@oasisprotocol/privana-sdk 0.5.2 → 0.5.3

package/dist/{chunk-ZVUMV4NR.js → chunk-DZURIIRE.js}

@@ -1,8 +1,8 @@
 "use client";
-import { createContext, useContext, useRef, useCallback, useSyncExternalStore, useState, useEffect, useMemo } from 'react';
+import { createSiweMessage } from 'viem/siwe';
+import { createContext, useContext, useRef, useCallback, useSyncExternalStore, useMemo, useState, useEffect } from 'react';
 import { WagmiContext, useConfig, useChainId, useSwitchChain, useAccount, useWalletClient } from 'wagmi';
 import { watchAccount, getAccount, getWalletClient } from 'wagmi/actions';
-import { createSiweMessage } from 'viem/siwe';
 import { jsx, jsxs } from 'react/jsx-runtime';
 import { parseAbiItem, zeroAddress, walletActions, hexToString, parseUnits, decodeEventLog, formatUnits, createClient, custom } from 'viem';
 import { useQueryClient } from '@tanstack/react-query';
@@ -95,8 +95,11 @@ function getExplorerAddressUrl(chainId, address) {
   return `${chain.explorerUrl}/address/${address}#tokentxns`;
 }
 
+// src/sdk/auth/auth-clock-skew.ts
+var AUTH_CLOCK_SKEW_MS = 3e4;
+
 // src/sdk/auth/hosted-auth.ts
-var HOSTED_AUTH_CLOCK_SKEW_MS = 3e4;
+var HOSTED_AUTH_CLOCK_SKEW_MS = AUTH_CLOCK_SKEW_MS;
 var PKCE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
 var DEFAULT_RANDOM_LENGTH = 64;
 var HOSTED_AUTH_CALLBACK_QUERY_KEYS = ["code", "error", "error_description", "state"];
@@ -218,11 +221,32 @@ function isHostedAuthSessionActive(session, now = Date.now(), skewMs = HOSTED_AU
 function isHostedAuthRefreshActive(session, now = Date.now(), skewMs = HOSTED_AUTH_CLOCK_SKEW_MS) {
   return session.refreshExpiresAt > now + skewMs;
 }
-
-// src/sdk/auth/siwe.ts
+var SIWE_MESSAGE_VALIDITY_MS = 24 * 60 * 60 * 1e3;
 function buildSiweStatement(chainId) {
   return `Sign in to Privana on chain ${chainId}`;
 }
+async function buildSiweLoginMessage(api, params) {
+  const { address, chainId, apiUrl } = params;
+  const [{ domain }, { nonce }] = await Promise.all([
+    api.getSiweDomain(),
+    api.getSiweNonce(address)
+  ]);
+  const issuedAt = /* @__PURE__ */ new Date();
+  const expirationTime = new Date(issuedAt.getTime() + SIWE_MESSAGE_VALIDITY_MS);
+  const uri = typeof window !== "undefined" && window.location.origin ? window.location.origin : apiUrl;
+  const message = createSiweMessage({
+    address,
+    chainId,
+    domain,
+    expirationTime,
+    issuedAt,
+    nonce,
+    statement: buildSiweStatement(chainId),
+    uri,
+    version: "1"
+  });
+  return { message, expirationTime };
+}
 
 // src/sdk/client/errors.ts
 var AccountingApiError = class _AccountingApiError extends Error {
@@ -347,9 +371,10 @@ var HttpClient = class {
 var PRIVATE_READ_TOKEN_HEADER = "X-SIWE-Token";
 var MAX_BATCH_BALANCE_TOKEN_IDS = 100;
 var MAX_HISTORY_PAGE_SIZE = 100;
-var PrivanaClient = class {
+var PrivanaClient = class _PrivanaClient {
   constructor(config) {
     this.http = new HttpClient(config);
+    this.baseConfig = { ...config, headers: { ...config.headers } };
   }
   getBaseUrl() {
     return this.http.getBaseUrl();
@@ -619,10 +644,23 @@ var PrivanaClient = class {
   async getPendingOnRamps() {
     return this.http.get("/v1/accounting/onramp/pending");
   }
+  /**
+   * @deprecated This mutates the shared client's headers and displaces its Authorization
+   * (JWT bearer) header, which breaks concurrent JWT-authenticated requests. Use
+   * {@link PrivanaClient.withPrivateReadToken} instead, which returns a scoped client that
+   * authenticates the private read without touching the shared client's headers. Will be
+   * removed in a future release.
+   */
   setPrivateReadToken(token) {
     this.http.removeHeader("Authorization");
     this.http.setHeader(PRIVATE_READ_TOKEN_HEADER, token);
   }
+  /**
+   * @deprecated The shared client no longer carries a private-read token between requests;
+   * private reads now run on a scoped client from {@link PrivanaClient.withPrivateReadToken}.
+   * Returns whatever X-SIWE-Token is currently set on the shared client's headers. Will be
+   * removed in a future release.
+   */
   getPrivateReadToken() {
     return this.http.getHeader(PRIVATE_READ_TOKEN_HEADER);
   }
@@ -636,6 +674,26 @@ var PrivanaClient = class {
   clearBearerToken() {
     this.http.removeHeader("Authorization");
   }
+  /**
+   * Returns a scoped client whose requests authenticate with the given SIWE private-read
+   * token (X-SIWE-Token) instead of the client-wide JWT bearer. The scoped client shares
+   * baseUrl/timeout/base headers but owns a separate header set, so private reads issued
+   * through it never displace the real client's Authorization header: concurrent
+   * JWT-authenticated requests on the real client keep their bearer, and a bearer installed
+   * mid-flight (auto-login/hydration) is never erased by a private read.
+   */
+  withPrivateReadToken(token) {
+    const headers = {};
+    for (const [name, value] of Object.entries(this.baseConfig.headers ?? {})) {
+      const lower = name.toLowerCase();
+      if (lower === "authorization" || lower === PRIVATE_READ_TOKEN_HEADER.toLowerCase()) {
+        continue;
+      }
+      headers[name] = value;
+    }
+    headers[PRIVATE_READ_TOKEN_HEADER] = token;
+    return new _PrivanaClient({ ...this.baseConfig, headers });
+  }
 };
 
 // src/sdk/signatures/eip712-types.ts
@@ -865,8 +923,421 @@ function useSafeAccount() {
   return useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
 }
 
+// src/sdk/auth/siwe-persistence.ts
+var PERSISTED_SIWE_AUTH_RECORD_VERSION = 2;
+var warnedBlockedStorage = false;
+function warnBlockedStorageOnce() {
+  if (warnedBlockedStorage) return;
+  warnedBlockedStorage = true;
+  if (typeof console !== "undefined" && typeof console.warn === "function") {
+    console.warn(
+      "Privana SIWE auth: localStorage is unavailable or blocked; sessions will stay in memory only."
