@proveanything/smartlinks-auth-ui 0.1.43 → 0.1.45

package/dist/components/SmartlinksAuthUI.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SmartlinksAuthUI.d.ts","sourceRoot":"","sources":["../../src/components/SmartlinksAuthUI.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAuC,MAAM,OAAO,CAAC;AAW5D,OAAO,KAAK,EAAE,qBAAqB,EAAyF,MAAM,UAAU,CAAC;AAgI7I,QAAA,MAAM,mBAAmB,QAAa,OAAO,CAAC,IAAI,CA+CjD,CAAC;AAyFF,OAAO,EAAE,mBAAmB,EAAE,CAAC;AA8B/B,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAulD5D,CAAC"}
+{"version":3,"file":"SmartlinksAuthUI.d.ts","sourceRoot":"","sources":["../../src/components/SmartlinksAuthUI.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAuC,MAAM,OAAO,CAAC;AAW5D,OAAO,KAAK,EAAE,qBAAqB,EAAyF,MAAM,UAAU,CAAC;AAgI7I,QAAA,MAAM,mBAAmB,QAAa,OAAO,CAAC,IAAI,CA+CjD,CAAC;AAyFF,OAAO,EAAE,mBAAmB,EAAE,CAAC;AA8B/B,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CA8oD5D,CAAC"}

package/dist/context/AuthContext.d.ts

@@ -15,7 +15,7 @@ interface AuthContextValue {
     contactId: string | null;
     getContact: (forceRefresh?: boolean) => Promise<ContactResponse | null>;
     updateContactCustomFields: (customFields: Record<string, any>) => Promise<ContactResponse>;
-    login: (token: string, user: AuthUser, accountData?: Record<string, any>, isNewUser?: boolean, expiresAt?: number) => Promise<void>;
+    login: (token: string, user: AuthUser, accountData?: Record<string, any>, isNewUser?: boolean, expiresAt?: number, waitForParentAck?: boolean) => Promise<void>;
     logout: () => Promise<void>;
     getToken: () => Promise<string | null>;
     getTokenInfo: () => Promise<{

package/dist/context/AuthContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../../src/context/AuthContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA8E,MAAM,OAAO,CAAC;AAGnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGjE,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAErF,UAAU,gBAAgB;IACxB,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IAGnB,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACxE,yBAAyB,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAG3F,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpI,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC,YAAY,EAAE,MAAM,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC5F,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,MAAM,IAAI,CAAC;IACrE,iBAAiB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAID,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CA03BpD,CAAC;AAEF,eAAO,MAAM,OAAO,QAAO,gBAM1B,CAAC"}
+{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../../src/context/AuthContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA8E,MAAM,OAAO,CAAC;AAGnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGjE,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAErF,UAAU,gBAAgB;IACxB,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IAGnB,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACxE,yBAAyB,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAG3F,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChK,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC,YAAY,EAAE,MAAM,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC5F,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,MAAM,IAAI,CAAC;IACrE,iBAAiB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAID,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAq7BpD,CAAC;AAEF,eAAO,MAAM,OAAO,QAAO,gBAM1B,CAAC"}

