@openfort/react 1.0.6 → 1.0.7

package/build/components/Common/WalletRecoveryIcon/index.d.ts

@@ -1,4 +1,5 @@
 import { RecoveryMethod } from '@openfort/openfort-js';
+export declare const RECOVERY_METHOD_LABEL: Record<RecoveryMethod, string>;
 export declare const WalletRecoveryIcon: ({ recovery }: {
     recovery: RecoveryMethod | undefined;
 }) => import("react/jsx-runtime").JSX.Element | null;

package/build/components/Common/WalletRecoveryIcon/index.js

@@ -2,6 +2,11 @@ import { jsx } from 'react/jsx-runtime';
 import { RecoveryMethod } from '@openfort/openfort-js';
 import { LockIcon, FingerPrintIcon, KeyIcon } from '../../../assets/icons.js';
 
+const RECOVERY_METHOD_LABEL = {
+    [RecoveryMethod.AUTOMATIC]: 'Automatic',
+    [RecoveryMethod.PASSWORD]: 'Password',
+    [RecoveryMethod.PASSKEY]: 'Passkey',
+};
 const WalletRecoveryIcon = ({ recovery }) => {
     switch (recovery) {
         case RecoveryMethod.PASSWORD:
@@ -15,5 +20,5 @@ const WalletRecoveryIcon = ({ recovery }) => {
     }
 };
 
-export { WalletRecoveryIcon };
+export { RECOVERY_METHOD_LABEL, WalletRecoveryIcon };
 //# sourceMappingURL=index.js.map

package/build/components/Common/WalletRecoveryIcon/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/components/ConnectModal/ConnectWithInjector/index.js

@@ -118,7 +118,7 @@ const ConnectWithInjector = ({ forceState }) => {
             connectorType: (_b = walletItem.connector) === null || _b === void 0 ? void 0 : _b.type,
             walletClientType: (_c = walletItem.connector) === null || _c === void 0 ? void 0 : _c.id,
             onError: (error, _errorType) => {
-                logger.error(error);
+                logger.error('[ConnectWithInjector] SIWE failed:', error);
                 disconnect();
                 setStatus(states.FAILED);
             },
@@ -211,14 +211,14 @@ const ConnectWithInjector = ({ forceState }) => {
             }
             if (!wallet) {
                 setStatus(states.FAILED);
-                logger.error('No wallet found');
+                logger.error('[ConnectWithInjector] No wallet found after connect');
                 return;
             }
-            logger.log('Connect type is:', props.connectType);
+            logger.log('[ConnectWithInjector] Connect type is:', props.connectType);
             await handleConnectSettled(wallet, connectResult);
         }
         catch (err) {
-            logger.error(err);
+            logger.error('[ConnectWithInjector] Connection error', err instanceof Error ? err.message : err);
             handleConnectError(err && typeof err === 'object' && 'code' in err
                 ? err
                 : {

package/build/components/ConnectModal/ConnectWithMobile.js

@@ -1,5 +1,6 @@
 import { jsxs, jsx } from 'react/jsx-runtime';
 import { useState, useEffect } from 'react';
+import { embeddedWalletId } from '../../constants/openfort.js';
 import { useEthereumBridge } from '../../ethereum/OpenfortEthereumBridgeContext.js';
 import styled from '../../styles/styled/index.js';
 import { isAndroid } from '../../utils/index.js';
@@ -25,7 +26,7 @@ const DownloadFooter = styled.div `
   color: var(--ck-body-color-muted);
 `;
 const ConnectWithMobile = () => {
-    var _a, _b, _c, _d, _e;
+    var _a, _b, _c, _d, _e, _f, _g;
     const { connector, setRoute } = useOpenfort();
     const walletId = Object.keys(walletConfigs).find(
     // where id is comma separated list
@@ -35,8 +36,9 @@ const ConnectWithMobile = () => {
         .indexOf(connector.id) !== -1);
     const wallet = useExternalConnector(connector.id) || (walletId && walletConfigs[walletId]) || {};
     const bridge = useEthereumBridge();
-    const isConnected = (_b = (_a = bridge === null || bridge === void 0 ? void 0 : bridge.account) === null || _a === void 0 ? void 0 : _a.isConnected) !== null && _b !== void 0 ? _b : false;
-    const [status, setStatus] = useState(isConnected ? states.INIT : states.CONNECTING);
+    // Only consider external wallets as "connected" — ignore the embedded wallet connector
+    const isExternalConnected = (_d = (((_a = bridge === null || bridge === void 0 ? void 0 : bridge.account) === null || _a === void 0 ? void 0 : _a.isConnected) && ((_c = (_b = bridge === null || bridge === void 0 ? void 0 : bridge.account) === null || _b === void 0 ? void 0 : _b.connector) === null || _c === void 0 ? void 0 : _c.id) !== embeddedWalletId)) !== null && _d !== void 0 ? _d : false;
+    const [status, setStatus] = useState(isExternalConnected ? states.CONNECTING : states.INIT);
     const [description, setDescription] = useState(undefined);
     const [hasReturned, setHasReturned] = useState(false);
     const { connectWithSiwe } = useConnectWithSiwe();
@@ -59,7 +61,7 @@ const ConnectWithMobile = () => {
     useEffect(() => {
         if (hasReturned) {
             setHasReturned(false);
-            if (isConnected) {
+            if (isExternalConnected) {
                 setStatus(states.CONNECTING);
             }
             else {
@@ -67,7 +69,7 @@ const ConnectWithMobile = () => {
                 setDescription('Connection failed or cancelled');
             }
         }
-    }, [hasReturned, isConnected]);
+    }, [hasReturned, isExternalConnected]);
     useEffect(() => {
         switch (status) {
             case states.INIT:
@@ -86,13 +88,13 @@ const ConnectWithMobile = () => {
         }
     }, [status]);
     return (jsxs(PageContent, { children: [jsx(Loader, { header: `Connecting with ${connector.id.split(',')[0]}`, icon: wallet === null || wallet === void 0 ? void 0 : wallet.icon, isError: status === states.ERROR, description: description, onRetry: () => {
-                    setStatus(isConnected ? states.CONNECTING : states.INIT);
+                    setStatus(isExternalConnected ? states.CONNECTING : states.INIT);
                     setDescription('');
-                } }), isConnected ? (jsx(Button, { onClick: () => {
+                } }), isExternalConnected ? (jsx(Button, { onClick: () => {
                     openApp();
                 }, children: "Sign in App" })) : (jsx(Button, { onClick: () => {
                     openApp();
-                }, children: "Sign in App" })), jsx(DownloadFooter, { children: jsxs(FitText, { children: ["Don't have ", (_c = wallet.name) !== null && _c !== void 0 ? _c : connector.id.split(',')[0], " installed?", ' ', jsx("a", { style: { marginLeft: 5 }, href: isAndroid() ? (_d = wallet === null || wallet === void 0 ? void 0 : wallet.downloadUrls) === null || _d === void 0 ? void 0 : _d.android : (_e = wallet === null || wallet === void 0 ? void 0 : wallet.downloadUrls) === null || _e === void 0 ? void 0 : _e.ios, target: "_blank", rel: "noreferrer", children: "GET" })] }) })] }));
+                }, children: "Sign in App" })), jsx(DownloadFooter, { children: jsxs(FitText, { children: ["Don't have ", (_e = wallet.name) !== null && _e !== void 0 ? _e : connector.id.split(',')[0], " installed?", ' ', jsx("a", { style: { marginLeft: 5 }, href: isAndroid() ? (_f = wallet === null || wallet === void 0 ? void 0 : wallet.downloadUrls) === null || _f === void 0 ? void 0 : _f.android : (_g = wallet === null || wallet === void 0 ? void 0 : wallet.downloadUrls) === null || _g === void 0 ? void 0 : _g.ios, target: "_blank", rel: "noreferrer", children: "GET" })] }) })] }));
 };
 