+    );
+  }
+}
+function createSiweAuthStorageKey(apiUrl, chainId) {
+  const normalizedApiUrl = apiUrl.replace(/\/$/, "");
+  return ["privana", "siwe-auth", normalizedApiUrl, String(chainId)].join(":");
+}
+function buildPersistedSiweAuthRecordFromLogin(response, now, siweTokenExpiresAt) {
+  return {
+    version: PERSISTED_SIWE_AUTH_RECORD_VERSION,
+    tokens: {
+      siwe_token: response.siwe_token,
+      jwt_access_token: response.jwt_access_token,
+      jwt_refresh_token: response.jwt_refresh_token,
+      address: response.address
+    },
+    accessTokenExpiresAt: now + response.jwt_expires_in * 1e3,
+    refreshTokenExpiresAt: now + response.jwt_refresh_expires_in * 1e3,
+    siweTokenExpiresAt,
+    updatedAt: now
+  };
+}
+function applyRefreshToPersistedSiweAuthRecord(previous, response, now = Date.now()) {
+  return {
+    ...previous,
+    tokens: {
+      ...previous.tokens,
+      jwt_access_token: response.token,
+      jwt_refresh_token: response.refresh_token
+    },
+    accessTokenExpiresAt: now + response.expires_in * 1e3,
+    refreshTokenExpiresAt: now + response.refresh_expires_in * 1e3,
+    updatedAt: now
+  };
+}
+function isPersistedSiweAuthRecord(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  if (record.version !== PERSISTED_SIWE_AUTH_RECORD_VERSION) return false;
+  if (typeof record.accessTokenExpiresAt !== "number") return false;
+  if (typeof record.refreshTokenExpiresAt !== "number") return false;
+  if (typeof record.siweTokenExpiresAt !== "number") return false;
+  if (typeof record.updatedAt !== "number") return false;
+  const tokens = record.tokens;
+  if (typeof tokens !== "object" || tokens === null) return false;
+  const tokenFields = tokens;
+  return typeof tokenFields.siwe_token === "string" && typeof tokenFields.jwt_access_token === "string" && typeof tokenFields.jwt_refresh_token === "string" && typeof tokenFields.address === "string" && tokenFields.address.length > 0;
+}
+function isPersistedSiweAuthAccessActive(record, now = Date.now()) {
+  return record.accessTokenExpiresAt > now + AUTH_CLOCK_SKEW_MS;
+}
+function isPersistedSiweAuthRefreshActive(record, now = Date.now()) {
+  return record.refreshTokenExpiresAt > now + AUTH_CLOCK_SKEW_MS;
+}
+function parsePersistedSiweAuthRecord(raw, now = Date.now()) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!isPersistedSiweAuthRecord(parsed)) return null;
+  if (!isPersistedSiweAuthRefreshActive(parsed, now)) return null;
+  return parsed;
+}
+function readPersistedSiweAuth(storage, key, now = Date.now()) {
+  let raw;
+  try {
+    raw = storage.getItem(key);
+  } catch {
+    return null;
+  }
+  if (raw == null) return null;
+  const record = parsePersistedSiweAuthRecord(raw, now);
+  if (!record) removePersistedSiweAuth(storage, key);
+  return record;
+}
+function writePersistedSiweAuth(storage, key, record) {
+  try {
+    storage.setItem(key, JSON.stringify(record));
+  } catch {
+    warnBlockedStorageOnce();
+  }
+}
+function removePersistedSiweAuth(storage, key) {
+  try {
+    storage.removeItem(key);
+  } catch {
+  }
+}
+var localStorageProbe;
+function getSiweAuthLocalStorage() {
+  if (localStorageProbe !== void 0) return localStorageProbe;
+  if (typeof window === "undefined") return null;
+  try {
+    const storage = window.localStorage;
+    storage.getItem("__privana_siwe_probe__");
+    localStorageProbe = storage;
+  } catch {
+    warnBlockedStorageOnce();
+    localStorageProbe = null;
+  }
+  return localStorageProbe;
+}
+function isAdoptableRecord(record, currentAddress, currentUpdatedAt) {
+  if (!record || !currentAddress) return false;
+  if (record.tokens.address.toLowerCase() !== currentAddress.toLowerCase()) return false;
+  return record.updatedAt > (currentUpdatedAt ?? -1);
+}
+function resolveHydrationAction(record, connectedAddress, now = Date.now()) {
+  if (!connectedAddress) return { type: "dormant" };
+  if (!record) return { type: "dormant" };
+  if (record.tokens.address.toLowerCase() !== connectedAddress.toLowerCase()) {
+    return { type: "remove" };
+  }
+  if (isPersistedSiweAuthAccessActive(record, now)) return { type: "restore", record };
+  if (isPersistedSiweAuthRefreshActive(record, now)) return { type: "refresh", record };
+  return { type: "remove" };
+}
+function resolveStorageEvent(newValue, currentAddress, currentUpdatedAt, now = Date.now()) {
+  if (!currentAddress) return { type: "ignore" };
+  if (newValue == null) return { type: "logout" };
+  const record = parsePersistedSiweAuthRecord(newValue, now);
+  if (!record) return { type: "ignore" };
+  if (!isAdoptableRecord(record, currentAddress, currentUpdatedAt)) return { type: "ignore" };
+  return { type: "adopt", record };
+}
+
+// src/sdk/auth/siwe-auth-policy.ts
+function resolveActiveSessionAddress(...candidates) {
+  return candidates.find((candidate) => !!candidate) ?? null;
+}
+function resolveAutoLoginEffectAction(input) {
+  const {
+    status,
+    isConnected,
+    address,
+    sessionAddress,
+    autoLogin,
+    isLoading,
+    isHydrating,
+    autoAttemptedAddress,
+    authenticatingAddress
+  } = input;
+  const activeAddress2 = resolveActiveSessionAddress(sessionAddress, authenticatingAddress);
+  if (status === "connecting" || status === "reconnecting") return { type: "wait" };
+  if (!isConnected && activeAddress2) return { type: "reset-on-disconnect" };
+  if (isConnected && address && activeAddress2 && address.toLowerCase() !== activeAddress2.toLowerCase()) {
+    return { type: "clear-on-mismatch" };
+  }
+  if (!autoLogin) return { type: "noop" };
+  if (isHydrating) return { type: "wait" };
+  if (isConnected && address && !sessionAddress && !isLoading && autoAttemptedAddress !== address) {
+    return { type: "auto-login" };
+  }
+  return { type: "noop" };
+}
+
+// src/sdk/auth/auth-lifecycle.ts
+function initialAuthLifecycleState() {
+  return {
+    generation: 0,
+    refreshData: null,
+    currentRecord: null,
+    autoAttemptedAddress: null,
+    authenticatingAddress: null,
+    hydratedAddress: null
+  };
+}
+function reduceAuthLifecycle(state, event) {
+  switch (event.type) {
+    case "reset":
+      return {
+        generation: state.generation + 1,
+        refreshData: null,
+        currentRecord: null,
+        autoAttemptedAddress: null,
+        authenticatingAddress: null,
+        hydratedAddress: null
+      };
+    case "commit":
+      return {
+        ...state,
+        generation: state.generation + 1,
+        refreshData: {
+          refreshToken: event.record.tokens.jwt_refresh_token,
+          refreshExpiresAt: event.record.refreshTokenExpiresAt
+        },
+        currentRecord: event.record
+      };
+    case "refresh":
+      return {
+        ...state,
+        refreshData: event.refreshData,
+        currentRecord: event.record
+      };
+    case "setAutoAttemptedAddress":
+      return { ...state, autoAttemptedAddress: event.address };
+    case "setAuthenticatingAddress":
+      return { ...state, authenticatingAddress: event.address };
+    case "setHydratedAddress":
+      return { ...state, hydratedAddress: event.address };
+    case "clearCurrentRecord":
+      return { ...state, currentRecord: null };
+  }
+}
+
+// src/sdk/auth/auth-lifecycle-effects.ts
+function armPrivateRead(ports, input) {
+  ports.cache.set(input.scopeKey, input.siweToken, input.siweExpiry);
+}
+function applyAccessRotation(ports, rotation) {
+  ports.client.setBearerToken(rotation.accessToken);
+  ports.react.setTokens(
+    (prev) => prev ? {
+      ...prev,
+      jwt_access_token: rotation.accessToken,
+      jwt_refresh_token: rotation.refreshToken
+    } : prev
+  );
+  ports.react.setAccessTokenExpiresAt(rotation.accessTokenExpiresAt);
+}
+function publishSession(ports, record) {
+  ports.client.setBearerToken(record.tokens.jwt_access_token);
+  ports.react.setSession({ address: record.tokens.address });
+  ports.react.setTokens({
+    siwe_token: record.tokens.siwe_token,
+    jwt_access_token: record.tokens.jwt_access_token,
+    jwt_refresh_token: record.tokens.jwt_refresh_token,
+    address: record.tokens.address
+  });
+  ports.react.setAccessTokenExpiresAt(record.accessTokenExpiresAt);
+}
+function persistRecordIfEnabled(ports, record) {
+  if (!ports.persistJwt) return;
+  if (record) ports.storage.write(record);
+  else ports.storage.remove();
+}
+function clearSessionEffects(ports) {
+  ports.client.clearPrivateReadToken();
+  ports.client.clearBearerToken();
+  ports.react.setSession(null);
+  ports.react.setTokens(null);
+  ports.react.setAccessTokenExpiresAt(null);
+  ports.react.setIsLoading(false);
