@turnkey/react-wallet-kit 1.0.0-beta.5 → 1.0.0

package/dist/providers/client/Provider.js

@@ -4,7 +4,8 @@
 var jsxRuntime = require('react/jsx-runtime');
 var sha2 = require('@noble/hashes/sha2');
 var utils$1 = require('@noble/hashes/utils');
-var utils = require('../../utils.js');
+var utils = require('../../utils/utils.js');
+var timers = require('../../utils/timers.js');
 var core = require('@turnkey/core');
 var react = require('react');
 var sdkTypes = require('@turnkey/sdk-types');
@@ -23,7 +24,7 @@ var UpdatePhoneNumber = require('../../components/user/UpdatePhoneNumber.js');
 var UpdateUserName = require('../../components/user/UpdateUserName.js');
 var RemoveOAuthProvider = require('../../components/user/RemoveOAuthProvider.js');
 var RemovePasskey = require('../../components/user/RemovePasskey.js');
-var LinkWallet = require('../../components/user/LinkWallet.js');
+var ConnectWallet = require('../../components/user/ConnectWallet.js');
 var Types = require('./Types.js');
 var OTP = require('../../components/auth/OTP.js');
 var RemoveEmail = require('../../components/user/RemoveEmail.js');
@@ -32,7 +33,7 @@ var RemovePhoneNumber = require('../../components/user/RemovePhoneNumber.js');
 /**
  * Provides Turnkey client authentication, session management, wallet operations, and user profile management
  * for the React Wallet Kit SDK. This context provider encapsulates all core authentication flows (Passkey, Wallet, OTP, OAuth),
- * session lifecycle (creation, expiration, refresh), wallet linking/import/export, and user profile updates (email, phone, name).
+ * session lifecycle (creation, expiration, refresh), wallet connecting/import/export, and user profile updates (email, phone, name).
  *
  * The provider automatically initializes the Turnkey client, fetches configuration (including proxy auth config if needed),
  * and synchronizes session and authentication state. It exposes a comprehensive set of methods for authentication flows,
@@ -41,9 +42,9 @@ var RemovePhoneNumber = require('../../components/user/RemovePhoneNumber.js');
  * Features:
  * - Passkey, Wallet, OTP (Email/SMS), and OAuth (Google, Apple, Facebook) authentication and sign-up flows.
  * - Session management: creation, expiration scheduling, refresh, and clearing.
- * - Wallet management: fetch, link, import, export, account management.
+ * - Wallet management: fetch, connect, import, export, account management.
  * - User profile management: email, phone, name, OAuth provider, and passkey linking/removal.
- * - Modal-driven UI flows for authentication, wallet linking, and profile updates.
+ * - Modal-driven UI flows for authentication, wallet connecting, and profile updates.
  * - Error handling and callback integration for custom error and event responses.
  *
  * Usage:
@@ -74,6 +75,7 @@ const ClientProvider = ({
   const proxyAuthConfigRef = react.useRef(null);
   const [allSessions, setAllSessions] = react.useState(undefined);
   const {
+    isMobile,
     pushPage,
     closeModal
   } = Hook.useModal();
@@ -92,6 +94,7 @@ const ClientProvider = ({
           const flow = stateParams.get("flow");
           const publicKey = stateParams.get("publicKey");
           const openModal = stateParams.get("openModal");
+          const sessionKey = stateParams.get("sessionKey");
           if (provider === "facebook" && flow === "redirect" && publicKey) {
             // We have all the required parameters for a Facebook PKCE flow
             const clientId = masterConfig?.auth?.oauthConfig?.facebookClientId;
@@ -116,8 +119,13 @@ const ClientProvider = ({
                             await completeOauth({
                               oidcToken,
                               publicKey,
-                              providerName: "facebook"
+                              providerName: "facebook",
+                              ...(sessionKey && {
+                                sessionKey
+                              })
                             });
+                            // Clean up the URL after processing
+                            window.history.replaceState(null, document.title, window.location.pathname);
                             resolve();
                           } catch (err) {
                             reject(err);
@@ -140,6 +148,116 @@ const ClientProvider = ({
               });
             }
           }
+          if (provider === "discord" && flow === "redirect" && publicKey) {
+            const clientId = masterConfig?.auth?.oauthConfig?.discordClientId;
+            const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
+            const verifier = sessionStorage.getItem("discord_verifier");
+            const nonce = stateParams.get("nonce");
+            const sessionKey = stateParams.get("sessionKey");
+            if (clientId && redirectURI && verifier && nonce) {
+              await new Promise((resolve, reject) => {
+                pushPage({
+                  key: `Discord OAuth`,
+                  content: jsxRuntime.jsx(Action.ActionPage, {
+                    title: `Authenticating with Discord...`,
+                    action: async () => {
+                      try {
+                        const resp = await client?.httpClient.proxyOAuth2Authenticate({
+                          provider: "OAUTH2_PROVIDER_DISCORD",
+                          authCode: code,
+                          redirectUri: redirectURI,
+                          codeVerifier: verifier,
+                          clientId,
+                          nonce: nonce
+                        });
+                        sessionStorage.removeItem("discord_verifier");
+                        const oidcToken = resp?.oidcToken;
+                        if (!oidcToken) {
+                          throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+                        }
+                        await completeOauth({
+                          oidcToken,
+                          publicKey,
+                          providerName: "discord",
+                          ...(sessionKey && {
+                            sessionKey
+                          })
+                        });
+                        // Clean up the URL after processing
+                        window.history.replaceState(null, document.title, window.location.pathname);
+                        resolve(null);
+                      } catch (err) {
+                        reject(err);
+                        if (callbacks?.onError) {
+                          callbacks.onError(err instanceof sdkTypes.TurnkeyError ? err : new sdkTypes.TurnkeyError("Discord authentication failed", sdkTypes.TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR, err));
+                        }
+                      }
+                    },
+                    icon: jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
+                      size: "3x",
+                      icon: freeBrandsSvgIcons.faDiscord
+                    })
+                  }),
+                  showTitle: false
+                });
+              });
+            }
+          }
+          if (provider === "twitter" && flow === "redirect" && publicKey) {
+            const clientId = masterConfig?.auth?.oauthConfig?.xClientId;
+            const redirectURI = masterConfig?.auth?.oauthConfig?.oauthRedirectUri;
+            const verifier = sessionStorage.getItem("twitter_verifier");
+            const nonce = stateParams.get("nonce");
