@proveanything/smartlinks-auth-ui 0.4.5 → 0.4.7

package/dist/index.esm.js

@@ -258,7 +258,7 @@ const AuthModeToggle = ({ mode, onModeChange, disabled = false, }) => {
     return (jsxs("div", { className: "auth-mode-toggle", role: "tablist", "aria-label": "Authentication mode", children: [jsx("button", { type: "button", role: "tab", "aria-selected": mode === 'login', className: `auth-mode-toggle-button ${mode === 'login' ? 'auth-mode-toggle-button--active' : ''}`, onClick: () => onModeChange('login'), disabled: disabled, children: "Sign In" }), jsx("button", { type: "button", role: "tab", "aria-selected": mode === 'register', className: `auth-mode-toggle-button ${mode === 'register' ? 'auth-mode-toggle-button--active' : ''}`, onClick: () => onModeChange('register'), disabled: disabled, children: "Create Account" })] }));
 };
 
-const EmailAuthForm = ({ mode, onSubmit, onModeSwitch, onForgotPassword, loading, error, signupProminence = 'minimal', schema, registrationFieldsConfig = [], additionalFields = [], }) => {
+const EmailAuthForm = ({ mode, onSubmit, onModeSwitch, onForgotPassword, loading, error, signupProminence = 'minimal', signupRedirectUrl, schema, registrationFieldsConfig = [], additionalFields = [], }) => {
     const [formData, setFormData] = useState({
         email: '',
         password: '',
@@ -314,7 +314,7 @@ const EmailAuthForm = ({ mode, onSubmit, onModeSwitch, onForgotPassword, loading
                     if (newMode !== mode) {
                         onModeSwitch();
                     }
-                }, disabled: loading })), jsxs("div", { className: "auth-form-header", children: [jsx("h2", { className: "auth-form-title", children: title }), jsx("p", { className: "auth-form-subtitle", children: subtitle })] }), error && (jsxs("div", { className: "auth-error", role: "alert", children: [jsx("svg", { width: "16", height: "16", viewBox: "0 0 16 16", fill: "currentColor", children: jsx("path", { d: "M8 0C3.58 0 0 3.58 0 8s3.58 8 8 8 8-3.58 8-8-3.58-8-8-8zm1 13H7v-2h2v2zm0-3H7V4h2v6z" }) }), error] })), mode === 'register' && (jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "displayName", className: "auth-label", children: "Full Name" }), jsx("input", { type: "text", id: "displayName", className: "auth-input", value: formData.displayName || '', onChange: (e) => handleChange('displayName', e.target.value), required: mode === 'register', disabled: loading, placeholder: "John Smith" })] })), jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "email", className: "auth-label", children: "Email address" }), jsx("input", { type: "email", id: "email", className: "auth-input", value: formData.email || '', onChange: (e) => handleChange('email', e.target.value), required: true, disabled: loading, placeholder: "you@example.com", autoComplete: "email" })] }), jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "password", className: "auth-label", children: "Password" }), jsx("input", { type: "password", id: "password", className: "auth-input", value: formData.password || '', onChange: (e) => handleChange('password', e.target.value), required: true, disabled: loading, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", autoComplete: mode === 'login' ? 'current-password' : 'new-password', minLength: 6 })] }), mode === 'register' && hasSchemaFields && schemaFields.inline.map(renderSchemaField), mode === 'register' && hasLegacyFields && additionalFields.map(renderLegacyField), mode === 'register' && hasSchemaFields && schemaFields.postCredentials.length > 0 && (jsxs(Fragment, { children: [jsx("div", { className: "auth-divider", style: { margin: '16px 0' }, children: jsx("span", { children: "Additional Information" }) }), schemaFields.postCredentials.map(renderSchemaField)] })), mode === 'login' && (jsx("div", { className: "auth-form-footer", children: jsx("button", { type: "button", className: "auth-link", onClick: onForgotPassword, disabled: loading, children: "Forgot password?" }) })), jsx("button", { type: "submit", className: "auth-button auth-button-primary", disabled: loading, children: loading ? (jsx("span", { className: "auth-spinner" })) : mode === 'login' ? ('Sign in') : ('Create account') }), signupProminence !== 'balanced' && (jsxs("div", { className: "auth-divider", children: [jsx("span", { children: mode === 'login' ? "Don't have an account?" : 'Already have an account?' }), jsx("button", { type: "button", className: "auth-link auth-link-bold", onClick: onModeSwitch, disabled: loading, children: mode === 'login' ? 'Sign up' : 'Sign in' })] }))] }));