 export { ConnectWithMobile as default };

package/build/components/ConnectModal/ConnectWithMobile.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConnectWithMobile.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"ConnectWithMobile.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/components/ConnectModal/ConnectWithOAuth.js

@@ -3,6 +3,7 @@ import { useState, useEffect } from 'react';
 import { providersLogos } from '../../assets/logos.js';
 import { useOpenfortCore } from '../../openfort/useOpenfort.js';
 import { logger } from '../../utils/logger.js';
+import { parseCallbackUrl, suppressReferrer } from '../../utils/urlSecurity.js';
 import Loader from '../Common/Loading/index.js';
 import { routes } from '../Openfort/types.js';
 import { useOpenfort } from '../Openfort/useOpenfort.js';
@@ -27,7 +28,7 @@ const ConnectWithOAuth = () => {
                 return;
             if (connector.type !== 'oauth')
                 throw new Error('Invalid connector type');
-            const url = new URL(win.location.href.replace('?access_token=', '&access_token=')); // handle both ? and & cases
+            const url = parseCallbackUrl(win.location.href);
             const hasProvider = !!url.searchParams.get('openfortAuthProviderUI');
             const provider = connector.id;
             switch (status) {
@@ -38,6 +39,8 @@ const ConnectWithOAuth = () => {
                         setTimeout(() => setStatus(states.REDIRECT), 150); // UX: wait a bit before redirecting
                     break;
                 case states.CONNECTING: {
+                    // Suppress Referer before any async work to prevent token leakage
+                    const restoreReferrer = suppressReferrer();
                     const userId = url.searchParams.get('user_id');
                     const token = url.searchParams.get('access_token');
                     const error = url.searchParams.get('error');
@@ -45,6 +48,7 @@ const ConnectWithOAuth = () => {
                         url.searchParams.delete(key);
                     });
                     win.history.replaceState({}, doc.title, url.toString());
+                    restoreReferrer();
                     if (!userId || !token || error) {
                         logger.error(`Missing user id or access token: userId=${userId}, accessToken=${token ? `${token.substring(0, 10)}...` : token}`);
                         setStatus(states.ERROR);

package/build/components/ConnectModal/ConnectWithOAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConnectWithOAuth.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"ConnectWithOAuth.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/components/Openfort/OpenfortProvider.js

@@ -142,6 +142,10 @@ const OpenfortProvider = ({ children, uiConfig, onConnect, onDisconnect, debugMo
     const setOpen = useCallback((value) => {
         if (value) {
             setRouteHistory([]);
+            // Reset route and connector to avoid stale state from a previous modal session
+            // (e.g. a failed SIWE attempt leaving route on CONNECT with a stale connector)
+            setRoute({ route: routes.LOADING });
+            setConnector(initialConnector);
         }
         setOpenWithoutHistory(value);
     }, []);

package/build/components/Openfort/OpenfortProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"OpenfortProvider.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"OpenfortProvider.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/components/Pages/Connectors/index.js

@@ -1,64 +1,10 @@
 import { jsx } from 'react/jsx-runtime';
-import { useState, useEffect } from 'react';
-import { useEthereumBridge } from '../../../ethereum/OpenfortEthereumBridgeContext.js';
-import useIsMobile from '../../../hooks/useIsMobile.js';
-import { useWalletConnectModal } from '../../../hooks/useWalletConnectModal.js';
 import { logger } from '../../../utils/logger.js';
 import ConnectorList from '../../Common/ConnectorList/index.js';
-import Loader from '../../Common/Loading/index.js';
-import { routes } from '../../Openfort/types.js';
-import { useOpenfort } from '../../Openfort/useOpenfort.js';
 import { PageContent } from '../../PageContent/index.js';
 
 let hasWarnedConnectors = false;
-const ConnectWithMobile = () => {
-    var _a, _b;
-    const { open: openWalletConnectModal } = useWalletConnectModal();
-    const [error, setError] = useState(undefined);
-    const bridge = useEthereumBridge();
-    const connector = (_a = bridge === null || bridge === void 0 ? void 0 : bridge.account) === null || _a === void 0 ? void 0 : _a.connector;
-    const address = (_b = bridge === null || bridge === void 0 ? void 0 : bridge.account) === null || _b === void 0 ? void 0 : _b.address;
-    const { setRoute, setConnector } = useOpenfort();
-    const openWCModal = async () => {
-        setError(undefined);
-        const { error } = await openWalletConnectModal();
-        if (error) {
-            setError(error);
-        }
-    };
-    useEffect(() => {
-        openWCModal();
-    }, []);
-    useEffect(() => {
-        if (connector && address) {
-            const walletConnectDeeplinkChoice = localStorage.getItem('WALLETCONNECT_DEEPLINK_CHOICE');
-            if (walletConnectDeeplinkChoice) {
-                try {
-                    const parsedChoice = JSON.parse(walletConnectDeeplinkChoice);
-                    if (parsedChoice &&
-                        typeof parsedChoice === 'object' &&
-                        'name' in parsedChoice &&
-                        typeof parsedChoice.name === 'string') {
-                        setConnector({ id: parsedChoice.name });
-                    }
-                    else {
-                        setConnector({ id: connector.id });
-                    }
-                }
-                catch {
-                    setConnector({ id: connector.id });
-                }
-            }
-            else {
-                setConnector({ id: connector.id });
-            }
-            setRoute(routes.CONNECT_WITH_MOBILE);
-        }
-    }, [address, connector]);
-    return (jsx(Loader, { header: error ? 'Error connecting wallet.' : `Connecting...`, isError: !!error, description: error, onRetry: () => openWCModal() }));
-};
 const Connectors = ({ logoutOnBack }) => {
-    const isMobile = useIsMobile();
     // Runtime deprecation warning
     if (process.env.NODE_ENV === 'development' && !hasWarnedConnectors) {
         logger.warn('[@openfort/react] <Connectors /> is deprecated and will be moved to @openfort/react/wagmi in v3.0.\n' +
@@ -66,7 +12,7 @@ const Connectors = ({ logoutOnBack }) => {
             'See: https://openfort.io/docs/migration/external-wallets');
         hasWarnedConnectors = true;
     }
-    return (jsx(PageContent, { logoutOnBack: logoutOnBack, width: 312, children: isMobile ? jsx(ConnectWithMobile, {}) : jsx(ConnectorList, {}) }));
+    return (jsx(PageContent, { logoutOnBack: logoutOnBack, width: 312, children: jsx(ConnectorList, {}) }));
 };
 