package/dist/index.esm.js

@@ -11840,7 +11840,42 @@ collectionId, enableContactSync, enableInteractionTracking, interactionAppId, in
             unsubscribe();
         };
     }, [proxyMode, notifyAuthStateChange]);
-    const login = useCallback(async (authToken, authUser, authAccountData, isNewUser, expiresAt) => {
+    // Helper: Send login to parent and wait for acknowledgment
+    // Used for deep-link flows (email verification, magic link) where we need to ensure
+    // the parent has persisted the session before redirecting (which causes page reload)
+    const notifyParentLoginAndWait = async (authToken, authUser, authAccountData, timeoutMs = 5000) => {
+        return new Promise((resolve) => {
+            const messageId = `login-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+            const handleAck = (event) => {
+                if (event.data?.type === 'smartlinks:authkit:login-acknowledged' &&
+                    event.data?.messageId === messageId) {
+                    window.removeEventListener('message', handleAck);
+                    clearTimeout(timeoutHandle);
+                    if (event.data.success) {
+                        console.log('[AuthContext] Parent acknowledged login successfully');
+                    }
+                    else {
+                        console.warn('[AuthContext] Parent rejected login:', event.data.error);
+                    }
+                    resolve();
+                }
+            };
+            const timeoutHandle = setTimeout(() => {
+                window.removeEventListener('message', handleAck);
+                console.warn('[AuthContext] Parent login acknowledgment timed out, proceeding anyway');
+                resolve(); // Don't block forever - fallback to current behavior
+            }, timeoutMs);
+            window.addEventListener('message', handleAck);
+            console.log('[AuthContext] Sending login to parent, awaiting acknowledgment:', messageId);
+            iframe.sendParentCustom('smartlinks:authkit:login', {
+                messageId,
+                token: authToken,
+                user: authUser,
+                accountData: authAccountData || null
+            });
+        });
+    };
+    const login = useCallback(async (authToken, authUser, authAccountData, isNewUser, expiresAt, waitForParentAck) => {
         try {
             // Only persist to storage in standalone mode
             if (!proxyMode) {
@@ -11861,12 +11896,20 @@ collectionId, enableContactSync, enableInteractionTracking, interactionAppId, in
             pendingVerificationRef.current = false;
             // Cross-iframe auth state synchronization
             if (iframe.isIframe()) {
-                console.log('[AuthContext] Notifying parent of login via postMessage');
-                iframe.sendParentCustom('smartlinks:authkit:login', {
-                    token: authToken,
-                    user: authUser,
-                    accountData: authAccountData || null
-                });
+                if (waitForParentAck) {
+                    // For deep-link flows: wait for parent to validate and persist session before redirect
+                    console.log('[AuthContext] Notifying parent of login and waiting for acknowledgment');
+                    await notifyParentLoginAndWait(authToken, authUser, authAccountData);
+                }
+                else {
+                    // For interactive flows: fire-and-forget is fine (no redirect follows)
+                    console.log('[AuthContext] Notifying parent of login via postMessage');
+                    iframe.sendParentCustom('smartlinks:authkit:login', {
+                        token: authToken,
+                        user: authUser,
+                        accountData: authAccountData || null
+                    });
+                }
             }
             notifyAuthStateChange('LOGIN', authUser, authToken, authAccountData || null, null, true);
             // Sync contact (non-blocking)
@@ -12192,7 +12235,7 @@ const useAuth = () => {
 };
 