+                }, disabled: loading })), jsxs("div", { className: "auth-form-header", children: [jsx("h2", { className: "auth-form-title", children: title }), jsx("p", { className: "auth-form-subtitle", children: subtitle })] }), error && (jsxs("div", { className: "auth-error", role: "alert", children: [jsx("svg", { width: "16", height: "16", viewBox: "0 0 16 16", fill: "currentColor", children: jsx("path", { d: "M8 0C3.58 0 0 3.58 0 8s3.58 8 8 8 8-3.58 8-8-3.58-8-8-8zm1 13H7v-2h2v2zm0-3H7V4h2v6z" }) }), error] })), mode === 'register' && (jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "displayName", className: "auth-label", children: "Full Name" }), jsx("input", { type: "text", id: "displayName", className: "auth-input", value: formData.displayName || '', onChange: (e) => handleChange('displayName', e.target.value), required: mode === 'register', disabled: loading, placeholder: "John Smith" })] })), jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "email", className: "auth-label", children: "Email address" }), jsx("input", { type: "email", id: "email", className: "auth-input", value: formData.email || '', onChange: (e) => handleChange('email', e.target.value), required: true, disabled: loading, placeholder: "you@example.com", autoComplete: "email" })] }), jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "password", className: "auth-label", children: "Password" }), jsx("input", { type: "password", id: "password", className: "auth-input", value: formData.password || '', onChange: (e) => handleChange('password', e.target.value), required: true, disabled: loading, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", autoComplete: mode === 'login' ? 'current-password' : 'new-password', minLength: 6 })] }), mode === 'register' && hasSchemaFields && schemaFields.inline.map(renderSchemaField), mode === 'register' && hasLegacyFields && additionalFields.map(renderLegacyField), mode === 'register' && hasSchemaFields && schemaFields.postCredentials.length > 0 && (jsxs(Fragment, { children: [jsx("div", { className: "auth-divider", style: { margin: '16px 0' }, children: jsx("span", { children: "Additional Information" }) }), schemaFields.postCredentials.map(renderSchemaField)] })), mode === 'login' && (jsx("div", { className: "auth-form-footer", children: jsx("button", { type: "button", className: "auth-link", onClick: onForgotPassword, disabled: loading, children: "Forgot password?" }) })), jsx("button", { type: "submit", className: "auth-button auth-button-primary", disabled: loading, children: loading ? (jsx("span", { className: "auth-spinner" })) : mode === 'login' ? ('Sign in') : ('Create account') }), signupProminence !== 'balanced' && signupProminence !== 'none' && (jsxs("div", { className: "auth-divider", children: [jsx("span", { children: mode === 'login' ? "Don't have an account?" : 'Already have an account?' }), signupRedirectUrl && mode === 'login' ? (jsx("a", { href: signupRedirectUrl, target: "_top", className: "auth-link auth-link-bold", children: "Sign up" })) : (jsx("button", { type: "button", className: "auth-link auth-link-bold", onClick: onModeSwitch, disabled: loading, children: mode === 'login' ? 'Sign up' : 'Sign in' }))] }))] }));
 };
 
 const ProviderButtons = ({ enabledProviders, providerOrder, onEmailLogin, onGoogleLogin, onPhoneLogin, onMagicLinkLogin, loading, }) => {
@@ -10811,7 +10811,7 @@ const PhoneAuthForm = ({ onSubmit, onBack, loading, error, }) => {
                                 : 'Resend code' }) })] })), jsx("button", { type: "submit", className: "auth-button auth-button-primary", disabled: loading, children: loading ? (jsx("span", { className: "auth-spinner" })) : codeSent ? ('Verify Code') : ('Send Code') }), jsx("div", { className: "auth-divider", children: jsx("button", { type: "button", className: "auth-link auth-link-bold", onClick: onBack, disabled: loading, children: "\u2190 Back to login" }) })] }));
 };
 
-const PasswordResetForm = ({ onSubmit, onBack, loading, error, success, successMessage, token, }) => {
+const PasswordResetForm = ({ onSubmit, onBack, loading, error, success, successMessage, token, resetEmail, }) => {
     const [email, setEmail] = useState('');
     const [password, setPassword] = useState('');
     const [confirmPassword, setConfirmPassword] = useState('');
@@ -10836,14 +10836,14 @@ const PasswordResetForm = ({ onSubmit, onBack, loading, error, success, successM
             await onSubmit(email);
         }
     };
-    if (success) {
+    if (success && !error) {
         return (jsxs("div", { className: "auth-form", children: [jsxs("div", { className: "auth-form-header", children: [jsx("div", { style: { textAlign: 'center', marginBottom: '1rem' }, children: jsxs("svg", { width: "64", height: "64", viewBox: "0 0 64 64", fill: "none", style: { margin: '0 auto' }, children: [jsx("circle", { cx: "32", cy: "32", r: "32", fill: "#10b981", fillOpacity: "0.1" }), jsx("path", { d: "M20 32l8 8 16-16", stroke: "#10b981", strokeWidth: "4", strokeLinecap: "round", strokeLinejoin: "round" })] }) }), jsx("h2", { className: "auth-form-title", children: token ? 'Password reset!' : 'Check your email' }), jsx("p", { className: "auth-form-subtitle", children: token
                                 ? (successMessage || 'Your password has been successfully reset. You can now sign in with your new password.')
                                 : (successMessage || `We've sent password reset instructions to ${email}`) })] }), jsx("button", { type: "button", className: "auth-button auth-button-primary", onClick: onBack, children: "Back to Sign in" })] }));
     }
     return (jsxs("form", { className: "auth-form", onSubmit: handleSubmit, children: [jsxs("div", { className: "auth-form-header", children: [jsx("h2", { className: "auth-form-title", children: token ? 'Set new password' : 'Reset your password' }), jsx("p", { className: "auth-form-subtitle", children: token
                             ? 'Enter your new password below.'
