@bounded-sh/client 0.0.60 → 0.0.62

package/dist/{index.native-CDfx0N6p.js → index.native-BSheiGj2.js}

@@ -3707,6 +3707,7 @@ const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wa
     'then sign from a user gesture.';
 const PKCE_STORE_KEY = 'bounded.oidc.pkce';
 const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
+const ISSUER_SESSION_KIND_KEY$1 = 'bounded_issuer_session_kind';
 // Active session store (Web on web, RN on React Native) — selected by config,
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
@@ -4213,6 +4214,13 @@ async function exchangeCode(code, verifier, redirectUri) {
         getPlatform().storage.setItem(STORED_AUTH_METHOD_KEY$1, 'email');
     }
     catch ( /* storage unavailable */_b) { /* storage unavailable */ }
+    // OIDC login does establish the issuer's Better Auth browser cookie. Record
+    // that fact separately from the provider name so logout clears the cookie
+    // and returns through the registered app origin.
+    try {
+        getPlatform().storage.setItem(ISSUER_SESSION_KIND_KEY$1, 'hosted');
+    }
+    catch ( /* storage unavailable */_c) { /* storage unavailable */ }
     setCurrentUser(user);
     setAuthProviderInstance(oidcProviderSingleton);
     return user;
@@ -4229,6 +4237,7 @@ const objectIdentityKeys = new WeakMap();
 let nextObjectIdentityKey = 1;
 // --- localStorage helpers: track which auth method created the active session ---
 const STORED_AUTH_METHOD_KEY = 'bounded_last_auth_method';
+const ISSUER_SESSION_KIND_KEY = 'bounded_issuer_session_kind';
 function getStoredAuthMethod() {
     try {
         return getPlatform().storage.getItem(STORED_AUTH_METHOD_KEY);
@@ -4245,11 +4254,25 @@ function setStoredAuthMethod(method) {
         else {
             getPlatform().storage.removeItem(STORED_AUTH_METHOD_KEY);
         }
+        // Non-email providers cannot own a Better Auth browser session. Clear
+        // any prior hosted/inline classification when the active provider is
+        // replaced or the session is removed.
+        if (method !== 'email') {
+            getPlatform().storage.removeItem(ISSUER_SESSION_KIND_KEY);
+        }
     }
     catch (_a) {
         // storage might not be available
     }
 }
+function getIssuerSessionKind() {
+    try {
+        return getPlatform().storage.getItem(ISSUER_SESSION_KIND_KEY);
+    }
+    catch (_a) {
+        return null;
+    }
+}
 function getStoredIdToken() {
     try {
         return core.getActiveSessionManager().getIdToken();
@@ -4474,7 +4497,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BCEdcnRu.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BttT2sZK.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4493,7 +4516,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-TPx8Wzvq.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BMDJntMD.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4506,7 +4529,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CGa692L1.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-7XawIUdJ.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4534,7 +4557,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CrRreOyf.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BcR-MQ0g.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4590,7 +4613,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CrRreOyf.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BcR-MQ0g.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4848,15 +4871,15 @@ async function logout$1(options) {
     const idTokenHint = idTokenHintOrNull(sm);
     if (refreshToken)
         await core.revokeSession(refreshToken, sessionIssuer !== null && sessionIssuer !== void 0 ? sessionIssuer : undefined);
-    // Hosted sessions ('email' covers the whole hosted surface: email OTP +
-    // social + the OIDC redirect/popup flows) are the ones with an issuer
-    // cookie; wallet and guest sessions have nothing hosted to end.
-    // Check the STORED marker as well as the in-memory method: the hosted
-    // OIDC flows (loginWithPopup / completeLoginFromRedirect) write the
-    // 'email' marker via exchangeCode() but never touch currentAuthMethod,
-    // which stays 'guest'/explicit even after a hosted upgrade. Worst case of
-    // a false positive is a harmless idempotent issuer bounce.
-    const wasHosted = currentAuthMethod === 'email' || getStoredAuthMethod() === 'email';
+    // Only OIDC-hosted sessions own an issuer browser cookie. Turnkey-native
+    // email OTP is also an email auth method, but it mints the app session
+    // inline and has no issuer cookie to clear. Use the explicit session-kind
+    // marker when present. The auth-method fallback preserves correct logout
+    // behavior for hosted sessions created by older SDK versions.
+    const issuerSessionKind = getIssuerSessionKind();
+    const wasHosted = issuerSessionKind === 'hosted'
+        || (issuerSessionKind === null
+            && (currentAuthMethod === 'email' || getStoredAuthMethod() === 'email'));
     await currentAuthProvider.logout();
     setStoredAuthMethod(null);
     currentAuthProvider = null;
@@ -6465,4 +6488,4 @@ exports.signInAnonymously = signInAnonymously;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
-//# sourceMappingURL=index.native-CDfx0N6p.js.map
+//# sourceMappingURL=index.native-BSheiGj2.js.map