@turnkey/react-wallet-kit 2.1.1 → 2.3.0

package/dist/providers/client/Provider.mjs

@@ -1,9 +1,9 @@
 'use client';
 import { slicedToArray as _slicedToArray, asyncToGenerator as _asyncToGenerator, regenerator as _regenerator, objectSpread2 as _objectSpread2, toConsumableArray as _toConsumableArray } from '../../_virtual/_rollupPluginBabelHelpers.mjs';
-import { jsx } from 'react/jsx-runtime';
+import { jsxs, jsx } from 'react/jsx-runtime';
 import { sha256 } from '@noble/hashes/sha2';
 import { bytesToHex } from '@noble/hashes/utils';
-import { storePKCEVerifier, storeOAuthAddProviderMetadata, clearAllOAuthData, getOAuthAddProviderMetadata, hasPKCEVerifier, OAUTH_INTENT_ADD_PROVIDER } from '../../utils/oauth/storage.mjs';
+import { storePKCEVerifier, storeOAuthCaptchaToken, storeOAuthAddProviderMetadata, clearAllOAuthData, getOAuthAddProviderMetadata, hasPKCEVerifier, OAUTH_INTENT_ADD_PROVIDER } from '../../utils/oauth/storage.mjs';
 import '../../utils/oauth/config.mjs';
 import { parseOAuthResponse, openOAuthPopup, buildOAuthUrl, redirectToOAuthProvider, cleanupOAuthUrlPreserveSearch, cleanupOAuthUrl } from '../../utils/oauth/url.mjs';
 import { completeOAuthPopup, completeOAuthFlow, completePKCEFlow } from '../../utils/oauth/completion.mjs';
@@ -11,7 +11,7 @@ import { generateChallengePair, exchangeFacebookCodeForToken } from '../../utils
 import { capitalizeProviderName, getProviderIcon } from '../../utils/oauth/helpers.mjs';
 import { useWalletProviderState, useDebouncedCallback, isValidSession, withTurnkeyErrorHandling, SESSION_WARNING_THRESHOLD_MS, mergeWalletsWithoutDuplicates } from '../../utils/utils.mjs';
 import { clearKeys, clearAll, setCappedTimeoutInMap, clearKey, setTimeoutInMap } from '../../utils/timers.mjs';
-import { resetPasskeyScope, DEFAULT_SESSION_EXPIRATION_IN_SECONDS, OtpType, applyPasskeyScope, buildSecondaryOauthProviders, TurnkeyClient, Chain, WalletInterfaceType, getAuthProxyConfig, WalletSource, buildSecondaryOidcClaims } from '@turnkey/core';
+import { resetPasskeyScope, DEFAULT_SESSION_EXPIRATION_IN_SECONDS, OtpType, applyPasskeyScope, buildSecondaryOauthProviders, TurnkeyClient, Chain, WalletInterfaceType, getAuthProxyConfig, getClientParams, WalletSource, buildSecondaryOidcClaims } from '@turnkey/core';
 import { useState, useRef, useCallback, useEffect } from 'react';
 import { TurnkeyError, TurnkeyErrorCodes, TurnkeyNetworkError, AuthAction, OAuthProviders, FiatOnRampCryptoCurrency, FiatOnRampBlockchainNetwork } from '@turnkey/sdk-types';
 import { useModal } from '../modal/Hook.mjs';
@@ -39,6 +39,7 @@ import { OnRampPage } from '../../components/onramp/OnRamp.mjs';
 import { CoinbaseLogo, MoonPayLogo } from '../../components/design/Svg.mjs';
 import { SendTransactionPage } from '../../components/send-transaction/SendTransaction.mjs';
 import { getChainLogo } from '../../components/send-transaction/helpers.mjs';
+import { Turnstile } from '../../components/auth/Turnstile.mjs';
 
 /**
  * Provides Turnkey client authentication, session management, wallet operations, and user profile management
@@ -99,6 +100,14 @@ var ClientProvider = function ClientProvider(_ref) {
     _useState12 = _slicedToArray(_useState11, 2),
     authState = _useState12[0],
     setAuthState = _useState12[1];
+  // Turnstile state: pre-warm the challenge in the background
+  var turnstileTokenRef = useRef(null);
+  var getTurnstileToken = useCallback(function () {
+    return turnstileTokenRef.current;
+  }, []);
+  var setTurnstileToken = useCallback(function (token) {
+    turnstileTokenRef.current = token;
+  }, []);
   // if there is no authProxyConfigId or if autoFetchWalletKitConfig is specifically
   // set to false, we don't need to fetch the config
   var shouldFetchWalletKitConfig = !!config.authProxyConfigId && ((_config$autoFetchWall = config.autoFetchWalletKitConfig) !== null && _config$autoFetchWall !== void 0 ? _config$autoFetchWall : true);
@@ -110,6 +119,7 @@ var ClientProvider = function ClientProvider(_ref) {
     setWalletProviders = _useWalletProviderSta2[1];
   var expiryTimeoutsRef = useRef({});
   var proxyAuthConfigRef = useRef(null);
+  var clientParamsRef = useRef(null);
   var _useState13 = useState(undefined),
     _useState14 = _slicedToArray(_useState13, 2),
     allSessions = _useState14[0],
@@ -121,7 +131,7 @@ var ClientProvider = function ClientProvider(_ref) {
     closeModal = _useModal.closeModal;
   var completeRedirectOauth = /*#__PURE__*/function () {
     var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee1() {
-      var withModalWrapper, result, code, provider, publicKey, oauthIntent, sessionKey, nonce, openModal, isAddProvider, metadata, completePKCERedirect, _masterConfig$auth2, _masterConfig$auth2$o, _masterConfig$auth2$o2, _masterConfig$auth$oa, _masterConfig$auth3, _masterConfig$auth3$o, _masterConfig$auth3$o2, _masterConfig$auth4, _masterConfig$auth4$o, clientId, secondaryClientIds, redirectURI, hasVerifier, _masterConfig$auth5, _masterConfig$auth5$o, _masterConfig$auth5$o2, _masterConfig$auth$oa2, _masterConfig$auth6, _masterConfig$auth6$o, _masterConfig$auth6$o2, _masterConfig$auth7, _masterConfig$auth7$o, _clientId, _secondaryClientIds, _redirectURI, _hasVerifier, _masterConfig$auth8, _masterConfig$auth8$o, _masterConfig$auth8$o2, _masterConfig$auth$oa3, _masterConfig$auth9, _masterConfig$auth9$o, _masterConfig$auth9$o2, _masterConfig$auth0, _masterConfig$auth0$o, _clientId2, _secondaryClientIds2, _redirectURI2, _hasVerifier2, _ref0, _masterConfig$auth1, _masterConfig$auth1$o, _masterConfig$auth1$o2, _masterConfig$auth10, _masterConfig$auth10$, _masterConfig$auth10$2, _result, idToken, _provider, _publicKey, _openModal, _sessionKey, _oauthIntent, _isAddProvider, _metadata, resolvedProvider, _secondaryClientIds3, action;
+      var withModalWrapper, result, code, provider, publicKey, oauthIntent, sessionKey, nonce, openModal, captchaToken, isAddProvider, metadata, completePKCERedirect, _masterConfig$auth2, _masterConfig$auth2$o, _masterConfig$auth2$o2, _masterConfig$auth$oa, _masterConfig$auth3, _masterConfig$auth3$o, _masterConfig$auth3$o2, _masterConfig$auth4, _masterConfig$auth4$o, clientId, secondaryClientIds, redirectURI, hasVerifier, _masterConfig$auth5, _masterConfig$auth5$o, _masterConfig$auth5$o2, _masterConfig$auth$oa2, _masterConfig$auth6, _masterConfig$auth6$o, _masterConfig$auth6$o2, _masterConfig$auth7, _masterConfig$auth7$o, _clientId, _secondaryClientIds, _redirectURI, _hasVerifier, _masterConfig$auth8, _masterConfig$auth8$o, _masterConfig$auth8$o2, _masterConfig$auth$oa3, _masterConfig$auth9, _masterConfig$auth9$o, _masterConfig$auth9$o2, _masterConfig$auth0, _masterConfig$auth0$o, _clientId2, _secondaryClientIds2, _redirectURI2, _hasVerifier2, _ref0, _masterConfig$auth1, _masterConfig$auth1$o, _masterConfig$auth1$o2, _masterConfig$auth10, _masterConfig$auth10$, _masterConfig$auth10$2, _result, idToken, _provider, _publicKey, _openModal, _sessionKey, _oauthIntent, _captchaToken, _isAddProvider, _metadata, resolvedProvider, _secondaryClientIds3, action;
