@bounded-sh/client 0.0.30 → 0.0.32

package/dist/index.native.mjs

@@ -4352,7 +4352,8 @@ async function loginWithRedirect(opts) {
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake.
     sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
-    window.location.href = url;
+    setAuthLoading(true); // reflect "signing in…" right up to navigation; the return page's
+    window.location.href = url; // completeLoginFromRedirect() keeps it true until the user resolves.
 }
 /** UPGRADE the current anonymous (guest) session by linking a SOCIAL/redirect login
  *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Carries the guest's signed
@@ -4429,7 +4430,8 @@ async function completeLoginFromRedirect() {
     }
 }
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page must call completeLoginInPopup(). */
+ *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
+ *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
     if (!hasDOM())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
@@ -4444,42 +4446,57 @@ async function loginWithPopup(opts) {
     // Use the RESOLVED redirect_uri (buildAuthorize defaulted it to the current page on web),
     // not opts.redirectUri which may be undefined.
     const expectedOrigin = new URL(pkce.redirectUri).origin;
-    return await new Promise((resolve, reject) => {
-        const onMsg = async (ev) => {
-            if (ev.origin !== expectedOrigin)
-                return; // only trust the redirect_uri origin
-            const d = ev.data;
-            if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
-                return;
-            window.removeEventListener('message', onMsg);
-            try {
-                const raw = sessionStorage.getItem(PKCE_STORE_KEY);
-                if (!raw)
-                    throw new Error('Missing PKCE state');
-                const pkce = JSON.parse(raw);
-                if (d.state !== pkce.state)
-                    throw new Error('OAuth state mismatch');
-                const user = await exchangeCode(d.code, pkce.verifier, pkce.redirectUri);
-                sessionStorage.removeItem(PKCE_STORE_KEY);
+    setAuthLoading(true); // reflect "signing in…" while the popup is open
+    try {
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            let timer;
+            const cleanup = () => { settled = true; clearInterval(timer); window.removeEventListener('message', onMsg); };
+            const onMsg = async (ev) => {
+                if (ev.origin !== expectedOrigin)
+                    return; // only trust the redirect_uri origin
+                const d = ev.data;
+                if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
+                    return;
+                cleanup();
                 try {
-                    popup.close();
+                    const raw = sessionStorage.getItem(PKCE_STORE_KEY);
+                    if (!raw)
+                        throw new Error('Missing PKCE state');
+                    const pkce = JSON.parse(raw);
+                    if (d.state !== pkce.state)
+                        throw new Error('OAuth state mismatch');
+                    const user = await exchangeCode(d.code, pkce.verifier, pkce.redirectUri);
+                    sessionStorage.removeItem(PKCE_STORE_KEY);
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_a) { /* ignore */ }
+                    resolve(user);
                 }
-                catch ( /* ignore */_a) { /* ignore */ }
-                resolve(user);
-            }
-            catch (e) {
-                reject(e);
-            }
-        };
-        window.addEventListener('message', onMsg);
-        const timer = setInterval(() => {
-            if (popup.closed) {
-                clearInterval(timer);
-                window.removeEventListener('message', onMsg);
-                reject(new Error('Login window closed'));
-            }
-        }, 500);
-    });
+                catch (e) {
+                    reject(e);
+                }
+            };
+            window.addEventListener('message', onMsg);
+            // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
+            // races the just-posted message and would report a spurious "Login window closed" on a
+            // SUCCESSFUL login. When we see it closed, wait a beat for that pending message to settle
+            // before declaring the window closed.
+            timer = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(timer);
+                    setTimeout(() => { if (!settled) {
+                        cleanup();
+                        reject(new Error('Login window closed'));
+                    } }, 500);
+                }
+            }, 500);
+        });
+    }
+    finally {
+        setAuthLoading(false);
+    }
 }
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
@@ -4771,7 +4788,13 @@ async function signInAnonymously() {
     coreConfig.authMethod = 'guest';
     setAuthProviderInstance(provider);
     setStoredAuthMethod('guest');
-    return provider.login();
+    setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
+    try {
+        return await provider.login();
+    }
+    finally {
+        setAuthLoading(false);
+    }
 }
 /**
  * Log in with Privy as a co-equal route — selectable at runtime alongside