@bounded-sh/core 0.0.112-ux-audit.2 → 0.0.113

package/dist/{index-DOKk4VdC.js → index-WIHuQp4L.js}

@@ -4190,7 +4190,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-BMaEWGOW.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-Ce6_jR6H.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4520,7 +4520,7 @@ function normalizeAuthExpiredError(error, fallbackMessage) {
 }
 /** Refresh this many ms before `exp`, so a token cannot die mid-flight. */
 const TOKEN_EXPIRY_SKEW_MS = 60000;
-function classifyToken(token, nowMs = Date.now()) {
+function classifyToken(token, nowMs = Date.now(), skewMs = TOKEN_EXPIRY_SKEW_MS) {
     let exp;
     try {
         const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
@@ -4535,7 +4535,7 @@ function classifyToken(token, nowMs = Date.now()) {
     const expiresAtMs = exp * 1000;
     if (nowMs >= expiresAtMs)
         return 'expired';
-    if (nowMs >= expiresAtMs - TOKEN_EXPIRY_SKEW_MS)
+    if (nowMs >= expiresAtMs - skewMs)
         return 'expiring-soon';
     return 'fresh';
 }
@@ -4606,12 +4606,13 @@ async function commit(isServer, expected, refreshed) {
  * used; the caller must surface it rather than downgrade to anonymous.
  */
 async function getFreshAuthToken(isServer = false, options = {}) {
+    var _a;
     const { idToken, refreshToken, issuer, generation } = await readSessionParts(isServer);
     // No session at all: anonymous is legitimate.
     if (!idToken)
         return null;
     const force = options.force === true;
-    const freshness = classifyToken(idToken);
+    const freshness = classifyToken(idToken, Date.now(), Math.max(TOKEN_EXPIRY_SKEW_MS, (_a = options.refreshWithinMs) !== null && _a !== void 0 ? _a : 0));
     if (!force && freshness === 'fresh')
         return idToken;
     // Still valid for a little longer, so a failed refresh can fall back to it —
@@ -5334,8 +5335,11 @@ const connectionAcquisitions = new Map();
 // cache entry so collision isolation does not evict another principal's cache.
 const responseCache = new Map();
 const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
-const TOKEN_REFRESH_BUFFER = 10 * 60 * 1000; // Refresh token 10 minutes before expiry
 const TOKEN_CHECK_INTERVAL = 5 * 60 * 1000; // Check token freshness every 5 minutes
+// The worker closes a socket once the token it authenticated with expires. A socket
+// opens with, and each check refreshes, any token that would expire before the next
+// check plus two minutes for a timer a background tab delays.
+const TOKEN_REFRESH_WITHIN_MS = TOKEN_CHECK_INTERVAL + 2 * 60 * 1000;
 function getResponseCacheEntry(cacheKey, identityToken) {
     var _a;
     return (_a = responseCache.get(cacheKey)) === null || _a === void 0 ? void 0 : _a.find(entry => entry.identityToken === identityToken);
@@ -5623,21 +5627,13 @@ let connectionEpoch = 0;
 // WebSocket paths cannot drift apart. `classifyToken` replaces the old boolean,
 // which collapsed "expiring soon" and "already expired" into one answer and read a
 // token with no numeric `exp` as fresh.
-function getTokenExpirationTime(token) {
-    try {
-        const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
-        return payload.exp ? payload.exp * 1000 : null;
-    }
-    catch (_a) {
-        return null;
-    }
-}
 function failConnectionAuth(connection, error) {
     connection.authFailure = error;
     connection.pendingAuthToken = null;
     connection.pendingAuthSnapshot = null;
     connection.authTokenValue = null;
     connection.authPrincipal = null;
+    connection.reauthSnapshot = null;
     connection.isConnecting = false;
     connection.isConnected = false;
     connection.isAuthenticating = false;
@@ -5664,48 +5660,43 @@ function scheduleTokenRefresh(connection, isServer) {
             const currentToken = await getIdToken(isServer);
             if (!currentToken)
                 return; // Unauthenticated, nothing to refresh
-            const expirationTime = getTokenExpirationTime(currentToken);
-            if (!expirationTime)
-                return;
-            const timeUntilExpiry = expirationTime - Date.now();
-            if (timeUntilExpiry <= TOKEN_REFRESH_BUFFER) {
-                console.info('[WS v2] Token expiring soon, proactively refreshing');
-                // Refresh the token and store it. Do NOT reconnect — the server only
-                // verifies JWT at $connect time, so the existing connection continues
-                // working. The fresh token is picked up by urlProvider the next time
-                // a reconnect naturally happens (network drop, keepalive timeout, etc.).
-                //
-                // Routed through the shared transaction. This used to read a refresh
-                // token, call refreshSession, and write the result with nothing binding
-                // it to the session it started from — so a timer that fired for S1 and
-                // completed after a same-wallet re-login could overwrite S2's rotated
-                // token, and the next refresh would trip the issuer's reuse detection
-                // and revoke the whole family.
