@bounded-sh/client 0.0.58 → 0.0.60

package/dist/{index-MKE9tHpl.js → index-iu8vB4ye.js}

@@ -3475,7 +3475,7 @@ const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets —
 const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
     'the app policy so email logins get a non-custodial wallet (@user.address), ' +
     'then sign from a user gesture.';
-function hasDOM$4() {
+function hasDOM$5() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt$1(token) {
@@ -3535,7 +3535,7 @@ let requestSeq$1 = 0;
  * wallet's owner, and validates that the wallet address matches the account.
  */
 async function signViaSignerPopup(action) {
-    if (!hasDOM$4()) {
+    if (!hasDOM$5()) {
         throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
     }
     const isEvm = action.kind === 'evmTransaction';
@@ -3711,7 +3711,7 @@ const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
 const sessionManager = core.getActiveSessionManager;
-function hasDOM$3() {
+function hasDOM$4() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt(token) {
@@ -3742,7 +3742,7 @@ const oidcProviderSingleton = {
         const idToken = sessionManager().getIdToken();
         return idToken ? userFromIdToken(idToken) : null;
     },
-    async logout() { sessionManager().clearSession(); },
+    async logout() { await sessionManager().clearSession(); },
     async signMessage(_message) {
         throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
     },
@@ -3851,7 +3851,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM$3() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$4() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -3959,7 +3959,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -3975,7 +3975,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4021,7 +4021,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -4161,7 +4161,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$3() || !window.opener)
+    if (!hasDOM$4() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4390,15 +4390,20 @@ function authProviderConfigKey(config) {
  * so both web (WebSessionManager) and RN (ReactNativeSessionManager) sessions
  * are properly cleared.
  */
-function clearIncompatibleSession() {
+async function clearIncompatibleSession() {
     if (getStoredAuthMethod() === currentAuthMethod) {
         return false;
     }
     // Clear both managers: on web the RN manager is a no-op (not configured),
     // and on RN the web manager is a no-op (no localStorage).
-    core.WebSessionManager.clearSession();
+    //
+    // AWAITED. Session removal is serialized through a cross-tab lock now, so a
+    // fire-and-forget call would let init() reach setCurrentUser while the old
+    // credential was still readable — and a request issued in that gap would
+    // authenticate as the session we are in the middle of discarding.
+    await core.WebSessionManager.clearSession();
     try {
-        core.ReactNativeSessionManager.clearSession();
+        await core.ReactNativeSessionManager.clearSession();
     }
     catch ( /* not configured on web */_a) { /* not configured on web */ }
     setStoredAuthMethod(null);
@@ -4531,7 +4536,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BHtR1H_E.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-B5yIZe1l.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4550,7 +4555,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BUvN5Y6_.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-DYZFxIdd.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4563,7 +4568,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-BOPzdm7E.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-LTWiACl5.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4591,7 +4596,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BPXDJoEQ.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CZ-CpNhD.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4647,7 +4652,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BPXDJoEQ.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CZ-CpNhD.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4689,7 +4694,7 @@ async function signInAnonymously() {
             }
             catch (_b) {
                 try {
-                    core.getActiveSessionManager().clearSession();
+                    await core.getActiveSessionManager().clearSession();
                 }
                 catch ( /* fail closed below */_c) { /* fail closed below */ }
             }
@@ -4798,7 +4803,7 @@ async function loginWithWallet(options) {
         ? Object.assign(Object.assign({}, base), { getProvider: options.getProvider }) : base;
     const rpcUrl = normalizeSolanaRpcUrl(cfg.rpcUrl);
     const network = getConfiguredSolanaNetwork(cfg);
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BUvN5Y6_.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-DYZFxIdd.js'); });
     let provider = new InjectedWalletProvider(injectedConfig, rpcUrl, network);
     if (coreConfig.chain === 'offchain')
         provider = new OffchainAuthProvider(provider);
@@ -4870,7 +4875,7 @@ function getCurrentAuthMethod() {
 // allowlist here: on a trusted origin we end the issuer session with a
 // top-level bounce; anywhere else (custom domains, http dev) we keep the
 // local-only logout instead of stranding the user on the issuer origin.
-function issuerLogoutBounceUrl(issuerBase) {
+function issuerLogoutBounceUrl(issuerBase, idTokenHint) {
     if (typeof window === 'undefined' || typeof document === 'undefined')
         return null; // RN/Node: no shared cookie jar to clear this way
     try {
@@ -4893,12 +4898,27 @@ function issuerLogoutBounceUrl(issuerBase) {
         if (!trusted)
             return null;
         const base = issuerBase.replace(/\/$/, '');
-        return `${base}/logout?redirect_uri=${encodeURIComponent(here.href)}`;
+        // #228: send the id_token_hint so the issuer can bind the post-logout redirect to this
+        // session + app + registered origin. Without it the issuer safely falls back to its own
+        // origin (it no longer trusts a bare suffix match), so the return-to-app bounce is a no-op.
