@proveanything/smartlinks-auth-ui 0.5.6 → 0.5.8

package/dist/api.d.ts

@@ -74,7 +74,13 @@ export declare class AuthAPI {
             buttonLabel: string;
             buttonUrl: string;
         };
-    }, prefillMessage?: string): Promise<{
+    }, prefillMessage?: string, contactData?: {
+        name?: string;
+        email?: string;
+        source?: string;
+        customFields?: Record<string, any>;
+        [key: string]: any;
+    }): Promise<{
         waLink: string;
         code: string;
         token: string;

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAIpF;;;GAGG;AACH,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,OAAO,CAAC,GAAG,CAAyC;gBAExC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU;IAQxF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAI7D,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAWnD,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAC7C,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACjF,SAAS,CAAC,EAAE,UAAU,GAAG,cAAc,CAAC;KACzC,GAAG,OAAO,CAAC,YAAY,CAAC;IAmBnB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAc7E,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvE,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC;IAIlB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BxG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBlH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAIzG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IASzH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAIhF,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAStH,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC;IAsB1C;;;;OAIG;IACG,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBlG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAQvH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAM3E,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EACzF,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IAYI,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAIxG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAC9C,EAAE,EAAE,OAAO,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;QAClE,QAAQ,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC;IAII,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAChE,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC;CAGH"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAIpF;;;GAGG;AACH,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,OAAO,CAAC,GAAG,CAAyC;gBAExC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU;IAQxF,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAI7D,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAWnD,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAC7C,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACjF,SAAS,CAAC,EAAE,UAAU,GAAG,cAAc,CAAC;KACzC,GAAG,OAAO,CAAC,YAAY,CAAC;IAmBnB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAc7E,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvE,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC;IAIlB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BxG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBlH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAIzG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IASzH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAIhF,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAStH,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC;IAsB1C;;;;OAIG;IACG,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBlG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAQvH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAM3E,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EACzF,cAAc,CAAC,EAAE,MAAM,EACvB,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,GACA,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IAeI,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAIxG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAC9C,EAAE,EAAE,OAAO,CAAC;QACZ,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;QAClE,QAAQ,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC;IAII,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAChE,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC;CAGH"}

package/dist/components/AccountManagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccountManagement.d.ts","sourceRoot":"","sources":["../../src/components/AccountManagement.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA2C,MAAM,OAAO,CAAC;AAOhE,OAAO,KAAK,EAAE,sBAAsB,EAAe,MAAM,UAAU,CAAC;AACpE,OAAO,qBAAqB,CAAC;AAK7B,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,sBAAsB,CA4vB9D,CAAC"}
+{"version":3,"file":"AccountManagement.d.ts","sourceRoot":"","sources":["../../src/components/AccountManagement.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA2C,MAAM,OAAO,CAAC;AAOhE,OAAO,KAAK,EAAE,sBAAsB,EAAe,MAAM,UAAU,CAAC;AACpE,OAAO,qBAAqB,CAAC;AAK7B,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAgzB9D,CAAC"}

package/dist/components/SmartlinksAuthUI.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SmartlinksAuthUI.d.ts","sourceRoot":"","sources":["../../src/components/SmartlinksAuthUI.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAapE,OAAO,KAAK,EAAE,qBAAqB,EAAyF,MAAM,UAAU,CAAC;AAqQ7I,QAAA,MAAM,mBAAmB,QAAa,OAAO,CAAC,IAAI,CAqBjD,CAAC;AAqDF,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAI/B,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAq+D5D,CAAC"}
+{"version":3,"file":"SmartlinksAuthUI.d.ts","sourceRoot":"","sources":["../../src/components/SmartlinksAuthUI.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA+C,MAAM,OAAO,CAAC;AAapE,OAAO,KAAK,EAAE,qBAAqB,EAAyF,MAAM,UAAU,CAAC;AAqQ7I,QAAA,MAAM,mBAAmB,QAAa,OAAO,CAAC,IAAI,CAqBjD,CAAC;AAqDF,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAI/B,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAq/D5D,CAAC"}