 export { Connectors as default };

package/build/components/Pages/Connectors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;"}

package/build/components/Pages/LinkedProvider/index.js

@@ -1,5 +1,5 @@
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
-import { useMemo } from 'react';
+import { useRef, useMemo } from 'react';
 import { useUser } from '../../../hooks/openfort/useUser.js';
 import { useResolvedIdentity } from '../../../hooks/useResolvedIdentity.js';
 import { useOpenfortCore } from '../../../openfort/useOpenfort.js';
@@ -65,11 +65,14 @@ const OAuthContent = ({ account }) => {
 };
 const LinkedProvider = () => {
     const { route } = useOpenfort();
+    const lastAccountRef = useRef(null);
     const account = useMemo(() => {
         if (route.route === 'linkedProvider') {
+            lastAccountRef.current = route.account;
             return route.account;
         }
-        throw new Error('No account found in route');
+        // During exit animations or route transitions, return the last known account
+        return lastAccountRef.current;
     }, [route]);
     const getProviderDetails = (account) => {
         switch (account.provider) {
@@ -83,6 +86,8 @@ const LinkedProvider = () => {
                 return (jsxs("div", { style: { marginTop: '16px', display: 'flex', alignItems: 'center', gap: '8px', flexDirection: 'column' }, children: [jsxs("div", { children: ["Authentication method: ", jsx("b", { children: getProviderName(account.provider) })] }), jsx(FitText, { children: jsx(ProviderHeader, { account: account }) })] }));
         }
     };
+    if (!account)
+        return null;
     return (jsxs(PageContent, { children: [jsx(ModalHeading, { children: getProviderName(account.provider) }), jsxs(ModalContent, { style: { paddingBottom: 0 }, children: [jsx(ProviderIconContainer, { children: jsx(ProviderIconWrapper, { children: jsx(ProviderIconInner, { children: jsx(ProviderIcon, { account: account }) }) }) }), jsx(ModalBody, { children: getProviderDetails(account) })] })] }));
 };
 

package/build/components/Pages/LinkedProvider/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/components/Pages/LoadWallets/index.js

@@ -1,5 +1,5 @@
 import { jsx } from 'react/jsx-runtime';
-import { ChainTypeEnum } from '@openfort/openfort-js';
+import { ChainTypeEnum, RecoveryMethod } from '@openfort/openfort-js';
 import { useState, useEffect } from 'react';
 import { useEthereumEmbeddedWallet } from '../../../ethereum/hooks/useEthereumEmbeddedWallet.js';
 import { toSolanaUserWallet } from '../../../hooks/openfort/walletTypes.js';
@@ -7,20 +7,24 @@ import { useOpenfortCore } from '../../../openfort/useOpenfort.js';
 import { useSolanaEmbeddedWallet } from '../../../solana/hooks/useSolanaEmbeddedWallet.js';
 import { logger } from '../../../utils/logger.js';
 import Loader from '../../Common/Loading/index.js';
-import { recoverRoute, createRoute } from '../../Openfort/routeHelpers.js';
+import { createRoute, recoverRoute } from '../../Openfort/routeHelpers.js';
 import { routes } from '../../Openfort/types.js';
 import { useOpenfort } from '../../Openfort/useOpenfort.js';
 import { PageContent } from '../../PageContent/index.js';
 
-const handleSingleWalletRegistry = {
-    [ChainTypeEnum.SVM]: (w, chainType, setRoute) => {
-        const walletForRoute = toSolanaUserWallet(w);
-        setRoute(recoverRoute(chainType, walletForRoute));
-    },
-    [ChainTypeEnum.EVM]: (w, chainType, setRoute) => {
-        setRoute(recoverRoute(chainType, w));
-    },
-};
+/** Pick the best wallet to auto-recover: automatic > passkey > first available */
+function pickBestWallet(wallets) {
+    var _a, _b;
+    return ((_b = (_a = wallets.find((w) => w.recoveryMethod === RecoveryMethod.AUTOMATIC)) !== null && _a !== void 0 ? _a : wallets.find((w) => w.recoveryMethod === RecoveryMethod.PASSKEY)) !== null && _b !== void 0 ? _b : wallets[0]);
+}
+function routeToRecover(wallet, chainType, setRoute) {
+    if (chainType === ChainTypeEnum.SVM) {
+        setRoute(recoverRoute(chainType, toSolanaUserWallet(wallet)));
+    }
+    else {
+        setRoute(recoverRoute(chainType, wallet));
+    }
+}
 const errorForChainRegistry = {
     [ChainTypeEnum.SVM]: () => ({ isError: false, message: undefined }),
     [ChainTypeEnum.EVM]: (errorWallets) => ({
@@ -29,11 +33,13 @@ const errorForChainRegistry = {
     }),
 };
 const LoadWallets = () => {
+    var _a;
     const { chainType, user, isLoadingAccounts } = useOpenfortCore();
     const { triggerResize, setRoute, setConnector, walletConfig } = useOpenfort();
     const ethereumWallet = useEthereumEmbeddedWallet();
     const solanaWallet = useSolanaEmbeddedWallet();
     const embeddedWallet = chainType === ChainTypeEnum.EVM ? ethereumWallet : solanaWallet;
+    const connectOnLogin = (_a = walletConfig === null || walletConfig === void 0 ? void 0 : walletConfig.connectOnLogin) !== null && _a !== void 0 ? _a : true;
     const [loadingUX, setLoadingUX] = useState(true);
     const wallets = embeddedWallet.wallets;
     const isLoadingWallets = embeddedWallet.status === 'fetching-wallets' ||
@@ -63,31 +69,32 @@ const LoadWallets = () => {
             return;
         }
         logger.log('User wallets loaded:', wallets.length);
+        // No wallets → create one
         if (wallets.length === 0) {
-            // Always show the create wallet page when no wallets exist.
-            // connectOnLogin only controls whether creation starts automatically
-            // (handled inside CreateWalletAutomaticRecovery), not whether the
-            // page is shown — routing to CONNECTED with 0 wallets would show a
-            // broken "Connect wallet" button aimed at external wagmi wallets.
             setRoute(createRoute(chainType));
             return;
         }
-        if (wallets.length === 1) {
-            const single = wallets[0];
-            const alreadyActive = embeddedWallet.status === 'connected' &&
-                embeddedWallet.address &&
-                (chainType === ChainTypeEnum.SVM
-                    ? embeddedWallet.address === single.address
-                    : embeddedWallet.address.toLowerCase() === single.address.toLowerCase());
-            if (alreadyActive) {
+        // If a wallet is already active and connected, go to connected (triggers auto-close)
+        if (embeddedWallet.status === 'connected' && embeddedWallet.address) {
+            const activeAddr = embeddedWallet.address;
+            const isActiveInList = wallets.some((w) => chainType === ChainTypeEnum.SVM
+                ? w.address === activeAddr
+                : w.address.toLowerCase() === activeAddr.toLowerCase());
+            if (isActiveInList) {
                 setRoute(chainType === ChainTypeEnum.SVM ? routes.SOL_CONNECTED : routes.ETH_CONNECTED);
                 return;
             }
-            handleSingleWalletRegistry[chainType](single, chainType, setRoute, setConnector);
-            return;
         }
-        setRoute(routes.SELECT_WALLET_TO_RECOVER);
-    }, [loadingUX, isLoadingWallets, wallets, user, chainType, setRoute, setConnector, walletConfig]);
+        if (connectOnLogin) {
+            // Auto-connect: pick the best wallet (automatic > passkey > password) and recover it
+            const best = pickBestWallet(wallets);
+            routeToRecover(best, chainType, setRoute);
+        }
+        else {
+            // Not auto-connecting: close modal (go to connected page which triggers auto-close)
+            setRoute(chainType === ChainTypeEnum.SVM ? routes.SOL_CONNECTED : routes.ETH_CONNECTED);
+        }
+    }, [loadingUX, isLoadingWallets, wallets, user, chainType, setRoute, setConnector, walletConfig, connectOnLogin]);
     const { isError: isErrorFromChain, message: errorMessageFromChain } = errorForChainRegistry[chainType](errorWallets);
     const isError = !user || isErrorFromChain;
     const errorMessage = !user ? undefined : errorMessageFromChain;

