@bounded-sh/client 0.0.58 → 0.0.60

package/dist/{index-DWodlTFG.mjs → index-CQtGkKVd.mjs}

@@ -1,4 +1,4 @@
-import { assertCanonicalBoundedRuntimeWriteCalldata, getActiveSessionManager, getConfig, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { assertCanonicalBoundedRuntimeWriteCalldata, getActiveSessionManager, getConfig, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, onSessionCleared, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 /**
@@ -3454,7 +3454,7 @@ const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets —
 const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
     'the app policy so email logins get a non-custodial wallet (@user.address), ' +
     'then sign from a user gesture.';
-function hasDOM$4() {
+function hasDOM$5() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt$1(token) {
@@ -3514,7 +3514,7 @@ let requestSeq$1 = 0;
  * wallet's owner, and validates that the wallet address matches the account.
  */
 async function signViaSignerPopup(action) {
-    if (!hasDOM$4()) {
+    if (!hasDOM$5()) {
         throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
     }
     const isEvm = action.kind === 'evmTransaction';
@@ -3690,7 +3690,7 @@ const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
 const sessionManager = getActiveSessionManager;
-function hasDOM$3() {
+function hasDOM$4() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt(token) {
@@ -3721,7 +3721,7 @@ const oidcProviderSingleton = {
         const idToken = sessionManager().getIdToken();
         return idToken ? userFromIdToken(idToken) : null;
     },
-    async logout() { sessionManager().clearSession(); },
+    async logout() { await sessionManager().clearSession(); },
     async signMessage(_message) {
         throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
     },
@@ -3830,7 +3830,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM$3() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$4() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -3938,7 +3938,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -3954,7 +3954,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4000,7 +4000,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -4140,7 +4140,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$3() || !window.opener)
+    if (!hasDOM$4() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4369,15 +4369,20 @@ function authProviderConfigKey(config) {
  * so both web (WebSessionManager) and RN (ReactNativeSessionManager) sessions
  * are properly cleared.
  */
-function clearIncompatibleSession() {
+async function clearIncompatibleSession() {
     if (getStoredAuthMethod() === currentAuthMethod) {
         return false;
     }
     // Clear both managers: on web the RN manager is a no-op (not configured),
     // and on RN the web manager is a no-op (no localStorage).
-    WebSessionManager.clearSession();
+    //
+    // AWAITED. Session removal is serialized through a cross-tab lock now, so a
+    // fire-and-forget call would let init() reach setCurrentUser while the old
+    // credential was still readable — and a request issued in that gap would
+    // authenticate as the session we are in the middle of discarding.
+    await WebSessionManager.clearSession();
     try {
-        ReactNativeSessionManager.clearSession();
+        await ReactNativeSessionManager.clearSession();
     }
     catch ( /* not configured on web */_a) { /* not configured on web */ }
     setStoredAuthMethod(null);
@@ -4510,7 +4515,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-CX7foEhA.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-nBv7mW9q.mjs')).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4529,7 +4534,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-Dg3MieTq.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-kx8tcMKM.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4542,7 +4547,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-CnJRLE8P.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-D8lYGcM2.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4570,7 +4575,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-DJmuReVa.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-DGvQgIwm.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4626,7 +4631,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-DJmuReVa.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-DGvQgIwm.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4668,7 +4673,7 @@ async function signInAnonymously() {
             }
             catch (_b) {
                 try {
-                    getActiveSessionManager().clearSession();
+                    await getActiveSessionManager().clearSession();
                 }
                 catch ( /* fail closed below */_c) { /* fail closed below */ }
             }
@@ -4777,7 +4782,7 @@ async function loginWithWallet(options) {
         ? Object.assign(Object.assign({}, base), { getProvider: options.getProvider }) : base;
     const rpcUrl = normalizeSolanaRpcUrl(cfg.rpcUrl);
     const network = getConfiguredSolanaNetwork(cfg);
-    const { InjectedWalletProvider } = await import('./injected-wallet-provider-Dg3MieTq.mjs');
+    const { InjectedWalletProvider } = await import('./injected-wallet-provider-kx8tcMKM.mjs');
     let provider = new InjectedWalletProvider(injectedConfig, rpcUrl, network);
     if (coreConfig.chain === 'offchain')
         provider = new OffchainAuthProvider(provider);
@@ -4849,7 +4854,7 @@ function getCurrentAuthMethod() {
 // allowlist here: on a trusted origin we end the issuer session with a
 // top-level bounce; anywhere else (custom domains, http dev) we keep the
 // local-only logout instead of stranding the user on the issuer origin.
