@turnkey/react-wallet-kit 2.2.0 → 2.3.0

package/dist/providers/client/Provider.mjs

@@ -1,9 +1,9 @@
 'use client';
 import { slicedToArray as _slicedToArray, asyncToGenerator as _asyncToGenerator, regenerator as _regenerator, objectSpread2 as _objectSpread2, toConsumableArray as _toConsumableArray } from '../../_virtual/_rollupPluginBabelHelpers.mjs';
-import { jsx } from 'react/jsx-runtime';
+import { jsxs, jsx } from 'react/jsx-runtime';
 import { sha256 } from '@noble/hashes/sha2';
 import { bytesToHex } from '@noble/hashes/utils';
-import { storePKCEVerifier, storeOAuthAddProviderMetadata, clearAllOAuthData, getOAuthAddProviderMetadata, hasPKCEVerifier, OAUTH_INTENT_ADD_PROVIDER } from '../../utils/oauth/storage.mjs';
+import { storePKCEVerifier, storeOAuthCaptchaToken, storeOAuthAddProviderMetadata, clearAllOAuthData, getOAuthAddProviderMetadata, hasPKCEVerifier, OAUTH_INTENT_ADD_PROVIDER } from '../../utils/oauth/storage.mjs';
 import '../../utils/oauth/config.mjs';
 import { parseOAuthResponse, openOAuthPopup, buildOAuthUrl, redirectToOAuthProvider, cleanupOAuthUrlPreserveSearch, cleanupOAuthUrl } from '../../utils/oauth/url.mjs';
 import { completeOAuthPopup, completeOAuthFlow, completePKCEFlow } from '../../utils/oauth/completion.mjs';
@@ -11,7 +11,7 @@ import { generateChallengePair, exchangeFacebookCodeForToken } from '../../utils
 import { capitalizeProviderName, getProviderIcon } from '../../utils/oauth/helpers.mjs';
 import { useWalletProviderState, useDebouncedCallback, isValidSession, withTurnkeyErrorHandling, SESSION_WARNING_THRESHOLD_MS, mergeWalletsWithoutDuplicates } from '../../utils/utils.mjs';
 import { clearKeys, clearAll, setCappedTimeoutInMap, clearKey, setTimeoutInMap } from '../../utils/timers.mjs';
-import { resetPasskeyScope, DEFAULT_SESSION_EXPIRATION_IN_SECONDS, OtpType, applyPasskeyScope, buildSecondaryOauthProviders, TurnkeyClient, Chain, WalletInterfaceType, getAuthProxyConfig, WalletSource, buildSecondaryOidcClaims } from '@turnkey/core';
+import { resetPasskeyScope, DEFAULT_SESSION_EXPIRATION_IN_SECONDS, OtpType, applyPasskeyScope, buildSecondaryOauthProviders, TurnkeyClient, Chain, WalletInterfaceType, getAuthProxyConfig, getClientParams, WalletSource, buildSecondaryOidcClaims } from '@turnkey/core';
 import { useState, useRef, useCallback, useEffect } from 'react';
 import { TurnkeyError, TurnkeyErrorCodes, TurnkeyNetworkError, AuthAction, OAuthProviders, FiatOnRampCryptoCurrency, FiatOnRampBlockchainNetwork } from '@turnkey/sdk-types';
 import { useModal } from '../modal/Hook.mjs';
@@ -39,6 +39,7 @@ import { OnRampPage } from '../../components/onramp/OnRamp.mjs';
 import { CoinbaseLogo, MoonPayLogo } from '../../components/design/Svg.mjs';
 import { SendTransactionPage } from '../../components/send-transaction/SendTransaction.mjs';
 import { getChainLogo } from '../../components/send-transaction/helpers.mjs';
+import { Turnstile } from '../../components/auth/Turnstile.mjs';
 
 /**
  * Provides Turnkey client authentication, session management, wallet operations, and user profile management
@@ -99,6 +100,14 @@ var ClientProvider = function ClientProvider(_ref) {
     _useState12 = _slicedToArray(_useState11, 2),
     authState = _useState12[0],
     setAuthState = _useState12[1];
+  // Turnstile state: pre-warm the challenge in the background
+  var turnstileTokenRef = useRef(null);
+  var getTurnstileToken = useCallback(function () {
+    return turnstileTokenRef.current;
+  }, []);
+  var setTurnstileToken = useCallback(function (token) {
+    turnstileTokenRef.current = token;
+  }, []);
   // if there is no authProxyConfigId or if autoFetchWalletKitConfig is specifically
   // set to false, we don't need to fetch the config
   var shouldFetchWalletKitConfig = !!config.authProxyConfigId && ((_config$autoFetchWall = config.autoFetchWalletKitConfig) !== null && _config$autoFetchWall !== void 0 ? _config$autoFetchWall : true);
@@ -110,6 +119,7 @@ var ClientProvider = function ClientProvider(_ref) {
     setWalletProviders = _useWalletProviderSta2[1];
   var expiryTimeoutsRef = useRef({});
   var proxyAuthConfigRef = useRef(null);
+  var clientParamsRef = useRef(null);
   var _useState13 = useState(undefined),
     _useState14 = _slicedToArray(_useState13, 2),
     allSessions = _useState14[0],
@@ -121,7 +131,7 @@ var ClientProvider = function ClientProvider(_ref) {
     closeModal = _useModal.closeModal;
   var completeRedirectOauth = /*#__PURE__*/function () {
     var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee1() {
-      var withModalWrapper, result, code, provider, publicKey, oauthIntent, sessionKey, nonce, openModal, isAddProvider, metadata, completePKCERedirect, _masterConfig$auth2, _masterConfig$auth2$o, _masterConfig$auth2$o2, _masterConfig$auth$oa, _masterConfig$auth3, _masterConfig$auth3$o, _masterConfig$auth3$o2, _masterConfig$auth4, _masterConfig$auth4$o, clientId, secondaryClientIds, redirectURI, hasVerifier, _masterConfig$auth5, _masterConfig$auth5$o, _masterConfig$auth5$o2, _masterConfig$auth$oa2, _masterConfig$auth6, _masterConfig$auth6$o, _masterConfig$auth6$o2, _masterConfig$auth7, _masterConfig$auth7$o, _clientId, _secondaryClientIds, _redirectURI, _hasVerifier, _masterConfig$auth8, _masterConfig$auth8$o, _masterConfig$auth8$o2, _masterConfig$auth$oa3, _masterConfig$auth9, _masterConfig$auth9$o, _masterConfig$auth9$o2, _masterConfig$auth0, _masterConfig$auth0$o, _clientId2, _secondaryClientIds2, _redirectURI2, _hasVerifier2, _ref0, _masterConfig$auth1, _masterConfig$auth1$o, _masterConfig$auth1$o2, _masterConfig$auth10, _masterConfig$auth10$, _masterConfig$auth10$2, _result, idToken, _provider, _publicKey, _openModal, _sessionKey, _oauthIntent, _isAddProvider, _metadata, resolvedProvider, _secondaryClientIds3, action;
