@bounded-sh/client 0.0.111 → 0.0.112-ux-audit.2

package/dist/{index.native-B_AFa0GD.js → index.native-ingNhWPw.js}

@@ -236,8 +236,9 @@ class OffchainAuthProvider {
     async logout() {
         await this.wrappedProvider.logout();
     }
-    async restoreSession() {
-        const user = await this.wrappedProvider.restoreSession();
+    async restoreSession(beforeCommit) {
+        const provider = this.wrappedProvider;
+        const user = await provider.restoreSession(beforeCommit);
         if (user) {
             return Object.assign(Object.assign({}, user), { provider: this });
         }
@@ -5297,7 +5298,8 @@ async function loginWithRedirect(opts) {
         return runNativeLogin(opts);
     if (!hasDOM$1())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
-    const { url, pkce } = await buildAuthorize(opts);
+    const { url, pkce } = await untilAborted(buildAuthorize(opts), opts.signal);
+    throwIfCancelled(opts.signal);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
@@ -5326,9 +5328,29 @@ async function completeLoginFromRedirect() {
         throw error;
     return result.user;
 }
+function throwIfCancelled(signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted)
+        throw new Error('cancelled');
+}
+async function untilAborted(work, signal) {
+    if (!signal)
+        return work;
+    throwIfCancelled(signal);
+    let onAbort;
+    try {
+        return await Promise.race([work, new Promise((_, reject) => {
+                onAbort = () => reject(new Error('cancelled'));
+                signal.addEventListener('abort', onAbort, { once: true });
+            })]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
  *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
+    throwIfCancelled(opts.signal);
     if (!hasDOM$1())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
@@ -5346,7 +5368,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts, 'popup');
+        authorization = await untilAborted(buildAuthorize(opts, 'popup'), opts.signal);
     }
     catch (error) {
         try {
@@ -5363,6 +5385,7 @@ async function loginWithPopup(opts) {
     // window with no listener or watchdog attached.
     let expectedOrigin;
     try {
+        throwIfCancelled(opts.signal);
         expectedOrigin = new URL(pkce.redirectUri).origin;
         sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
     }
@@ -5394,20 +5417,42 @@ async function loginWithPopup(opts) {
     setAuthLoading(true); // reflect "signing in…" while the popup is open
     try {
         return await new Promise((resolve, reject) => {
+            var _a, _b;
             let settled = false;
+            let handedOff = false;
+            let committing = false;
             let timer;
             let navigationTimer;
             let completionTimer;
             const cleanup = () => {
-                settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
                 clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
                 removeAttempt(pkce.state);
             };
+            const finish = (error, user) => {
+                var _a;
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.removeEventListener('abort', onAbort);
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_b) { /* ignore */ }
+                if (error)
+                    reject(error);
+                else
+                    resolve(user);
+            };
+            // Provider adoption commits synchronously after its final guard. An auth
+            // listener dismissing the card there cannot cancel an already signed-in user.
+            const onAbort = () => { if (!committing)
+                finish(new Error('cancelled')); };
             const onMsg = async (ev) => {
-                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                if (settled || handedOff || ev.origin !== expectedOrigin || ev.source !== popup)
                     return;
                 const d = ev.data;
                 if (!d || d.type !== 'bounded-oidc-code' ||
@@ -5421,35 +5466,30 @@ async function loginWithPopup(opts) {
                     return;
                 if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
                     return;
+                handedOff = true;
                 cleanup();
                 try {
+                    throwIfCancelled(opts.signal);
                     await validateAttempt(pkce, new URL(d.callbackUrl));
+                    throwIfCancelled(opts.signal);
                     popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
                     if (d.error)
                         throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
-                    const user = await exchangeCode(d.code, pkce);
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_a) { /* ignore */ }
-                    resolve(user);
+                    const user = await exchangeCode(d.code, pkce, opts.signal, () => { committing = true; });
+                    finish(undefined, user);
                 }
                 catch (e) {
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_b) { /* ignore */ }
-                    reject(e);
+                    finish(e);
                 }
             };
+            (_a = opts.signal) === null || _a === void 0 ? void 0 : _a.addEventListener('abort', onAbort, { once: true });
