@bounded-sh/core 0.0.112-ux-audit.1 → 0.0.112

package/dist/{index-CVWqE5hO.mjs → index-CkgEqMkJ.mjs}

@@ -4188,7 +4188,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-BTs3b7JU.mjs');
+        const { genSolanaMessage } = await import('./solana-message-BBMxFFjM.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4518,7 +4518,7 @@ function normalizeAuthExpiredError(error, fallbackMessage) {
 }
 /** Refresh this many ms before `exp`, so a token cannot die mid-flight. */
 const TOKEN_EXPIRY_SKEW_MS = 60000;
-function classifyToken(token, nowMs = Date.now()) {
+function classifyToken(token, nowMs = Date.now(), skewMs = TOKEN_EXPIRY_SKEW_MS) {
     let exp;
     try {
         const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
@@ -4533,7 +4533,7 @@ function classifyToken(token, nowMs = Date.now()) {
     const expiresAtMs = exp * 1000;
     if (nowMs >= expiresAtMs)
         return 'expired';
-    if (nowMs >= expiresAtMs - TOKEN_EXPIRY_SKEW_MS)
+    if (nowMs >= expiresAtMs - skewMs)
         return 'expiring-soon';
     return 'fresh';
 }
@@ -4604,12 +4604,13 @@ async function commit(isServer, expected, refreshed) {
  * used; the caller must surface it rather than downgrade to anonymous.
  */
 async function getFreshAuthToken(isServer = false, options = {}) {
+    var _a;
     const { idToken, refreshToken, issuer, generation } = await readSessionParts(isServer);
     // No session at all: anonymous is legitimate.
     if (!idToken)
         return null;
     const force = options.force === true;
-    const freshness = classifyToken(idToken);
+    const freshness = classifyToken(idToken, Date.now(), Math.max(TOKEN_EXPIRY_SKEW_MS, (_a = options.refreshWithinMs) !== null && _a !== void 0 ? _a : 0));
     if (!force && freshness === 'fresh')
         return idToken;
     // Still valid for a little longer, so a failed refresh can fall back to it —
@@ -5332,8 +5333,11 @@ const connectionAcquisitions = new Map();
 // cache entry so collision isolation does not evict another principal's cache.
 const responseCache = new Map();
 const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
-const TOKEN_REFRESH_BUFFER = 10 * 60 * 1000; // Refresh token 10 minutes before expiry
 const TOKEN_CHECK_INTERVAL = 5 * 60 * 1000; // Check token freshness every 5 minutes
+// The worker closes a socket once the token it authenticated with expires. A socket
+// opens with, and each check refreshes, any token that would expire before the next
+// check plus two minutes for a timer a background tab delays.
+const TOKEN_REFRESH_WITHIN_MS = TOKEN_CHECK_INTERVAL + 2 * 60 * 1000;
 function getResponseCacheEntry(cacheKey, identityToken) {
     var _a;
     return (_a = responseCache.get(cacheKey)) === null || _a === void 0 ? void 0 : _a.find(entry => entry.identityToken === identityToken);
@@ -5621,21 +5625,13 @@ let connectionEpoch = 0;
 // WebSocket paths cannot drift apart. `classifyToken` replaces the old boolean,
 // which collapsed "expiring soon" and "already expired" into one answer and read a
 // token with no numeric `exp` as fresh.
-function getTokenExpirationTime(token) {
-    try {
-        const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
-        return payload.exp ? payload.exp * 1000 : null;
-    }
-    catch (_a) {
-        return null;
-    }
-}
 function failConnectionAuth(connection, error) {
     connection.authFailure = error;
     connection.pendingAuthToken = null;
     connection.pendingAuthSnapshot = null;
     connection.authTokenValue = null;
     connection.authPrincipal = null;
+    connection.reauthSnapshot = null;
     connection.isConnecting = false;
     connection.isConnected = false;
     connection.isAuthenticating = false;
@@ -5662,48 +5658,43 @@ function scheduleTokenRefresh(connection, isServer) {
             const currentToken = await getIdToken(isServer);
             if (!currentToken)
                 return; // Unauthenticated, nothing to refresh
-            const expirationTime = getTokenExpirationTime(currentToken);
-            if (!expirationTime)
-                return;
-            const timeUntilExpiry = expirationTime - Date.now();
-            if (timeUntilExpiry <= TOKEN_REFRESH_BUFFER) {
-                console.info('[WS v2] Token expiring soon, proactively refreshing');
-                // Refresh the token and store it. Do NOT reconnect — the server only
-                // verifies JWT at $connect time, so the existing connection continues
-                // working. The fresh token is picked up by urlProvider the next time
-                // a reconnect naturally happens (network drop, keepalive timeout, etc.).
