@bounded-sh/client 0.0.50 → 0.0.51

package/dist/{index.native-BfoLJCZg.js → index.native-BaEZwiWd.js}

@@ -4466,7 +4466,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CmYs6Dcm.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CnHsY8U-.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4485,7 +4485,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-PYcvLO2Z.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-C65NiItg.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4498,7 +4498,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-BXj1YFaZ.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-DUyX7Xj9.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4526,7 +4526,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CxsLCznO.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-fjOMwfpW.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4582,7 +4582,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CxsLCznO.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-fjOMwfpW.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4758,8 +4758,45 @@ async function login$1(options) {
 function getCurrentAuthMethod() {
     return currentAuthMethod;
 }
-async function logout$1() {
-    var _a;
+// The hosted issuer keeps its OWN browser session (the Better Auth cookie on
+// auth.bounded.sh) — clearing the app-local session alone leaves it alive, so
+// the next loginWithRedirect() silently re-signs the user in as the SAME
+// account: "sign out" that never lets you re-choose. The issuer ships
+// GET /logout for exactly this — it expires the session cookies and bounces
+// back — but it only redirects to https origins it trusts. Mirror that
+// allowlist here: on a trusted origin we end the issuer session with a
+// top-level bounce; anywhere else (custom domains, http dev) we keep the
+// local-only logout instead of stranding the user on the issuer origin.
+function issuerLogoutBounceUrl(issuerBase) {
+    if (typeof window === 'undefined' || typeof document === 'undefined')
+        return null; // RN/Node: no shared cookie jar to clear this way
+    try {
+        if (window.top !== window.self)
+            return null; // framed: SameSite=Lax cookies don't ride iframe navigations
+    }
+    catch (_a) {
+        return null;
+    }
+    try {
+        const here = new URL(window.location.href);
+        const host = here.hostname;
+        const isLocalhost = host === 'localhost' || host === '127.0.0.1' || host.endsWith('.localhost');
+        const trusted = here.protocol === 'https:' &&
+            (host === 'bounded.sh' ||
+                host.endsWith('.bounded.sh') ||
+                host.endsWith('.bounded.page') ||
+                host.endsWith('.oapps.fun') ||
+                isLocalhost);
+        if (!trusted)
+            return null;
+        const base = issuerBase.replace(/\/$/, '');
+        return `${base}/logout?redirect_uri=${encodeURIComponent(here.href)}`;
+    }
+    catch (_b) {
+        return null;
+    }
+}
+async function logout$1(options) {
     // Re-initialize the provider if it was cleared by a prior logout — the exact mirror
     // of login()'s self-heal above. A hosted popup/redirect login (loginWithPopup /
     // completeLoginFromRedirect) establishes a session WITHOUT touching the provider
@@ -4782,13 +4819,28 @@ async function logout$1() {
     // mistake a local-only logout for server revocation.
     const sm = core.getActiveSessionManager();
     const refreshToken = sm.getRefreshToken();
+    const sessionIssuer = sm.getIssuer();
     if (refreshToken)
-        await core.revokeSession(refreshToken, (_a = sm.getIssuer()) !== null && _a !== void 0 ? _a : undefined);
+        await core.revokeSession(refreshToken, sessionIssuer !== null && sessionIssuer !== void 0 ? sessionIssuer : undefined);
+    // Hosted sessions ('email' covers the whole hosted surface: email OTP +
+    // social + the OIDC redirect/popup flows) are the ones with an issuer
+    // cookie; wallet and guest sessions have nothing hosted to end.
+    const wasHosted = (currentAuthMethod !== null && currentAuthMethod !== void 0 ? currentAuthMethod : getStoredAuthMethod()) === 'email';
     await currentAuthProvider.logout();
     setStoredAuthMethod(null);
     currentAuthProvider = null;
     currentAuthMethod = null;
     currentAuthProviderConfigKey = null;
+    if (wasHosted && !(options === null || options === void 0 ? void 0 : options.keepIssuerSession)) {
+        const issuerBase = sessionIssuer
+            || (await core.getConfig()).humanAuthApiUrl
+            || 'https://auth.bounded.sh';
+        const bounce = issuerLogoutBounceUrl(issuerBase);
+        // Local state is already cleared, so even if the navigation is stopped
+        // (tab close, extension) the app-side logout has fully happened.
+        if (bounce)
+            window.location.href = bounce;
+    }
 }
 
 /**
@@ -4918,11 +4970,11 @@ async function login(options) {
     setCurrentUser(loggedInUser);
     return currentUser;
 }
-async function logout() {
+async function logout(options) {
     if (!authProviderInstance) {
         throw new Error('SDK not initialized. Please call init() first.');
     }
-    await logout$1();
+    await logout$1(options);
     setCurrentUser(null);
 }
 var hasRunFirstTime = false;
@@ -6032,4 +6084,4 @@ exports.setPlatform = setPlatform;
 exports.signInAnonymously = signInAnonymously;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
-//# sourceMappingURL=index.native-BfoLJCZg.js.map
+//# sourceMappingURL=index.native-BaEZwiWd.js.map