package/build/components/Pages/LoadWallets/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/components/Pages/RemoveLinkedProvider/index.js

@@ -32,7 +32,7 @@ const RemoveLinkedProvider = () => {
         if (route.route === 'removeLinkedProvider') {
             return route.account;
         }
-        throw new Error('No provider found in route');
+        return null;
     }, [route]);
     useEffect(() => {
         if (error)
@@ -60,6 +60,8 @@ const RemoveLinkedProvider = () => {
     }, [isSuccess]);
     const handleRemove = async () => {
         var _a;
+        if (!provider)
+            return;
         const errorMsg = 'Failed to remove linked provider. Please try again.';
         if (provider.provider === 'siwe' || provider.provider === 'wallet') {
             try {
@@ -97,6 +99,8 @@ const RemoveLinkedProvider = () => {
             }
         }
     };
+    if (!provider)
+        return null;
     return (jsxs(PageContent, { children: [jsxs(ModalHeading, { children: ["Remove ", getProviderName(provider.provider)] }), jsxs(ModalContent, { style: { paddingBottom: 0 }, children: [jsx(ProviderIconContainer, { style: { marginBottom: '16px' }, children: jsx(ProviderIconWrapper, { children: jsx(ProviderIconInner, { children: jsx(ProviderIcon, { account: provider }) }) }) }), isSuccess ? (jsxs(Fragment, { children: [jsx(ModalH1, { "$valid": true, children: "Success" }), jsxs(ModalBody, { children: ["Successfully removed", ' ', provider.provider === 'siwe' ? (jsxs("span", { children: [jsx("b", { children: jsx(WalletDisplay, { walletAddress: provider.accountId }) }), "."] })) : (jsxs(Fragment, { children: [jsx("b", { children: getProviderName(provider.provider) }), " as an authentication method."] }))] }), jsx(ButtonWrapper, { style: { marginTop: 0 }, children: jsx(Button, { onClick: () => onBack === null || onBack === void 0 ? void 0 : onBack(), children: "Back" }) })] })) : (jsxs(Fragment, { children: [jsxs("p", { children: ["Are you sure you want to remove", ' ', provider.provider === 'siwe' ? (jsxs(CopyText, { value: provider.accountId, children: [jsx("b", { children: jsx(WalletDisplay, { walletAddress: provider.accountId }) }), "?"] })) : (jsxs(Fragment, { children: [jsx("b", { children: getProviderName(provider.provider) }), "as an authentication method?"] }))] }), error && jsx(ErrorMessage, { children: error }), jsxs(ButtonWrapper, { style: { marginTop: 0 }, children: [jsx(Button, { onClick: () => onBack === null || onBack === void 0 ? void 0 : onBack(), children: "Cancel" }), jsx(Button, { onClick: handleRemove, children: "Remove" })] })] }))] })] }));
 };
 

package/build/components/Pages/RemoveLinkedProvider/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/components/Pages/SelectWalletToRecover/index.js

@@ -6,19 +6,50 @@ import { toSolanaUserWallet } from '../../../hooks/openfort/walletTypes.js';
 import { useResolvedIdentity } from '../../../hooks/useResolvedIdentity.js';
 import { useOpenfortCore } from '../../../openfort/useOpenfort.js';
 import { useSolanaEmbeddedWallet } from '../../../solana/hooks/useSolanaEmbeddedWallet.js';
+import styled from '../../../styles/styled/index.js';
 import 'detect-browser';
 import 'react';
 import { truncateEthAddress } from '../../../utils/format.js';
 import { walletConfigs } from '../../../wallets/walletConfigs.js';
 import Button from '../../Common/Button/index.js';
 import { ModalHeading } from '../../Common/Modal/styles.js';
-import { WalletRecoveryIcon } from '../../Common/WalletRecoveryIcon/index.js';
+import { RECOVERY_METHOD_LABEL, WalletRecoveryIcon } from '../../Common/WalletRecoveryIcon/index.js';
 import { recoverRoute } from '../../Openfort/routeHelpers.js';
 import { routes } from '../../Openfort/types.js';
 import { useOpenfort } from '../../Openfort/useOpenfort.js';
 import { PageContent } from '../../PageContent/index.js';
 import { ProvidersButton, ProviderLabel, ProviderIcon } from '../Providers/styles.js';
 
