@oasisprotocol/privana-sdk 0.5.2 → 0.5.3

package/dist/{chunk-UHXVYWTF.cjs → chunk-7KEQHWZB.cjs}

@@ -1,10 +1,10 @@
 "use client";
 'use strict';
 
+var siwe = require('viem/siwe');
 var react = require('react');
 var wagmi = require('wagmi');
 var actions = require('wagmi/actions');
-var siwe = require('viem/siwe');
 var jsxRuntime = require('react/jsx-runtime');
 var viem = require('viem');
 var reactQuery = require('@tanstack/react-query');
@@ -97,8 +97,11 @@ function getExplorerAddressUrl(chainId, address) {
   return `${chain.explorerUrl}/address/${address}#tokentxns`;
 }
 
+// src/sdk/auth/auth-clock-skew.ts
+var AUTH_CLOCK_SKEW_MS = 3e4;
+
 // src/sdk/auth/hosted-auth.ts
-var HOSTED_AUTH_CLOCK_SKEW_MS = 3e4;
+var HOSTED_AUTH_CLOCK_SKEW_MS = AUTH_CLOCK_SKEW_MS;
 var PKCE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
 var DEFAULT_RANDOM_LENGTH = 64;
 var HOSTED_AUTH_CALLBACK_QUERY_KEYS = ["code", "error", "error_description", "state"];
@@ -220,11 +223,32 @@ function isHostedAuthSessionActive(session, now = Date.now(), skewMs = HOSTED_AU
 function isHostedAuthRefreshActive(session, now = Date.now(), skewMs = HOSTED_AUTH_CLOCK_SKEW_MS) {
   return session.refreshExpiresAt > now + skewMs;
 }
-
-// src/sdk/auth/siwe.ts
+var SIWE_MESSAGE_VALIDITY_MS = 24 * 60 * 60 * 1e3;
 function buildSiweStatement(chainId) {
   return `Sign in to Privana on chain ${chainId}`;
 }
+async function buildSiweLoginMessage(api, params) {
+  const { address, chainId, apiUrl } = params;
+  const [{ domain }, { nonce }] = await Promise.all([
+    api.getSiweDomain(),
+    api.getSiweNonce(address)
+  ]);
+  const issuedAt = /* @__PURE__ */ new Date();
+  const expirationTime = new Date(issuedAt.getTime() + SIWE_MESSAGE_VALIDITY_MS);
+  const uri = typeof window !== "undefined" && window.location.origin ? window.location.origin : apiUrl;
+  const message = siwe.createSiweMessage({
+    address,
+    chainId,
+    domain,
+    expirationTime,
+    issuedAt,
+    nonce,
+    statement: buildSiweStatement(chainId),
+    uri,
+    version: "1"
+  });
+  return { message, expirationTime };
+}
 
 // src/sdk/client/errors.ts
 var AccountingApiError = class _AccountingApiError extends Error {
@@ -349,9 +373,10 @@ var HttpClient = class {
 var PRIVATE_READ_TOKEN_HEADER = "X-SIWE-Token";
 var MAX_BATCH_BALANCE_TOKEN_IDS = 100;
 var MAX_HISTORY_PAGE_SIZE = 100;
-var PrivanaClient = class {
+var PrivanaClient = class _PrivanaClient {
   constructor(config) {
     this.http = new HttpClient(config);
+    this.baseConfig = { ...config, headers: { ...config.headers } };
   }
   getBaseUrl() {
     return this.http.getBaseUrl();
@@ -621,10 +646,23 @@ var PrivanaClient = class {
   async getPendingOnRamps() {
     return this.http.get("/v1/accounting/onramp/pending");
   }
+  /**
+   * @deprecated This mutates the shared client's headers and displaces its Authorization
+   * (JWT bearer) header, which breaks concurrent JWT-authenticated requests. Use
+   * {@link PrivanaClient.withPrivateReadToken} instead, which returns a scoped client that
+   * authenticates the private read without touching the shared client's headers. Will be
+   * removed in a future release.
+   */
   setPrivateReadToken(token) {
     this.http.removeHeader("Authorization");
     this.http.setHeader(PRIVATE_READ_TOKEN_HEADER, token);
   }
+  /**
+   * @deprecated The shared client no longer carries a private-read token between requests;
+   * private reads now run on a scoped client from {@link PrivanaClient.withPrivateReadToken}.
+   * Returns whatever X-SIWE-Token is currently set on the shared client's headers. Will be
+   * removed in a future release.
+   */
   getPrivateReadToken() {
     return this.http.getHeader(PRIVATE_READ_TOKEN_HEADER);
   }
@@ -638,6 +676,26 @@ var PrivanaClient = class {
   clearBearerToken() {
     this.http.removeHeader("Authorization");
   }
+  /**
+   * Returns a scoped client whose requests authenticate with the given SIWE private-read
+   * token (X-SIWE-Token) instead of the client-wide JWT bearer. The scoped client shares
+   * baseUrl/timeout/base headers but owns a separate header set, so private reads issued
+   * through it never displace the real client's Authorization header: concurrent
+   * JWT-authenticated requests on the real client keep their bearer, and a bearer installed
+   * mid-flight (auto-login/hydration) is never erased by a private read.
+   */
+  withPrivateReadToken(token) {
+    const headers = {};
+    for (const [name, value] of Object.entries(this.baseConfig.headers ?? {})) {
+      const lower = name.toLowerCase();
+      if (lower === "authorization" || lower === PRIVATE_READ_TOKEN_HEADER.toLowerCase()) {
+        continue;
+      }
+      headers[name] = value;
+    }
+    headers[PRIVATE_READ_TOKEN_HEADER] = token;
+    return new _PrivanaClient({ ...this.baseConfig, headers });
+  }
 };
 
 // src/sdk/signatures/eip712-types.ts
@@ -867,8 +925,421 @@ function useSafeAccount() {
   return react.useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
 }
 
+// src/sdk/auth/siwe-persistence.ts
+var PERSISTED_SIWE_AUTH_RECORD_VERSION = 2;
+var warnedBlockedStorage = false;
+function warnBlockedStorageOnce() {
+  if (warnedBlockedStorage) return;
+  warnedBlockedStorage = true;
+  if (typeof console !== "undefined" && typeof console.warn === "function") {
+    console.warn(
+      "Privana SIWE auth: localStorage is unavailable or blocked; sessions will stay in memory only."