package/dist/context/AuthContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../../src/context/AuthContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA8E,MAAM,OAAO,CAAC;AAOnG,OAAO,KAAK,EAAqC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGvG,eAAO,MAAM,WAAW,6CAAyD,CAAC;AAGlF,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CA81BpD,CAAC;AAEF,eAAO,MAAM,OAAO,QAAO,gBAM1B,CAAC"}
+{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../../src/context/AuthContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA8E,MAAM,OAAO,CAAC;AAOnG,OAAO,KAAK,EAAqC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGvG,eAAO,MAAM,WAAW,6CAAyD,CAAC;AAGlF,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAw4BpD,CAAC;AAEF,eAAO,MAAM,OAAO,QAAO,gBAM1B,CAAC"}

package/dist/index.esm.js

@@ -11493,15 +11493,18 @@ class AuthAPI {
         return smartlinks.authKit.verifyMagicLink(this.clientId, token);
     }
     // ============= WhatsApp =============
-    async sendWhatsApp(redirectUrl, phoneNumber, reply, prefillMessage) {
+    async sendWhatsApp(redirectUrl, phoneNumber, reply, prefillMessage, contactData) {
         // phoneNumber is optional — backend extracts it from the inbound WhatsApp webhook.
         // `reply`, when provided, is sent back to the user via WhatsApp on successful verification.
         // `prefillMessage` customizes the message body pre-filled in the wa.me link.
+        // `contactData` is upserted onto the contact when the backend creates/links it,
+        // so the returned session.user is fully formed (name, email, custom fields, etc.).
         return smartlinks.authKit.sendWhatsApp(this.clientId, {
             phoneNumber: phoneNumber ?? '',
             redirectUrl,
             ...(reply ? { reply } : {}),
             ...(prefillMessage ? { prefillMessage } : {}),
+            ...(contactData ? { contactData } : {}),
         });
     }
     async exchangeWhatsAppSession(token, sessionKey) {
@@ -12693,6 +12696,44 @@ collectionId, enableContactSync, enableInteractionTracking, interactionAppId, in
             }
         }
     }, [token, user, isVerified, accountData, accountInfo, contact, contactId, notifyAuthStateChange, isNetworkError, logout]);
+    // Apply a session refresh from SDK calls that rotate the bearer token
+    // (e.g. authKit.updateProfile returns { token, ...profile }). Without this
+    // the persisted token still decodes to the OLD claims, so a page refresh
+    // would resurrect stale displayName / email / phone values.
+    const applySessionRefresh = useCallback(async (payload) => {
+        const nextToken = payload.token;
+        const nextUser = user
+            ? { ...user, ...(payload.user || {}) }
+            : (payload.user && payload.user.uid ? payload.user : null);
+        const nextAccountData = payload.accountData ?? accountData;
+        if (nextToken && !proxyMode) {
+            // Match the 7-day lifetime used by login()/refreshToken() — backend mints fresh JWTs with the same TTL.
+            await tokenStorage.saveToken(nextToken, Date.now() + 7 * 24 * 60 * 60 * 1000);
+            if (nextUser)
+                await tokenStorage.saveUser(nextUser);
+            if (payload.accountData)
+                await tokenStorage.saveAccountData(payload.accountData);
+        }
+        if (nextToken)
+            setToken(nextToken);
+        if (nextUser)
+            setUser(nextUser);
+        if (payload.accountData)
+            setAccountData(nextAccountData);
+        // Refresh contact too — the backend's account/contact unification means
+        // the contact record may now reflect the new displayName/email/phone.
+        if (collectionId && shouldSyncContacts) {
+            try {
+                const fresh = await smartlinks.contact.publicGetMine(collectionId);
+                if (fresh?.contact)
+                    setContact(fresh.contact);
+            }
+            catch {
+                // Non-fatal
+            }
+        }
+        notifyAuthStateChange('TOKEN_REFRESH', nextUser, nextToken ?? token, nextAccountData, accountInfo, isVerified, contact, contactId);
+    }, [proxyMode, user, accountData, accountInfo, isVerified, contact, contactId, collectionId, shouldSyncContacts, token, notifyAuthStateChange]);
     // Online/offline event listener for auto-retry verification
     useEffect(() => {
         if (proxyMode)
@@ -12770,6 +12811,7 @@ collectionId, enableContactSync, enableInteractionTracking, interactionAppId, in
         clearAccountCache,
         onAuthStateChange,
         retryVerification,
+        applySessionRefresh,
     };
     return jsx(AuthContext.Provider, { value: value, children: children });
 };
@@ -14271,8 +14313,17 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             });
             // Resolve outbound prefill message: per-call prop wins, then AuthKit default.
             const prefillMessage = whatsappPrefillMessage ?? config?.whatsappPrefillMessage;
-            const result = await api.sendWhatsApp(getRedirectUrl(), undefined, reply, prefillMessage);
-            whatsappSendRef.current = { token: result.token, sessionKey: result.sessionKey };
+            // Pass collected signup details as contactData so the backend creates the
+            // contact with name/customFields already attached and returns a fully