+            const sessionKey = stateParams.get("sessionKey");
+            if (clientId && redirectURI && verifier && nonce) {
+              await new Promise((resolve, reject) => {
+                pushPage({
+                  key: `Twitter OAuth`,
+                  content: jsxRuntime.jsx(Action.ActionPage, {
+                    title: `Authenticating with Twitter...`,
+                    action: async () => {
+                      try {
+                        const resp = await client?.httpClient.proxyOAuth2Authenticate({
+                          provider: "OAUTH2_PROVIDER_X",
+                          authCode: code,
+                          redirectUri: redirectURI,
+                          codeVerifier: verifier,
+                          clientId,
+                          nonce: nonce
+                        });
+                        sessionStorage.removeItem("twitter_verifier");
+                        const oidcToken = resp?.oidcToken;
+                        if (!oidcToken) {
+                          throw new sdkTypes.TurnkeyError("Missing OIDC token", sdkTypes.TurnkeyErrorCodes.OAUTH_LOGIN_ERROR);
+                        }
+                        await completeOauth({
+                          oidcToken,
+                          publicKey,
+                          providerName: "twitter",
+                          ...(sessionKey && {
+                            sessionKey
+                          })
+                        });
+                        // Clean up the URL after processing
+                        window.history.replaceState(null, document.title, window.location.pathname);
+                        resolve(null);
+                      } catch (err) {
+                        reject(err);
+                        if (callbacks?.onError) {
+                          callbacks.onError(err instanceof sdkTypes.TurnkeyError ? err : new sdkTypes.TurnkeyError("Twitter authentication failed", sdkTypes.TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR, err));
+                        }
+                      }
+                    },
+                    icon: jsxRuntime.jsx(reactFontawesome.FontAwesomeIcon, {
+                      size: "3x",
+                      icon: freeBrandsSvgIcons.faXTwitter
+                    })
+                  }),
+                  showTitle: false
+                });
+              });
+            }
+          }
         }
       }
       // Handle Google/Apple redirects (uses hash with id_token)
@@ -151,7 +269,8 @@ const ClientProvider = ({
           provider,
           flow,
           publicKey,
-          openModal
+          openModal,
+          sessionKey
         } = utils.parseOAuthRedirect(hash);
         if (idToken && flow === "redirect" && publicKey) {
           if (openModal === "true") {
@@ -183,7 +302,10 @@ const ClientProvider = ({
                         publicKey,
                         ...(provider ? {
                           providerName: provider
-                        } : {})
+                        } : {}),
+                        ...(sessionKey && {
+                          sessionKey
+                        })
                       });
                       resolve(null);
                     } catch (err) {
@@ -223,11 +345,21 @@ const ClientProvider = ({
       passkeyAuthEnabled: config.auth?.methods?.passkeyAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("passkey"),
       walletAuthEnabled: config.auth?.methods?.walletAuthEnabled ?? proxyAuthConfig?.enabledProviders.includes("wallet"),
       googleOauthEnabled: config.auth?.methods?.googleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("google"),
+      xOauthEnabled: config.auth?.methods?.xOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("x"),
+      discordOauthEnabled: config.auth?.methods?.discordOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("discord"),
       appleOauthEnabled: config.auth?.methods?.appleOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("apple"),
       facebookOauthEnabled: config.auth?.methods?.facebookOauthEnabled ?? proxyAuthConfig?.enabledProviders.includes("facebook")
     };
+    const resolvedClientIds = {
+      googleClientId: config.auth?.oauthConfig?.googleClientId ?? proxyAuthConfig?.oauthClientIds?.google,
+      appleClientId: config.auth?.oauthConfig?.appleClientId ?? proxyAuthConfig?.oauthClientIds?.apple,
+      facebookClientId: config.auth?.oauthConfig?.facebookClientId ?? proxyAuthConfig?.oauthClientIds?.facebook,
+      xClientId: config.auth?.oauthConfig?.xClientId ?? proxyAuthConfig?.oauthClientIds?.x,
+      discordClientId: config.auth?.oauthConfig?.discordClientId ?? proxyAuthConfig?.oauthClientIds?.discord
+    };
+    const redirectUrl = config.auth?.oauthConfig?.oauthRedirectUri ?? proxyAuthConfig?.oauthRedirectUrl;
     // Set a default ordering for the oAuth methods
-    const oauthOrder = config.auth?.oauthOrder ?? ["google", "apple", "facebook"].filter(provider => resolvedMethods[`${provider}OauthEnabled`]);
+    const oauthOrder = config.auth?.oauthOrder ?? ["google", "apple", "x", "discord", "facebook"].filter(provider => resolvedMethods[`${provider}OauthEnabled`]);
     // Set a default ordering for the overall auth methods
     const methodOrder = config.auth?.methodOrder ?? [oauthOrder.length > 0 ? "socials" : null, resolvedMethods.emailOtpAuthEnabled ? "email" : null, resolvedMethods.smsOtpAuthEnabled ? "sms" : null, resolvedMethods.passkeyAuthEnabled ? "passkey" : null, resolvedMethods.walletAuthEnabled ? "wallet" : null].filter(Boolean);
     return {
@@ -238,13 +370,18 @@ const ClientProvider = ({
         methods: resolvedMethods,
         oauthConfig: {
           ...config.auth?.oauthConfig,
-          openOauthInPage: config.auth?.oauthConfig?.openOauthInPage
+          ...resolvedClientIds,
+          oauthRedirectUri: redirectUrl,
+          // on mobile we default to true since many mobile browsers
+          // (e.g. Safari) block popups
+          openOauthInPage: isMobile ? true : config.auth?.oauthConfig?.openOauthInPage
         },
         sessionExpirationSeconds: proxyAuthConfig?.sessionExpirationSeconds,
         methodOrder,
         oauthOrder,
         autoRefreshSession: config.auth?.autoRefreshSession ?? true
       },
+      autoRefreshManagedState: config.autoRefreshManagedState ?? true,
       walletConfig: {
         ...config.walletConfig,
         features: {
@@ -442,14 +579,13 @@ const ClientProvider = ({
   }
   /**
    * @internal
-   * Schedules a session expiration and warning timeout for the given session key.
+   * Schedules a session expiration and warning timer for the given session key.
    *
-   * - This function sets up two timeouts: one for warning before the session expires and another to expire the session.
-   * - The warning timeout is set to trigger before the session expires, allowing for actions like refreshing the session.
-   * - The expiration timeout clears the session and triggers any necessary callbacks.
+   * - Sets up two timers: one for warning before expiry and one for actual expiry.
+   * - Uses capped timeouts under the hood so delays > 24.8 days are safe (see utils/timers.ts).
    *
    * @param params.sessionKey - The key of the session to schedule expiration for.
-   * @param params.expiry - The expiration time in seconds for the session.
+   * @param params.expiry - The expiration time in seconds since epoch.
    * @throws {TurnkeyError} If an error occurs while scheduling the session expiration.