+const RecoveryTag = styled.span `
+  display: inline-flex;
+  align-items: center;
+  padding: 2px 8px;
+  border-radius: 6px;
+  font-size: 11px;
+  font-weight: 600;
+  line-height: 16px;
+  white-space: nowrap;
+  background: var(--ck-body-background-secondary, #f0f0f0);
+  color: var(--ck-body-color-muted, #999);
+`;
+const WalletListScroll = styled.div `
+  max-height: min(400px, 50vh);
+  overflow-x: hidden;
+  overflow-y: auto;
+
+  &::-webkit-scrollbar {
+    width: 4px;
+  }
+  &::-webkit-scrollbar-track {
+    background: transparent;
+  }
+  &::-webkit-scrollbar-thumb {
+    background: var(--ck-body-color-muted, #c47a2a);
+    border-radius: 4px;
+  }
+  scrollbar-width: thin;
+  scrollbar-color: var(--ck-body-color-muted, #c47a2a) transparent;
+`;
 function WalletRow({ chainType, wallet, }) {
     var _a;
     const { setRoute } = useOpenfort();
@@ -54,7 +85,8 @@ function WalletRow({ chainType, wallet, }) {
         }
         setRoute(recoverRoute(chainType, wallet));
     };
-    return (jsx(ProvidersButton, { children: jsxs(Button, { onClick: handleClick, children: [jsx(ProviderLabel, { children: display }), jsx(ProviderIcon, { children: walletIcon() })] }) }));
+    const tag = wallet.recoveryMethod != null ? RECOVERY_METHOD_LABEL[wallet.recoveryMethod] : undefined;
+    return (jsx(ProvidersButton, { children: jsxs(Button, { onClick: handleClick, children: [jsxs(ProviderLabel, { children: [display, tag && jsx(RecoveryTag, { children: tag })] }), jsx(ProviderIcon, { children: walletIcon() })] }) }));
 }
 function SelectWalletToRecover() {
     const { chainType } = useOpenfortCore();
@@ -63,7 +95,7 @@ function SelectWalletToRecover() {
     const embeddedWallet = chainType === ChainTypeEnum.EVM ? ethereumWallet : solanaWallet;
     const wallets = embeddedWallet.wallets;
     const list = wallets.map((wallet) => jsx(WalletRow, { chainType: chainType, wallet: wallet }, wallet.id));
-    return (jsxs(PageContent, { onBack: routes.PROVIDERS, logoutOnBack: true, children: [jsx(ModalHeading, { children: "Select a wallet to recover" }), list] }));
+    return (jsxs(PageContent, { onBack: routes.PROVIDERS, logoutOnBack: true, children: [jsx(ModalHeading, { children: "Select a wallet to recover" }), jsx(WalletListScroll, { children: list })] }));
 }
 
 export { SelectWalletToRecover as default };

package/build/components/Pages/SelectWalletToRecover/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/hooks/openfort/auth/useAuthCallback.d.ts

@@ -1,4 +1,4 @@
-import type { UIAuthProvider } from '../../../components/Openfort/types';
+import { UIAuthProvider } from '../../../components/Openfort/types';
 import { OpenfortError } from '../../../core/errors';
 import type { OpenfortHookOptions } from '../../../types';
 import type { CreateWalletPostAuthOptions } from './useConnectToWalletPostAuth';

package/build/hooks/openfort/auth/useAuthCallback.js

@@ -1,6 +1,8 @@
 import { useState, useRef, useEffect } from 'react';
+import { UIAuthProvider } from '../../../components/Openfort/types.js';
 import { OpenfortError, OpenfortReactErrorType } from '../../../types.js';
 import { logger } from '../../../utils/logger.js';
+import { parseCallbackUrl, suppressReferrer } from '../../../utils/urlSecurity.js';
 import { useEmailAuth } from './useEmailAuth.js';
 import { useOAuth } from './useOAuth.js';
 
@@ -79,17 +81,27 @@ const useAuthCallback = ({ enabled = true, // Automatically handle OAuth and ema
         if (callbackProcessedRef.current)
             return;
         callbackProcessedRef.current = true;
+        // Parse callback URL (fixes OF-1013 duplicate `?` issue)
+        const url = parseCallbackUrl(window.location.href);
+        const rawProvider = url.searchParams.get('openfortAuthProvider');
+        // Allowlist: UIAuthProvider values + callback-only providers set by buildCallbackUrl
+        const validProviders = new Set([
+            ...Object.values(UIAuthProvider),
+            'email', // set by buildCallbackUrl for email verification
+            'password', // set by buildCallbackUrl for password reset
+        ]);
+        if (!rawProvider || !validProviders.has(rawProvider)) {
+            return;
+        }
+        // Validated against the allowlist above
+        const openfortAuthProvider = rawProvider;
+        // Suppress Referer SYNCHRONOUSLY — before any async work — so that
+        // subresource requests cannot leak access_token to third parties.
+        const restoreReferrer = suppressReferrer();
         (async () => {
             var _a, _b, _c;
-            // redirectUrl is not working with query params OF-1013
-            const fixedUrl = window.location.href.replace('?state=', '&state=');
-            const url = new URL(fixedUrl);
-            const openfortAuthProvider = url.searchParams.get('openfortAuthProvider');
-            if (!openfortAuthProvider) {
-                return;
-            }
             setProvider(openfortAuthProvider);
-            if (openfortAuthProvider === 'email') {
+            if (openfortAuthProvider === 'email' || openfortAuthProvider === 'password') {
                 // Email verification flow
                 // The backend verifies the email server-side via /auth/verify-email?token=...
                 // and then redirects here. If a `state` token is present we verify client-side
@@ -101,6 +113,7 @@ const useAuthCallback = ({ enabled = true, // Automatically handle OAuth and ema
                         url.searchParams.delete(key);
                     });
                     window.history.replaceState({}, document.title, url.toString());
+                    restoreReferrer();
                 };
                 if (state && email) {
                     // State present — verify client-side as well
@@ -130,6 +143,7 @@ const useAuthCallback = ({ enabled = true, // Automatically handle OAuth and ema
                     removeParams();
                 }
                 else {
+                    restoreReferrer();
                     const err = new OpenfortError('No email found in URL', OpenfortReactErrorType.AUTHENTICATION_ERROR);
                     logger.error('No email found in URL');
                     (_b = hookOptions.onError) === null || _b === void 0 ? void 0 : _b.call(hookOptions, err);
@@ -142,6 +156,7 @@ const useAuthCallback = ({ enabled = true, // Automatically handle OAuth and ema
                 const userId = url.searchParams.get('user_id');
                 const token = url.searchParams.get('access_token');
                 if (!userId || !token) {
+                    restoreReferrer();
                     logger.error(`Missing user id or access token`, {
                         hasUserId: !!userId,
                         hasToken: !!token,
@@ -157,6 +172,7 @@ const useAuthCallback = ({ enabled = true, // Automatically handle OAuth and ema
                         url.searchParams.delete(key);
                     });
                     window.history.replaceState({}, document.title, url.toString());
+                    restoreReferrer();
                 };
                 logger.log('callback', { userId });
                 const options = {

package/build/hooks/openfort/auth/useAuthCallback.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthCallback.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"useAuthCallback.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/hooks/useResolvedIdentity.js

@@ -61,7 +61,10 @@ function useResolvedIdentity(options) {
     var _a, _b, _c, _d, _e;
     const { address, chainType = ChainTypeEnum.EVM, ensChainId = 0, enabled = true } = options;
     const { walletConfig } = useOpenfort();
-    const rpcUrl = (_c = (_b = (_a = walletConfig === null || walletConfig === void 0 ? void 0 : walletConfig.ethereum) === null || _a === void 0 ? void 0 : _a.rpcUrls) === null || _b === void 0 ? void 0 : _b[ensChainId]) !== null && _c !== void 0 ? _c : getDefaultEthereumRpcUrl(ensChainId);
+    // Only resolve RPC URL for mainnet (ensChainId === 1) — chainId 0 means "do not resolve"
+    const rpcUrl = ensChainId === 1
+        ? ((_c = (_b = (_a = walletConfig === null || walletConfig === void 0 ? void 0 : walletConfig.ethereum) === null || _a === void 0 ? void 0 : _a.rpcUrls) === null || _b === void 0 ? void 0 : _b[ensChainId]) !== null && _c !== void 0 ? _c : getDefaultEthereumRpcUrl(ensChainId))
+        : undefined;
     const isEnabled = enabled && !!address && address.length > 0 && ensChainId === 1 && !!rpcUrl;
     const { data, error, isLoading } = useAsyncData({
         queryKey: ['identity', chainType, address, ensChainId],

package/build/hooks/useResolvedIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"useResolvedIdentity.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"useResolvedIdentity.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/utils/rpc.d.ts