-                try {
-                    await getFreshAuthToken(isServer);
-                    console.info('[WS v2] Token refreshed successfully, stored for next connection');
-                }
-                catch (refreshError) {
-                    const definitive = (refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) === AUTH_CHANGED_CODE
-                        || !await getIdToken(isServer);
-                    if (definitive) {
-                        // The session is dead or belongs to someone else now. The shared
-                        // helper has already cleared storage and notified auth-state
-                        // listeners, so the UI stops showing a connection that is gone —
-                        // this branch used to just stop the timer and leave the UI
-                        // claiming to be connected.
-                        console.warn('[WS v2] Session no longer usable, stopping periodic refresh');
-                        if (connection.tokenRefreshTimer) {
-                            clearInterval(connection.tokenRefreshTimer);
-                            connection.tokenRefreshTimer = null;
-                        }
-                        return;
+            // The worker closes a socket once the token it authenticated with
+            // expires. Refresh any token the next check could reach too late, and
+            // give the open socket the stored token whenever it changed: refreshed
+            // here, in another tab, or by an HTTP call.
+            //
+            // Routed through the shared transaction. This used to read a refresh
+            // token, call refreshSession, and write the result with nothing binding
+            // it to the session it started from - so a timer that fired for S1 and
+            // completed after a same-wallet re-login could overwrite S2's rotated
+            // token, and the next refresh would trip the issuer's reuse detection
+            // and revoke the whole family.
+            try {
+                const token = await getFreshAuthToken(isServer, { refreshWithinMs: TOKEN_REFRESH_WITHIN_MS });
+                // A wallet-scoped socket authenticates through its own provider.
+                if (token && !connection.authTokenProvider)
+                    reauthenticateOpenSocket(connection, token);
+            }
+            catch (refreshError) {
+                const definitive = (refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) === AUTH_CHANGED_CODE
+                    || !await getIdToken(isServer);
+                if (definitive) {
+                    // The session is dead or belongs to someone else now. The shared
+                    // helper has already cleared storage and notified auth-state
+                    // listeners, so the UI stops showing a connection that is gone -
+                    // this branch used to just stop the timer and leave the UI
+                    // claiming to be connected.
+                    console.warn('[WS v2] Session no longer usable, stopping periodic refresh');
+                    if (connection.tokenRefreshTimer) {
+                        clearInterval(connection.tokenRefreshTimer);
+                        connection.tokenRefreshTimer = null;
                     }
-                    // Transient: keep the session and try again next interval.
-                    // Status only — the raw axios error carries config.data (the refresh
-                    // token) and must never hit the console / log sinks.
-                    console.warn('[WS v2] Proactive token refresh failed, will retry next interval. status:', (_b = (_a = refreshError === null || refreshError === void 0 ? void 0 : refreshError.status) !== null && _a !== void 0 ? _a : refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) !== null && _b !== void 0 ? _b : 'unknown');
+                    return;
                 }
+                // Transient: keep the session and try again next interval.
+                // Status only - the raw axios error carries config.data (the refresh
+                // token) and must never hit the console / log sinks.
+                console.warn('[WS v2] Proactive token refresh failed, will retry next interval. status:', (_b = (_a = refreshError === null || refreshError === void 0 ? void 0 : refreshError.status) !== null && _a !== void 0 ? _a : refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) !== null && _b !== void 0 ? _b : 'unknown');
             }
         }
         catch (error) {
@@ -5713,6 +5704,49 @@ function scheduleTokenRefresh(connection, isServer) {
         }
     }, TOKEN_CHECK_INTERVAL);
 }
+/**
+ * The identity the worker keys a socket's subscriptions by (subscriptions.ts
+ * connectionIdentityKey): the user id, wallet, email and EVM wallet its auth reads
+ * from the token, normalized as it does, plus the guest flag. An auth frame that
+ * changes it makes the worker drop every subscription on the socket.
+ */
+function socketIdentityKey(idToken) {
+    try {
+        const { id, address, email, evmAddress } = deriveUserIdentityFromIdToken(idToken);
+        const guest = JSON.parse(decodeBase64Url(idToken.split('.')[1])).is_anonymous === true;
+        return id && JSON.stringify([id, address, email, evmAddress, guest]);
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/**
+ * Give an authenticated socket the stored token before the worker closes it at
+ * its own token's expiry. For an unchanged worker identity an auth frame keeps
+ * the subscriptions and moves the deadline. The same account with changed claims
+ * (a refresh that bound a wallet, a guest that signed up) would lose them to that
+ * frame, so it reconnects and replays them instead. Another account is the
+ * auth-change path's job (reconnect with cleared read caches), never this one's.