+            if ((_b = opts.signal) === null || _b === void 0 ? void 0 : _b.aborted) {
+                onAbort();
+                return;
+            }
             window.addEventListener('message', onMsg);
             completionTimer = setTimeout(() => {
-                cleanup();
-                try {
-                    popup.close();
-                }
-                catch ( /* ignore */_a) { /* ignore */ }
-                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+                finish(new Error('Login expired or its popup disconnected. Start sign-in again.'));
             }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
@@ -5470,23 +5510,18 @@ async function loginWithPopup(opts) {
             const NAVIGATION_RECHECK_MS = 2000;
             const navigationStartedAt = Date.now();
             const checkNavigation = () => {
-                if (settled || popup.closed)
+                if (settled || handedOff || popup.closed)
                     return;
                 try {
                     if (popup.location.href === 'about:blank') {
                         if (Date.now() - navigationStartedAt >= NAVIGATION_GRACE_MS) {
-                            cleanup();
-                            try {
-                                popup.close();
-                            }
-                            catch ( /* ignore */_a) { /* ignore */ }
-                            reject(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
+                            finish(new Error('Popup stalled at about:blank - use loginWithRedirect() instead'));
                             return;
                         }
                         navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
                     }
                 }
-                catch ( /* cross-origin hosted auth loaded normally */_b) { /* cross-origin hosted auth loaded normally */ }
+                catch ( /* cross-origin hosted auth loaded normally */_a) { /* cross-origin hosted auth loaded normally */ }
             };
             navigationTimer = setTimeout(checkNavigation, NAVIGATION_RECHECK_MS);
             // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
@@ -5496,10 +5531,8 @@ async function loginWithPopup(opts) {
             timer = setInterval(() => {
                 if (popup.closed) {
                     clearInterval(timer);
-                    setTimeout(() => { if (!settled) {
-                        cleanup();
-                        reject(new Error('Login window closed'));
-                    } }, 500);
+                    setTimeout(() => { if (!settled && !handedOff)
+                        finish(new Error('Login window closed')); }, 500);
                 }
             }, 500);
         });
@@ -5508,9 +5541,10 @@ async function loginWithPopup(opts) {
         setAuthLoading(false);
     }
 }
-async function exchangeCode(code, pkce) {
+async function exchangeCode(code, pkce, signal, onCommitting) {
     const generation = getInitializationGeneration();
     const beforeCommit = () => {
+        throwIfCancelled(signal);
         if (generation !== getInitializationGeneration())
             throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
     };
@@ -5526,7 +5560,7 @@ async function exchangeCode(code, pkce) {
     let res;
     try {
         res = await fetch(`${base}/api/auth/oauth2/token`, {
-            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(),
+            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(), signal,
         });
     }
     catch (err) {
@@ -5552,7 +5586,7 @@ async function exchangeCode(code, pkce) {
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
     try {
-        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit: () => { beforeCommit(); onCommitting === null || onCommitting === void 0 ? void 0 : onCommitting(); } });
     }
     catch (error) {
         if (typeof rollback === 'function')
@@ -5621,6 +5655,31 @@ function idTokenIsGuest(idToken, expectedAddress) {
 function storedSessionIsGuest() {
     return idTokenIsGuest(getStoredIdToken());
 }
+/** Internal: select a cross-tab restore from bearer claims, never global hints. */
+function storedSessionAuthMethod(config) {
+    try {
+        const token = getStoredIdToken();
+        if (!token)
+            return null;
+        let payload = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        payload += '='.repeat((4 - payload.length % 4) % 4);
+        const claims = JSON.parse(getPlatform().atob(payload));
+        const method = claims.is_anonymous === true ? 'guest'
+            : claims['custom:walletProvider'] === 'turnkey' || claims.email ? 'email'
+                : claims['custom:evmWalletAddress'] ? 'evm-wallet'
+                    : claims['custom:walletAddress'] ? 'phantom' : 'email';
+        if (config.authMethod != null && canonicalWalletAuthMethod(config.authMethod) !== method)
+            return null;
+        if (method === 'evm-wallet' && config.authMethod !== 'evm-wallet')
+            return null;
+        if (method === 'phantom' && (isWalletLoginDisabled(config) || isEmailRequired(config)))
+            return null;
+        return method;
+    }
+    catch (_a) {
+        return null;
+    }
+}
 /**
  * Pick the provider used for an ordinary `init({ appId })` restore.
