@bounded-sh/core 0.0.115 → 0.0.116

package/dist/{index-BilGFb3V.mjs → index-Db4lrwO6.mjs}

@@ -824,6 +824,63 @@ function notifySessionCleared() {
     }
 }
 
+// Same-tab session change signal.
+//
+// A page can run more than one copy of the SDK: the app's own bundle and the hosted widget
+// bounded-router injects (which bundles its own, pinned copy). They share one session record in
+// localStorage, keyed by issuer and app id, but the browser fires `storage` events only in OTHER
+// tabs, so a copy that signs in never tells the other copy in the same tab. Until a reload, the
+// app stayed signed out after a widget sign-in and the widget stayed signed out after an app
+// sign-in (observed on staging, 2026-10-07).
+//
+// This announces "the record changed" on a BroadcastChannel, which reaches every other channel
+// on the origin, same tab included, and never the announcing instance itself. The message is a
+// nudge, not an authority: it carries no token and no identity, and a listener only re-reads the
+// record through its ordinary restore path. Nothing signs in or out because of the message alone.
+const SESSION_SIGNAL_CHANNEL = "bounded.session";
+let channel;
+function openChannel() {
+    var _a;
+    if (channel !== undefined)
+        return channel;
+    try {
+        channel = typeof BroadcastChannel === "function" ? new BroadcastChannel(SESSION_SIGNAL_CHANNEL) : null;
+        // Node's BroadcastChannel holds the event loop open until closed; a Node consumer (tests,
+        // tarobase-server) must not hang on exit because of a nudge channel. Browsers have no unref.
+        (_a = channel === null || channel === void 0 ? void 0 : channel.unref) === null || _a === void 0 ? void 0 : _a.call(channel);
+    }
+    catch (_b) {
+        channel = null;
+    }
+    return channel;
+}
+/** Tell the other SDK copies on this origin that the session record under `key` changed. */
+function announceSessionChange(key) {
+    const ch = openChannel();
+    if (!ch)
+        return;
+    try {
+        ch.postMessage({ type: "session-changed", key });
+    }
+    catch (_a) {
+        // A closed or unavailable channel loses the nudge; the record itself is unaffected.
+    }
+}
+/** Run `listener` when another SDK copy announces a session change. Returns the unsubscribe. */
+function onSessionChange(listener) {
+    const ch = openChannel();
+    if (!ch)
+        return () => { };
+    const handler = (event) => {
+        const data = event.data;
+        if (!data || data.type !== "session-changed" || typeof data.key !== "string")
+            return;
+        listener(data.key);
+    };
+    ch.addEventListener("message", handler);
+    return () => ch.removeEventListener("message", handler);
+}
+
 /**
  * The one protocol every session-storage mutation goes through.
  *
@@ -1020,6 +1077,7 @@ class WebSessionManager {
     }
     static writeRaw(sessionObj) {
         localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
     }
     /**
      * Read the session, stamping a `sessionGeneration` if it predates them.
@@ -1116,6 +1174,7 @@ class WebSessionManager {
                 idToken,
                 refreshToken, appId: currentAppId, sessionGeneration: generation }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
         });
+        announceSessionChange(storageKey);
         // Adoption can fail after persistence (for example, logout while the
         // provider is loading). Remove only this incomplete login, even if the
         // caller has since switched app configuration or another tab signed in.
@@ -1127,6 +1186,8 @@ class WebSessionManager {
                 localStorage.removeItem(storageKey);
                 return true;
             });
+            if (removed)
+                announceSessionChange(storageKey);
             if (removed)
                 notifySessionCleared();
         };
@@ -1256,8 +1317,10 @@ class WebSessionManager {
         });
         // Only announce a clear that actually happened, so a no-op cannot sign out
         // a UI that was already signed out.
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(key);
+        }
     }
     /**
      * Remove the session only if it is still the one identified by `generation`.
@@ -1282,8 +1345,10 @@ class WebSessionManager {
             localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
             return true;
         });
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
+        }
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
@@ -4240,7 +4305,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-BNGEBst_.mjs');
+        const { genSolanaMessage } = await import('./solana-message-BO6Dtgbv.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -7599,7 +7664,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-Bc71mTWr.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-CNs5zURZ.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -9099,7 +9164,7 @@ async function setMany(many, options) {
                     if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
                         throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
                     }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-BLbRO1rE.mjs');
+                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-DDt4CzRR.mjs');
                     const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
                     // Signing-only, exactly as on a real chain: signed and NOT committed.
                     if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