-                            : "Enter your email address and we'll send you instructions to reset your password." })] }), (error || passwordError) && (jsxs("div", { className: "auth-error", role: "alert", children: [jsx("svg", { width: "16", height: "16", viewBox: "0 0 16 16", fill: "currentColor", children: jsx("path", { d: "M8 0C3.58 0 0 3.58 0 8s3.58 8 8 8 8-3.58 8-8-3.58-8-8-8zm1 13H7v-2h2v2zm0-3H7V4h2v6z" }) }), error || passwordError] })), token ? (jsxs(Fragment, { children: [jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "password", className: "auth-label", children: "New Password" }), jsx("input", { type: "password", id: "password", className: "auth-input", value: password, onChange: (e) => setPassword(e.target.value), required: true, disabled: loading, placeholder: "Enter new password", autoComplete: "new-password", minLength: 6 })] }), jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "confirmPassword", className: "auth-label", children: "Confirm Password" }), jsx("input", { type: "password", id: "confirmPassword", className: "auth-input", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, disabled: loading, placeholder: "Confirm new password", autoComplete: "new-password", minLength: 6 })] })] })) : (jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "email", className: "auth-label", children: "Email address" }), jsx("input", { type: "email", id: "email", className: "auth-input", value: email, onChange: (e) => setEmail(e.target.value), required: true, disabled: loading, placeholder: "you@example.com", autoComplete: "email" })] })), jsx("button", { type: "submit", className: "auth-button auth-button-primary", disabled: loading, children: loading ? (jsx("span", { className: "auth-spinner" })) : token ? ('Reset password') : ('Send reset instructions') }), jsx("div", { className: "auth-divider", children: jsx("button", { type: "button", className: "auth-link auth-link-bold", onClick: onBack, disabled: loading, children: "\u2190 Back to Sign in" }) })] }));
+                            : "Enter your email address and we'll send you instructions to reset your password." })] }), (error || passwordError) && (jsxs("div", { className: "auth-error", role: "alert", children: [jsx("svg", { width: "16", height: "16", viewBox: "0 0 16 16", fill: "currentColor", children: jsx("path", { d: "M8 0C3.58 0 0 3.58 0 8s3.58 8 8 8 8-3.58 8-8-3.58-8-8-8zm1 13H7v-2h2v2zm0-3H7V4h2v6z" }) }), error || passwordError] })), token ? (jsxs(Fragment, { children: [resetEmail && (jsx("input", { type: "email", value: resetEmail, readOnly: true, autoComplete: "username", style: { position: 'absolute', opacity: 0, height: 0, width: 0, overflow: 'hidden', pointerEvents: 'none' }, tabIndex: -1, "aria-hidden": "true" })), jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "password", className: "auth-label", children: "New Password" }), jsx("input", { type: "password", id: "password", className: "auth-input", value: password, onChange: (e) => setPassword(e.target.value), required: true, disabled: loading, placeholder: "Enter new password", autoComplete: "new-password", minLength: 6 })] }), jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "confirmPassword", className: "auth-label", children: "Confirm Password" }), jsx("input", { type: "password", id: "confirmPassword", className: "auth-input", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), required: true, disabled: loading, placeholder: "Confirm new password", autoComplete: "new-password", minLength: 6 })] })] })) : (jsxs("div", { className: "auth-form-group", children: [jsx("label", { htmlFor: "email", className: "auth-label", children: "Email address" }), jsx("input", { type: "email", id: "email", className: "auth-input", value: email, onChange: (e) => setEmail(e.target.value), required: true, disabled: loading, placeholder: "you@example.com", autoComplete: "email" })] })), jsx("button", { type: "submit", className: "auth-button auth-button-primary", disabled: loading, children: loading ? (jsx("span", { className: "auth-spinner" })) : token ? ('Reset password') : ('Send reset instructions') }), jsx("div", { className: "auth-divider", children: jsx("button", { type: "button", className: "auth-link auth-link-bold", onClick: onBack, disabled: loading, children: "\u2190 Back to Sign in" }) })] }));
 };
 
 const MagicLinkForm = ({ onSubmit, onCancel, loading = false, error, }) => {
@@ -10949,14 +10949,46 @@ class AuthAPI {
         return smartlinks.authKit.verifyPhoneCode(this.clientId, phoneNumber, code);
     }
     async requestPasswordReset(email, redirectUrl) {
-        return smartlinks.authKit.requestPasswordReset(this.clientId, {
-            email,
-            redirectUrl,
-            clientName: this.clientName
-        });
+        console.log('[AuthKit:API] requestPasswordReset called', { clientId: this.clientId, email, redirectUrl });
+        try {
+            const result = await smartlinks.authKit.requestPasswordReset(this.clientId, {
+                email,
+                redirectUrl,
+                clientName: this.clientName
+            });
+            console.log('[AuthKit:API] requestPasswordReset resolved:', JSON.stringify(result));
+            return result;
+        }
+        catch (error) {
+            const err = error;
+            console.error('[AuthKit:API] requestPasswordReset threw:', {
+                type: typeof error,
+                message: err?.message,
+                statusCode: err?.statusCode ?? err?.response?.status,
+                errorCode: err?.errorCode ?? err?.details?.errorCode,
+                details: err?.details ?? err?.response?.data,
+                keys: err ? Object.keys(err) : [],
+            });
+            throw error;
+        }
     }
     async verifyResetToken(token) {
-        return smartlinks.authKit.verifyResetToken(this.clientId, token);
+        console.log('[AuthKit:API] verifyResetToken called');
+        try {
+            const result = await smartlinks.authKit.verifyResetToken(this.clientId, token);
+            console.log('[AuthKit:API] verifyResetToken resolved:', JSON.stringify(result));
+            return result;
+        }
+        catch (error) {
+            const err = error;
+            console.error('[AuthKit:API] verifyResetToken threw:', {
+                type: typeof error,
+                message: err?.message,
+                statusCode: err?.statusCode ?? err?.response?.status,
+                errorCode: err?.errorCode ?? err?.details?.errorCode,
+            });
+            throw error;
+        }
     }
     async completePasswordReset(token, newPassword) {
         return smartlinks.authKit.completePasswordReset(this.clientId, token, newPassword);
@@ -10992,7 +11024,6 @@ class AuthAPI {
             this.log.warn('Failed to fetch UI config, using defaults:', error);
             return {
                 branding: {
-                    title: 'Smartlinks Auth',
                     subtitle: 'Sign in to your account',
                     primaryColor: '#3B82F6',
                     secondaryColor: '#1D4ED8',
@@ -12388,6 +12419,10 @@ function getFriendlyErrorMessage(error) {
     if (isApiErrorLike(error)) {
         // First, check for specific error code (most precise)
         const errorCode = error.errorCode || error.details?.errorCode || error.details?.error;
