@bounded-sh/core 0.0.115 → 0.0.117-sync.0

package/dist/{index-BilGFb3V.mjs → index-l5JPD7_a.mjs}

@@ -824,6 +824,63 @@ function notifySessionCleared() {
     }
 }
 
+// Same-tab session change signal.
+//
+// A page can run more than one copy of the SDK: the app's own bundle and the hosted widget
+// bounded-router injects (which bundles its own, pinned copy). They share one session record in
+// localStorage, keyed by issuer and app id, but the browser fires `storage` events only in OTHER
+// tabs, so a copy that signs in never tells the other copy in the same tab. Until a reload, the
+// app stayed signed out after a widget sign-in and the widget stayed signed out after an app
+// sign-in (observed on staging, 2026-10-07).
+//
+// This announces "the record changed" on a BroadcastChannel, which reaches every other channel
+// on the origin, same tab included, and never the announcing instance itself. The message is a
+// nudge, not an authority: it carries no token and no identity, and a listener only re-reads the
+// record through its ordinary restore path. Nothing signs in or out because of the message alone.
+const SESSION_SIGNAL_CHANNEL = "bounded.session";
+let channel;
+function openChannel() {
+    var _a;
+    if (channel !== undefined)
+        return channel;
+    try {
+        channel = typeof BroadcastChannel === "function" ? new BroadcastChannel(SESSION_SIGNAL_CHANNEL) : null;
+        // Node's BroadcastChannel holds the event loop open until closed; a Node consumer (tests,
+        // tarobase-server) must not hang on exit because of a nudge channel. Browsers have no unref.
+        (_a = channel === null || channel === void 0 ? void 0 : channel.unref) === null || _a === void 0 ? void 0 : _a.call(channel);
+    }
+    catch (_b) {
+        channel = null;
+    }
+    return channel;
+}
+/** Tell the other SDK copies on this origin that the session record under `key` changed. */
+function announceSessionChange(key) {
+    const ch = openChannel();
+    if (!ch)
+        return;
+    try {
+        ch.postMessage({ type: "session-changed", key });
+    }
+    catch (_a) {
+        // A closed or unavailable channel loses the nudge; the record itself is unaffected.
+    }
+}
+/** Run `listener` when another SDK copy announces a session change. Returns the unsubscribe. */
+function onSessionChange(listener) {
+    const ch = openChannel();
+    if (!ch)
+        return () => { };
+    const handler = (event) => {
+        const data = event.data;
+        if (!data || data.type !== "session-changed" || typeof data.key !== "string")
+            return;
+        listener(data.key);
+    };
+    ch.addEventListener("message", handler);
+    return () => ch.removeEventListener("message", handler);
+}
+
 /**
  * The one protocol every session-storage mutation goes through.
  *
@@ -1020,6 +1077,7 @@ class WebSessionManager {
     }
     static writeRaw(sessionObj) {
         localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
     }
     /**
      * Read the session, stamping a `sessionGeneration` if it predates them.
@@ -1116,6 +1174,7 @@ class WebSessionManager {
                 idToken,
                 refreshToken, appId: currentAppId, sessionGeneration: generation }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
         });
+        announceSessionChange(storageKey);
         // Adoption can fail after persistence (for example, logout while the
         // provider is loading). Remove only this incomplete login, even if the
         // caller has since switched app configuration or another tab signed in.
@@ -1127,6 +1186,8 @@ class WebSessionManager {
                 localStorage.removeItem(storageKey);
                 return true;
             });
+            if (removed)
+                announceSessionChange(storageKey);
             if (removed)
                 notifySessionCleared();
         };
@@ -1256,8 +1317,10 @@ class WebSessionManager {
         });
         // Only announce a clear that actually happened, so a no-op cannot sign out
         // a UI that was already signed out.
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(key);
+        }
     }
     /**
      * Remove the session only if it is still the one identified by `generation`.