+            // formed session.user — no follow-up updateProfile call needed.
+            const trimmedName = displayName?.trim() || undefined;
+            const contactData = trimmedName ? { name: trimmedName } : undefined;
+            const result = await api.sendWhatsApp(getRedirectUrl(), undefined, reply, prefillMessage, contactData);
+            whatsappSendRef.current = {
+                token: result.token,
+                sessionKey: result.sessionKey,
+                displayName: trimmedName,
+            };
             return result;
         }
         catch (err) {
@@ -14291,9 +14342,9 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
         const target = status.redirectUrl || getRedirectUrl();
         setAuthSuccess(true);
         setSuccessMessage('WhatsApp verified! Signing you in…');
-        // Exchange the verified WhatsApp proof for a real Auth Kit session token,
-        // so the user is fully logged in (not just verified) and any same-tab
-        // continuation flows (claim, bid, etc.) pick up an authenticated session.
+        // Exchange the verified WhatsApp proof for a real Auth Kit session token.
+        // The backend has already created/updated the contact using contactData
+        // sent at sendWhatsApp time, so session.user is fully formed.
         const send = whatsappSendRef.current;
         if (send?.sessionKey) {
             try {
@@ -14636,6 +14687,32 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     const [profile, setProfile] = useState(null);
     const [error, setError] = useState();
     const [success, setSuccess] = useState();
+    const [resolvedClientId, setResolvedClientId] = useState(clientId);
+    // Keep prop in sync
+    useEffect(() => {
+        if (clientId)
+            setResolvedClientId(clientId);
+    }, [clientId]);
+    // If no clientId was provided, try to resolve the collection's default Auth Kit.
+    // This supports "portal mode" where the host app only knows the collectionId.
+    useEffect(() => {
+        if (clientId || !collectionId)
+            return;
+        let cancelled = false;
+        (async () => {
+            try {
+                const collection = await smartlinks.collection.get(collectionId);
+                const defaultId = collection?.defaultAuthKitId;
+                if (!cancelled && defaultId)
+                    setResolvedClientId(defaultId);
+            }
+            catch {
+                // Non-fatal — handlers will surface a friendly error if still missing
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [clientId, collectionId]);
+    const NO_CLIENT_ID_MSG = 'This account section is not connected to an Auth Kit yet. Pass a clientId prop, or set a default Auth Kit on the collection in the admin console.';
     // Schema state — now uses SDK type directly
     const [schema, setSchema] = useState(null);
     const [schemaLoading, setSchemaLoading] = useState(false);
@@ -14707,26 +14784,29 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         setLoading(true);
         setError(undefined);
         try {
+            // Pull contact first so we can fall back to fields the auth user object
+            // may not carry (e.g. WhatsApp phone numbers, displayName, email).
+            let contactData = auth.contact;
+            if (collectionId && !contactData) {
+                try {
+                    contactData = (await auth.getContact?.()) || null;
+                }
+                catch { /* non-fatal */ }
+            }
+            const contactAny = contactData;
             const profileData = {
                 uid: auth.user?.uid || '',
-                email: auth.user?.email,
-                displayName: auth.user?.displayName,
-                phoneNumber: auth.user?.phoneNumber,
+                email: auth.user?.email || contactAny?.email,
+                displayName: auth.user?.displayName || contactAny?.displayName || contactAny?.name,
+                phoneNumber: auth.user?.phoneNumber || contactAny?.phone || contactAny?.phoneNumber,
                 photoURL: auth.user?.photoURL,
                 emailVerified: true,
                 accountData: auth.accountData || {},
             };
             setProfile(profileData);
             setDisplayName(profileData.displayName || '');
-            // Load contact custom fields if collectionId provided
-            if (collectionId && auth.contact) {
-                setCustomFieldValues(auth.contact.customFields || {});
-            }
-            else if (collectionId) {
-                const contact = await auth.getContact?.();
-                if (contact?.customFields) {
-                    setCustomFieldValues(contact.customFields);
-                }
+            if (collectionId && contactData?.customFields) {
+                setCustomFieldValues(contactData.customFields);
             }
         }
         catch (err) {
@@ -14758,19 +14838,34 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     const editableCustomFields = getEditableFields(schema, customFieldValues).filter(f => !['email', 'displayName', 'phone', 'phoneNumber'].includes(f.key));
     const handleUpdateProfile = async (e) => {
         e.preventDefault();
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         setLoading(true);