+        // For rate-limit errors, prefer the backend's message as it includes specific wait times
+        if (errorCode === 'RATE_LIMIT_EXCEEDED' && error.message && error.message !== '[object Object]') {
+            return error.message;
+        }
         if (errorCode && ERROR_CODE_MESSAGES[errorCode]) {
             return ERROR_CODE_MESSAGES[errorCode];
         }
@@ -12395,6 +12430,10 @@ function getFriendlyErrorMessage(error) {
         if (error.statusCode >= 500) {
             return 'Server error. Please try again later.';
         }
+        // For 429 status, prefer backend message (may include wait time)
+        if (error.statusCode === 429 && error.message && error.message !== '[object Object]') {
+            return error.message;
+        }
         if (STATUS_MESSAGES[error.statusCode]) {
             return STATUS_MESSAGES[error.statusCode];
         }
@@ -12521,7 +12560,7 @@ function requiresEmailVerification(error) {
 }
 
 // VERSION: Update this when making changes to help identify which version is running
-const AUTH_UI_VERSION = '44';
+const AUTH_UI_VERSION = '46';
 const LOG_PREFIX = `[SmartlinksAuthUI:v${AUTH_UI_VERSION}]`;
 // Helper to check for URL auth params synchronously (runs during initialization)
 // This prevents the form from flashing before detecting deep-link flows
@@ -12545,6 +12584,24 @@ const getExpirationFromResponse = (response) => {
         return Date.now() + response.expiresIn;
     return undefined; // Will use 7-day default in tokenStorage
 };
+const getActionResultErrorMessage = (result) => {
+    if (!result || typeof result !== 'object')
+        return null;
+    const candidate = result;
+    const numericStatusCode = typeof candidate.statusCode === 'string'
+        ? Number(candidate.statusCode)
+        : candidate.statusCode;
+    const hasFailureStatus = typeof numericStatusCode === 'number' && !Number.isNaN(numericStatusCode) && numericStatusCode >= 400;
+    const isFailure = candidate.success === false || candidate.ok === false || !!candidate.errorCode || hasFailureStatus;
+    if (!isFailure)
+        return null;
+    return getFriendlyErrorMessage({
+        statusCode: hasFailureStatus ? numericStatusCode : 400,
+        errorCode: candidate.errorCode,
+        message: candidate.message || 'Request failed. Please try again.',
+        details: candidate.details,
+    });
+};
 // Default Smartlinks Google OAuth Client ID (public - safe to expose)
 const DEFAULT_GOOGLE_CLIENT_ID = '696509063554-jdlbjl8vsjt7cr0vgkjkjf3ffnvi3a70.apps.googleusercontent.com';
 // Default Google OAuth proxy URL (hosted on our whitelisted domain)
@@ -12636,6 +12693,43 @@ const getNativeBridge = () => {
         return native;
     return null;
 };
+// Helper to register an AuthKit.onAuthResult handler for a specific callbackId
+// The Android native app calls: window.AuthKit.onAuthResult(resultJson)
+const registerAuthKitCallback = (callbackId, onResult, timeoutMs = 5000, onTimeout) => {
+    const bridge = window.AuthKit;
+    if (!bridge) {
+        console.warn('[AuthKit] No AuthKit bridge found, cannot register callback');
+        onTimeout?.();
+        return () => { };
+    }
+    // Store the previous handler so we can restore on cleanup
+    const previousHandler = bridge.onAuthResult;
+    const timeout = setTimeout(() => {
+        // Restore previous handler on timeout
+        bridge.onAuthResult = previousHandler;
+        onTimeout?.();
+    }, timeoutMs);
+    bridge.onAuthResult = (resultOrJson) => {
+        const result = typeof resultOrJson === 'string' ? JSON.parse(resultOrJson) : resultOrJson;
+        // Match by callbackId if present, otherwise accept any result
+        if (result.callbackId && result.callbackId !== callbackId) {
+            // Not for us — pass through to previous handler if any
+            if (typeof previousHandler === 'function') {
+                previousHandler(resultOrJson);
+            }
+            return;
+        }
+        clearTimeout(timeout);
+        // Restore previous handler
+        bridge.onAuthResult = previousHandler;
+        onResult(result);
+    };
+    // Return cleanup function
+    return () => {
+        clearTimeout(timeout);
+        bridge.onAuthResult = previousHandler;
+    };
+};
 // Sign out from Google on the native side (clears cached Google account)
 // This is fire-and-forget with a timeout - gracefully degrades if not supported
 const signOutGoogleNative = async () => {
@@ -12644,21 +12738,7 @@ const signOutGoogleNative = async () => {
         return;
     const callbackId = `google_signout_${Date.now()}`;
     return new Promise((resolve) => {
-        const timeout = setTimeout(() => resolve(), 3000);
-        // Store original callback to restore later
-        const originalCallback = window.smartlinksNativeCallback;
-        window.smartlinksNativeCallback = (result) => {
-            if (result.callbackId === callbackId) {
-                clearTimeout(timeout);
-                // Restore original callback
-                window.smartlinksNativeCallback = originalCallback;
-                resolve();
-            }
-            else if (originalCallback) {
-                // Pass through to original callback for other messages
-                originalCallback(result);
-            }
-        };
+        registerAuthKitCallback(callbackId, () => resolve(), 3000, () => resolve());
         const payload = JSON.stringify({
             type: 'GOOGLE_SIGN_OUT',
             callbackId,
@@ -12672,44 +12752,32 @@ const checkSilentGoogleSignIn = async (clientId, googleClientId) => {
         return null;
     const callbackId = `google_check_${Date.now()}`;
     return new Promise((resolve) => {
-        const timeout = setTimeout(() => resolve(null), 5000);
-        // Store original callback to restore later
-        const originalCallback = window.smartlinksNativeCallback;
-        window.smartlinksNativeCallback = (result) => {
-            if (result.callbackId === callbackId) {
-                clearTimeout(timeout);
-                // Restore original callback
-                window.smartlinksNativeCallback = originalCallback;
-                if (result.success) {
-                    resolve({
-                        isSignedIn: result.isSignedIn || false,
-                        idToken: result.idToken,
-                        email: result.email,
-                        name: result.name,
-                        picture: result.picture,
-                    });
-                }
-                else {
-                    resolve(null);
-                }
+        registerAuthKitCallback(callbackId, (result) => {
+            if (result.success) {
+                resolve({
+                    isSignedIn: result.isSignedIn || false,
+                    idToken: result.idToken,
+                    email: result.email,
+                    name: result.name,
+                    picture: result.picture,
+                });
             }
-            else if (originalCallback) {
-                // Pass through to original callback for other messages
-                originalCallback(result);
+            else {
+                resolve(null);
             }
-        };
+        }, 5000, () => resolve(null));