    */
   async function scheduleSessionExpiration(params) {
@@ -458,21 +594,18 @@ const ClientProvider = ({
       expiry
     } = params;
     try {
-      // Clear any existing timeout for this session key
-      if (expiryTimeoutsRef.current[sessionKey]) {
-        clearTimeout(expiryTimeoutsRef.current[sessionKey]);
-        delete expiryTimeoutsRef.current[sessionKey];
-      }
-      if (expiryTimeoutsRef.current[`${sessionKey}-warning`]) {
-        clearTimeout(expiryTimeoutsRef.current[`${sessionKey}-warning`]);
-        delete expiryTimeoutsRef.current[`${sessionKey}-warning`];
-      }
-      const timeUntilExpiry = expiry * 1000 - Date.now();
+      const warnKey = `${sessionKey}-warning`;
+      // Replace any prior timers for this session
+      timers.clearKey(expiryTimeoutsRef.current, sessionKey);
+      timers.clearKey(expiryTimeoutsRef.current, warnKey);
+      const now = Date.now();
+      const expiryMs = expiry * 1000;
+      const timeUntilExpiry = expiryMs - now;
       const beforeExpiry = async () => {
         const activeSession = await getSession();
-        if (!activeSession && expiryTimeoutsRef.current[sessionKey]) {
-          clearTimeout(expiryTimeoutsRef.current[`${sessionKey}-warning`]);
-          expiryTimeoutsRef.current[`${sessionKey}-warning`] = setTimeout(beforeExpiry, 10000);
+        if (!activeSession && expiryTimeoutsRef.current[warnKey]) {
+          // Keep nudging until session materializes (short 10s timer is fine)
+          timers.setTimeoutInMap(expiryTimeoutsRef.current, warnKey, beforeExpiry, 10_000);
           return;
         }
         const session = await getSession({
@@ -500,27 +633,36 @@ const ClientProvider = ({
         if ((await getActiveSessionKey()) === sessionKey) {
           setSession(undefined);
         }
-        setAllSessions(prevSessions => {
-          if (!prevSessions) return prevSessions;
-          const newSessions = {
-            ...prevSessions
+        setAllSessions(prev => {
+          if (!prev) return prev;
+          const next = {
+            ...prev
           };
-          delete newSessions[sessionKey];
-          return newSessions;
+          delete next[sessionKey];
+          return next;
         });
         await clearSession({
           sessionKey
         });
-        delete expiryTimeoutsRef.current[sessionKey];
-        delete expiryTimeoutsRef.current[`${sessionKey}-warning`];
+        // Remove timers for this session
+        timers.clearKey(expiryTimeoutsRef.current, sessionKey);
+        timers.clearKey(expiryTimeoutsRef.current, warnKey);
         await logout();
       };
-      if (timeUntilExpiry <= utils.SESSION_WARNING_THRESHOLD_MS) {
-        beforeExpiry();
+      // Already expired → expire immediately
+      if (timeUntilExpiry <= 0) {
+        await expireSession();
+        return;
+      }
+      // Warning timer (if threshold is in the future)
+      const warnAt = expiryMs - utils.SESSION_WARNING_THRESHOLD_MS;
+      if (warnAt <= now) {
+        void beforeExpiry(); // fire-and-forget is fine
       } else {
-        expiryTimeoutsRef.current[`${sessionKey}-warning`] = setTimeout(beforeExpiry, timeUntilExpiry - utils.SESSION_WARNING_THRESHOLD_MS);
+        timers.setCappedTimeoutInMap(expiryTimeoutsRef.current, warnKey, beforeExpiry, warnAt - now);
       }
-      expiryTimeoutsRef.current[sessionKey] = setTimeout(expireSession, timeUntilExpiry);
+      // Actual expiry timer (safe for long delays)
+      timers.setCappedTimeoutInMap(expiryTimeoutsRef.current, sessionKey, expireSession, timeUntilExpiry);
     } catch (error) {
       if (error instanceof sdkTypes.TurnkeyError || error instanceof sdkTypes.TurnkeyNetworkError) {
         callbacks?.onError?.(error);
@@ -530,25 +672,25 @@ const ClientProvider = ({
     }
   }
   /**
-   * Clears all scheduled session expiration and warning timeouts for the client.
+   * Clears all scheduled session timers (warning + expiry).
    *
-   * - This function removes all active session expiration and warning timeouts managed by the provider.
-   * - It is called automatically when sessions are re-initialized or on logout to prevent memory leaks and ensure no stale timeouts remain.
-   * - All timeouts stored in `expiryTimeoutsRef` are cleared and the reference is reset.
+   * - Removes all active timers managed by this client.
+   * - Useful on re-init or logout to avoid stale timers.
    *
-   * @throws {TurnkeyError} If an error occurs while clearing the timeouts.
+   * @throws {TurnkeyError} If an error occurs while clearing the timers.
    */
-  function clearSessionTimeouts() {
+  function clearSessionTimeouts(sessionKeys) {
     try {
-      Object.values(expiryTimeoutsRef.current).forEach(timeout => {
-        clearTimeout(timeout);
-      });
-      expiryTimeoutsRef.current = {};
+      if (sessionKeys) {
+        timers.clearKeys(expiryTimeoutsRef.current, sessionKeys);
+      } else {
+        timers.clearAll(expiryTimeoutsRef.current); // clears & deletes everything
+      }
     } catch (error) {
       if (error instanceof sdkTypes.TurnkeyError || error instanceof sdkTypes.TurnkeyNetworkError) {
         callbacks?.onError?.(error);
       } else {
-        callbacks?.onError?.(new sdkTypes.TurnkeyError(`Failed to clear session timeouts`, sdkTypes.TurnkeyErrorCodes.CLEAR_SESSION_TIMEOUTS_ERROR, error));
+        callbacks?.onError?.(new sdkTypes.TurnkeyError("Failed to clear session timeouts", sdkTypes.TurnkeyErrorCodes.CLEAR_SESSION_TIMEOUTS_ERROR, error));
       }
     }
   }
@@ -564,7 +706,12 @@ const ClientProvider = ({
    * @returns A void promise.
    * @throws {TurnkeyError} If the client is not initialized or if there is an error during the process.
    */
-  const handlePostAuth = async () => {
+  const handlePostAuth = async params => {
+    const {
+      method,
+      action,
+      identifier
+    } = params;
     try {
       const sessionKey = await getActiveSessionKey();
       const session = await getSession({
@@ -581,6 +728,12 @@ const ClientProvider = ({
       setAllSessions(allSessions);
       await refreshWallets();
       await refreshUser();
+      callbacks?.onAuthenticationSuccess?.({
+        session,
+        method,
+        action,
+        identifier
+      });
     } catch (error) {
       if (error instanceof sdkTypes.TurnkeyError || error instanceof sdkTypes.TurnkeyNetworkError) {
         callbacks?.onError?.(error);
@@ -594,19 +747,29 @@ const ClientProvider = ({
    * Handles the post-logout flow.
    *
    * - This function is called after a successful logout or session clear.
-   * - It clears all scheduled session expiration and warning timeouts to prevent memory leaks.
-   * - It resets the session state, removes all session and user data from memory, and clears the wallets list.
+   * - It clears all scheduled session expiration and warning timeouts associated to the session key to prevent memory leaks.
+   * - It resets the session state, removes user data from memory, the logged out session from all sessions state, and clears the wallets list.
    * - This ensures that all sensitive information is removed from the provider state after logout.
    * - Called internally after logout or when all sessions are cleared.
    *
    * @returns void
    * @throws {TurnkeyError} If there is an error during the post-logout process.
    */
-  const handlePostLogout = () => {
+  const handlePostLogout = sessionKey => {
     try {
-      clearSessionTimeouts();
+      clearSessionTimeouts(sessionKey ? [sessionKey, `${sessionKey}-warning`] : undefined);
+      setAllSessions(prev => {
+        if (!prev) return prev;
+        if (sessionKey) {
+          const next = {
+            ...prev
+          };
+          delete next[sessionKey];
+          return next;
+        }
+        return {};
+      });
       setSession(undefined);
-      setAllSessions(undefined);
       setUser(undefined);
       setWallets([]);
     } catch (error) {
@@ -625,8 +788,14 @@ const ClientProvider = ({
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     }
-    await utils.withTurnkeyErrorHandling(() => client.logout(params), callbacks, "Failed to logout");
-    handlePostLogout();
+    await utils.withTurnkeyErrorHandling(async () => {
+      // If no sessionKey is provided, we try to get the active one.
+      let sessionKey = params?.sessionKey;
+      if (!sessionKey) sessionKey = await getActiveSessionKey();
+      await client.logout(params);
+      // We only handle post logout if the sessionKey is defined since that means we actually logged out of a session.