-function issuerLogoutBounceUrl(issuerBase) {
+function issuerLogoutBounceUrl(issuerBase, idTokenHint) {
     if (typeof window === 'undefined' || typeof document === 'undefined')
         return null; // RN/Node: no shared cookie jar to clear this way
     try {
@@ -4872,12 +4877,27 @@ function issuerLogoutBounceUrl(issuerBase) {
         if (!trusted)
             return null;
         const base = issuerBase.replace(/\/$/, '');
-        return `${base}/logout?redirect_uri=${encodeURIComponent(here.href)}`;
+        // #228: send the id_token_hint so the issuer can bind the post-logout redirect to this
+        // session + app + registered origin. Without it the issuer safely falls back to its own
+        // origin (it no longer trusts a bare suffix match), so the return-to-app bounce is a no-op.
+        const hint = idTokenHint ? `&id_token_hint=${encodeURIComponent(idTokenHint)}` : '';
+        return `${base}/logout?redirect_uri=${encodeURIComponent(here.href)}${hint}`;
     }
     catch (_b) {
         return null;
     }
 }
+// #228 helper, deliberately OUTSIDE logout(): the logout body is source-guarded
+// against any `catch` so a revokeSession failure can never be swallowed, and a
+// missing id token is the one benign absence worth tolerating here.
+function idTokenHintOrNull(sm) {
+    try {
+        return sm.getIdToken();
+    }
+    catch (_a) {
+        return null; /* no id token to hint with */
+    }
+}
 async function logout$1(options) {
     // Re-initialize the provider if it was cleared by a prior logout — the exact mirror
     // of login()'s self-heal above. A hosted popup/redirect login (loginWithPopup /
@@ -4902,6 +4922,9 @@ async function logout$1(options) {
     const sm = getActiveSessionManager();
     const refreshToken = sm.getRefreshToken();
     const sessionIssuer = sm.getIssuer();
+    // #228: capture the id token NOW, before currentAuthProvider.logout() clears the session, so we
+    // can hand it to the issuer /logout as an id_token_hint (which binds the post-logout redirect).
+    const idTokenHint = idTokenHintOrNull(sm);
     if (refreshToken)
         await revokeSession(refreshToken, sessionIssuer !== null && sessionIssuer !== void 0 ? sessionIssuer : undefined);
     // Hosted sessions ('email' covers the whole hosted surface: email OTP +
@@ -4922,7 +4945,7 @@ async function logout$1(options) {
         const issuerBase = sessionIssuer
             || (await getConfig()).humanAuthApiUrl
             || 'https://auth.bounded.sh';
-        const bounce = issuerLogoutBounceUrl(issuerBase);
+        const bounce = issuerLogoutBounceUrl(issuerBase, idTokenHint);
         // Local state is already cleared, so even if the navigation is stopped
         // (tab close, extension) the app-side logout has fully happened.
         if (bounce)
@@ -4951,6 +4974,22 @@ var index = /*#__PURE__*/Object.freeze({
     signInAnonymously: signInAnonymously
 });
 
+/**
+ * Subscribed once per process, not per init(): re-registering on every init would
+ * stack duplicate handlers on repeated initialization.
+ */
+let sessionClearedBridgeRegistered = false;
+function registerSessionClearedBridge() {
+    if (sessionClearedBridgeRegistered)
+        return;
+    sessionClearedBridgeRegistered = true;
+    onSessionCleared(() => {
+        // Core fires this only when storage was ACTUALLY cleared, never on a
+        // transient refresh failure that preserved the session — so this cannot
+        // sign anyone out over a network blip.
+        setCurrentUser(null);
+    });
+}
 /**
  * Read the active session's idToken synchronously from whichever store is live
  * for this runtime (WebSessionManager on web, ReactNativeSessionManager on RN —
@@ -5008,6 +5047,15 @@ async function init(newConfig) {
     // setting it here makes "no flash" the SDK's default behavior for every consumer.
     setAuthLoading(true);
     try {
+        // Bridge core's "the stored session is gone" signal into SDK auth state.