       return _regenerator().w(function (_context1) {
         while (1) switch (_context1.p = _context1.n) {
           case 0:
@@ -245,7 +255,7 @@ var ClientProvider = function ClientProvider(_ref) {
             }
             return _context1.a(2);
           case 3:
-            code = result.authCode, provider = result.provider, publicKey = result.publicKey, oauthIntent = result.oauthIntent, sessionKey = result.sessionKey, nonce = result.nonce, openModal = result.openModal;
+            code = result.authCode, provider = result.provider, publicKey = result.publicKey, oauthIntent = result.oauthIntent, sessionKey = result.sessionKey, nonce = result.nonce, openModal = result.openModal, captchaToken = result.captchaToken;
             isAddProvider = oauthIntent === OAUTH_INTENT_ADD_PROVIDER;
             metadata = isAddProvider ? getOAuthAddProviderMetadata() : null;
             /**
@@ -271,6 +281,7 @@ var ClientProvider = function ClientProvider(_ref) {
                                   publicKey: publicKey,
                                   providerName: providerName,
                                   sessionKey: sessionKey !== null && sessionKey !== void 0 ? sessionKey : undefined,
+                                  captchaToken: captchaToken !== null && captchaToken !== void 0 ? captchaToken : undefined,
                                   callbacks: callbacks,
                                   completeOauth: function completeOauth(completionParams) {
                                     var _masterConfig$auth, _masterConfig$auth$cr, _completionParams$pro, _existingCreateSubOrg;
@@ -503,7 +514,7 @@ var ClientProvider = function ClientProvider(_ref) {
             }
             return _context1.a(2);
           case 10:
-            idToken = _result.idToken, _provider = _result.provider, _publicKey = _result.publicKey, _openModal = _result.openModal, _sessionKey = _result.sessionKey, _oauthIntent = _result.oauthIntent;
+            idToken = _result.idToken, _provider = _result.provider, _publicKey = _result.publicKey, _openModal = _result.openModal, _sessionKey = _result.sessionKey, _oauthIntent = _result.oauthIntent, _captchaToken = _result.captchaToken;
             _isAddProvider = _oauthIntent === OAUTH_INTENT_ADD_PROVIDER;
             _metadata = _isAddProvider ? getOAuthAddProviderMetadata() : null;
             resolvedProvider = _provider || OAuthProviders.GOOGLE; // Grab Google/Apple secondary client IDs from config for use in completion
@@ -519,6 +530,7 @@ var ClientProvider = function ClientProvider(_ref) {
                         publicKey: _publicKey,
                         oidcToken: idToken,
                         sessionKey: _sessionKey !== null && _sessionKey !== void 0 ? _sessionKey : undefined,
+                        captchaToken: _captchaToken !== null && _captchaToken !== void 0 ? _captchaToken : undefined,
                         callbacks: callbacks,
                         completeOauth: function completeOauth(completionParams) {
                           var _masterConfig$auth11, _masterConfig$auth11$, _completionParams$pro2, _existingCreateSubOrg2;
@@ -592,7 +604,7 @@ var ClientProvider = function ClientProvider(_ref) {
       return _ref2.apply(this, arguments);
     };
   }();
-  var buildConfig = function buildConfig(proxyAuthConfig) {
+  var buildConfig = function buildConfig(proxyAuthConfig, clientParams) {
     var _config$ui$authModal$, _config$ui, _config$ui$authModal, _config$ui$authModal$2, _config$ui$authModal$3, _config$ui2, _config$ui2$authModal, _config$ui2$authModal2, _config$ui$authModal$4, _config$ui3, _config$ui3$authModal, _config$ui3$authModal2, _config$ui$authModal$5, _config$ui4, _config$ui4$authModal, _config$ui4$authModal2, _config$ui$authModal$6, _config$ui5, _config$ui5$authModal, _config$ui5$authModal2, _config$ui$authModal$7, _config$ui6, _config$ui6$authModal, _config$ui6$authModal2, _config$ui$authModal$8, _config$ui7, _config$ui7$authModal, _config$ui7$authModal2, _config$ui$authModal$9, _config$ui8, _config$ui8$authModal, _config$ui8$authModal2, _config$ui$authModal$0, _config$ui9, _config$ui9$authModal, _config$ui9$authModal2, _config$auth$oauthCon, _config$auth, _config$auth$oauthCon2, _config$auth$oauthCon3, _proxyAuthConfig$oaut, _config$auth$oauthCon4, _config$auth2, _config$auth2$oauthCo, _config$auth2$oauthCo2, _config$auth$oauthCon5, _config$auth3, _config$auth3$oauthCo, _config$auth3$oauthCo2, _proxyAuthConfig$oaut2, _config$auth$oauthCon6, _config$auth4, _config$auth4$oauthCo, _config$auth4$oauthCo2, _config$auth$oauthCon7, _config$auth5, _config$auth5$oauthCo, _config$auth5$oauthCo2, _proxyAuthConfig$oaut3, _config$auth$oauthCon8, _config$auth6, _config$auth6$oauthCo, _config$auth6$oauthCo2, _config$auth$oauthCon9, _config$auth7, _config$auth7$oauthCo, _config$auth7$oauthCo2, _proxyAuthConfig$oaut4, _config$auth$oauthCon0, _config$auth8, _config$auth8$oauthCo, _config$auth8$oauthCo2, _config$auth$oauthCon1, _config$auth9, _config$auth9$oauthCo, _config$auth9$oauthCo2, _proxyAuthConfig$oaut5, _config$auth$oauthCon10, _config$auth0, _config$auth0$oauthCo, _config$auth0$oauthCo2, _config$auth$oauthCon11, _config$auth1, _config$auth1$oauthCo, _config$ui$authModal$1, _config$ui0, _config$ui0$authModal, _config$ui$authModal$10, _config$ui1, _config$ui1$authModal, _proxyAuthConfig$sess, _config$auth13, _ref11, _proxyAuthConfig$otpA, _config$auth14, _ref12, _proxyAuthConfig$otpL, _config$auth15, _config$auth$scopePas, _config$auth16, _config$auth17, _config$auth18, _config$auth18$oauthC, _config$auth$autoRefr, _config$auth19, _config$ui10, _config$autoRefreshMa, _config$walletConfig, _ref13, _resolvedMethods$wall, _config$walletConfig2, _config$walletConfig3, _config$walletConfig$, _config$walletConfig4, _config$walletConfig5, _config$walletConfig6, _config$walletConfig7, _config$walletConfig8, _config$walletConfig$2, _config$walletConfig9, _config$walletConfig0, _config$walletConfig1, _config$walletConfig10, _config$walletConfig11, _config$walletConfig$3, _config$walletConfig12, _config$walletConfig13, _config$walletConfig14, _config$importIframeU, _config$exportIframeU;
     // Juggle the local overrides with the values set in the dashboard (proxyAuthConfig).
