@glideidentity/web-client-sdk 4.4.8-beta.3 → 4.4.8

package/dist/core/phone-auth/strategies/link.js

@@ -17,8 +17,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LinkHandler = void 0;
 class LinkHandler {
     constructor() {
-        this.isPolling = false;
+        this.isPollingActive = false;
         this.isCancelled = false;
+        this.isPollingInProgress = false;
     }
     /**
      * Invoke link-based authentication
@@ -26,7 +27,6 @@ class LinkHandler {
      */
     invoke(data, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            console.log('[Link Auth] 🔗 SDK Version: 4.4.8-beta.2 (with enhanced error logging)');
             console.log('[Link Auth] 🔗 invoke() called with data:', JSON.stringify(data, null, 2));
             console.log('[Link Auth] Options:', options ? JSON.stringify({
                 pollingInterval: options.pollingInterval,
@@ -70,7 +70,7 @@ class LinkHandler {
     startPolling(sessionKey, linkData, options) {
         return __awaiter(this, void 0, void 0, function* () {
             const interval = (options === null || options === void 0 ? void 0 : options.pollingInterval) || 2000; // Fixed 2 second interval
-            const maxAttempts = (options === null || options === void 0 ? void 0 : options.maxPollingAttempts) || 150; // 5 minutes with 2s interval
+            const maxAttempts = (options === null || options === void 0 ? void 0 : options.maxPollingAttempts) || 30; // 1 minute with 2s interval
             let attempts = 0;
             console.log('[Link Auth] 🚀 Starting polling:', {
                 sessionKey,
@@ -79,27 +79,37 @@ class LinkHandler {
                 linkDataAvailable: !!linkData
             });
             return new Promise((resolve, reject) => {
-                this.isPolling = true;
+                this.isPollingActive = true;
+                this.pollingReject = reject; // Store reject function for cancel()
                 const poll = () => __awaiter(this, void 0, void 0, function* () {
-                    if (!this.isPolling) {
+                    if (!this.isPollingActive) {
                         return; // Polling was stopped
                     }
+                    // Skip if another poll is already in progress
+                    if (this.isPollingInProgress) {
+                        return;
+                    }
                     let statusUrl = ''; // Declare at function scope for catch block access
                     try {
-                        attempts++;
-                        // Check max attempts
+                        this.isPollingInProgress = true;
+                        // Check max attempts before making the request
                         if (attempts >= maxAttempts) {
                             this.stopPolling();
                             if (options === null || options === void 0 ? void 0 : options.onTimeout) {
                                 options.onTimeout();
                             }
+                            // Calculate actual timeout duration
+                            const timeoutSeconds = Math.round((maxAttempts * interval) / 1000);
+                            const timeoutMessage = timeoutSeconds >= 60
+                                ? `${Math.floor(timeoutSeconds / 60)} minute${Math.floor(timeoutSeconds / 60) > 1 ? 's' : ''}`
+                                : `${timeoutSeconds} seconds`;
                             if (options === null || options === void 0 ? void 0 : options.onStatusUpdate) {
                                 options.onStatusUpdate({
                                     status: 'expired',
-                                    message: 'Authentication timeout'
+                                    message: `Authentication timeout after ${timeoutMessage}`
                                 });
                             }
-                            reject(new Error('Authentication timeout after 5 minutes'));
+                            reject(new Error(`Authentication timeout after ${timeoutMessage}`));
                             return;
                         }
                         // Build public status endpoint URL
@@ -178,6 +188,7 @@ class LinkHandler {