         setError(undefined);
         setSuccess(undefined);
         try {
-            await smartlinks.authKit.updateProfile(clientId, { displayName });
+            // SDK 1.13.17+: updateProfile returns a fresh bearer token with refreshed
+            // claims (displayName/photoURL). We MUST persist the new token, otherwise
+            // a page refresh would decode the old token and resurrect stale values.
+            // Cast: older @proveanything/smartlinks type defs typed this as UserProfile
+            // (no `token`). The runtime always returns the rotated token in 1.13.17+.
+            const updated = await smartlinks.authKit.updateProfile(resolvedClientId, { displayName });
+            await auth.applySessionRefresh({
+                token: updated.token,
+                user: {
+                    displayName: updated.displayName ?? displayName,
+                    email: updated.email,
+                    phoneNumber: updated.phoneNumber ?? undefined,
+                    photoURL: updated.photoURL ?? undefined,
+                },
+                accountData: updated.accountData,
+            });
             setSuccess('Profile updated successfully!');
             setEditingSection(null);
             if (profile) {
-                setProfile({ ...profile, displayName });
+                setProfile({ ...profile, displayName: updated.displayName ?? displayName });
             }
         }
         catch (err) {
@@ -14805,8 +14900,8 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     };
     const handleChangeEmail = async (e) => {
         e.preventDefault();
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         setLoading(true);
@@ -14814,7 +14909,11 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         setSuccess(undefined);
         try {
             const redirectUrl = window.location.href;
-            await smartlinks.authKit.changeEmail(clientId, newEmail, emailPassword, redirectUrl);
+            const res = await smartlinks.authKit.changeEmail(resolvedClientId, newEmail, emailPassword, redirectUrl);
+            // SDK may rotate bearer token on email change — persist if present.
+            if (res?.token) {
+                await auth.applySessionRefresh({ token: res.token });
+            }
             setSuccess('Email change requested. Please check your new email for verification.');
             setEditingSection(null);
             setNewEmail('');
@@ -14830,8 +14929,8 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     };
     const handleChangePassword = async (e) => {
         e.preventDefault();
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         if (newPassword !== confirmPassword) {
@@ -14846,7 +14945,7 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         setError(undefined);
         setSuccess(undefined);
         try {
-            await smartlinks.authKit.changePassword(clientId, currentPassword, newPassword);
+            await smartlinks.authKit.changePassword(resolvedClientId, currentPassword, newPassword);
             setSuccess('Password changed successfully!');
             setEditingSection(null);
             setCurrentPassword('');
@@ -14862,14 +14961,14 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         }
     };
     const handleSendPhoneCode = async () => {
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         setLoading(true);
         setError(undefined);
         try {
-            await smartlinks.authKit.sendPhoneCode(clientId, newPhone);
+            await smartlinks.authKit.sendPhoneCode(resolvedClientId, newPhone);
             setPhoneCodeSent(true);
             setSuccess('Verification code sent to your phone');
         }
@@ -14883,15 +14982,20 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     };
     const handleUpdatePhone = async (e) => {
         e.preventDefault();
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         setLoading(true);
         setError(undefined);
         setSuccess(undefined);
         try {
-            await smartlinks.authKit.updatePhone(clientId, newPhone, phoneCode);
+            const res = await smartlinks.authKit.updatePhone(resolvedClientId, newPhone, phoneCode);
+            // Phone change rotates the bearer token (phoneNumber is a JWT claim).
+            await auth.applySessionRefresh({
+                token: res?.token,
+                user: { phoneNumber: newPhone },
+            });
             setSuccess('Phone number updated successfully!');
             setEditingSection(null);
             setNewPhone('');
@@ -14908,8 +15012,8 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         }
     };
     const handleDeleteAccount = async () => {
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         if (deleteConfirmText !== 'DELETE') {
@@ -14923,7 +15027,7 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         setLoading(true);
         setError(undefined);
         try {
-            await smartlinks.authKit.deleteAccount(clientId, deletePassword, deleteConfirmText);
+            await smartlinks.authKit.deleteAccount(resolvedClientId, deletePassword, deleteConfirmText);
             setSuccess('Account deleted successfully');
             await auth.logout();
         }