+  ports.react.setIsHydrating(false);
+  ports.react.setError(null);
+}
+
+// src/sdk/auth/siwe-auth-controller.ts
+function activeAddress(ctrl) {
+  return resolveActiveSessionAddress(
+    ctrl.getSessionAddress(),
+    ctrl.getState().currentRecord?.tokens.address
+  );
+}
+function ctrlReset(ctrl, removeStorage) {
+  ctrl.loginInFlight = false;
+  ctrl.loginOwnerGeneration = -1;
+  ctrl.hydrateOwnerGeneration = -1;
+  ctrl.refreshPromise = null;
+  ctrl.dispatch({ type: "reset" });
+  clearSessionEffects(ctrl.ports);
+  if (removeStorage) persistRecordIfEnabled(ctrl.ports, null);
+}
+function ctrlRestoreSession(ctrl, record) {
+  ctrl.dispatch({ type: "commit", record });
+  armPrivateRead(ctrl.ports, {
+    siweToken: record.tokens.siwe_token,
+    siweExpiry: record.siweTokenExpiresAt,
+    scopeKey: ctrl.ports.makeScopeKey(record.tokens.address)
+  });
+  publishSession(ctrl.ports, record);
+}
+function ctrlAdoptNewerRecordIfAvailable(ctrl) {
+  if (!ctrl.config.persistJwt) return false;
+  const record = ctrl.ports.storage.read();
+  if (!record) return false;
+  const current = activeAddress(ctrl);
+  if (!isAdoptableRecord(record, current, ctrl.getState().currentRecord?.updatedAt ?? null)) {
+    return false;
+  }
+  ctrlRestoreSession(ctrl, record);
+  return true;
+}
+async function ctrlLogin(ctrl) {
+  const address = ctrl.config.address;
+  if (!address) throw new Error("No wallet connected");
+  if (ctrl.loginInFlight) return;
+  ctrl.loginInFlight = true;
+  ctrl.dispatch({ type: "setAutoAttemptedAddress", address });
+  ctrl.dispatch({ type: "setAuthenticatingAddress", address });
+  ctrl.ports.react.setIsLoading(true);
+  ctrl.ports.react.setError(null);
+  const generation = ctrl.getState().generation;
+  ctrl.loginOwnerGeneration = generation;
+  const { chainId, apiUrl } = ctrl.config;
+  const api = ctrl.api;
+  try {
+    const { message, expirationTime } = await buildSiweLoginMessage(api, {
+      address,
+      chainId,
+      apiUrl
+    });
+    const signature = await ctrl.signer.signSiweMessage({ account: address, message });
+    const res = await api.loginWithSiwe({ siwe_message: message, signature });
+    if (ctrl.getState().generation !== generation) return;
+    const record = buildPersistedSiweAuthRecordFromLogin(res, Date.now(), expirationTime.getTime());
+    ctrlRestoreSession(ctrl, record);
+    persistRecordIfEnabled(ctrl.ports, record);
+  } catch (err) {
+    if (ctrl.loginOwnerGeneration === generation) {
+      ctrl.ports.react.setError(err instanceof Error ? err : new Error("Sign-in failed"));
+    }
+    throw err;
+  } finally {
+    if (ctrl.loginOwnerGeneration === generation) {
+      ctrl.ports.react.setIsLoading(false);
+      ctrl.loginInFlight = false;
+      ctrl.loginOwnerGeneration = -1;
+    }
+  }
+}
+async function ctrlLogout(ctrl) {
+  const refreshToken = ctrl.getState().refreshData?.refreshToken;
+  try {
+    if (refreshToken) {
+      try {
+        await ctrl.api.logoutJwtSession({ refresh_token: refreshToken, revoke_all: true });
+      } catch {
+      }
+    }
+  } finally {
+    ctrlReset(ctrl, ctrl.config.persistJwt);
+    ctrl.dispatch({ type: "setAutoAttemptedAddress", address: ctrl.config.address ?? null });
+  }
+}
+async function ctrlRefreshAccessToken(ctrl) {
+  const data = ctrl.getState().refreshData;
+  if (!data) return;
+  if (Date.now() >= data.refreshExpiresAt - AUTH_CLOCK_SKEW_MS) {
+    ctrlReset(ctrl, ctrl.config.persistJwt);
+    return;
+  }
+  if (ctrl.refreshPromise) return ctrl.refreshPromise;
+  const generation = ctrl.getState().generation;
+  const promise = (async () => {
+    try {
+      if (ctrlAdoptNewerRecordIfAvailable(ctrl)) return;
+      const res = await ctrl.api.refreshJwtSession({ refresh_token: data.refreshToken });
+      if (ctrl.getState().generation !== generation) return;
+      const refreshedAt = Date.now();
+      const refreshData = {
+        refreshToken: res.refresh_token,
+        refreshExpiresAt: refreshedAt + res.refresh_expires_in * 1e3
+      };
+      const previous = ctrl.getState().currentRecord;
+      if (previous && ctrl.config.persistJwt) {
+        const nextRecord = applyRefreshToPersistedSiweAuthRecord(previous, res, refreshedAt);
+        ctrl.dispatch({ type: "refresh", refreshData, record: nextRecord });
+        ctrl.ports.storage.write(nextRecord);
+      } else {
+        ctrl.dispatch({ type: "refresh", refreshData, record: previous });
+      }
+      applyAccessRotation(ctrl.ports, {
+        accessToken: res.token,
+        refreshToken: res.refresh_token,
+        accessTokenExpiresAt: refreshedAt + res.expires_in * 1e3
+      });
+    } catch {
+      if (ctrl.getState().generation !== generation) return;
+      if (!ctrlAdoptNewerRecordIfAvailable(ctrl)) ctrlReset(ctrl, ctrl.config.persistJwt);
+    }
+  })();
+  ctrl.refreshPromise = promise;
+  try {
+    await promise;
+  } finally {
+    if (ctrl.refreshPromise === promise) ctrl.refreshPromise = null;
+  }
+}
+async function ctrlHydrateViaRefresh(ctrl, record, address) {
+  ctrl.dispatch({ type: "setAutoAttemptedAddress", address });
+  ctrl.dispatch({ type: "setAuthenticatingAddress", address });
+  ctrl.ports.react.setIsHydrating(true);
+  ctrl.dispatch({ type: "commit", record });
+  const hydrationGen = ctrl.getState().generation;
+  ctrl.hydrateOwnerGeneration = hydrationGen;
+  try {
+    await ctrlRefreshAccessToken(ctrl).catch(() => {
+    });
+    const fresh = ctrl.getState().currentRecord;
+    if (fresh && fresh.tokens.address.toLowerCase() === address.toLowerCase() && isPersistedSiweAuthAccessActive(fresh)) {
+      ctrlRestoreSession(ctrl, fresh);
+    } else if (ctrl.getState().generation === hydrationGen) {
+      ctrl.dispatch({ type: "setAutoAttemptedAddress", address: null });
+    }
+  } finally {
+    if (ctrl.hydrateOwnerGeneration === hydrationGen) {
+      ctrl.ports.react.setIsHydrating(false);
+      ctrl.hydrateOwnerGeneration = -1;
+    }
+  }
+}
+
 // src/sdk/hooks/private-read-token-store.ts
-var AUTH_CLOCK_SKEW_MS = 3e4;
 var cache = /* @__PURE__ */ new Map();
 function createScopeKey(apiUrl, chainId, address) {
   return `${apiUrl.replace(/\/$/, "")}:${chainId}:${address.toLowerCase()}`;
@@ -886,164 +1357,240 @@ function setCachedPrivateReadToken(scopeKey, token, expiresAt) {
 function deleteCachedPrivateReadToken(scopeKey) {
   cache.delete(scopeKey);
 }
-var DEFAULT_SIWE_VALIDITY_MS = 24 * 60 * 60 * 1e3;
-var AUTH_REFRESH_SKEW_MS = 3e4;
-var SiweAuthContext = createContext(null);
-function SiweAuthProvider({
-  children,
-  client,
-  networkConfig,
-  autoLogin = true
-}) {
+
+// src/sdk/hooks/use-siwe-auth-lifecycle.ts
+function useSiweAuthLifecycle(deps) {
+  const { storageKey, apiUrl, chainId, persistJwt, autoLogin, client, api } = deps;
   const wagmiContext = useContext(WagmiContext);
   const { address, isConnected, status } = useSafeAccount();
   const [session, setSession] = useState(null);
   const [tokens, setTokens] = useState(null);
   const [isLoading, setIsLoading] = useState(false);
+  const [isHydrating, setIsHydrating] = useState(false);
   const [error, setError] = useState(null);
   const [accessTokenExpiresAt, setAccessTokenExpiresAt] = useState(null);
-  const loginInFlight = useRef(false);
-  const autoAttemptedAddress = useRef(null);
-  const refreshInFlight = useRef(false);
-  const refreshDataRef = useRef(null);
-  const clearSession = useCallback(() => {
-    refreshDataRef.current = null;
-    setAccessTokenExpiresAt(null);
-    client.clearPrivateReadToken();
-    client.clearBearerToken();
-    setSession(null);
-    setTokens(null);
-    setError(null);
-    autoAttemptedAddress.current = null;
-  }, [client]);
-  const logout = useCallback(async () => {
-    setError(null);
-    const refreshToken = refreshDataRef.current?.refreshToken;
-    try {
-      if (refreshToken) {
-        await client.logoutJwtSession({ refresh_token: refreshToken });
+  const sessionRef = useRef(null);
+  const prevPersistJwtRef = useRef(void 0);
+  const authRef = useRef(initialAuthLifecycleState());
+  const storageAdapter = useMemo(
+    () => ({
+      read: () => {
+        const ls = getSiweAuthLocalStorage();
+        return ls ? readPersistedSiweAuth(ls, storageKey) : null;
+      },
+      write: (record) => {
+        const ls = getSiweAuthLocalStorage();
+        if (ls) writePersistedSiweAuth(ls, storageKey, record);
+      },
+      remove: () => {
+        const ls = getSiweAuthLocalStorage();
+        if (ls) removePersistedSiweAuth(ls, storageKey);
       }
-    } finally {
-      clearSession();
-      autoAttemptedAddress.current = address ?? null;