 // VERSION: Update this when making changes to help identify which version is running
-const AUTH_UI_VERSION = '37';
+const AUTH_UI_VERSION = '41';
 const LOG_PREFIX = `[SmartlinksAuthUI:v${AUTH_UI_VERSION}]`;
 // Helper to calculate expiration from AuthResponse
 const getExpirationFromResponse = (response) => {
@@ -12707,7 +12750,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                         const authResponse = await api.loginWithGoogle(result.idToken);
                         if (authResponse.token) {
                             console.log(`${LOG_PREFIX} 🔇 Silent sign-in successful!`);
-                            auth.login(authResponse.token, authResponse.user, authResponse.accountData, false, getExpirationFromResponse(authResponse));
+                            await auth.login(authResponse.token, authResponse.user, authResponse.accountData, false, getExpirationFromResponse(authResponse));
                             setAuthSuccess(true);
                             setSuccessMessage('Signed in automatically with Google!');
                             onAuthSuccess(authResponse.token, authResponse.user, authResponse.accountData);
@@ -12779,18 +12822,30 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                 const verificationMode = response.emailVerificationMode || config?.emailVerification?.mode || 'verify-auto-login';
                 if ((verificationMode === 'verify-auto-login' || verificationMode === 'immediate') && response.token) {
                     // Auto-login modes: Log the user in immediately if token is provided
-                    auth.login(response.token, response.user, response.accountData, true, getExpirationFromResponse(response));
-                    setAuthSuccess(true);
-                    setSuccessMessage('Email verified successfully! You are now logged in.');
-                    onAuthSuccess(response.token, response.user, response.accountData);
-                    // Clear the URL parameters
+                    // In proxy mode, wait for parent to acknowledge (validate & persist) before redirect
+                    // MUST await to ensure session is ready before any redirect
+                    await auth.login(response.token, response.user, response.accountData, true, getExpirationFromResponse(response), proxyMode // waitForParentAck - ensures parent has validated/persisted before redirect
+                    );
+                    // Clean URL parameters regardless of redirect
                     const cleanUrl = window.location.href.split('?')[0];
                     window.history.replaceState({}, document.title, cleanUrl);
-                    // For email verification deep links, redirect immediately if configured
-                    // (user came from an email link, so redirect is expected behavior)
                     if (redirectUrl) {
+                        // Redirect to clean URL and resume flow
+                        // In proxy mode: parent already validated & persisted via acknowledgment in auth.login()
+                        // In standalone mode: session saved to IndexedDB, AuthContext will restore on reload
+                        // Either way: DON'T call onAuthSuccess (redirect wipes page state)
+                        log.log('Email verification complete, redirecting to:', redirectUrl);
                         performRedirect(redirectUrl, 'email-verified');
                     }
+                    else {
+                        // No redirect configured: show success UI
+                        setAuthSuccess(true);
+                        setSuccessMessage('Email verified successfully! You are now logged in.');
+                        if (!proxyMode) {
+                            // Only call onAuthSuccess in standalone mode (proxy mode used postMessage)
+                            onAuthSuccess(response.token, response.user, response.accountData);
+                        }
+                    }
                 }
                 else {
                     // verify-manual-login mode or no token: Show success but require manual login
@@ -12828,18 +12883,26 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                 const response = await api.verifyMagicLink(token);
                 // Auto-login with magic link if token is provided
                 if (response.token) {
-                    auth.login(response.token, response.user, response.accountData, true, getExpirationFromResponse(response));
-                    setAuthSuccess(true);
-                    setSuccessMessage('Magic link verified! You are now logged in.');
-                    onAuthSuccess(response.token, response.user, response.accountData);
-                    // Clear the URL parameters
+                    // In proxy mode, wait for parent to acknowledge (validate & persist) before redirect
+                    // MUST await to ensure session is ready before any redirect
+                    await auth.login(response.token, response.user, response.accountData, true, getExpirationFromResponse(response), proxyMode // waitForParentAck
+                    );
+                    // Clean URL parameters regardless of redirect
                     const cleanUrl = window.location.href.split('?')[0];
                     window.history.replaceState({}, document.title, cleanUrl);
-                    // For magic link deep links, redirect immediately if configured
-                    // (user came from an email link, so redirect is expected behavior)
                     if (redirectUrl) {
+                        // Redirect to clean URL and resume flow
+                        log.log('Magic link verification complete, redirecting to:', redirectUrl);
                         performRedirect(redirectUrl, 'magic-link');
                     }
+                    else {
+                        // No redirect configured: show success UI
+                        setAuthSuccess(true);
+                        setSuccessMessage('Magic link verified! You are now logged in.');
+                        if (!proxyMode) {
+                            onAuthSuccess(response.token, response.user, response.accountData);
+                        }
+                    }
                 }
                 else {
                     throw new Error('Authentication failed - no token received');
@@ -12897,7 +12960,8 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             // Exchange authorization code for tokens
             const response = await api.loginWithGoogleCode(code, redirectUri);
             if (response.token) {
-                auth.login(response.token, response.user, response.accountData, response.isNewUser, getExpirationFromResponse(response));
+                // Await login to ensure token is persisted before any navigation
+                await auth.login(response.token, response.user, response.accountData, response.isNewUser, getExpirationFromResponse(response));
                 setAuthSuccess(true);
                 setSuccessMessage('Google login successful!');
                 onAuthSuccess(response.token, response.user, response.accountData);
@@ -12945,7 +13009,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                 // Handle different verification modes
                 if (verificationMode === 'immediate' && response.token) {
                     // Immediate mode: Log in right away if token is provided (isNewUser=true for registration)
-                    auth.login(response.token, response.user, response.accountData, true, getExpirationFromResponse(response));
