@bounded-sh/client 0.0.60 → 0.0.62

package/dist/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-iu8vB4ye.js');
+var index = require('./index-DEDYfO2p.js');
 var core = require('@bounded-sh/core');
 require('react');
 

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { a2 as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, a1 as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, a0 as BUILD_REVIEW_CAPABILITY_SCHEMA, W as BuildsApiError, $ as FAILURE_REASONS, X as NON_TERMINAL_STATES, S as OffchainAuthProvider, _ as PARK_REASONS, T as PrivyExpoProvider, Z as RUN_STATES, Y as TERMINAL_STATES, I as apps, V as builds, A as completeLoginFromRedirect, C as completeLoginInPopup, k as defaultInjectedEvmProvider, d as defaultInjectedProvider, J as deserializeTransaction, q as getAuthLoading, v as getAuthProvider, m as getCurrentUser, N as getIdToken, L as getOrCreateTurnkeyWallet, g as getPlatform, l as init, t as login, B as loginWithPopup, x as loginWithPrivy, z as loginWithRedirect, y as loginWithWallet, u as logout, p as onAuthLoadingChanged, o as onAuthStateChanged, O as onramp, P as onrampQuote, Q as onrampStatus, D as openBoundedWidget, U as requestEip6963Providers, R as setPlatform, w as signInAnonymously, K as signSolanaMessageViaTurnkey, M as startTurnkeyEmailLogin, F as useAuth, H as useBuildRun, G as useQuery } from './index-CQtGkKVd.mjs';
+export { a2 as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, a1 as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, a0 as BUILD_REVIEW_CAPABILITY_SCHEMA, W as BuildsApiError, $ as FAILURE_REASONS, X as NON_TERMINAL_STATES, S as OffchainAuthProvider, _ as PARK_REASONS, T as PrivyExpoProvider, Z as RUN_STATES, Y as TERMINAL_STATES, I as apps, V as builds, A as completeLoginFromRedirect, C as completeLoginInPopup, k as defaultInjectedEvmProvider, d as defaultInjectedProvider, J as deserializeTransaction, q as getAuthLoading, v as getAuthProvider, m as getCurrentUser, N as getIdToken, L as getOrCreateTurnkeyWallet, g as getPlatform, l as init, t as login, B as loginWithPopup, x as loginWithPrivy, z as loginWithRedirect, y as loginWithWallet, u as logout, p as onAuthLoadingChanged, o as onAuthStateChanged, O as onramp, P as onrampQuote, Q as onrampStatus, D as openBoundedWidget, U as requestEip6963Providers, R as setPlatform, w as signInAnonymously, K as signSolanaMessageViaTurnkey, M as startTurnkeyEmailLogin, F as useAuth, H as useBuildRun, G as useQuery } from './index-DpJl_Cpa.mjs';
 export * from '@bounded-sh/core';
 export { BoundedDeclineError, DECLINE_EVENT_NAME, RATE_LIMIT_EVENT_NAME, ScopedClientReadOnlyError, aggregate, count, createClient, deriveDecline, dispatchDeclineEvent, dispatchRateLimitEvent, docId, get, getConfig, getFiles, getMany, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
 import 'react';

