@pollar/core 0.9.0-rc.0 → 0.9.0-rc.2

package/dist/index.js

@@ -341,7 +341,6 @@ var WebCryptoKeyManager = class {
     if (this.keyPair) return;
     if (!this._initPromise) {
       this._initPromise = this._doInit().catch((err) => {
-        console.error("[PollarClient:keys] WebCryptoKeyManager init failed", err);
         this._initPromise = null;
         throw err;
       });
@@ -1076,6 +1075,16 @@ function normalizeHtu(rawUrl) {
   return `${scheme}//${host}${portPart}${url.pathname}`;
 }
 
+// src/lib/logger.ts
+var RANK = { silent: 0, error: 1, warn: 2, info: 3, debug: 4 };
+function createLogger(level = "info", sink = console) {
+  const threshold = RANK[level];
+  const gate = (lvl) => (...args) => {
+    if (threshold >= RANK[lvl]) sink[lvl](...args);
+  };
+  return { error: gate("error"), warn: gate("warn"), info: gate("info"), debug: gate("debug") };
+}
+
 // src/storage/web.ts
 var LOG_PREFIX = "[PollarClient:storage]";
 function createMemoryAdapter() {
@@ -1099,7 +1108,7 @@ function createLocalStorageAdapter(options = {}) {
   function degrade(reason, error) {
     if (degraded) return;
     degraded = true;
-    console.warn(`${LOG_PREFIX} localStorage unavailable (${reason}); degrading to in-memory storage`);
+    (options.logger ?? console).warn(`${LOG_PREFIX} localStorage unavailable (${reason}); degrading to in-memory storage`);
     options.onDegrade?.(reason, error);
   }
   return {
@@ -1164,7 +1173,7 @@ function defaultStorage(options = {}) {
 }
 
 // src/version.ts
-var POLLAR_CORE_VERSION = "0.9.0-rc.0" ;
+var POLLAR_CORE_VERSION = "0.9.0-rc.2" ;
 
 // src/visibility/noop.ts
 function createNoopVisibilityProvider() {
@@ -1336,7 +1345,10 @@ function openAlbedoPopup(url) {
 }
 function waitForAlbedoPopup() {
   return new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => reject(new Error("Albedo response timeout")), 2 * 60 * 1e3);
+    const timeout = setTimeout(() => {
+      window.removeEventListener("message", handler);
+      reject(new Error("Albedo response timeout"));
+    }, 2 * 60 * 1e3);
     function handler(event) {
       if (event.origin !== window.location.origin || event.data?.type !== "ALBEDO_RESULT") return;
       clearTimeout(timeout);
@@ -1346,24 +1358,6 @@ function waitForAlbedoPopup() {
     window.addEventListener("message", handler);
   });
 }
-function waitForAlbedoResult() {
-  return new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => reject(new Error("Albedo response timeout")), 2 * 60 * 1e3);
-    const parseResult = () => {
-      const params = new URLSearchParams(window.location.search);
-      if (!params.has("pubkey") && !params.has("signed_envelope_xdr") && !params.has("signed_xdr")) return;
-      clearTimeout(timeout);
-      const result = {};
-      params.forEach((value, key) => {
-        result[key] = value;
-      });
-      window.history.replaceState({}, document.title, window.location.pathname);
-      resolve(result);
-    };
-    parseResult();
-    window.addEventListener("popstate", parseResult);
-  });
-}
 var AlbedoAdapter = class {
   /**
    * Network used for `connect` and `signAuthEntry` (which carry no per-call
@@ -1405,10 +1399,10 @@ var AlbedoAdapter = class {
     url.searchParams.set("xdr", xdr);
     url.searchParams.set("app_name", "Pollar");
     url.searchParams.set("network", albedoNetwork(options, this.network));
-    url.searchParams.set("callback", window.location.href);
+    url.searchParams.set("callback", `${window.location.origin}/albedo-callback`);
     url.searchParams.set("origin", window.location.origin);
-    window.location.href = url.toString();
-    const result = await waitForAlbedoResult();
+    openAlbedoPopup(url.toString());
+    const result = await waitForAlbedoPopup();
     if (!result.signed_envelope_xdr) throw new Error("Albedo signing rejected");
     return { signedTxXdr: result.signed_envelope_xdr };
   }
@@ -1418,10 +1412,10 @@ var AlbedoAdapter = class {