@@ -1282,8 +1345,10 @@ class WebSessionManager {
             localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
             return true;
         });
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
+        }
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
@@ -4240,7 +4305,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-BNGEBst_.mjs');
+        const { genSolanaMessage } = await import('./solana-message-DXWlEuK5.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4986,6 +5051,7 @@ class BoundedDeclineError extends Error {
 
 const apiClient = axios.create();
 const TRANSIENT_GET_STATUSES = new Set([500, 502, 503, 504]);
+const TRANSIENT_SYNC_STATUSES = new Set([502, 503, 504]);
 const RATE_LIMIT_RETRY_BASE_DELAY_MS = 100;
 /** The window event emitted when the API responds with HTTP 429. */
 const RATE_LIMIT_EVENT_NAME = 'bounded:ratelimit';
@@ -5034,7 +5100,7 @@ function getRateLimitAttempt(error) {
 axiosRetry(apiClient, {
     retries: 2,
     retryCondition: (error) => {
-        var _a, _b, _c, _d, _e, _f, _g, _h;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
         // A caller cancellation is final. In particular, never turn a route
         // unmount into a fresh GET after its AbortSignal has fired.
         const canceled = axios.isCancel(error)
@@ -5050,15 +5116,27 @@ axiosRetry(apiClient, {
         // safe for every method, including POST requests to the queries API.
         if (((_d = error.response) === null || _d === void 0 ? void 0 : _d.status) === 429)
             return true;
-        // Only retry idempotent GETs. Network failures and the small set of
-        // conventional transient gateway/runtime statuses get two bounded
-        // retries; auth, policy, invariant, and other terminal responses stay final.
-        // Writes are never retried because the server may already have applied
-        // them before the response was lost.
-        if (((_f = (_e = error.config) === null || _e === void 0 ? void 0 : _e.method) === null || _f === void 0 ? void 0 : _f.toLowerCase()) !== 'get')
+        // Sync only indexes existing chain state, so repeating it cannot submit
+        // a second transaction. Keep its retries in this same bounded transport
+        // loop instead of multiplying them with another SDK retry loop.
+        const method = (_f = (_e = error.config) === null || _e === void 0 ? void 0 : _e.method) === null || _f === void 0 ? void 0 : _f.toLowerCase();
+        let isSync = false;
+        if (method === 'put') {
+            try {
+                isSync = new URL(String((_g = error.config) === null || _g === void 0 ? void 0 : _g.url)).pathname === '/items/sync';
+            }
+            catch ( /* An unrecognized URL is never safe to retry. */_m) { /* An unrecognized URL is never safe to retry. */ }
+        }
+        if (isSync) {
+            return axiosRetry.isNetworkError(error)
+                || TRANSIENT_SYNC_STATUSES.has((_j = (_h = error.response) === null || _h === void 0 ? void 0 : _h.status) !== null && _j !== void 0 ? _j : 0);
+        }
+        // Ordinary writes are never retried: a lost response may follow commit.
+        // GET network and selected gateway/runtime failures are safe to repeat.
+        if (method !== 'get')
             return false;
         return axiosRetry.isNetworkError(error)
-            || TRANSIENT_GET_STATUSES.has((_h = (_g = error.response) === null || _g === void 0 ? void 0 : _g.status) !== null && _h !== void 0 ? _h : 0);
+            || TRANSIENT_GET_STATUSES.has((_l = (_k = error.response) === null || _k === void 0 ? void 0 : _k.status) !== null && _l !== void 0 ? _l : 0);
     },
     retryDelay: (retryCount, error) => {
         var _a;
@@ -7599,7 +7677,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-Bc71mTWr.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-CofPUMMC.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8785,12 +8863,6 @@ async function runExpressionMany(many) {
     }
 }
 /* ===================== WRITE RECEIPT HELPERS (W4) ======================== */
-/**
- * Settle delay before the best-effort mirror read on an on-chain write. It is
- * an optimization, not a correctness guarantee: the receipt is captured first
- * and returned regardless of what the mirror read reports.