-                //
-                // Routed through the shared transaction. This used to read a refresh
-                // token, call refreshSession, and write the result with nothing binding
-                // it to the session it started from — so a timer that fired for S1 and
-                // completed after a same-wallet re-login could overwrite S2's rotated
-                // token, and the next refresh would trip the issuer's reuse detection
-                // and revoke the whole family.
-                try {
-                    await getFreshAuthToken(isServer);
-                    console.info('[WS v2] Token refreshed successfully, stored for next connection');
-                }
-                catch (refreshError) {
-                    const definitive = (refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) === AUTH_CHANGED_CODE
-                        || !await getIdToken(isServer);
-                    if (definitive) {
-                        // The session is dead or belongs to someone else now. The shared
-                        // helper has already cleared storage and notified auth-state
-                        // listeners, so the UI stops showing a connection that is gone —
-                        // this branch used to just stop the timer and leave the UI
-                        // claiming to be connected.
-                        console.warn('[WS v2] Session no longer usable, stopping periodic refresh');
-                        if (connection.tokenRefreshTimer) {
-                            clearInterval(connection.tokenRefreshTimer);
-                            connection.tokenRefreshTimer = null;
-                        }
-                        return;
+            // The worker closes a socket once the token it authenticated with
+            // expires. Refresh any token the next check could reach too late, and
+            // give the open socket the stored token whenever it changed: refreshed
+            // here, in another tab, or by an HTTP call.
+            //
+            // Routed through the shared transaction. This used to read a refresh
+            // token, call refreshSession, and write the result with nothing binding
+            // it to the session it started from - so a timer that fired for S1 and
+            // completed after a same-wallet re-login could overwrite S2's rotated
+            // token, and the next refresh would trip the issuer's reuse detection
+            // and revoke the whole family.
+            try {
+                const token = await getFreshAuthToken(isServer, { refreshWithinMs: TOKEN_REFRESH_WITHIN_MS });
+                // A wallet-scoped socket authenticates through its own provider.
+                if (token && !connection.authTokenProvider)
+                    reauthenticateOpenSocket(connection, token);
+            }
+            catch (refreshError) {
+                const definitive = (refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) === AUTH_CHANGED_CODE
+                    || !await getIdToken(isServer);
+                if (definitive) {
+                    // The session is dead or belongs to someone else now. The shared
+                    // helper has already cleared storage and notified auth-state
+                    // listeners, so the UI stops showing a connection that is gone -
+                    // this branch used to just stop the timer and leave the UI
+                    // claiming to be connected.
+                    console.warn('[WS v2] Session no longer usable, stopping periodic refresh');
+                    if (connection.tokenRefreshTimer) {
+                        clearInterval(connection.tokenRefreshTimer);
+                        connection.tokenRefreshTimer = null;
                     }
-                    // Transient: keep the session and try again next interval.
-                    // Status only — the raw axios error carries config.data (the refresh
-                    // token) and must never hit the console / log sinks.
-                    console.warn('[WS v2] Proactive token refresh failed, will retry next interval. status:', (_b = (_a = refreshError === null || refreshError === void 0 ? void 0 : refreshError.status) !== null && _a !== void 0 ? _a : refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) !== null && _b !== void 0 ? _b : 'unknown');
+                    return;
                 }
+                // Transient: keep the session and try again next interval.
+                // Status only - the raw axios error carries config.data (the refresh
+                // token) and must never hit the console / log sinks.
+                console.warn('[WS v2] Proactive token refresh failed, will retry next interval. status:', (_b = (_a = refreshError === null || refreshError === void 0 ? void 0 : refreshError.status) !== null && _a !== void 0 ? _a : refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) !== null && _b !== void 0 ? _b : 'unknown');
             }
         }
         catch (error) {
@@ -5711,6 +5702,49 @@ function scheduleTokenRefresh(connection, isServer) {
         }
     }, TOKEN_CHECK_INTERVAL);
 }
+/**
+ * The identity the worker keys a socket's subscriptions by (subscriptions.ts
+ * connectionIdentityKey): the user id, wallet, email and EVM wallet its auth reads
+ * from the token, normalized as it does, plus the guest flag. An auth frame that
+ * changes it makes the worker drop every subscription on the socket.