                                     });
                                 }
                                 // Return the authentication result
+                                this.pollingReject = undefined; // Clear reject function on success
                                 resolve({
                                     authenticated: true,
                                     credential: result.credential || sessionKey,
@@ -193,6 +204,7 @@ class LinkHandler {
                             else if (result.status === 'pending') {
                                 // Continue polling
                                 console.log('[Link Auth] Status still pending, continuing to poll...');
+                                attempts++; // Increment attempts after successful poll
                                 if (options === null || options === void 0 ? void 0 : options.onStatusUpdate) {
                                     options.onStatusUpdate({
                                         status: 'pending',
@@ -203,6 +215,7 @@ class LinkHandler {
                             else {
                                 // Unexpected status value
                                 console.log('[Link Auth] ⚠️ Unexpected status value:', result.status, 'Full result:', JSON.stringify(result, null, 2));
+                                attempts++; // Increment for unexpected status too
                             }
                         }
                         else if (response.status === 410) {
@@ -263,6 +276,7 @@ class LinkHandler {
                         else {
                             // Unexpected status - continue polling
                             console.log('[Link Auth] ⚠️ Unexpected HTTP status:', response.status, 'continuing to poll...');
+                            attempts++; // Increment for unexpected HTTP status
                             try {
                                 const body = yield response.text();
                                 console.log('[Link Auth] Response body:', body);
@@ -275,6 +289,7 @@ class LinkHandler {
                     catch (error) {
                         // Network or other error - continue polling
                         console.error('[Link Auth] 🔴 Polling error:', error.message || error);
+                        attempts++; // Increment for error case
                         console.error('[Link Auth] Error details:', {
                             name: error.name,
                             message: error.message,
@@ -295,6 +310,10 @@ class LinkHandler {
                             });
                         }
                     }
+                    finally {
+                        // Always clear the polling flag when done
+                        this.isPollingInProgress = false;
+                    }
                 });
                 // Start initial poll immediately
                 poll();
@@ -308,7 +327,8 @@ class LinkHandler {
      */
     stopPolling() {
         console.log('[Link Auth] 🏁 Stopping polling');
-        this.isPolling = false;
+        this.isPollingActive = false;
+        this.isPollingInProgress = false;
         if (this.pollingInterval) {
             clearInterval(this.pollingInterval);
             this.pollingInterval = undefined;
@@ -343,15 +363,31 @@ class LinkHandler {
         this.stopPolling();
         this.isCancelled = false;
         this.onCancel = undefined;
+        this.pollingReject = undefined;
+    }
+    /**
+     * Check if polling is currently active
+     */
+    isPolling() {
+        return this.pollingInterval !== undefined;
     }
     /**
      * Cancel the ongoing authentication
      */
     cancel() {
         var _a;
+        console.log('[Link Auth] Cancelling authentication');
         this.isCancelled = true;
         this.stopPolling();
         (_a = this.onCancel) === null || _a === void 0 ? void 0 : _a.call(this);
+        // Immediately reject the polling promise
+        if (this.pollingReject) {
+            this.pollingReject({
+                code: 'USER_DENIED',
+                message: 'Authentication cancelled by user'
+            });
+            this.pollingReject = undefined;
+        }
     }
 }
 exports.LinkHandler = LinkHandler;