     var resolvedMethods = {
@@ -694,7 +706,8 @@ var ClientProvider = function ClientProvider(_ref) {
         })
       }),
       importIframeUrl: (_config$importIframeU = config.importIframeUrl) !== null && _config$importIframeU !== void 0 ? _config$importIframeU : "https://import.turnkey.com",
-      exportIframeUrl: (_config$exportIframeU = config.exportIframeUrl) !== null && _config$exportIframeU !== void 0 ? _config$exportIframeU : "https://export.turnkey.com"
+      exportIframeUrl: (_config$exportIframeU = config.exportIframeUrl) !== null && _config$exportIframeU !== void 0 ? _config$exportIframeU : "https://export.turnkey.com",
+      turnstileSiteKey: clientParams === null || clientParams === void 0 ? void 0 : clientParams.turnstileSiteKey
     });
   };
   /**
@@ -941,7 +954,7 @@ var ClientProvider = function ClientProvider(_ref) {
               var walletEvents = provider === null || provider === void 0 ? void 0 : (_provider$features = provider.features) === null || _provider$features === void 0 ? void 0 : _provider$features["standard:events"];
               if (walletEvents !== null && walletEvents !== void 0 && walletEvents.on) {
                 var offChange = walletEvents.on("change", /*#__PURE__*/function () {
-                  var _ref165 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee140(_evt) {
+                  var _ref166 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee140(_evt) {
                     return _regenerator().w(function (_context140) {
                       while (1) switch (_context140.n) {
                         case 0:
@@ -953,7 +966,7 @@ var ClientProvider = function ClientProvider(_ref) {
                     }, _callee140);
                   }));
                   return function (_x118) {
-                    return _ref165.apply(this, arguments);
+                    return _ref166.apply(this, arguments);
                   };
                 }());
                 cleanups.push(offChange);
@@ -967,7 +980,7 @@ var ClientProvider = function ClientProvider(_ref) {
             attachEthereumListeners = function _attachEthereumListen(provider, onUpdateState) {
               if (typeof provider.on !== "function") return;
               var handleChainChanged = /*#__PURE__*/function () {
-                var _ref163 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee138(_chainId) {
+                var _ref164 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee138(_chainId) {
                   return _regenerator().w(function (_context138) {
                     while (1) switch (_context138.n) {
                       case 0:
@@ -976,11 +989,11 @@ var ClientProvider = function ClientProvider(_ref) {
                   }, _callee138);
                 }));
                 return function handleChainChanged(_x116) {
-                  return _ref163.apply(this, arguments);
+                  return _ref164.apply(this, arguments);
                 };
               }();
               var handleAccountsChanged = /*#__PURE__*/function () {
-                var _ref164 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee139(accounts) {
+                var _ref165 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee139(accounts) {
                   return _regenerator().w(function (_context139) {
                     while (1) switch (_context139.n) {
                       case 0:
@@ -991,7 +1004,7 @@ var ClientProvider = function ClientProvider(_ref) {
                   }, _callee139);
                 }));
                 return function handleAccountsChanged(_x117) {
-                  return _ref164.apply(this, arguments);
+                  return _ref165.apply(this, arguments);
                 };
               }();
               var handleDisconnect = function handleDisconnect() {
@@ -1048,7 +1061,7 @@ var ClientProvider = function ClientProvider(_ref) {
               if (standardEvents !== null && standardEvents !== void 0 && standardEvents.on) {
                 if (standardEvents !== null && standardEvents !== void 0 && standardEvents.on) {
                   unsubscribe = standardEvents.on("change", /*#__PURE__*/function () {
-                    var _ref166 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee141(evt) {
+                    var _ref167 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee141(evt) {
                       var _callbacks$onError10, providers, currentSession, _wcProviders, wcWallets;
                       return _regenerator().w(function (_context141) {
                         while (1) switch (_context141.n) {
@@ -1110,7 +1123,7 @@ var ClientProvider = function ClientProvider(_ref) {
                       }, _callee141);
                     }));
                     return function (_x119) {
-                      return _ref166.apply(this, arguments);
+                      return _ref167.apply(this, arguments);
                     };
                   }());
                   cleanups.push(unsubscribe);
@@ -4003,11 +4016,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleDiscordOauth = useCallback(/*#__PURE__*/function () {
     var _ref108 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee96(params) {
       var _masterConfig$auth36, _masterConfig$auth36$, _masterConfig$auth36$2, _masterConfig$auth$oa4, _masterConfig$auth37, _masterConfig$auth37$, _masterConfig$auth37$2, _masterConfig$auth$oa5, _masterConfig$auth38, _masterConfig$auth38$, _masterConfig$auth39, _masterConfig$auth39$, _masterConfig$auth40;
-      var _ref109, _ref109$primaryClient, primaryClientId, _ref109$secondaryClie, secondaryClientIds, _ref109$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle, verifier, codeChallenge, authUrl, authWindow;
+      var _ref109, _ref109$primaryClient, primaryClientId, _ref109$secondaryClie, secondaryClientIds, _ref109$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle, verifier, codeChallenge, authUrl, authWindow;
       return _regenerator().w(function (_context96) {
         while (1) switch (_context96.n) {
           case 0:
-            _ref109 = params || {}, _ref109$primaryClient = _ref109.primaryClientId, primaryClientId = _ref109$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth36 = masterConfig.auth) === null || _masterConfig$auth36 === void 0 ? void 0 : (_masterConfig$auth36$ = _masterConfig$auth36.oauthConfig) === null || _masterConfig$auth36$ === void 0 ? void 0 : (_masterConfig$auth36$2 = _masterConfig$auth36$.discord) === null || _masterConfig$auth36$2 === void 0 ? void 0 : _masterConfig$auth36$2.primaryClientId : _ref109$primaryClient, _ref109$secondaryClie = _ref109.secondaryClientIds, secondaryClientIds = _ref109$secondaryClie === void 0 ? (_masterConfig$auth$oa4 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth37 = masterConfig.auth) === null || _masterConfig$auth37 === void 0 ? void 0 : (_masterConfig$auth37$ = _masterConfig$auth37.oauthConfig) === null || _masterConfig$auth37$ === void 0 ? void 0 : (_masterConfig$auth37$2 = _masterConfig$auth37$.discord) === null || _masterConfig$auth37$2 === void 0 ? void 0 : _masterConfig$auth37$2.secondaryClientIds) !== null && _masterConfig$auth$oa4 !== void 0 ? _masterConfig$auth$oa4 : [] : _ref109$secondaryClie, _ref109$openInPage = _ref109.openInPage, openInPage = _ref109$openInPage === void 0 ? (_masterConfig$auth$oa5 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth38 = masterConfig.auth) === null || _masterConfig$auth38 === void 0 ? void 0 : (_masterConfig$auth38$ = _masterConfig$auth38.oauthConfig) === null || _masterConfig$auth38$ === void 0 ? void 0 : _masterConfig$auth38$.openOauthInPage) !== null && _masterConfig$auth$oa5 !== void 0 ? _masterConfig$auth$oa5 : false : _ref109$openInPage, additionalParameters = _ref109.additionalState;