+      var withModalWrapper, result, code, provider, publicKey, oauthIntent, sessionKey, nonce, openModal, captchaToken, isAddProvider, metadata, completePKCERedirect, _masterConfig$auth2, _masterConfig$auth2$o, _masterConfig$auth2$o2, _masterConfig$auth$oa, _masterConfig$auth3, _masterConfig$auth3$o, _masterConfig$auth3$o2, _masterConfig$auth4, _masterConfig$auth4$o, clientId, secondaryClientIds, redirectURI, hasVerifier, _masterConfig$auth5, _masterConfig$auth5$o, _masterConfig$auth5$o2, _masterConfig$auth$oa2, _masterConfig$auth6, _masterConfig$auth6$o, _masterConfig$auth6$o2, _masterConfig$auth7, _masterConfig$auth7$o, _clientId, _secondaryClientIds, _redirectURI, _hasVerifier, _masterConfig$auth8, _masterConfig$auth8$o, _masterConfig$auth8$o2, _masterConfig$auth$oa3, _masterConfig$auth9, _masterConfig$auth9$o, _masterConfig$auth9$o2, _masterConfig$auth0, _masterConfig$auth0$o, _clientId2, _secondaryClientIds2, _redirectURI2, _hasVerifier2, _ref0, _masterConfig$auth1, _masterConfig$auth1$o, _masterConfig$auth1$o2, _masterConfig$auth10, _masterConfig$auth10$, _masterConfig$auth10$2, _result, idToken, _provider, _publicKey, _openModal, _sessionKey, _oauthIntent, _captchaToken, _isAddProvider, _metadata, resolvedProvider, _secondaryClientIds3, action;
       return _regenerator().w(function (_context1) {
         while (1) switch (_context1.p = _context1.n) {
           case 0:
@@ -245,7 +255,7 @@ var ClientProvider = function ClientProvider(_ref) {
             }
             return _context1.a(2);
           case 3:
-            code = result.authCode, provider = result.provider, publicKey = result.publicKey, oauthIntent = result.oauthIntent, sessionKey = result.sessionKey, nonce = result.nonce, openModal = result.openModal;
+            code = result.authCode, provider = result.provider, publicKey = result.publicKey, oauthIntent = result.oauthIntent, sessionKey = result.sessionKey, nonce = result.nonce, openModal = result.openModal, captchaToken = result.captchaToken;
             isAddProvider = oauthIntent === OAUTH_INTENT_ADD_PROVIDER;
             metadata = isAddProvider ? getOAuthAddProviderMetadata() : null;
             /**
@@ -271,6 +281,7 @@ var ClientProvider = function ClientProvider(_ref) {
                                   publicKey: publicKey,
                                   providerName: providerName,
                                   sessionKey: sessionKey !== null && sessionKey !== void 0 ? sessionKey : undefined,
+                                  captchaToken: captchaToken !== null && captchaToken !== void 0 ? captchaToken : undefined,
                                   callbacks: callbacks,
                                   completeOauth: function completeOauth(completionParams) {
                                     var _masterConfig$auth, _masterConfig$auth$cr, _completionParams$pro, _existingCreateSubOrg;
@@ -503,7 +514,7 @@ var ClientProvider = function ClientProvider(_ref) {
             }
             return _context1.a(2);
           case 10:
-            idToken = _result.idToken, _provider = _result.provider, _publicKey = _result.publicKey, _openModal = _result.openModal, _sessionKey = _result.sessionKey, _oauthIntent = _result.oauthIntent;
+            idToken = _result.idToken, _provider = _result.provider, _publicKey = _result.publicKey, _openModal = _result.openModal, _sessionKey = _result.sessionKey, _oauthIntent = _result.oauthIntent, _captchaToken = _result.captchaToken;
             _isAddProvider = _oauthIntent === OAUTH_INTENT_ADD_PROVIDER;
             _metadata = _isAddProvider ? getOAuthAddProviderMetadata() : null;
             resolvedProvider = _provider || OAuthProviders.GOOGLE; // Grab Google/Apple secondary client IDs from config for use in completion
@@ -519,6 +530,7 @@ var ClientProvider = function ClientProvider(_ref) {
                         publicKey: _publicKey,
                         oidcToken: idToken,
                         sessionKey: _sessionKey !== null && _sessionKey !== void 0 ? _sessionKey : undefined,
+                        captchaToken: _captchaToken !== null && _captchaToken !== void 0 ? _captchaToken : undefined,
                         callbacks: callbacks,
                         completeOauth: function completeOauth(completionParams) {
                           var _masterConfig$auth11, _masterConfig$auth11$, _completionParams$pro2, _existingCreateSubOrg2;
@@ -592,7 +604,7 @@ var ClientProvider = function ClientProvider(_ref) {
       return _ref2.apply(this, arguments);
     };
   }();
-  var buildConfig = function buildConfig(proxyAuthConfig) {
+  var buildConfig = function buildConfig(proxyAuthConfig, clientParams) {
     var _config$ui$authModal$, _config$ui, _config$ui$authModal, _config$ui$authModal$2, _config$ui$authModal$3, _config$ui2, _config$ui2$authModal, _config$ui2$authModal2, _config$ui$authModal$4, _config$ui3, _config$ui3$authModal, _config$ui3$authModal2, _config$ui$authModal$5, _config$ui4, _config$ui4$authModal, _config$ui4$authModal2, _config$ui$authModal$6, _config$ui5, _config$ui5$authModal, _config$ui5$authModal2, _config$ui$authModal$7, _config$ui6, _config$ui6$authModal, _config$ui6$authModal2, _config$ui$authModal$8, _config$ui7, _config$ui7$authModal, _config$ui7$authModal2, _config$ui$authModal$9, _config$ui8, _config$ui8$authModal, _config$ui8$authModal2, _config$ui$authModal$0, _config$ui9, _config$ui9$authModal, _config$ui9$authModal2, _config$auth$oauthCon, _config$auth, _config$auth$oauthCon2, _config$auth$oauthCon3, _proxyAuthConfig$oaut, _config$auth$oauthCon4, _config$auth2, _config$auth2$oauthCo, _config$auth2$oauthCo2, _config$auth$oauthCon5, _config$auth3, _config$auth3$oauthCo, _config$auth3$oauthCo2, _proxyAuthConfig$oaut2, _config$auth$oauthCon6, _config$auth4, _config$auth4$oauthCo, _config$auth4$oauthCo2, _config$auth$oauthCon7, _config$auth5, _config$auth5$oauthCo, _config$auth5$oauthCo2, _proxyAuthConfig$oaut3, _config$auth$oauthCon8, _config$auth6, _config$auth6$oauthCo, _config$auth6$oauthCo2, _config$auth$oauthCon9, _config$auth7, _config$auth7$oauthCo, _config$auth7$oauthCo2, _proxyAuthConfig$oaut4, _config$auth$oauthCon0, _config$auth8, _config$auth8$oauthCo, _config$auth8$oauthCo2, _config$auth$oauthCon1, _config$auth9, _config$auth9$oauthCo, _config$auth9$oauthCo2, _proxyAuthConfig$oaut5, _config$auth$oauthCon10, _config$auth0, _config$auth0$oauthCo, _config$auth0$oauthCo2, _config$auth$oauthCon11, _config$auth1, _config$auth1$oauthCo, _config$ui$authModal$1, _config$ui0, _config$ui0$authModal, _config$ui$authModal$10, _config$ui1, _config$ui1$authModal, _proxyAuthConfig$sess, _config$auth13, _ref11, _proxyAuthConfig$otpA, _config$auth14, _ref12, _proxyAuthConfig$otpL, _config$auth15, _config$auth$scopePas, _config$auth16, _config$auth17, _config$auth18, _config$auth18$oauthC, _config$auth$autoRefr, _config$auth19, _config$ui10, _config$autoRefreshMa, _config$walletConfig, _ref13, _resolvedMethods$wall, _config$walletConfig2, _config$walletConfig3, _config$walletConfig$, _config$walletConfig4, _config$walletConfig5, _config$walletConfig6, _config$walletConfig7, _config$walletConfig8, _config$walletConfig$2, _config$walletConfig9, _config$walletConfig0, _config$walletConfig1, _config$walletConfig10, _config$walletConfig11, _config$walletConfig$3, _config$walletConfig12, _config$walletConfig13, _config$walletConfig14, _config$importIframeU, _config$exportIframeU;
     // Juggle the local overrides with the values set in the dashboard (proxyAuthConfig).
     var resolvedMethods = {
@@ -694,7 +706,8 @@ var ClientProvider = function ClientProvider(_ref) {
         })
       }),
       importIframeUrl: (_config$importIframeU = config.importIframeUrl) !== null && _config$importIframeU !== void 0 ? _config$importIframeU : "https://import.turnkey.com",
-      exportIframeUrl: (_config$exportIframeU = config.exportIframeUrl) !== null && _config$exportIframeU !== void 0 ? _config$exportIframeU : "https://export.turnkey.com"
+      exportIframeUrl: (_config$exportIframeU = config.exportIframeUrl) !== null && _config$exportIframeU !== void 0 ? _config$exportIframeU : "https://export.turnkey.com",
+      turnstileSiteKey: clientParams === null || clientParams === void 0 ? void 0 : clientParams.turnstileSiteKey
     });
   };
   /**
@@ -4003,11 +4016,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleDiscordOauth = useCallback(/*#__PURE__*/function () {
     var _ref108 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee96(params) {
       var _masterConfig$auth36, _masterConfig$auth36$, _masterConfig$auth36$2, _masterConfig$auth$oa4, _masterConfig$auth37, _masterConfig$auth37$, _masterConfig$auth37$2, _masterConfig$auth$oa5, _masterConfig$auth38, _masterConfig$auth38$, _masterConfig$auth39, _masterConfig$auth39$, _masterConfig$auth40;
-      var _ref109, _ref109$primaryClient, primaryClientId, _ref109$secondaryClie, secondaryClientIds, _ref109$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle, verifier, codeChallenge, authUrl, authWindow;
+      var _ref109, _ref109$primaryClient, primaryClientId, _ref109$secondaryClie, secondaryClientIds, _ref109$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle, verifier, codeChallenge, authUrl, authWindow;
       return _regenerator().w(function (_context96) {
         while (1) switch (_context96.n) {
           case 0:
-            _ref109 = params || {}, _ref109$primaryClient = _ref109.primaryClientId, primaryClientId = _ref109$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth36 = masterConfig.auth) === null || _masterConfig$auth36 === void 0 ? void 0 : (_masterConfig$auth36$ = _masterConfig$auth36.oauthConfig) === null || _masterConfig$auth36$ === void 0 ? void 0 : (_masterConfig$auth36$2 = _masterConfig$auth36$.discord) === null || _masterConfig$auth36$2 === void 0 ? void 0 : _masterConfig$auth36$2.primaryClientId : _ref109$primaryClient, _ref109$secondaryClie = _ref109.secondaryClientIds, secondaryClientIds = _ref109$secondaryClie === void 0 ? (_masterConfig$auth$oa4 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth37 = masterConfig.auth) === null || _masterConfig$auth37 === void 0 ? void 0 : (_masterConfig$auth37$ = _masterConfig$auth37.oauthConfig) === null || _masterConfig$auth37$ === void 0 ? void 0 : (_masterConfig$auth37$2 = _masterConfig$auth37$.discord) === null || _masterConfig$auth37$2 === void 0 ? void 0 : _masterConfig$auth37$2.secondaryClientIds) !== null && _masterConfig$auth$oa4 !== void 0 ? _masterConfig$auth$oa4 : [] : _ref109$secondaryClie, _ref109$openInPage = _ref109.openInPage, openInPage = _ref109$openInPage === void 0 ? (_masterConfig$auth$oa5 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth38 = masterConfig.auth) === null || _masterConfig$auth38 === void 0 ? void 0 : (_masterConfig$auth38$ = _masterConfig$auth38.oauthConfig) === null || _masterConfig$auth38$ === void 0 ? void 0 : _masterConfig$auth38$.openOauthInPage) !== null && _masterConfig$auth$oa5 !== void 0 ? _masterConfig$auth$oa5 : false : _ref109$openInPage, additionalParameters = _ref109.additionalState;
+            _ref109 = params || {}, _ref109$primaryClient = _ref109.primaryClientId, primaryClientId = _ref109$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth36 = masterConfig.auth) === null || _masterConfig$auth36 === void 0 ? void 0 : (_masterConfig$auth36$ = _masterConfig$auth36.oauthConfig) === null || _masterConfig$auth36$ === void 0 ? void 0 : (_masterConfig$auth36$2 = _masterConfig$auth36$.discord) === null || _masterConfig$auth36$2 === void 0 ? void 0 : _masterConfig$auth36$2.primaryClientId : _ref109$primaryClient, _ref109$secondaryClie = _ref109.secondaryClientIds, secondaryClientIds = _ref109$secondaryClie === void 0 ? (_masterConfig$auth$oa4 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth37 = masterConfig.auth) === null || _masterConfig$auth37 === void 0 ? void 0 : (_masterConfig$auth37$ = _masterConfig$auth37.oauthConfig) === null || _masterConfig$auth37$ === void 0 ? void 0 : (_masterConfig$auth37$2 = _masterConfig$auth37$.discord) === null || _masterConfig$auth37$2 === void 0 ? void 0 : _masterConfig$auth37$2.secondaryClientIds) !== null && _masterConfig$auth$oa4 !== void 0 ? _masterConfig$auth$oa4 : [] : _ref109$secondaryClie, _ref109$openInPage = _ref109.openInPage, openInPage = _ref109$openInPage === void 0 ? (_masterConfig$auth$oa5 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth38 = masterConfig.auth) === null || _masterConfig$auth38 === void 0 ? void 0 : (_masterConfig$auth38$ = _masterConfig$auth38.oauthConfig) === null || _masterConfig$auth38$ === void 0 ? void 0 : _masterConfig$auth38$.openOauthInPage) !== null && _masterConfig$auth$oa5 !== void 0 ? _masterConfig$auth$oa5 : false : _ref109$openInPage, additionalParameters = _ref109.additionalState, captchaToken = _ref109.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.DISCORD;