package/dist/core/phone-auth/types.d.ts

@@ -72,7 +72,7 @@ export interface AuthConfig extends PhoneAuthCallbacks {
     pollingInterval?: number;
     /**
      * Maximum polling attempts before timeout
-     * @default 150 (5 minutes with 2s interval)
+     * @default 30 (1 minute with 2s interval)
      */
     maxPollingAttempts?: number;
     /**

package/dist/core/phone-auth/ui/modal.d.ts

@@ -26,6 +26,10 @@ export declare class AuthModal {
     private closeCallback?;
     constructor(options?: InvokeOptions['modalOptions'], callbacks?: InvokeOptions['callbacks']);
     private handleEscapeKey;
+    /**
+     * Escape HTML to prevent XSS attacks
+     */
+    private escapeHtml;
     /**
      * Shows the modal with a QR code for desktop authentication
      * Supports both single QR code (legacy) and dual-platform QR codes (iOS + Android)

package/dist/core/phone-auth/ui/modal.js

@@ -47,6 +47,17 @@ class AuthModal {
             }
         }
     }
+    /**
+     * Escape HTML to prevent XSS attacks
+     */
+    escapeHtml(unsafe) {
+        return unsafe
+            .replace(/&/g, "&")
+            .replace(/</g, "&lt;")
+            .replace(/>/g, "&gt;")
+            .replace(/"/g, "&quot;")
+            .replace(/'/g, "&#039;");
+    }
     /**
      * Shows the modal with a QR code for desktop authentication
      * Supports both single QR code (legacy) and dual-platform QR codes (iOS + Android)
@@ -75,7 +86,7 @@ class AuthModal {
                 // Only iOS QR code available - show single QR
                 this.createModal(`
           <div class="glide-auth-qr-container">
-            <img src="${qrCodeData.iosQRCode}" alt="QR Code" class="glide-auth-qr-code" />
+            <img src="${this.escapeHtml(qrCodeData.iosQRCode)}" alt="QR Code" class="glide-auth-qr-code" />
             <p class="glide-auth-status">Scan with your iPhone to authenticate</p>
           </div>
         `);
@@ -86,8 +97,8 @@ class AuthModal {
             // Legacy single QR code
             this.createModal(`
         <div class="glide-auth-qr-container">
-          <img src="${qrCodeData}" alt="QR Code" class="glide-auth-qr-code" />
-          <p class="glide-auth-status">${statusMessage}</p>
+          <img src="${this.escapeHtml(qrCodeData)}" alt="QR Code" class="glide-auth-qr-code" />
+          <p class="glide-auth-status">${this.escapeHtml(statusMessage)}</p>
         </div>
       `);
         }
@@ -118,11 +129,11 @@ class AuthModal {
         <!-- QR Code Image -->
         <img 
           id="glide-qr-code-img" 
-          src="${qrCodeData.iosQRCode}" 
+          src="${this.escapeHtml(qrCodeData.iosQRCode)}" 
           alt="QR Code" 
           class="glide-auth-qr-code" 
-          data-ios="${qrCodeData.iosQRCode}"
-          data-android="${qrCodeData.androidQRCode}"
+          data-ios="${this.escapeHtml(qrCodeData.iosQRCode)}"
+          data-android="${this.escapeHtml(qrCodeData.androidQRCode || '')}"
         />
         
         <!-- Status Message -->

package/dist/core/version.js

@@ -2,4 +2,4 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_VERSION = void 0;
 // SDK version - injected at build time
-exports.SDK_VERSION = '4.4.8-beta.3';
+exports.SDK_VERSION = '4.4.8';