         const payload = JSON.stringify({
             type: 'GOOGLE_CHECK_SIGN_IN',
             clientId,
             googleClientId,
-            serverClientId: googleClientId, // Alias for Android SDK
+            serverClientId: googleClientId,
             callbackId,
         });
         nativeBridge.checkGoogleSignIn(payload);
     });
 };
 // getFriendlyErrorMessage is now imported from ../utils/errorHandling
-const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAuthSuccess, onAuthError, onRedirect, enabledProviders = ['email', 'google', 'phone'], initialMode, signupProminence, redirectUrl, theme = 'auto', className, customization, skipConfigFetch = false, minimal = false, logger, proxyMode = false, collectionId, disableConfigCache = false, enableSilentGoogleSignIn = false, }) => {
+const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAuthSuccess, onAuthError, onRedirect, enabledProviders = ['email', 'google', 'phone'], initialMode, signupProminence, redirectUrl, theme = 'light', className, customization, skipConfigFetch = false, minimal = false, logger, proxyMode = false, collectionId, disableConfigCache = false, enableSilentGoogleSignIn = false, }) => {
     // Resolve signup prominence from props, customization, config, or default
     const resolvedSignupProminence = signupProminence || customization?.signupProminence || 'minimal';
     // Determine initial mode based on signupProminence setting
@@ -12746,6 +12814,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
     const [contactSchema, setContactSchema] = useState(null); // Schema for registration fields
     const [silentSignInChecked, setSilentSignInChecked] = useState(false); // Track if silent sign-in has been checked
     const [googleFallbackToPopup, setGoogleFallbackToPopup] = useState(false); // Show popup fallback when FedCM is blocked/dismissed
+    const [googleNativeTimedOut, setGoogleNativeTimedOut] = useState(false); // Native bridge callback timed out
     const log = useMemo(() => createLoggerWrapper(logger), [logger]);
     const api = new AuthAPI(apiEndpoint, clientId, clientName, logger);
     const auth = useAuth();
@@ -13022,6 +13091,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             if (urlMode === 'verifyEmail') {
                 log.log('Verifying email with token:', token);
                 const response = await api.verifyEmailWithToken(token);
+                log.log('Email verification response:', { hasToken: !!response.token, hasUser: !!response.user, emailVerificationMode: response.emailVerificationMode, isNewUser: response.isNewUser });
                 // Get email verification mode from response or config
                 const verificationMode = response.emailVerificationMode || config?.emailVerification?.mode || 'verify-auto-login';
                 if ((verificationMode === 'verify-auto-login' || verificationMode === 'immediate') && response.token) {
@@ -13066,9 +13136,9 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                 log.log('Verifying reset token:', token);
                 // Verify token is valid, then show password reset form
                 const verifyResult = await api.verifyResetToken(token);
-                // Check if token is valid before proceeding
-                if (!verifyResult.valid) {
-                    throw new Error(verifyResult.message || 'Invalid or expired token');
+                // Guard against undefined result (proxy mode may resolve without data)
+                if (!verifyResult || !verifyResult.valid) {
+                    throw new Error(verifyResult?.message || 'Invalid or expired token');
                 }
                 setUrlAuthProcessing(false); // Clear processing state - showing reset form
                 setResetToken(token); // Store token for use in password reset
@@ -13083,6 +13153,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             else if (urlMode === 'magicLink') {
                 log.log('Verifying magic link token:', token);
                 const response = await api.verifyMagicLink(token);
+                log.log('Magic link verification response:', { hasToken: !!response.token, hasUser: !!response.user, isNewUser: response.isNewUser });
                 // Auto-login with magic link if token is provided
                 if (response.token) {
                     // Always await - auth.login now waits for parent ack automatically in iframe mode
@@ -13158,6 +13229,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             const redirectUri = state.redirectUri || window.location.origin + window.location.pathname;
             // Exchange authorization code for tokens
             const response = await api.loginWithGoogleCode(code, redirectUri);
+            log.log('Google OAuth code exchange response:', { hasToken: !!response.token, hasUser: !!response.user, isNewUser: response.isNewUser });
             if (response.token) {
                 // Await login to ensure token is persisted before any navigation
                 await auth.login(response.token, response.user, response.accountData, response.isNewUser, getExpirationFromResponse(response));
@@ -13188,13 +13260,15 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
         setError(undefined);
         setAuthSuccess(false);
         try {
+            log.log('Submitting email auth:', { mode, email: data.email });
             const response = mode === 'login'
                 ? await api.login(data.email, data.password)
                 : await api.register({
                     ...data,
                     accountData: mode === 'register' ? accountData : undefined,
-                    redirectUrl: getRedirectUrl(), // Include redirect URL for email verification
+                    redirectUrl: getRedirectUrl(),
                 });
+            log.log('Email auth response:', { mode, hasToken: !!response?.token, hasUser: !!response?.user, isNewUser: response?.isNewUser, requiresEmailVerification: response?.requiresEmailVerification, accountLocked: response?.accountLocked, emailVerificationMode: response?.emailVerificationMode });
             // Defensive check: validate response before accessing properties
             // SDK should throw on 401/error responses, but handle edge cases gracefully
             if (!response) {
@@ -13342,17 +13416,46 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             return;
         setLoading(true);
         setError(undefined);
+        setAuthSuccess(false);
+        setResetSuccess(false);
+        setSuccessMessage(undefined);
+        setShowResendVerification(false);
         try {
             const result = await api.requestPasswordReset(resetRequestEmail, getRedirectUrl());
-            // Use resetSuccess (not authSuccess) to show password reset confirmation, not "Login successful"
+            const resultError = getActionResultErrorMessage(result);
+            if (resultError) {
+                setAuthSuccess(false);
+                setResetSuccess(false);
+                setSuccessMessage(undefined);
+                setError(resultError);
+                setShowRequestNewReset(true);
+                return;
+            }
+            const resultAny = result;
+            const isConfirmedSuccess = result && (resultAny.success === true ||