-    }
-  }, [clearSession, client, address]);
-  const login = useCallback(async () => {
-    if (!wagmiContext) throw new Error("WagmiProvider is required for SIWE auth");
-    if (!address) throw new Error("No wallet connected");
-    if (loginInFlight.current) return;
-    loginInFlight.current = true;
-    setIsLoading(true);
-    setError(null);
-    try {
-      const walletClient = await getWalletClient(wagmiContext);
-      if (!walletClient) throw new Error("No wallet client available");
-      const [{ domain }, nonceRes] = await Promise.all([
-        client.getSiweDomain(),
-        client.getSiweNonce(address)
-      ]);
-      const issuedAt = /* @__PURE__ */ new Date();
-      const expirationTime = new Date(issuedAt.getTime() + DEFAULT_SIWE_VALIDITY_MS);
-      const uri = typeof window !== "undefined" && window.location.origin ? window.location.origin : networkConfig.apiUrl;
-      const message = createSiweMessage({
-        address,
-        chainId: networkConfig.chainId,
-        domain,
-        uri,
-        version: "1",
-        nonce: nonceRes.nonce,
-        statement: buildSiweStatement(networkConfig.chainId),
-        issuedAt,
-        expirationTime
-      });
-      const signature = await walletClient.signMessage({
-        account: walletClient.account ?? address,
-        message
-      });
-      const res = await client.loginWithSiwe({ siwe_message: message, signature });
-      const loggedInAt = Date.now();
-      client.setPrivateReadToken(res.siwe_token);
-      client.setBearerToken(res.jwt_access_token);
-      refreshDataRef.current = {
-        refreshToken: res.jwt_refresh_token,
-        refreshExpiresAt: loggedInAt + res.jwt_refresh_expires_in * 1e3
-      };
-      setCachedPrivateReadToken(
-        createScopeKey(networkConfig.apiUrl, networkConfig.chainId, address),
-        res.siwe_token,
-        expirationTime.getTime()
-      );
-      setSession({ address: res.address });
-      setTokens({
-        siwe_token: res.siwe_token,
-        jwt_access_token: res.jwt_access_token,
-        jwt_refresh_token: res.jwt_refresh_token,
-        address: res.address
-      });
-      setAccessTokenExpiresAt(loggedInAt + res.jwt_expires_in * 1e3);
-    } catch (err) {
-      setError(err instanceof Error ? err : new Error("Sign-in failed"));
-      throw err;
-    } finally {
-      setIsLoading(false);
-      loginInFlight.current = false;
-    }
-  }, [wagmiContext, address, client, networkConfig.chainId, networkConfig.apiUrl]);
-  const refreshAccessToken = useCallback(async () => {
-    const data = refreshDataRef.current;
-    if (!data || refreshInFlight.current) return;
-    if (Date.now() >= data.refreshExpiresAt - AUTH_REFRESH_SKEW_MS) {
-      clearSession();
-      return;
-    }
-    refreshInFlight.current = true;
-    try {
-      const res = await client.refreshJwtSession({ refresh_token: data.refreshToken });
-      const refreshedAt = Date.now();
-      client.setBearerToken(res.token);
-      refreshDataRef.current = {
-        refreshToken: res.refresh_token,
-        refreshExpiresAt: refreshedAt + res.refresh_expires_in * 1e3
-      };
-      setTokens(
-        (prev) => prev ? { ...prev, jwt_access_token: res.token, jwt_refresh_token: res.refresh_token } : prev
-      );
-      setAccessTokenExpiresAt(refreshedAt + res.expires_in * 1e3);
-    } catch {
-      clearSession();
-    } finally {
-      refreshInFlight.current = false;
-    }
-  }, [client, clearSession]);
+    }),
+    [storageKey]
+  );
+  const scopeInputsRef = useRef({ apiUrl, chainId });
+  scopeInputsRef.current.apiUrl = apiUrl;
+  scopeInputsRef.current.chainId = chainId;
+  const wagmiContextRef = useRef(wagmiContext);
+  wagmiContextRef.current = wagmiContext;
+  const portsRef = useRef(null);
+  if (!portsRef.current) {
+    portsRef.current = {
+      persistJwt,
+      client,
+      storage: storageAdapter,
+      cache: { set: setCachedPrivateReadToken },
+      react: {
+        setSession,
+        setTokens,
+        setAccessTokenExpiresAt,
+        setIsLoading,
+        setIsHydrating,
+        setError
+      },
+      makeScopeKey: (addr) => createScopeKey(scopeInputsRef.current.apiUrl, scopeInputsRef.current.chainId, addr)
+    };
+  }
+  const ports = portsRef.current;
+  ports.persistJwt = persistJwt;
+  ports.client = client;
+  ports.storage = storageAdapter;
+  const ctrlRef = useRef(null);
+  if (!ctrlRef.current) {
+    ctrlRef.current = {
+      config: { address, chainId, apiUrl, persistJwt },
+      ports,
+      api,
+      signer: {
+        signSiweMessage: async ({ account, message }) => {
+          const ctx = wagmiContextRef.current;
+          if (!ctx) throw new Error("WagmiProvider is required for SIWE auth");
+          const walletClient = await getWalletClient(ctx);
+          if (!walletClient) throw new Error("No wallet client available");
+          return walletClient.signMessage({
+            account: walletClient.account ?? account,
+            message
+          });
+        }
+      },
+      loginInFlight: false,
+      loginOwnerGeneration: -1,
+      hydrateOwnerGeneration: -1,
+      refreshPromise: null,
+      getState: () => authRef.current,
+      getSessionAddress: () => sessionRef.current?.address ?? null,
+      dispatch: (event) => {
+        authRef.current = reduceAuthLifecycle(authRef.current, event);
+      }
+    };
+  }
+  const ctrl = ctrlRef.current;
+  ctrl.config = { address, chainId, apiUrl, persistJwt };
+  ctrl.api = api;
+  const login = useCallback(() => ctrlLogin(ctrl), [ctrl]);
+  const logout = useCallback(() => ctrlLogout(ctrl), [ctrl]);
+  const refreshAccessToken = useCallback(() => ctrlRefreshAccessToken(ctrl), [ctrl]);
+  const resetSession = useCallback(() => ctrlReset(ctrl, false), [ctrl]);
+  const clearSession = useCallback(() => ctrlReset(ctrl, ctrl.config.persistJwt), [ctrl]);
+  const restoreSession = useCallback(
+    (record) => ctrlRestoreSession(ctrl, record),
+    [ctrl]
+  );
+  const hydrateViaRefresh = useCallback(
+    (record, addr) => ctrlHydrateViaRefresh(ctrl, record, addr),
+    [ctrl]
+  );
   useEffect(() => {
     if (accessTokenExpiresAt == null) return;
-    const delay = Math.max(accessTokenExpiresAt - AUTH_REFRESH_SKEW_MS - Date.now(), 0);
+    const delay = Math.max(accessTokenExpiresAt - AUTH_CLOCK_SKEW_MS - Date.now(), 0);
     const timer = setTimeout(() => {
       void refreshAccessToken();
     }, delay);
     return () => clearTimeout(timer);
   }, [accessTokenExpiresAt, refreshAccessToken]);
+  const scopeRef = useRef(void 0);
   useEffect(() => {
-    if (!autoLogin) return;
+    const prev = scopeRef.current;
+    scopeRef.current = { apiUrl, chainId, client };
+    const scopeChanged = !!prev && !(prev.apiUrl === apiUrl && prev.chainId === chainId && prev.client === client);
+    if (scopeChanged) {
+      ctrlReset(ctrl, false);
+    }
+    if (!persistJwt) return;
     if (status === "connecting" || status === "reconnecting") return;
-    if (!isConnected && session) {
-      clearSession();
-      return;
+    if (!isConnected || !address) return;
+    if (ctrl.getState().hydratedAddress === address) return;
+    ctrl.dispatch({ type: "setHydratedAddress", address });
+    const action = resolveHydrationAction(storageAdapter.read(), address);
+    switch (action.type) {
+      case "restore":
+        restoreSession(action.record);
+        ctrl.dispatch({ type: "setAutoAttemptedAddress", address });
+        break;
+      case "refresh":
+        void hydrateViaRefresh(action.record, address);
+        break;
+      case "remove":
+        storageAdapter.remove();
+        break;
     }
-    if (isConnected && address && session && address.toLowerCase() !== session.address.toLowerCase()) {
-      clearSession();
-      return;
+  }, [
+    apiUrl,
+    chainId,
+    client,
+    persistJwt,
+    status,
+    isConnected,
+    address,
+    storageAdapter,
+    ctrl,
+    restoreSession,
+    hydrateViaRefresh
+  ]);
+  useEffect(() => {
+    const action = resolveAutoLoginEffectAction({
+      status,
+      isConnected,
+      address: address ?? null,
+      sessionAddress: session?.address ?? null,
+      autoLogin,
+      isLoading,
+      isHydrating,
+      autoAttemptedAddress: ctrl.getState().autoAttemptedAddress,
+      authenticatingAddress: ctrl.getState().authenticatingAddress
+    });
+    switch (action.type) {
+      case "wait":
+      case "noop":
+        return;
+      case "reset-on-disconnect":
+        resetSession();
+        return;
+      case "clear-on-mismatch":
+        clearSession();
+        return;