+      if (sessionKey) handlePostLogout(sessionKey);
+    }, callbacks, "Failed to logout");
     return;
   }, [client, callbacks]);
   const loginWithPasskey = react.useCallback(async params => {
@@ -639,7 +808,11 @@ const ClientProvider = ({
       expirationSeconds
     }), callbacks, "Failed to login with passkey");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Passkey,
+        action: sdkTypes.AuthAction.LOGIN,
+        identifier: res.credentialId
+      });
     }
     return res;
   }, [client, callbacks]);
@@ -674,15 +847,19 @@ const ClientProvider = ({
       expirationSeconds
     }), callbacks, "Failed to sign up with passkey");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Passkey,
+        action: sdkTypes.AuthAction.SIGNUP,
+        identifier: res.credentialId
+      });
     }
     return res;
   }, [client, callbacks]);
-  const getWalletProviders = react.useCallback(async chain => {
+  const fetchWalletProviders = react.useCallback(async chain => {
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     }
-    const newProviders = await client.getWalletProviders(chain);
+    const newProviders = await client.fetchWalletProviders(chain);
     // we update state with the latest providers
     // we keep this state so that initializeWalletProviderListeners() re-runs
     // whenever the list of connected providers changes
@@ -705,7 +882,7 @@ const ClientProvider = ({
     await client.disconnectWalletAccount(walletProvider);
     // we only refresh the wallets if:
     // 1. there is an active session. This is needed because for WalletConnect
-    //    you can unlink a wallet before actually being logged in
+    //    you can disconnect a wallet before actually being logged in
     //
     // 2. it was a WalletConnect provider that we just disconnected. Since
     //    native providers emit a disconnect event which will already refresh
@@ -734,7 +911,11 @@ const ClientProvider = ({
       expirationSeconds
     }), callbacks, "Failed to login with wallet");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Wallet,
+        action: sdkTypes.AuthAction.LOGIN,
+        identifier: res.address
+      });
     }
     return res;
   }, [client, callbacks]);
@@ -759,7 +940,11 @@ const ClientProvider = ({
       expirationSeconds
     }), callbacks, "Failed to sign up with wallet");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Wallet,
+        action: sdkTypes.AuthAction.SIGNUP,
+        identifier: res.address
+      });
     }
     return res;
   }, [client, callbacks, masterConfig]);
@@ -784,7 +969,11 @@ const ClientProvider = ({
       expirationSeconds
     }), callbacks, "Failed to login or sign up with wallet");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Wallet,
+        action: res.action,
+        identifier: res.address
+      });
     }
     return res;
   }, [client, callbacks, masterConfig]);
@@ -806,7 +995,11 @@ const ClientProvider = ({
     }
     const res = await utils.withTurnkeyErrorHandling(() => client.loginWithOtp(params), callbacks, "Failed to login with OTP");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Otp,
+        action: sdkTypes.AuthAction.LOGIN,
+        identifier: params.verificationToken
+      });
     }
     return res;
   }, [client, callbacks]);
@@ -834,7 +1027,11 @@ const ClientProvider = ({
     };
     const res = await utils.withTurnkeyErrorHandling(() => client.signUpWithOtp(params), callbacks, "Failed to sign up with OTP");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Otp,
+        action: sdkTypes.AuthAction.SIGNUP,
+        identifier: params.verificationToken
+      });
     }
     return res;
   }, [client, callbacks, masterConfig]);
@@ -862,11 +1059,29 @@ const ClientProvider = ({
     };
     const res = await utils.withTurnkeyErrorHandling(() => client.completeOtp(params), callbacks, "Failed to complete OTP");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Otp,
+        action: res.action,
+        identifier: res.verificationToken
+      });
     }
     return res;
   }, [client, callbacks, masterConfig]);
-  const completeOauth = react.useCallback(async params => {
+  const loginWithOauth = react.useCallback(async params => {
+    if (!client) {
+      throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    }
+    const res = await utils.withTurnkeyErrorHandling(() => client.loginWithOauth(params), callbacks, "Failed to login with OAuth");
+    if (res) {
+      await handlePostAuth({
+        method: base.AuthMethod.Oauth,
+        action: sdkTypes.AuthAction.LOGIN,
+        identifier: params.oidcToken
+      });
+    }
+    return res;
+  }, [client, callbacks]);
+  const signUpWithOauth = react.useCallback(async params => {
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     }
@@ -874,30 +1089,24 @@ const ClientProvider = ({
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
     }
     // If createSubOrgParams is not provided, use the default from masterConfig
-    const createSubOrgParams = params.createSubOrgParams ?? masterConfig.auth?.createSuborgParams?.oauth;
+    let createSubOrgParams = params.createSubOrgParams ?? masterConfig.auth?.createSuborgParams?.oauth;
     params = createSubOrgParams !== undefined ? {
       ...params,
       createSubOrgParams
     } : {
       ...params
     };
-    const res = await utils.withTurnkeyErrorHandling(() => client.completeOauth(params), callbacks, "Failed to complete OAuth");
+    const res = await utils.withTurnkeyErrorHandling(() => client.signUpWithOauth(params), callbacks, "Failed to sign up with OAuth");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Oauth,
+        action: sdkTypes.AuthAction.SIGNUP,
+        identifier: params.oidcToken
+      });
     }
     return res;
   }, [client, callbacks, masterConfig]);
-  const loginWithOauth = react.useCallback(async params => {
-    if (!client) {
-      throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
-    }
-    const res = await utils.withTurnkeyErrorHandling(() => client.loginWithOauth(params), callbacks, "Failed to login with OAuth");
-    if (res) {
-      await handlePostAuth();
-    }
-    return res;
-  }, [client, callbacks]);
-  const signUpWithOauth = react.useCallback(async params => {
+  const completeOauth = react.useCallback(async params => {
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     }
@@ -905,16 +1114,20 @@ const ClientProvider = ({
       throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
     }
     // If createSubOrgParams is not provided, use the default from masterConfig
-    let createSubOrgParams = params.createSubOrgParams ?? masterConfig.auth?.createSuborgParams?.oauth;
+    const createSubOrgParams = params.createSubOrgParams ?? masterConfig.auth?.createSuborgParams?.oauth;
     params = createSubOrgParams !== undefined ? {
       ...params,
       createSubOrgParams
     } : {
       ...params
     };
-    const res = await utils.withTurnkeyErrorHandling(() => client.signUpWithOauth(params), callbacks, "Failed to sign up with OAuth");
+    const res = await utils.withTurnkeyErrorHandling(() => client.completeOauth(params), callbacks, "Failed to complete OAuth");
     if (res) {
-      await handlePostAuth();
+      await handlePostAuth({
+        method: base.AuthMethod.Oauth,
+        action: res.action,
+        identifier: params.oidcToken
+      });
     }
     return res;
   }, [client, callbacks, masterConfig]);
@@ -930,6 +1143,12 @@ const ClientProvider = ({
     }
     return utils.withTurnkeyErrorHandling(() => client.fetchWalletAccounts(params), callbacks, "Failed to fetch wallet accounts");
   }, [client, callbacks]);
+  const fetchPrivateKeys = react.useCallback(async params => {
+    if (!client) {
+      throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    }
+    return utils.withTurnkeyErrorHandling(() => client.fetchPrivateKeys(params), callbacks, "Failed to fetch private keys");
+  }, [client, callbacks]);
   const signMessage = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.signMessage(params), callbacks, "Failed to sign message");
@@ -941,7 +1160,7 @@ const ClientProvider = ({
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return new Promise((resolve, reject) => {
       pushPage({
-        key: "Sign Message",
+        key: "Sign message",
         content: jsxRuntime.jsx(Message.SignMessageModal, {
           message: params.message,
           subText: params?.subText,
@@ -979,6 +1198,14 @@ const ClientProvider = ({
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.fetchUser(params), callbacks, "Failed to fetch user");
   }, [client, callbacks]);
+  const fetchOrCreateP256ApiKeyUser = react.useCallback(async params => {
+    if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    return utils.withTurnkeyErrorHandling(() => client.fetchOrCreateP256ApiKeyUser(params), callbacks, "Failed to fetch or create delegated access user");
+  }, [client, callbacks]);
+  const fetchOrCreatePolicies = react.useCallback(async params => {