@@ -6,10 +6,6 @@
  */
 import type { Chain } from 'viem';
 import type { SolanaCluster } from '../solana/types';
-/**
- * Get default Ethereum RPC URL for a chain ID.
- * Returns the viem/chains default RPC when known, falls back to Sepolia.
- */
 export declare function getDefaultEthereumRpcUrl(chainId: number): string;
 /**
  * Get default Solana RPC URL for a cluster.

package/build/utils/rpc.js

@@ -30,11 +30,15 @@ const DEFAULT_SOLANA_RPC_URLS = {
  * Get default Ethereum RPC URL for a chain ID.
  * Returns the viem/chains default RPC when known, falls back to Sepolia.
  */
+const warnedChainIds = new Set();
 function getDefaultEthereumRpcUrl(chainId) {
     const chain = KNOWN_CHAINS[chainId];
     const rpcUrl = chain === null || chain === void 0 ? void 0 : chain.rpcUrls.default.http[0];
     if (!rpcUrl) {
-        logger.warn(`No default Ethereum RPC URL found for chain ${chainId}. Configure rpcUrls in OpenfortProvider for better reliability and rate limits.`);
+        if (!warnedChainIds.has(chainId)) {
+            warnedChainIds.add(chainId);
+            logger.warn(`No default Ethereum RPC URL found for chain ${chainId}. Configure rpcUrls in OpenfortProvider for better reliability and rate limits.`);
+        }
         return sepolia.rpcUrls.default.http[0];
     }
     return rpcUrl;

package/build/utils/rpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"rpc.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"rpc.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/utils/urlSecurity.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Utilities for secure handling of OAuth callback URLs containing tokens.
+ *
+ * Prevents Referer-header leakage of access tokens and provides robust
+ * URL parsing for the OF-1013 workaround (duplicate `?` in redirect URLs).
+ */
+/**
+ * Injects a `<meta name="referrer" content="no-referrer">` tag so that
+ * any subresource request fired before `history.replaceState` strips the
+ * tokens will NOT leak the full URL (including access_token) via the
+ * Referer header.
+ *
+ * Call this **synchronously** — before any `await` — when the URL
+ * contains sensitive query parameters.
+ *
+ * @returns A cleanup function that removes the meta tag.
+ */
+export declare function suppressReferrer(): () => void;
+/**
+ * Parses the current `window.location.href`, fixing the OF-1013 issue
+ * where the server redirect produces a URL with a duplicate `?`, e.g.
+ * `https://example.com/callback?existing=1?access_token=xxx&user_id=yyy`.
+ *
+ * Instead of a fragile `.replace('?access_token=', '&access_token=')`
+ * that can mangle values containing the same substring, this finds the
+ * *second* `?` (if any) and replaces it with `&`.
+ */
+export declare function parseCallbackUrl(href: string): URL;

package/build/utils/urlSecurity.js

@@ -0,0 +1,56 @@
+/**
+ * Utilities for secure handling of OAuth callback URLs containing tokens.
+ *
+ * Prevents Referer-header leakage of access tokens and provides robust
+ * URL parsing for the OF-1013 workaround (duplicate `?` in redirect URLs).
+ */
+const REFERRER_META_ID = '__openfort_no_referrer';
+/**
+ * Injects a `<meta name="referrer" content="no-referrer">` tag so that
+ * any subresource request fired before `history.replaceState` strips the
+ * tokens will NOT leak the full URL (including access_token) via the
+ * Referer header.
+ *
+ * Call this **synchronously** — before any `await` — when the URL
+ * contains sensitive query parameters.
+ *
+ * @returns A cleanup function that removes the meta tag.
+ */
+function suppressReferrer() {
+    if (typeof document === 'undefined')
+        return () => { };
+    // Avoid duplicates if called more than once
+    if (document.getElementById(REFERRER_META_ID))
+        return () => { };
+    const meta = document.createElement('meta');
+    meta.id = REFERRER_META_ID;
+    meta.name = 'referrer';
+    meta.content = 'no-referrer';
+    document.head.appendChild(meta);
+    return () => {
+        meta.remove();
+    };
+}
+/**
+ * Parses the current `window.location.href`, fixing the OF-1013 issue
+ * where the server redirect produces a URL with a duplicate `?`, e.g.
+ * `https://example.com/callback?existing=1?access_token=xxx&user_id=yyy`.
+ *
+ * Instead of a fragile `.replace('?access_token=', '&access_token=')`
+ * that can mangle values containing the same substring, this finds the
+ * *second* `?` (if any) and replaces it with `&`.
+ */
+function parseCallbackUrl(href) {
+    const firstQ = href.indexOf('?');
+    if (firstQ === -1)
+        return new URL(href);
+    const secondQ = href.indexOf('?', firstQ + 1);
+    if (secondQ === -1)
+        return new URL(href);
+    // Replace only the second `?` with `&`
+    const fixed = `${href.slice(0, secondQ)}&${href.slice(secondQ + 1)}`;
+    return new URL(fixed);
+}
+
+export { parseCallbackUrl, suppressReferrer };
+//# sourceMappingURL=urlSecurity.js.map

package/build/utils/urlSecurity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"urlSecurity.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/version.d.ts

@@ -1 +1 @@
-export declare const OPENFORT_VERSION = "1.0.6";
+export declare const OPENFORT_VERSION = "1.0.7";

package/build/version.js

@@ -1,4 +1,4 @@
-const OPENFORT_VERSION = '1.0.6';
+const OPENFORT_VERSION = '1.0.7';
 