+      case "auto-login":
+        void login().catch(() => {
+        });
+        return;
     }
-    if (isConnected && address && !session && !isLoading && autoAttemptedAddress.current !== address) {
-      autoAttemptedAddress.current = address;
-      void login().catch(() => {
-      });
+  }, [
+    autoLogin,
+    status,
+    isConnected,
+    address,
+    session,
+    isLoading,
+    isHydrating,
+    ctrl,
+    login,
+    clearSession,
+    resetSession
+  ]);
+  useEffect(() => {
+    if (!persistJwt || typeof window === "undefined") return;
+    function onStorage(event) {
+      if (event.key !== storageKey) return;
+      const currentAddress = resolveActiveSessionAddress(
+        sessionRef.current?.address,
+        ctrl.getState().currentRecord?.tokens.address,
+        ctrl.getState().authenticatingAddress
+      );
+      const action = resolveStorageEvent(
+        event.newValue,
+        currentAddress,
+        ctrl.getState().currentRecord?.updatedAt ?? null
+      );
+      switch (action.type) {
+        case "logout":
+          resetSession();
+          if (currentAddress)
+            ctrl.dispatch({ type: "setAutoAttemptedAddress", address: currentAddress });
+          break;
+        case "adopt":
+          restoreSession(action.record);
+          break;
+      }
     }
-  }, [autoLogin, status, isConnected, address, session, isLoading, login, clearSession]);
-  const value = useMemo(
+    window.addEventListener("storage", onStorage);
+    return () => window.removeEventListener("storage", onStorage);
+  }, [persistJwt, storageKey, ctrl, restoreSession, resetSession]);
+  useEffect(() => {
+    const prev = prevPersistJwtRef.current;
+    prevPersistJwtRef.current = persistJwt;
+    if (!(prev === true && !persistJwt)) return;
+    ctrl.dispatch({ type: "clearCurrentRecord" });
+    storageAdapter.remove();
+  }, [persistJwt, storageAdapter, ctrl]);
+  useEffect(() => {
+    sessionRef.current = session;
+  }, [session]);
+  return useMemo(
     () => ({
       isAuthenticated: !!session,
-      isLoading,
+      isLoading: isLoading || isHydrating,
+      isHydrating,
       error,
       session,
       accessToken: tokens?.jwt_access_token,
@@ -1051,8 +1598,38 @@ function SiweAuthProvider({
       login,
       logout
     }),
-    [session, isLoading, error, tokens, login, logout]
+    [session, isLoading, isHydrating, error, tokens, login, logout]
+  );
+}
+var SiweAuthContext = createContext(null);
+function SiweAuthProvider({
+  children,
+  client,
+  networkConfig,
+  autoLogin = true,
+  persistJwt = false
+}) {
+  const storageKey = useMemo(
+    () => createSiweAuthStorageKey(networkConfig.apiUrl, networkConfig.chainId),
+    [networkConfig.apiUrl, networkConfig.chainId]
+  );
+  const lifecycleClient = useMemo(
+    () => ({
+      setBearerToken: (t) => client.setBearerToken(t),
+      clearBearerToken: () => client.clearBearerToken(),
+      clearPrivateReadToken: () => client.clearPrivateReadToken()
+    }),
+    [client]
   );
+  const value = useSiweAuthLifecycle({
+    storageKey,
+    apiUrl: networkConfig.apiUrl,
+    chainId: networkConfig.chainId,
+    persistJwt,
+    autoLogin,
+    client: lifecycleClient,
+    api: client
+  });
   return /* @__PURE__ */ jsx(SiweAuthContext.Provider, { value, children });
 }
 function useSiweAuth() {
@@ -1364,6 +1941,7 @@ function PrivanaProvider({
       client,
       networkConfig,
       autoLogin: typeof siweAuth === "object" ? siweAuth.autoLogin : void 0,
+      persistJwt: typeof siweAuth === "object" ? siweAuth.persistJwt : void 0,
       children
     }
   ) : children });
@@ -1434,6 +2012,47 @@ function removeBrowserStorageItem(key) {
     }
   }
 }
+function canUseSharedBrowserStorage() {
+  const storage = storageCandidate("localStorage");
+  if (!storage) return false;
+  const probeKey = "privana:shared-storage-probe";
+  try {
+    storage.setItem(probeKey, "1");
+    storage.removeItem(probeKey);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function setSharedBrowserStorageItem(key, value) {
+  const storage = storageCandidate("localStorage");
+  if (!storage) return false;
+  try {
+    storage.setItem(key, value);
+  } catch {
+    return false;
+  }
+  try {
+    storageCandidate("sessionStorage")?.removeItem(key);
+  } catch {
+  }
+  return true;
+}
+function getSharedBrowserStorageItem(key) {
+  try {
+    return storageCandidate("localStorage")?.getItem(key) ?? null;
+  } catch {
+    return null;
+  }
+}
+function removeSharedBrowserStorageItem(key) {
+  for (const storage of storageCandidates()) {
+    try {
+      storage.removeItem(key);
+    } catch {
+    }
+  }
+}
 
 // src/sdk/hooks/pending-lock.ts
 var DEFAULT_LOCK_DURATION_SECONDS = 259200;
@@ -1449,6 +2068,25 @@ function applyLockBuffer(amount, buffer = DEFAULT_ONRAMP_LOCK_BUFFER) {
 function clampLockAmount(amount, maxAmount) {
   return maxAmount !== void 0 && maxAmount < amount ? maxAmount : amount;
 }
+function requireServiceAddress(serviceAddress) {
+  if (!serviceAddress) {
+    throw new Error("Service address not configured");
+  }
+  return serviceAddress;
+}
+function requireDepositLockOwner(walletAddress, beneficiary) {
+  if (!walletAddress) throw new Error("No wallet connected");
+  if (!beneficiary) throw new Error("No authenticated deposit account");
+  if (walletAddress.toLowerCase() !== beneficiary.toLowerCase()) {
+    throw new Error("Connected wallet does not match the authenticated deposit account");
+  }
+  return beneficiary;
+}
+function walletClientAccountAddress(walletClient) {
+  const account = walletClient.account;
+  if (!account) return void 0;
+  return typeof account === "string" ? account : account.address;
+}
 async function createSignedLockRequest({
   client,
   walletClient,
@@ -1462,6 +2100,10 @@ async function createSignedLockRequest({
   if (amount <= 0n) {
     throw new Error("Lock amount must be positive");
   }
+  const signerAddress = walletClientAccountAddress(walletClient);
+  if (!signerAddress || signerAddress.toLowerCase() !== userAddress.toLowerCase()) {
+    throw new Error("Connected wallet does not match the authenticated deposit account");
+  }
   const expiry = BigInt(Math.floor(Date.now() / 1e3) + lockDuration);
   const { nonce } = await client.getLockNonce(userAddress);
   const signature = await signLockMessage({
@@ -1498,13 +2140,15 @@ var PostDepositLockError = class _PostDepositLockError extends Error {
     this.signedAmount = signedAmount;
     this.creditedAmount = creditedAmount;
     this.name = "PostDepositLockError";
+    this.submissionMayHaveSucceeded = options?.submissionMayHaveSucceeded ?? false;
     Object.setPrototypeOf(this, _PostDepositLockError.prototype);
   }
 };
 async function submitPendingLock({
   client,
   payload,
-  creditedAmount
+  creditedAmount,
+  beforeSubmit
 }) {
   let signedAmount;
   try {
@@ -1528,13 +2172,14 @@ async function submitPendingLock({
   }
   if (creditedAmount !== void 0 && creditedAmount < signedAmount) {
     throw new PostDepositLockError(
-      `Credited amount (${creditedAmount}) is below the signed lock amount (${signedAmount})`,
+      "Credited amount is below the signed lock amount",
       "credited-below-signed",
       signedAmount,
       creditedAmount
     );
   }
   try {
+    beforeSubmit?.();
     return await client.lockFunds(payload);
   } catch (err) {
     throw new PostDepositLockError(
@@ -1579,7 +2224,6 @@ function clearPendingLock(userAddress, correlationId) {
 }
 var INITIAL_AUTH_BACKOFF_MS = 5e3;
 var MAX_AUTH_BACKOFF_MS = 6e4;
-var DEFAULT_SIWE_AUTH_VALIDITY_MS = 24 * 60 * 60 * 1e3;
 var privateReadFailureCache = /* @__PURE__ */ new Map();
 var privateReadInflight = /* @__PURE__ */ new Map();
 async function executeHostedAuthPrivateReadRequest({
@@ -1604,13 +2248,13 @@ async function executeHostedAuthPrivateReadRequest({
   };
   await ensureHostedAuth(false);
   try {
-    return await request();
+    return await request(client);
   } catch (error) {
     if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
       throw error;
     }
     await ensureHostedAuth(true);
-    return request();
+    return request(client);
   }
 }
 function clearPrivateReadScope(scopeKey, client) {
@@ -1618,6 +2262,24 @@ function clearPrivateReadScope(scopeKey, client) {
   privateReadFailureCache.delete(scopeKey);
   client.clearPrivateReadToken();
 }
+async function executeSiwePrivateReadRequest({
+  client,
+  scopeKey,
+  getToken,
+  request
+}) {
+  const run = (token2) => request(client.withPrivateReadToken(token2));
+  const token = await getToken(false);
+  try {