+ */
+function socketIdentityKey(idToken) {
+    try {
+        const { id, address, email, evmAddress } = deriveUserIdentityFromIdToken(idToken);
+        const guest = JSON.parse(decodeBase64Url(idToken.split('.')[1])).is_anonymous === true;
+        return id && JSON.stringify([id, address, email, evmAddress, guest]);
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/**
+ * Give an authenticated socket the stored token before the worker closes it at
+ * its own token's expiry. For an unchanged worker identity an auth frame keeps
+ * the subscriptions and moves the deadline. The same account with changed claims
+ * (a refresh that bound a wallet, a guest that signed up) would lose them to that
+ * frame, so it reconnects and replays them instead. Another account is the
+ * auth-change path's job (reconnect with cleared read caches), never this one's.
+ */
+function reauthenticateOpenSocket(connection, token) {
+    // Only a socket that is OPEN: reconnecting-websocket queues anything else and
+    // flushes it into the next socket ahead of that socket's own auth.
+    if (!isWarmConnection(connection) || connection.reauthSnapshot)
+        return;
+    if (!connection.authTokenValue || connection.authTokenValue === token)
+        return;
+    const identity = socketIdentityKey(token);
+    if (!identity)
+        return;
+    const snapshot = authSnapshotFromToken(token);
+    if (identity === socketIdentityKey(connection.authTokenValue)) {
+        connection.reauthSnapshot = snapshot;
+        connection.ws.send(JSON.stringify({ type: 'auth', token }));
+    }
+    else if (snapshot.principal === connection.authPrincipal) {
+        connection.ws.reconnect();
+    }
+}
 /**
  * WS-local wrapper around the shared freshness helper.
  *
@@ -5721,7 +5755,8 @@ function scheduleTokenRefresh(connection, isServer) {
 async function getWsAuthToken(isServer) {
     var _a, _b;
     try {
-        return await getFreshAuthToken(isServer);
+        // A socket must outlive its first token check, five minutes after it opens.
+        return await getFreshAuthToken(isServer, { refreshWithinMs: TOKEN_REFRESH_WITHIN_MS });
     }
     catch (error) {
         // Status only — the raw axios error carries config.data (the refresh token)
@@ -6227,6 +6262,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         pendingAuthSnapshot: null,
         authTokenValue: null,
         authPrincipal: null,
+        reauthSnapshot: null,
         socketGeneration: 0,
         heartbeat: null,
         heartbeatReconnectTimer: null,
@@ -6304,6 +6340,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         connection.socketGeneration += 1;
         connection.isConnecting = false;
         connection.isConnected = true;
+        connection.reauthSnapshot = null;
         startHeartbeat(connection, ws);
         // NOTE: Do NOT reset consecutiveAuthFailures here. It is reset when a
         // fresh auth token is actually obtained or on an explicit auth change.
@@ -6370,6 +6407,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         stopHeartbeat(connection);
         connection.isConnected = false;
         connection.isAuthenticating = false;
+        connection.reauthSnapshot = null;
         const disconnectError = new Error('WebSocket disconnected');
         for (const subscriptionId of Array.from(connection.pendingSubscriptions.keys())) {
             rejectPendingSubscriptionConfirmation(connection, subscriptionId, disconnectError);
@@ -6391,6 +6429,21 @@ function handleServerMessage(connection, message) {
     var _a, _b, _c, _d, _e, _f;
     switch (message.type) {
         case 'authenticated': {
+            const reauth = connection.reauthSnapshot;
+            if (reauth) {
+                // The stored token on the open socket: its subscriptions are still
+                // live server-side, so there is nothing to replay, and a subscribe
+                // still awaiting confirmation keeps its one retry.