+    if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    return utils.withTurnkeyErrorHandling(() => client.fetchOrCreatePolicies(params), callbacks, "Failed to fetch or create delegated access user");
+  }, [client, callbacks]);
   const updateUserEmail = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const res = await utils.withTurnkeyErrorHandling(() => client.updateUserEmail(params), callbacks, "Failed to update user email");
@@ -1087,7 +1314,7 @@ const ClientProvider = ({
       stampWith: params?.stampWith
     });
     return res;
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const importWallet = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const res = await utils.withTurnkeyErrorHandling(() => client.importWallet(params), callbacks, "Failed to import wallet");
@@ -1095,16 +1322,16 @@ const ClientProvider = ({
       stampWith: params?.stampWith
     });
     return res;
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const importPrivateKey = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const res = await utils.withTurnkeyErrorHandling(() => client.importPrivateKey(params), callbacks, "Failed to import private key");
     return res;
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const deleteSubOrganization = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.deleteSubOrganization(params), callbacks, "Failed to delete sub-organization");
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const storeSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     await utils.withTurnkeyErrorHandling(() => client.storeSession(params), callbacks, "Failed to store session");
@@ -1122,7 +1349,7 @@ const ClientProvider = ({
     setSession(session);
     setAllSessions(allSessions);
     return;
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const clearSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     await utils.withTurnkeyErrorHandling(() => client.clearSession(params), callbacks, "Failed to clear session");
@@ -1131,13 +1358,13 @@ const ClientProvider = ({
     setSession(session);
     setAllSessions(allSessions);
     return;
-  }, [client, callbacks]);
+  }, [client, callbacks, session, user, masterConfig]);
   const clearAllSessions = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     setSession(undefined);
     setAllSessions(undefined);
     return await utils.withTurnkeyErrorHandling(() => client.clearAllSessions(), callbacks, "Failed to clear all sessions");
-  }, [client, callbacks]);
+  }, [client, callbacks, session, user, masterConfig]);
   const refreshSession = react.useCallback(async params => {
     if (!client) {
       throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
@@ -1166,15 +1393,15 @@ const ClientProvider = ({
     setSession(session);
     setAllSessions(allSessions);
     return res;
-  }, [client, callbacks]);
+  }, [client, callbacks, scheduleSessionExpiration, session, user, masterConfig]);
   const getSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getSession(params), callbacks, "Failed to get session");
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const getAllSessions = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getAllSessions(), callbacks, "Failed to get all sessions");
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const setActiveSession = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     const session = await utils.withTurnkeyErrorHandling(() => client.getSession({
@@ -1185,25 +1412,30 @@ const ClientProvider = ({
     }
     await utils.withTurnkeyErrorHandling(() => client.setActiveSession(params), callbacks, "Failed to set active session");
     setSession(session);
+    await utils.withTurnkeyErrorHandling(async () => {
+      await refreshWallets();
+      await refreshUser();
+    }, callbacks, "Failed to refresh data after setting active session");
     return;
-  }, [client, callbacks]);
+  }, [client, callbacks, session, user, masterConfig]);
   const getActiveSessionKey = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getActiveSessionKey(), callbacks, "Failed to get active session key");
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const clearUnusedKeyPairs = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.clearUnusedKeyPairs(), callbacks, "Failed to clear unused key pairs");
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const createApiKeyPair = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.createApiKeyPair(params), callbacks, "Failed to create API key pair");
-  }, [client, callbacks]);
+  }, [client, callbacks, session, user, masterConfig]);
   const getProxyAuthConfig = react.useCallback(async () => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     return utils.withTurnkeyErrorHandling(() => client.getProxyAuthConfig(), callbacks, "Failed to get proxy auth config");
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const refreshUser = react.useCallback(async params => {
+    if (!masterConfig?.autoRefreshManagedState) return;
     const {
       stampWith
     } = params || {};
@@ -1214,13 +1446,14 @@ const ClientProvider = ({
     if (user) {
       setUser(user);
     }
-  }, [client, callbacks]);
+  }, [client, callbacks, fetchUser, masterConfig, session, user]);
   const refreshWallets = react.useCallback(async params => {
+    if (!masterConfig?.autoRefreshManagedState) return;
     const {
       stampWith
     } = params || {};
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
-    const walletProviders = await utils.withTurnkeyErrorHandling(() => getWalletProviders(), callbacks, "Failed to refresh wallets");
+    const walletProviders = await utils.withTurnkeyErrorHandling(() => fetchWalletProviders(), callbacks, "Failed to refresh wallets");
     const wallets = await utils.withTurnkeyErrorHandling(() => fetchWallets({
       stampWith,
       walletProviders
@@ -1228,7 +1461,285 @@ const ClientProvider = ({
     if (wallets) {
       setWallets(wallets);
     }
-  }, [client, callbacks, getWalletProviders, fetchWallets]);
+  }, [client, callbacks, fetchWalletProviders, fetchWallets, masterConfig, session, user]);
+  const handleDiscordOauth = react.useCallback(async params => {
+    const {
+      clientId = masterConfig?.auth?.oauthConfig?.discordClientId,
+      openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
+      additionalState: additionalParameters
+    } = params || {};
+    try {
+      if (!masterConfig) {
+        throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+      }
+      if (!clientId) {
+        throw new sdkTypes.TurnkeyError("Discord Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+      }
+      if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
+        throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+      }
+      const flow = openInPage ? "redirect" : "popup";
+      const redirectURI = masterConfig.auth?.oauthConfig.oauthRedirectUri;
+      // Create key pair and generate nonce
+      const publicKey = await createApiKeyPair();
+      if (!publicKey) {
+        throw new Error("Failed to create public key for OAuth.");
+      }
+      const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
+      // Generate PKCE challenge pair
+      const {
+        verifier,
+        codeChallenge
+      } = await utils.generateChallengePair();
+      sessionStorage.setItem("discord_verifier", verifier);
+      // Construct Discord Auth URL
+      const discordAuthUrl = new URL(utils.DISCORD_AUTH_URL);
+      discordAuthUrl.searchParams.set("client_id", clientId);
+      discordAuthUrl.searchParams.set("redirect_uri", redirectURI);
+      discordAuthUrl.searchParams.set("response_type", "code");
+      discordAuthUrl.searchParams.set("code_challenge", codeChallenge);
+      discordAuthUrl.searchParams.set("code_challenge_method", "S256");
+      discordAuthUrl.searchParams.set("scope", "identify email");
+      discordAuthUrl.searchParams.set("state", `provider=discord&flow=${flow}&publicKey=${encodeURIComponent(publicKey)}&nonce=${nonce}`);
+      if (additionalParameters) {
+        const extra = Object.entries(additionalParameters).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+        if (extra) {
+          discordAuthUrl.searchParams.set("state", discordAuthUrl.searchParams.get("state") + `&${extra}`);
+        }
+      }
+      if (openInPage) {
+        window.location.href = discordAuthUrl.toString();
+        return new Promise((_, reject) => {
+          const timeout = setTimeout(() => {
+            reject(new Error("Authentication timed out."));
+          }, 300000);
+          window.addEventListener("beforeunload", () => clearTimeout(timeout));
+        });
+      } else {
+        const width = utils.popupWidth;
+        const height = utils.popupHeight;
+        const left = window.screenX + (window.innerWidth - width) / 2;
+        const top = window.screenY + (window.innerHeight - height) / 2;