     url.searchParams.set("xdr", entryXdr);
     url.searchParams.set("app_name", "Pollar");
     url.searchParams.set("network", this.network);
-    url.searchParams.set("callback", window.location.href);
+    url.searchParams.set("callback", `${window.location.origin}/albedo-callback`);
     url.searchParams.set("origin", window.location.origin);
-    window.location.href = url.toString();
-    const result = await waitForAlbedoResult();
+    openAlbedoPopup(url.toString());
+    const result = await waitForAlbedoPopup();
     if (!result.signed_xdr) throw new Error("Albedo auth entry signing rejected");
     return { signedAuthEntry: result.signed_xdr };
   }
@@ -1448,85 +1442,85 @@ function isBoundedString(v, max, allowEmpty = false) {
   if (!allowEmpty && v.length === 0) return false;
   return v.length <= max;
 }
-function isValidSession(value) {
+function isValidSession(value, logger = console) {
   if (typeof value !== "object" || value === null) {
-    console.warn("[PollarClient:session] Invalid session \u2014 value is not an object");
+    logger.debug("[PollarClient:session] Invalid session \u2014 value is not an object");
     return false;
   }
   const s = value;
   if (!isBoundedString(s["clientSessionId"], MAX_CLIENT_SESSION_ID)) {
-    console.warn("[PollarClient:session] Invalid session \u2014 clientSessionId missing/empty/too long");
+    logger.debug("[PollarClient:session] Invalid session \u2014 clientSessionId missing/empty/too long");
     return false;
   }
   if (s["userId"] !== null && !isBoundedString(s["userId"], MAX_USER_ID)) {
-    console.warn("[PollarClient:session] Invalid session \u2014 userId must be string|null");
+    logger.debug("[PollarClient:session] Invalid session \u2014 userId must be string|null");
     return false;
   }
   if (!isBoundedString(s["status"], MAX_STATUS)) {
-    console.warn("[PollarClient:session] Invalid session \u2014 status must be string");
+    logger.debug("[PollarClient:session] Invalid session \u2014 status must be string");
     return false;
   }
   const token = s["token"];
   if (typeof token !== "object" || token === null) {
-    console.warn("[PollarClient:session] Invalid session \u2014 token missing or not an object");
+    logger.debug("[PollarClient:session] Invalid session \u2014 token missing or not an object");
     return false;
   }
   const t = token;
   if (!isBoundedString(t["accessToken"], MAX_ACCESS_TOKEN)) {
-    console.warn("[PollarClient:session] Invalid session \u2014 token.accessToken missing/empty/too long");
+    logger.debug("[PollarClient:session] Invalid session \u2014 token.accessToken missing/empty/too long");
     return false;
   }
   if (!isBoundedString(t["refreshToken"], MAX_REFRESH_TOKEN)) {
-    console.warn("[PollarClient:session] Invalid session \u2014 token.refreshToken missing/empty/too long");
+    logger.debug("[PollarClient:session] Invalid session \u2014 token.refreshToken missing/empty/too long");
     return false;
   }
   if (typeof t["expiresAt"] !== "number" || !Number.isFinite(t["expiresAt"])) {
-    console.warn("[PollarClient:session] Invalid session \u2014 token.expiresAt must be a finite number");
+    logger.debug("[PollarClient:session] Invalid session \u2014 token.expiresAt must be a finite number");
     return false;
   }
   const user = s["user"];
   if (typeof user !== "object" || user === null) {
-    console.warn("[PollarClient:session] Invalid session \u2014 user missing or not an object");
+    logger.debug("[PollarClient:session] Invalid session \u2014 user missing or not an object");
     return false;
   }
   const u = user;
   if (u["id"] !== void 0 && !isBoundedString(u["id"], MAX_USER_ID)) {
-    console.warn("[PollarClient:session] Invalid session \u2014 user.id must be string if present");
+    logger.debug("[PollarClient:session] Invalid session \u2014 user.id must be string if present");
     return false;
   }
   if (typeof u["ready"] !== "boolean") {