+        const hint = idTokenHint ? `&id_token_hint=${encodeURIComponent(idTokenHint)}` : '';
+        return `${base}/logout?redirect_uri=${encodeURIComponent(here.href)}${hint}`;
     }
     catch (_b) {
         return null;
     }
 }
+// #228 helper, deliberately OUTSIDE logout(): the logout body is source-guarded
+// against any `catch` so a revokeSession failure can never be swallowed, and a
+// missing id token is the one benign absence worth tolerating here.
+function idTokenHintOrNull(sm) {
+    try {
+        return sm.getIdToken();
+    }
+    catch (_a) {
+        return null; /* no id token to hint with */
+    }
+}
 async function logout$1(options) {
     // Re-initialize the provider if it was cleared by a prior logout — the exact mirror
     // of login()'s self-heal above. A hosted popup/redirect login (loginWithPopup /
@@ -4923,6 +4943,9 @@ async function logout$1(options) {
     const sm = core.getActiveSessionManager();
     const refreshToken = sm.getRefreshToken();
     const sessionIssuer = sm.getIssuer();
+    // #228: capture the id token NOW, before currentAuthProvider.logout() clears the session, so we
+    // can hand it to the issuer /logout as an id_token_hint (which binds the post-logout redirect).
+    const idTokenHint = idTokenHintOrNull(sm);
     if (refreshToken)
         await core.revokeSession(refreshToken, sessionIssuer !== null && sessionIssuer !== void 0 ? sessionIssuer : undefined);
     // Hosted sessions ('email' covers the whole hosted surface: email OTP +
@@ -4943,7 +4966,7 @@ async function logout$1(options) {
         const issuerBase = sessionIssuer
             || (await core.getConfig()).humanAuthApiUrl
             || 'https://auth.bounded.sh';
-        const bounce = issuerLogoutBounceUrl(issuerBase);
+        const bounce = issuerLogoutBounceUrl(issuerBase, idTokenHint);
         // Local state is already cleared, so even if the navigation is stopped
         // (tab close, extension) the app-side logout has fully happened.
         if (bounce)
@@ -4972,6 +4995,22 @@ var index = /*#__PURE__*/Object.freeze({
     signInAnonymously: signInAnonymously
 });
 
+/**
+ * Subscribed once per process, not per init(): re-registering on every init would
+ * stack duplicate handlers on repeated initialization.
+ */
+let sessionClearedBridgeRegistered = false;
+function registerSessionClearedBridge() {
+    if (sessionClearedBridgeRegistered)
+        return;
+    sessionClearedBridgeRegistered = true;
+    core.onSessionCleared(() => {
+        // Core fires this only when storage was ACTUALLY cleared, never on a
+        // transient refresh failure that preserved the session — so this cannot
+        // sign anyone out over a network blip.
+        setCurrentUser(null);
+    });
+}
 /**
  * Read the active session's idToken synchronously from whichever store is live
  * for this runtime (WebSessionManager on web, ReactNativeSessionManager on RN —
@@ -5029,6 +5068,15 @@ async function init(newConfig) {
     // setting it here makes "no flash" the SDK's default behavior for every consumer.
     setAuthLoading(true);
     try {
+        // Bridge core's "the stored session is gone" signal into SDK auth state.
+        //
+        // Core cannot import this package, and a session can die deep inside a
+        // session manager (dead refresh token, rejected refresh, app-id mismatch).
+        // Before this, setCurrentUser(null) was only ever called by logout() and
+        // init(), so storage could be wiped while `currentUser` stayed populated —
+        // onAuthStateChanged never fired, and every consumer UI went on showing a
+        // connected wallet for a session the server no longer knew about.
+        registerSessionClearedBridge();
         // Get auth provider first
         authProviderInstance = await getAuthProvider(newConfig);
         // Initialize config with auth provider
@@ -5045,7 +5093,12 @@ async function init(newConfig) {
         let user = await authProviderInstance.restoreSession();
         // If a session exists but was created before auth method tracking (legacy session),
         // clear it to avoid mismatches when the app switches auth methods (e.g. email → phantom)
-        if (user && clearIncompatibleSession()) {
+        //
+        // AWAITED: the clear is serialized through a cross-tab lock now, and an
+        // unawaited call would return a Promise (always truthy) — nulling the user
+        // unconditionally AND letting setCurrentUser run while the old credential
+        // was still in storage.