- */
-const MIRROR_SYNC_SETTLE_MS = 1500;
 const SOLANA_CHAIN_TAGS = new Set(['solana_devnet', 'solana_mainnet']);
 /**
  * Read the execution-lane tag the WORKER reported. The SDK never infers it: a
@@ -8865,16 +8937,14 @@ function validatePathKeyedDocuments(paths, source) {
     return { observed: true, documents };
 }
 /**
- * Best-effort mirror read. A confirmed transaction must NEVER be lost to a
+ * Best-effort chain synchronization. A confirmed transaction must NEVER be lost to a
  * synchronization failure, so this reports its outcome in `mirrorSync` and
- * never rejects. It reads the CONCRETE destination paths, so a collection
- * insert with a generated id syncs the path that actually exists.
+ * never rejects. The signature lets the server index the exact transaction,
+ * including hook-mutated documents beyond the requested destination paths.
  */
-async function attemptMirrorSync(paths, options, settleMs = MIRROR_SYNC_SETTLE_MS) {
+async function attemptMirrorSync(paths, options, transactionSignature) {
     try {
-        if (settleMs > 0)
-            await new Promise(resolve => setTimeout(resolve, settleMs));
-        const synced = await syncItems(paths, options);
+        const synced = await syncItems(paths, options, transactionSignature);
         // The sync endpoint answers `{ data: <path-keyed map>, status }`; a document
         // path always contains a `/`, so a top-level `data` key is never one.
         const map = (synced && typeof synced === 'object' && !Array.isArray(synced) && 'data' in synced)
@@ -9099,7 +9169,7 @@ async function setMany(many, options) {
                     if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
                         throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
                     }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-BLbRO1rE.mjs');
+                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-CuWKt_pG.mjs');
                     const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
                     // Signing-only, exactly as on a real chain: signed and NOT committed.
                     if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
@@ -9137,7 +9207,7 @@ async function setMany(many, options) {
                             'Nothing was signed or submitted.');
                     }
                     const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-BLbRO1rE.mjs');
+                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-CuWKt_pG.mjs');
                     // OA-0001: derive the expected intent from OUR OWN request (the one
                     // ground truth a tampered builder response cannot change) so the
                     // validator can reject any transaction whose operation semantics
@@ -9178,7 +9248,7 @@ async function setMany(many, options) {
                     // best-effort enrichment reported in `mirrorSync`, never a rejection.
                     const mirrorSync = grantLane
                         ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
-                        : await attemptMirrorSync(requestedPaths, options);
+                        : await attemptMirrorSync(requestedPaths, Object.assign(Object.assign({}, options), { _overrides: Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _config: config }) }), solanaOutcome.transactionSignature);
                     return {
                         status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
                         transactionId: solanaOutcome.transactionSignature,
@@ -9450,14 +9520,18 @@ async function signAndSubmitTransaction(transaction, feePayer) {
     }
     return config.authProvider.signAndSubmitTransaction(transaction, feePayer);
 }
-async function syncItems(paths, options) {
-    try {
-        const response = await makeApiRequest('PUT', 'items/sync', { paths }, options === null || options === void 0 ? void 0 : options._overrides);
-        return response.data;
-    }
-    catch (error) {
-        throw error;
+/** Refresh concrete paths, or index a confirmed transaction and read its requested paths. */
+async function syncItems(paths, options, transactionSignature) {
+    var _a, _b;
+    const response = await makeApiRequest('PUT', 'items/sync', Object.assign({ paths }, (transactionSignature !== undefined ? { transactionSignature } : {})), options === null || options === void 0 ? void 0 : options._overrides);
+    if (transactionSignature !== undefined && (response.status !== 200
+        || ((_a = response.data) === null || _a === void 0 ? void 0 : _a.synchronized) !== true
+        || ((_b = response.data) === null || _b === void 0 ? void 0 : _b.transactionSignature) !== transactionSignature)) {
+        // An older server's local-read stub can return 200 with stale documents.
+        // Only the matching server acknowledgment proves this transaction was indexed.