  *
@@ -5867,9 +5926,10 @@ function optionalProviderError(method) {
         `loginWithRedirect(...) for Bounded Auth, signInAnonymously() for guests, ` +
         `or install/import an explicit wallet-provider entry once your app opts into "${method}".`);
 }
-async function getAuthProvider(config) {
+async function getAuthProvider(config, fromStorage = false) {
     var _a;
-    const nextProviderConfigKey = config ? authProviderConfigKey(config) : null;
+    const requestedAuthMethod = config ? (fromStorage ? storedSessionAuthMethod(config) : authMethodForInit(config)) : null;
+    const nextProviderConfigKey = config ? authProviderConfigKey(Object.assign(Object.assign({}, config), { authMethod: requestedAuthMethod })) : null;
     if (currentAuthProvider && (!config || currentAuthProviderConfigKey === nextProviderConfigKey)) {
         return currentAuthProvider;
     }
@@ -5884,7 +5944,8 @@ async function getAuthProvider(config) {
     initConfig = config;
     // Keep what the app actually wrote for error text; everything else runs on
     // the canonical method so exactly one string reaches storage and the issuer.
-    const requestedAuthMethod = authMethodForInit(config);
+    if (!requestedAuthMethod)
+        throw new Error('The stored session is incompatible with this app authentication configuration.');
     const authMethod = canonicalWalletAuthMethod(requestedAuthMethod);
     const rpcUrl = normalizeSolanaRpcUrl(config.rpcUrl);
     const configuredNetwork = getConfiguredSolanaNetwork(config);
@@ -5909,7 +5970,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CiqhQ1c2.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-DTrCfOJd.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -5951,7 +6012,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CUKdAuFu.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-DSlHfgMU.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -5964,7 +6025,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-DeLUwvGs.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-Cao1U0NZ.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -5989,7 +6050,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-D9FGNuP9.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Tndt6tzJ.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6051,7 +6112,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-D9FGNuP9.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Tndt6tzJ.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6222,7 +6283,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-CUKdAuFu.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-DSlHfgMU.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6518,12 +6579,80 @@ let isAuthLoading = false;
 let authReadyPromise = null;
 let initializingConfig = null;
 let initializationGeneration = 0;
+let initializedConfig = null;
+let storageBridgeRegistered = false;
+let observedIdToken = null;
+let observedIssuer = null;
+// Storage events carry no authority. Re-read the active manager's app/issuer
+// namespace, then use the ordinary initializer/provider restore and listeners.
+function registerStorageBridge() {
+    if (storageBridgeRegistered || !getPlatform().hasDOM || typeof window === 'undefined')
+        return;
+    storageBridgeRegistered = true;
+    window.addEventListener('storage', (event) => {
+        if (event.storageArea !== window.localStorage || !initializedConfig)
+            return;
+        void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
+    });
+}
+async function syncStoredSession() {
+    const config = initializedConfig;
+    if (!config)
+        return;
+    const token = core.WebSessionManager.getIdToken();
+    const issuer = core.WebSessionManager.getIssuer();
+    if (token === observedIdToken && issuer === observedIssuer)
+        return;
+    observedIdToken = token;
+    observedIssuer = issuer;
+    const generation = ++initializationGeneration;
+    // Hide the former principal while the replacement is validated. This also
+    // reconnects live reads through the existing auth-state change path.
+    setCurrentUser(null);
+    if (authReadyPromise)
+        await authReadyPromise.catch(() => { });
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const record = await core.WebSessionManager.readSessionWithGeneration();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    if (!record)
+        return;
+    const normalize = (url) => (url || '').replace(/\/+$/, '');
+    const resolvedConfig = await core.getConfig();
+    if (generation !== initializationGeneration || config !== initializedConfig)
+        return;
+    const allowedIssuers = [normalize(resolvedConfig.humanAuthApiUrl || 'https://auth.bounded.sh'), normalize(resolvedConfig.authApiUrl)].filter(Boolean);
+    // A legacy shared blob can belong to another app. Never restore or clear
+    // that app's credential; the current app remains signed out.