package/dist/esm/core/phone-auth/client.js

@@ -170,6 +170,10 @@ export class PhoneAuthClient {
                 }
                 // Step 3: Process the response through appropriate endpoint
                 const credential = credentialResponse;
+                // Validate use_case is provided for endpoint selection
+                if (!options.use_case) {
+                    throw this.createError(PhoneAuthErrorCode.MISSING_PARAMETERS, 'use_case is required', { field: 'use_case' });
+                }
                 const result = options.use_case === API.USE_CASE.GET_PHONE_NUMBER
                     ? yield this.getPhoneNumber(credential, preparedRequest.session)
                     : yield this.verifyPhoneNumber(credential, preparedRequest.session);
@@ -278,16 +282,7 @@ export class PhoneAuthClient {
      */
     preparePhoneRequest(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            // Validate use case requirements first
-            // const useCaseValidation = validateUseCaseRequirements(options.use_case, options.phone_number);
-            // if (!useCaseValidation.valid) {
-            //   throw this.createError(
-            //     PhoneAuthErrorCode.BAD_REQUEST,
-            //     useCaseValidation.error!,
-            //     { field: 'use_case' }
-            //   );
-            // }
-            var _a, _b;
+            var _a, _b, _c;
             // Validate phone number if provided
             if (options.phone_number) {
                 const phoneValidation = validatePhoneNumber(options.phone_number);
@@ -309,8 +304,12 @@ export class PhoneAuthClient {
                     throw this.createError(PhoneAuthErrorCode.BAD_REQUEST, consentValidation.error, { field: 'consent_data' });
                 }
             }
+            // Validate use_case is provided (unless only parent_session_id is given)
+            if (!options.use_case && !(((_a = options.options) === null || _a === void 0 ? void 0 : _a.parent_session_id) && !options.phone_number && !options.plmn)) {
+                throw this.createError(PhoneAuthErrorCode.MISSING_PARAMETERS, 'use_case is required', { field: 'use_case' });
+            }
             // Validate required parameters based on use case
-            if (!options.phone_number && !options.plmn && !((_a = options.options) === null || _a === void 0 ? void 0 : _a.parent_session_id)) {
+            if (!options.phone_number && !options.plmn && !((_b = options.options) === null || _b === void 0 ? void 0 : _b.parent_session_id)) {
                 // Provide specific error message based on use case
                 if (options.use_case === API.USE_CASE.GET_PHONE_NUMBER) {
                     throw this.createError(PhoneAuthErrorCode.MISSING_PARAMETERS, 'PLMN (MCC/MNC) is required for GetPhoneNumber. Please provide carrier network information.', { field: 'plmn', useCase: 'GetPhoneNumber' });
@@ -318,19 +317,15 @@ export class PhoneAuthClient {
                 else if (options.use_case === API.USE_CASE.VERIFY_PHONE_NUMBER) {
                     throw this.createError(PhoneAuthErrorCode.MISSING_PARAMETERS, 'Phone number is required for VerifyPhoneNumber', { field: 'phoneNumber', useCase: 'VerifyPhoneNumber' });
                 }
-                else if (!options.use_case) {
-                    // If no use case, that's an error
-                    throw this.createError(PhoneAuthErrorCode.MISSING_PARAMETERS, 'use_case is required', { field: 'use_case' });
-                }
                 else {
                     // Fallback for other use cases
                     throw this.createError(PhoneAuthErrorCode.MISSING_PARAMETERS, 'Either phone number or PLMN (MCC/MNC) must be provided', { field: 'phoneNumber,plmn' });
                 }
             }
-            // If only parent_session_id is provided, use_case is optional (will be inherited)
-            if (((_b = options.options) === null || _b === void 0 ? void 0 : _b.parent_session_id) && !options.phone_number && !options.plmn && !options.use_case) {
+            // Log parent session usage
+            if (((_c = options.options) === null || _c === void 0 ? void 0 : _c.parent_session_id) && !options.phone_number && !options.plmn) {
                 if (this.debug) {
-                    console.log('[PhoneAuth] Using parent_session_id only - all fields will be inherited from parent session');
+                    console.log('[PhoneAuth] Using parent_session_id: %s, use_case: %s', options.options.parent_session_id, options.use_case || 'not provided');
                 }
             }
             const requestId = `web-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
@@ -345,11 +340,13 @@ export class PhoneAuthClient {
                 throw this.createError(PhoneAuthErrorCode.INTERNAL_SERVER_ERROR, 'Failed to generate valid nonce', { field: 'nonce' });
             }
             // Build properly typed request body according to API specification
+            // Be permissive - backend will ignore extra fields if not needed
             const requestBody = {
-                // Required fields
+                // Include use_case if provided (optional when parent_session_id is given)
                 use_case: options.use_case,
-                // One of these is required
+                // Include phone_number if provided (backend ignores if not needed)
                 phone_number: options.phone_number,
+                // Include PLMN if provided
                 plmn: options.plmn ? {
                     mcc: options.plmn.mcc,
                     mnc: options.plmn.mnc
@@ -381,7 +378,7 @@ export class PhoneAuthClient {
                         // Always include the HTTP status from the response
                         errorDetails = Object.assign(Object.assign({}, errorDetails), { status: response.status });
                     }
-                    catch (_c) {
+                    catch (_d) {
                         // If JSON parsing fails, use status text
                         errorDetails = { status: response.status, statusText: response.statusText };
                     }
@@ -649,12 +646,15 @@ export class PhoneAuthClient {
                 });