+            _ref109 = params || {}, _ref109$primaryClient = _ref109.primaryClientId, primaryClientId = _ref109$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth36 = masterConfig.auth) === null || _masterConfig$auth36 === void 0 ? void 0 : (_masterConfig$auth36$ = _masterConfig$auth36.oauthConfig) === null || _masterConfig$auth36$ === void 0 ? void 0 : (_masterConfig$auth36$2 = _masterConfig$auth36$.discord) === null || _masterConfig$auth36$2 === void 0 ? void 0 : _masterConfig$auth36$2.primaryClientId : _ref109$primaryClient, _ref109$secondaryClie = _ref109.secondaryClientIds, secondaryClientIds = _ref109$secondaryClie === void 0 ? (_masterConfig$auth$oa4 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth37 = masterConfig.auth) === null || _masterConfig$auth37 === void 0 ? void 0 : (_masterConfig$auth37$ = _masterConfig$auth37.oauthConfig) === null || _masterConfig$auth37$ === void 0 ? void 0 : (_masterConfig$auth37$2 = _masterConfig$auth37$.discord) === null || _masterConfig$auth37$2 === void 0 ? void 0 : _masterConfig$auth37$2.secondaryClientIds) !== null && _masterConfig$auth$oa4 !== void 0 ? _masterConfig$auth$oa4 : [] : _ref109$secondaryClie, _ref109$openInPage = _ref109.openInPage, openInPage = _ref109$openInPage === void 0 ? (_masterConfig$auth$oa5 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth38 = masterConfig.auth) === null || _masterConfig$auth38 === void 0 ? void 0 : (_masterConfig$auth38$ = _masterConfig$auth38.oauthConfig) === null || _masterConfig$auth38$ === void 0 ? void 0 : _masterConfig$auth38$.openOauthInPage) !== null && _masterConfig$auth$oa5 !== void 0 ? _masterConfig$auth$oa5 : false : _ref109$openInPage, additionalParameters = _ref109.additionalState, captchaToken = _ref109.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.DISCORD;
             if (masterConfig) {
@@ -4048,6 +4061,10 @@ var ClientProvider = function ClientProvider(_ref) {
             verifier = _yield$generateChalle.verifier;
             codeChallenge = _yield$generateChalle.codeChallenge;
             storePKCEVerifier(provider, verifier);
+            // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
             // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
@@ -4057,7 +4074,7 @@ var ClientProvider = function ClientProvider(_ref) {
               nonce: nonce,
               flow: flow,
               codeChallenge: codeChallenge,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context96.n = 7;
@@ -4103,6 +4120,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess,
                         exchangeCodeForToken: function () {
                           var _exchangeCodeForToken = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee95(codeVerifier) {
@@ -4154,11 +4172,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleXOauth = useCallback(/*#__PURE__*/function () {
     var _ref110 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee98(params) {
       var _masterConfig$auth42, _masterConfig$auth42$, _masterConfig$auth42$2, _masterConfig$auth$oa6, _masterConfig$auth43, _masterConfig$auth43$, _masterConfig$auth43$2, _masterConfig$auth$oa7, _masterConfig$auth44, _masterConfig$auth44$, _masterConfig$auth45, _masterConfig$auth45$, _masterConfig$auth46;
-      var _ref111, _ref111$primaryClient, primaryClientId, _ref111$secondaryClie, secondaryClientIds, _ref111$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle2, verifier, codeChallenge, authUrl, authWindow;
+      var _ref111, _ref111$primaryClient, primaryClientId, _ref111$secondaryClie, secondaryClientIds, _ref111$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle2, verifier, codeChallenge, authUrl, authWindow;
       return _regenerator().w(function (_context98) {
         while (1) switch (_context98.n) {
           case 0:
-            _ref111 = params || {}, _ref111$primaryClient = _ref111.primaryClientId, primaryClientId = _ref111$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth42 = masterConfig.auth) === null || _masterConfig$auth42 === void 0 ? void 0 : (_masterConfig$auth42$ = _masterConfig$auth42.oauthConfig) === null || _masterConfig$auth42$ === void 0 ? void 0 : (_masterConfig$auth42$2 = _masterConfig$auth42$.x) === null || _masterConfig$auth42$2 === void 0 ? void 0 : _masterConfig$auth42$2.primaryClientId : _ref111$primaryClient, _ref111$secondaryClie = _ref111.secondaryClientIds, secondaryClientIds = _ref111$secondaryClie === void 0 ? (_masterConfig$auth$oa6 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth43 = masterConfig.auth) === null || _masterConfig$auth43 === void 0 ? void 0 : (_masterConfig$auth43$ = _masterConfig$auth43.oauthConfig) === null || _masterConfig$auth43$ === void 0 ? void 0 : (_masterConfig$auth43$2 = _masterConfig$auth43$.x) === null || _masterConfig$auth43$2 === void 0 ? void 0 : _masterConfig$auth43$2.secondaryClientIds) !== null && _masterConfig$auth$oa6 !== void 0 ? _masterConfig$auth$oa6 : [] : _ref111$secondaryClie, _ref111$openInPage = _ref111.openInPage, openInPage = _ref111$openInPage === void 0 ? (_masterConfig$auth$oa7 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth44 = masterConfig.auth) === null || _masterConfig$auth44 === void 0 ? void 0 : (_masterConfig$auth44$ = _masterConfig$auth44.oauthConfig) === null || _masterConfig$auth44$ === void 0 ? void 0 : _masterConfig$auth44$.openOauthInPage) !== null && _masterConfig$auth$oa7 !== void 0 ? _masterConfig$auth$oa7 : false : _ref111$openInPage, additionalParameters = _ref111.additionalState;
+            _ref111 = params || {}, _ref111$primaryClient = _ref111.primaryClientId, primaryClientId = _ref111$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth42 = masterConfig.auth) === null || _masterConfig$auth42 === void 0 ? void 0 : (_masterConfig$auth42$ = _masterConfig$auth42.oauthConfig) === null || _masterConfig$auth42$ === void 0 ? void 0 : (_masterConfig$auth42$2 = _masterConfig$auth42$.x) === null || _masterConfig$auth42$2 === void 0 ? void 0 : _masterConfig$auth42$2.primaryClientId : _ref111$primaryClient, _ref111$secondaryClie = _ref111.secondaryClientIds, secondaryClientIds = _ref111$secondaryClie === void 0 ? (_masterConfig$auth$oa6 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth43 = masterConfig.auth) === null || _masterConfig$auth43 === void 0 ? void 0 : (_masterConfig$auth43$ = _masterConfig$auth43.oauthConfig) === null || _masterConfig$auth43$ === void 0 ? void 0 : (_masterConfig$auth43$2 = _masterConfig$auth43$.x) === null || _masterConfig$auth43$2 === void 0 ? void 0 : _masterConfig$auth43$2.secondaryClientIds) !== null && _masterConfig$auth$oa6 !== void 0 ? _masterConfig$auth$oa6 : [] : _ref111$secondaryClie, _ref111$openInPage = _ref111.openInPage, openInPage = _ref111$openInPage === void 0 ? (_masterConfig$auth$oa7 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth44 = masterConfig.auth) === null || _masterConfig$auth44 === void 0 ? void 0 : (_masterConfig$auth44$ = _masterConfig$auth44.oauthConfig) === null || _masterConfig$auth44$ === void 0 ? void 0 : _masterConfig$auth44$.openOauthInPage) !== null && _masterConfig$auth$oa7 !== void 0 ? _masterConfig$auth$oa7 : false : _ref111$openInPage, additionalParameters = _ref111.additionalState, captchaToken = _ref111.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.X;
             if (masterConfig) {
@@ -4199,6 +4217,10 @@ var ClientProvider = function ClientProvider(_ref) {
             verifier = _yield$generateChalle2.verifier;
             codeChallenge = _yield$generateChalle2.codeChallenge;
             storePKCEVerifier(provider, verifier);
+            // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
             // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
@@ -4208,7 +4230,7 @@ var ClientProvider = function ClientProvider(_ref) {
               nonce: nonce,
               flow: flow,
               codeChallenge: codeChallenge,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context98.n = 7;
@@ -4254,6 +4276,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess,
                         exchangeCodeForToken: function () {
                           var _exchangeCodeForToken2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee97(codeVerifier) {
@@ -4305,11 +4328,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleGoogleOauth = useCallback(/*#__PURE__*/function () {
     var _ref112 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee99(params) {
       var _masterConfig$auth48, _masterConfig$auth48$, _masterConfig$auth48$2, _masterConfig$auth$oa8, _masterConfig$auth49, _masterConfig$auth49$, _masterConfig$auth49$2, _masterConfig$auth$oa9, _masterConfig$auth50, _masterConfig$auth50$, _masterConfig$auth51, _masterConfig$auth51$, _masterConfig$auth52;
-      var _ref113, _ref113$primaryClient, primaryClientId, _ref113$secondaryClie, secondaryClientIds, _ref113$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, authUrl, authWindow;
+      var _ref113, _ref113$primaryClient, primaryClientId, _ref113$secondaryClie, secondaryClientIds, _ref113$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, authUrl, authWindow;
       return _regenerator().w(function (_context99) {
         while (1) switch (_context99.n) {
           case 0:
