:walletAddress'] ? 'phantom' : 'email';
+        if (config.authMethod != null && canonicalWalletAuthMethod(config.authMethod) !== method)
+            return null;
+        if (method === 'evm-wallet' && config.authMethod !== 'evm-wallet')
+            return null;
+        if (method === 'phantom' && (isWalletLoginDisabled(config) || isEmailRequired(config)))
+            return null;
+        return method;
+    }
+    catch (_a) {
+        return null;
+    }
+}
 /**
  * Pick the provider used for an ordinary `init({ appId })` restore.
  *
@@ -5846,9 +5905,10 @@ function optionalProviderError(method) {
         `loginWithRedirect(...) for Bounded Auth, signInAnonymously() for guests, ` +
         `or install/import an explicit wallet-provider entry once your app opts into "${method}".`);
 }
-async function getAuthProvider(config) {
+async function getAuthProvider(config, fromStorage = false) {
     var _a;
-    const nextProviderConfigKey = config ? authProviderConfigKey(config) : null;
+    const requestedAuthMethod = config ? (fromStorage ? storedSessionAuthMethod(config) : authMethodForInit(config)) : null;
+    const nextProviderConfigKey = config ? authProviderConfigKey(Object.assign(Object.assign({}, config), { authMethod: requestedAuthMethod })) : null;
     if (currentAuthProvider && (!config || currentAuthProviderConfigKey === nextProviderConfigKey)) {
         return currentAuthProvider;
     }
@@ -5863,7 +5923,8 @@ async function getAuthProvider(config) {
     initConfig = config;
     // Keep what the app actually wrote for error text; everything else runs on
     // the canonical method so exactly one string reaches storage and the issuer.
-    const requestedAuthMethod = authMethodForInit(config);
+    if (!requestedAuthMethod)
+        throw new Error('The stored session is incompatible with this app authentication configuration.');
     const authMethod = canonicalWalletAuthMethod(requestedAuthMethod);
     const rpcUrl = normalizeSolanaRpcUrl(config.rpcUrl);
     const configuredNetwork = getConfiguredSolanaNetwork(config);
@@ -5888,7 +5949,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-CVp6hSCo.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-BfCH7K6N.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -5930,7 +5991,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BEuj4sM3.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-CfYNIIHd.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -5943,7 +6004,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-BUjqxQxp.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-DXjwPjLW.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -5968,7 +6029,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-Cc8y4Qd1.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-DjOFjtnk.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6030,7 +6091,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-Cc8y4Qd1.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-DjOFjtnk.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6201,7 +6262,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-BEuj4sM3.mjs');
+            await import('./injected-wallet-provider-CfYNIIHd.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6497,12 +6558,80 @@ let isAuthLoading = false;
 let authReadyPromise = null;
 let initializingConfig = null;
 let initializationGeneration = 0;
+let initializedConfig = null;
+let storageBridgeRegistered = false;
+let observedIdToken = null;
+let observedIssuer = null;
+// Storage events carry no authority. Re-read the active manager's app/issuer
+// namespace, then use the ordinary initializer/provider restore and listeners.
+function registerStorageBridge() {
+    if (storageBridgeRegistered || !getPlatform().hasDOM || typeof window === 'undefined')
+        return;
+    storageBridgeRegistered = true;
+    window.addEventListener('storage', (event) => {
+        if (event.storageArea !== window.localStorage || !initializedConfig)
+            return;
+        void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
+    });
+}
+async function syncStoredSession() {
+    const config = initializedConfig;
+    if (!config)
+        return;
+    const token = WebSessionManager.getIdToken();
+    const issuer = WebSessionManager.getIssuer();
+    if (token === observedIdToken && issuer === observedIssuer)
+        return;
+    observedIdToken = token;
+    observedIssuer = issuer;
+    const generation = ++initializationGeneration;
+    // Hide the former principal while the replacement is validated. This also
+    // reconnects live reads through the existing auth-state change path.
+    setCurrentUser(null);
+    if (authReadyPromise)
+        await authReadyPromise.catch(() => { });
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const record = await WebSessionManager.readSessionWithGeneration();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    if (!record)
+        return;
+    const normalize = (url) => (url || '').replace(/\/+$/, '');
+    const resolvedConfig = await getConfig();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const allowedIssuers = [normalize(resolvedConfig.humanAuthApiUrl || 'https://auth.bounded.sh'), normalize(resolvedConfig.authApiUrl)].filter(Boolean);
+    // A legacy shared blob can belong to another app. Never restore or clear
+    // that app's credential; the current app remains signed out.
+    if ((record.appId && record.appId !== config.appId)
+        || (record.issuer && !allowedIssuers.includes(normalize(record.issuer))))
+        return;
+    if (!storedSessionAuthMethod(config))
+        return;
+    const restored = startInitialization(config, true);
+    const restoreGeneration = initializationGeneration;
+    try {
+        await restored;
+    }
+    catch (error) {
+        if (restoreGeneration === initializationGeneration && WebSessionManager.getIdToken())
+            throw error;
+    }
+}
 /** Internal guard for a login result arriving after the app reconfigured the SDK. */
 function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
-async function initialize(requestedConfig) {
+async function initialize(requestedConfig, fromStorage) {
     const newConfig = withDefaultSolanaRpcUrl(requestedConfig);
+    const generation = initializationGeneration;
+    const validateStorage = fromStorage ? WebSessionManager.captureSessionEstablishment() : undefined;
+    const beforeCommit = () => {
+        if (generation !== initializationGeneration)
+            throw new Error('Session restore was superseded.');
+        validateStorage === null || validateStorage === void 0 ? void 0 : validateStorage();
+    };
     // Mark auth as loading for the ENTIRE init/restore window so consumers render
     // a neutral/loading state instead of the signed-out UI while we rehydrate the
     // session — otherwise getCurrentUser() is null + loading is false during the
@@ -6521,8 +6650,9 @@ async function initialize(requestedConfig) {
         // onAuthStateChanged never fired, and every consumer UI went on showing a
         // connected wallet for a session the server no longer knew about.