+    );
+  }
+}
+function createSiweAuthStorageKey(apiUrl, chainId) {
+  const normalizedApiUrl = apiUrl.replace(/\/$/, "");
+  return ["privana", "siwe-auth", normalizedApiUrl, String(chainId)].join(":");
+}
+function buildPersistedSiweAuthRecordFromLogin(response, now, siweTokenExpiresAt) {
+  return {
+    version: PERSISTED_SIWE_AUTH_RECORD_VERSION,
+    tokens: {
+      siwe_token: response.siwe_token,
+      jwt_access_token: response.jwt_access_token,
+      jwt_refresh_token: response.jwt_refresh_token,
+      address: response.address
+    },
+    accessTokenExpiresAt: now + response.jwt_expires_in * 1e3,
+    refreshTokenExpiresAt: now + response.jwt_refresh_expires_in * 1e3,
+    siweTokenExpiresAt,
+    updatedAt: now
+  };
+}
+function applyRefreshToPersistedSiweAuthRecord(previous, response, now = Date.now()) {
+  return {
+    ...previous,
+    tokens: {
+      ...previous.tokens,
+      jwt_access_token: response.token,
+      jwt_refresh_token: response.refresh_token
+    },
+    accessTokenExpiresAt: now + response.expires_in * 1e3,
+    refreshTokenExpiresAt: now + response.refresh_expires_in * 1e3,
+    updatedAt: now
+  };
+}
+function isPersistedSiweAuthRecord(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  if (record.version !== PERSISTED_SIWE_AUTH_RECORD_VERSION) return false;
+  if (typeof record.accessTokenExpiresAt !== "number") return false;
+  if (typeof record.refreshTokenExpiresAt !== "number") return false;
+  if (typeof record.siweTokenExpiresAt !== "number") return false;
+  if (typeof record.updatedAt !== "number") return false;
+  const tokens = record.tokens;
+  if (typeof tokens !== "object" || tokens === null) return false;
+  const tokenFields = tokens;
+  return typeof tokenFields.siwe_token === "string" && typeof tokenFields.jwt_access_token === "string" && typeof tokenFields.jwt_refresh_token === "string" && typeof tokenFields.address === "string" && tokenFields.address.length > 0;
+}
+function isPersistedSiweAuthAccessActive(record, now = Date.now()) {
+  return record.accessTokenExpiresAt > now + AUTH_CLOCK_SKEW_MS;
+}
+function isPersistedSiweAuthRefreshActive(record, now = Date.now()) {
+  return record.refreshTokenExpiresAt > now + AUTH_CLOCK_SKEW_MS;
+}
+function parsePersistedSiweAuthRecord(raw, now = Date.now()) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!isPersistedSiweAuthRecord(parsed)) return null;
+  if (!isPersistedSiweAuthRefreshActive(parsed, now)) return null;
+  return parsed;
+}
+function readPersistedSiweAuth(storage, key, now = Date.now()) {
+  let raw;
+  try {
+    raw = storage.getItem(key);
+  } catch {
+    return null;
+  }
+  if (raw == null) return null;
+  const record = parsePersistedSiweAuthRecord(raw, now);
+  if (!record) removePersistedSiweAuth(storage, key);
+  return record;
+}
+function writePersistedSiweAuth(storage, key, record) {
+  try {
+    storage.setItem(key, JSON.stringify(record));
+  } catch {
+    warnBlockedStorageOnce();
+  }
+}
+function removePersistedSiweAuth(storage, key) {
+  try {
+    storage.removeItem(key);
+  } catch {
+  }
+}
+var localStorageProbe;
+function getSiweAuthLocalStorage() {
+  if (localStorageProbe !== void 0) return localStorageProbe;
+  if (typeof window === "undefined") return null;
+  try {
+    const storage = window.localStorage;
+    storage.getItem("__privana_siwe_probe__");
+    localStorageProbe = storage;
+  } catch {
+    warnBlockedStorageOnce();
+    localStorageProbe = null;
+  }
+  return localStorageProbe;
+}
+function isAdoptableRecord(record, currentAddress, currentUpdatedAt) {
+  if (!record || !currentAddress) return false;
+  if (record.tokens.address.toLowerCase() !== currentAddress.toLowerCase()) return false;
+  return record.updatedAt > (currentUpdatedAt ?? -1);
+}
+function resolveHydrationAction(record, connectedAddress, now = Date.now()) {
+  if (!connectedAddress) return { type: "dormant" };
+  if (!record) return { type: "dormant" };
+  if (record.tokens.address.toLowerCase() !== connectedAddress.toLowerCase()) {
+    return { type: "remove" };
+  }
+  if (isPersistedSiweAuthAccessActive(record, now)) return { type: "restore", record };
+  if (isPersistedSiweAuthRefreshActive(record, now)) return { type: "refresh", record };
+  return { type: "remove" };
+}
+function resolveStorageEvent(newValue, currentAddress, currentUpdatedAt, now = Date.now()) {
+  if (!currentAddress) return { type: "ignore" };
+  if (newValue == null) return { type: "logout" };
+  const record = parsePersistedSiweAuthRecord(newValue, now);
+  if (!record) return { type: "ignore" };
+  if (!isAdoptableRecord(record, currentAddress, currentUpdatedAt)) return { type: "ignore" };
+  return { type: "adopt", record };
+}
+
+// src/sdk/auth/siwe-auth-policy.ts
+function resolveActiveSessionAddress(...candidates) {
+  return candidates.find((candidate) => !!candidate) ?? null;
+}
+function resolveAutoLoginEffectAction(input) {
+  const {
+    status,
+    isConnected,
+    address,
+    sessionAddress,
+    autoLogin,
+    isLoading,
+    isHydrating,
+    autoAttemptedAddress,
+    authenticatingAddress
+  } = input;
+  const activeAddress2 = resolveActiveSessionAddress(sessionAddress, authenticatingAddress);
+  if (status === "connecting" || status === "reconnecting") return { type: "wait" };
+  if (!isConnected && activeAddress2) return { type: "reset-on-disconnect" };
+  if (isConnected && address && activeAddress2 && address.toLowerCase() !== activeAddress2.toLowerCase()) {
+    return { type: "clear-on-mismatch" };
+  }
+  if (!autoLogin) return { type: "noop" };
+  if (isHydrating) return { type: "wait" };
+  if (isConnected && address && !sessionAddress && !isLoading && autoAttemptedAddress !== address) {
+    return { type: "auto-login" };
+  }
+  return { type: "noop" };
+}
+
+// src/sdk/auth/auth-lifecycle.ts
+function initialAuthLifecycleState() {
+  return {
+    generation: 0,
+    refreshData: null,
+    currentRecord: null,
+    autoAttemptedAddress: null,
+    authenticatingAddress: null,
+    hydratedAddress: null
+  };
+}
+function reduceAuthLifecycle(state, event) {
+  switch (event.type) {
+    case "reset":
+      return {
+        generation: state.generation + 1,
+        refreshData: null,
+        currentRecord: null,
+        autoAttemptedAddress: null,
+        authenticatingAddress: null,
+        hydratedAddress: null
+      };
+    case "commit":
+      return {
+        ...state,
+        generation: state.generation + 1,
+        refreshData: {
+          refreshToken: event.record.tokens.jwt_refresh_token,
+          refreshExpiresAt: event.record.refreshTokenExpiresAt
+        },
+        currentRecord: event.record
+      };
+    case "refresh":
+      return {
+        ...state,
+        refreshData: event.refreshData,
+        currentRecord: event.record
+      };
+    case "setAutoAttemptedAddress":
+      return { ...state, autoAttemptedAddress: event.address };
+    case "setAuthenticatingAddress":
+      return { ...state, authenticatingAddress: event.address };
+    case "setHydratedAddress":
+      return { ...state, hydratedAddress: event.address };
+    case "clearCurrentRecord":
+      return { ...state, currentRecord: null };
+  }
+}
+
+// src/sdk/auth/auth-lifecycle-effects.ts
+function armPrivateRead(ports, input) {
+  ports.cache.set(input.scopeKey, input.siweToken, input.siweExpiry);
+}
+function applyAccessRotation(ports, rotation) {
+  ports.client.setBearerToken(rotation.accessToken);
+  ports.react.setTokens(
+    (prev) => prev ? {
+      ...prev,
+      jwt_access_token: rotation.accessToken,
+      jwt_refresh_token: rotation.refreshToken
+    } : prev
+  );
+  ports.react.setAccessTokenExpiresAt(rotation.accessTokenExpiresAt);
+}
+function publishSession(ports, record) {
+  ports.client.setBearerToken(record.tokens.jwt_access_token);
+  ports.react.setSession({ address: record.tokens.address });
+  ports.react.setTokens({
+    siwe_token: record.tokens.siwe_token,
+    jwt_access_token: record.tokens.jwt_access_token,
+    jwt_refresh_token: record.tokens.jwt_refresh_token,
+    address: record.tokens.address
+  });
+  ports.react.setAccessTokenExpiresAt(record.accessTokenExpiresAt);
+}
+function persistRecordIfEnabled(ports, record) {
+  if (!ports.persistJwt) return;
+  if (record) ports.storage.write(record);
+  else ports.storage.remove();
+}
+function clearSessionEffects(ports) {