+                    await auth.login(response.token, response.user, response.accountData, true, getExpirationFromResponse(response));
                     setAuthSuccess(true);
                     const deadline = response.emailVerificationDeadline
                         ? new Date(response.emailVerificationDeadline).toLocaleString()
@@ -12999,7 +13063,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                     if (response.requiresEmailVerification) {
                         throw new Error('Please verify your email before logging in. Check your inbox for the verification link.');
                     }
-                    auth.login(response.token, response.user, response.accountData, false, getExpirationFromResponse(response));
+                    await auth.login(response.token, response.user, response.accountData, false, getExpirationFromResponse(response));
                     setAuthSuccess(true);
                     setSuccessMessage('Login successful!');
                     onAuthSuccess(response.token, response.user, response.accountData);
@@ -13059,14 +13123,23 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
         setLoading(true);
         setError(undefined);
         try {
-            await api.requestPasswordReset(resetRequestEmail, getRedirectUrl());
-            setAuthSuccess(true);
-            setSuccessMessage('Password reset email sent! Please check your inbox.');
+            const result = await api.requestPasswordReset(resetRequestEmail, getRedirectUrl());
+            // Use resetSuccess (not authSuccess) to show password reset confirmation, not "Login successful"
+            setResetSuccess(true);
+            // Use backend message if available, otherwise default
+            setSuccessMessage(result?.message || 'Password reset email sent! Please check your inbox.');
             setShowRequestNewReset(false);
             setResetRequestEmail('');
         }
         catch (err) {
-            const errorMessage = err instanceof Error ? err.message : 'Failed to send password reset email';
+            // Extract error message - handle both Error objects and API error responses
+            let errorMessage = 'Failed to send password reset email';
+            if (err instanceof Error) {
+                errorMessage = err.message;
+            }
+            else if (err && typeof err === 'object' && 'message' in err) {
+                errorMessage = err.message;
+            }
             setError(errorMessage);
             onAuthError?.(err instanceof Error ? err : new Error(errorMessage));
         }
@@ -13157,7 +13230,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                             });
                             if (authResponse.token) {
                                 console.log(`${LOG_PREFIX} 🎉 Login successful! Calling auth.login and onAuthSuccess...`);
-                                auth.login(authResponse.token, authResponse.user, authResponse.accountData, authResponse.isNewUser, getExpirationFromResponse(authResponse));
+                                await auth.login(authResponse.token, authResponse.user, authResponse.accountData, authResponse.isNewUser, getExpirationFromResponse(authResponse));
                                 setAuthSuccess(true);
                                 setSuccessMessage('Google login successful!');
                                 onAuthSuccess(authResponse.token, authResponse.user, authResponse.accountData);
@@ -13316,7 +13389,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                                 });
                                 if (authResponse.token) {
                                     // Google OAuth can be login or signup - use isNewUser flag from backend if available
-                                    auth.login(authResponse.token, authResponse.user, authResponse.accountData, authResponse.isNewUser, getExpirationFromResponse(authResponse));
+                                    await auth.login(authResponse.token, authResponse.user, authResponse.accountData, authResponse.isNewUser, getExpirationFromResponse(authResponse));
                                     setAuthSuccess(true);
                                     setSuccessMessage('Google login successful!');
                                     onAuthSuccess(authResponse.token, authResponse.user, authResponse.accountData);
@@ -13362,7 +13435,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                             const authResponse = await api.loginWithGoogle(idToken);
                             if (authResponse.token) {
                                 // Google OAuth can be login or signup - use isNewUser flag from backend if available
-                                auth.login(authResponse.token, authResponse.user, authResponse.accountData, authResponse.isNewUser, getExpirationFromResponse(authResponse));
+                                await auth.login(authResponse.token, authResponse.user, authResponse.accountData, authResponse.isNewUser, getExpirationFromResponse(authResponse));
                                 setAuthSuccess(true);
                                 setSuccessMessage('Google login successful!');
                                 onAuthSuccess(authResponse.token, authResponse.user, authResponse.accountData);
@@ -13419,11 +13492,22 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                 // Update auth context with account data if token is provided
                 if (response.token) {
                     // Phone auth can be login or signup - use isNewUser flag from backend if available
-                    auth.login(response.token, response.user, response.accountData, response.isNewUser, getExpirationFromResponse(response));
-                    onAuthSuccess(response.token, response.user, response.accountData);
+                    // In proxy mode, wait for parent to acknowledge (validate & persist) before redirect
+                    await auth.login(response.token, response.user, response.accountData, response.isNewUser, getExpirationFromResponse(response), proxyMode // waitForParentAck
+                    );
                     if (redirectUrl) {
+                        // Redirect to clean URL and resume flow
+                        log.log('Phone verification complete, redirecting to:', redirectUrl);
                         performRedirect(redirectUrl, 'phone-verified');
                     }
+                    else {
+                        // No redirect configured: show success UI
+                        setAuthSuccess(true);
+                        setSuccessMessage('Phone verified! You are now logged in.');
+                        if (!proxyMode) {
+                            onAuthSuccess(response.token, response.user, response.accountData);
+                        }
+                    }
                 }
                 else {
                     throw new Error('Authentication failed - no token received');
@@ -13461,7 +13545,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                     try {
                         const loginResponse = await api.login(resetEmail, emailOrPassword);
                         if (loginResponse.token) {
-                            auth.login(loginResponse.token, loginResponse.user, loginResponse.accountData, false);
+                            await auth.login(loginResponse.token, loginResponse.user, loginResponse.accountData, false);
                             setAuthSuccess(true);
                             setSuccessMessage('Password reset successful! You are now signed in.');
                             onAuthSuccess(loginResponse.token, loginResponse.user, loginResponse.accountData);