+    if ((record.appId && record.appId !== config.appId)
+        || (record.issuer && !allowedIssuers.includes(normalize(record.issuer))))
+        return;
+    if (!storedSessionAuthMethod(config))
+        return;
+    const restored = startInitialization(config, true);
+    const restoreGeneration = initializationGeneration;
+    try {
+        await restored;
+    }
+    catch (error) {
+        if (restoreGeneration === initializationGeneration && core.WebSessionManager.getIdToken())
+            throw error;
+    }
+}
 /** Internal guard for a login result arriving after the app reconfigured the SDK. */
 function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
-async function initialize(requestedConfig) {
+async function initialize(requestedConfig, fromStorage) {
     const newConfig = withDefaultSolanaRpcUrl(requestedConfig);
+    const generation = initializationGeneration;
+    const validateStorage = fromStorage ? core.WebSessionManager.captureSessionEstablishment() : undefined;
+    const beforeCommit = () => {
+        if (generation !== initializationGeneration)
+            throw new Error('Session restore was superseded.');
+        validateStorage === null || validateStorage === void 0 ? void 0 : validateStorage();
+    };
     // Mark auth as loading for the ENTIRE init/restore window so consumers render
     // a neutral/loading state instead of the signed-out UI while we rehydrate the
     // session — otherwise getCurrentUser() is null + loading is false during the
@@ -6542,8 +6671,9 @@ async function initialize(requestedConfig) {
         // onAuthStateChanged never fired, and every consumer UI went on showing a
         // connected wallet for a session the server no longer knew about.
         registerSessionClearedBridge();
+        registerStorageBridge();
         // Get auth provider first
-        authProviderInstance = await getAuthProvider(newConfig);
+        authProviderInstance = await getAuthProvider(newConfig, fromStorage);
         // Initialize config with auth provider
         await core.init(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
         // A return establishes its own provider/session, or hands off a popup.
@@ -6568,7 +6698,8 @@ async function initialize(requestedConfig) {
         // Wait for restoreSession to complete
         // The appId check is done in SessionManager.getSession which is called by restoreSession
         // If there's an appId mismatch, the session will be cleared and restoreSession will return null
-        let user = await authProviderInstance.restoreSession();
+        let user = await authProviderInstance.restoreSession(beforeCommit);
+        beforeCommit();
         // If a session exists but was created before auth method tracking (legacy session),
         // clear it to avoid mismatches when the app switches auth methods (e.g. email → phantom)
         //
@@ -6576,9 +6707,10 @@ async function initialize(requestedConfig) {
         // unawaited call would return a Promise (always truthy) — nulling the user
         // unconditionally AND letting setCurrentUser run while the old credential
         // was still in storage.
-        if (user && await clearIncompatibleSession()) {
+        if (user && !fromStorage && await clearIncompatibleSession()) {
             user = null;
         }
+        beforeCommit();
         setCurrentUser(user);
         // Mark init as completed
         initCompleted = true;
@@ -6618,13 +6750,17 @@ function sameConfigValue(a, b, seen = new WeakMap()) {
         && sameConfigValue(a[key], b[key], seen));
 }
 function init(newConfig) {
+    return startInitialization(newConfig, false);
+}
+function startInitialization(newConfig, fromStorage) {
     if (initializingConfig) {
         if (sameConfigValue(initializingConfig, newConfig)) {
             return authReadyPromise;
         }
         return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
     }
-    initializingConfig = Object.assign({}, newConfig);
+    initializedConfig = Object.assign({}, newConfig);
+    initializingConfig = initializedConfig;
     initializationGeneration++;
     let resolveReady;
     let rejectReady;
@@ -6636,7 +6772,7 @@ function init(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
+    void initialize(initializingConfig, fromStorage).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -6709,6 +6845,13 @@ function userPrincipalKey(user) {
 }
 // Update the currentUser and notify listeners
 function setCurrentUser(user) {
+    observedIdToken = getCurrentIdToken();
+    try {
+        observedIssuer = core.getActiveSessionManager().getIssuer();
+    }
+    catch (_a) {
+        observedIssuer = null;
+    }
     // Enrich with the universal identity fields (id/email) derived from the
     // active session's idToken — central chokepoint so every provider's user
     // object gains { id, address, email } without each construction site
@@ -8511,8 +8654,9 @@ class PrivyExpoProvider {
         const { signature } = await this.signAndSubmitInternal(transaction, wallet, connection);
         return signature;
     }
-    async restoreSession() {
+    async restoreSession(beforeCommit) {
         const session = await core.getActiveSessionManager().getSession();
+        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();
         if (session) {
             this.authenticatedAddress = session.address;
             return { provider: this, address: session.address };
@@ -8674,4 +8818,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index.native-B_AFa0GD.js.map
+//# sourceMappingURL=index.native-ingNhWPw.js.map