+  ports.client.clearPrivateReadToken();
+  ports.client.clearBearerToken();
+  ports.react.setSession(null);
+  ports.react.setTokens(null);
+  ports.react.setAccessTokenExpiresAt(null);
+  ports.react.setIsLoading(false);
+  ports.react.setIsHydrating(false);
+  ports.react.setError(null);
+}
+
+// src/sdk/auth/siwe-auth-controller.ts
+function activeAddress(ctrl) {
+  return resolveActiveSessionAddress(
+    ctrl.getSessionAddress(),
+    ctrl.getState().currentRecord?.tokens.address
+  );
+}
+function ctrlReset(ctrl, removeStorage) {
+  ctrl.loginInFlight = false;
+  ctrl.loginOwnerGeneration = -1;
+  ctrl.hydrateOwnerGeneration = -1;
+  ctrl.refreshPromise = null;
+  ctrl.dispatch({ type: "reset" });
+  clearSessionEffects(ctrl.ports);
+  if (removeStorage) persistRecordIfEnabled(ctrl.ports, null);
+}
+function ctrlRestoreSession(ctrl, record) {
+  ctrl.dispatch({ type: "commit", record });
+  armPrivateRead(ctrl.ports, {
+    siweToken: record.tokens.siwe_token,
+    siweExpiry: record.siweTokenExpiresAt,
+    scopeKey: ctrl.ports.makeScopeKey(record.tokens.address)
+  });
+  publishSession(ctrl.ports, record);
+}
+function ctrlAdoptNewerRecordIfAvailable(ctrl) {
+  if (!ctrl.config.persistJwt) return false;
+  const record = ctrl.ports.storage.read();
+  if (!record) return false;
+  const current = activeAddress(ctrl);
+  if (!isAdoptableRecord(record, current, ctrl.getState().currentRecord?.updatedAt ?? null)) {
+    return false;
+  }
+  ctrlRestoreSession(ctrl, record);
+  return true;
+}
+async function ctrlLogin(ctrl) {
+  const address = ctrl.config.address;
+  if (!address) throw new Error("No wallet connected");
+  if (ctrl.loginInFlight) return;
+  ctrl.loginInFlight = true;
+  ctrl.dispatch({ type: "setAutoAttemptedAddress", address });
+  ctrl.dispatch({ type: "setAuthenticatingAddress", address });
+  ctrl.ports.react.setIsLoading(true);
+  ctrl.ports.react.setError(null);
+  const generation = ctrl.getState().generation;
+  ctrl.loginOwnerGeneration = generation;
+  const { chainId, apiUrl } = ctrl.config;
+  const api = ctrl.api;
+  try {
+    const { message, expirationTime } = await buildSiweLoginMessage(api, {
+      address,
+      chainId,
+      apiUrl
+    });
+    const signature = await ctrl.signer.signSiweMessage({ account: address, message });
+    const res = await api.loginWithSiwe({ siwe_message: message, signature });
+    if (ctrl.getState().generation !== generation) return;
+    const record = buildPersistedSiweAuthRecordFromLogin(res, Date.now(), expirationTime.getTime());
+    ctrlRestoreSession(ctrl, record);
+    persistRecordIfEnabled(ctrl.ports, record);
+  } catch (err) {
+    if (ctrl.loginOwnerGeneration === generation) {
+      ctrl.ports.react.setError(err instanceof Error ? err : new Error("Sign-in failed"));
+    }
+    throw err;
+  } finally {
+    if (ctrl.loginOwnerGeneration === generation) {
+      ctrl.ports.react.setIsLoading(false);
+      ctrl.loginInFlight = false;
+      ctrl.loginOwnerGeneration = -1;
+    }
+  }
+}
+async function ctrlLogout(ctrl) {
+  const refreshToken = ctrl.getState().refreshData?.refreshToken;
+  try {
+    if (refreshToken) {
+      try {
+        await ctrl.api.logoutJwtSession({ refresh_token: refreshToken, revoke_all: true });
+      } catch {
+      }
+    }
+  } finally {
+    ctrlReset(ctrl, ctrl.config.persistJwt);
+    ctrl.dispatch({ type: "setAutoAttemptedAddress", address: ctrl.config.address ?? null });
+  }
+}
+async function ctrlRefreshAccessToken(ctrl) {
+  const data = ctrl.getState().refreshData;
+  if (!data) return;
+  if (Date.now() >= data.refreshExpiresAt - AUTH_CLOCK_SKEW_MS) {
+    ctrlReset(ctrl, ctrl.config.persistJwt);
+    return;
+  }
+  if (ctrl.refreshPromise) return ctrl.refreshPromise;
+  const generation = ctrl.getState().generation;
+  const promise = (async () => {
+    try {
+      if (ctrlAdoptNewerRecordIfAvailable(ctrl)) return;
+      const res = await ctrl.api.refreshJwtSession({ refresh_token: data.refreshToken });
+      if (ctrl.getState().generation !== generation) return;
+      const refreshedAt = Date.now();
+      const refreshData = {
+        refreshToken: res.refresh_token,
+        refreshExpiresAt: refreshedAt + res.refresh_expires_in * 1e3
+      };
+      const previous = ctrl.getState().currentRecord;
+      if (previous && ctrl.config.persistJwt) {
+        const nextRecord = applyRefreshToPersistedSiweAuthRecord(previous, res, refreshedAt);
+        ctrl.dispatch({ type: "refresh", refreshData, record: nextRecord });
+        ctrl.ports.storage.write(nextRecord);
+      } else {
+        ctrl.dispatch({ type: "refresh", refreshData, record: previous });
+      }
+      applyAccessRotation(ctrl.ports, {
+        accessToken: res.token,
+        refreshToken: res.refresh_token,
+        accessTokenExpiresAt: refreshedAt + res.expires_in * 1e3
+      });
+    } catch {
+      if (ctrl.getState().generation !== generation) return;
+      if (!ctrlAdoptNewerRecordIfAvailable(ctrl)) ctrlReset(ctrl, ctrl.config.persistJwt);
+    }
+  })();
+  ctrl.refreshPromise = promise;
+  try {
+    await promise;
+  } finally {
+    if (ctrl.refreshPromise === promise) ctrl.refreshPromise = null;
+  }
+}
+async function ctrlHydrateViaRefresh(ctrl, record, address) {
+  ctrl.dispatch({ type: "setAutoAttemptedAddress", address });
+  ctrl.dispatch({ type: "setAuthenticatingAddress", address });
+  ctrl.ports.react.setIsHydrating(true);
+  ctrl.dispatch({ type: "commit", record });
+  const hydrationGen = ctrl.getState().generation;
+  ctrl.hydrateOwnerGeneration = hydrationGen;
+  try {
+    await ctrlRefreshAccessToken(ctrl).catch(() => {
+    });
+    const fresh = ctrl.getState().currentRecord;
+    if (fresh && fresh.tokens.address.toLowerCase() === address.toLowerCase() && isPersistedSiweAuthAccessActive(fresh)) {
+      ctrlRestoreSession(ctrl, fresh);
+    } else if (ctrl.getState().generation === hydrationGen) {
+      ctrl.dispatch({ type: "setAutoAttemptedAddress", address: null });
+    }
+  } finally {
+    if (ctrl.hydrateOwnerGeneration === hydrationGen) {
+      ctrl.ports.react.setIsHydrating(false);
+      ctrl.hydrateOwnerGeneration = -1;
+    }
+  }
+}
+
 // src/sdk/hooks/private-read-token-store.ts
-var AUTH_CLOCK_SKEW_MS = 3e4;
 var cache = /* @__PURE__ */ new Map();
 function createScopeKey(apiUrl, chainId, address) {
   return `${apiUrl.replace(/\/$/, "")}:${chainId}:${address.toLowerCase()}`;
@@ -888,164 +1359,240 @@ function setCachedPrivateReadToken(scopeKey, token, expiresAt) {
 function deleteCachedPrivateReadToken(scopeKey) {
   cache.delete(scopeKey);
 }
-var DEFAULT_SIWE_VALIDITY_MS = 24 * 60 * 60 * 1e3;
-var AUTH_REFRESH_SKEW_MS = 3e4;
-var SiweAuthContext = react.createContext(null);
-function SiweAuthProvider({
-  children,
-  client,
-  networkConfig,
-  autoLogin = true
-}) {
+
+// src/sdk/hooks/use-siwe-auth-lifecycle.ts
+function useSiweAuthLifecycle(deps) {
+  const { storageKey, apiUrl, chainId, persistJwt, autoLogin, client, api } = deps;
   const wagmiContext = react.useContext(wagmi.WagmiContext);
   const { address, isConnected, status } = useSafeAccount();
   const [session, setSession] = react.useState(null);
   const [tokens, setTokens] = react.useState(null);
   const [isLoading, setIsLoading] = react.useState(false);
+  const [isHydrating, setIsHydrating] = react.useState(false);
   const [error, setError] = react.useState(null);
   const [accessTokenExpiresAt, setAccessTokenExpiresAt] = react.useState(null);
-  const loginInFlight = react.useRef(false);
-  const autoAttemptedAddress = react.useRef(null);
-  const refreshInFlight = react.useRef(false);
-  const refreshDataRef = react.useRef(null);
-  const clearSession = react.useCallback(() => {
-    refreshDataRef.current = null;
-    setAccessTokenExpiresAt(null);
-    client.clearPrivateReadToken();
-    client.clearBearerToken();
-    setSession(null);
-    setTokens(null);
-    setError(null);
-    autoAttemptedAddress.current = null;
-  }, [client]);
-  const logout = react.useCallback(async () => {
-    setError(null);
-    const refreshToken = refreshDataRef.current?.refreshToken;
-    try {
-      if (refreshToken) {
-        await client.logoutJwtSession({ refresh_token: refreshToken });
+  const sessionRef = react.useRef(null);
+  const prevPersistJwtRef = react.useRef(void 0);
+  const authRef = react.useRef(initialAuthLifecycleState());
+  const storageAdapter = react.useMemo(