                 // TS43 always auto-triggers (no SDK UI ever)
                 // The Digital Credentials API provides its own OS-level UI
-                let credentialPromise;
+                // Use a wrapper object to allow updating the promise reference
+                const credentialWrapper = {
+                    promise: null
+                };
                 try {
                     // Always try to trigger immediately
                     const vpToken = yield enhancedTriggerTS43();
                     // Convert to AuthCredential format
-                    credentialPromise = Promise.resolve({
+                    credentialWrapper.promise = Promise.resolve({
                         credential: typeof vpToken === 'string' ? vpToken : Object.values(vpToken)[0],
                         session: plainResponse.session,
                         authenticated: true
@@ -662,36 +662,46 @@ export class PhoneAuthClient {
                 }
                 catch (error) {
                     // If auto-trigger fails, create a rejected promise
-                    credentialPromise = Promise.reject(error);
+                    credentialWrapper.promise = Promise.reject(error);
                 }
                 // Handle based on execution mode
                 if (executionMode === 'extended') {
                     // Extended mode - return control methods
-                    return {
+                    const response = {
                         strategy: 'ts43',
                         session: plainResponse.session,
-                        credential: credentialPromise,
+                        credential: credentialWrapper.promise, // Initial value
                         // Re-trigger credential request
                         trigger: () => __awaiter(this, void 0, void 0, function* () {
                             const vpToken = yield enhancedTriggerTS43();
-                            // Update the credential promise
-                            credentialPromise = Promise.resolve({
+                            // Update the credential promise in the wrapper
+                            credentialWrapper.promise = Promise.resolve({
                                 credential: typeof vpToken === 'string' ? vpToken : Object.values(vpToken)[0],
                                 session: plainResponse.session,
                                 authenticated: true
                             });
+                            // Return void as per interface
                         }),
                         cancel: () => {
                             // TS43 doesn't have a way to cancel once triggered
                             // but we can reject the promise
-                            credentialPromise = Promise.reject(this.createError(PhoneAuthErrorCode.USER_DENIED, 'Authentication cancelled'));
+                            credentialWrapper.promise = Promise.reject(this.createError(PhoneAuthErrorCode.USER_DENIED, 'Authentication cancelled'));
                         }
                     };
+                    // Define credential as a getter that always returns the current promise
+                    Object.defineProperty(response, 'credential', {
+                        get() {
+                            return credentialWrapper.promise;
+                        },
+                        enumerable: true,
+                        configurable: true
+                    });
+                    return response;
                 }
                 else {
                     // Standard mode - just return credential
                     // Wait for and return the credential
-                    const credential = yield credentialPromise;
+                    const credential = yield credentialWrapper.promise;
                     // Return in standard format
                     return {
                         [plainResponse.session.session_key]: credential.credential
@@ -721,7 +731,7 @@ export class PhoneAuthClient {
                 const pollingEndpointToUse = (invokeOptions === null || invokeOptions === void 0 ? void 0 : invokeOptions.pollingEndpoint) ||
                     (desktopOptions === null || desktopOptions === void 0 ? void 0 : desktopOptions.pollingEndpoint) ||
                     ((_m = this.config.endpoints) === null || _m === void 0 ? void 0 : _m.polling);
-                const pollingOptions = Object.assign(Object.assign({}, desktopOptions), { pollingEndpoint: pollingEndpointToUse, pollingInterval: (invokeOptions === null || invokeOptions === void 0 ? void 0 : invokeOptions.pollingInterval) || (desktopOptions === null || desktopOptions === void 0 ? void 0 : desktopOptions.pollingInterval) || this.config.pollingInterval || 2000, maxPollingAttempts: (invokeOptions === null || invokeOptions === void 0 ? void 0 : invokeOptions.maxPollingAttempts) || (desktopOptions === null || desktopOptions === void 0 ? void 0 : desktopOptions.maxPollingAttempts) || this.config.maxPollingAttempts || 150, onQRCodeReady: undefined, onStatusUpdate: undefined });
+                const pollingOptions = Object.assign(Object.assign({}, desktopOptions), { pollingEndpoint: pollingEndpointToUse, pollingInterval: (invokeOptions === null || invokeOptions === void 0 ? void 0 : invokeOptions.pollingInterval) || (desktopOptions === null || desktopOptions === void 0 ? void 0 : desktopOptions.pollingInterval) || this.config.pollingInterval || 2000, maxPollingAttempts: (invokeOptions === null || invokeOptions === void 0 ? void 0 : invokeOptions.maxPollingAttempts) || (desktopOptions === null || desktopOptions === void 0 ? void 0 : desktopOptions.maxPollingAttempts) || this.config.maxPollingAttempts || 30, onQRCodeReady: undefined, onStatusUpdate: undefined });
                 // Decide whether to show modal based on preventDefaultUI
                 const showModal = !preventDefaultUI;
                 let modal;
@@ -784,31 +794,79 @@ export class PhoneAuthClient {
                 // Handle based on execution mode
                 if (executionMode === 'extended') {
                     // Extended mode - return control methods
-                    const credentialPromise = showModal ? startPolling() : Promise.resolve({