 export { OPENFORT_VERSION };
 //# sourceMappingURL=version.js.map

package/build/wagmi/useConnectWithSiwe.js

@@ -1,5 +1,5 @@
 import { OpenfortError } from '@openfort/openfort-js';
-import { useCallback } from 'react';
+import { useRef, useCallback } from 'react';
 import { useEthereumBridge } from '../ethereum/OpenfortEthereumBridgeContext.js';
 import { useOpenfortCore } from '../openfort/useOpenfort.js';
 import { createSIWEMessage } from '../siwe/create-siwe-message.js';
@@ -17,27 +17,35 @@ import { logger } from '../utils/logger.js';
  * ```
  */
 function useConnectWithSiwe() {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
     const { client, user, updateUser } = useOpenfortCore();
     const bridge = useEthereumBridge();
-    const address = (_a = bridge === null || bridge === void 0 ? void 0 : bridge.account) === null || _a === void 0 ? void 0 : _a.address;
-    const connector = (_b = bridge === null || bridge === void 0 ? void 0 : bridge.account) === null || _b === void 0 ? void 0 : _b.connector;
-    const chainId = (_c = bridge === null || bridge === void 0 ? void 0 : bridge.chainId) !== null && _c !== void 0 ? _c : 0;
-    const accountChainId = (_f = (_e = (_d = bridge === null || bridge === void 0 ? void 0 : bridge.account) === null || _d === void 0 ? void 0 : _d.chain) === null || _e === void 0 ? void 0 : _e.id) !== null && _f !== void 0 ? _f : bridge === null || bridge === void 0 ? void 0 : bridge.chainId;
-    const chainName = (_h = (_g = bridge === null || bridge === void 0 ? void 0 : bridge.account) === null || _g === void 0 ? void 0 : _g.chain) === null || _h === void 0 ? void 0 : _h.name;
-    const switchChainAsync = (_j = bridge === null || bridge === void 0 ? void 0 : bridge.switchChain) === null || _j === void 0 ? void 0 : _j.switchChainAsync;
-    const signMessage = bridge === null || bridge === void 0 ? void 0 : bridge.signMessage;
-    const connectWithSiwe = useCallback(async ({ onError, onConnect, address: propsAddress, connectorType: propsConnectorType, walletClientType: propsWalletClientType, link = !!user, } = {}) => {
-        var _a, _b;
-        const addressToUse = propsAddress !== null && propsAddress !== void 0 ? propsAddress : address;
-        const connectorType = propsConnectorType !== null && propsConnectorType !== void 0 ? propsConnectorType : connector === null || connector === void 0 ? void 0 : connector.type;
-        const walletClientType = propsWalletClientType !== null && propsWalletClientType !== void 0 ? propsWalletClientType : connector === null || connector === void 0 ? void 0 : connector.id;
-        if (!addressToUse || !connectorType || !walletClientType) {
-            logger.log('No address found', { address: addressToUse, connectorType, walletClientType });
+    // Use a ref so the callback always reads the latest bridge state,
+    // not a stale closure from the last render (critical after connectAsync changes the active connector).
+    const bridgeRef = useRef(bridge);
+    bridgeRef.current = bridge;
+    const userRef = useRef(user);
+    userRef.current = user;
+    const connectWithSiwe = useCallback(async ({ onError, onConnect, address: propsAddress, connectorType: propsConnectorType, walletClientType: propsWalletClientType, link, } = {}) => {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+        // Read fresh values from the bridge ref — NOT from the stale render closure
+        const b = bridgeRef.current;
+        const currentUser = userRef.current;
+        const shouldLink = link !== null && link !== void 0 ? link : !!currentUser;
+        const address = propsAddress !== null && propsAddress !== void 0 ? propsAddress : (_a = b === null || b === void 0 ? void 0 : b.account) === null || _a === void 0 ? void 0 : _a.address;
+        const connectorType = propsConnectorType !== null && propsConnectorType !== void 0 ? propsConnectorType : (_c = (_b = b === null || b === void 0 ? void 0 : b.account) === null || _b === void 0 ? void 0 : _b.connector) === null || _c === void 0 ? void 0 : _c.type;
+        const walletClientType = propsWalletClientType !== null && propsWalletClientType !== void 0 ? propsWalletClientType : (_e = (_d = b === null || b === void 0 ? void 0 : b.account) === null || _d === void 0 ? void 0 : _d.connector) === null || _e === void 0 ? void 0 : _e.id;
+        const chainId = (_f = b === null || b === void 0 ? void 0 : b.chainId) !== null && _f !== void 0 ? _f : 0;
+        const accountChainId = (_j = (_h = (_g = b === null || b === void 0 ? void 0 : b.account) === null || _g === void 0 ? void 0 : _g.chain) === null || _h === void 0 ? void 0 : _h.id) !== null && _j !== void 0 ? _j : b === null || b === void 0 ? void 0 : b.chainId;
+        const chainName = (_l = (_k = b === null || b === void 0 ? void 0 : b.account) === null || _k === void 0 ? void 0 : _k.chain) === null || _l === void 0 ? void 0 : _l.name;
+        const switchChainAsync = (_m = b === null || b === void 0 ? void 0 : b.switchChain) === null || _m === void 0 ? void 0 : _m.switchChainAsync;
+        const signMessage = b === null || b === void 0 ? void 0 : b.signMessage;
+        if (!address || !connectorType || !walletClientType) {
+            logger.warn('[useConnectWithSiwe] Missing params', { address, connectorType, walletClientType });
             onError === null || onError === void 0 ? void 0 : onError('No address found');
             return;
         }
         if (!signMessage) {
+            logger.warn('[useConnectWithSiwe] No signMessage on bridge');
             onError === null || onError === void 0 ? void 0 : onError('EVM bridge not available (signMessage)');
             return;
         }
@@ -46,46 +54,44 @@ function useConnectWithSiwe() {
                 await switchChainAsync({ chainId });
             }
             let nonce;
-            if (link) {
-                const resp = await client.auth.initLinkSiwe({ address: addressToUse });
+            if (shouldLink) {
+                const resp = await client.auth.initLinkSiwe({ address });
                 nonce = resp.nonce;
             }
             else {
-                const resp = await client.auth.initSiwe({ address: addressToUse });
+                const resp = await client.auth.initSiwe({ address });
                 nonce = resp.nonce;
             }
-            const SIWEMessage = createSIWEMessage(addressToUse, nonce, chainId);
+            const SIWEMessage = createSIWEMessage(address, nonce, chainId);
             if (!SIWEMessage)
                 throw new Error('SIWE message creation failed (window not available)');
             const signature = await signMessage({ message: SIWEMessage });
-            if (link) {
-                logger.log('Linking wallet to user');
+            if (shouldLink) {
                 await client.auth.linkWithSiwe({
                     signature,
                     message: SIWEMessage,
                     connectorType,
                     walletClientType,
-                    address: addressToUse,
+                    address,
                     chainId,
                 });
             }
             else {
-                logger.log('Authenticating with SIWE');
                 await client.auth.loginWithSiwe({
                     signature,
                     message: SIWEMessage,
                     connectorType,
                     walletClientType,
-                    address: addressToUse,
+                    address,
                 });
             }
             await updateUser();
             await Promise.resolve(onConnect === null || onConnect === void 0 ? void 0 : onConnect());
         }
         catch (err) {
-            logger.log('Failed to connect with SIWE', {
-                error: err,
-                status: (_b = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : 'unknown',