+    () => ({
+      read: () => {
+        const ls = getSiweAuthLocalStorage();
+        return ls ? readPersistedSiweAuth(ls, storageKey) : null;
+      },
+      write: (record) => {
+        const ls = getSiweAuthLocalStorage();
+        if (ls) writePersistedSiweAuth(ls, storageKey, record);
+      },
+      remove: () => {
+        const ls = getSiweAuthLocalStorage();
+        if (ls) removePersistedSiweAuth(ls, storageKey);
       }
-    } finally {
-      clearSession();
-      autoAttemptedAddress.current = address ?? null;
-    }
-  }, [clearSession, client, address]);
-  const login = react.useCallback(async () => {
-    if (!wagmiContext) throw new Error("WagmiProvider is required for SIWE auth");
-    if (!address) throw new Error("No wallet connected");
-    if (loginInFlight.current) return;
-    loginInFlight.current = true;
-    setIsLoading(true);
-    setError(null);
-    try {
-      const walletClient = await actions.getWalletClient(wagmiContext);
-      if (!walletClient) throw new Error("No wallet client available");
-      const [{ domain }, nonceRes] = await Promise.all([
-        client.getSiweDomain(),
-        client.getSiweNonce(address)
-      ]);
-      const issuedAt = /* @__PURE__ */ new Date();
-      const expirationTime = new Date(issuedAt.getTime() + DEFAULT_SIWE_VALIDITY_MS);
-      const uri = typeof window !== "undefined" && window.location.origin ? window.location.origin : networkConfig.apiUrl;
-      const message = siwe.createSiweMessage({
-        address,
-        chainId: networkConfig.chainId,
-        domain,
-        uri,
-        version: "1",
-        nonce: nonceRes.nonce,
-        statement: buildSiweStatement(networkConfig.chainId),
-        issuedAt,
-        expirationTime
-      });
-      const signature = await walletClient.signMessage({
-        account: walletClient.account ?? address,
-        message
-      });
-      const res = await client.loginWithSiwe({ siwe_message: message, signature });
-      const loggedInAt = Date.now();
-      client.setPrivateReadToken(res.siwe_token);
-      client.setBearerToken(res.jwt_access_token);
-      refreshDataRef.current = {
-        refreshToken: res.jwt_refresh_token,
-        refreshExpiresAt: loggedInAt + res.jwt_refresh_expires_in * 1e3
-      };
-      setCachedPrivateReadToken(
-        createScopeKey(networkConfig.apiUrl, networkConfig.chainId, address),
-        res.siwe_token,
-        expirationTime.getTime()
-      );
-      setSession({ address: res.address });
-      setTokens({
-        siwe_token: res.siwe_token,
-        jwt_access_token: res.jwt_access_token,
-        jwt_refresh_token: res.jwt_refresh_token,
-        address: res.address
-      });
-      setAccessTokenExpiresAt(loggedInAt + res.jwt_expires_in * 1e3);
-    } catch (err) {
-      setError(err instanceof Error ? err : new Error("Sign-in failed"));
-      throw err;
-    } finally {
-      setIsLoading(false);
-      loginInFlight.current = false;
-    }
-  }, [wagmiContext, address, client, networkConfig.chainId, networkConfig.apiUrl]);
-  const refreshAccessToken = react.useCallback(async () => {
-    const data = refreshDataRef.current;
-    if (!data || refreshInFlight.current) return;
-    if (Date.now() >= data.refreshExpiresAt - AUTH_REFRESH_SKEW_MS) {
-      clearSession();
-      return;
-    }
-    refreshInFlight.current = true;
-    try {
-      const res = await client.refreshJwtSession({ refresh_token: data.refreshToken });
-      const refreshedAt = Date.now();
-      client.setBearerToken(res.token);
-      refreshDataRef.current = {
-        refreshToken: res.refresh_token,
-        refreshExpiresAt: refreshedAt + res.refresh_expires_in * 1e3
-      };
-      setTokens(
-        (prev) => prev ? { ...prev, jwt_access_token: res.token, jwt_refresh_token: res.refresh_token } : prev
-      );
-      setAccessTokenExpiresAt(refreshedAt + res.expires_in * 1e3);
-    } catch {
-      clearSession();
-    } finally {
-      refreshInFlight.current = false;
-    }
-  }, [client, clearSession]);
+    }),
+    [storageKey]
+  );
+  const scopeInputsRef = react.useRef({ apiUrl, chainId });
+  scopeInputsRef.current.apiUrl = apiUrl;
+  scopeInputsRef.current.chainId = chainId;
+  const wagmiContextRef = react.useRef(wagmiContext);
+  wagmiContextRef.current = wagmiContext;
+  const portsRef = react.useRef(null);
+  if (!portsRef.current) {
+    portsRef.current = {
+      persistJwt,
+      client,
+      storage: storageAdapter,
+      cache: { set: setCachedPrivateReadToken },
+      react: {
+        setSession,
+        setTokens,
+        setAccessTokenExpiresAt,
+        setIsLoading,
+        setIsHydrating,
+        setError
+      },
+      makeScopeKey: (addr) => createScopeKey(scopeInputsRef.current.apiUrl, scopeInputsRef.current.chainId, addr)
+    };
+  }
+  const ports = portsRef.current;
+  ports.persistJwt = persistJwt;
+  ports.client = client;
+  ports.storage = storageAdapter;
+  const ctrlRef = react.useRef(null);
+  if (!ctrlRef.current) {
+    ctrlRef.current = {
+      config: { address, chainId, apiUrl, persistJwt },
+      ports,
+      api,
+      signer: {
+        signSiweMessage: async ({ account, message }) => {
+          const ctx = wagmiContextRef.current;
+          if (!ctx) throw new Error("WagmiProvider is required for SIWE auth");
+          const walletClient = await actions.getWalletClient(ctx);
+          if (!walletClient) throw new Error("No wallet client available");
+          return walletClient.signMessage({
+            account: walletClient.account ?? account,
+            message
+          });
+        }
+      },
+      loginInFlight: false,
+      loginOwnerGeneration: -1,
+      hydrateOwnerGeneration: -1,
+      refreshPromise: null,
+      getState: () => authRef.current,
+      getSessionAddress: () => sessionRef.current?.address ?? null,
+      dispatch: (event) => {
+        authRef.current = reduceAuthLifecycle(authRef.current, event);
+      }
+    };
+  }
+  const ctrl = ctrlRef.current;
+  ctrl.config = { address, chainId, apiUrl, persistJwt };
+  ctrl.api = api;
+  const login = react.useCallback(() => ctrlLogin(ctrl), [ctrl]);
+  const logout = react.useCallback(() => ctrlLogout(ctrl), [ctrl]);
+  const refreshAccessToken = react.useCallback(() => ctrlRefreshAccessToken(ctrl), [ctrl]);
+  const resetSession = react.useCallback(() => ctrlReset(ctrl, false), [ctrl]);
+  const clearSession = react.useCallback(() => ctrlReset(ctrl, ctrl.config.persistJwt), [ctrl]);
+  const restoreSession = react.useCallback(
+    (record) => ctrlRestoreSession(ctrl, record),
+    [ctrl]
+  );
+  const hydrateViaRefresh = react.useCallback(
+    (record, addr) => ctrlHydrateViaRefresh(ctrl, record, addr),
+    [ctrl]
+  );
   react.useEffect(() => {
     if (accessTokenExpiresAt == null) return;
-    const delay = Math.max(accessTokenExpiresAt - AUTH_REFRESH_SKEW_MS - Date.now(), 0);
+    const delay = Math.max(accessTokenExpiresAt - AUTH_CLOCK_SKEW_MS - Date.now(), 0);
     const timer = setTimeout(() => {
       void refreshAccessToken();
     }, delay);
     return () => clearTimeout(timer);
   }, [accessTokenExpiresAt, refreshAccessToken]);
+  const scopeRef = react.useRef(void 0);
   react.useEffect(() => {
-    if (!autoLogin) return;
+    const prev = scopeRef.current;
+    scopeRef.current = { apiUrl, chainId, client };
+    const scopeChanged = !!prev && !(prev.apiUrl === apiUrl && prev.chainId === chainId && prev.client === client);
+    if (scopeChanged) {
+      ctrlReset(ctrl, false);
+    }
+    if (!persistJwt) return;
     if (status === "connecting" || status === "reconnecting") return;
-    if (!isConnected && session) {
-      clearSession();
-      return;
+    if (!isConnected || !address) return;
+    if (ctrl.getState().hydratedAddress === address) return;
+    ctrl.dispatch({ type: "setHydratedAddress", address });
+    const action = resolveHydrationAction(storageAdapter.read(), address);
+    switch (action.type) {
+      case "restore":
+        restoreSession(action.record);
+        ctrl.dispatch({ type: "setAutoAttemptedAddress", address });
+        break;
+      case "refresh":
+        void hydrateViaRefresh(action.record, address);
+        break;
+      case "remove":
+        storageAdapter.remove();
+        break;
     }
-    if (isConnected && address && session && address.toLowerCase() !== session.address.toLowerCase()) {