+        const authWindow = window.open("about:blank", "_blank", `width=${width},height=${height},top=${top},left=${left},scrollbars=yes,resizable=yes`);
+        if (!authWindow) {
+          throw new Error("Failed to open Discord login window.");
+        }
+        authWindow.location.href = discordAuthUrl.toString();
+        return new Promise((resolve, reject) => {
+          const interval = setInterval(() => {
+            try {
+              if (authWindow.closed) {
+                clearInterval(interval);
+                reject(new Error("Authentication window was closed."));
+                return;
+              }
+              const url = authWindow.location.href || "";
+              if (url.startsWith(window.location.origin)) {
+                const urlParams = new URLSearchParams(new URL(url).search);
+                const authCode = urlParams.get("code");
+                const stateParam = urlParams.get("state");
+                const sessionKey = stateParam?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
+                if (authCode && stateParam && stateParam.includes("provider=discord")) {
+                  authWindow.close();
+                  clearInterval(interval);
+                  const verifier = sessionStorage.getItem("discord_verifier");
+                  if (!verifier) {
+                    reject(new Error("Missing PKCE verifier"));
+                    return;
+                  }
+                  client?.httpClient.proxyOAuth2Authenticate({
+                    provider: "OAUTH2_PROVIDER_DISCORD",
+                    authCode,
+                    redirectUri: redirectURI,
+                    codeVerifier: verifier,
+                    clientId,
+                    nonce: nonce
+                  }).then(resp => {
+                    sessionStorage.removeItem("discord_verifier");
+                    const oidcToken = resp.oidcToken;
+                    if (params?.onOauthSuccess) {
+                      params.onOauthSuccess({
+                        oidcToken,
+                        providerName: "discord",
+                        ...(sessionKey && {
+                          sessionKey
+                        })
+                      });
+                    } else if (callbacks?.onOauthRedirect) {
+                      callbacks.onOauthRedirect({
+                        idToken: oidcToken,
+                        publicKey,
+                        ...(sessionKey && {
+                          sessionKey
+                        })
+                      });
+                    } else {
+                      completeOauth({
+                        oidcToken,
+                        publicKey,
+                        providerName: "discord",
+                        ...(sessionKey && {
+                          sessionKey
+                        })
+                      }).then(() => resolve()).catch(reject);
+                      return;
+                    }
+                    resolve();
+                  }).catch(reject);
+                }
+              }
+            } catch {
+              // ignore cross-origin
+            }
+          }, 500);
+          if (authWindow.closed) {
+            clearInterval(interval);
+          }
+        });
+      }
+    } catch (error) {
+      throw error;
+    }
+  }, [client, callbacks, completeOauth, createApiKeyPair, masterConfig, session, user]);
+  const handleXOauth = react.useCallback(async params => {
+    const {
+      clientId = masterConfig?.auth?.oauthConfig?.xClientId,
+      openInPage = masterConfig?.auth?.oauthConfig?.openOauthInPage ?? false,
+      additionalState: additionalParameters
+    } = params || {};
+    try {
+      if (!masterConfig) {
+        throw new sdkTypes.TurnkeyError("Config is not ready yet!", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+      }
+      if (!clientId) {
+        throw new sdkTypes.TurnkeyError("Twitter Client ID is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+      }
+      if (!masterConfig.auth?.oauthConfig?.oauthRedirectUri) {
+        throw new sdkTypes.TurnkeyError("OAuth Redirect URI is not configured.", sdkTypes.TurnkeyErrorCodes.INVALID_CONFIGURATION);
+      }
+      const flow = openInPage ? "redirect" : "popup";
+      const redirectURI = masterConfig.auth?.oauthConfig.oauthRedirectUri;
+      // Create key pair and generate nonce
+      const publicKey = await createApiKeyPair();
+      if (!publicKey) {
+        throw new Error("Failed to create public key for OAuth.");
+      }
+      const nonce = utils$1.bytesToHex(sha2.sha256(publicKey));
+      // Generate PKCE challenge pair
+      const {
+        verifier,
+        codeChallenge
+      } = await utils.generateChallengePair();
+      sessionStorage.setItem("twitter_verifier", verifier);
+      // Construct Twitter Auth URL
+      const twitterAuthUrl = new URL(utils.X_AUTH_URL);
+      twitterAuthUrl.searchParams.set("client_id", clientId);
+      twitterAuthUrl.searchParams.set("redirect_uri", redirectURI);
+      twitterAuthUrl.searchParams.set("response_type", "code");
+      twitterAuthUrl.searchParams.set("code_challenge", codeChallenge);
+      twitterAuthUrl.searchParams.set("code_challenge_method", "S256");
+      twitterAuthUrl.searchParams.set("scope", "tweet.read users.read");
+      twitterAuthUrl.searchParams.set("state", `provider=twitter&flow=${flow}&publicKey=${encodeURIComponent(publicKey)}&nonce=${nonce}`);
+      if (additionalParameters) {
+        const extra = Object.entries(additionalParameters).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+        if (extra) {
+          twitterAuthUrl.searchParams.set("state", twitterAuthUrl.searchParams.get("state") + `&${extra}`);
+        }
+      }
+      if (openInPage) {
+        window.location.href = twitterAuthUrl.toString();
+        return new Promise((_, reject) => {
+          const timeout = setTimeout(() => {
+            reject(new Error("Authentication timed out."));
+          }, 300000);
+          window.addEventListener("beforeunload", () => clearTimeout(timeout));
+        });
+      } else {
+        const width = utils.popupWidth;
+        const height = utils.popupHeight;
+        const left = window.screenX + (window.innerWidth - width) / 2;
+        const top = window.screenY + (window.innerHeight - height) / 2;
+        const authWindow = window.open("about:blank", "_blank", `width=${width},height=${height},top=${top},left=${left},scrollbars=yes,resizable=yes`);
+        if (!authWindow) {
+          throw new Error("Failed to open Twitter login window.");
+        }
+        authWindow.location.href = twitterAuthUrl.toString();
+        return new Promise((resolve, reject) => {
+          const interval = setInterval(() => {
+            try {
+              if (authWindow.closed) {
+                clearInterval(interval);
+                reject(new Error("Authentication window was closed."));
+                return;
+              }
+              const url = authWindow.location.href || "";
+              if (url.startsWith(window.location.origin)) {
+                const urlParams = new URLSearchParams(new URL(url).search);
+                const authCode = urlParams.get("code");
+                const stateParam = urlParams.get("state");
+                const sessionKey = stateParam?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
+                if (authCode && stateParam && stateParam.includes("provider=twitter")) {
+                  authWindow.close();
+                  clearInterval(interval);
+                  const verifier = sessionStorage.getItem("twitter_verifier");
+                  if (!verifier) {
+                    reject(new Error("Missing PKCE verifier"));
+                    return;
+                  }
+                  client?.httpClient.proxyOAuth2Authenticate({
+                    provider: "OAUTH2_PROVIDER_X",
+                    authCode,
+                    redirectUri: redirectURI,
+                    codeVerifier: verifier,
+                    clientId,
+                    nonce
+                  }).then(resp => {
+                    sessionStorage.removeItem("twitter_verifier");
+                    const oidcToken = resp.oidcToken;
+                    if (params?.onOauthSuccess) {
+                      params.onOauthSuccess({
+                        oidcToken,
+                        providerName: "twitter",
+                        ...(sessionKey && {
+                          sessionKey
+                        })
+                      });
+                    } else if (callbacks?.onOauthRedirect) {
+                      callbacks.onOauthRedirect({
+                        idToken: oidcToken,
+                        publicKey,
+                        ...(sessionKey && {
+                          sessionKey
+                        })
+                      });
+                    } else {
+                      completeOauth({
