@bounded-sh/core 0.0.115 → 0.0.116

package/dist/{index-5TMFraRK.js → index-CjiaT9AT.js}

@@ -826,6 +826,63 @@ function notifySessionCleared() {
     }
 }
 
+// Same-tab session change signal.
+//
+// A page can run more than one copy of the SDK: the app's own bundle and the hosted widget
+// bounded-router injects (which bundles its own, pinned copy). They share one session record in
+// localStorage, keyed by issuer and app id, but the browser fires `storage` events only in OTHER
+// tabs, so a copy that signs in never tells the other copy in the same tab. Until a reload, the
+// app stayed signed out after a widget sign-in and the widget stayed signed out after an app
+// sign-in (observed on staging, 2026-10-07).
+//
+// This announces "the record changed" on a BroadcastChannel, which reaches every other channel
+// on the origin, same tab included, and never the announcing instance itself. The message is a
+// nudge, not an authority: it carries no token and no identity, and a listener only re-reads the
+// record through its ordinary restore path. Nothing signs in or out because of the message alone.
+const SESSION_SIGNAL_CHANNEL = "bounded.session";
+let channel;
+function openChannel() {
+    var _a;
+    if (channel !== undefined)
+        return channel;
+    try {
+        channel = typeof BroadcastChannel === "function" ? new BroadcastChannel(SESSION_SIGNAL_CHANNEL) : null;
+        // Node's BroadcastChannel holds the event loop open until closed; a Node consumer (tests,
+        // tarobase-server) must not hang on exit because of a nudge channel. Browsers have no unref.
+        (_a = channel === null || channel === void 0 ? void 0 : channel.unref) === null || _a === void 0 ? void 0 : _a.call(channel);
+    }
+    catch (_b) {
+        channel = null;
+    }
+    return channel;
+}
+/** Tell the other SDK copies on this origin that the session record under `key` changed. */
+function announceSessionChange(key) {
+    const ch = openChannel();
+    if (!ch)
+        return;
+    try {
+        ch.postMessage({ type: "session-changed", key });
+    }
+    catch (_a) {
+        // A closed or unavailable channel loses the nudge; the record itself is unaffected.
+    }
+}
+/** Run `listener` when another SDK copy announces a session change. Returns the unsubscribe. */
+function onSessionChange(listener) {
+    const ch = openChannel();
+    if (!ch)
+        return () => { };
+    const handler = (event) => {
+        const data = event.data;
+        if (!data || data.type !== "session-changed" || typeof data.key !== "string")
+            return;
+        listener(data.key);
+    };
+    ch.addEventListener("message", handler);
+    return () => ch.removeEventListener("message", handler);
+}
+
 /**
  * The one protocol every session-storage mutation goes through.
  *
@@ -1022,6 +1079,7 @@ class WebSessionManager {
     }
     static writeRaw(sessionObj) {
         localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
     }
     /**
      * Read the session, stamping a `sessionGeneration` if it predates them.
@@ -1118,6 +1176,7 @@ class WebSessionManager {
                 idToken,
                 refreshToken, appId: currentAppId, sessionGeneration: generation }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
         });
+        announceSessionChange(storageKey);
         // Adoption can fail after persistence (for example, logout while the
         // provider is loading). Remove only this incomplete login, even if the
         // caller has since switched app configuration or another tab signed in.
@@ -1129,6 +1188,8 @@ class WebSessionManager {
                 localStorage.removeItem(storageKey);
                 return true;
             });
+            if (removed)
+                announceSessionChange(storageKey);
             if (removed)
                 notifySessionCleared();
         };
@@ -1258,8 +1319,10 @@ class WebSessionManager {
         });
         // Only announce a clear that actually happened, so a no-op cannot sign out
         // a UI that was already signed out.
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(key);
+        }
     }
     /**
      * Remove the session only if it is still the one identified by `generation`.
@@ -1284,8 +1347,10 @@ class WebSessionManager {
             localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
             return true;
         });
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
+        }
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
@@ -4242,7 +4307,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-BVwD6WVm.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-CXuLc7NX.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -7601,7 +7666,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-BiChlioj.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-IPPwUhJc.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -9101,7 +9166,7 @@ async function setMany(many, options) {
                     if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
                         throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
                     }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-B3u6Arbf.js'); });
+                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-CghJe0_7.js'); });
                     const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
                     // Signing-only, exactly as on a real chain: signed and NOT committed.
                     if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
@@ -9139,7 +9204,7 @@ async function setMany(many, options) {
                             'Nothing was signed or submitted.');
                     }
                     const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-B3u6Arbf.js'); });
+                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-CghJe0_7.js'); });
                     // OA-0001: derive the expected intent from OUR OWN request (the one
                     // ground truth a tampered builder response cannot change) so the
                     // validator can reject any transaction whose operation semantics
@@ -10983,7 +11048,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-BVwD6WVm.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-CXuLc7NX.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11545,6 +11610,7 @@ exports.LiveIntentError = LiveIntentError;
 exports.MIN_QUERY_POLL_INTERVAL_MS = MIN_QUERY_POLL_INTERVAL_MS;
 exports.RATE_LIMIT_EVENT_NAME = RATE_LIMIT_EVENT_NAME;
 exports.ReactNativeSessionManager = ReactNativeSessionManager;
+exports.SESSION_SIGNAL_CHANNEL = SESSION_SIGNAL_CHANNEL;
 exports.SOLANA_SIGN_IN_STATEMENT = SOLANA_SIGN_IN_STATEMENT;
 exports.ScopedClientReadOnlyError = ScopedClientReadOnlyError;
 exports.ServerSessionManager = ServerSessionManager;
@@ -11552,6 +11618,7 @@ exports.SessionEnvironmentError = SessionEnvironmentError;
 exports.UNSUPPORTED_ENVIRONMENT_CODE = UNSUPPORTED_ENVIRONMENT_CODE;
 exports.WebSessionManager = WebSessionManager;
 exports.aggregate = aggregate;
+exports.announceSessionChange = announceSessionChange;
 exports.browserSignInDomain = browserSignInDomain;
 exports.bufferExports = bufferExports;
 exports.canonicalizeArgs = canonicalizeArgs;
@@ -11602,6 +11669,7 @@ exports.live = live;
 exports.markWriteNotApplied = markWriteNotApplied;
 exports.normalizeEvmAddress = normalizeEvmAddress;
 exports.now = now;
+exports.onSessionChange = onSessionChange;
 exports.onSessionCleared = onSessionCleared;
 exports.queryAggregate = queryAggregate;
 exports.reconcileSetResult = reconcileSetResult;
@@ -11633,4 +11701,4 @@ exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
 exports.writeNotAppliedPhase = writeNotAppliedPhase;
-//# sourceMappingURL=index-5TMFraRK.js.map
+//# sourceMappingURL=index-CjiaT9AT.js.map