-      clearSession();
-      return;
+  }, [
+    apiUrl,
+    chainId,
+    client,
+    persistJwt,
+    status,
+    isConnected,
+    address,
+    storageAdapter,
+    ctrl,
+    restoreSession,
+    hydrateViaRefresh
+  ]);
+  react.useEffect(() => {
+    const action = resolveAutoLoginEffectAction({
+      status,
+      isConnected,
+      address: address ?? null,
+      sessionAddress: session?.address ?? null,
+      autoLogin,
+      isLoading,
+      isHydrating,
+      autoAttemptedAddress: ctrl.getState().autoAttemptedAddress,
+      authenticatingAddress: ctrl.getState().authenticatingAddress
+    });
+    switch (action.type) {
+      case "wait":
+      case "noop":
+        return;
+      case "reset-on-disconnect":
+        resetSession();
+        return;
+      case "clear-on-mismatch":
+        clearSession();
+        return;
+      case "auto-login":
+        void login().catch(() => {
+        });
+        return;
     }
-    if (isConnected && address && !session && !isLoading && autoAttemptedAddress.current !== address) {
-      autoAttemptedAddress.current = address;
-      void login().catch(() => {
-      });
+  }, [
+    autoLogin,
+    status,
+    isConnected,
+    address,
+    session,
+    isLoading,
+    isHydrating,
+    ctrl,
+    login,
+    clearSession,
+    resetSession
+  ]);
+  react.useEffect(() => {
+    if (!persistJwt || typeof window === "undefined") return;
+    function onStorage(event) {
+      if (event.key !== storageKey) return;
+      const currentAddress = resolveActiveSessionAddress(
+        sessionRef.current?.address,
+        ctrl.getState().currentRecord?.tokens.address,
+        ctrl.getState().authenticatingAddress
+      );
+      const action = resolveStorageEvent(
+        event.newValue,
+        currentAddress,
+        ctrl.getState().currentRecord?.updatedAt ?? null
+      );
+      switch (action.type) {
+        case "logout":
+          resetSession();
+          if (currentAddress)
+            ctrl.dispatch({ type: "setAutoAttemptedAddress", address: currentAddress });
+          break;
+        case "adopt":
+          restoreSession(action.record);
+          break;
+      }
     }
-  }, [autoLogin, status, isConnected, address, session, isLoading, login, clearSession]);
-  const value = react.useMemo(
+    window.addEventListener("storage", onStorage);
+    return () => window.removeEventListener("storage", onStorage);
+  }, [persistJwt, storageKey, ctrl, restoreSession, resetSession]);
+  react.useEffect(() => {
+    const prev = prevPersistJwtRef.current;
+    prevPersistJwtRef.current = persistJwt;
+    if (!(prev === true && !persistJwt)) return;
+    ctrl.dispatch({ type: "clearCurrentRecord" });
+    storageAdapter.remove();
+  }, [persistJwt, storageAdapter, ctrl]);
+  react.useEffect(() => {
+    sessionRef.current = session;
+  }, [session]);
+  return react.useMemo(
     () => ({
       isAuthenticated: !!session,
-      isLoading,
+      isLoading: isLoading || isHydrating,
+      isHydrating,
       error,
       session,
       accessToken: tokens?.jwt_access_token,
@@ -1053,8 +1600,38 @@ function SiweAuthProvider({
       login,
       logout
     }),
-    [session, isLoading, error, tokens, login, logout]
+    [session, isLoading, isHydrating, error, tokens, login, logout]
+  );
+}
+var SiweAuthContext = react.createContext(null);
+function SiweAuthProvider({
+  children,
+  client,
+  networkConfig,
+  autoLogin = true,
+  persistJwt = false
+}) {
+  const storageKey = react.useMemo(
+    () => createSiweAuthStorageKey(networkConfig.apiUrl, networkConfig.chainId),
+    [networkConfig.apiUrl, networkConfig.chainId]
+  );
+  const lifecycleClient = react.useMemo(
+    () => ({
+      setBearerToken: (t) => client.setBearerToken(t),
+      clearBearerToken: () => client.clearBearerToken(),
+      clearPrivateReadToken: () => client.clearPrivateReadToken()
+    }),
+    [client]
   );
+  const value = useSiweAuthLifecycle({
+    storageKey,
+    apiUrl: networkConfig.apiUrl,
+    chainId: networkConfig.chainId,
+    persistJwt,
+    autoLogin,
+    client: lifecycleClient,
+    api: client
+  });
   return /* @__PURE__ */ jsxRuntime.jsx(SiweAuthContext.Provider, { value, children });
 }
 function useSiweAuth() {
@@ -1366,6 +1943,7 @@ function PrivanaProvider({
       client,
       networkConfig,
       autoLogin: typeof siweAuth === "object" ? siweAuth.autoLogin : void 0,
+      persistJwt: typeof siweAuth === "object" ? siweAuth.persistJwt : void 0,
       children
     }
   ) : children });
@@ -1436,6 +2014,47 @@ function removeBrowserStorageItem(key) {
     }
   }
 }
+function canUseSharedBrowserStorage() {
+  const storage = storageCandidate("localStorage");
+  if (!storage) return false;
+  const probeKey = "privana:shared-storage-probe";
+  try {
+    storage.setItem(probeKey, "1");
+    storage.removeItem(probeKey);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function setSharedBrowserStorageItem(key, value) {
+  const storage = storageCandidate("localStorage");
+  if (!storage) return false;
+  try {
+    storage.setItem(key, value);
+  } catch {
+    return false;
+  }
+  try {
+    storageCandidate("sessionStorage")?.removeItem(key);
+  } catch {
+  }
+  return true;
+}
+function getSharedBrowserStorageItem(key) {
+  try {
+    return storageCandidate("localStorage")?.getItem(key) ?? null;
+  } catch {
+    return null;
+  }
+}
+function removeSharedBrowserStorageItem(key) {
+  for (const storage of storageCandidates()) {
+    try {
+      storage.removeItem(key);
+    } catch {
+    }
+  }
+}
 
 // src/sdk/hooks/pending-lock.ts
 var DEFAULT_LOCK_DURATION_SECONDS = 259200;
@@ -1451,6 +2070,25 @@ function applyLockBuffer(amount, buffer = DEFAULT_ONRAMP_LOCK_BUFFER) {
 function clampLockAmount(amount, maxAmount) {
   return maxAmount !== void 0 && maxAmount < amount ? maxAmount : amount;
 }
+function requireServiceAddress(serviceAddress) {
+  if (!serviceAddress) {
+    throw new Error("Service address not configured");
+  }
+  return serviceAddress;
+}
+function requireDepositLockOwner(walletAddress, beneficiary) {
+  if (!walletAddress) throw new Error("No wallet connected");
+  if (!beneficiary) throw new Error("No authenticated deposit account");
+  if (walletAddress.toLowerCase() !== beneficiary.toLowerCase()) {
+    throw new Error("Connected wallet does not match the authenticated deposit account");
+  }
+  return beneficiary;
+}
+function walletClientAccountAddress(walletClient) {
+  const account = walletClient.account;
+  if (!account) return void 0;
+  return typeof account === "string" ? account : account.address;
+}
 async function createSignedLockRequest({
   client,
   walletClient,
@@ -1464,6 +2102,10 @@ async function createSignedLockRequest({
   if (amount <= 0n) {
     throw new Error("Lock amount must be positive");
   }
+  const signerAddress = walletClientAccountAddress(walletClient);
+  if (!signerAddress || signerAddress.toLowerCase() !== userAddress.toLowerCase()) {
+    throw new Error("Connected wallet does not match the authenticated deposit account");
+  }
   const expiry = BigInt(Math.floor(Date.now() / 1e3) + lockDuration);
   const { nonce } = await client.getLockNonce(userAddress);
   const signature = await signLockMessage({
@@ -1500,13 +2142,15 @@ var PostDepositLockError = class _PostDepositLockError extends Error {
     this.signedAmount = signedAmount;
     this.creditedAmount = creditedAmount;
     this.name = "PostDepositLockError";
+    this.submissionMayHaveSucceeded = options?.submissionMayHaveSucceeded ?? false;
     Object.setPrototypeOf(this, _PostDepositLockError.prototype);
   }
 };
 async function submitPendingLock({
   client,
   payload,
-  creditedAmount
+  creditedAmount,
+  beforeSubmit
 }) {
   let signedAmount;
   try {
@@ -1530,13 +2174,14 @@ async function submitPendingLock({
   }
   if (creditedAmount !== void 0 && creditedAmount < signedAmount) {
     throw new PostDepositLockError(
-      `Credited amount (${creditedAmount}) is below the signed lock amount (${signedAmount})`,
+      "Credited amount is below the signed lock amount",
       "credited-below-signed",
       signedAmount,
       creditedAmount
     );
   }
   try {
+    beforeSubmit?.();
     return await client.lockFunds(payload);
   } catch (err) {
     throw new PostDepositLockError(
@@ -1581,7 +2226,6 @@ function clearPendingLock(userAddress, correlationId) {