+                        oidcToken,
+                        publicKey,
+                        providerName: "twitter",
+                        ...(sessionKey && {
+                          sessionKey
+                        })
+                      }).then(() => resolve()).catch(reject);
+                      return;
+                    }
+                    resolve();
+                  }).catch(reject);
+                }
+              }
+            } catch {
+              // ignore cross-origin
+            }
+          }, 500);
+          if (authWindow.closed) {
+            clearInterval(interval);
+          }
+        });
+      }
+    } catch (error) {
+      throw error;
+    }
+  }, [client, callbacks, masterConfig, session, user]);
   const handleGoogleOauth = react.useCallback(async params => {
     const {
       clientId = masterConfig?.auth?.oauthConfig?.googleClientId,
@@ -1309,24 +1820,35 @@ const ClientProvider = ({
               if (url.startsWith(window.location.origin)) {
                 const hashParams = new URLSearchParams(url.split("#")[1]);
                 const idToken = hashParams.get("id_token");
+                const stateParams = hashParams.get("state");
+                const sessionKey = stateParams?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
                 if (idToken) {
                   authWindow.close();
                   clearInterval(interval);
                   if (params?.onOauthSuccess) {
                     params.onOauthSuccess({
                       oidcToken: idToken,
-                      providerName: "google"
+                      providerName: "google",
+                      ...(sessionKey && {
+                        sessionKey
+                      })
                     });
                   } else if (callbacks?.onOauthRedirect) {
                     callbacks.onOauthRedirect({
                       idToken,
-                      publicKey
+                      publicKey,
+                      ...(sessionKey && {
+                        sessionKey
+                      })
                     });
                   } else {
                     completeOauth({
                       oidcToken: idToken,
                       publicKey,
-                      providerName: "google"
+                      providerName: "google",
+                      ...(sessionKey && {
+                        sessionKey
+                      })
                     }).then(() => resolve()).catch(reject);
                     return;
                   }
@@ -1345,7 +1867,7 @@ const ClientProvider = ({
     } catch (error) {
       throw error;
     }
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const handleAppleOauth = react.useCallback(async params => {
     const {
       clientId = masterConfig?.auth?.oauthConfig?.appleClientId,
@@ -1422,24 +1944,35 @@ const ClientProvider = ({
               if (url.startsWith(window.location.origin)) {
                 const hashParams = new URLSearchParams(url.split("#")[1]);
                 const idToken = hashParams.get("id_token");
+                const stateParams = hashParams.get("state");
+                const sessionKey = stateParams?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
                 if (idToken) {
                   authWindow.close();
                   clearInterval(interval);
                   if (params?.onOauthSuccess) {
                     params.onOauthSuccess({
                       oidcToken: idToken,
-                      providerName: "apple"
+                      providerName: "apple",
+                      ...(sessionKey && {
+                        sessionKey
+                      })
                     });
                   } else if (callbacks?.onOauthRedirect) {
                     callbacks.onOauthRedirect({
                       idToken,
-                      publicKey
+                      publicKey,
+                      ...(sessionKey && {
+                        sessionKey
+                      })
                     });
                   } else {
                     completeOauth({
                       oidcToken: idToken,
                       publicKey,
-                      providerName: "apple"
+                      providerName: "apple",
+                      ...(sessionKey && {
+                        sessionKey
+                      })
                     }).then(() => resolve()).catch(reject);
                     return;
                   }
@@ -1458,7 +1991,7 @@ const ClientProvider = ({
     } catch (error) {
       throw error;
     }
-  }, [client, callbacks]);
+  }, [client, callbacks, masterConfig, session, user]);
   const handleFacebookOauth = react.useCallback(async params => {
     const {
       clientId = masterConfig?.auth?.oauthConfig?.facebookClientId,
@@ -1546,6 +2079,7 @@ const ClientProvider = ({
                 const authCode = urlParams.get("code");
                 const stateParam = urlParams.get("state");
                 if (authCode && stateParam && stateParam.includes("provider=facebook")) {
+                  const sessionKey = stateParam?.split("&").find(param => param.startsWith("sessionKey="))?.split("=")[1];
                   authWindow.close();
                   clearInterval(interval);
                   // Exchange code for token
@@ -1559,18 +2093,27 @@ const ClientProvider = ({
                     if (params?.onOauthSuccess) {
                       params.onOauthSuccess({
                         oidcToken: tokenData.id_token,
-                        providerName: "apple"
+                        providerName: "facebook",
+                        ...(sessionKey && {
+                          sessionKey
+                        })
                       });
                     } else if (callbacks?.onOauthRedirect) {
                       callbacks.onOauthRedirect({
                         idToken: tokenData.id_token,
-                        publicKey
+                        publicKey,
+                        ...(sessionKey && {
+                          sessionKey
+                        })
                       });
                     } else {
                       completeOauth({
                         oidcToken: tokenData.id_token,
                         publicKey,
-                        providerName: "facebook"
+                        providerName: "facebook",
+                        ...(sessionKey && {
+                          sessionKey
+                        })
                       }).then(() => resolve()).catch(reject);
                       return;
                     }
@@ -1590,13 +2133,15 @@ const ClientProvider = ({
     } catch (error) {
       throw error;
     }
-  }, [client, callbacks]);
-  const handleLogin = react.useCallback(async () => {
+  }, [client, callbacks, masterConfig, client, session, user]);
+  const handleLogin = react.useCallback(async params => {
     pushPage({
       key: "Log in or sign up",
-      content: jsxRuntime.jsx(index.AuthComponent, {})
+      content: jsxRuntime.jsx(index.AuthComponent, {
+        sessionKey: params?.sessionKey
+      })
     });
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleExportWallet = react.useCallback(async params => {
     const {
       walletId,
@@ -1604,7 +2149,7 @@ const ClientProvider = ({
       stampWith
     } = params;
     pushPage({
-      key: "Export Wallet",
+      key: "Export wallet",
       content: jsxRuntime.jsx(Export.ExportComponent, {
         target: walletId,
         exportType: base.ExportType.Wallet,
@@ -1616,18 +2161,22 @@ const ClientProvider = ({
         } : {})
       })
     });
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleExportPrivateKey = react.useCallback(async params => {
     const {
       privateKeyId,
       targetPublicKey,
+      keyFormat,
       stampWith
     } = params;
     pushPage({
-      key: "Export Private Key",
+      key: "Export private key",
       content: jsxRuntime.jsx(Export.ExportComponent, {
         target: privateKeyId,
         exportType: base.ExportType.PrivateKey,
+        ...(keyFormat !== undefined ? {
+          keyFormat
+        } : {}),
         ...(targetPublicKey !== undefined ? {
           targetPublicKey
         } : {}),
@@ -1636,18 +2185,22 @@ const ClientProvider = ({
         } : {})
       })
     });
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleExportWalletAccount = react.useCallback(async params => {
     const {
       address,
       targetPublicKey,
+      keyFormat,
       stampWith
     } = params;
     pushPage({
-      key: "Export Wallet Account",
+      key: "Export wallet account",
       content: jsxRuntime.jsx(Export.ExportComponent, {
         target: address,
         exportType: base.ExportType.WalletAccount,
+        ...(keyFormat !== undefined ? {
+          keyFormat
+        } : {}),
         ...(targetPublicKey !== undefined ? {
           targetPublicKey