-                        credential: '',
-                        session: plainResponse.session,
-                        authenticated: false
+                    let credentialResolve = null;
+                    let credentialReject = null;
+                    let pollingStarted = false;
+                    // Create a promise that will remain pending until polling starts
+                    const credentialPromise = new Promise((resolve, reject) => {
+                        credentialResolve = resolve;
+                        credentialReject = reject;
+                        // If modal is shown, start polling immediately
+                        if (showModal) {
+                            pollingStarted = true;
+                            startPolling()
+                                .then(resolve)
+                                .catch(reject);
+                        }
+                        // Otherwise, promise remains pending until start_polling() is called
                     });
-                    return {
+                    // Create wrapped functions
+                    const wrappedStartPolling = () => __awaiter(this, void 0, void 0, function* () {
+                        if (pollingStarted) {
+                            throw this.createError(PhoneAuthErrorCode.INVALID_SESSION_STATE, 'Polling has already been started');
+                        }
+                        pollingStarted = true;
+                        try {
+                            const result = yield startPolling();
+                            if (credentialResolve) {
+                                credentialResolve(result);
+                            }
+                            return result;
+                        }
+                        catch (err) {
+                            if (credentialReject) {
+                                credentialReject(err);
+                            }
+                            throw err;
+                        }
+                    });
+                    const wrappedStopPolling = () => {
+                        handler.cleanup();
+                        if (modal)
+                            modal.close();
+                    };
+                    const wrappedCancel = () => {
+                        handler.cancel();
+                        handler.cleanup();
+                        if (modal)
+                            modal.close();
+                        // Reject the credential promise if it's still pending
+                        if (!pollingStarted && credentialReject) {
+                            credentialReject(this.createError(PhoneAuthErrorCode.USER_DENIED, 'Desktop authentication cancelled by user'));
+                        }
+                    };
+                    // Create the response object with a getter for is_polling
+                    const response = {
                         strategy: 'desktop',
                         session: plainResponse.session,
                         credential: credentialPromise,
                         qr_code_data: qrCodeDataSnakeCase,
                         modal_ref: modalRef,
-                        start_polling: startPolling,
-                        stop_polling: () => {
-                            handler.cleanup();
-                            if (modal)
-                                modal.close();
-                        },
-                        cancel: () => {
-                            handler.cancel();
-                            handler.cleanup();
-                            if (modal)
-                                modal.close();
-                        },
-                        is_polling: showModal // If modal shown, polling already started
+                        start_polling: wrappedStartPolling,
+                        stop_polling: wrappedStopPolling,
+                        cancel: wrappedCancel,
+                        // This will be replaced with a getter
+                        is_polling: false // Initial value, will be overridden by getter
                     };
+                    // Define is_polling as a getter that returns current state
+                    Object.defineProperty(response, 'is_polling', {
+                        get() {
+                            return handler.isPolling();
+                        },
+                        enumerable: true,
+                        configurable: true
+                    });
+                    return response;
                 }
                 else {
                     // Standard mode - return credential when complete
@@ -872,28 +930,62 @@ export class PhoneAuthClient {
                 const pollingOptions = {
                     pollingEndpoint: (invokeOptions === null || invokeOptions === void 0 ? void 0 : invokeOptions.pollingEndpoint) || ((_q = this.config.endpoints) === null || _q === void 0 ? void 0 : _q.polling),
                     pollingInterval: (invokeOptions === null || invokeOptions === void 0 ? void 0 : invokeOptions.pollingInterval) || this.config.pollingInterval || 2000,
-                    maxPollingAttempts: (invokeOptions === null || invokeOptions === void 0 ? void 0 : invokeOptions.maxPollingAttempts) || this.config.maxPollingAttempts || 150,
+                    maxPollingAttempts: (invokeOptions === null || invokeOptions === void 0 ? void 0 : invokeOptions.maxPollingAttempts) || this.config.maxPollingAttempts || 30,
                     onLinkOpened: undefined,
                     onStatusUpdate: undefined
                 };
                 console.log('[PhoneAuth Client] Final Link polling options:', pollingOptions);
-                // Create credential promise
-                const credentialPromise = handler.invoke(plainResponse, pollingOptions).then(result => {
-                    if (result.authenticated && result.credential) {
-                        return {
-                            credential: result.credential,
-                            session: plainResponse.session,
-                            authenticated: true
-                        };
-                    }
-                    else {