             if (masterConfig) {
@@ -4048,6 +4061,10 @@ var ClientProvider = function ClientProvider(_ref) {
             verifier = _yield$generateChalle.verifier;
             codeChallenge = _yield$generateChalle.codeChallenge;
             storePKCEVerifier(provider, verifier);
+            // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
             // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
@@ -4057,7 +4074,7 @@ var ClientProvider = function ClientProvider(_ref) {
               nonce: nonce,
               flow: flow,
               codeChallenge: codeChallenge,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context96.n = 7;
@@ -4103,6 +4120,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess,
                         exchangeCodeForToken: function () {
                           var _exchangeCodeForToken = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee95(codeVerifier) {
@@ -4154,11 +4172,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleXOauth = useCallback(/*#__PURE__*/function () {
     var _ref110 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee98(params) {
       var _masterConfig$auth42, _masterConfig$auth42$, _masterConfig$auth42$2, _masterConfig$auth$oa6, _masterConfig$auth43, _masterConfig$auth43$, _masterConfig$auth43$2, _masterConfig$auth$oa7, _masterConfig$auth44, _masterConfig$auth44$, _masterConfig$auth45, _masterConfig$auth45$, _masterConfig$auth46;
-      var _ref111, _ref111$primaryClient, primaryClientId, _ref111$secondaryClie, secondaryClientIds, _ref111$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle2, verifier, codeChallenge, authUrl, authWindow;
+      var _ref111, _ref111$primaryClient, primaryClientId, _ref111$secondaryClie, secondaryClientIds, _ref111$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle2, verifier, codeChallenge, authUrl, authWindow;
       return _regenerator().w(function (_context98) {
         while (1) switch (_context98.n) {
           case 0:
-            _ref111 = params || {}, _ref111$primaryClient = _ref111.primaryClientId, primaryClientId = _ref111$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth42 = masterConfig.auth) === null || _masterConfig$auth42 === void 0 ? void 0 : (_masterConfig$auth42$ = _masterConfig$auth42.oauthConfig) === null || _masterConfig$auth42$ === void 0 ? void 0 : (_masterConfig$auth42$2 = _masterConfig$auth42$.x) === null || _masterConfig$auth42$2 === void 0 ? void 0 : _masterConfig$auth42$2.primaryClientId : _ref111$primaryClient, _ref111$secondaryClie = _ref111.secondaryClientIds, secondaryClientIds = _ref111$secondaryClie === void 0 ? (_masterConfig$auth$oa6 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth43 = masterConfig.auth) === null || _masterConfig$auth43 === void 0 ? void 0 : (_masterConfig$auth43$ = _masterConfig$auth43.oauthConfig) === null || _masterConfig$auth43$ === void 0 ? void 0 : (_masterConfig$auth43$2 = _masterConfig$auth43$.x) === null || _masterConfig$auth43$2 === void 0 ? void 0 : _masterConfig$auth43$2.secondaryClientIds) !== null && _masterConfig$auth$oa6 !== void 0 ? _masterConfig$auth$oa6 : [] : _ref111$secondaryClie, _ref111$openInPage = _ref111.openInPage, openInPage = _ref111$openInPage === void 0 ? (_masterConfig$auth$oa7 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth44 = masterConfig.auth) === null || _masterConfig$auth44 === void 0 ? void 0 : (_masterConfig$auth44$ = _masterConfig$auth44.oauthConfig) === null || _masterConfig$auth44$ === void 0 ? void 0 : _masterConfig$auth44$.openOauthInPage) !== null && _masterConfig$auth$oa7 !== void 0 ? _masterConfig$auth$oa7 : false : _ref111$openInPage, additionalParameters = _ref111.additionalState;
+            _ref111 = params || {}, _ref111$primaryClient = _ref111.primaryClientId, primaryClientId = _ref111$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth42 = masterConfig.auth) === null || _masterConfig$auth42 === void 0 ? void 0 : (_masterConfig$auth42$ = _masterConfig$auth42.oauthConfig) === null || _masterConfig$auth42$ === void 0 ? void 0 : (_masterConfig$auth42$2 = _masterConfig$auth42$.x) === null || _masterConfig$auth42$2 === void 0 ? void 0 : _masterConfig$auth42$2.primaryClientId : _ref111$primaryClient, _ref111$secondaryClie = _ref111.secondaryClientIds, secondaryClientIds = _ref111$secondaryClie === void 0 ? (_masterConfig$auth$oa6 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth43 = masterConfig.auth) === null || _masterConfig$auth43 === void 0 ? void 0 : (_masterConfig$auth43$ = _masterConfig$auth43.oauthConfig) === null || _masterConfig$auth43$ === void 0 ? void 0 : (_masterConfig$auth43$2 = _masterConfig$auth43$.x) === null || _masterConfig$auth43$2 === void 0 ? void 0 : _masterConfig$auth43$2.secondaryClientIds) !== null && _masterConfig$auth$oa6 !== void 0 ? _masterConfig$auth$oa6 : [] : _ref111$secondaryClie, _ref111$openInPage = _ref111.openInPage, openInPage = _ref111$openInPage === void 0 ? (_masterConfig$auth$oa7 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth44 = masterConfig.auth) === null || _masterConfig$auth44 === void 0 ? void 0 : (_masterConfig$auth44$ = _masterConfig$auth44.oauthConfig) === null || _masterConfig$auth44$ === void 0 ? void 0 : _masterConfig$auth44$.openOauthInPage) !== null && _masterConfig$auth$oa7 !== void 0 ? _masterConfig$auth$oa7 : false : _ref111$openInPage, additionalParameters = _ref111.additionalState, captchaToken = _ref111.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.X;
             if (masterConfig) {
@@ -4199,6 +4217,10 @@ var ClientProvider = function ClientProvider(_ref) {
             verifier = _yield$generateChalle2.verifier;