+        if (user && await clearIncompatibleSession()) {
             user = null;
         }
         setCurrentUser(user);
@@ -5163,7 +5216,7 @@ function setAuthProviderInstance(provider) {
 // The modal is a warm singleton: it stays mounted (hidden) between uses so a
 // second open - or a signature right after login - is instant and, when it is
 // already open, a clean in-place view swap rather than a reopen.
-function hasDOM$2() {
+function hasDOM$3() {
     return typeof window !== "undefined" && typeof document !== "undefined";
 }
 const OVERLAY_CSS = `
@@ -5385,7 +5438,7 @@ function detachIframe(m) {
 // no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
 const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
 function ensureFonts() {
-    if (!hasDOM$2())
+    if (!hasDOM$3())
         return;
     if (document.querySelector('link[data-bounded-fonts="1"]'))
         return;
@@ -5691,7 +5744,7 @@ function discoverStandardWallets() {
     return out;
 }
 
-function hasDOM$1() {
+function hasDOM$2() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 async function signerOrigin() {
@@ -5768,7 +5821,7 @@ function sealOtpInIframe(code, otpEncryptionTargetBundle) {
  * step needs the signer iframe); on React Native use loginWithRedirect() instead.
  */
 async function startTurnkeyEmailLogin(email) {
-    if (!hasDOM$1()) {
+    if (!hasDOM$2()) {
         throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
     }
     const trimmed = email.trim();
@@ -5957,7 +6010,7 @@ function el(tag, cls, text) {
  */
 async function openBoundedWidget(opts = {}) {
     var _a, _b, _c, _d, _e, _f, _g, _h;
-    if (!hasDOM$2()) {
+    if (!hasDOM$3()) {
         throw new Error("openBoundedWidget is web-only - on React Native use loginWithRedirect()");
     }
     // Imported lazily to avoid a static cycle with the auth index barrel.
@@ -7064,7 +7117,7 @@ async function deserializeTransaction(tx) {
  * (Safari cross-origin create) or cannot be mounted.
  */
 async function runWidget(url, signerOrigin, ex, popupFallback) {
-    if (!hasDOM$2())
+    if (!hasDOM$3())
         return popupFallback();
     const m = getModal();
     const requestId = String(ex.request.requestId);
@@ -7173,7 +7226,7 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
 // ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
 // Bounded apps (any subdomain / custom domain) sign through this one origin - giving
 // every user one wallet + one passkey that roams across every app.
-function hasDOM() {
+function hasDOM$1() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 // Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
@@ -7182,7 +7235,7 @@ function hasDOM() {
 // There we pick the popup up front, from the original click, so enrollment is solid.
 // Everywhere else the inline widget is used (buttery in-app modal).
 function preferPopup() {
-    if (!hasDOM() || typeof navigator === 'undefined')
+    if (!hasDOM$1() || typeof navigator === 'undefined')
         return true;
     const ua = navigator.userAgent || '';
     return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
@@ -7299,7 +7352,7 @@ async function runPopup(url, signerOrigin, ex) {
  * Use this to learn the fee-payer address BEFORE building a transaction to sign.
  */
 async function getOrCreateTurnkeyWallet() {
-    if (!hasDOM())
+    if (!hasDOM$1())
         throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
     const { url, origin } = await turnkeySignerPage();
     const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
@@ -7323,7 +7376,7 @@ async function getOrCreateTurnkeyWallet() {
  * signatures are just a passkey approval.
  */
 async function signSolanaMessageViaTurnkey(message) {
-    if (!hasDOM()) {
+    if (!hasDOM$1()) {
         throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
     }
     const { url, origin } = await turnkeySignerPage();
@@ -7340,6 +7393,199 @@ async function signSolanaMessageViaTurnkey(message) {
     });
 }
 
+// bounded.onramp() - fund the signed-in user's wallet with Coinbase Onramp.
+//
+// Web-only. Opens Coinbase's hosted checkout (pay.coinbase.com) in a popup
+// (new-tab fallback) using a single-use session token minted by the Bounded
+// platform at POST <origin>/__bounded/onramp/session on the app's own origin.
+// The platform holds the Coinbase credential; the app never sees it. The
+// session is bound server-side to the caller's verified Bounded JWT, and the
+// destination defaults to that user's embedded wallet.
+//
+// Amount semantics:
+//   amountUsd    - exact fiat in; the fee/output breakdown comes back as `quote`.