+        //
+        // Core cannot import this package, and a session can die deep inside a
+        // session manager (dead refresh token, rejected refresh, app-id mismatch).
+        // Before this, setCurrentUser(null) was only ever called by logout() and
+        // init(), so storage could be wiped while `currentUser` stayed populated —
+        // onAuthStateChanged never fired, and every consumer UI went on showing a
+        // connected wallet for a session the server no longer knew about.
+        registerSessionClearedBridge();
         // Get auth provider first
         authProviderInstance = await getAuthProvider(newConfig);
         // Initialize config with auth provider
@@ -5024,7 +5072,12 @@ async function init(newConfig) {
         let user = await authProviderInstance.restoreSession();
         // If a session exists but was created before auth method tracking (legacy session),
         // clear it to avoid mismatches when the app switches auth methods (e.g. email → phantom)
-        if (user && clearIncompatibleSession()) {
+        //
+        // AWAITED: the clear is serialized through a cross-tab lock now, and an
+        // unawaited call would return a Promise (always truthy) — nulling the user
+        // unconditionally AND letting setCurrentUser run while the old credential
+        // was still in storage.
+        if (user && await clearIncompatibleSession()) {
             user = null;
         }
         setCurrentUser(user);
@@ -5142,7 +5195,7 @@ function setAuthProviderInstance(provider) {
 // The modal is a warm singleton: it stays mounted (hidden) between uses so a
 // second open - or a signature right after login - is instant and, when it is
 // already open, a clean in-place view swap rather than a reopen.
-function hasDOM$2() {
+function hasDOM$3() {
     return typeof window !== "undefined" && typeof document !== "undefined";
 }
 const OVERLAY_CSS = `
@@ -5364,7 +5417,7 @@ function detachIframe(m) {
 // no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
 const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
 function ensureFonts() {
-    if (!hasDOM$2())
+    if (!hasDOM$3())
         return;
     if (document.querySelector('link[data-bounded-fonts="1"]'))
         return;
@@ -5670,7 +5723,7 @@ function discoverStandardWallets() {
     return out;
 }
 
-function hasDOM$1() {
+function hasDOM$2() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 async function signerOrigin() {
@@ -5747,7 +5800,7 @@ function sealOtpInIframe(code, otpEncryptionTargetBundle) {
  * step needs the signer iframe); on React Native use loginWithRedirect() instead.
  */
 async function startTurnkeyEmailLogin(email) {
-    if (!hasDOM$1()) {
+    if (!hasDOM$2()) {
         throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
     }
     const trimmed = email.trim();
@@ -5936,7 +5989,7 @@ function el(tag, cls, text) {
  */
 async function openBoundedWidget(opts = {}) {
     var _a, _b, _c, _d, _e, _f, _g, _h;
-    if (!hasDOM$2()) {
+    if (!hasDOM$3()) {
         throw new Error("openBoundedWidget is web-only - on React Native use loginWithRedirect()");
     }
     // Imported lazily to avoid a static cycle with the auth index barrel.
@@ -7043,7 +7096,7 @@ async function deserializeTransaction(tx) {
  * (Safari cross-origin create) or cannot be mounted.
  */
 async function runWidget(url, signerOrigin, ex, popupFallback) {
-    if (!hasDOM$2())
+    if (!hasDOM$3())
         return popupFallback();
     const m = getModal();
     const requestId = String(ex.request.requestId);
@@ -7152,7 +7205,7 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
 // ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
 // Bounded apps (any subdomain / custom domain) sign through this one origin - giving
 // every user one wallet + one passkey that roams across every app.
-function hasDOM() {
+function hasDOM$1() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 // Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
@@ -7161,7 +7214,7 @@ function hasDOM() {
 // There we pick the popup up front, from the original click, so enrollment is solid.
 // Everywhere else the inline widget is used (buttery in-app modal).
 function preferPopup() {
-    if (!hasDOM() || typeof navigator === 'undefined')
+    if (!hasDOM$1() || typeof navigator === 'undefined')
         return true;
     const ua = navigator.userAgent || '';
     return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
@@ -7278,7 +7331,7 @@ async function runPopup(url, signerOrigin, ex) {
  * Use this to learn the fee-payer address BEFORE building a transaction to sign.