-            _ref113 = params || {}, _ref113$primaryClient = _ref113.primaryClientId, primaryClientId = _ref113$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth48 = masterConfig.auth) === null || _masterConfig$auth48 === void 0 ? void 0 : (_masterConfig$auth48$ = _masterConfig$auth48.oauthConfig) === null || _masterConfig$auth48$ === void 0 ? void 0 : (_masterConfig$auth48$2 = _masterConfig$auth48$.google) === null || _masterConfig$auth48$2 === void 0 ? void 0 : _masterConfig$auth48$2.primaryClientId : _ref113$primaryClient, _ref113$secondaryClie = _ref113.secondaryClientIds, secondaryClientIds = _ref113$secondaryClie === void 0 ? (_masterConfig$auth$oa8 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth49 = masterConfig.auth) === null || _masterConfig$auth49 === void 0 ? void 0 : (_masterConfig$auth49$ = _masterConfig$auth49.oauthConfig) === null || _masterConfig$auth49$ === void 0 ? void 0 : (_masterConfig$auth49$2 = _masterConfig$auth49$.google) === null || _masterConfig$auth49$2 === void 0 ? void 0 : _masterConfig$auth49$2.secondaryClientIds) !== null && _masterConfig$auth$oa8 !== void 0 ? _masterConfig$auth$oa8 : [] : _ref113$secondaryClie, _ref113$openInPage = _ref113.openInPage, openInPage = _ref113$openInPage === void 0 ? (_masterConfig$auth$oa9 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth50 = masterConfig.auth) === null || _masterConfig$auth50 === void 0 ? void 0 : (_masterConfig$auth50$ = _masterConfig$auth50.oauthConfig) === null || _masterConfig$auth50$ === void 0 ? void 0 : _masterConfig$auth50$.openOauthInPage) !== null && _masterConfig$auth$oa9 !== void 0 ? _masterConfig$auth$oa9 : false : _ref113$openInPage, additionalParameters = _ref113.additionalState;
+            _ref113 = params || {}, _ref113$primaryClient = _ref113.primaryClientId, primaryClientId = _ref113$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth48 = masterConfig.auth) === null || _masterConfig$auth48 === void 0 ? void 0 : (_masterConfig$auth48$ = _masterConfig$auth48.oauthConfig) === null || _masterConfig$auth48$ === void 0 ? void 0 : (_masterConfig$auth48$2 = _masterConfig$auth48$.google) === null || _masterConfig$auth48$2 === void 0 ? void 0 : _masterConfig$auth48$2.primaryClientId : _ref113$primaryClient, _ref113$secondaryClie = _ref113.secondaryClientIds, secondaryClientIds = _ref113$secondaryClie === void 0 ? (_masterConfig$auth$oa8 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth49 = masterConfig.auth) === null || _masterConfig$auth49 === void 0 ? void 0 : (_masterConfig$auth49$ = _masterConfig$auth49.oauthConfig) === null || _masterConfig$auth49$ === void 0 ? void 0 : (_masterConfig$auth49$2 = _masterConfig$auth49$.google) === null || _masterConfig$auth49$2 === void 0 ? void 0 : _masterConfig$auth49$2.secondaryClientIds) !== null && _masterConfig$auth$oa8 !== void 0 ? _masterConfig$auth$oa8 : [] : _ref113$secondaryClie, _ref113$openInPage = _ref113.openInPage, openInPage = _ref113$openInPage === void 0 ? (_masterConfig$auth$oa9 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth50 = masterConfig.auth) === null || _masterConfig$auth50 === void 0 ? void 0 : (_masterConfig$auth50$ = _masterConfig$auth50.oauthConfig) === null || _masterConfig$auth50$ === void 0 ? void 0 : _masterConfig$auth50$.openOauthInPage) !== null && _masterConfig$auth$oa9 !== void 0 ? _masterConfig$auth$oa9 : false : _ref113$openInPage, additionalParameters = _ref113.additionalState, captchaToken = _ref113.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.GOOGLE;
             if (masterConfig) {
@@ -4342,7 +4365,11 @@ var ClientProvider = function ClientProvider(_ref) {
             }
             throw new Error("Failed to create public key for OAuth.");
           case 5:
-            nonce = bytesToHex(sha256(publicKey)); // Build OAuth URL
+            nonce = bytesToHex(sha256(publicKey)); // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
+            // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
               clientId: clientId,
@@ -4350,7 +4377,7 @@ var ClientProvider = function ClientProvider(_ref) {
               publicKey: publicKey,
               nonce: nonce,
               flow: flow,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context99.n = 6;
@@ -4396,6 +4423,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess
                       }).then(function () {
                         return resolve();
@@ -4420,11 +4448,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleAppleOauth = useCallback(/*#__PURE__*/function () {
     var _ref114 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee100(params) {
       var _masterConfig$auth54, _masterConfig$auth54$, _masterConfig$auth54$2, _masterConfig$auth$oa0, _masterConfig$auth55, _masterConfig$auth55$, _masterConfig$auth55$2, _masterConfig$auth$oa1, _masterConfig$auth56, _masterConfig$auth56$, _masterConfig$auth57, _masterConfig$auth57$, _masterConfig$auth58;
-      var _ref115, _ref115$primaryClient, primaryClientId, _ref115$secondaryClie, secondaryClientIds, _ref115$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, authUrl, authWindow;
+      var _ref115, _ref115$primaryClient, primaryClientId, _ref115$secondaryClie, secondaryClientIds, _ref115$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, authUrl, authWindow;
       return _regenerator().w(function (_context100) {
         while (1) switch (_context100.n) {
           case 0:
-            _ref115 = params || {}, _ref115$primaryClient = _ref115.primaryClientId, primaryClientId = _ref115$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth54 = masterConfig.auth) === null || _masterConfig$auth54 === void 0 ? void 0 : (_masterConfig$auth54$ = _masterConfig$auth54.oauthConfig) === null || _masterConfig$auth54$ === void 0 ? void 0 : (_masterConfig$auth54$2 = _masterConfig$auth54$.apple) === null || _masterConfig$auth54$2 === void 0 ? void 0 : _masterConfig$auth54$2.primaryClientId : _ref115$primaryClient, _ref115$secondaryClie = _ref115.secondaryClientIds, secondaryClientIds = _ref115$secondaryClie === void 0 ? (_masterConfig$auth$oa0 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth55 = masterConfig.auth) === null || _masterConfig$auth55 === void 0 ? void 0 : (_masterConfig$auth55$ = _masterConfig$auth55.oauthConfig) === null || _masterConfig$auth55$ === void 0 ? void 0 : (_masterConfig$auth55$2 = _masterConfig$auth55$.apple) === null || _masterConfig$auth55$2 === void 0 ? void 0 : _masterConfig$auth55$2.secondaryClientIds) !== null && _masterConfig$auth$oa0 !== void 0 ? _masterConfig$auth$oa0 : [] : _ref115$secondaryClie, _ref115$openInPage = _ref115.openInPage, openInPage = _ref115$openInPage === void 0 ? (_masterConfig$auth$oa1 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth56 = masterConfig.auth) === null || _masterConfig$auth56 === void 0 ? void 0 : (_masterConfig$auth56$ = _masterConfig$auth56.oauthConfig) === null || _masterConfig$auth56$ === void 0 ? void 0 : _masterConfig$auth56$.openOauthInPage) !== null && _masterConfig$auth$oa1 !== void 0 ? _masterConfig$auth$oa1 : false : _ref115$openInPage, additionalParameters = _ref115.additionalState;
+            _ref115 = params || {}, _ref115$primaryClient = _ref115.primaryClientId, primaryClientId = _ref115$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth54 = masterConfig.auth) === null || _masterConfig$auth54 === void 0 ? void 0 : (_masterConfig$auth54$ = _masterConfig$auth54.oauthConfig) === null || _masterConfig$auth54$ === void 0 ? void 0 : (_masterConfig$auth54$2 = _masterConfig$auth54$.apple) === null || _masterConfig$auth54$2 === void 0 ? void 0 : _masterConfig$auth54$2.primaryClientId : _ref115$primaryClient, _ref115$secondaryClie = _ref115.secondaryClientIds, secondaryClientIds = _ref115$secondaryClie === void 0 ? (_masterConfig$auth$oa0 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth55 = masterConfig.auth) === null || _masterConfig$auth55 === void 0 ? void 0 : (_masterConfig$auth55$ = _masterConfig$auth55.oauthConfig) === null || _masterConfig$auth55$ === void 0 ? void 0 : (_masterConfig$auth55$2 = _masterConfig$auth55$.apple) === null || _masterConfig$auth55$2 === void 0 ? void 0 : _masterConfig$auth55$2.secondaryClientIds) !== null && _masterConfig$auth$oa0 !== void 0 ? _masterConfig$auth$oa0 : [] : _ref115$secondaryClie, _ref115$openInPage = _ref115.openInPage, openInPage = _ref115$openInPage === void 0 ? (_masterConfig$auth$oa1 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth56 = masterConfig.auth) === null || _masterConfig$auth56 === void 0 ? void 0 : (_masterConfig$auth56$ = _masterConfig$auth56.oauthConfig) === null || _masterConfig$auth56$ === void 0 ? void 0 : _masterConfig$auth56$.openOauthInPage) !== null && _masterConfig$auth$oa1 !== void 0 ? _masterConfig$auth$oa1 : false : _ref115$openInPage, additionalParameters = _ref115.additionalState, captchaToken = _ref115.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.APPLE;