         } : {}),
@@ -1656,7 +2209,7 @@ const ClientProvider = ({
         } : {})
       })
     });
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleImportWallet = react.useCallback(async params => {
     const {
       defaultWalletAccounts,
@@ -1665,8 +2218,9 @@ const ClientProvider = ({
     } = params || {};
     try {
       return utils.withTurnkeyErrorHandling(() => new Promise((resolve, reject) => pushPage({
-        key: "Import Wallet",
+        key: "Import wallet",
         content: jsxRuntime.jsx(Import.ImportComponent, {
+          importType: base.ImportType.Wallet,
           onError: error => {
             reject(error);
           },
@@ -1688,7 +2242,40 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to import wallet.", sdkTypes.TurnkeyErrorCodes.IMPORT_WALLET_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
+  const handleImportPrivateKey = react.useCallback(async params => {
+    const {
+      curve,
+      addressFormats,
+      successPageDuration = 2000,
+      stampWith
+    } = params || {};
+    try {
+      return utils.withTurnkeyErrorHandling(() => new Promise((resolve, reject) => pushPage({
+        key: "Import private key",
+        content: jsxRuntime.jsx(Import.ImportComponent, {
+          importType: base.ImportType.PrivateKey,
+          curve: curve,
+          addressFormats: addressFormats,
+          onError: error => {
+            reject(error);
+          },
+          onSuccess: privateKeyId => resolve(privateKeyId),
+          ...(successPageDuration !== undefined && {
+            successPageDuration
+          }),
+          ...(stampWith !== undefined && {
+            stampWith
+          })
+        })
+      })));
+    } catch (error) {
+      if (error instanceof sdkTypes.TurnkeyError) {
+        throw error;
+      }
+      throw new sdkTypes.TurnkeyError("Failed to import private key.", sdkTypes.TurnkeyErrorCodes.IMPORT_WALLET_ERROR, error);
+    }
+  }, [pushPage, masterConfig, client, session, user]);
   const handleUpdateUserName = react.useCallback(async params => {
     const {
       successPageDuration = 2000,
@@ -1754,7 +2341,7 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to update user name.", sdkTypes.TurnkeyErrorCodes.UPDATE_USER_NAME_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleUpdateUserPhoneNumber = react.useCallback(async params => {
     const {
       successPageDuration = 2000,
@@ -1858,7 +2445,7 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to initialize OTP for sms verification.", sdkTypes.TurnkeyErrorCodes.INIT_OTP_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleUpdateUserEmail = react.useCallback(async params => {
     const {
       successPageDuration = 2000,
@@ -1955,14 +2542,16 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to initialize OTP for email verification.", sdkTypes.TurnkeyErrorCodes.INIT_OTP_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleAddEmail = react.useCallback(async params => {
     const {
       successPageDuration = 2000,
       subTitle,
       title
     } = params || {};
-    if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    if (!client) {
+      throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
+    }
     if (!session) {
       throw new sdkTypes.TurnkeyError("No active session found.", sdkTypes.TurnkeyErrorCodes.NO_SESSION_FOUND);
     }
@@ -2052,7 +2641,7 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to initialize OTP for email verification.", sdkTypes.TurnkeyErrorCodes.INIT_OTP_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, client, session, user]);
   const handleAddPhoneNumber = react.useCallback(async params => {
     const {
       successPageDuration = 2000,
@@ -2160,7 +2749,7 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to initialize OTP for sms verification.", sdkTypes.TurnkeyErrorCodes.INIT_OTP_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleRemovePasskey = react.useCallback(async params => {
     const {
       authenticatorId,
@@ -2201,7 +2790,7 @@ const ClientProvider = ({
         preventBack: true
       });
     }), callbacks, "Failed to remove passkey");
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleAddPasskey = react.useCallback(async params => {
     const {
       name,
@@ -2246,7 +2835,7 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to add passkey in handler.", sdkTypes.TurnkeyErrorCodes.ADD_PASSKEY_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleRemoveOauthProvider = react.useCallback(async params => {
     const {
       providerId,
@@ -2290,7 +2879,7 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to remove OAuth provider in handler.", sdkTypes.TurnkeyErrorCodes.REMOVE_OAUTH_PROVIDER_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleAddOauthProvider = react.useCallback(async params => {
     if (!client) throw new sdkTypes.TurnkeyError("Client is not initialized.", sdkTypes.TurnkeyErrorCodes.CLIENT_NOT_INITIALIZED);
     if (!session) {
@@ -2320,6 +2909,22 @@ const ClientProvider = ({
       });
     };
     switch (providerName) {
+      case sdkTypes.OAuthProviders.DISCORD:
+        {
+          await handleDiscordOauth({
+            openInPage: false,
+            onOauthSuccess
+          });
+          break;
+        }
+      case sdkTypes.OAuthProviders.X:
+        {
+          await handleXOauth({
+            openInPage: false,
+            onOauthSuccess
+          });
+          break;
+        }
       case sdkTypes.OAuthProviders.GOOGLE:
         {
           await handleGoogleOauth({
@@ -2349,8 +2954,8 @@ const ClientProvider = ({
           throw new sdkTypes.TurnkeyError(`Unsupported OAuth provider: ${providerName}`, sdkTypes.TurnkeyErrorCodes.NOT_FOUND);
         }
     }
-  }, [pushPage]);
-  const handleLinkExternalWallet = react.useCallback(async params => {
+  }, [pushPage, masterConfig, client, session, user]);
+  const handleConnectExternalWallet = react.useCallback(async params => {
     const {
       successPageDuration = 2000
     } = params || {};
@@ -2361,15 +2966,15 @@ const ClientProvider = ({
     if (!masterConfig?.walletConfig?.features?.connecting) {
       throw new sdkTypes.TurnkeyError("Wallet connecting is not enabled.", sdkTypes.TurnkeyErrorCodes.FEATURE_NOT_ENABLED);
     }
-    const providers = await getWalletProviders();
+    const providers = await fetchWalletProviders();
     pushPage({
-      key: "Link Wallet",
-      content: jsxRuntime.jsx(LinkWallet.LinkWalletModal, {
+      key: "Connect wallet",
+      content: jsxRuntime.jsx(ConnectWallet.ConnectWalletModal, {
         providers: providers,
         successPageDuration: successPageDuration
       })
     });
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleRemoveUserEmail = react.useCallback(async params => {
     const {
       successPageDuration = 2000,
@@ -2408,7 +3013,7 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to remove user email.", sdkTypes.TurnkeyErrorCodes.UPDATE_USER_EMAIL_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   const handleRemoveUserPhoneNumber = react.useCallback(async params => {
     const {
       successPageDuration = 2000,
@@ -2447,7 +3052,7 @@ const ClientProvider = ({
       }
       throw new sdkTypes.TurnkeyError("Failed to remove user phone number.", sdkTypes.TurnkeyErrorCodes.UPDATE_USER_PHONE_NUMBER_ERROR, error);
     }
-  }, [pushPage]);
+  }, [pushPage, masterConfig, client, session, user]);
   react.useEffect(() => {
     if (proxyAuthConfigRef.current) return;
     // Only fetch the proxy auth config once. Use that to build the master config.
@@ -2546,7 +3151,7 @@ const ClientProvider = ({
       logout,
       loginWithPasskey,
       signUpWithPasskey,
-      getWalletProviders,
+      fetchWalletProviders,
       connectWalletAccount,
       disconnectWalletAccount,
       switchWalletAccountChain,
@@ -2563,11 +3168,14 @@ const ClientProvider = ({
       completeOauth,
       fetchWallets,
       fetchWalletAccounts,
+      fetchPrivateKeys,
       refreshWallets,
       signMessage,
       signTransaction,
       signAndSendTransaction,
       fetchUser,
+      fetchOrCreateP256ApiKeyUser,
+      fetchOrCreatePolicies,
       refreshUser,
       updateUserEmail,
       removeUserEmail,
@@ -2599,12 +3207,15 @@ const ClientProvider = ({
       getProxyAuthConfig,
       handleLogin,
       handleGoogleOauth,
+      handleXOauth,
+      handleDiscordOauth,
       handleAppleOauth,
       handleFacebookOauth,
       handleExportWallet,
       handleExportPrivateKey,
       handleExportWalletAccount,
       handleImportWallet,
+      handleImportPrivateKey,
       handleUpdateUserEmail,
       handleUpdateUserPhoneNumber,
       handleUpdateUserName,
@@ -2615,7 +3226,7 @@ const ClientProvider = ({
       handleAddEmail,
       handleAddPhoneNumber,
       handleSignMessage,
-      handleLinkExternalWallet,
+      handleConnectExternalWallet,
       handleRemoveUserEmail,
       handleRemoveUserPhoneNumber
     },