-    console.warn("[PollarClient:session] Invalid session \u2014 user.ready must be boolean");
+    logger.debug("[PollarClient:session] Invalid session \u2014 user.ready must be boolean");
     return false;
   }
   const wallet = s["wallet"];
   if (typeof wallet !== "object" || wallet === null) {
-    console.warn("[PollarClient:session] Invalid session \u2014 wallet missing or not an object");
+    logger.debug("[PollarClient:session] Invalid session \u2014 wallet missing or not an object");
     return false;
   }
   const w = wallet;
-  if (w["type"] !== "custodial" && w["type"] !== "smart" && w["type"] !== "external") {
-    console.warn("[PollarClient:session] Invalid session \u2014 wallet.type must be custodial|smart|external");
+  if (w["type"] !== "internal" && w["type"] !== "smart" && w["type"] !== "external") {
+    logger.debug("[PollarClient:session] Invalid session \u2014 wallet.type must be internal|smart|external");
     return false;
   }
   if (w["address"] !== null && !isBoundedString(w["address"], MAX_WALLET_PUBLIC_KEY)) {
-    console.warn("[PollarClient:session] Invalid session \u2014 wallet.address must be string|null");
+    logger.debug("[PollarClient:session] Invalid session \u2014 wallet.address must be string|null");
     return false;
   }
   if (w["existsOnStellar"] !== void 0 && typeof w["existsOnStellar"] !== "boolean") {
-    console.warn("[PollarClient:session] Invalid session \u2014 wallet.existsOnStellar must be boolean if present");
+    logger.debug("[PollarClient:session] Invalid session \u2014 wallet.existsOnStellar must be boolean if present");
     return false;
   }
   if (w["createdAt"] !== void 0 && (typeof w["createdAt"] !== "number" || !Number.isFinite(w["createdAt"]))) {
-    console.warn("[PollarClient:session] Invalid session \u2014 wallet.createdAt must be a finite number if present");
+    logger.debug("[PollarClient:session] Invalid session \u2014 wallet.createdAt must be a finite number if present");
     return false;
   }
   if (w["linkedAt"] !== void 0 && (typeof w["linkedAt"] !== "number" || !Number.isFinite(w["linkedAt"]))) {
-    console.warn("[PollarClient:session] Invalid session \u2014 wallet.linkedAt must be a finite number if present");
+    logger.debug("[PollarClient:session] Invalid session \u2014 wallet.linkedAt must be a finite number if present");
     return false;
   }
   return true;
 }
-async function readStorage(storage, apiKeyHash) {
+async function readStorage(storage, apiKeyHash, logger = console) {
   const raw = await storage.get(sessionStorageKey(apiKeyHash));
   if (!raw) return null;
   try {
@@ -1536,10 +1530,13 @@ async function readStorage(storage, apiKeyHash) {
       if (w && w["address"] == null && typeof w["publicKey"] === "string") {
         w["address"] = w["publicKey"];
       }
+      if (w && w["type"] === "custodial") {
+        w["type"] = "internal";
+      }
     }
-    if (!isValidSession(session)) {
+    if (!isValidSession(session, logger)) {
       await storage.remove(sessionStorageKey(apiKeyHash));
-      console.warn("[PollarClient:session] Stored session is invalid \u2014 clearing storage");
+      logger.warn("[PollarClient:session] Stored session is invalid \u2014 clearing storage");
       return null;
     }
     if (session.token.expiresAt * 1e3 < Date.now()) {
@@ -1547,7 +1544,7 @@ async function readStorage(storage, apiKeyHash) {
     }
     return session;
   } catch (error) {
-    console.error("[PollarClient:session] Failed to parse session from storage", error);
+    logger.error("[PollarClient:session] Failed to parse session from storage", error);
     await storage.remove(sessionStorageKey(apiKeyHash));
     return null;
   }
@@ -1609,7 +1606,7 @@ function abortableDelay(ms, signal) {
   });
 }
 var MAX_BACKOFF_MS = 5e3;
-async function streamUntilFound(api, clientSessionId, check, retryDelayMs = 200, signal) {