 }
 var INITIAL_AUTH_BACKOFF_MS = 5e3;
 var MAX_AUTH_BACKOFF_MS = 6e4;
-var DEFAULT_SIWE_AUTH_VALIDITY_MS = 24 * 60 * 60 * 1e3;
 var privateReadFailureCache = /* @__PURE__ */ new Map();
 var privateReadInflight = /* @__PURE__ */ new Map();
 async function executeHostedAuthPrivateReadRequest({
@@ -1606,13 +2250,13 @@ async function executeHostedAuthPrivateReadRequest({
   };
   await ensureHostedAuth(false);
   try {
-    return await request();
+    return await request(client);
   } catch (error) {
     if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
       throw error;
     }
     await ensureHostedAuth(true);
-    return request();
+    return request(client);
   }
 }
 function clearPrivateReadScope(scopeKey, client) {
@@ -1620,6 +2264,24 @@ function clearPrivateReadScope(scopeKey, client) {
   privateReadFailureCache.delete(scopeKey);
   client.clearPrivateReadToken();
 }
+async function executeSiwePrivateReadRequest({
+  client,
+  scopeKey,
+  getToken,
+  request
+}) {
+  const run = (token2) => request(client.withPrivateReadToken(token2));
+  const token = await getToken(false);
+  try {
+    return await run(token);
+  } catch (error) {
+    if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
+      throw error;
+    }
+    clearPrivateReadScope(scopeKey, client);
+    return run(await getToken(true));
+  }
+}
 function recordPrivateReadFailure(scopeKey) {
   const previous = privateReadFailureCache.get(scopeKey);
   const backoffMs = Math.min(
@@ -1666,46 +2328,26 @@ function usePrivateReadRequest() {
       if (!walletAddress) {
         throw new Error("No wallet connected");
       }
-      const walletClient = await actions.getWalletClient(wagmiContext);
-      if (!walletClient) {
-        throw new Error("No wallet client available");
-      }
       const apiUrl = networkConfig.apiUrl;
       const scopeKey = createScopeKey(apiUrl, networkConfig.chainId, walletAddress);
       const getToken = async (forceRefresh) => {
         const inflight = privateReadInflight.get(scopeKey);
-        if (inflight) {
-          const token = await inflight;
-          client.setPrivateReadToken(token);
-          return token;
-        }
+        if (inflight) return inflight;
         if (!forceRefresh) {
           const cached = getCachedPrivateReadToken(scopeKey);
-          if (cached) {
-            client.setPrivateReadToken(cached);
-            return cached;
-          }
+          if (cached) return cached;
         }
         ensureFailureBackoff(scopeKey);
         const authPromise = (async () => {
           try {
-            const [{ domain }, nonceResponse] = await Promise.all([
-              client.getSiweDomain(),
-              client.getSiweNonce(walletAddress)
-            ]);
-            const issuedAt = /* @__PURE__ */ new Date();
-            const expirationTime = new Date(issuedAt.getTime() + DEFAULT_SIWE_AUTH_VALIDITY_MS);
-            const uri = typeof window !== "undefined" && window.location.origin ? window.location.origin : apiUrl;
-            const message = siwe.createSiweMessage({
+            const walletClient = await actions.getWalletClient(wagmiContext);
+            if (!walletClient) {
+              throw new Error("No wallet client available");
+            }
+            const { message, expirationTime } = await buildSiweLoginMessage(client, {
               address: walletAddress,
               chainId: networkConfig.chainId,
-              domain,
-              expirationTime,
-              issuedAt,
-              nonce: nonceResponse.nonce,
-              statement: buildSiweStatement(networkConfig.chainId),
-              uri,
-              version: "1"
+              apiUrl
             });
             const signature = await walletClient.signMessage({
               account: walletClient.account ?? walletAddress,
@@ -1717,7 +2359,6 @@ function usePrivateReadRequest() {
             });
             setCachedPrivateReadToken(scopeKey, login.siwe_token, expirationTime.getTime());
             privateReadFailureCache.delete(scopeKey);
-            client.setPrivateReadToken(login.siwe_token);
             return login.siwe_token;
           } catch (error) {
             const authError = error instanceof Error ? error : new Error("Failed to authenticate private reads");
@@ -1731,17 +2372,7 @@ function usePrivateReadRequest() {
         privateReadInflight.set(scopeKey, authPromise);
         return authPromise;
       };
-      await getToken(false);
-      try {
-        return await request();
-      } catch (error) {
-        if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
-          throw error;
-        }
-        clearPrivateReadScope(scopeKey, client);
-        await getToken(true);
-        return request();
-      }
+      return executeSiwePrivateReadRequest({ client, scopeKey, getToken, request });
     },
     [
       client,
@@ -1768,7 +2399,6 @@ function usePrivateReadRequest() {
 
 // src/sdk/hooks/use-deposit-verification.ts
 function useDepositVerification(options = {}) {
-  const { client } = usePrivanaContext();
   const queryClient = reactQuery.useQueryClient();
   const { executePrivateRead } = usePrivateReadRequest();
   const pollInterval = options.pollInterval ?? 5e3;
@@ -1777,6 +2407,7 @@ function useDepositVerification(options = {}) {
   const [isVerifying, setIsVerifying] = react.useState(false);
   const [didTimeout, setDidTimeout] = react.useState(false);
   const [verificationFailed, setVerificationFailed] = react.useState(false);
+  const [canCheckAnotherTransfer, setCanCheckAnotherTransfer] = react.useState(false);
   const [error, setError] = react.useState(null);
   const [txHash, setTxHash] = react.useState();
   const generationRef = react.useRef(0);
@@ -1812,14 +2443,16 @@ function useDepositVerification(options = {}) {
       const isStale = () => generation !== generationRef.current;
       const { hash, chainId, amount, logIndex } = ctx;
       setVerificationFailed(false);
+      setCanCheckAnotherTransfer(false);
       setError(null);
       setDidTimeout(false);
       setIsVerifying(true);
       const pollStartTime = Date.now();
-      const markVerificationFailed = (err) => {
+      const markVerificationFailed = (err, canCheckAnother = false) => {
         setIsVerifying(false);
         setError(err);
         setVerificationFailed(true);
+        setCanCheckAnotherTransfer(canCheckAnother);
         onErrorRef.current?.(err);
       };
       const markVerificationTimedOut = () => {
@@ -1835,7 +2468,7 @@ function useDepositVerification(options = {}) {
           if (isStale()) return;
           try {
             const result = await executePrivateRead(
-              () => client.checkDeposit({
+              (readClient) => readClient.checkDeposit({
                 chain_id: chainId,
                 tx_hash: hash,
                 amount: amount.toString(),
@@ -1870,11 +2503,12 @@ function useDepositVerification(options = {}) {
         }
         if (isStale()) return;
         if (triggerResult.status === "credited") {
+          const creditedAmount = creditedAmountFromResponse(triggerResult, amount);
           setIsVerifying(false);
           verificationContextRef.current = null;
           queryClient.invalidateQueries({ queryKey: ["accounting-balance"] });
           queryClient.invalidateQueries({ queryKey: ["accounting-history"] });
-          onCreditedRef.current?.(hash, triggerResult);
+          onCreditedRef.current?.(hash, triggerResult, creditedAmount);
           return;
         }
         if (triggerResult.status === "error") {
@@ -1894,16 +2528,29 @@ function useDepositVerification(options = {}) {
             return true;
           }
           try {
-            const result = await executePrivateRead(() => client.getDepositStatus(depositId));
+            const result = await executePrivateRead(
+              (readClient) => readClient.getDepositStatus(depositId)
+            );
             if (isStale()) return true;
             consecutiveFailures = 0;
             if (result.status === "credited") {
+              let creditedAmount;
+              try {
+                creditedAmount = creditedAmountFromResponse(result, amount);
+              } catch (err) {
+                stopPolling();
+                markVerificationFailed(
+                  err instanceof Error ? err : new Error("Deposit credited amount is invalid"),