             if (masterConfig) {
@@ -4457,7 +4485,11 @@ var ClientProvider = function ClientProvider(_ref) {
             }
             throw new Error("Failed to create public key for OAuth.");
           case 5:
-            nonce = bytesToHex(sha256(publicKey)); // Build OAuth URL
+            nonce = bytesToHex(sha256(publicKey)); // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
+            // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
               clientId: clientId,
@@ -4465,7 +4497,7 @@ var ClientProvider = function ClientProvider(_ref) {
               publicKey: publicKey,
               nonce: nonce,
               flow: flow,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context100.n = 6;
@@ -4511,6 +4543,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess
                       }).then(function () {
                         return resolve();
@@ -4535,11 +4568,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleFacebookOauth = useCallback(/*#__PURE__*/function () {
     var _ref116 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee102(params) {
       var _masterConfig$auth60, _masterConfig$auth60$, _masterConfig$auth60$2, _masterConfig$auth$oa10, _masterConfig$auth61, _masterConfig$auth61$, _masterConfig$auth61$2, _masterConfig$auth$oa11, _masterConfig$auth62, _masterConfig$auth62$, _masterConfig$auth63, _masterConfig$auth63$, _masterConfig$auth64;
-      var _ref117, _ref117$primaryClient, primaryClientId, _ref117$secondaryClie, secondaryClientIds, _ref117$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle3, verifier, codeChallenge, authUrl, authWindow;
+      var _ref117, _ref117$primaryClient, primaryClientId, _ref117$secondaryClie, secondaryClientIds, _ref117$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle3, verifier, codeChallenge, authUrl, authWindow;
       return _regenerator().w(function (_context102) {
         while (1) switch (_context102.n) {
           case 0:
-            _ref117 = params || {}, _ref117$primaryClient = _ref117.primaryClientId, primaryClientId = _ref117$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth60 = masterConfig.auth) === null || _masterConfig$auth60 === void 0 ? void 0 : (_masterConfig$auth60$ = _masterConfig$auth60.oauthConfig) === null || _masterConfig$auth60$ === void 0 ? void 0 : (_masterConfig$auth60$2 = _masterConfig$auth60$.facebook) === null || _masterConfig$auth60$2 === void 0 ? void 0 : _masterConfig$auth60$2.primaryClientId : _ref117$primaryClient, _ref117$secondaryClie = _ref117.secondaryClientIds, secondaryClientIds = _ref117$secondaryClie === void 0 ? (_masterConfig$auth$oa10 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth61 = masterConfig.auth) === null || _masterConfig$auth61 === void 0 ? void 0 : (_masterConfig$auth61$ = _masterConfig$auth61.oauthConfig) === null || _masterConfig$auth61$ === void 0 ? void 0 : (_masterConfig$auth61$2 = _masterConfig$auth61$.facebook) === null || _masterConfig$auth61$2 === void 0 ? void 0 : _masterConfig$auth61$2.secondaryClientIds) !== null && _masterConfig$auth$oa10 !== void 0 ? _masterConfig$auth$oa10 : [] : _ref117$secondaryClie, _ref117$openInPage = _ref117.openInPage, openInPage = _ref117$openInPage === void 0 ? (_masterConfig$auth$oa11 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth62 = masterConfig.auth) === null || _masterConfig$auth62 === void 0 ? void 0 : (_masterConfig$auth62$ = _masterConfig$auth62.oauthConfig) === null || _masterConfig$auth62$ === void 0 ? void 0 : _masterConfig$auth62$.openOauthInPage) !== null && _masterConfig$auth$oa11 !== void 0 ? _masterConfig$auth$oa11 : false : _ref117$openInPage, additionalParameters = _ref117.additionalState;
+            _ref117 = params || {}, _ref117$primaryClient = _ref117.primaryClientId, primaryClientId = _ref117$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth60 = masterConfig.auth) === null || _masterConfig$auth60 === void 0 ? void 0 : (_masterConfig$auth60$ = _masterConfig$auth60.oauthConfig) === null || _masterConfig$auth60$ === void 0 ? void 0 : (_masterConfig$auth60$2 = _masterConfig$auth60$.facebook) === null || _masterConfig$auth60$2 === void 0 ? void 0 : _masterConfig$auth60$2.primaryClientId : _ref117$primaryClient, _ref117$secondaryClie = _ref117.secondaryClientIds, secondaryClientIds = _ref117$secondaryClie === void 0 ? (_masterConfig$auth$oa10 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth61 = masterConfig.auth) === null || _masterConfig$auth61 === void 0 ? void 0 : (_masterConfig$auth61$ = _masterConfig$auth61.oauthConfig) === null || _masterConfig$auth61$ === void 0 ? void 0 : (_masterConfig$auth61$2 = _masterConfig$auth61$.facebook) === null || _masterConfig$auth61$2 === void 0 ? void 0 : _masterConfig$auth61$2.secondaryClientIds) !== null && _masterConfig$auth$oa10 !== void 0 ? _masterConfig$auth$oa10 : [] : _ref117$secondaryClie, _ref117$openInPage = _ref117.openInPage, openInPage = _ref117$openInPage === void 0 ? (_masterConfig$auth$oa11 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth62 = masterConfig.auth) === null || _masterConfig$auth62 === void 0 ? void 0 : (_masterConfig$auth62$ = _masterConfig$auth62.oauthConfig) === null || _masterConfig$auth62$ === void 0 ? void 0 : _masterConfig$auth62$.openOauthInPage) !== null && _masterConfig$auth$oa11 !== void 0 ? _masterConfig$auth$oa11 : false : _ref117$openInPage, additionalParameters = _ref117.additionalState, captchaToken = _ref117.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.FACEBOOK;
             if (masterConfig) {
@@ -4580,6 +4613,10 @@ var ClientProvider = function ClientProvider(_ref) {
             verifier = _yield$generateChalle3.verifier;
             codeChallenge = _yield$generateChalle3.codeChallenge;
             storePKCEVerifier(provider, verifier);
+            // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
             // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
@@ -4589,7 +4626,7 @@ var ClientProvider = function ClientProvider(_ref) {
               nonce: nonce,
               flow: flow,
               codeChallenge: codeChallenge,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context102.n = 7;
@@ -4635,6 +4672,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess,
                         exchangeCodeForToken: function () {
                           var _exchangeCodeForToken3 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee101(codeVerifier) {
@@ -6369,7 +6407,7 @@ var ClientProvider = function ClientProvider(_ref) {
             return _context129.a(2, new Promise(function (resolve, reject) {
               var action = /*#__PURE__*/function () {
                 var _ref151 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee128() {
-                  var _ref153, _txDetails$eth$txHash, _txDetails$eth, _txDetails$solana;
+                  var _ref154, _txDetails$eth$txHash, _txDetails$eth, _txDetails$solana;
                   var sendTransactionStatusId, pollResult, txDetails, txHash, _t28;
                   return _regenerator().w(function (_context128) {
                     while (1) switch (_context128.n) {
@@ -6391,22 +6429,20 @@ var ClientProvider = function ClientProvider(_ref) {
                       case 2:
                         _context128.n = 3;
                         return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee127() {
-                          var from, to, value, data, nonce, gasLimit, maxFeePerGas, maxPriorityFeePerGas, sponsor, cleanedData, tx;
+                          var ethTx, cleanData, from, sponsor, nonce, gasLimit, maxFeePerGas, maxPriorityFeePerGas, commonFields, tx, cleanedData;
                           return _regenerator().w(function (_context127) {
                             while (1) switch (_context127.n) {
                               case 0:
-                                from = transaction.from, to = transaction.to, value = transaction.value, data = transaction.data, nonce = transaction.nonce, gasLimit = transaction.gasLimit, maxFeePerGas = transaction.maxFeePerGas, maxPriorityFeePerGas = transaction.maxPriorityFeePerGas, sponsor = transaction.sponsor;
-                                cleanedData = data && data !== "0x" && data !== "" ? data : undefined;
-                                tx = _objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2({
+                                ethTx = transaction; // Drop empty/no-op calldata ("0x" or "") so it isn't sent.