+                const previous = connection.authTokenValue;
+                connection.reauthSnapshot = null;
+                connection.authTokenValue = reauth.tokenValue;
+                connection.authPrincipal = reauth.principal;
+                for (const pending of connection.pendingSubscriptions.values()) {
+                    if (pending.authTokenValue === previous)
+                        pending.authTokenValue = reauth.tokenValue;
+                }
+                break;
+            }
             connection.isAuthenticating = false;
             connection.authTokenValue = (_b = (_a = connection.pendingAuthSnapshot) === null || _a === void 0 ? void 0 : _a.tokenValue) !== null && _b !== void 0 ? _b : null;
             connection.authPrincipal = (_d = (_c = connection.pendingAuthSnapshot) === null || _c === void 0 ? void 0 : _c.principal) !== null && _d !== void 0 ? _d : null;
@@ -7474,7 +7527,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-Cno1p315.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-BIB8v265.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8972,7 +9025,7 @@ async function setMany(many, options) {
                     if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
                         throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
                     }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-CU-8CFHk.mjs');
+                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-Cshh2EfH.mjs');
                     const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
                     // Signing-only, exactly as on a real chain: signed and NOT committed.
                     if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
@@ -8997,7 +9050,7 @@ async function setMany(many, options) {
                             'Nothing was signed or submitted.');
                     }
                     const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-CU-8CFHk.mjs');
+                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-Cshh2EfH.mjs');
                     // OA-0001: derive the expected intent from OUR OWN request (the one
                     // ground truth a tampered builder response cannot change) so the
                     // validator can reject any transaction whose operation semantics
@@ -10761,7 +10814,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-BTs3b7JU.mjs');
+    const implementation = await import('./solana-message-BBMxFFjM.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11311,4 +11364,4 @@ function defineLiveModule(mod) {
 }
 
 export { increment as $, isWriteNotApplied as A, writeNotAppliedPhase as B, subscribe as C, closeAllSubscriptions as D, clearCache as E, getCachedData as F, reconnectWithNewAuth as G, createClient as H, InsufficientBalanceError as I, exchangeAppToken as J, clearAppTokenCache as K, createAppTokenAuthHeaders as L, AppTokenExchangeError as M, subscribeQuery as N, closeAllQuerySubscriptions as O, canonicalizeArgs as P, canonicalizeResult as Q, DEFAULT_QUERY_POLL_INTERVAL_MS as R, ScopedClientReadOnlyError as S, MIN_QUERY_POLL_INTERVAL_MS as T, BoundedDeclineError as U, deriveDecline as V, dispatchDeclineEvent as W, DECLINE_EVENT_NAME as X, dispatchRateLimitEvent as Y, RATE_LIMIT_EVENT_NAME as Z, hasActiveConnection as _, getWebhookKeysUrl as a, serverTimestamp as a0, now as a1, toSeconds as a2, toMillis as a3, getIdToken as a4, deriveUserIdentityFromIdToken as a5, getSessionGeneration as a6, WebSessionManager as a7, ReactNativeSessionManager as a8, getActiveSessionManager as a9, live as aA, intent as aB, status as aC, subscribeView as aD, LiveIntentError as aE, withEffects as aF, isEffectResult as aG, defineLiveModule as aH, EFFECT_INTENT_ADDRESS as aI, onSessionCleared as aa, SessionEnvironmentError as ab, UNSUPPORTED_ENVIRONMENT_CODE as ac, AUTH_CHANGED_CODE as ad, AUTH_EXPIRED_CODE as ae, isAuthExpiredError as af, getFreshAuthToken as ag, ServerSessionManager as ah, createSessionWithSignature as ai, refreshSession as aj, revokeSession as ak, signSessionCreateMessage as al, genAuthNonce as am, genSolanaMessage as an, createSolanaSignInRequest as ao, createSolanaSignInMessageText as ap, genSolanaSignInRequest as aq, genSolanaSignInMessage as ar, browserSignInDomain as as, SOLANA_SIGN_IN_STATEMENT as at, genSiweMessage as au, normalizeEvmAddress as av, toLowerEvmAddress as aw, functions as ax, invoke as ay, FunctionInvokeError as az, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, markWriteNotApplied as m, runQueryMany as n, runExpression as o, runExpressionMany as p, queryAggregate as q, runQuery as r, set as s, signMessage as t, signTransaction as u, signAndSubmitTransaction as v, count as w, aggregate as x, reconcileSetResult as y, waitForSetResult as z };
-//# sourceMappingURL=index-CVWqE5hO.mjs.map
+//# sourceMappingURL=index-CkgEqMkJ.mjs.map