+    return await run(token);
+  } catch (error) {
+    if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
+      throw error;
+    }
+    clearPrivateReadScope(scopeKey, client);
+    return run(await getToken(true));
+  }
+}
 function recordPrivateReadFailure(scopeKey) {
   const previous = privateReadFailureCache.get(scopeKey);
   const backoffMs = Math.min(
@@ -1664,46 +2326,26 @@ function usePrivateReadRequest() {
       if (!walletAddress) {
         throw new Error("No wallet connected");
       }
-      const walletClient = await getWalletClient(wagmiContext);
-      if (!walletClient) {
-        throw new Error("No wallet client available");
-      }
       const apiUrl = networkConfig.apiUrl;
       const scopeKey = createScopeKey(apiUrl, networkConfig.chainId, walletAddress);
       const getToken = async (forceRefresh) => {
         const inflight = privateReadInflight.get(scopeKey);
-        if (inflight) {
-          const token = await inflight;
-          client.setPrivateReadToken(token);
-          return token;
-        }
+        if (inflight) return inflight;
         if (!forceRefresh) {
           const cached = getCachedPrivateReadToken(scopeKey);
-          if (cached) {
-            client.setPrivateReadToken(cached);
-            return cached;
-          }
+          if (cached) return cached;
         }
         ensureFailureBackoff(scopeKey);
         const authPromise = (async () => {
           try {
-            const [{ domain }, nonceResponse] = await Promise.all([
-              client.getSiweDomain(),
-              client.getSiweNonce(walletAddress)
-            ]);
-            const issuedAt = /* @__PURE__ */ new Date();
-            const expirationTime = new Date(issuedAt.getTime() + DEFAULT_SIWE_AUTH_VALIDITY_MS);
-            const uri = typeof window !== "undefined" && window.location.origin ? window.location.origin : apiUrl;
-            const message = createSiweMessage({
+            const walletClient = await getWalletClient(wagmiContext);
+            if (!walletClient) {
+              throw new Error("No wallet client available");
+            }
+            const { message, expirationTime } = await buildSiweLoginMessage(client, {
               address: walletAddress,
               chainId: networkConfig.chainId,
-              domain,
-              expirationTime,
-              issuedAt,
-              nonce: nonceResponse.nonce,
-              statement: buildSiweStatement(networkConfig.chainId),
-              uri,
-              version: "1"
+              apiUrl
             });
             const signature = await walletClient.signMessage({
               account: walletClient.account ?? walletAddress,
@@ -1715,7 +2357,6 @@ function usePrivateReadRequest() {
             });
             setCachedPrivateReadToken(scopeKey, login.siwe_token, expirationTime.getTime());
             privateReadFailureCache.delete(scopeKey);
-            client.setPrivateReadToken(login.siwe_token);
             return login.siwe_token;
           } catch (error) {
             const authError = error instanceof Error ? error : new Error("Failed to authenticate private reads");
@@ -1729,17 +2370,7 @@ function usePrivateReadRequest() {
         privateReadInflight.set(scopeKey, authPromise);
         return authPromise;
       };
-      await getToken(false);
-      try {
-        return await request();
-      } catch (error) {
-        if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
-          throw error;
-        }
-        clearPrivateReadScope(scopeKey, client);
-        await getToken(true);
-        return request();
-      }
+      return executeSiwePrivateReadRequest({ client, scopeKey, getToken, request });
     },
     [
       client,
@@ -1766,7 +2397,6 @@ function usePrivateReadRequest() {
 
 // src/sdk/hooks/use-deposit-verification.ts
 function useDepositVerification(options = {}) {
-  const { client } = usePrivanaContext();
   const queryClient = useQueryClient();
   const { executePrivateRead } = usePrivateReadRequest();
   const pollInterval = options.pollInterval ?? 5e3;
@@ -1775,6 +2405,7 @@ function useDepositVerification(options = {}) {
   const [isVerifying, setIsVerifying] = useState(false);
   const [didTimeout, setDidTimeout] = useState(false);
   const [verificationFailed, setVerificationFailed] = useState(false);
+  const [canCheckAnotherTransfer, setCanCheckAnotherTransfer] = useState(false);
   const [error, setError] = useState(null);
   const [txHash, setTxHash] = useState();
   const generationRef = useRef(0);
@@ -1810,14 +2441,16 @@ function useDepositVerification(options = {}) {
       const isStale = () => generation !== generationRef.current;
       const { hash, chainId, amount, logIndex } = ctx;
       setVerificationFailed(false);
+      setCanCheckAnotherTransfer(false);
       setError(null);
       setDidTimeout(false);
       setIsVerifying(true);
       const pollStartTime = Date.now();
-      const markVerificationFailed = (err) => {
+      const markVerificationFailed = (err, canCheckAnother = false) => {
         setIsVerifying(false);
         setError(err);
         setVerificationFailed(true);
+        setCanCheckAnotherTransfer(canCheckAnother);
         onErrorRef.current?.(err);
       };
       const markVerificationTimedOut = () => {
@@ -1833,7 +2466,7 @@ function useDepositVerification(options = {}) {
           if (isStale()) return;
           try {
             const result = await executePrivateRead(
-              () => client.checkDeposit({
+              (readClient) => readClient.checkDeposit({
                 chain_id: chainId,
                 tx_hash: hash,
                 amount: amount.toString(),
@@ -1868,11 +2501,12 @@ function useDepositVerification(options = {}) {
         }
         if (isStale()) return;
         if (triggerResult.status === "credited") {
+          const creditedAmount = creditedAmountFromResponse(triggerResult, amount);
           setIsVerifying(false);
           verificationContextRef.current = null;
           queryClient.invalidateQueries({ queryKey: ["accounting-balance"] });
           queryClient.invalidateQueries({ queryKey: ["accounting-history"] });
-          onCreditedRef.current?.(hash, triggerResult);
+          onCreditedRef.current?.(hash, triggerResult, creditedAmount);
           return;
         }
         if (triggerResult.status === "error") {
@@ -1892,16 +2526,29 @@ function useDepositVerification(options = {}) {
             return true;
           }
           try {
-            const result = await executePrivateRead(() => client.getDepositStatus(depositId));
+            const result = await executePrivateRead(
+              (readClient) => readClient.getDepositStatus(depositId)
+            );
             if (isStale()) return true;
             consecutiveFailures = 0;
             if (result.status === "credited") {
+              let creditedAmount;
+              try {
+                creditedAmount = creditedAmountFromResponse(result, amount);
+              } catch (err) {
+                stopPolling();
+                markVerificationFailed(
+                  err instanceof Error ? err : new Error("Deposit credited amount is invalid"),
+                  false
+                );
+                return true;
+              }
               stopPolling();
               setIsVerifying(false);
               verificationContextRef.current = null;
               queryClient.invalidateQueries({ queryKey: ["accounting-balance"] });
               queryClient.invalidateQueries({ queryKey: ["accounting-history"] });
-              onCreditedRef.current?.(hash, result);
+              onCreditedRef.current?.(hash, result, creditedAmount);
               return true;
             }
             if (result.status === "error") {
@@ -1933,20 +2580,11 @@ function useDepositVerification(options = {}) {
       } catch (err) {
         if (isStale()) return;
         stopPolling();
-        markVerificationFailed(
-          err instanceof Error ? err : new Error("Deposit verification failed")
-        );
+        const error2 = err instanceof Error ? err : new Error("Deposit verification failed");
+        markVerificationFailed(error2, isDefinitiveCandidateFailure(error2));
       }
     },
-    [
-      client,
-      executePrivateRead,
-      finalityRetryInterval,
-      pollInterval,
-      pollTimeout,
-      queryClient,
-      stopPolling
-    ]
+    [executePrivateRead, finalityRetryInterval, pollInterval, pollTimeout, queryClient, stopPolling]
   );
   const verify = useCallback(
     async (ctx) => {
