@bounded-sh/client 0.0.42 → 0.0.43

package/REACT_NATIVE.md

@@ -63,20 +63,18 @@ On native, `loginWithRedirect()` opens the system/in-app browser and resolves
 with the user when the callback returns to the app. `completeLoginFromRedirect()`
 is for web callback pages.
 
-## 3. Guest login
-
-Anonymous auth is fully native and does not require Expo browser packages:
-
-```ts
-import { init, signInAnonymously, getCurrentUser } from "@bounded-sh/client";
-
-await init({ appId: "YOUR_APP_ID" });
-await signInAnonymously();
-const user = await getCurrentUser();
-```
-
-The device-local ed25519 keypair is stored in the RN storage adapter, so the
-guest identity survives app restarts until `logout()` clears it.
+## 3. Guest login is browser-only in the current release
+
+Do not call `signInAnonymously()` from React Native. The current guest identity
+uses a non-extractable WebCrypto Ed25519 key stored in IndexedDB; it does not use
+the React Native session-storage adapter above. Native runtimes therefore fail
+closed before making an authentication request.
+
+Use hosted email/social login from section 2, or the explicit Privy Expo bridge
+below. Do not add an IndexedDB polyfill to persist a guest signing key: that does
+not provide the platform-backed, non-exportable key contract a native guest flow
+needs. Native anonymous auth will be documented here only after the SDK ships a
+Keychain/Keystore-backed signing implementation and migration/loss semantics.
 
 ## 4. Privy on React Native (`privy-expo`)
 

package/dist/index.js

@@ -4530,23 +4530,74 @@ async function completeLoginFromRedirect() {
 async function loginWithPopup(opts) {
     if (!hasDOM())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
-    const { url, pkce } = await buildAuthorize(opts);
-    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
+    // Open synchronously, before PKCE/config awaits consume the click's user-
+    // activation window. Opening only after buildAuthorize() intermittently
+    // left Chrome with a real named window stranded at about:blank (or blocked
+    // it entirely), while callers waited forever for an OAuth message.
     const w = opts.width || 480, h = opts.height || 720;
     const left = window.screenX + (window.outerWidth - w) / 2;
     const top = window.screenY + (window.outerHeight - h) / 2;
-    const popup = window.open(url, 'bounded-oidc', `width=${w},height=${h},left=${left},top=${top}`);
+    const popup = window.open('', 'bounded-oidc', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup)
         throw new Error('Popup blocked — use loginWithRedirect() instead');
-    // Use the RESOLVED redirect_uri (buildAuthorize defaulted it to the current page on web),
-    // not opts.redirectUri which may be undefined.
-    const expectedOrigin = new URL(pkce.redirectUri).origin;
+    let authorization;
+    try {
+        authorization = await buildAuthorize(opts);
+    }
+    catch (error) {
+        try {
+            popup.close();
+        }
+        catch ( /* ignore */_a) { /* ignore */ }
+        throw error;
+    }
+    const { url, pkce } = authorization;
+    // Validate every remaining synchronous setup step before navigating. Both
+    // URL parsing and sessionStorage can throw (malformed caller input, blocked
+    // storage, quota/privacy mode); because the popup is already open to retain
+    // user activation, close it on either failure instead of orphaning a blank
+    // window with no listener or watchdog attached.
+    let expectedOrigin;
+    try {
+        expectedOrigin = new URL(pkce.redirectUri).origin;
+        sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
+    }
+    catch (error) {
+        try {
+            popup.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        throw error;
+    }
+    try {
+        popup.location.replace(url);
+    }
+    catch (_c) {
+        try {
+            popup.location.href = url;
+        }
+        catch (_d) {
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_e) { /* ignore */ }
+            throw new Error('Popup failed to navigate — use loginWithRedirect() instead');
+        }
+    }
+    // expectedOrigin came from the RESOLVED redirect_uri (buildAuthorize defaulted it to the
+    // current page on web), not opts.redirectUri which may be undefined.
     setAuthLoading(true); // reflect "signing in…" while the popup is open
     try {
         return await new Promise((resolve, reject) => {
             let settled = false;
             let timer;
-            const cleanup = () => { settled = true; clearInterval(timer); window.removeEventListener('message', onMsg); };
+            let navigationTimer;
+            const cleanup = () => {
+                settled = true;
+                clearInterval(timer);
+                clearTimeout(navigationTimer);
+                window.removeEventListener('message', onMsg);
+            };
             const onMsg = async (ev) => {
                 if (ev.origin !== expectedOrigin)
                     return; // only trust the redirect_uri origin
@@ -4574,6 +4625,27 @@ async function loginWithPopup(opts) {
                 }
             };
             window.addEventListener('message', onMsg);
+            // Some browser/extension combinations can return a real popup handle but
+            // strand the window at about:blank instead of navigating to the hosted
+            // authorize URL. The old code then waited forever because the popup was
+            // open and no message could ever arrive. Once the popup becomes
+            // cross-origin, reading location throws — that is positive evidence that
+            // navigation succeeded, so only a still-readable about:blank is rejected.
+            navigationTimer = setTimeout(() => {
+                if (settled || popup.closed)
+                    return;
+                try {
+                    if (popup.location.href === 'about:blank') {
+                        cleanup();
+                        try {
+                            popup.close();
+                        }
+                        catch ( /* ignore */_a) { /* ignore */ }
+                        reject(new Error('Popup stalled at about:blank — use loginWithRedirect() instead'));
+                    }
+                }
+                catch ( /* cross-origin hosted auth loaded normally */_b) { /* cross-origin hosted auth loaded normally */ }
+            }, 4000);
             // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
             // races the just-posted message and would report a spurious "Login window closed" on a
             // SUCCESSFUL login. When we see it closed, wait a beat for that pending message to settle
@@ -5345,6 +5417,12 @@ function useQuery(path, options) {
         core.subscribe(path, Object.assign(Object.assign({}, options), { onData: (d) => {
                 if (!active)
                     return;
+                // A reconnect can legitimately surface a transport error before the
+                // socket re-authenticates and sends a new authorized snapshot. That
+                // fresh snapshot is the recovery boundary: keep the error visible
+                // until data arrives, then clear it so React does not remain stuck on
+                // a failure page after realtime has recovered.
+                setError(null);
                 setData(d);
                 setLoading(false);
             }, onError: (e) => {