             codeChallenge = _yield$generateChalle2.codeChallenge;
             storePKCEVerifier(provider, verifier);
+            // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
             // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
@@ -4208,7 +4230,7 @@ var ClientProvider = function ClientProvider(_ref) {
               nonce: nonce,
               flow: flow,
               codeChallenge: codeChallenge,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context98.n = 7;
@@ -4254,6 +4276,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess,
                         exchangeCodeForToken: function () {
                           var _exchangeCodeForToken2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee97(codeVerifier) {
@@ -4305,11 +4328,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleGoogleOauth = useCallback(/*#__PURE__*/function () {
     var _ref112 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee99(params) {
       var _masterConfig$auth48, _masterConfig$auth48$, _masterConfig$auth48$2, _masterConfig$auth$oa8, _masterConfig$auth49, _masterConfig$auth49$, _masterConfig$auth49$2, _masterConfig$auth$oa9, _masterConfig$auth50, _masterConfig$auth50$, _masterConfig$auth51, _masterConfig$auth51$, _masterConfig$auth52;
-      var _ref113, _ref113$primaryClient, primaryClientId, _ref113$secondaryClie, secondaryClientIds, _ref113$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, authUrl, authWindow;
+      var _ref113, _ref113$primaryClient, primaryClientId, _ref113$secondaryClie, secondaryClientIds, _ref113$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, authUrl, authWindow;
       return _regenerator().w(function (_context99) {
         while (1) switch (_context99.n) {
           case 0:
-            _ref113 = params || {}, _ref113$primaryClient = _ref113.primaryClientId, primaryClientId = _ref113$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth48 = masterConfig.auth) === null || _masterConfig$auth48 === void 0 ? void 0 : (_masterConfig$auth48$ = _masterConfig$auth48.oauthConfig) === null || _masterConfig$auth48$ === void 0 ? void 0 : (_masterConfig$auth48$2 = _masterConfig$auth48$.google) === null || _masterConfig$auth48$2 === void 0 ? void 0 : _masterConfig$auth48$2.primaryClientId : _ref113$primaryClient, _ref113$secondaryClie = _ref113.secondaryClientIds, secondaryClientIds = _ref113$secondaryClie === void 0 ? (_masterConfig$auth$oa8 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth49 = masterConfig.auth) === null || _masterConfig$auth49 === void 0 ? void 0 : (_masterConfig$auth49$ = _masterConfig$auth49.oauthConfig) === null || _masterConfig$auth49$ === void 0 ? void 0 : (_masterConfig$auth49$2 = _masterConfig$auth49$.google) === null || _masterConfig$auth49$2 === void 0 ? void 0 : _masterConfig$auth49$2.secondaryClientIds) !== null && _masterConfig$auth$oa8 !== void 0 ? _masterConfig$auth$oa8 : [] : _ref113$secondaryClie, _ref113$openInPage = _ref113.openInPage, openInPage = _ref113$openInPage === void 0 ? (_masterConfig$auth$oa9 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth50 = masterConfig.auth) === null || _masterConfig$auth50 === void 0 ? void 0 : (_masterConfig$auth50$ = _masterConfig$auth50.oauthConfig) === null || _masterConfig$auth50$ === void 0 ? void 0 : _masterConfig$auth50$.openOauthInPage) !== null && _masterConfig$auth$oa9 !== void 0 ? _masterConfig$auth$oa9 : false : _ref113$openInPage, additionalParameters = _ref113.additionalState;
+            _ref113 = params || {}, _ref113$primaryClient = _ref113.primaryClientId, primaryClientId = _ref113$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth48 = masterConfig.auth) === null || _masterConfig$auth48 === void 0 ? void 0 : (_masterConfig$auth48$ = _masterConfig$auth48.oauthConfig) === null || _masterConfig$auth48$ === void 0 ? void 0 : (_masterConfig$auth48$2 = _masterConfig$auth48$.google) === null || _masterConfig$auth48$2 === void 0 ? void 0 : _masterConfig$auth48$2.primaryClientId : _ref113$primaryClient, _ref113$secondaryClie = _ref113.secondaryClientIds, secondaryClientIds = _ref113$secondaryClie === void 0 ? (_masterConfig$auth$oa8 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth49 = masterConfig.auth) === null || _masterConfig$auth49 === void 0 ? void 0 : (_masterConfig$auth49$ = _masterConfig$auth49.oauthConfig) === null || _masterConfig$auth49$ === void 0 ? void 0 : (_masterConfig$auth49$2 = _masterConfig$auth49$.google) === null || _masterConfig$auth49$2 === void 0 ? void 0 : _masterConfig$auth49$2.secondaryClientIds) !== null && _masterConfig$auth$oa8 !== void 0 ? _masterConfig$auth$oa8 : [] : _ref113$secondaryClie, _ref113$openInPage = _ref113.openInPage, openInPage = _ref113$openInPage === void 0 ? (_masterConfig$auth$oa9 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth50 = masterConfig.auth) === null || _masterConfig$auth50 === void 0 ? void 0 : (_masterConfig$auth50$ = _masterConfig$auth50.oauthConfig) === null || _masterConfig$auth50$ === void 0 ? void 0 : _masterConfig$auth50$.openOauthInPage) !== null && _masterConfig$auth$oa9 !== void 0 ? _masterConfig$auth$oa9 : false : _ref113$openInPage, additionalParameters = _ref113.additionalState, captchaToken = _ref113.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.GOOGLE;
             if (masterConfig) {
@@ -4342,7 +4365,11 @@ var ClientProvider = function ClientProvider(_ref) {
             }
             throw new Error("Failed to create public key for OAuth.");
           case 5:
-            nonce = bytesToHex(sha256(publicKey)); // Build OAuth URL
+            nonce = bytesToHex(sha256(publicKey)); // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
+            // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
               clientId: clientId,
@@ -4350,7 +4377,7 @@ var ClientProvider = function ClientProvider(_ref) {
               publicKey: publicKey,
               nonce: nonce,
               flow: flow,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context99.n = 6;
@@ -4396,6 +4423,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess
                       }).then(function () {
                         return resolve();
@@ -4420,11 +4448,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleAppleOauth = useCallback(/*#__PURE__*/function () {
     var _ref114 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee100(params) {
       var _masterConfig$auth54, _masterConfig$auth54$, _masterConfig$auth54$2, _masterConfig$auth$oa0, _masterConfig$auth55, _masterConfig$auth55$, _masterConfig$auth55$2, _masterConfig$auth$oa1, _masterConfig$auth56, _masterConfig$auth56$, _masterConfig$auth57, _masterConfig$auth57$, _masterConfig$auth58;
-      var _ref115, _ref115$primaryClient, primaryClientId, _ref115$secondaryClie, secondaryClientIds, _ref115$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, authUrl, authWindow;
+      var _ref115, _ref115$primaryClient, primaryClientId, _ref115$secondaryClie, secondaryClientIds, _ref115$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, authUrl, authWindow;
       return _regenerator().w(function (_context100) {
         while (1) switch (_context100.n) {
           case 0:
-            _ref115 = params || {}, _ref115$primaryClient = _ref115.primaryClientId, primaryClientId = _ref115$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth54 = masterConfig.auth) === null || _masterConfig$auth54 === void 0 ? void 0 : (_masterConfig$auth54$ = _masterConfig$auth54.oauthConfig) === null || _masterConfig$auth54$ === void 0 ? void 0 : (_masterConfig$auth54$2 = _masterConfig$auth54$.apple) === null || _masterConfig$auth54$2 === void 0 ? void 0 : _masterConfig$auth54$2.primaryClientId : _ref115$primaryClient, _ref115$secondaryClie = _ref115.secondaryClientIds, secondaryClientIds = _ref115$secondaryClie === void 0 ? (_masterConfig$auth$oa0 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth55 = masterConfig.auth) === null || _masterConfig$auth55 === void 0 ? void 0 : (_masterConfig$auth55$ = _masterConfig$auth55.oauthConfig) === null || _masterConfig$auth55$ === void 0 ? void 0 : (_masterConfig$auth55$2 = _masterConfig$auth55$.apple) === null || _masterConfig$auth55$2 === void 0 ? void 0 : _masterConfig$auth55$2.secondaryClientIds) !== null && _masterConfig$auth$oa0 !== void 0 ? _masterConfig$auth$oa0 : [] : _ref115$secondaryClie, _ref115$openInPage = _ref115.openInPage, openInPage = _ref115$openInPage === void 0 ? (_masterConfig$auth$oa1 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth56 = masterConfig.auth) === null || _masterConfig$auth56 === void 0 ? void 0 : (_masterConfig$auth56$ = _masterConfig$auth56.oauthConfig) === null || _masterConfig$auth56$ === void 0 ? void 0 : _masterConfig$auth56$.openOauthInPage) !== null && _masterConfig$auth$oa1 !== void 0 ? _masterConfig$auth$oa1 : false : _ref115$openInPage, additionalParameters = _ref115.additionalState;
+            _ref115 = params || {}, _ref115$primaryClient = _ref115.primaryClientId, primaryClientId = _ref115$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth54 = masterConfig.auth) === null || _masterConfig$auth54 === void 0 ? void 0 : (_masterConfig$auth54$ = _masterConfig$auth54.oauthConfig) === null || _masterConfig$auth54$ === void 0 ? void 0 : (_masterConfig$auth54$2 = _masterConfig$auth54$.apple) === null || _masterConfig$auth54$2 === void 0 ? void 0 : _masterConfig$auth54$2.primaryClientId : _ref115$primaryClient, _ref115$secondaryClie = _ref115.secondaryClientIds, secondaryClientIds = _ref115$secondaryClie === void 0 ? (_masterConfig$auth$oa0 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth55 = masterConfig.auth) === null || _masterConfig$auth55 === void 0 ? void 0 : (_masterConfig$auth55$ = _masterConfig$auth55.oauthConfig) === null || _masterConfig$auth55$ === void 0 ? void 0 : (_masterConfig$auth55$2 = _masterConfig$auth55$.apple) === null || _masterConfig$auth55$2 === void 0 ? void 0 : _masterConfig$auth55$2.secondaryClientIds) !== null && _masterConfig$auth$oa0 !== void 0 ? _masterConfig$auth$oa0 : [] : _ref115$secondaryClie, _ref115$openInPage = _ref115.openInPage, openInPage = _ref115$openInPage === void 0 ? (_masterConfig$auth$oa1 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth56 = masterConfig.auth) === null || _masterConfig$auth56 === void 0 ? void 0 : (_masterConfig$auth56$ = _masterConfig$auth56.oauthConfig) === null || _masterConfig$auth56$ === void 0 ? void 0 : _masterConfig$auth56$.openOauthInPage) !== null && _masterConfig$auth$oa1 !== void 0 ? _masterConfig$auth$oa1 : false : _ref115$openInPage, additionalParameters = _ref115.additionalState, captchaToken = _ref115.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.APPLE;
             if (masterConfig) {
@@ -4457,7 +4485,11 @@ var ClientProvider = function ClientProvider(_ref) {
             }
             throw new Error("Failed to create public key for OAuth.");
           case 5:
-            nonce = bytesToHex(sha256(publicKey)); // Build OAuth URL
+            nonce = bytesToHex(sha256(publicKey)); // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
+            // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
               clientId: clientId,
@@ -4465,7 +4497,7 @@ var ClientProvider = function ClientProvider(_ref) {
               publicKey: publicKey,
               nonce: nonce,
               flow: flow,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context100.n = 6;
@@ -4511,6 +4543,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess
                       }).then(function () {
                         return resolve();
@@ -4535,11 +4568,11 @@ var ClientProvider = function ClientProvider(_ref) {
   var handleFacebookOauth = useCallback(/*#__PURE__*/function () {
     var _ref116 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee102(params) {
       var _masterConfig$auth60, _masterConfig$auth60$, _masterConfig$auth60$2, _masterConfig$auth$oa10, _masterConfig$auth61, _masterConfig$auth61$, _masterConfig$auth61$2, _masterConfig$auth$oa11, _masterConfig$auth62, _masterConfig$auth62$, _masterConfig$auth63, _masterConfig$auth63$, _masterConfig$auth64;