+        throw new Error('the synchronization response did not acknowledge the confirmed transaction');
     }
+    return response.data;
 }
 
 var operations = /*#__PURE__*/Object.freeze({
@@ -9490,8 +9564,6 @@ var operations = /*#__PURE__*/Object.freeze({
 const DEFAULT_TIMEOUT_MS = 60000;
 const DEFAULT_MAX_ATTEMPTS$1 = 20;
 const DEFAULT_POLL_INTERVAL_MS = 3000;
-/** Mirror read after a late confirmation. No settle delay: the tx already landed. */
-const RECONCILE_MIRROR_SETTLE_MS = 0;
 function errorText(error) {
     const message = error === null || error === void 0 ? void 0 : error.message;
     return typeof message === 'string' && message.length > 0 ? message : String(error);
@@ -9540,12 +9612,12 @@ function assertReceiptMatchesContext(receipt, config) {
 function stillSubmitted(receipt, reason) {
     return Object.assign(Object.assign({}, receipt), { confirmation: Object.assign(Object.assign({}, receipt.confirmation), { reason }) });
 }
-async function mirrorFor(receipt, options) {
+async function mirrorFor(receipt, config, options) {
     const paths = receipt.requestedDocuments.map(entry => entry.path);
     if (paths.length === 0)
         return { observed: false, reason: 'the receipt carried no requested paths' };
-    const setOptions = (options === null || options === void 0 ? void 0 : options._overrides) ? { _overrides: options._overrides } : undefined;
-    return attemptMirrorSync(paths, setOptions, RECONCILE_MIRROR_SETTLE_MS);
+    const setOptions = { _overrides: Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _config: config }) };
+    return attemptMirrorSync(paths, setOptions, receipt.transactionId);
 }
 async function resolveSolanaRpc(config, options) {
     var _a, _b;
@@ -9627,7 +9699,7 @@ async function reconcileSolana(receipt, config, options) {
             signedTransaction: receipt.signedTransaction,
             fence: receipt.fence,
             confirmationContextSlot: typeof statusValue.slot === 'number' ? statusValue.slot : (contextSlot !== null && contextSlot !== void 0 ? contextSlot : 0),
-            mirrorSync: await mirrorFor(receipt, options),
+            mirrorSync: await mirrorFor(receipt, config, options),
         };
         return confirmed;
     }
@@ -10981,7 +11053,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-BNGEBst_.mjs');
+    const implementation = await import('./solana-message-DXWlEuK5.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11530,5 +11602,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { RATE_LIMIT_EVENT_NAME as $, isWriteNotApplied as A, writeNotAppliedPhase as B, subscribe as C, closeAllSubscriptions as D, clearCache as E, getCachedData as F, reconnectWithNewAuth as G, createClient as H, InsufficientBalanceError as I, exchangeAppToken as J, clearAppTokenCache as K, createAppTokenAuthHeaders as L, AppTokenExchangeError as M, setWithVenueGrant as N, resolveVenueRpcUrl as O, subscribeQuery as P, closeAllQuerySubscriptions as Q, canonicalizeArgs as R, ScopedClientReadOnlyError as S, canonicalizeResult as T, DEFAULT_QUERY_POLL_INTERVAL_MS as U, MIN_QUERY_POLL_INTERVAL_MS as V, BoundedDeclineError as W, deriveDecline as X, dispatchDeclineEvent as Y, DECLINE_EVENT_NAME as Z, dispatchRateLimitEvent as _, getWebhookKeysUrl as a, hasActiveConnection as a0, increment as a1, serverTimestamp as a2, now as a3, toSeconds as a4, toMillis as a5, getIdToken as a6, deriveUserIdentityFromIdToken as a7, getSessionGeneration as a8, WebSessionManager as a9, invoke as aA, FunctionInvokeError as aB, live as aC, intent as aD, status as aE, subscribeView as