+            logger.error('[useConnectWithSiwe] SIWE failed', {
+                message: err instanceof Error ? err.message : String(err),
+                status: (_o = err === null || err === void 0 ? void 0 : err.response) === null || _o === void 0 ? void 0 : _o.status,
             });
             if (!onError)
                 return;
@@ -107,7 +113,7 @@ function useConnectWithSiwe() {
             }
             onError(message, err instanceof OpenfortError ? err : undefined);
         }
-    }, [client, user, updateUser, address, chainId, connector, accountChainId, chainName, switchChainAsync, signMessage]);
+    }, [client, updateUser]);
     return { connectWithSiwe };
 }
 

package/build/wagmi/useConnectWithSiwe.js.map

@@ -1 +1 @@
-{"version":3,"file":"useConnectWithSiwe.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"useConnectWithSiwe.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/wagmi/useEmbeddedWalletWagmiSync.js

@@ -1,7 +1,8 @@
-import { useEffect } from 'react';
+import { useRef, useEffect } from 'react';
 import { useAccount, useConnect, useDisconnect } from 'wagmi';
 import { embeddedWalletId } from '../constants/openfort.js';
 import { useEthereumEmbeddedWallet } from '../ethereum/hooks/useEthereumEmbeddedWallet.js';
+import { logger } from '../utils/logger.js';
 import { setEmbeddedWalletProvider } from './embeddedConnector.js';
 
 /** Null component — rendered inside CoreOpenfortProvider + WagmiProvider to sync embedded wallet into wagmi. */
@@ -16,6 +17,16 @@ function useEmbeddedWalletWagmiSync() {
     const { disconnectAsync } = useDisconnect();
     const status = wallet.status;
     const provider = status === 'connected' ? wallet.provider : null;
+    // Track whether an external wallet was explicitly connected — don't override it
+    const externalConnectorActiveRef = useRef(false);
+    useEffect(() => {
+        if (activeConnector && activeConnector.id !== embeddedWalletId) {
+            externalConnectorActiveRef.current = true;
+        }
+        else if (!activeConnector || activeConnector.id === embeddedWalletId) {
+            externalConnectorActiveRef.current = false;
+        }
+    }, [activeConnector]);
     // Keep the module-level provider slot in sync — clear on disconnect
     useEffect(() => {
         if (status === 'connected' && provider) {
@@ -26,6 +37,7 @@ function useEmbeddedWalletWagmiSync() {
         }
     }, [status, provider]);
     // Connect wagmi once the embedded wallet is ready AND wagmi has settled (not mid-reconnect)
+    // BUT do NOT override an explicitly connected external wallet
     useEffect(() => {
         if (status !== 'connected' || !provider)
             return;
@@ -33,9 +45,17 @@ function useEmbeddedWalletWagmiSync() {
             return;
         if ((activeConnector === null || activeConnector === void 0 ? void 0 : activeConnector.id) === embeddedWalletId)
             return;
+        // An external wallet is actively connected — don't override it
+        if (externalConnectorActiveRef.current) {
+            logger.log('[EmbeddedWalletWagmiSync] Skipping auto-connect — external wallet is active', {
+                activeConnector: activeConnector === null || activeConnector === void 0 ? void 0 : activeConnector.id,
+            });
+            return;
+        }
         const embeddedConnector = connectors.find((c) => c.id === embeddedWalletId);
         if (!embeddedConnector)
             return;
+        logger.log('[EmbeddedWalletWagmiSync] Auto-connecting embedded wallet to wagmi');
         connectAsync({ connector: embeddedConnector }).catch(() => { });
     }, [status, provider, wagmiStatus, activeConnector, connectors, connectAsync]);
     // Disconnect embedded connector from wagmi when the embedded wallet logs out

package/build/wagmi/useEmbeddedWalletWagmiSync.js.map

@@ -1 +1 @@
-{"version":3,"file":"useEmbeddedWalletWagmiSync.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"useEmbeddedWalletWagmiSync.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/wagmi/useWalletAuth.js

@@ -6,6 +6,7 @@ import { mapStatus } from '../hooks/openfort/auth/status.js';
 import { onError, onSuccess } from '../hooks/openfort/hookConsistency.js';
 import { useOpenfortCore } from '../openfort/useOpenfort.js';
 import { createSIWEMessage } from '../siwe/create-siwe-message.js';
+import { logger } from '../utils/logger.js';
 
 function runConnectWithSiwe(bridge, openfort, params) {
     var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s;
@@ -19,10 +20,12 @@ function runConnectWithSiwe(bridge, openfort, params) {
     const switchChainAsync = (_q = bridge.switchChain) === null || _q === void 0 ? void 0 : _q.switchChainAsync;
     const signMessage = bridge.signMessage;
     if (!address || !connectorType || !walletClientType) {
+        logger.warn('[runConnectWithSiwe] Missing params', { address, connectorType, walletClientType });
         (_r = params.onError) === null || _r === void 0 ? void 0 : _r.call(params, 'No address found');
         return Promise.resolve();
     }
     if (!signMessage) {
+        logger.warn('[runConnectWithSiwe] No signMessage on bridge');
         (_s = params.onError) === null || _s === void 0 ? void 0 : _s.call(params, 'EVM bridge not available (signMessage)');
         return Promise.resolve();
     }
@@ -67,6 +70,7 @@ function runConnectWithSiwe(bridge, openfort, params) {
             (_a = params.onConnect) === null || _a === void 0 ? void 0 : _a.call(params);
         }
         catch (err) {
+            logger.error('[runConnectWithSiwe] SIWE failed', err instanceof Error ? err.message : err);
             if (!params.onError)
                 return;
             let message = err instanceof Error ? err.message : String(err);
@@ -105,6 +109,7 @@ function useWalletAuth(hookOptions = {}) {
         const connector = (_a = bridge === null || bridge === void 0 ? void 0 : bridge.connectors) === null || _a === void 0 ? void 0 : _a.find((c) => c.id === connectorId);
         if (!connector || !(bridge === null || bridge === void 0 ? void 0 : bridge.connectAsync)) {
             const msg = 'Connector not available';
+            logger.warn('[useWalletAuth] Connector not found', { connectorId });
             const err = new OpenfortError(msg, OpenfortReactErrorType.AUTHENTICATION_ERROR);
             setStatus({ status: 'error', error: err });
             onError({ hookOptions, error: err });
@@ -118,6 +123,7 @@ function useWalletAuth(hookOptions = {}) {
                 await bridge.disconnect();
             }
             catch (e) {
+                logger.error('[useWalletAuth] Failed to disconnect', e);
                 setWalletConnectingTo(null);
                 const err = new OpenfortError('Failed to disconnect', OpenfortReactErrorType.AUTHENTICATION_ERROR, {
                     error: e,
@@ -157,6 +163,7 @@ function useWalletAuth(hookOptions = {}) {
             });
         }
         catch (err) {
+            logger.error('[useWalletAuth] connectAsync failed', err instanceof Error ? err.message : err);
             setWalletConnectingTo(null);
             const message = err instanceof Error ? err.message : 'Connection failed';
             const openfortErr = new OpenfortError(message, OpenfortReactErrorType.AUTHENTICATION_ERROR, { error: err });

package/build/wagmi/useWalletAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"useWalletAuth.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"useWalletAuth.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openfort/react",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "author": "Openfort (https://www.openfort.io)",
   "license": "BSD-2-Clause license",
   "description": "The easiest way to integrate Openfort to your project.",