+async function streamUntilFound(api, clientSessionId, check, retryDelayMs = 200, signal, logger = console) {
   let backoff = retryDelayMs;
   const sleep = async (ms) => {
     if (ms <= 0) return;
@@ -1627,7 +1624,7 @@ async function streamUntilFound(api, clientSessionId, check, retryDelayMs = 200,
       }));
     } catch (e) {
       if (e instanceof Error && e.name === "AbortError") throw e;
-      console.warn("[PollarClient:stream] session-status request failed; will retry", e);
+      logger.debug("[PollarClient:stream] session-status request failed; will retry", e);
     }
     if (error || !data) {
       await sleep(backoff);
@@ -1636,16 +1633,12 @@ async function streamUntilFound(api, clientSessionId, check, retryDelayMs = 200,
     }
     const reader = data.getReader();
     const decoder = new TextDecoder();
-    let streamDone = false;
     let sawAnyChunk = false;
     try {
       while (true) {
         throwIfAborted(signal);
         const { done, value } = await reader.read();
-        if (done) {
-          streamDone = true;
-          break;
-        }
+        if (done) break;
         sawAnyChunk = true;
         const chunk = decoder.decode(value);
         for (const message of chunk.split("\n\n").filter(Boolean)) {
@@ -1667,17 +1660,16 @@ async function streamUntilFound(api, clientSessionId, check, retryDelayMs = 200,
     } catch (e) {
       if (e instanceof Error && e.name === "AbortError") throw e;
       if (e instanceof SessionStatusError) throw e;
-      console.warn("[PollarClient:stream] session-status stream read failed; will retry", e);
+      logger.debug("[PollarClient:stream] session-status stream read failed; will retry", e);
     } finally {
       reader.releaseLock();
     }
     if (sawAnyChunk) backoff = retryDelayMs;
     else backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
-    const delay = streamDone ? backoff : 0;
-    if (delay) await sleep(delay);
+    await sleep(backoff);
   }
 }
-async function pollUntilFound(baseUrl, clientSessionId, check, intervalMs = 500, signal) {
+async function pollUntilFound(baseUrl, clientSessionId, check, intervalMs = 500, signal, logger = console) {
   const url = `${baseUrl}/auth/session/status/${encodeURIComponent(clientSessionId)}/poll`;
   let backoff = intervalMs;
   const sleep = async (ms) => {
@@ -1695,7 +1687,7 @@ async function pollUntilFound(baseUrl, clientSessionId, check, intervalMs = 500,
       envelope = await response.json().catch(() => null);
     } catch (e) {
       if (e instanceof Error && e.name === "AbortError") throw e;
-      console.warn("[PollarClient:stream] session-status poll failed; will retry", e);
+      logger.debug("[PollarClient:stream] session-status poll failed; will retry", e);
     }
     if (httpStatus === 404 || envelope?.code === "INVALID_CLIENT_SESSION_ID") {
       throw new SessionStatusError("INVALID_CLIENT_SESSION_ID");
@@ -1712,13 +1704,13 @@ async function pollUntilFound(baseUrl, clientSessionId, check, intervalMs = 500,
   }
 }
 function waitForSessionReady(args) {
-  const { api, baseUrl, clientSessionId, check, useStreaming, retryDelayMs, signal } = args;
-  return useStreaming ? streamUntilFound(api, clientSessionId, check, retryDelayMs ?? 200, signal) : pollUntilFound(baseUrl, clientSessionId, check, retryDelayMs ?? 500, signal);
+  const { api, baseUrl, clientSessionId, check, useStreaming, retryDelayMs, signal, logger = console } = args;
+  return useStreaming ? streamUntilFound(api, clientSessionId, check, retryDelayMs ?? 200, signal, logger) : pollUntilFound(baseUrl, clientSessionId, check, retryDelayMs ?? 500, signal, logger);
 }
 
 // src/client/auth/authenticate.ts
 async function authenticate(clientSessionId, deps, expectedWallet) {
-  const { api, basePath, useStreaming, signal, setAuthState, storeSession, clearSession } = deps;
+  const { api, logger, basePath, useStreaming, signal, setAuthState, storeSession, clearSession } = deps;
   setAuthState({ step: "authenticating" });