@@ -9137,7 +9202,7 @@ async function setMany(many, options) {
                             'Nothing was signed or submitted.');
                     }
                     const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-BLbRO1rE.mjs');
+                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-DDt4CzRR.mjs');
                     // OA-0001: derive the expected intent from OUR OWN request (the one
                     // ground truth a tampered builder response cannot change) so the
                     // validator can reject any transaction whose operation semantics
@@ -10981,7 +11046,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-BNGEBst_.mjs');
+    const implementation = await import('./solana-message-BO6Dtgbv.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11530,5 +11595,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { RATE_LIMIT_EVENT_NAME as $, isWriteNotApplied as A, writeNotAppliedPhase as B, subscribe as C, closeAllSubscriptions as D, clearCache as E, getCachedData as F, reconnectWithNewAuth as G, createClient as H, InsufficientBalanceError as I, exchangeAppToken as J, clearAppTokenCache as K, createAppTokenAuthHeaders as L, AppTokenExchangeError as M, setWithVenueGrant as N, resolveVenueRpcUrl as O, subscribeQuery as P, closeAllQuerySubscriptions as Q, canonicalizeArgs as R, ScopedClientReadOnlyError as S, canonicalizeResult as T, DEFAULT_QUERY_POLL_INTERVAL_MS as U, MIN_QUERY_POLL_INTERVAL_MS as V, BoundedDeclineError as W, deriveDecline as X, dispatchDeclineEvent as Y, DECLINE_EVENT_NAME as Z, dispatchRateLimitEvent as _, getWebhookKeysUrl as a, hasActiveConnection as a0, increment as a1, serverTimestamp as a2, now as a3, toSeconds as a4, toMillis as a5, getIdToken as a6, deriveUserIdentityFromIdToken as a7, getSessionGeneration as a8, WebSessionManager as a9, invoke as aA, FunctionInvokeError as aB, live as aC, intent as aD, status as aE, subscribeView as aF, LiveIntentError as aG, withEffects as aH, isEffectResult as aI, defineLiveModule as aJ, EFFECT_INTENT_ADDRESS as aK, ReactNativeSessionManager as aa, getActiveSessionManager as ab, onSessionCleared as ac, SessionEnvironmentError as ad, UNSUPPORTED_ENVIRONMENT_CODE as ae, AUTH_CHANGED_CODE as af, AUTH_EXPIRED_CODE as ag, isAuthExpiredError as ah, getFreshAuthToken as ai, ServerSessionManager as aj, createSessionWithSignature as ak, refreshSession as al, revokeSession as am, signSessionCreateMessage as an, genAuthNonce as ao, genSolanaMessage as ap, createSolanaSignInRequest as aq, createSolanaSignInMessageText as ar, genSolanaSignInRequest as as, genSolanaSignInMessage as at, browserSignInDomain as au, SOLANA_SIGN_IN_STATEMENT as av, genSiweMessage as aw, normalizeEvmAddress as ax, toLowerEvmAddress as ay, functions as az, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, markWriteNotApplied as m, runQueryMany as n, runExpression as o, runExpressionMany as p, queryAggregate as q, runQuery as r, set as s, signMessage as t, signTransaction as u, signAndSubmitTransaction as v, count as w, aggregate as x, reconcileSetResult as y, waitForSetResult as z };
-//# sourceMappingURL=index-BilGFb3V.mjs.map
+export { RATE_LIMIT_EVENT_NAME as $, isWriteNotApplied as A, writeNotAppliedPhase as B, subscribe as C, closeAllSubscriptions as D, clearCache as E, getCachedData as F, reconnectWithNewAuth as G, createClient as H, InsufficientBalanceError as I, exchangeAppToken as J, clearAppTokenCache as K, createAppTokenAuthHeaders as L, AppTokenExchangeError as M, setWithVenueGrant as N, resolveVenueRpcUrl as O, subscribeQuery as P, closeAllQuerySubscriptions as Q, canonicalizeArgs as R, ScopedClientReadOnlyError as S, canonicalizeResult as T, DEFAULT_QUERY_POLL_INTERVAL_MS as U, MIN_QUERY_POLL_INTERVAL_MS as V, BoundedDeclineError as W, deriveDecline as X, dispatchDeclineEvent as Y, DECLINE_EVENT_NAME as Z, dispatchRateLimitEvent as _, getWebhookKeysUrl as a, hasActiveConnection as a0, increment as a1, serverTimestamp as a2, now as a3, toSeconds as a4, toMillis as a5, getIdToken as a6, deriveUserIdentityFromIdToken as a7, getSessionGeneration as a8, WebSessionManager as a9, normalizeEvmAddress as aA, toLowerEvmAddress as aB, functions as aC, invoke as aD, FunctionInvokeError as aE, live as aF, intent as aG, status as aH, subscribeView as aI, LiveIntentError as aJ, withEffects as aK, isEffectResult as aL, defineLiveModule as aM, EFFECT_INTENT_ADDRESS as aN, ReactNativeSessionManager as aa, getActiveSessionManager as ab, onSessionCleared as ac, announceSessionChange as ad, onSessionChange as ae, SESSION_SIGNAL_CHANNEL as af, SessionEnvironmentError as ag, UNSUPPORTED_ENVIRONMENT_CODE as ah, AUTH_CHANGED_CODE as ai, AUTH_EXPIRED_CODE as aj, isAuthExpiredError as ak, getFreshAuthToken as al, ServerSessionManager as am, createSessionWithSignature as an, refreshSession as ao, revokeSession as ap, signSessionCreateMessage as aq, genAuthNonce as ar, genSolanaMessage as as, createSolanaSignInRequest as at, createSolanaSignInMessageText as au, genSolanaSignInRequest as av, genSolanaSignInMessage as aw, browserSignInDomain as ax, SOLANA_SIGN_IN_STATEMENT as ay, genSiweMessage as az, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, markWriteNotApplied as m, runQueryMany as n, runExpression as o, runExpressionMany as p, queryAggregate as q, runQuery as r, set as s, signMessage as t, signTransaction as u, signAndSubmitTransaction as v, count as w, aggregate as x, reconcileSetResult as y, waitForSetResult as z };
+//# sourceMappingURL=index-Db4lrwO6.mjs.map