         registerSessionClearedBridge();
+        registerStorageBridge();
         // Get auth provider first
-        authProviderInstance = await getAuthProvider(newConfig);
+        authProviderInstance = await getAuthProvider(newConfig, fromStorage);
         // Initialize config with auth provider
         await init$1(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
         // A return establishes its own provider/session, or hands off a popup.
@@ -6547,7 +6677,8 @@ async function initialize(requestedConfig) {
         // Wait for restoreSession to complete
         // The appId check is done in SessionManager.getSession which is called by restoreSession
         // If there's an appId mismatch, the session will be cleared and restoreSession will return null
-        let user = await authProviderInstance.restoreSession();
+        let user = await authProviderInstance.restoreSession(beforeCommit);
+        beforeCommit();
         // If a session exists but was created before auth method tracking (legacy session),
         // clear it to avoid mismatches when the app switches auth methods (e.g. email → phantom)
         //
@@ -6555,9 +6686,10 @@ async function initialize(requestedConfig) {
         // unawaited call would return a Promise (always truthy) — nulling the user
         // unconditionally AND letting setCurrentUser run while the old credential
         // was still in storage.
-        if (user && await clearIncompatibleSession()) {
+        if (user && !fromStorage && await clearIncompatibleSession()) {
             user = null;
         }
+        beforeCommit();
         setCurrentUser(user);
         // Mark init as completed
         initCompleted = true;
@@ -6597,13 +6729,17 @@ function sameConfigValue(a, b, seen = new WeakMap()) {
         && sameConfigValue(a[key], b[key], seen));
 }
 function init(newConfig) {
+    return startInitialization(newConfig, false);
+}
+function startInitialization(newConfig, fromStorage) {
     if (initializingConfig) {
         if (sameConfigValue(initializingConfig, newConfig)) {
             return authReadyPromise;
         }
         return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
     }
-    initializingConfig = Object.assign({}, newConfig);
+    initializedConfig = Object.assign({}, newConfig);
+    initializingConfig = initializedConfig;
     initializationGeneration++;
     let resolveReady;
     let rejectReady;
@@ -6615,7 +6751,7 @@ function init(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
+    void initialize(initializingConfig, fromStorage).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -6688,6 +6824,13 @@ function userPrincipalKey(user) {
 }
 // Update the currentUser and notify listeners
 function setCurrentUser(user) {
+    observedIdToken = getCurrentIdToken();
+    try {
+        observedIssuer = getActiveSessionManager().getIssuer();
+    }
+    catch (_a) {
+        observedIssuer = null;
+    }
     // Enrich with the universal identity fields (id/email) derived from the
     // active session's idToken — central chokepoint so every provider's user
     // object gains { id, address, email } without each construction site
@@ -8490,8 +8633,9 @@ class PrivyExpoProvider {
         const { signature } = await this.signAndSubmitInternal(transaction, wallet, connection);
         return signature;
     }
-    async restoreSession() {
+    async restoreSession(beforeCommit) {
         const session = await getActiveSessionManager().getSession();
+        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();
         if (session) {
             this.authenticatedAddress = session.address;
             return { provider: this, address: session.address };
@@ -8598,4 +8742,4 @@ class PrivyExpoProvider {
 }
 
 export { BUILD_REVIEW_CAPABILITY_SCHEMA as $, logout as A, getAuthProvider as B, signInAnonymously as C, loginWithPrivy as D, loginWithRedirect as E, completeLoginFromRedirect as F, getLoginReturnError as G, loginWithPopup as H, useAuth as I, useQuery as J, useBuildRun as K, apps as L, getIdToken as M, onramp as N, onrampQuote as O, onrampStatus as P, setPlatform as Q, OffchainAuthProvider as R, PrivyExpoProvider as S, builds as T, BuildsApiError as U, mediaAgentTools as V, NON_TERMINAL_STATES as W, TERMINAL_STATES as X, RUN_STATES as Y, PARK_REASONS as Z, FAILURE_REASONS as _, signMessageWithTurnkey as a, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a0, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a1, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, getWallets as f, getPlatform as g, hasTurnkeyWallet as h, isSolanaMobileWallet as i, solanaMobileWalletLeavesPage as j, setAuthLoading as k, bufferExports as l, setStoredAuthMethod as m, normalizeSolanaRpcUrl as n, confirmAndCheckTransaction as o, resolveSolanaRpcUrl as p, init as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, getCurrentUser as u, onAuthStateChanged as v, onAuthLoadingChanged as w, getAuthLoading as x, waitForAuthReady as y, login as z };
-//# sourceMappingURL=index.native-BHjpXkKQ.mjs.map
+//# sourceMappingURL=index.native-CAH_ks0s.mjs.map