   try {
     await waitForSessionReady({
@@ -1727,7 +1719,8 @@ async function authenticate(clientSessionId, deps, expectedWallet) {
       clientSessionId,
       check: (data2) => data2?.status === "READY",
       useStreaming,
-      signal
+      signal,
+      logger
     });
   } catch (err) {
     if (err instanceof SessionStatusError) {
@@ -1752,18 +1745,19 @@ async function authenticate(clientSessionId, deps, expectedWallet) {
     },
     signal
   });
-  if (data?.code === "SDK_LOGIN_SUCCESS" && isValidSession(data?.content)) {
-    if (expectedWallet && data.content.data.providers.wallet?.address !== expectedWallet) {
+  if (data?.code === "SDK_LOGIN_SUCCESS" && isValidSession(data?.content, logger)) {
+    const sessionWallet = data.content.data?.providers?.wallet?.address;
+    if (expectedWallet && sessionWallet !== expectedWallet) {
       setAuthState({
         step: "error",
         previousStep: "authenticating",
         message: "Wallet mismatch: session wallet does not match connected wallet",
         errorCode: AUTH_ERROR_CODES.WALLET_AUTH_FAILED
       });
-      clearSession();
+      await clearSession();
       return;
     }
-    storeSession(data.content);
+    await storeSession(data.content);
   } else {
     setAuthState({
       step: "error",
@@ -1771,7 +1765,7 @@ async function authenticate(clientSessionId, deps, expectedWallet) {
       message: "Failed to load session",
       errorCode: AUTH_ERROR_CODES.AUTH_FAILED
     });
-    clearSession();
+    await clearSession();
   }
 }
 
@@ -2070,7 +2064,9 @@ var PollarClient = class {
     this.apiKey = config.apiKey;
     this.id = randomUUID();
     this.basePath = `${config.baseUrl || "https://sdk.api.pollar.xyz"}/v1`;
+    this._log = createLogger(config.logLevel ?? "info", config.logger);
     this._storage = config.storage ?? defaultStorage({
+      logger: this._log,
       onDegrade: (reason, error) => {
         config.onStorageDegrade?.(reason, error);
         this._dispatchStorageDegrade(reason, error);
@@ -2085,7 +2081,7 @@ var PollarClient = class {
     this._visibilityProvider = config.visibilityProvider ?? defaultVisibilityProvider();
     this._maxIdleMs = config.maxIdleMs;
     this._openAuthUrl = config.openAuthUrl ?? defaultWebOAuthOpener;
-    this._oauthRedirectUri = config.oauthRedirectUri ?? (isBrowser ? window.location.origin : "");
+    this._oauthRedirectUri = config.oauthRedirectUri ?? (isBrowser ? window.location?.origin ?? "" : "");
     this._api = createApiClient(this.basePath);
     this._wireMiddlewares();
     this._networkState = { step: "connected", network: config.stellarNetwork ?? "testnet" };
@@ -2094,7 +2090,7 @@ var PollarClient = class {
       this._initialized = Promise.resolve();
       return;
     }
-    console.info(
+    this._log.info(
       `[PollarClient] Initialized v${POLLAR_CORE_VERSION} \u2014 endpoint: ${this.basePath}, network: ${this._networkState.network}`
     );
     this._initialized = this._initialize();
@@ -2121,7 +2117,7 @@ var PollarClient = class {
       const sessionKey = sessionStorageKey(this._apiKeyHash);
       const handler = (e) => {
         if (e.key === sessionKey) {
-          this._restoreSession().catch((err) => console.error("[PollarClient] Cross-tab restore failed", err));
+          this._restoreSession().catch((err) => this._log.error("[PollarClient] Cross-tab restore failed", err));
         }
       };
       window.addEventListener("storage", handler);
@@ -2130,7 +2126,7 @@ var PollarClient = class {
     try {
       await this._keyManager.init();
     } catch (err) {
-      console.warn("[PollarClient] KeyManager init failed; DPoP unavailable for this session", err);
+      this._log.warn("[PollarClient] KeyManager init failed; DPoP unavailable for this session", err);
     }
     await this._restoreSession();
     this._visibilityUnsubscribe = this._visibilityProvider.onChange((visible) => {