-                        throw this.createError(PhoneAuthErrorCode.USER_DENIED, result.error || 'Link authentication failed');
-                    }
-                });
                 // Handle based on execution mode
                 if (executionMode === 'extended') {
-                    // Extended mode - return control methods
-                    return {
+                    // Extended mode - return control methods without starting polling immediately
+                    let credentialResolve = null;
+                    let credentialReject = null;
+                    let pollingStarted = false;
+                    let pollingPromise = null;
+                    // Create a pending promise that will be resolved when polling completes
+                    const credentialPromise = new Promise((resolve, reject) => {
+                        credentialResolve = resolve;
+                        credentialReject = reject;
+                    });
+                    // Function to start polling (only once)
+                    const startPolling = () => __awaiter(this, void 0, void 0, function* () {
+                        if (pollingStarted) {
+                            throw this.createError(PhoneAuthErrorCode.INVALID_SESSION_STATE, 'Polling has already been started');
+                        }
+                        pollingStarted = true;
+                        try {
+                            // Store the polling promise to ensure we use the same one
+                            if (!pollingPromise) {
+                                pollingPromise = handler.invoke(plainResponse, pollingOptions);
+                            }
+                            const result = yield pollingPromise;
+                            if (result.authenticated && result.credential) {
+                                const authCredential = {
+                                    credential: result.credential,
+                                    session: plainResponse.session,
+                                    authenticated: true
+                                };
+                                if (credentialResolve) {
+                                    credentialResolve(authCredential);
+                                }
+                                return authCredential;
+                            }
+                            else {
+                                const error = this.createError(PhoneAuthErrorCode.USER_DENIED, result.error || 'Link authentication failed');
+                                if (credentialReject) {
+                                    credentialReject(error);
+                                }
+                                throw error;
+                            }
+                        }
+                        catch (err) {
+                            if (credentialReject) {
+                                credentialReject(err);
+                            }
+                            throw err;
+                        }
+                    });
+                    const response = {
                         strategy: 'link',
                         session: plainResponse.session,
                         credential: credentialPromise,
@@ -902,22 +994,44 @@ export class PhoneAuthClient {
                         },
                         // Re-open the app link
                         trigger: triggerLink,
-                        // Polling control
-                        start_polling: () => handler.invoke(plainResponse, pollingOptions).then(result => ({
-                            credential: result.credential || '',
-                            session: plainResponse.session,
-                            authenticated: result.authenticated
-                        })),
+                        // Polling control - now prevents double polling
+                        start_polling: startPolling,
                         stop_polling: () => handler.cleanup(),
                         cancel: () => {
                             handler.cancel();
                             handler.cleanup();
+                            // Reject the credential promise if polling hasn't started
+                            if (!pollingStarted && credentialReject) {
+                                credentialReject(this.createError(PhoneAuthErrorCode.USER_DENIED, 'Link authentication cancelled by user'));
+                            }
                         },
-                        is_polling: true
+                        // This will be replaced with a getter
+                        is_polling: false // Initial value, will be overridden by getter
                     };
+                    // Define is_polling as a getter that returns current state
+                    Object.defineProperty(response, 'is_polling', {
+                        get() {
+                            return handler.isPolling();
+                        },
+                        enumerable: true,
+                        configurable: true
+                    });
+                    return response;
                 }
                 else {
-                    // Standard mode - return credential when complete
+                    // Standard mode - start polling immediately and wait for completion
+                    const credentialPromise = handler.invoke(plainResponse, pollingOptions).then(result => {
+                        if (result.authenticated && result.credential) {
+                            return {
+                                credential: result.credential,
+                                session: plainResponse.session,
+                                authenticated: true
+                            };
+                        }
+                        else {
+                            throw this.createError(PhoneAuthErrorCode.USER_DENIED, result.error || 'Link authentication failed');
+                        }
+                    });
                     // Wait for credential and return in standard format
                     const credential = yield credentialPromise;
                     const aggregatorId = this.config.aggregatorId || 'default';