+                resultAny.ok === true ||
+                (resultAny.message && !resultAny.errorCode && !resultAny.statusCode));
+            if (!isConfirmedSuccess) {
+                setAuthSuccess(false);
+                setResetSuccess(false);
+                setSuccessMessage(undefined);
+                setError(resultAny?.message || 'Unable to send password reset email. Please try again.');
+                setShowRequestNewReset(true);
+                return;
+            }
+            setAuthSuccess(false);
+            setMode('reset-password');
             setResetSuccess(true);
-            // Use backend message if available, otherwise default
             setSuccessMessage(result?.message || 'Password reset email sent! Please check your inbox.');
             setShowRequestNewReset(false);
             setResetRequestEmail('');
         }
         catch (err) {
+            setAuthSuccess(false);
+            setResetSuccess(false);
+            setSuccessMessage(undefined);
             setError(getFriendlyErrorMessage(err));
+            setShowRequestNewReset(true);
             onAuthError?.(err instanceof Error ? err : new Error(getFriendlyErrorMessage(err)));
         }
         finally {
@@ -13407,21 +13510,20 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             if (nativeBridge) {
                 log.log('Using native bridge for Google Sign-In');
                 const callbackId = `google_auth_${Date.now()}`;
-                window.smartlinksNativeCallback = async (result) => {
-                    // Ignore stale callbacks
-                    if (result.callbackId !== callbackId) {
-                        log.log('Ignoring stale native callback:', result.callbackId);
-                        return;
-                    }
-                    log.log('Native callback received:', {
+                // Register callback via AuthKit.onAuthResult (the native app calls this)
+                const cleanup = registerAuthKitCallback(callbackId, async (result) => {
+                    log.log('Native Google auth result received:', {
                         success: result.success,
                         hasIdToken: !!result.idToken,
                         email: result.email,
                         error: result.error,
+                        callbackId: result.callbackId,
                     });
+                    setGoogleNativeTimedOut(false);
                     try {
                         if (result.success && result.idToken) {
                             const authResponse = await api.loginWithGoogle(result.idToken);
+                            log.log('Native Google login response:', { hasToken: !!authResponse.token, hasUser: !!authResponse.user, isNewUser: authResponse.isNewUser });
                             if (authResponse.token) {
                                 await auth.login(authResponse.token, authResponse.user, authResponse.accountData, authResponse.isNewUser, getExpirationFromResponse(authResponse));
                                 setAuthSuccess(true);
@@ -13444,7 +13546,12 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                     finally {
                         setLoading(false);
                     }
-                };
+                }, 30000, // 30s timeout for interactive Google Sign-In
+                () => {
+                    log.log('Native Google Sign-In timed out after 30s');
+                    setLoading(false);
+                    setGoogleNativeTimedOut(true);
+                });
                 const payloadObj = {
                     type: 'GOOGLE_SIGN_IN',
                     clientId,
@@ -13456,12 +13563,13 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                     requestServerAuthCode: false,
                 };
                 const payload = JSON.stringify(payloadObj);
-                log.log('Invoking native signInWithGoogle');
+                log.log('Invoking native signInWithGoogle with callbackId:', callbackId);
                 try {
                     nativeBridge.signInWithGoogle(payload);
                 }
                 catch (invokeError) {
                     console.error(`${LOG_PREFIX} Exception invoking signInWithGoogle:`, invokeError);
+                    cleanup(); // Clean up the callback registration
                     throw invokeError;
                 }
                 // Don't set loading to false - waiting for native callback
@@ -13506,6 +13614,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                     clearInterval(checkClosed);
                     try {
                         if (event.data.success && event.data.token) {
+                            log.log('Google proxy result received:', { success: true, hasUser: !!event.data.user, isNewUser: event.data.isNewUser });
                             const { token, user, accountData, isNewUser, expiresAt, expiresIn } = event.data;
                             const expiration = expiresAt || (expiresIn ? Date.now() + expiresIn : undefined);
                             await auth.login(token, user, accountData, isNewUser, expiration);
@@ -13633,6 +13742,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                                     googleUserInfo: userInfo,
                                     tokenType: 'access_token',
                                 });
+                                log.log('Popup Google login response:', { hasToken: !!authResponse.token, hasUser: !!authResponse.user, isNewUser: authResponse.isNewUser });
                                 if (authResponse.token) {
                                     // Google OAuth can be login or signup - use isNewUser flag from backend if available
                                     await auth.login(authResponse.token, authResponse.user, authResponse.accountData, authResponse.isNewUser, getExpirationFromResponse(authResponse));
@@ -13672,12 +13782,17 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                     client_id: googleClientId,
                     origin: window.location.origin,
                 });
+                // Track whether the credential callback has fired (user selected an account)
+                // so we don't show the "blocked" fallback when the prompt closes after a successful selection
+                let credentialCallbackFired = false;
                 google.accounts.id.initialize({
                     client_id: googleClientId,
                     callback: async (response) => {
+                        credentialCallbackFired = true;
                         try {
                             const idToken = response.credential;
                             const authResponse = await api.loginWithGoogle(idToken);
+                            log.log('OneTap Google login response:', { hasToken: !!authResponse.token, hasUser: !!authResponse.user, isNewUser: authResponse.isNewUser });
                             if (authResponse.token) {
                                 // Google OAuth can be login or signup - use isNewUser flag from backend if available
                                 await auth.login(authResponse.token, authResponse.user, authResponse.accountData, authResponse.isNewUser, getExpirationFromResponse(authResponse));