+                  false
+                );
+                return true;
+              }
               stopPolling();
               setIsVerifying(false);
               verificationContextRef.current = null;
               queryClient.invalidateQueries({ queryKey: ["accounting-balance"] });
               queryClient.invalidateQueries({ queryKey: ["accounting-history"] });
-              onCreditedRef.current?.(hash, result);
+              onCreditedRef.current?.(hash, result, creditedAmount);
               return true;
             }
             if (result.status === "error") {
@@ -1935,20 +2582,11 @@ function useDepositVerification(options = {}) {
       } catch (err) {
         if (isStale()) return;
         stopPolling();
-        markVerificationFailed(
-          err instanceof Error ? err : new Error("Deposit verification failed")
-        );
+        const error2 = err instanceof Error ? err : new Error("Deposit verification failed");
+        markVerificationFailed(error2, isDefinitiveCandidateFailure(error2));
       }
     },
-    [
-      client,
-      executePrivateRead,
-      finalityRetryInterval,
-      pollInterval,
-      pollTimeout,
-      queryClient,
-      stopPolling
-    ]
+    [executePrivateRead, finalityRetryInterval, pollInterval, pollTimeout, queryClient, stopPolling]
   );
   const verify = react.useCallback(
     async (ctx) => {
@@ -1979,12 +2617,14 @@ function useDepositVerification(options = {}) {
     setIsVerifying(false);
     setDidTimeout(false);
     setVerificationFailed(false);
+    setCanCheckAnotherTransfer(false);
     setError(null);
   }, [stopPolling]);
   return {
     isVerifying,
     didTimeout,
     verificationFailed,
+    canCheckAnotherTransfer,
     error,
     txHash,
     verify,
@@ -1992,6 +2632,19 @@ function useDepositVerification(options = {}) {
     reset
   };
 }
+function creditedAmountFromResponse(response, requestedAmount) {
+  if (response.amount == null) return requestedAmount;
+  try {
+    const amount = BigInt(response.amount);
+    if (amount <= 0n) throw new Error("non-positive amount");
+    return amount;
+  } catch (err) {
+    throw new Error("Deposit API returned an invalid credited amount", { cause: err });
+  }
+}
+function isDefinitiveCandidateFailure(error) {
+  return error instanceof AccountingApiError && error.statusCode === 400;
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -2433,7 +3086,9 @@ function useFiatOnRamp(options) {
   const { address } = wagmi.useAccount();
   const { data: walletClient } = wagmi.useWalletClient();
   const { client, enabledTokens, networkConfig, serviceAddress } = usePrivanaContext();
-  const { executePrivateRead, privateReadReady } = usePrivateReadRequest();
+  const { executePrivateRead, privateReadAddress, privateReadReady } = usePrivateReadRequest();
+  const privateReadAddressRef = react.useRef(privateReadAddress);
+  privateReadAddressRef.current = privateReadAddress;
   const { ensureCorrectChain } = useEnsureCorrectChain();
   const wagmiConfig = wagmi.useConfig();
   const queryClient = reactQuery.useQueryClient();
@@ -2455,7 +3110,6 @@ function useFiatOnRamp(options) {
   const activeIntentIdRef = react.useRef(null);
   const activeVerificationRecordRef = react.useRef(null);
   const activeVerificationKeyRef = react.useRef(null);
-  const activeVerificationAmountRef = react.useRef(null);
   const lockOwnerRef = react.useRef(null);
   const triggeredVerificationKeysRef = react.useRef(/* @__PURE__ */ new Set());
   const activeVerificationDoneRef = react.useRef(null);
@@ -2504,7 +3158,7 @@ function useFiatOnRamp(options) {
     void (async () => {
       try {
         emitDebug("deposit-address:request");
-        const resp = await executePrivateRead(() => client.getDepositAddress());
+        const resp = await executePrivateRead((readClient) => readClient.getDepositAddress());
         if (cancelled) return;
         setDepositAddress(resp.deposit_address);
         const token = enabledTokens.find((t) => t.id.toLowerCase() === tokenId.toLowerCase());
@@ -2534,7 +3188,9 @@ function useFiatOnRamp(options) {
     }
     try {
       emitDebug("pending:request");
-      const { pending: rows } = await executePrivateRead(() => client.getPendingOnRamps());
+      const { pending: rows } = await executePrivateRead(
+        (readClient) => readClient.getPendingOnRamps()
+      );
       setPending(rows);
       emitDebug("pending:success", {
         count: rows.length,
@@ -2544,7 +3200,7 @@ function useFiatOnRamp(options) {
       emitDebug("pending:error", errorPayload(err));
       console.warn("Failed to load pending on-ramps:", err);
     }
-  }, [client, emitDebug, executePrivateRead, privateReadReady]);
+  }, [emitDebug, executePrivateRead, privateReadReady]);
   react.useEffect(() => {
     refreshPending();
   }, [refreshPending]);
@@ -2554,13 +3210,12 @@ function useFiatOnRamp(options) {
     if (key) triggeredVerificationKeysRef.current.delete(key);
     activeVerificationKeyRef.current = null;
     activeVerificationRecordRef.current = null;
-    activeVerificationAmountRef.current = null;
     setActiveVerificationId(null);
     activeVerificationDoneRef.current?.();
     activeVerificationDoneRef.current = null;
   }, []);
   const submitPendingLockAfterCredit = react.useCallback(
-    async (transactionId, userAddress) => {
+    async (transactionId, userAddress, creditedAmount) => {
       const signedLock = loadPendingLock(userAddress, transactionId);
       if (!signedLock) {
         clearPendingLock(userAddress, transactionId);
@@ -2573,7 +3228,6 @@ function useFiatOnRamp(options) {
         (onLockFailedRef.current ?? onErrorRef.current)?.(error2);
         return;
       }
-      const creditedAmount = activeVerificationAmountRef.current ?? void 0;
       try {
         const result = await submitPendingLock({ client, payload: signedLock, creditedAmount });
         queryClient.invalidateQueries({ queryKey: ["accounting-balance"] });
@@ -2619,7 +3273,7 @@ function useFiatOnRamp(options) {
       });
       setFinalityProgress((prev) => ({ ...prev, [record.transaction_id]: message }));
     },
-    onCredited: (depositTxHash) => {
+    onCredited: (depositTxHash, _response, creditedAmount) => {
       const record = activeVerificationRecordRef.current;
       const verificationKey = record ? getOnRampVerificationKey(record) : null;
       emitDebug("verification:credited", {
@@ -2636,9 +3290,9 @@ function useFiatOnRamp(options) {
           delete next[record.transaction_id];
           return next;
         });
-        const lockOwner = lockOwnerRef.current ?? address;
+        const lockOwner = lockOwnerRef.current ?? privateReadAddress;
         if (lockOwner) {
-          void submitPendingLockAfterCredit(record.transaction_id, lockOwner);
+          void submitPendingLockAfterCredit(record.transaction_id, lockOwner, creditedAmount);
         } else if (postDepositLock) {
           emitDebug("lock:owner-unavailable", { transactionId: record.transaction_id });
           (onLockFailedRef.current ?? onErrorRef.current)?.(
@@ -2657,7 +3311,7 @@ function useFiatOnRamp(options) {
               depositTxHash
             });
             const updated = await executePrivateRead(
-              () => client.updateOnRamp(record.transaction_id, {
+              (readClient) => readClient.updateOnRamp(record.transaction_id, {
                 deposit_tx_hash: depositTxHash
               })
             );
@@ -2718,8 +3372,10 @@ function useFiatOnRamp(options) {
         if (!token) throw new Error(`Unknown token: ${tokenId}`);
         if (!depositAddress) throw new Error("Privana deposit address is not ready");
         let lockAmount;
+        let lockOwner;
         if (postDepositLock) {
           if (!address || !walletClient) throw new Error("Wallet not connected");
+          lockOwner = requireDepositLockOwner(address, privateReadAddress);
           if (!quoteCurrencyAmount) {
             throw new Error(
               "postDepositLock requires quoteCurrencyAmount to derive the lock amount"
@@ -2748,7 +3404,7 @@ function useFiatOnRamp(options) {
           depositAddress
         });
         const record = await executePrivateRead(
-          () => client.createOnRampIntent({
+          (readClient) => readClient.createOnRampIntent({
             wallet_address: depositAddress,