+ */
+function reauthenticateOpenSocket(connection, token) {
+    // Only a socket that is OPEN: reconnecting-websocket queues anything else and
+    // flushes it into the next socket ahead of that socket's own auth.
+    if (!isWarmConnection(connection) || connection.reauthSnapshot)
+        return;
+    if (!connection.authTokenValue || connection.authTokenValue === token)
+        return;
+    const identity = socketIdentityKey(token);
+    if (!identity)
+        return;
+    const snapshot = authSnapshotFromToken(token);
+    if (identity === socketIdentityKey(connection.authTokenValue)) {
+        connection.reauthSnapshot = snapshot;
+        connection.ws.send(JSON.stringify({ type: 'auth', token }));
+    }
+    else if (snapshot.principal === connection.authPrincipal) {
+        connection.ws.reconnect();
+    }
+}
 /**
  * WS-local wrapper around the shared freshness helper.
  *
@@ -5723,7 +5757,8 @@ function scheduleTokenRefresh(connection, isServer) {
 async function getWsAuthToken(isServer) {
     var _a, _b;
     try {
-        return await getFreshAuthToken(isServer);
+        // A socket must outlive its first token check, five minutes after it opens.
+        return await getFreshAuthToken(isServer, { refreshWithinMs: TOKEN_REFRESH_WITHIN_MS });
     }
     catch (error) {
         // Status only — the raw axios error carries config.data (the refresh token)
@@ -6229,6 +6264,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         pendingAuthSnapshot: null,
         authTokenValue: null,
         authPrincipal: null,
+        reauthSnapshot: null,
         socketGeneration: 0,
         heartbeat: null,
         heartbeatReconnectTimer: null,
@@ -6306,6 +6342,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         connection.socketGeneration += 1;
         connection.isConnecting = false;
         connection.isConnected = true;
+        connection.reauthSnapshot = null;
         startHeartbeat(connection, ws);
         // NOTE: Do NOT reset consecutiveAuthFailures here. It is reset when a
         // fresh auth token is actually obtained or on an explicit auth change.
@@ -6372,6 +6409,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         stopHeartbeat(connection);
         connection.isConnected = false;
         connection.isAuthenticating = false;
+        connection.reauthSnapshot = null;
         const disconnectError = new Error('WebSocket disconnected');
         for (const subscriptionId of Array.from(connection.pendingSubscriptions.keys())) {
             rejectPendingSubscriptionConfirmation(connection, subscriptionId, disconnectError);
@@ -6393,6 +6431,21 @@ function handleServerMessage(connection, message) {
     var _a, _b, _c, _d, _e, _f;
     switch (message.type) {
         case 'authenticated': {
+            const reauth = connection.reauthSnapshot;
+            if (reauth) {
+                // The stored token on the open socket: its subscriptions are still
+                // live server-side, so there is nothing to replay, and a subscribe
+                // still awaiting confirmation keeps its one retry.
+                const previous = connection.authTokenValue;
+                connection.reauthSnapshot = null;
+                connection.authTokenValue = reauth.tokenValue;
+                connection.authPrincipal = reauth.principal;
+                for (const pending of connection.pendingSubscriptions.values()) {
+                    if (pending.authTokenValue === previous)
+                        pending.authTokenValue = reauth.tokenValue;
+                }
+                break;
+            }
             connection.isAuthenticating = false;
             connection.authTokenValue = (_b = (_a = connection.pendingAuthSnapshot) === null || _a === void 0 ? void 0 : _a.tokenValue) !== null && _b !== void 0 ? _b : null;
             connection.authPrincipal = (_d = (_c = connection.pendingAuthSnapshot) === null || _c === void 0 ? void 0 : _c.principal) !== null && _d !== void 0 ? _d : null;
@@ -7476,7 +7529,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-CIrvP17-.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-7itLaAao.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8974,7 +9027,7 @@ async function setMany(many, options) {
                     if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
                         throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
                     }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-BcFqY34S.js'); });
+                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-CNeO_lJ2.js'); });
                     const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
                     // Signing-only, exactly as on a real chain: signed and NOT committed.
                     if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
@@ -8999,7 +9052,7 @@ async function setMany(many, options) {
                             'Nothing was signed or submitted.');
                     }
                     const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-BcFqY34S.js'); });
+                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-CNeO_lJ2.js'); });
                     // OA-0001: derive the expected intent from OUR OWN request (the one
                     // ground truth a tampered builder response cannot change) so the
                     // validator can reject any transaction whose operation semantics
@@ -10763,7 +10816,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-BMaEWGOW.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-Ce6_jR6H.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11411,4 +11464,4 @@ exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
 exports.writeNotAppliedPhase = writeNotAppliedPhase;
-//# sourceMappingURL=index-DOKk4VdC.js.map
+//# sourceMappingURL=index-WIHuQp4L.js.map