package/dist/{index.native-Crfn_NOB.mjs → index.native-BIUs8t7F.mjs}

@@ -3686,6 +3686,7 @@ const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wa
     'then sign from a user gesture.';
 const PKCE_STORE_KEY = 'bounded.oidc.pkce';
 const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
+const ISSUER_SESSION_KIND_KEY$1 = 'bounded_issuer_session_kind';
 // Active session store (Web on web, RN on React Native) — selected by config,
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
@@ -4192,6 +4193,13 @@ async function exchangeCode(code, verifier, redirectUri) {
         getPlatform().storage.setItem(STORED_AUTH_METHOD_KEY$1, 'email');
     }
     catch ( /* storage unavailable */_b) { /* storage unavailable */ }
+    // OIDC login does establish the issuer's Better Auth browser cookie. Record
+    // that fact separately from the provider name so logout clears the cookie
+    // and returns through the registered app origin.
+    try {
+        getPlatform().storage.setItem(ISSUER_SESSION_KIND_KEY$1, 'hosted');
+    }
+    catch ( /* storage unavailable */_c) { /* storage unavailable */ }
     setCurrentUser(user);
     setAuthProviderInstance(oidcProviderSingleton);
     return user;
@@ -4208,6 +4216,7 @@ const objectIdentityKeys = new WeakMap();
 let nextObjectIdentityKey = 1;
 // --- localStorage helpers: track which auth method created the active session ---
 const STORED_AUTH_METHOD_KEY = 'bounded_last_auth_method';
+const ISSUER_SESSION_KIND_KEY = 'bounded_issuer_session_kind';
 function getStoredAuthMethod() {
     try {
         return getPlatform().storage.getItem(STORED_AUTH_METHOD_KEY);
@@ -4224,11 +4233,25 @@ function setStoredAuthMethod(method) {
         else {
             getPlatform().storage.removeItem(STORED_AUTH_METHOD_KEY);
         }
+        // Non-email providers cannot own a Better Auth browser session. Clear
+        // any prior hosted/inline classification when the active provider is
+        // replaced or the session is removed.
+        if (method !== 'email') {
+            getPlatform().storage.removeItem(ISSUER_SESSION_KIND_KEY);
+        }
     }
     catch (_a) {
         // storage might not be available
     }
 }
+function getIssuerSessionKind() {
+    try {
+        return getPlatform().storage.getItem(ISSUER_SESSION_KIND_KEY);
+    }
+    catch (_a) {
+        return null;
+    }
+}
 function getStoredIdToken() {
     try {
         return getActiveSessionManager().getIdToken();
@@ -4453,7 +4476,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-BF-vvbAt.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-Cb4VKA1E.mjs')).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4472,7 +4495,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-CcyA5JBS.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-ZkPzVj5W.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4485,7 +4508,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-Bi9G3X35.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-DnOrVMDX.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4513,7 +4536,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-DFNAHmtY.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-BBPpydtM.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4569,7 +4592,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-DFNAHmtY.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-BBPpydtM.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4827,15 +4850,15 @@ async function logout$1(options) {
     const idTokenHint = idTokenHintOrNull(sm);
     if (refreshToken)
         await revokeSession(refreshToken, sessionIssuer !== null && sessionIssuer !== void 0 ? sessionIssuer : undefined);
-    // Hosted sessions ('email' covers the whole hosted surface: email OTP +
-    // social + the OIDC redirect/popup flows) are the ones with an issuer
-    // cookie; wallet and guest sessions have nothing hosted to end.
-    // Check the STORED marker as well as the in-memory method: the hosted
-    // OIDC flows (loginWithPopup / completeLoginFromRedirect) write the
-    // 'email' marker via exchangeCode() but never touch currentAuthMethod,
-    // which stays 'guest'/explicit even after a hosted upgrade. Worst case of
-    // a false positive is a harmless idempotent issuer bounce.
-    const wasHosted = currentAuthMethod === 'email' || getStoredAuthMethod() === 'email';
+    // Only OIDC-hosted sessions own an issuer browser cookie. Turnkey-native
+    // email OTP is also an email auth method, but it mints the app session
+    // inline and has no issuer cookie to clear. Use the explicit session-kind
+    // marker when present. The auth-method fallback preserves correct logout
+    // behavior for hosted sessions created by older SDK versions.
+    const issuerSessionKind = getIssuerSessionKind();
+    const wasHosted = issuerSessionKind === 'hosted'
+        || (issuerSessionKind === null
+            && (currentAuthMethod === 'email' || getStoredAuthMethod() === 'email'));
     await currentAuthProvider.logout();
     setStoredAuthMethod(null);
     currentAuthProvider = null;
@@ -6396,4 +6419,4 @@ class PrivyExpoProvider {
 }
 
 export { useAuth as A, useQuery as B, useBuildRun as C, apps as D, EMBEDDED_WALLET_UNSUPPORTED as E, deserializeTransaction as F, getIdToken as G, onramp as H, onrampQuote as I, onrampStatus as J, setPlatform as K, builds as L, BuildsApiError as M, NON_TERMINAL_STATES as N, OffchainAuthProvider as O, PrivyExpoProvider as P, PARK_REASONS as Q, RUN_STATES as R, FAILURE_REASONS as S, TERMINAL_STATES as T, BUILD_REVIEW_CAPABILITY_SCHEMA as U, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as V, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as W, hasEmbeddedEvmWallet as a, embeddedSignAndSubmit as b, setAuthLoading as c, bufferExports as d, embeddedRunEvmTransaction as e, bs58 as f, getPlatform as g, hasEmbeddedWallet as h, confirmAndCheckTransaction as i, init as j, getCurrentUser as k, onAuthLoadingChanged as l, getAuthLoading as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, login as p, logout as q, resolveSolanaRpcUrl as r, setCurrentUser as s, getAuthProvider as t, signInAnonymously as u, loginWithPrivy as v, loginWithRedirect as w, completeLoginFromRedirect as x, loginWithPopup as y, completeLoginInPopup as z };
-//# sourceMappingURL=index.native-Crfn_NOB.mjs.map
+//# sourceMappingURL=index.native-BIUs8t7F.mjs.map