@@ -13701,23 +13816,29 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                     cancel_on_tap_outside: true,
                     use_fedcm_for_prompt: true, // Enable FedCM for future browser compatibility
                 });
-                // Use timeout fallback — if no prompt interaction after 5s, assume FedCM was blocked
+                // Use timeout fallback — if no prompt interaction after 15s, assume FedCM was blocked
+                // (15s gives users enough time to choose a Google account from the picker)
                 const promptTimeout = setTimeout(() => {
+                    if (credentialCallbackFired)
+                        return; // Auth is already in progress, don't show fallback
                     log.log('Google OneTap prompt timed out — FedCM may be blocked or unavailable');
                     setGoogleFallbackToPopup(true);
                     setLoading(false);
-                }, 5000);
+                }, 15000);
                 google.accounts.id.prompt((notification) => {
                     clearTimeout(promptTimeout);
+                    // If the credential callback already fired, the user successfully selected an account
+                    // The prompt closing with 'dismissed' is expected — don't show fallback
+                    if (credentialCallbackFired) {
+                        log.log('Google OneTap prompt closed after credential selection — ignoring');
+                        return;
+                    }
                     // Check for FedCM/OneTap dismissal or blocking
-                    // notification may have getMomentType(), getDismissedReason(), getSkippedReason()
                     const momentType = notification?.getMomentType?.();
                     const dismissedReason = notification?.getDismissedReason?.();
                     const skippedReason = notification?.getSkippedReason?.();
                     log.log('Google OneTap prompt notification:', { momentType, dismissedReason, skippedReason });
                     if (momentType === 'skipped' || momentType === 'dismissed') {
-                        // User dismissed the prompt, or browser blocked it (FedCM disabled)
-                        // Offer popup flow as alternative
                         log.log('Google OneTap was dismissed/skipped, offering popup fallback');
                         setGoogleFallbackToPopup(true);
                     }
@@ -13744,6 +13865,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             else {
                 // Verify code - Twilio identifies the verification by phone number
                 const response = await api.verifyPhoneCode(phoneNumber, verificationCode);
+                log.log('Phone verification response:', { hasToken: !!response?.token, hasUser: !!response?.user, isNewUser: response?.isNewUser });
                 // Defensive validation: API may return undefined or error object on failure
                 if (!response) {
                     throw new Error('Verification failed - please check your code and try again');
@@ -13778,6 +13900,9 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
     const handlePasswordReset = async (emailOrPassword, confirmPassword) => {
         setLoading(true);
         setError(undefined);
+        setAuthSuccess(false);
+        setResetSuccess(false);
+        setSuccessMessage(undefined);
         const effectiveRedirectUrl = getRedirectUrl();
         try {
             if (resetToken && confirmPassword) {
@@ -13786,6 +13911,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                 // Auto-login with the new password if we have the email
                 if (resetEmail) {
                     try {
+                        log.log('Auto-login after password reset for:', resetEmail);
                         const loginResponse = await api.login(resetEmail, emailOrPassword);
                         if (loginResponse.token) {
                             await auth.login(loginResponse.token, loginResponse.user, loginResponse.accountData, false);
@@ -13798,9 +13924,12 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                         }
                     }
                     catch (loginErr) {
-                        // Auto-login failed, fall back to showing success message
+                        log.warn('Auto-login after password reset failed, requiring manual login:', loginErr);
                     }
                 }
+                else {
+                    log.warn('No resetEmail available for auto-login after password reset');
+                }
                 // Fallback: show success but require manual login
                 setResetSuccess(true);
                 setSuccessMessage('Password reset successful! Please sign in with your new password.');
@@ -13810,14 +13939,35 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             else {
                 // Request password reset email
                 const result = await api.requestPasswordReset(emailOrPassword, effectiveRedirectUrl);
+                const resultError = getActionResultErrorMessage(result);
+                if (resultError) {
+                    setAuthSuccess(false);
+                    setResetSuccess(false);
+                    setSuccessMessage(undefined);
+                    setError(resultError);
+                    return;
+                }
+                const resultAny = result;
+                const isConfirmedSuccess = result && (resultAny.success === true ||
+                    resultAny.ok === true ||
+                    (resultAny.message && !resultAny.errorCode && !resultAny.statusCode));
+                if (!isConfirmedSuccess) {
+                    setAuthSuccess(false);
+                    setResetSuccess(false);
+                    setSuccessMessage(undefined);
+                    setError(resultAny?.message || 'Unable to send password reset email. Please try again.');
+                    return;
+                }
                 setResetSuccess(true);
-                // Use backend message if available
                 if (result?.message) {
                     setSuccessMessage(result.message);
                 }
             }
         }
         catch (err) {
+            setAuthSuccess(false);
+            setResetSuccess(false);
+            setSuccessMessage(undefined);
             setError(getFriendlyErrorMessage(err));
             onAuthError?.(err instanceof Error ? err : new Error(getFriendlyErrorMessage(err)));
         }
@@ -13881,7 +14031,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                 setResetToken(undefined); // Clear token when going back
                 setResetEmail(undefined); // Clear email when going back
                 setSuccessMessage(undefined); // Clear success message
-            }, loading: loading, error: error, success: resetSuccess, successMessage: successMessage, token: resetToken })) : (mode === 'login' || mode === 'register') ? (jsx(Fragment, { children: showResendVerification ? (jsxs("div", { style: {
+            }, loading: loading, error: error, success: resetSuccess, successMessage: successMessage, token: resetToken, resetEmail: resetEmail })) : (mode === 'login' || mode === 'register') ? (jsx(Fragment, { children: showResendVerification ? (jsxs("div", { style: {