@@ -2171,7 +2167,7 @@ var PollarClient = class {
           try {
             self._requestBodyCache.set(request, await request.clone().arrayBuffer());
           } catch (err) {
-            console.warn("[PollarClient] Could not snapshot request body for retry", err);
+            this._log.warn("[PollarClient] Could not snapshot request body for retry", err);
           }
         }
         const isRefresh = request.url.includes("/auth/refresh");
@@ -2230,7 +2226,7 @@ var PollarClient = class {
         this._keyManager
       );
     } catch (err) {
-      console.warn("[PollarClient] DPoP proof build failed", err);
+      this._log.warn("[PollarClient] DPoP proof build failed", err);
       return null;
     }
   }
@@ -2284,7 +2280,7 @@ var PollarClient = class {
   async _doRefresh() {
     const refreshToken = this._session?.token?.refreshToken;
     if (!refreshToken) {
-      console.warn("[PollarClient] Refresh skipped: no refresh token in session");
+      this._log.warn("[PollarClient] Refresh skipped: no refresh token in session");
       await this._clearSession();
       throw new Error("No refresh token available");
     }
@@ -2295,18 +2291,18 @@ var PollarClient = class {
       data = response.data;
       error = response.error;
     } catch (err) {
-      console.error("[PollarClient] /auth/refresh request threw", err);
+      this._log.error("[PollarClient] /auth/refresh request threw", err);
       await this._clearSession();
       throw err;
     }
     if (error || !data) {
-      console.error("[PollarClient] /auth/refresh returned error", { error });
+      this._log.error("[PollarClient] /auth/refresh returned error", { error });
       await this._clearSession();
       throw new Error("Refresh failed");
     }
     const successData = data;
     if (!successData.success || !successData.content?.token) {
-      console.error("[PollarClient] /auth/refresh response malformed", {
+      this._log.error("[PollarClient] /auth/refresh response malformed", {
         success: successData.success,
         hasToken: !!successData.content?.token
       });
@@ -2315,7 +2311,7 @@ var PollarClient = class {
     }
     const newToken = successData.content.token;
     if (typeof newToken.accessToken !== "string" || typeof newToken.refreshToken !== "string" || typeof newToken.expiresAt !== "number") {
-      console.error("[PollarClient] /auth/refresh token shape invalid", {
+      this._log.error("[PollarClient] /auth/refresh token shape invalid", {
         accessToken: typeof newToken.accessToken,
         refreshToken: typeof newToken.refreshToken,
         expiresAt: typeof newToken.expiresAt
@@ -2327,9 +2323,9 @@ var PollarClient = class {
       try {
         this._session = { ...this._session, token: newToken };
         await writeStorage(this._storage, this.apiKeyHash, this._session);
-        console.info("[PollarClient] Tokens refreshed");
+        this._log.info("[PollarClient] Tokens refreshed");
       } catch (err) {
-        console.error("[PollarClient] Failed to persist refreshed session", err);
+        this._log.error("[PollarClient] Failed to persist refreshed session", err);
       }
       this._scheduleNextRefresh();
     }
@@ -2383,7 +2379,7 @@ var PollarClient = class {
     try {
       await this.refresh();
     } catch (err) {
-      console.warn("[PollarClient] Proactive refresh failed; session cleared", err);
+      this._log.warn("[PollarClient] Proactive refresh failed; session cleared", err);
     }
   }
   _clearRefreshTimer() {
@@ -2429,7 +2425,7 @@ var PollarClient = class {
       try {
         cb(reason, error);
       } catch (err) {
-        console.error("[PollarClient] onStorageDegrade listener threw", err);
+        this._log.error("[PollarClient] onStorageDegrade listener threw", err);
       }
     }
   }
@@ -2549,20 +2545,20 @@ var PollarClient = class {
       warnServerSide("logout");
       return;
     }