@@ -1977,12 +2615,14 @@ function useDepositVerification(options = {}) {
     setIsVerifying(false);
     setDidTimeout(false);
     setVerificationFailed(false);
+    setCanCheckAnotherTransfer(false);
     setError(null);
   }, [stopPolling]);
   return {
     isVerifying,
     didTimeout,
     verificationFailed,
+    canCheckAnotherTransfer,
     error,
     txHash,
     verify,
@@ -1990,6 +2630,19 @@ function useDepositVerification(options = {}) {
     reset
   };
 }
+function creditedAmountFromResponse(response, requestedAmount) {
+  if (response.amount == null) return requestedAmount;
+  try {
+    const amount = BigInt(response.amount);
+    if (amount <= 0n) throw new Error("non-positive amount");
+    return amount;
+  } catch (err) {
+    throw new Error("Deposit API returned an invalid credited amount", { cause: err });
+  }
+}
+function isDefinitiveCandidateFailure(error) {
+  return error instanceof AccountingApiError && error.statusCode === 400;
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -2431,7 +3084,9 @@ function useFiatOnRamp(options) {
   const { address } = useAccount();
   const { data: walletClient } = useWalletClient();
   const { client, enabledTokens, networkConfig, serviceAddress } = usePrivanaContext();
-  const { executePrivateRead, privateReadReady } = usePrivateReadRequest();
+  const { executePrivateRead, privateReadAddress, privateReadReady } = usePrivateReadRequest();
+  const privateReadAddressRef = useRef(privateReadAddress);
+  privateReadAddressRef.current = privateReadAddress;
   const { ensureCorrectChain } = useEnsureCorrectChain();
   const wagmiConfig = useConfig();
   const queryClient = useQueryClient();
@@ -2453,7 +3108,6 @@ function useFiatOnRamp(options) {
   const activeIntentIdRef = useRef(null);
   const activeVerificationRecordRef = useRef(null);
   const activeVerificationKeyRef = useRef(null);
-  const activeVerificationAmountRef = useRef(null);
   const lockOwnerRef = useRef(null);
   const triggeredVerificationKeysRef = useRef(/* @__PURE__ */ new Set());
   const activeVerificationDoneRef = useRef(null);
@@ -2502,7 +3156,7 @@ function useFiatOnRamp(options) {
     void (async () => {
       try {
         emitDebug("deposit-address:request");
-        const resp = await executePrivateRead(() => client.getDepositAddress());
+        const resp = await executePrivateRead((readClient) => readClient.getDepositAddress());
         if (cancelled) return;
         setDepositAddress(resp.deposit_address);
         const token = enabledTokens.find((t) => t.id.toLowerCase() === tokenId.toLowerCase());
@@ -2532,7 +3186,9 @@ function useFiatOnRamp(options) {
     }
     try {
       emitDebug("pending:request");
-      const { pending: rows } = await executePrivateRead(() => client.getPendingOnRamps());
+      const { pending: rows } = await executePrivateRead(
+        (readClient) => readClient.getPendingOnRamps()
+      );
       setPending(rows);
       emitDebug("pending:success", {
         count: rows.length,
@@ -2542,7 +3198,7 @@ function useFiatOnRamp(options) {
       emitDebug("pending:error", errorPayload(err));
       console.warn("Failed to load pending on-ramps:", err);
     }
-  }, [client, emitDebug, executePrivateRead, privateReadReady]);
+  }, [emitDebug, executePrivateRead, privateReadReady]);
   useEffect(() => {
     refreshPending();
   }, [refreshPending]);
@@ -2552,13 +3208,12 @@ function useFiatOnRamp(options) {
     if (key) triggeredVerificationKeysRef.current.delete(key);
     activeVerificationKeyRef.current = null;
     activeVerificationRecordRef.current = null;
-    activeVerificationAmountRef.current = null;
     setActiveVerificationId(null);
     activeVerificationDoneRef.current?.();
     activeVerificationDoneRef.current = null;
   }, []);
   const submitPendingLockAfterCredit = useCallback(
-    async (transactionId, userAddress) => {
+    async (transactionId, userAddress, creditedAmount) => {
       const signedLock = loadPendingLock(userAddress, transactionId);
       if (!signedLock) {
         clearPendingLock(userAddress, transactionId);
@@ -2571,7 +3226,6 @@ function useFiatOnRamp(options) {
         (onLockFailedRef.current ?? onErrorRef.current)?.(error2);
         return;
       }
-      const creditedAmount = activeVerificationAmountRef.current ?? void 0;
       try {
         const result = await submitPendingLock({ client, payload: signedLock, creditedAmount });
         queryClient.invalidateQueries({ queryKey: ["accounting-balance"] });
@@ -2617,7 +3271,7 @@ function useFiatOnRamp(options) {
       });
       setFinalityProgress((prev) => ({ ...prev, [record.transaction_id]: message }));
     },
-    onCredited: (depositTxHash) => {
+    onCredited: (depositTxHash, _response, creditedAmount) => {
       const record = activeVerificationRecordRef.current;
       const verificationKey = record ? getOnRampVerificationKey(record) : null;
       emitDebug("verification:credited", {
@@ -2634,9 +3288,9 @@ function useFiatOnRamp(options) {
           delete next[record.transaction_id];
           return next;
         });
-        const lockOwner = lockOwnerRef.current ?? address;
+        const lockOwner = lockOwnerRef.current ?? privateReadAddress;
         if (lockOwner) {
-          void submitPendingLockAfterCredit(record.transaction_id, lockOwner);
+          void submitPendingLockAfterCredit(record.transaction_id, lockOwner, creditedAmount);
         } else if (postDepositLock) {
           emitDebug("lock:owner-unavailable", { transactionId: record.transaction_id });
           (onLockFailedRef.current ?? onErrorRef.current)?.(
@@ -2655,7 +3309,7 @@ function useFiatOnRamp(options) {
               depositTxHash
             });
             const updated = await executePrivateRead(
-              () => client.updateOnRamp(record.transaction_id, {
+              (readClient) => readClient.updateOnRamp(record.transaction_id, {
                 deposit_tx_hash: depositTxHash
               })
             );
@@ -2716,8 +3370,10 @@ function useFiatOnRamp(options) {
         if (!token) throw new Error(`Unknown token: ${tokenId}`);
         if (!depositAddress) throw new Error("Privana deposit address is not ready");
         let lockAmount;
+        let lockOwner;
         if (postDepositLock) {
           if (!address || !walletClient) throw new Error("Wallet not connected");
+          lockOwner = requireDepositLockOwner(address, privateReadAddress);
           if (!quoteCurrencyAmount) {
             throw new Error(
               "postDepositLock requires quoteCurrencyAmount to derive the lock amount"
@@ -2746,7 +3402,7 @@ function useFiatOnRamp(options) {
           depositAddress
         });
         const record = await executePrivateRead(
-          () => client.createOnRampIntent({
+          (readClient) => readClient.createOnRampIntent({
             wallet_address: depositAddress,
             token_id: tokenId,
             chain_id: token.chainId,
@@ -2755,22 +3411,25 @@ function useFiatOnRamp(options) {
             base_currency_amount: baseCurrencyAmount
           })
         );
-        if (postDepositLock && address && walletClient && lockAmount !== void 0) {
+        if (postDepositLock && lockOwner && lockAmount !== void 0) {
           const signingWalletClient = await getWalletClient3(wagmiConfig, {
             chainId: networkConfig.chainId
           });
           const signedLock = await createSignedLockRequest({
             client,
             walletClient: signingWalletClient,
-            userAddress: address,
+            userAddress: lockOwner,
             networkConfig,
             serviceAddress: requireServiceAddress(postDepositLock.serviceAddress ?? serviceAddress),
             tokenId,
             amount: lockAmount,
             lockDuration: postDepositLock.lockDuration
           });
-          savePendingLock(address, record.transaction_id, signedLock);
-          lockOwnerRef.current = address;
+          if (privateReadAddressRef.current?.toLowerCase() !== lockOwner.toLowerCase()) {
+            throw new Error("Authenticated deposit account changed while signing");
+          }
+          savePendingLock(lockOwner, record.transaction_id, signedLock);
+          lockOwnerRef.current = lockOwner;
           emitDebug("intent:lock-signed", {
             transactionId: record.transaction_id,
             amount: signedLock.amount,
@@ -2802,6 +3461,7 @@ function useFiatOnRamp(options) {
       executePrivateRead,
       networkConfig,
       postDepositLock,
+      privateReadAddress,
       serviceAddress,
       tokenId,
       wagmiConfig,