+                                cleanData = function cleanData(data) {
+                                  return data && data !== "0x" && data !== "" ? data : undefined;
+                                }; // Shared fee/nonce fields, present on both the V1 and V2 intents.
+                                from = ethTx.from, sponsor = ethTx.sponsor, nonce = ethTx.nonce, gasLimit = ethTx.gasLimit, maxFeePerGas = ethTx.maxFeePerGas, maxPriorityFeePerGas = ethTx.maxPriorityFeePerGas;
+                                commonFields = _objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2({
                                   from: from,
-                                  to: to,
-                                  caip2: caip2,
+                                  caip2: ethTx.caip2,
                                   sponsor: sponsor !== null && sponsor !== void 0 ? sponsor : false
-                                }, value ? {
-                                  value: value
-                                } : {}), cleanedData ? {
-                                  data: cleanedData
-                                } : {}), nonce ? {
+                                }, nonce ? {
                                   nonce: nonce
                                 } : {}), gasLimit ? {
                                   gasLimit: gasLimit
@@ -6414,7 +6450,34 @@ var ClientProvider = function ClientProvider(_ref) {
                                   maxFeePerGas: maxFeePerGas
                                 } : {}), maxPriorityFeePerGas ? {
                                   maxPriorityFeePerGas: maxPriorityFeePerGas
-                                } : {});
+                                } : {}); // V2 multi-call intent vs. legacy single-call (V1) intent.
+                                // TODO (breaking change): eventually, we wont generate the v1 activity at all, remove this check and update the intent.
+                                if ("calls" in ethTx) {
+                                  tx = _objectSpread2(_objectSpread2({}, commonFields), {}, {
+                                    calls: ethTx.calls.map(function (_ref153) {
+                                      var to = _ref153.to,
+                                        value = _ref153.value,
+                                        data = _ref153.data;
+                                      var cleanedData = cleanData(data);
+                                      return _objectSpread2(_objectSpread2({
+                                        to: to
+                                      }, value ? {
+                                        value: value
+                                      } : {}), cleanedData ? {
+                                        data: cleanedData
+                                      } : {});
+                                    })
+                                  });
+                                } else {
+                                  cleanedData = cleanData(ethTx.data);
+                                  tx = _objectSpread2(_objectSpread2(_objectSpread2({}, commonFields), {}, {
+                                    to: ethTx.to
+                                  }, ethTx.value ? {
+                                    value: ethTx.value
+                                  } : {}), cleanedData ? {
+                                    data: cleanedData
+                                  } : {});
+                                }
                                 return _context127.a(2, ethSendTransaction({
                                   organizationId: organizationId,
                                   transaction: tx,
@@ -6441,7 +6504,7 @@ var ClientProvider = function ClientProvider(_ref) {
                       case 6:
                         pollResult = _context128.v;
                         txDetails = pollResult;
-                        txHash = (_ref153 = (_txDetails$eth$txHash = (_txDetails$eth = txDetails.eth) === null || _txDetails$eth === void 0 ? void 0 : _txDetails$eth.txHash) !== null && _txDetails$eth$txHash !== void 0 ? _txDetails$eth$txHash : (_txDetails$solana = txDetails.solana) === null || _txDetails$solana === void 0 ? void 0 : _txDetails$solana.signature) !== null && _ref153 !== void 0 ? _ref153 : txDetails.txHash;
+                        txHash = (_ref154 = (_txDetails$eth$txHash = (_txDetails$eth = txDetails.eth) === null || _txDetails$eth === void 0 ? void 0 : _txDetails$eth.txHash) !== null && _txDetails$eth$txHash !== void 0 ? _txDetails$eth$txHash : (_txDetails$solana = txDetails.solana) === null || _txDetails$solana === void 0 ? void 0 : _txDetails$solana.signature) !== null && _ref154 !== void 0 ? _ref154 : txDetails.txHash;
                         return _context128.a(2, txHash ? {
                           txHash: txHash
                         } : {});
@@ -6481,7 +6544,7 @@ var ClientProvider = function ClientProvider(_ref) {
     };
   }(), [ethSendTransaction, getSession, pollTransactionStatus, pushPage, solSendTransaction]);
   var handleSendErc20Transfer = useCallback(/*#__PURE__*/function () {
-    var _ref154 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee131(params) {
+    var _ref155 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee131(params) {
       var session, organizationId, transfer, icon, stampWith, _params$successPageDu6, successPageDuration, caip2;
       return _regenerator().w(function (_context131) {
         while (1) switch (_context131.n) {
@@ -6501,7 +6564,7 @@ var ClientProvider = function ClientProvider(_ref) {
             caip2 = transfer.caip2;
             return _context131.a(2, new Promise(function (resolve, reject) {
               var action = /*#__PURE__*/function () {
-                var _ref155 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee130() {
+                var _ref156 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee130() {
                   var _pollResult$eth$txHas, _pollResult$eth;
                   var sendTransactionStatusId, pollResult, txHash;
                   return _regenerator().w(function (_context130) {
@@ -6536,7 +6599,7 @@ var ClientProvider = function ClientProvider(_ref) {
                   }, _callee130);
                 }));
                 return function action() {
-                  return _ref155.apply(this, arguments);
+                  return _ref156.apply(this, arguments);
                 };
               }();
               pushPage({
@@ -6564,11 +6627,11 @@ var ClientProvider = function ClientProvider(_ref) {
       }, _callee131);
     }));
     return function (_x113) {
-      return _ref154.apply(this, arguments);
+      return _ref155.apply(this, arguments);
     };
   }(), [ethSendErc20Transfer, getSession, pollTransactionStatus, pushPage]);
   var handleOnRamp = useCallback(/*#__PURE__*/function () {
-    var _ref156 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee134(params) {
+    var _ref157 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee134(params) {
       var _walletAccount$addres;
       var walletAccount, fiatCurrencyAmount, fiatCurrencyCode, paymentMethod, countrySubdivisionCode, urlForSignature, countryCode, _params$onrampProvide, onrampProvider, _params$sandboxMode, sandboxMode, _params$successPageDu7, successPageDuration, _params$openInNewTab, openInNewTab, s, organizationId, cryptoCurrencyCode, network, openNewTab, _t31;
       return _regenerator().w(function (_context134) {
@@ -6628,7 +6691,7 @@ var ClientProvider = function ClientProvider(_ref) {
                   };
                 }, []);
                 var action = /*#__PURE__*/function () {
-                  var _ref157 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee133() {
+                  var _ref158 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee133() {
                     var _client$httpClient, onRampWindow, result, popupWidth, popupHeight, left, top, onRampTransactionId, _t30;
                     return _regenerator().w(function (_context133) {
                       while (1) switch (_context133.p = _context133.n) {
@@ -6771,7 +6834,7 @@ var ClientProvider = function ClientProvider(_ref) {
                     }, _callee133, null, [[0, 7]]);
                   }));
                   return function action() {
-                    return _ref157.apply(this, arguments);
+                    return _ref158.apply(this, arguments);
                   };
                 }();
                 return jsx(OnRampPage, {
@@ -6807,16 +6870,16 @@ var ClientProvider = function ClientProvider(_ref) {
       }, _callee134);
     }));
     return function (_x114) {
-      return _ref156.apply(this, arguments);
+      return _ref157.apply(this, arguments);
     };
   }(), [getSession, client, pushPage]);
   var handleVerifyAppProofs = useCallback(/*#__PURE__*/function () {
-    var _ref159 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee135(params) {
-      var _ref160, appProofs, _ref160$successPageDu, successPageDuration, stampWith, s, organizationId, _t32;
+    var _ref160 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee135(params) {
+      var _ref161, appProofs, _ref161$successPageDu, successPageDuration, stampWith, s, organizationId, _t32;
       return _regenerator().w(function (_context135) {
         while (1) switch (_context135.p = _context135.n) {
           case 0:
-            _ref160 = params || {}, appProofs = _ref160.appProofs, _ref160$successPageDu = _ref160.successPageDuration, successPageDuration = _ref160$successPageDu === void 0 ? 3000 : _ref160$successPageDu, stampWith = _ref160.stampWith;
+            _ref161 = params || {}, appProofs = _ref161.appProofs, _ref161$successPageDu = _ref161.successPageDuration, successPageDuration = _ref161$successPageDu === void 0 ? 3000 : _ref161$successPageDu, stampWith = _ref161.stampWith;
             _context135.n = 1;
             return getSession();
           case 1:
@@ -6870,45 +6933,53 @@ var ClientProvider = function ClientProvider(_ref) {
       }, _callee135, null, [[2, 3]]);
     }));
     return function (_x115) {
-      return _ref159.apply(this, arguments);
+      return _ref160.apply(this, arguments);
     };
   }(), [getSession, pushPage]);
   useEffect(function () {
     if (proxyAuthConfigRef.current) return;
-    // Only fetch the proxy auth config once. Use that to build the master config.