-    console.info("[PollarClient] Logout requested", { everywhere: !!options.everywhere });
+    this._log.info("[PollarClient] Logout requested", { everywhere: !!options.everywhere });
     if (this._session?.token?.accessToken) {
       try {
         await this._api.POST("/auth/logout", {
           body: options.everywhere ? { everywhere: true } : {}
         });
       } catch (err) {
-        console.warn("[PollarClient] Server logout failed (continuing with local clear)", err);
+        this._log.warn("[PollarClient] Server logout failed (continuing with local clear)", err);
       }
     }
     try {
       await this._clearSession();
     } catch (err) {
-      console.warn("[PollarClient] Local logout cleanup failed", err);
+      this._log.warn("[PollarClient] Local logout cleanup failed", err);
     }
   }
   /** Convenience: revoke every active session for this user (all devices). */
@@ -2638,6 +2634,14 @@ var PollarClient = class {
   getNetworkState() {
     return this._networkState;
   }
+  /**
+   * The client's level-gated logger (built from `logLevel` / `logger`). Exposed
+   * so the runtime layer (`@pollar/react`) can route its own logs through the
+   * same level and sink instead of calling `console` directly.
+   */
+  getLogger() {
+    return this._log;
+  }
   setNetwork(network) {
     this._setNetworkState({ step: "connected", network });
   }
@@ -2786,7 +2790,7 @@ var PollarClient = class {
       this._setTransactionState({ step: "error", phase: "building", ...details && { details } });
       return { status: "error", ...details && { details } };
     } catch (err) {
-      console.error("[PollarClient] buildTx failed", err);
+      this._log.error("[PollarClient] buildTx failed", err);
       this._setTransactionState({ step: "error", phase: "building" });
       return { status: "error" };
     }
@@ -3299,6 +3303,7 @@ var PollarClient = class {
   _flowDeps(signal) {
     return {
       api: this._api,
+      logger: this._log,
       basePath: this.basePath,
       // SSE status streaming works on web; React Native's `fetch` has no
       // readable `response.body`, so those clients poll the non-streaming
@@ -3351,12 +3356,12 @@ var PollarClient = class {
   }
   _handleFlowError(error) {
     if (error instanceof Error && error.name === "AbortError") {
-      console.info("[PollarClient] Login cancelled");
+      this._log.debug("[PollarClient] Login cancelled");
       this._setAuthState({ step: "idle" });
       return;
     }
     if (error instanceof Error && error.code === AUTH_ERROR_CODES.WALLET_RESOLVER_TIMEOUT) {
-      console.error("[PollarClient]", error.message);
+      this._log.error("[PollarClient]", error.message);
       this._setAuthState({
         step: "error",
         previousStep: this._authState.step,
@@ -3365,7 +3370,7 @@ var PollarClient = class {
       });
       return;
     }
-    console.error("[PollarClient] Unexpected error in auth flow", error);
+    this._log.error("[PollarClient] Unexpected error in auth flow", error);
     this._setAuthState({
       step: "error",
       previousStep: this._authState.step,
@@ -3374,22 +3379,25 @@ var PollarClient = class {
     });
   }
   async _restoreSession() {
-    this._session = await readStorage(this._storage, this.apiKeyHash);
+    this._session = await readStorage(this._storage, this.apiKeyHash, this._log);
     if (this._session) {
       const storedType = await readWalletType(this._storage, this.apiKeyHash);
       if (storedType) {
         try {
           this._walletAdapter = await this._resolveWalletAdapter(storedType);
         } catch (err) {
-          console.warn("[PollarClient] Could not restore wallet adapter for stored id", { id: storedType, err });
+          this._log.warn("[PollarClient] Could not restore wallet adapter for stored id", { id: storedType, err });
         }
       }
-      console.info("[PollarClient] Session restored from storage");