  */
 async function getOrCreateTurnkeyWallet() {
-    if (!hasDOM())
+    if (!hasDOM$1())
         throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
     const { url, origin } = await turnkeySignerPage();
     const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
@@ -7302,7 +7355,7 @@ async function getOrCreateTurnkeyWallet() {
  * signatures are just a passkey approval.
  */
 async function signSolanaMessageViaTurnkey(message) {
-    if (!hasDOM()) {
+    if (!hasDOM$1()) {
         throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
     }
     const { url, origin } = await turnkeySignerPage();
@@ -7319,6 +7372,199 @@ async function signSolanaMessageViaTurnkey(message) {
     });
 }
 
+// bounded.onramp() - fund the signed-in user's wallet with Coinbase Onramp.
+//
+// Web-only. Opens Coinbase's hosted checkout (pay.coinbase.com) in a popup
+// (new-tab fallback) using a single-use session token minted by the Bounded
+// platform at POST <origin>/__bounded/onramp/session on the app's own origin.
+// The platform holds the Coinbase credential; the app never sees it. The
+// session is bound server-side to the caller's verified Bounded JWT, and the
+// destination defaults to that user's embedded wallet.
+//
+// Amount semantics:
+//   amountUsd    - exact fiat in; the fee/output breakdown comes back as `quote`.
+//   minAmountOut - a FLOOR on crypto received. The platform quotes Coinbase's
+//     worst-fee payment method (card) and pads by `slippagePad` (default 1%),
+//     so cheaper methods overshoot the floor rather than undershooting it. The
+//     floor holds unless the market moves more than the pad while the user sits
+//     on the checkout screen - which is why completion is VERIFIED: after the
+//     popup closes we poll the platform's status leg and resolve with the
+//     actual filled amount when Coinbase reports it.
+//
+// Works on Bounded-served origins (<app>.bounded.page / custom domains). On a
+// local dev origin the session endpoint does not exist; we fail with a clear
+// error rather than guessing a host.
+function hasDOM() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+async function authedFetch(path, init) {
+    const idToken = await getIdToken();
+    if (!idToken)
+        throw new Error('onramp: no active session - call login() first');
+    return fetch(`${window.location.origin}${path}`, Object.assign(Object.assign({}, init), { headers: Object.assign(Object.assign({}, init === null || init === void 0 ? void 0 : init.headers), { Authorization: `Bearer ${idToken}` }) }));
+}
+async function readError(res) {
+    var _a;
+    try {
+        return (_a = (await res.json()).error) !== null && _a !== void 0 ? _a : '';
+    }
+    catch (_b) {
+        return '';
+    }
+}
+function sessionBody(options, extra) {
+    return JSON.stringify(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.address ? { address: options.address } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {})), (options.minAmountOut !== undefined ? { minAmountOut: options.minAmountOut } : {})), (options.slippagePad !== undefined ? { slippagePad: options.slippagePad } : {})), extra));
+}
+function resolveAddress(options) {
+    var _a, _b;
+    const user = getCurrentUser();
+    const address = (_b = (_a = options.address) !== null && _a !== void 0 ? _a : user === null || user === void 0 ? void 0 : user.address) !== null && _b !== void 0 ? _b : undefined;
+    if (!address) {
+        throw new Error(user
+            ? 'onramp: the signed-in account has no wallet address - pass { address } explicitly'
+            : 'onramp: no signed-in user - call login() first or pass { address }');
+    }
+    return address;
+}
+/**
+ * Preview a quote (fees + exact/floor output) WITHOUT opening any window or
+ * consuming a session. Show this to the user, then call onramp() to check out.
+ */
+async function onrampQuote(options = {}) {
+    if (!hasDOM())
+        throw new Error('onrampQuote is web-only');
+    resolveAddress(options);
+    const res = await authedFetch('/__bounded/onramp/session', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: sessionBody(options, { quoteOnly: true }),
+    });
+    if (!res.ok)
+        throw new Error(`onrampQuote: failed (${res.status}${await readError(res).then((e) => (e ? `: ${e}` : ''))})`);
+    return (await res.json());
+}
+/** The signed-in user's recent onramp transactions (newest first). */
+async function onrampStatus(sinceMs) {
+    if (!hasDOM())
+        throw new Error('onrampStatus is web-only');
+    const res = await authedFetch(`/__bounded/onramp/status${sinceMs ? `?since=${Math.floor(sinceMs)}` : ''}`);
+    if (!res.ok)
+        throw new Error(`onrampStatus: failed (${res.status})`);
+    return (await res.json()).transactions;
+}
+function isSuccess(t) {
+    return /SUCCESS|COMPLETED/i.test(t.status);
+}
+function isPending(t) {
+    return /PROGRESS|PENDING|CREATED/i.test(t.status);
+}
+async function verifyCompletion(openedAt, asset, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    // 60s of clock-skew slack on `since`: Coinbase stamps server-side.