+//   minAmountOut - a FLOOR on crypto received. The platform quotes Coinbase's
+//     worst-fee payment method (card) and pads by `slippagePad` (default 1%),
+//     so cheaper methods overshoot the floor rather than undershooting it. The
+//     floor holds unless the market moves more than the pad while the user sits
+//     on the checkout screen - which is why completion is VERIFIED: after the
+//     popup closes we poll the platform's status leg and resolve with the
+//     actual filled amount when Coinbase reports it.
+//
+// Works on Bounded-served origins (<app>.bounded.page / custom domains). On a
+// local dev origin the session endpoint does not exist; we fail with a clear
+// error rather than guessing a host.
+function hasDOM() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+async function authedFetch(path, init) {
+    const idToken = await getIdToken();
+    if (!idToken)
+        throw new Error('onramp: no active session - call login() first');
+    return fetch(`${window.location.origin}${path}`, Object.assign(Object.assign({}, init), { headers: Object.assign(Object.assign({}, init === null || init === void 0 ? void 0 : init.headers), { Authorization: `Bearer ${idToken}` }) }));
+}
+async function readError(res) {
+    var _a;
+    try {
+        return (_a = (await res.json()).error) !== null && _a !== void 0 ? _a : '';
+    }
+    catch (_b) {
+        return '';
+    }
+}
+function sessionBody(options, extra) {
+    return JSON.stringify(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.address ? { address: options.address } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {})), (options.minAmountOut !== undefined ? { minAmountOut: options.minAmountOut } : {})), (options.slippagePad !== undefined ? { slippagePad: options.slippagePad } : {})), extra));
+}
+function resolveAddress(options) {
+    var _a, _b;
+    const user = getCurrentUser();
+    const address = (_b = (_a = options.address) !== null && _a !== void 0 ? _a : user === null || user === void 0 ? void 0 : user.address) !== null && _b !== void 0 ? _b : undefined;
+    if (!address) {
+        throw new Error(user
+            ? 'onramp: the signed-in account has no wallet address - pass { address } explicitly'
+            : 'onramp: no signed-in user - call login() first or pass { address }');
+    }
+    return address;
+}
+/**
+ * Preview a quote (fees + exact/floor output) WITHOUT opening any window or
+ * consuming a session. Show this to the user, then call onramp() to check out.
+ */
+async function onrampQuote(options = {}) {
+    if (!hasDOM())
+        throw new Error('onrampQuote is web-only');
+    resolveAddress(options);
+    const res = await authedFetch('/__bounded/onramp/session', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: sessionBody(options, { quoteOnly: true }),
+    });
+    if (!res.ok)
+        throw new Error(`onrampQuote: failed (${res.status}${await readError(res).then((e) => (e ? `: ${e}` : ''))})`);
+    return (await res.json());
+}
+/** The signed-in user's recent onramp transactions (newest first). */
+async function onrampStatus(sinceMs) {
+    if (!hasDOM())
+        throw new Error('onrampStatus is web-only');
+    const res = await authedFetch(`/__bounded/onramp/status${sinceMs ? `?since=${Math.floor(sinceMs)}` : ''}`);
+    if (!res.ok)
+        throw new Error(`onrampStatus: failed (${res.status})`);
+    return (await res.json()).transactions;
+}
+function isSuccess(t) {
+    return /SUCCESS|COMPLETED/i.test(t.status);
+}
+function isPending(t) {
+    return /PROGRESS|PENDING|CREATED/i.test(t.status);
+}
+async function verifyCompletion(openedAt, asset, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    // 60s of clock-skew slack on `since`: Coinbase stamps server-side.
+    const since = openedAt - 60000;
+    for (;;) {
+        let sawPending = false;
+        try {
+            const txs = await onrampStatus(since);
+            const done = txs.find((t) => isSuccess(t) && (t.asset === null || t.asset === asset));
+            if (done)
+                return done;
+            sawPending = txs.some(isPending);
+        }
+        catch ( /* transient - keep polling until the deadline */_a) { /* transient - keep polling until the deadline */ }
+        // No completed fill and nothing in flight: one grace poll cycle still
+        // runs (Coinbase's record can lag the redirect), but don't burn the
+        // full window when the user plainly abandoned checkout.
+        if (Date.now() >= deadline)
+            return null;
+        if (!sawPending && Date.now() >= openedAt + 12000 && Date.now() - openedAt > timeoutMs / 2)
+            return null;
+        await new Promise((r) => setTimeout(r, 3000));
+    }
+}
+/**
+ * Open Coinbase Onramp for the signed-in user. Resolves after the window
+ * closes, with completion VERIFIED against Coinbase when possible.