aF, LiveIntentError as aG, withEffects as aH, isEffectResult as aI, defineLiveModule as aJ, EFFECT_INTENT_ADDRESS as aK, ReactNativeSessionManager as aa, getActiveSessionManager as ab, onSessionCleared as ac, SessionEnvironmentError as ad, UNSUPPORTED_ENVIRONMENT_CODE as ae, AUTH_CHANGED_CODE as af, AUTH_EXPIRED_CODE as ag, isAuthExpiredError as ah, getFreshAuthToken as ai, ServerSessionManager as aj, createSessionWithSignature as ak, refreshSession as al, revokeSession as am, signSessionCreateMessage as an, genAuthNonce as ao, genSolanaMessage as ap, createSolanaSignInRequest as aq, createSolanaSignInMessageText as ar, genSolanaSignInRequest as as, genSolanaSignInMessage as at, browserSignInDomain as au, SOLANA_SIGN_IN_STATEMENT as av, genSiweMessage as aw, normalizeEvmAddress as ax, toLowerEvmAddress as ay, functions as az, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, markWriteNotApplied as m, runQueryMany as n, runExpression as o, runExpressionMany as p, queryAggregate as q, runQuery as r, set as s, signMessage as t, signTransaction as u, signAndSubmitTransaction as v, count as w, aggregate as x, reconcileSetResult as y, waitForSetResult as z };
-//# sourceMappingURL=index-BilGFb3V.mjs.map
+export { RATE_LIMIT_EVENT_NAME as $, isWriteNotApplied as A, writeNotAppliedPhase as B, subscribe as C, closeAllSubscriptions as D, clearCache as E, getCachedData as F, reconnectWithNewAuth as G, createClient as H, InsufficientBalanceError as I, exchangeAppToken as J, clearAppTokenCache as K, createAppTokenAuthHeaders as L, AppTokenExchangeError as M, setWithVenueGrant as N, resolveVenueRpcUrl as O, subscribeQuery as P, closeAllQuerySubscriptions as Q, canonicalizeArgs as R, ScopedClientReadOnlyError as S, canonicalizeResult as T, DEFAULT_QUERY_POLL_INTERVAL_MS as U, MIN_QUERY_POLL_INTERVAL_MS as V, BoundedDeclineError as W, deriveDecline as X, dispatchDeclineEvent as Y, DECLINE_EVENT_NAME as Z, dispatchRateLimitEvent as _, getWebhookKeysUrl as a, hasActiveConnection as a0, increment as a1, serverTimestamp as a2, now as a3, toSeconds as a4, toMillis as a5, getIdToken as a6, deriveUserIdentityFromIdToken as a7, getSessionGeneration as a8, WebSessionManager as a9, normalizeEvmAddress as aA, toLowerEvmAddress as aB, functions as aC, invoke as aD, FunctionInvokeError as aE, live as aF, intent as aG, status as aH, subscribeView as aI, LiveIntentError as aJ, withEffects as aK, isEffectResult as aL, defineLiveModule as aM, EFFECT_INTENT_ADDRESS as aN, ReactNativeSessionManager as aa, getActiveSessionManager as ab, onSessionCleared as ac, announceSessionChange as ad, onSessionChange as ae, SESSION_SIGNAL_CHANNEL as af, SessionEnvironmentError as ag, UNSUPPORTED_ENVIRONMENT_CODE as ah, AUTH_CHANGED_CODE as ai, AUTH_EXPIRED_CODE as aj, isAuthExpiredError as ak, getFreshAuthToken as al, ServerSessionManager as am, createSessionWithSignature as an, refreshSession as ao, revokeSession as ap, signSessionCreateMessage as aq, genAuthNonce as ar, genSolanaMessage as as, createSolanaSignInRequest as at, createSolanaSignInMessageText as au, genSolanaSignInRequest as av, genSolanaSignInMessage as aw, browserSignInDomain as ax, SOLANA_SIGN_IN_STATEMENT as ay, genSiweMessage as az, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, markWriteNotApplied as m, runQueryMany as n, runExpression as o, runExpressionMany as p, queryAggregate as q, runQuery as r, set as s, signMessage as t, signTransaction as u, signAndSubmitTransaction as v, count as w, aggregate as x, reconcileSetResult as y, waitForSetResult as z };
+//# sourceMappingURL=index-l5JPD7_a.mjs.map