+    const since = openedAt - 60000;
+    for (;;) {
+        let sawPending = false;
+        try {
+            const txs = await onrampStatus(since);
+            const done = txs.find((t) => isSuccess(t) && (t.asset === null || t.asset === asset));
+            if (done)
+                return done;
+            sawPending = txs.some(isPending);
+        }
+        catch ( /* transient - keep polling until the deadline */_a) { /* transient - keep polling until the deadline */ }
+        // No completed fill and nothing in flight: one grace poll cycle still
+        // runs (Coinbase's record can lag the redirect), but don't burn the
+        // full window when the user plainly abandoned checkout.
+        if (Date.now() >= deadline)
+            return null;
+        if (!sawPending && Date.now() >= openedAt + 12000 && Date.now() - openedAt > timeoutMs / 2)
+            return null;
+        await new Promise((r) => setTimeout(r, 3000));
+    }
+}
+/**
+ * Open Coinbase Onramp for the signed-in user. Resolves after the window
+ * closes, with completion VERIFIED against Coinbase when possible.
+ * Call from a click handler - popup blockers require user activation.
+ */
+async function onramp(options = {}) {
+    var _a;
+    if (!hasDOM())
+        throw new Error('onramp() is web-only');
+    resolveAddress(options);
+    // Open the window synchronously so the click's user-activation window is not
+    // consumed by the fetch below (same hard-won pattern as loginWithPopup).
+    let popup = null;
+    if (!options.newTab) {
+        const w = options.width || 460;
+        const h = options.height || 720;
+        const left = window.screenX + (window.outerWidth - w) / 2;
+        const top = window.screenY + (window.outerHeight - h) / 2;
+        popup = window.open('', 'bounded-onramp', `width=${w},height=${h},left=${left},top=${top}`);
+    }
+    let session;
+    try {
+        const res = await authedFetch('/__bounded/onramp/session', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: sessionBody(options),
+        });
+        if (!res.ok) {
+            const detail = await readError(res);
+            if (res.status === 404) {
+                throw new Error('onramp: session endpoint not found - onramp works on Bounded-served origins (your deployed app URL), not local dev servers');
+            }
+            throw new Error(`onramp: session mint failed (${res.status}${detail ? `: ${detail}` : ''})`);
+        }
+        session = (await res.json());
+    }
+    catch (error) {
+        try {
+            popup === null || popup === void 0 ? void 0 : popup.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        throw error;
+    }
+    const openedAt = Date.now();
+    const base = Object.assign({ address: session.address, asset: session.asset }, (session.quote ? { quote: session.quote } : {}));
+    if (popup) {
+        try {
+            popup.location.replace(session.url);
+        }
+        catch (_c) {
+            try {
+                popup.location.href = session.url;
+            }
+            catch (_d) {
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_e) { /* ignore */ }
+                throw new Error('onramp: popup failed to navigate - retry with { newTab: true }');
+            }
+        }
+        await new Promise((resolve) => {
+            const timer = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(timer);
+                    resolve();
+                }
+            }, 500);
+        });
+        const fill = await verifyCompletion(openedAt, session.asset, (_a = options.completionTimeoutMs) !== null && _a !== void 0 ? _a : 24000);
+        if (fill) {
+            return Object.assign(Object.assign(Object.assign(Object.assign({}, base), { status: 'completed' }), (fill.amountOut !== null ? { actualOut: fill.amountOut } : {})), (fill.txHash ? { txHash: fill.txHash } : {}));
+        }
+        return Object.assign(Object.assign({}, base), { status: 'closed' });
+    }
+    // New-tab path (popup was blocked or explicitly requested): cross-origin tab
+    // close is not observable, so resolve immediately; verify via onrampStatus().