             token_id: tokenId,
             chain_id: token.chainId,
@@ -2757,22 +3413,25 @@ function useFiatOnRamp(options) {
             base_currency_amount: baseCurrencyAmount
           })
         );
-        if (postDepositLock && address && walletClient && lockAmount !== void 0) {
+        if (postDepositLock && lockOwner && lockAmount !== void 0) {
           const signingWalletClient = await getWalletClient3(wagmiConfig, {
             chainId: networkConfig.chainId
           });
           const signedLock = await createSignedLockRequest({
             client,
             walletClient: signingWalletClient,
-            userAddress: address,
+            userAddress: lockOwner,
             networkConfig,
             serviceAddress: requireServiceAddress(postDepositLock.serviceAddress ?? serviceAddress),
             tokenId,
             amount: lockAmount,
             lockDuration: postDepositLock.lockDuration
           });
-          savePendingLock(address, record.transaction_id, signedLock);
-          lockOwnerRef.current = address;
+          if (privateReadAddressRef.current?.toLowerCase() !== lockOwner.toLowerCase()) {
+            throw new Error("Authenticated deposit account changed while signing");
+          }
+          savePendingLock(lockOwner, record.transaction_id, signedLock);
+          lockOwnerRef.current = lockOwner;
           emitDebug("intent:lock-signed", {
             transactionId: record.transaction_id,
             amount: signedLock.amount,
@@ -2804,6 +3463,7 @@ function useFiatOnRamp(options) {
       executePrivateRead,
       networkConfig,
       postDepositLock,
+      privateReadAddress,
       serviceAddress,
       tokenId,
       wagmiConfig,
@@ -2829,7 +3489,7 @@ function useFiatOnRamp(options) {
           chainId: token.chainId
         });
         const record = await executePrivateRead(
-          () => client.updateOnRamp(transactionId, {
+          (readClient) => readClient.updateOnRamp(transactionId, {
             token_id: tokenId,
             chain_id: token.chainId,
             moonpay_transaction_id: transactionId === moonpayTransactionId ? void 0 : moonpayTransactionId
@@ -2849,7 +3509,7 @@ function useFiatOnRamp(options) {
         console.warn("Failed to register on-ramp token mapping:", err);
       }
     },
-    [client, emitDebug, enabledTokens, executePrivateRead, tokenId]
+    [emitDebug, enabledTokens, executePrivateRead, tokenId]
   );
   const handleTransactionCreated = react.useCallback(
     async (props) => {
@@ -2864,7 +3524,9 @@ function useFiatOnRamp(options) {
       setError(null);
       try {
         emitDebug("moonpay:onUrlSignatureRequested", summariseMoonPayUrl(url));
-        const { signature } = await executePrivateRead(() => client.signOnRampUrl({ url }));
+        const { signature } = await executePrivateRead(
+          (readClient) => readClient.signOnRampUrl({ url })
+        );
         setStatus("awaiting-purchase");
         emitDebug("sign-url:success", {
           signatureLength: signature.length
@@ -2879,7 +3541,7 @@ function useFiatOnRamp(options) {
         throw err;
       }
     },
-    [client, emitDebug, executePrivateRead]
+    [emitDebug, executePrivateRead]
   );
   const waitForOnChainHash = react.useCallback(
     async (transactionId) => {
@@ -2891,7 +3553,9 @@ function useFiatOnRamp(options) {
       });
       while (Date.now() - startTime < deliveryTimeout) {
         try {
-          const { pending: rows } = await executePrivateRead(() => client.getPendingOnRamps());
+          const { pending: rows } = await executePrivateRead(
+            (readClient) => readClient.getPendingOnRamps()
+          );
           setPending(rows);
           const record = rows.find((r) => matchesOnRampTransaction(r, transactionId));
           emitDebug("delivery-poll:tick", {
@@ -2918,7 +3582,7 @@ function useFiatOnRamp(options) {
       emitDebug("delivery-poll:timeout", { transactionId });
       return null;
     },
-    [client, deliveryPollInterval, deliveryTimeout, emitDebug, executePrivateRead]
+    [deliveryPollInterval, deliveryTimeout, emitDebug, executePrivateRead]
   );
   const triggerVerification = react.useCallback(
     async (record) => {
@@ -2986,7 +3650,6 @@ function useFiatOnRamp(options) {
             `Delivered amount (${record.quote_currency_amount}) is below the minimum deposit.`
           );
         }
-        activeVerificationAmountRef.current = amount;
         if (activeIntentIdRef.current === record.transaction_id) {
           setStatus("verifying");
         }
@@ -3005,7 +3668,6 @@ function useFiatOnRamp(options) {
         if (activeVerificationKeyRef.current === verificationKey) {
           activeVerificationKeyRef.current = null;
           activeVerificationRecordRef.current = null;
-          activeVerificationAmountRef.current = null;
           setActiveVerificationId(null);
         }
         throw err;
@@ -3251,12 +3913,6 @@ function matchesOnRampTransaction(record, transactionId) {
 function getOnRampVerificationKey(record) {
   return record.on_chain_tx_hash ?? record.transaction_id;
 }
-function requireServiceAddress(serviceAddress) {
-  if (!serviceAddress) {
-    throw new Error("Service address not configured");
-  }
-  return serviceAddress;
-}
 function summariseMoonPayEventProps(props) {
   return {
     id: props.id,
@@ -3690,7 +4346,7 @@ function FiatOnRampForm({
     ] }),
     lockPending && /* @__PURE__ */ jsxRuntime.jsxs("p", { className: "text-muted-foreground flex items-center gap-2 text-sm", children: [
       /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Loader2, { className: "size-4 animate-spin", "aria-hidden": true }),
-      "Purchase credited \u2014 locking your funds\u2026"
+      "Purchase credited. Locking your funds\u2026"
     ] }),
     autoStart ? !visible && isPrePurchase && /* @__PURE__ */ jsxRuntime.jsx(Skeleton, { className: "h-[656px] w-full rounded-md" }) : isInitializing ? /* @__PURE__ */ jsxRuntime.jsx(Skeleton, { className: "h-9 w-full rounded-md" }) : /* @__PURE__ */ jsxRuntime.jsxs(Button, { type: "button", onClick: handleOpen, disabled: !canBuy, children: [
       (isBusy || visible) && /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Loader2, { className: "animate-spin", "aria-hidden": true }),
@@ -3750,6 +4406,7 @@ exports.buildHostedAuthSession = buildHostedAuthSession;
 exports.buildSiweStatement = buildSiweStatement;
 exports.buttonVariants = buttonVariants;
 exports.canUseBrowserStorage = canUseBrowserStorage;
+exports.canUseSharedBrowserStorage = canUseSharedBrowserStorage;
 exports.clampLockAmount = clampLockAmount;
 exports.clearHostedAuthPendingTransaction = clearHostedAuthPendingTransaction;
 exports.clearPendingLock = clearPendingLock;
@@ -3773,6 +4430,7 @@ exports.getChainById = getChainById;
 exports.getChainId = getChainId;
 exports.getExplorerAddressUrl = getExplorerAddressUrl;
 exports.getExplorerLabel = getExplorerLabel;
+exports.getSharedBrowserStorageItem = getSharedBrowserStorageItem;
 exports.getTransactionReceipt = getTransactionReceipt;
 exports.getWalletClient = getWalletClient3;
 exports.isHostedAuthRefreshActive = isHostedAuthRefreshActive;
@@ -3787,8 +4445,12 @@ exports.persistHostedAuthPendingTransaction = persistHostedAuthPendingTransactio
 exports.readHostedAuthPendingTransaction = readHostedAuthPendingTransaction;
 exports.readStoredHostedAuthSession = readStoredHostedAuthSession;
 exports.removeBrowserStorageItem = removeBrowserStorageItem;
+exports.removeSharedBrowserStorageItem = removeSharedBrowserStorageItem;
+exports.requireDepositLockOwner = requireDepositLockOwner;
+exports.requireServiceAddress = requireServiceAddress;
 exports.savePendingLock = savePendingLock;
 exports.setBrowserStorageItem = setBrowserStorageItem;
+exports.setSharedBrowserStorageItem = setSharedBrowserStorageItem;
 exports.shortenAddress = shortenAddress;
 exports.signLockMessage = signLockMessage;
 exports.signModifyLockMessage = signModifyLockMessage;
@@ -3808,5 +4470,5 @@ exports.useSafeAccount = useSafeAccount;
 exports.useSafePrivanaContext = useSafePrivanaContext;
 exports.useSiweAuth = useSiweAuth;
 exports.waitForTransactionReceipt = waitForTransactionReceipt;
-//# sourceMappingURL=chunk-UHXVYWTF.cjs.map
-//# sourceMappingURL=chunk-UHXVYWTF.cjs.map
+//# sourceMappingURL=chunk-7KEQHWZB.cjs.map
+//# sourceMappingURL=chunk-7KEQHWZB.cjs.map