+ * Call from a click handler - popup blockers require user activation.
+ */
+async function onramp(options = {}) {
+    var _a;
+    if (!hasDOM())
+        throw new Error('onramp() is web-only');
+    resolveAddress(options);
+    // Open the window synchronously so the click's user-activation window is not
+    // consumed by the fetch below (same hard-won pattern as loginWithPopup).
+    let popup = null;
+    if (!options.newTab) {
+        const w = options.width || 460;
+        const h = options.height || 720;
+        const left = window.screenX + (window.outerWidth - w) / 2;
+        const top = window.screenY + (window.outerHeight - h) / 2;
+        popup = window.open('', 'bounded-onramp', `width=${w},height=${h},left=${left},top=${top}`);
+    }
+    let session;
+    try {
+        const res = await authedFetch('/__bounded/onramp/session', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: sessionBody(options),
+        });
+        if (!res.ok) {
+            const detail = await readError(res);
+            if (res.status === 404) {
+                throw new Error('onramp: session endpoint not found - onramp works on Bounded-served origins (your deployed app URL), not local dev servers');
+            }
+            throw new Error(`onramp: session mint failed (${res.status}${detail ? `: ${detail}` : ''})`);
+        }
+        session = (await res.json());
+    }
+    catch (error) {
+        try {
+            popup === null || popup === void 0 ? void 0 : popup.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        throw error;
+    }
+    const openedAt = Date.now();
+    const base = Object.assign({ address: session.address, asset: session.asset }, (session.quote ? { quote: session.quote } : {}));
+    if (popup) {
+        try {
+            popup.location.replace(session.url);
+        }
+        catch (_c) {
+            try {
+                popup.location.href = session.url;
+            }
+            catch (_d) {
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_e) { /* ignore */ }
+                throw new Error('onramp: popup failed to navigate - retry with { newTab: true }');
+            }
+        }
+        await new Promise((resolve) => {
+            const timer = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(timer);
+                    resolve();
+                }
+            }, 500);
+        });
+        const fill = await verifyCompletion(openedAt, session.asset, (_a = options.completionTimeoutMs) !== null && _a !== void 0 ? _a : 24000);
+        if (fill) {
+            return Object.assign(Object.assign(Object.assign(Object.assign({}, base), { status: 'completed' }), (fill.amountOut !== null ? { actualOut: fill.amountOut } : {})), (fill.txHash ? { txHash: fill.txHash } : {}));
+        }
+        return Object.assign(Object.assign({}, base), { status: 'closed' });
+    }
+    // New-tab path (popup was blocked or explicitly requested): cross-origin tab
+    // close is not observable, so resolve immediately; verify via onrampStatus().
+    const tab = window.open(session.url, '_blank');
+    if (!tab)
+        throw new Error('onramp: window.open was blocked - call onramp() from a click handler');
+    return Object.assign(Object.assign({}, base), { status: 'opened' });
+}
+
 /**
  * Extracts a human-readable error message from Solana transaction logs.
  */
@@ -7469,7 +7715,7 @@ class PrivyExpoProvider {
                 return { provider: this, address: session.address };
             }
             // Stale session — clear and continue to fresh login flow
-            core.getActiveSessionManager().clearSession();
+            await core.getActiveSessionManager().clearSession();
         }
         // Trigger Privy login
         const privyUser = await this.privyMethods.login();
@@ -7650,7 +7896,7 @@ class PrivyExpoProvider {
         if ((_a = this.privyMethods) === null || _a === void 0 ? void 0 : _a.isAuthenticated) {
             await this.privyMethods.logout();
         }
-        core.getActiveSessionManager().clearSession();
+        await core.getActiveSessionManager().clearSession();
     }
     async getNativeMethods() {
         return this.privyMethods;
@@ -7850,6 +8096,9 @@ exports.logout = logout;
 exports.normalizeSolanaRpcUrl = normalizeSolanaRpcUrl;
 exports.onAuthLoadingChanged = onAuthLoadingChanged;
 exports.onAuthStateChanged = onAuthStateChanged;
+exports.onramp = onramp;
+exports.onrampQuote = onrampQuote;
+exports.onrampStatus = onrampStatus;
 exports.openBoundedWidget = openBoundedWidget;
 exports.requestEip6963Providers = requestEip6963Providers;
 exports.resolveSolanaRpcUrl = resolveSolanaRpcUrl;
@@ -7862,4 +8111,4 @@ exports.startTurnkeyEmailLogin = startTurnkeyEmailLogin;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
-//# sourceMappingURL=index-MKE9tHpl.js.map
+//# sourceMappingURL=index-iu8vB4ye.js.map