+    const tab = window.open(session.url, '_blank');
+    if (!tab)
+        throw new Error('onramp: window.open was blocked - call onramp() from a click handler');
+    return Object.assign(Object.assign({}, base), { status: 'opened' });
+}
+
 /**
  * Extracts a human-readable error message from Solana transaction logs.
  */
@@ -7448,7 +7694,7 @@ class PrivyExpoProvider {
                 return { provider: this, address: session.address };
             }
             // Stale session — clear and continue to fresh login flow
-            getActiveSessionManager().clearSession();
+            await getActiveSessionManager().clearSession();
         }
         // Trigger Privy login
         const privyUser = await this.privyMethods.login();
@@ -7629,7 +7875,7 @@ class PrivyExpoProvider {
         if ((_a = this.privyMethods) === null || _a === void 0 ? void 0 : _a.isAuthenticated) {
             await this.privyMethods.logout();
         }
-        getActiveSessionManager().clearSession();
+        await getActiveSessionManager().clearSession();
     }
     async getNativeMethods() {
         return this.privyMethods;
@@ -7787,5 +8033,5 @@ function defaultInjectedEvmProvider() {
     return null;
 }
 
-export { BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as $, completeLoginFromRedirect as A, loginWithPopup as B, completeLoginInPopup as C, openBoundedWidget as D, EMBEDDED_WALLET_UNSUPPORTED as E, useAuth as F, useQuery as G, useBuildRun as H, apps as I, deserializeTransaction as J, signSolanaMessageViaTurnkey as K, getOrCreateTurnkeyWallet as L, startTurnkeyEmailLogin as M, getIdToken as N, setPlatform as O, OffchainAuthProvider as P, PrivyExpoProvider as Q, requestEip6963Providers as R, builds as S, BuildsApiError as T, NON_TERMINAL_STATES as U, TERMINAL_STATES as V, RUN_STATES as W, PARK_REASONS as X, FAILURE_REASONS as Y, BUILD_REVIEW_CAPABILITY_SCHEMA as Z, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as _, hasEmbeddedEvmWallet as a, embeddedSignAndSubmit as b, setAuthLoading as c, defaultInjectedProvider as d, embeddedRunEvmTransaction as e, bufferExports as f, getPlatform as g, hasEmbeddedWallet as h, bs58 as i, confirmAndCheckTransaction as j, defaultInjectedEvmProvider as k, init as l, getCurrentUser as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, onAuthLoadingChanged as p, getAuthLoading as q, resolveSolanaRpcUrl as r, setCurrentUser as s, login as t, logout as u, getAuthProvider as v, signInAnonymously as w, loginWithPrivy as x, loginWithWallet as y, loginWithRedirect as z };
-//# sourceMappingURL=index-DWodlTFG.mjs.map
+export { FAILURE_REASONS as $, completeLoginFromRedirect as A, loginWithPopup as B, completeLoginInPopup as C, openBoundedWidget as D, EMBEDDED_WALLET_UNSUPPORTED as E, useAuth as F, useQuery as G, useBuildRun as H, apps as I, deserializeTransaction as J, signSolanaMessageViaTurnkey as K, getOrCreateTurnkeyWallet as L, startTurnkeyEmailLogin as M, getIdToken as N, onramp as O, onrampQuote as P, onrampStatus as Q, setPlatform as R, OffchainAuthProvider as S, PrivyExpoProvider as T, requestEip6963Providers as U, builds as V, BuildsApiError as W, NON_TERMINAL_STATES as X, TERMINAL_STATES as Y, RUN_STATES as Z, PARK_REASONS as _, hasEmbeddedEvmWallet as a, BUILD_REVIEW_CAPABILITY_SCHEMA as a0, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a1, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a2, embeddedSignAndSubmit as b, setAuthLoading as c, defaultInjectedProvider as d, embeddedRunEvmTransaction as e, bufferExports as f, getPlatform as g, hasEmbeddedWallet as h, bs58 as i, confirmAndCheckTransaction as j, defaultInjectedEvmProvider as k, init as l, getCurrentUser as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, onAuthLoadingChanged as p, getAuthLoading as q, resolveSolanaRpcUrl as r, setCurrentUser as s, login as t, logout as u, getAuthProvider as v, signInAnonymously as w, loginWithPrivy as x, loginWithWallet as y, loginWithRedirect as z };
+//# sourceMappingURL=index-CQtGkKVd.mjs.map