+      this._log.info("[PollarClient] Session restored from storage");
       this._setAuthState({ step: "authenticated", session: this._session, verified: false });
       this._scheduleNextRefresh();
       void this._resume();
     } else {
-      console.info("[PollarClient] No session in storage");
+      this._log.info("[PollarClient] No session in storage");
+      if (this._authState.step !== "idle") {
+        await this._clearSession();
+      }
     }
   }
   /**
@@ -3420,13 +3428,13 @@ var PollarClient = class {
       this._setAuthState({ step: "authenticated", session: this._session, verified: true });
     } catch (err) {
       if (err?.name === "AbortError") return;
-      console.warn("[PollarClient] resume failed (network); will retry", err);
+      this._log.warn("[PollarClient] resume failed (network); will retry", err);
     } finally {
       if (this._resumeController === controller) this._resumeController = null;
     }
   }
   async _storeSession(session) {
-    console.info("[PollarClient] Session stored");
+    this._log.info("[PollarClient] Session stored");
     const w = session.wallet;
     const persisted = {
       clientSessionId: session.clientSessionId,
@@ -3436,8 +3444,11 @@ var PollarClient = class {
       user: session.user,
       // The wire response still carries the legacy `publicKey` alias (kept for
       // older SDKs); the persisted session standardizes on `address` only.
+      // The wire also still emits the legacy type `'custodial'` (unchanged for
+      // SDKs ≤0.8.x); we remap it to `'internal'` here so the SDK surface and
+      // persisted session speak one vocabulary while the wire stays compatible.
       wallet: {
-        type: w.type,
+        type: w.type === "custodial" ? "internal" : w.type,
         address: w.address ?? w.publicKey ?? null,
         ...w.existsOnStellar !== void 0 ? { existsOnStellar: w.existsOnStellar } : {},
         ...w.createdAt !== void 0 ? { createdAt: w.createdAt } : {},
@@ -3461,7 +3472,7 @@ var PollarClient = class {
     this._scheduleNextRefresh();
   }
   async _clearSession() {
-    console.info("[PollarClient] Session cleared");
+    this._log.info("[PollarClient] Session cleared");
     this._clearRefreshTimer();
     this._session = null;
     this._profile = null;
@@ -3470,7 +3481,7 @@ var PollarClient = class {
     try {
       await this._keyManager.reset();
     } catch (err) {
-      console.warn("[PollarClient] KeyManager reset failed during clearSession", err);
+      this._log.warn("[PollarClient] KeyManager reset failed during clearSession", err);
     }
     await removeStorage(this._storage, this.apiKeyHash);
     this._transactionState = null;
@@ -3482,17 +3493,17 @@ var PollarClient = class {
   _setNetworkState(next) {
     this._networkState = next;
     const label = next.step === "connected" ? next.network : next.step;
-    console.info(`[PollarClient] network:${label}`);
+    this._log.debug(`[PollarClient] network:${label}`);
     for (const cb of this._networkStateListeners) cb(next);
   }
   _setAuthState(next) {
     this._authState = next;
-    console.info(`[PollarClient] auth:${next.step}`);
+    this._log.debug(`[PollarClient] auth:${next.step}`);
     for (const cb of this._authStateListeners) cb(next);
   }
   _setTransactionState(next) {
     this._transactionState = next;
-    console.info(`[PollarClient] transaction:${next.step}`);
+    this._log.debug(`[PollarClient] transaction:${next.step}`);
     for (const cb of this._transactionStateListeners) cb(next);
   }
   /**
@@ -3553,6 +3564,7 @@ exports.canonicalEcJwk = canonicalEcJwk;
 exports.claimDistributionRule = claimDistributionRule;
 exports.computeJwkThumbprint = computeJwkThumbprint;
 exports.createLocalStorageAdapter = createLocalStorageAdapter;
+exports.createLogger = createLogger;
 exports.createMemoryAdapter = createMemoryAdapter;
 exports.createOffRamp = createOffRamp;
 exports.createOnRamp = createOnRamp;