                     marginTop: '1rem',
                     padding: '1.5rem',
                     backgroundColor: config?.branding?.inheritHostStyles
@@ -13979,7 +14129,16 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                             color: config?.branding?.inheritHostStyles
                                 ? 'hsl(var(--foreground, 215 25% 15%))'
                                 : (resolvedTheme === 'dark' ? '#f1f5f9' : '#374151')
-                        }, children: "Password Reset Link Expired" }), jsx("p", { style: {
+                        }, children: "Password Reset Link Expired" }), error && (jsx("div", { style: {
+                            marginBottom: '1rem',
+                            padding: '0.75rem',
+                            backgroundColor: resolvedTheme === 'dark' ? 'rgba(239, 68, 68, 0.15)' : 'rgba(239, 68, 68, 0.1)',
+                            border: `1px solid ${resolvedTheme === 'dark' ? 'rgba(239, 68, 68, 0.3)' : 'rgba(239, 68, 68, 0.2)'}`,
+                            borderRadius: '0.375rem',
+                            color: resolvedTheme === 'dark' ? '#fca5a5' : '#dc2626',
+                            fontSize: '0.875rem',
+                            lineHeight: '1.5',
+                        }, children: error })), jsx("p", { style: {
                             marginBottom: '1rem',
                             fontSize: '0.875rem',
                             color: config?.branding?.inheritHostStyles
@@ -14078,10 +14237,48 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                                     backgroundColor: 'transparent',
                                     border: 'none',
                                     cursor: 'pointer',
-                                }, children: "Dismiss" })] })), (() => {
+                                }, children: "Dismiss" })] })), googleNativeTimedOut && (jsxs("div", { style: {
+                            marginBottom: '1rem',
+                            padding: '0.75rem 1rem',
+                            borderRadius: '0.5rem',
+                            backgroundColor: resolvedTheme === 'dark' ? 'rgba(245, 158, 11, 0.1)' : 'rgba(245, 158, 11, 0.05)',
+                            border: `1px solid ${resolvedTheme === 'dark' ? 'rgba(245, 158, 11, 0.3)' : 'rgba(245, 158, 11, 0.2)'}`,
+                        }, children: [jsx("p", { style: {
+                                    fontSize: '0.8125rem',
+                                    color: resolvedTheme === 'dark' ? '#fbbf24' : '#92400e',
+                                    marginBottom: '0.5rem',
+                                    lineHeight: 1.4,
+                                }, children: 'Google sign-in didn\'t respond. You can try again or use another sign-in method.' }), jsx("button", { onClick: () => {
+                                    setGoogleNativeTimedOut(false);
+                                    handleGoogleLogin();
+                                }, style: {
+                                    width: '100%',
+                                    padding: '0.5rem 1rem',
+                                    fontSize: '0.875rem',
+                                    fontWeight: 500,
+                                    color: '#fff',
+                                    backgroundColor: '#4285F4',
+                                    border: 'none',
+                                    borderRadius: '0.375rem',
+                                    cursor: 'pointer',
+                                }, children: 'Retry Google Sign-In' }), jsx("button", { onClick: () => setGoogleNativeTimedOut(false), style: {
+                                    marginTop: '0.375rem',
+                                    width: '100%',
+                                    padding: '0.25rem',
+                                    fontSize: '0.75rem',
+                                    color: resolvedTheme === 'dark' ? '#64748b' : '#9ca3af',
+                                    backgroundColor: 'transparent',
+                                    border: 'none',
+                                    cursor: 'pointer',
+                                }, children: 'Dismiss' })] })), (() => {
                         const emailDisplayMode = config?.emailDisplayMode || 'form';
                         const providerOrder = config?.providerOrder || (config?.enabledProviders || enabledProviders);
                         const actualProviders = config?.enabledProviders || enabledProviders;
+                        const hasEmailProvider = actualProviders.includes('email');
+                        // If email provider is not enabled, only show provider buttons (no email/password form)
+                        if (!hasEmailProvider) {
+                            return (jsx(ProviderButtons, { enabledProviders: actualProviders, providerOrder: providerOrder, onGoogleLogin: handleGoogleLogin, onPhoneLogin: () => setMode('phone'), onMagicLinkLogin: () => setMode('magic-link'), loading: loading }));
+                        }
                         // Button mode: show provider selection first, then email form if email is selected
                         if (emailDisplayMode === 'button' && !showEmailForm) {
                             return (jsx(ProviderButtons, { enabledProviders: actualProviders, providerOrder: providerOrder, onEmailLogin: () => setShowEmailForm(true), onGoogleLogin: handleGoogleLogin, onPhoneLogin: () => setMode('phone'), onMagicLinkLogin: () => setMode('magic-link'), loading: loading }));
@@ -14103,7 +14300,7 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
                                         setShowResendVerification(false);
                                         setShowRequestNewReset(false);
                                         setError(undefined);
-                                    }, onForgotPassword: () => setMode('reset-password'), loading: loading, error: error, signupProminence: resolvedSignupProminence, schema: contactSchema, registrationFieldsConfig: config?.registrationFields, additionalFields: config?.signupAdditionalFields }), emailDisplayMode === 'form' && actualProviders.length > 1 && (jsx(ProviderButtons, { enabledProviders: actualProviders.filter((p) => p !== 'email'), providerOrder: providerOrder, onGoogleLogin: handleGoogleLogin, onPhoneLogin: () => setMode('phone'), onMagicLinkLogin: () => setMode('magic-link'), loading: loading }))] }));
+                                    }, onForgotPassword: () => setMode('reset-password'), loading: loading, error: error, signupProminence: resolvedSignupProminence, signupRedirectUrl: config?.signupRedirectUrl || customization?.signupRedirectUrl, schema: contactSchema, registrationFieldsConfig: config?.registrationFields, additionalFields: config?.signupAdditionalFields }), emailDisplayMode === 'form' && actualProviders.length > 1 && (jsx(ProviderButtons, { enabledProviders: actualProviders.filter((p) => p !== 'email'), providerOrder: providerOrder, onGoogleLogin: handleGoogleLogin, onPhoneLogin: () => setMode('phone'), onMagicLinkLogin: () => setMode('magic-link'), loading: loading }))] }));
                     })()] })) })) : null }));
 };