@@ -2827,7 +3487,7 @@ function useFiatOnRamp(options) {
           chainId: token.chainId
         });
         const record = await executePrivateRead(
-          () => client.updateOnRamp(transactionId, {
+          (readClient) => readClient.updateOnRamp(transactionId, {
             token_id: tokenId,
             chain_id: token.chainId,
             moonpay_transaction_id: transactionId === moonpayTransactionId ? void 0 : moonpayTransactionId
@@ -2847,7 +3507,7 @@ function useFiatOnRamp(options) {
         console.warn("Failed to register on-ramp token mapping:", err);
       }
     },
-    [client, emitDebug, enabledTokens, executePrivateRead, tokenId]
+    [emitDebug, enabledTokens, executePrivateRead, tokenId]
   );
   const handleTransactionCreated = useCallback(
     async (props) => {
@@ -2862,7 +3522,9 @@ function useFiatOnRamp(options) {
       setError(null);
       try {
         emitDebug("moonpay:onUrlSignatureRequested", summariseMoonPayUrl(url));
-        const { signature } = await executePrivateRead(() => client.signOnRampUrl({ url }));
+        const { signature } = await executePrivateRead(
+          (readClient) => readClient.signOnRampUrl({ url })
+        );
         setStatus("awaiting-purchase");
         emitDebug("sign-url:success", {
           signatureLength: signature.length
@@ -2877,7 +3539,7 @@ function useFiatOnRamp(options) {
         throw err;
       }
     },
-    [client, emitDebug, executePrivateRead]
+    [emitDebug, executePrivateRead]
   );
   const waitForOnChainHash = useCallback(
     async (transactionId) => {
@@ -2889,7 +3551,9 @@ function useFiatOnRamp(options) {
       });
       while (Date.now() - startTime < deliveryTimeout) {
         try {
-          const { pending: rows } = await executePrivateRead(() => client.getPendingOnRamps());
+          const { pending: rows } = await executePrivateRead(
+            (readClient) => readClient.getPendingOnRamps()
+          );
           setPending(rows);
           const record = rows.find((r) => matchesOnRampTransaction(r, transactionId));
           emitDebug("delivery-poll:tick", {
@@ -2916,7 +3580,7 @@ function useFiatOnRamp(options) {
       emitDebug("delivery-poll:timeout", { transactionId });
       return null;
     },
-    [client, deliveryPollInterval, deliveryTimeout, emitDebug, executePrivateRead]
+    [deliveryPollInterval, deliveryTimeout, emitDebug, executePrivateRead]
   );
   const triggerVerification = useCallback(
     async (record) => {
@@ -2984,7 +3648,6 @@ function useFiatOnRamp(options) {
             `Delivered amount (${record.quote_currency_amount}) is below the minimum deposit.`
           );
         }
-        activeVerificationAmountRef.current = amount;
         if (activeIntentIdRef.current === record.transaction_id) {
           setStatus("verifying");
         }
@@ -3003,7 +3666,6 @@ function useFiatOnRamp(options) {
         if (activeVerificationKeyRef.current === verificationKey) {
           activeVerificationKeyRef.current = null;
           activeVerificationRecordRef.current = null;
-          activeVerificationAmountRef.current = null;
           setActiveVerificationId(null);
         }
         throw err;
@@ -3249,12 +3911,6 @@ function matchesOnRampTransaction(record, transactionId) {
 function getOnRampVerificationKey(record) {
   return record.on_chain_tx_hash ?? record.transaction_id;
 }
-function requireServiceAddress(serviceAddress) {
-  if (!serviceAddress) {
-    throw new Error("Service address not configured");
-  }
-  return serviceAddress;
-}
 function summariseMoonPayEventProps(props) {
   return {
     id: props.id,
@@ -3688,7 +4344,7 @@ function FiatOnRampForm({
     ] }),
     lockPending && /* @__PURE__ */ jsxs("p", { className: "text-muted-foreground flex items-center gap-2 text-sm", children: [
       /* @__PURE__ */ jsx(Loader2, { className: "size-4 animate-spin", "aria-hidden": true }),
-      "Purchase credited \u2014 locking your funds\u2026"
+      "Purchase credited. Locking your funds\u2026"
     ] }),
     autoStart ? !visible && isPrePurchase && /* @__PURE__ */ jsx(Skeleton, { className: "h-[656px] w-full rounded-md" }) : isInitializing ? /* @__PURE__ */ jsx(Skeleton, { className: "h-9 w-full rounded-md" }) : /* @__PURE__ */ jsxs(Button, { type: "button", onClick: handleOpen, disabled: !canBuy, children: [
       (isBusy || visible) && /* @__PURE__ */ jsx(Loader2, { className: "animate-spin", "aria-hidden": true }),
@@ -3717,6 +4373,6 @@ function parseFinalityProgress(message) {
   return match ? `${match[1]} confirmations` : null;
 }
 
-export { AccountingApiError, Button, DEFAULT_LOCK_DURATION_SECONDS, DEFAULT_ONRAMP_LOCK_BUFFER, FiatOnRampForm, HOSTED_AUTH_CLOCK_SKEW_MS, HostedAuthError, HostedAuthRequiredError, HostedAuthStateMismatchError, HttpClient, LOCK_TYPES, MODIFY_LOCK_TYPES, NETWORK_CONFIG, NetworkError, PostDepositLockError, PrivanaClient, PrivanaProvider, SUPPORTED_CHAINS, SiweAuthProvider, Skeleton, TRANSFER_LOCKED_TYPES, TRANSFER_TYPES, ValidationError, WITHDRAW_FROM_LOCK_TYPES, WITHDRAW_TYPES, applyLockBuffer, applyRefreshResponse, buildHostedAuthSession, buildSiweStatement, buttonVariants, canUseBrowserStorage, clampLockAmount, clearHostedAuthPendingTransaction, clearPendingLock, cn, createDomain, createHostedAuthPendingStorageKey, createHostedAuthState, createHostedAuthStorageKey, createLockExpiry, createPkceChallenge, createPkceVerifier, createSignedLockRequest, formatCountdown, formatTimeRemaining, formatTokenAmount, getAccountingContract, getApiUrl, getBlockNumber, getBrowserStorageItem, getChainById, getChainId, getExplorerAddressUrl, getExplorerLabel, getTransactionReceipt, getWalletClient3 as getWalletClient, isHostedAuthRefreshActive, isHostedAuthSessionActive, isSignedLockUsable, loadPendingLock, normalizeAddress, normalizeHex, parseHostedAuthCallback, parseTokenAmount, persistHostedAuthPendingTransaction, readHostedAuthPendingTransaction, readStoredHostedAuthSession, removeBrowserStorageItem, savePendingLock, setBrowserStorageItem, shortenAddress, signLockMessage, signModifyLockMessage, signTransferLockedMessage, signTransferMessage, signWithdrawFromLockMessage, signWithdrawMessage, stripHostedAuthCallbackParams, submitPendingLock, syncHostedAuthSessionToClient, useDepositVerification, useEnsureCorrectChain, useFiatOnRamp, usePrivanaContext, usePrivateReadRequest, useSafeAccount, useSafePrivanaContext, useSiweAuth, waitForTransactionReceipt };
-//# sourceMappingURL=chunk-ZVUMV4NR.js.map
-//# sourceMappingURL=chunk-ZVUMV4NR.js.map
+export { AccountingApiError, Button, DEFAULT_LOCK_DURATION_SECONDS, DEFAULT_ONRAMP_LOCK_BUFFER, FiatOnRampForm, HOSTED_AUTH_CLOCK_SKEW_MS, HostedAuthError, HostedAuthRequiredError, HostedAuthStateMismatchError, HttpClient, LOCK_TYPES, MODIFY_LOCK_TYPES, NETWORK_CONFIG, NetworkError, PostDepositLockError, PrivanaClient, PrivanaProvider, SUPPORTED_CHAINS, SiweAuthProvider, Skeleton, TRANSFER_LOCKED_TYPES, TRANSFER_TYPES, ValidationError, WITHDRAW_FROM_LOCK_TYPES, WITHDRAW_TYPES, applyLockBuffer, applyRefreshResponse, buildHostedAuthSession, buildSiweStatement, buttonVariants, canUseBrowserStorage, canUseSharedBrowserStorage, clampLockAmount, clearHostedAuthPendingTransaction, clearPendingLock, cn, createDomain, createHostedAuthPendingStorageKey, createHostedAuthState, createHostedAuthStorageKey, createLockExpiry, createPkceChallenge, createPkceVerifier, createSignedLockRequest, formatCountdown, formatTimeRemaining, formatTokenAmount, getAccountingContract, getApiUrl, getBlockNumber, getBrowserStorageItem, getChainById, getChainId, getExplorerAddressUrl, getExplorerLabel, getSharedBrowserStorageItem, getTransactionReceipt, getWalletClient3 as getWalletClient, isHostedAuthRefreshActive, isHostedAuthSessionActive, isSignedLockUsable, loadPendingLock, normalizeAddress, normalizeHex, parseHostedAuthCallback, parseTokenAmount, persistHostedAuthPendingTransaction, readHostedAuthPendingTransaction, readStoredHostedAuthSession, removeBrowserStorageItem, removeSharedBrowserStorageItem, requireDepositLockOwner, requireServiceAddress, savePendingLock, setBrowserStorageItem, setSharedBrowserStorageItem, shortenAddress, signLockMessage, signModifyLockMessage, signTransferLockedMessage, signTransferMessage, signWithdrawFromLockMessage, signWithdrawMessage, stripHostedAuthCallbackParams, submitPendingLock, syncHostedAuthSessionToClient, useDepositVerification, useEnsureCorrectChain, useFiatOnRamp, usePrivanaContext, usePrivateReadRequest, useSafeAccount, useSafePrivanaContext, useSiweAuth, waitForTransactionReceipt };
+//# sourceMappingURL=chunk-DZURIIRE.js.map
+//# sourceMappingURL=chunk-DZURIIRE.js.map