@bounded-sh/core 0.0.57 → 0.0.59

package/dist/utils/web-session-manager.d.ts

@@ -1,5 +1,18 @@
+import { type CommitResult, type ExpectedSession } from "./session-mutation";
 export declare class WebSessionManager {
     private static BOUNDED_SESSION_STORAGE_KEY;
+    /** Raw read of the stored blob. Callers inside the lock use this, never a cached copy. */
+    private static readRaw;
+    private static writeRaw;
+    /**
+     * Read the session, stamping a `sessionGeneration` if it predates them.
+     *
+     * Sessions written before generations existed have no lineage marker, so a
+     * later refresh could not prove it descended from them. Minting on read
+     * upgrades them in place; a request already in flight across that mint carries
+     * no generation and fails closed at commit rather than writing unprovably.
+     */
+    static readSessionWithGeneration(): Promise<any | null>;
     /**
      * Decode a base64url-encoded string (used by JWT payloads).
      * Normalises base64url → standard base64 before calling browser atob().
@@ -10,11 +23,39 @@ export declare class WebSessionManager {
         address: string;
         session: any;
     } | null>;
-    static clearSession(): void;
+    /**
+     * Remove the session unconditionally (logout, app-id mismatch, dead refresh).
+     *
+     * ASYNC AND LOCKED, and callers MUST await it. Two failure modes hang on this:
+     *
+     *  - Removing outside the lock lets a refresh that read before the logout write
+     *    the session back afterwards, resurrecting a logged-out session.
+     *  - Not awaiting lets `logout()` return while the credential is still in
+     *    storage, so the very next request authenticates as the user who just left.
+     */
+    static clearSession(): Promise<void>;
+    /**
+     * Remove the session only if it is still the one identified by `generation`.
+     *
+     * Used by every failure path that wants to drop a dead session without
+     * trampling a newer login that landed while the failure was in flight.
+     */
+    static clearSessionIfGeneration(generation: string | null): Promise<void>;
     static isAuthenticated(): boolean;
     static getIdToken(): string | null;
     static getRefreshToken(): string | null;
     /** The issuer base that minted this session (for routing silent refresh). */
     static getIssuer(): string | null;
-    static updateIdTokenAndAccessToken(idToken: string, accessToken: string, refreshToken?: string): Promise<void>;
+    /**
+     * Commit refreshed tokens, bound to the session generation they were minted for.
+     *
+     * Returns WHICH of the four outcomes happened, and the session the caller must
+     * actually use. The old version returned void and silently dropped a refused
+     * write, so `getFreshAuthToken` handed back the refreshed token regardless — a
+     * request could then execute as the previous user while storage and the UI had
+     * already moved to a new one.
+     *
+     * Never hand back `idToken` directly: use `result.session`.
+     */
+    static commitRefreshedTokens(expected: ExpectedSession, idToken: string, accessToken: string, refreshToken?: string): Promise<CommitResult<any>>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-sh/core",
-  "version": "0.0.57",
+  "version": "0.0.59",
   "description": "Shared client, data-plane, and transport primitives for Bounded, the full-stack app builder and runtime for AI-built apps: policy-enforced operations, files, functions, and realtime.",
   "homepage": "https://bounded.sh/docs/sdk",
   "main": "./dist/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "rm -rf ./dist ./.rollup-tmp && tsc -p tsconfig.build.json --outDir .rollup-tmp --declarationDir .rollup-tmp --emitDeclarationOnly false && rollup -c && tsc -p tsconfig.build.json --emitDeclarationOnly --declarationDir dist && rm -rf ./.rollup-tmp",
     "watch": "rollup -c -w",
-    "test": "node src/client/run-config-network-test.mjs && node src/client/run-read-principal-test.mjs && node src/client/run-principal-collision-test.mjs && node src/client/run-abortable-read-test.mjs && node src/utils/run-api-abort-test.mjs && node src/utils/run-api-transient-get-retry-test.mjs && node src/utils/run-auth-api-issuer-switch-test.mjs && node src/utils/run-session-manager-binding-test.mjs && node src/utils/run-server-session-manager-test.mjs && node src/utils/api-refresh-inflight-key.source.test.mjs && node src/client/run-row-shape-test.mjs && node src/client/run-transport-test.mjs && node src/client/run-queries-coalesce-test.mjs && node src/client/run-runexpression-overrides-test.mjs && node src/client/run-subscribe-query-test.mjs && node src/client/subscribe-query-defaults.source.test.mjs && node src/client/run-public-export-surface-test.mjs && node src/client/run-live-auth-test.mjs && node src/client/run-live-view-principal-test.mjs && node src/client/run-subscription-auth-error-test.mjs && node src/client/run-subscription-confirmation-retry-test.mjs && node src/client/subscription-handoff-grace.source.test.mjs && node src/client/run-onchain-validation-test.mjs && node src/client/run-evm-dispatch-test.mjs && node src/utils/evm/run-evm-utils-test.mjs && node src/client/websocket-auth-url.test.mjs && node src/client/run-create-client-http-test.mjs && node src/client/run-create-client-subscribe-test.mjs",
+    "test": "node src/client/run-config-network-test.mjs && node src/client/run-read-principal-test.mjs && node src/client/run-principal-collision-test.mjs && node src/client/run-abortable-read-test.mjs && node src/utils/run-api-abort-test.mjs && node src/utils/run-api-transient-get-retry-test.mjs && node src/utils/run-auth-api-issuer-switch-test.mjs && node src/utils/run-session-manager-binding-test.mjs && node src/utils/run-session-protocol-test.mjs && node src/utils/run-auth-token-freshness-test.mjs && node src/utils/run-api-401-recovery-test.mjs && node src/utils/run-server-session-manager-test.mjs && node src/utils/api-refresh-inflight-key.source.test.mjs && node src/client/run-row-shape-test.mjs && node src/client/run-transport-test.mjs && node src/client/run-queries-coalesce-test.mjs && node src/client/run-runexpression-overrides-test.mjs && node src/client/run-subscribe-query-test.mjs && node src/client/subscribe-query-defaults.source.test.mjs && node src/client/run-public-export-surface-test.mjs && node src/client/run-live-auth-test.mjs && node src/client/run-live-view-principal-test.mjs && node src/client/run-subscription-auth-error-test.mjs && node src/client/run-subscription-confirmation-retry-test.mjs && node src/client/subscription-handoff-grace.source.test.mjs && node src/client/run-onchain-validation-test.mjs && node src/client/run-evm-dispatch-test.mjs && node src/utils/evm/run-evm-utils-test.mjs && node src/client/websocket-auth-url.test.mjs && node src/client/run-create-client-http-test.mjs && node src/client/run-create-client-subscribe-test.mjs",
     "prepare": "npm run build"
   },
   "files": [