+    // Fetch proxy auth config and client params once. Use both to build the master config.
     var fetchProxyAuthConfig = /*#__PURE__*/function () {
-      var _ref161 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee136() {
-        var proxyAuthConfig;
+      var _ref162 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee136() {
+        var proxyAuthConfig, clientParams, promises;
         return _regenerator().w(function (_context136) {
           while (1) switch (_context136.p = _context136.n) {
             case 0:
               _context136.p = 0;
-              if (!shouldFetchWalletKitConfig) {
-                _context136.n = 2;
-                break;
+              promises = [];
+              if (shouldFetchWalletKitConfig) {
+                promises.push(getAuthProxyConfig(config.authProxyConfigId, config.authProxyUrl).then(function (result) {
+                  proxyAuthConfig = result;
+                }));
+              }
+              if (config.authProxyConfigId) {
+                promises.push(getClientParams(config.authProxyConfigId, config.authProxyUrl).then(function (result) {
+                  clientParams = result;
+                }));
               }
               _context136.n = 1;
-              return getAuthProxyConfig(config.authProxyConfigId,
-              // Can assert safely. See shouldFetchWalletKitConfig definition.
-              config.authProxyUrl);
+              return Promise.all(promises);
             case 1:
-              proxyAuthConfig = _context136.v;
-              proxyAuthConfigRef.current = proxyAuthConfig;
-            case 2:
-              setMasterConfig(buildConfig(proxyAuthConfig));
-              _context136.n = 4;
+              if (proxyAuthConfig) {
+                proxyAuthConfigRef.current = proxyAuthConfig;
+              }
+              if (clientParams) {
+                clientParamsRef.current = clientParams;
+              }
+              setMasterConfig(buildConfig(proxyAuthConfig, clientParams));
+              _context136.n = 3;
               break;
-            case 3:
-              _context136.p = 3;
+            case 2:
+              _context136.p = 2;
               _context136.v;
               setClientState(ClientState.Error);
-            case 4:
+            case 3:
               return _context136.a(2);
           }
-        }, _callee136, null, [[0, 3]]);
+        }, _callee136, null, [[0, 2]]);
       }));
       return function fetchProxyAuthConfig() {
-        return _ref161.apply(this, arguments);
+        return _ref162.apply(this, arguments);
       };
     }();
     fetchProxyAuthConfig();
@@ -6919,13 +6990,13 @@ var ClientProvider = function ClientProvider(_ref) {
     initializeClient();
   }, [masterConfig]);
   useEffect(function () {
-    var _proxyAuthConfigRef$c;
+    var _proxyAuthConfigRef$c, _clientParamsRef$curr;
     // Handle changes to the passed in config prop -- update the master config
     // Rebuild the master config with the updated config and stored proxyAuthConfig
     // If we don't have a stored proxyAuthConfig and we need to fetch it, we wait until that fetch is done in the other useEffect.
     // If shouldFetchWalletKitConfig is false, we'll never have a proxyAuthConfig to build the master config with, so this useEffect should always run.
     if (!proxyAuthConfigRef.current && shouldFetchWalletKitConfig) return;
-    setMasterConfig(buildConfig((_proxyAuthConfigRef$c = proxyAuthConfigRef.current) !== null && _proxyAuthConfigRef$c !== void 0 ? _proxyAuthConfigRef$c : undefined));
+    setMasterConfig(buildConfig((_proxyAuthConfigRef$c = proxyAuthConfigRef.current) !== null && _proxyAuthConfigRef$c !== void 0 ? _proxyAuthConfigRef$c : undefined, (_clientParamsRef$curr = clientParamsRef.current) !== null && _clientParamsRef$curr !== void 0 ? _clientParamsRef$curr : undefined));
   }, [config, proxyAuthConfigRef.current]);
   /**
    * @internal
@@ -6941,7 +7012,7 @@ var ClientProvider = function ClientProvider(_ref) {
   var debouncedFetchWalletProviders = useDebouncedCallback(fetchWalletProviders, 100);
   useEffect(function () {
     var handleUpdateState = /*#__PURE__*/function () {
-      var _ref162 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee137() {
+      var _ref163 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee137() {
         var currentSession;
         return _regenerator().w(function (_context137) {
           while (1) switch (_context137.n) {
@@ -6968,7 +7039,7 @@ var ClientProvider = function ClientProvider(_ref) {
         }, _callee137);
       }));
       return function handleUpdateState() {
-        return _ref162.apply(this, arguments);
+        return _ref163.apply(this, arguments);
       };
     }();
     var cleanup = function cleanup() {};
@@ -7010,7 +7081,7 @@ var ClientProvider = function ClientProvider(_ref) {
       clearSessionTimeouts();
     };
   }, [client]);
-  return jsx(ClientContext.Provider, {
+  return jsxs(ClientContext.Provider, {
     value: {
       session: session,
       allSessions: allSessions,
@@ -7118,9 +7189,26 @@ var ClientProvider = function ClientProvider(_ref) {
       handleVerifyAppProofs: handleVerifyAppProofs,
       handleOnRamp: handleOnRamp,
       handleSendTransaction: handleSendTransaction,
-      handleSendErc20Transfer: handleSendErc20Transfer
+      handleSendErc20Transfer: handleSendErc20Transfer,
+      getTurnstileToken: getTurnstileToken,
+      setTurnstileToken: setTurnstileToken
     },
-    children: children
+    children: [(masterConfig === null || masterConfig === void 0 ? void 0 : masterConfig.turnstileSiteKey) && authState !== AuthState.Authenticated && !getTurnstileToken() && jsx(Turnstile, {
+      siteKey: masterConfig.turnstileSiteKey,
+      onSuccess: function onSuccess(token) {
+        setTurnstileToken(token);
+      },
+      onError: function onError() {
+        setTurnstileToken(null);
+      },
+      onExpire: function onExpire() {
+        setTurnstileToken(null);
+      },
+      options: {
+        size: "invisible",
+        appearance: "execute"
+      }
+    }), children]
   });
 };