-      var _ref117, _ref117$primaryClient, primaryClientId, _ref117$secondaryClie, secondaryClientIds, _ref117$openInPage, openInPage, additionalParameters, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle3, verifier, codeChallenge, authUrl, authWindow;
+      var _ref117, _ref117$primaryClient, primaryClientId, _ref117$secondaryClie, secondaryClientIds, _ref117$openInPage, openInPage, additionalParameters, captchaToken, clientId, provider, flow, redirectUri, publicKey, nonce, _yield$generateChalle3, verifier, codeChallenge, authUrl, authWindow;
       return _regenerator().w(function (_context102) {
         while (1) switch (_context102.n) {
           case 0:
-            _ref117 = params || {}, _ref117$primaryClient = _ref117.primaryClientId, primaryClientId = _ref117$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth60 = masterConfig.auth) === null || _masterConfig$auth60 === void 0 ? void 0 : (_masterConfig$auth60$ = _masterConfig$auth60.oauthConfig) === null || _masterConfig$auth60$ === void 0 ? void 0 : (_masterConfig$auth60$2 = _masterConfig$auth60$.facebook) === null || _masterConfig$auth60$2 === void 0 ? void 0 : _masterConfig$auth60$2.primaryClientId : _ref117$primaryClient, _ref117$secondaryClie = _ref117.secondaryClientIds, secondaryClientIds = _ref117$secondaryClie === void 0 ? (_masterConfig$auth$oa10 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth61 = masterConfig.auth) === null || _masterConfig$auth61 === void 0 ? void 0 : (_masterConfig$auth61$ = _masterConfig$auth61.oauthConfig) === null || _masterConfig$auth61$ === void 0 ? void 0 : (_masterConfig$auth61$2 = _masterConfig$auth61$.facebook) === null || _masterConfig$auth61$2 === void 0 ? void 0 : _masterConfig$auth61$2.secondaryClientIds) !== null && _masterConfig$auth$oa10 !== void 0 ? _masterConfig$auth$oa10 : [] : _ref117$secondaryClie, _ref117$openInPage = _ref117.openInPage, openInPage = _ref117$openInPage === void 0 ? (_masterConfig$auth$oa11 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth62 = masterConfig.auth) === null || _masterConfig$auth62 === void 0 ? void 0 : (_masterConfig$auth62$ = _masterConfig$auth62.oauthConfig) === null || _masterConfig$auth62$ === void 0 ? void 0 : _masterConfig$auth62$.openOauthInPage) !== null && _masterConfig$auth$oa11 !== void 0 ? _masterConfig$auth$oa11 : false : _ref117$openInPage, additionalParameters = _ref117.additionalState;
+            _ref117 = params || {}, _ref117$primaryClient = _ref117.primaryClientId, primaryClientId = _ref117$primaryClient === void 0 ? masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth60 = masterConfig.auth) === null || _masterConfig$auth60 === void 0 ? void 0 : (_masterConfig$auth60$ = _masterConfig$auth60.oauthConfig) === null || _masterConfig$auth60$ === void 0 ? void 0 : (_masterConfig$auth60$2 = _masterConfig$auth60$.facebook) === null || _masterConfig$auth60$2 === void 0 ? void 0 : _masterConfig$auth60$2.primaryClientId : _ref117$primaryClient, _ref117$secondaryClie = _ref117.secondaryClientIds, secondaryClientIds = _ref117$secondaryClie === void 0 ? (_masterConfig$auth$oa10 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth61 = masterConfig.auth) === null || _masterConfig$auth61 === void 0 ? void 0 : (_masterConfig$auth61$ = _masterConfig$auth61.oauthConfig) === null || _masterConfig$auth61$ === void 0 ? void 0 : (_masterConfig$auth61$2 = _masterConfig$auth61$.facebook) === null || _masterConfig$auth61$2 === void 0 ? void 0 : _masterConfig$auth61$2.secondaryClientIds) !== null && _masterConfig$auth$oa10 !== void 0 ? _masterConfig$auth$oa10 : [] : _ref117$secondaryClie, _ref117$openInPage = _ref117.openInPage, openInPage = _ref117$openInPage === void 0 ? (_masterConfig$auth$oa11 = masterConfig === null || masterConfig === void 0 ? void 0 : (_masterConfig$auth62 = masterConfig.auth) === null || _masterConfig$auth62 === void 0 ? void 0 : (_masterConfig$auth62$ = _masterConfig$auth62.oauthConfig) === null || _masterConfig$auth62$ === void 0 ? void 0 : _masterConfig$auth62$.openOauthInPage) !== null && _masterConfig$auth$oa11 !== void 0 ? _masterConfig$auth$oa11 : false : _ref117$openInPage, additionalParameters = _ref117.additionalState, captchaToken = _ref117.captchaToken;
             clientId = primaryClientId;
             provider = OAuthProviders.FACEBOOK;
             if (masterConfig) {
@@ -4580,6 +4613,10 @@ var ClientProvider = function ClientProvider(_ref) {
             verifier = _yield$generateChalle3.verifier;
             codeChallenge = _yield$generateChalle3.codeChallenge;
             storePKCEVerifier(provider, verifier);
+            // Persist captcha out of the redirect URL (same pattern as PKCE verifier)
+            if (openInPage && captchaToken) {
+              storeOAuthCaptchaToken(captchaToken);
+            }
             // Build OAuth URL
             authUrl = buildOAuthUrl({
               provider: provider,
@@ -4589,7 +4626,7 @@ var ClientProvider = function ClientProvider(_ref) {
               nonce: nonce,
               flow: flow,
               codeChallenge: codeChallenge,
-              additionalState: additionalParameters
+              additionalState: _objectSpread2({}, additionalParameters)
             });
             if (!openInPage) {
               _context102.n = 7;
@@ -4635,6 +4672,7 @@ var ClientProvider = function ClientProvider(_ref) {
                             })
                           }));
                         },
+                        captchaToken: captchaToken,
                         onOauthSuccess: params === null || params === void 0 ? void 0 : params.onOauthSuccess,
                         exchangeCodeForToken: function () {
                           var _exchangeCodeForToken3 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee101(codeVerifier) {
@@ -6900,37 +6938,45 @@ var ClientProvider = function ClientProvider(_ref) {
   }(), [getSession, pushPage]);
   useEffect(function () {
     if (proxyAuthConfigRef.current) return;
-    // Only fetch the proxy auth config once. Use that to build the master config.
+    // Fetch proxy auth config and client params once. Use both to build the master config.
     var fetchProxyAuthConfig = /*#__PURE__*/function () {
       var _ref162 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee136() {
-        var proxyAuthConfig;
+        var proxyAuthConfig, clientParams, promises;
         return _regenerator().w(function (_context136) {
           while (1) switch (_context136.p = _context136.n) {
             case 0:
               _context136.p = 0;
-              if (!shouldFetchWalletKitConfig) {
-                _context136.n = 2;
-                break;
+              promises = [];
+              if (shouldFetchWalletKitConfig) {
+                promises.push(getAuthProxyConfig(config.authProxyConfigId, config.authProxyUrl).then(function (result) {
+                  proxyAuthConfig = result;
+                }));
+              }
+              if (config.authProxyConfigId) {
+                promises.push(getClientParams(config.authProxyConfigId, config.authProxyUrl).then(function (result) {
+                  clientParams = result;
+                }));
               }
               _context136.n = 1;
-              return getAuthProxyConfig(config.authProxyConfigId,
-              // Can assert safely. See shouldFetchWalletKitConfig definition.
-              config.authProxyUrl);
+              return Promise.all(promises);
             case 1:
-              proxyAuthConfig = _context136.v;
-              proxyAuthConfigRef.current = proxyAuthConfig;
-            case 2:
-              setMasterConfig(buildConfig(proxyAuthConfig));
-              _context136.n = 4;
+              if (proxyAuthConfig) {
+                proxyAuthConfigRef.current = proxyAuthConfig;
+              }
+              if (clientParams) {
+                clientParamsRef.current = clientParams;
+              }
+              setMasterConfig(buildConfig(proxyAuthConfig, clientParams));
+              _context136.n = 3;
               break;
-            case 3:
-              _context136.p = 3;
+            case 2:
+              _context136.p = 2;
               _context136.v;
               setClientState(ClientState.Error);
-            case 4:
+            case 3:
               return _context136.a(2);
           }
-        }, _callee136, null, [[0, 3]]);
+        }, _callee136, null, [[0, 2]]);
       }));
       return function fetchProxyAuthConfig() {
         return _ref162.apply(this, arguments);
@@ -6944,13 +6990,13 @@ var ClientProvider = function ClientProvider(_ref) {
     initializeClient();
   }, [masterConfig]);
   useEffect(function () {
-    var _proxyAuthConfigRef$c;
+    var _proxyAuthConfigRef$c, _clientParamsRef$curr;
     // Handle changes to the passed in config prop -- update the master config
     // Rebuild the master config with the updated config and stored proxyAuthConfig
     // If we don't have a stored proxyAuthConfig and we need to fetch it, we wait until that fetch is done in the other useEffect.
     // If shouldFetchWalletKitConfig is false, we'll never have a proxyAuthConfig to build the master config with, so this useEffect should always run.
     if (!proxyAuthConfigRef.current && shouldFetchWalletKitConfig) return;
-    setMasterConfig(buildConfig((_proxyAuthConfigRef$c = proxyAuthConfigRef.current) !== null && _proxyAuthConfigRef$c !== void 0 ? _proxyAuthConfigRef$c : undefined));
+    setMasterConfig(buildConfig((_proxyAuthConfigRef$c = proxyAuthConfigRef.current) !== null && _proxyAuthConfigRef$c !== void 0 ? _proxyAuthConfigRef$c : undefined, (_clientParamsRef$curr = clientParamsRef.current) !== null && _clientParamsRef$curr !== void 0 ? _clientParamsRef$curr : undefined));
   }, [config, proxyAuthConfigRef.current]);
   /**
    * @internal
@@ -7035,7 +7081,7 @@ var ClientProvider = function ClientProvider(_ref) {
       clearSessionTimeouts();
     };
   }, [client]);
-  return jsx(ClientContext.Provider, {
+  return jsxs(ClientContext.Provider, {
     value: {
       session: session,
       allSessions: allSessions,
@@ -7143,9 +7189,26 @@ var ClientProvider = function ClientProvider(_ref) {
       handleVerifyAppProofs: handleVerifyAppProofs,
       handleOnRamp: handleOnRamp,
       handleSendTransaction: handleSendTransaction,
-      handleSendErc20Transfer: handleSendErc20Transfer
+      handleSendErc20Transfer: handleSendErc20Transfer,
+      getTurnstileToken: getTurnstileToken,
+      setTurnstileToken: setTurnstileToken
     },
-    children: children
+    children: [(masterConfig === null || masterConfig === void 0 ? void 0 : masterConfig.turnstileSiteKey) && authState !== AuthState.Authenticated && !getTurnstileToken() && jsx(Turnstile, {
+      siteKey: masterConfig.turnstileSiteKey,
+      onSuccess: function onSuccess(token) {
+        setTurnstileToken(token);
+      },
+      onError: function onError() {
+        setTurnstileToken(null);
+      },
+      onExpire: function onExpire() {
+        setTurnstileToken(null);
+      },
+      options: {
+        size: "invisible",
+        appearance: "execute"
+      }
+    }), children]
   });
 };