@bounded-sh/core 0.0.58 → 0.0.60

package/dist/{index-B30-XpaX.js → index-BIdD2yUB.js}

@@ -2909,19 +2909,19 @@ async function createSessionWithSignature(address, message, signature, authMetho
 // Note: module-level state is shared across requests in SSR/Node — acceptable
 // since there is only one active session per server instance (same pattern as
 // refreshInFlight in api.ts).
-let refreshInFlight$1 = null;
+let refreshInFlight = null;
 let refreshInFlightToken = null;
 async function refreshSession(refreshToken, issuer) {
     // Dedupe per (issuer, token): the rotating token is single-use, so two
     // concurrent refreshes of the SAME token must share one in-flight request or
     // the second would look like reuse and revoke the family.
     const dedupeKey = `${issuer || ''}::${refreshToken}`;
-    if (refreshInFlight$1 && refreshInFlightToken === dedupeKey) {
-        return refreshInFlight$1;
+    if (refreshInFlight && refreshInFlightToken === dedupeKey) {
+        return refreshInFlight;
     }
     refreshInFlightToken = dedupeKey;
     let currentFlight;
-    currentFlight = refreshInFlight$1 = (async () => {
+    currentFlight = refreshInFlight = (async () => {
         try {
             const config = await getConfig();
             const appId = config.appId;
@@ -2938,13 +2938,13 @@ async function refreshSession(refreshToken, issuer) {
         finally {
             // Only clear if we're still the active in-flight request.
             // A second call with a different token may have replaced us.
-            if (refreshInFlight$1 === currentFlight) {
-                refreshInFlight$1 = null;
+            if (refreshInFlight === currentFlight) {
+                refreshInFlight = null;
                 refreshInFlightToken = null;
             }
         }
     })();
-    return refreshInFlight$1;
+    return refreshInFlight;
 }
 class SessionRevokeError extends Error {
     constructor(message, cause) {
@@ -3029,7 +3029,248 @@ function refreshedTokenMayReplaceStored(newIdToken, storedAddress, decodeBase64U
     return tokenWallet === storedAddress;
 }
 
+/**
+ * The one signal core sends upward when a stored session stops existing.
+ *
+ * `tarobase-core` cannot import `js-sdk` (that would be a cycle), and core has no
+ * event bus, so a session dying inside a session manager used to be invisible to
+ * the SDK: `setCurrentUser(null)` was only ever called by `logout()` and `init()`.
+ * The result was a UI that kept showing a connected wallet long after the session
+ * it was showing had been wiped, which is exactly what let the Solana lab freeze a
+ * review against a wallet the server no longer knew about.
+ *
+ * `js-sdk` registers a handler at init; core fires it ONLY when storage was
+ * actually cleared, never on a failed-but-preserved refresh. Firing on a
+ * preserved session would log people out on a transient network blip.
+ */
+let handlers = [];
+/**
+ * Register a listener for "the stored session is gone".
+ * Returns an unsubscribe function.
+ */
+function onSessionCleared(handler) {
+    handlers.push(handler);
+    return () => {
+        handlers = handlers.filter((h) => h !== handler);
+    };
+}
+/**
+ * Announce that session storage was cleared.
+ *
+ * Call this ONLY after a removal actually happened. Handlers are best-effort: a
+ * throwing listener must not turn a successful clear into a failed one, because
+ * the storage mutation has already committed by this point.
+ */
+function notifySessionCleared() {
+    for (const handler of handlers) {
+        try {
+            handler();
+        }
+        catch (_a) {
+            // A listener's failure cannot un-clear storage; keep notifying the rest.
+        }
+    }
+}
+
+/**
+ * The one protocol every session-storage mutation goes through.
+ *
+ * WHY THIS EXISTS
+ *
+ * `localStorage` is shared by every tab on an origin but offers no atomic
+ * compare-and-set spanning a read and a write, and each tab is a separate JS
+ * realm, so an in-memory guard cannot serialize them. The old code relied on
+ * doing its read → check → write inside one synchronous turn, which is only
+ * atomic *within* a realm.
+ *
+ * That is not a theoretical gap. `REFRESH_REUSE_GRACE_MS` on the issuer is 60s,
+ * so two tabs presenting the same refresh token inside that window BOTH succeed
+ * and BOTH receive the same successor refresh token — while each response mints
+ * its own distinct idToken. Concurrent cross-tab commits are a designed-for
+ * occurrence, not an edge case.
+ *
+ * Two failures follow from an unlocked read-then-write, and both are closed here:
+ *
+ *   1. Lost update / resurrection. Tab A reads, tab B logs in (or logs out), tab A
+ *      writes its stale blob back. B's login is silently replaced, or a logged-out
+ *      session comes back to life.
+ *   2. Spurious "the user changed". Tab B's commit finds tab A's blob, which
+ *      matches neither B's snapshot nor B's own result because the idTokens
+ *      differ — even though it is the same user and the same login.
+ *
+ * THE CRITICAL SECTION IS THE COMMIT, NOT THE NETWORK CALL
+ *
+ * The lock covers read → compare → write only. The refresh POST happens outside
+ * it: holding a cross-tab lock across a 30s network call would serialize every
+ * tab behind the slowest one. This is safe because the snapshot captured before
+ * the network call is used only for COMPARISON. What actually gets written is
+ * decided against storage re-read inside the lock, so a login or logout that lands
+ * during the network call is always observed.
+ *
+ * NO BEST-EFFORT FALLBACK
+ *
+ * A `localStorage` lease was considered and rejected: its own acquire sequence is
+ * a non-atomic read-then-write across realms, and a backgrounded tab can be frozen
+ * past any lease timeout and then resume and write. Both leave exactly the windows
+ * this module exists to close, so a browser without Web Locks fails closed instead.
+ * Absence of `navigator.locks` does NOT imply a single realm — such a browser still
+ * has tabs. Single realm is determined by the absence of `localStorage`.
+ */
+const SESSION_LOCK_NAME = "bounded_session_mutation";
+const UNSUPPORTED_ENVIRONMENT_CODE = "unsupported_environment";
+/**
+ * Thrown when authenticated session work is attempted in a browser that shares
+ * `localStorage` across tabs but cannot serialize access to it. Reads and
+ * anonymous requests are unaffected; only session mutation is refused.
+ */
+class SessionEnvironmentError extends Error {
+    constructor(message) {
+        super(message);
+        this.code = UNSUPPORTED_ENVIRONMENT_CODE;
+        this.name = "SessionEnvironmentError";
+    }
+}
+/**
+ * True when nothing outside this realm can touch session storage.
+ *
+ * Keyed on `localStorage`, not on `window`: React Native defines `window` but
+ * stores sessions through a per-process StorageAdapter, and Node/SSR has neither.
+ * A browser is the only multi-realm case, and `localStorage` is what makes it one.
+ */
+function isSingleRealm() {
+    return typeof localStorage === "undefined";
+}
+function hasWebLocks() {
+    var _a;
+    return typeof navigator !== "undefined"
+        && typeof ((_a = navigator.locks) === null || _a === void 0 ? void 0 : _a.request) === "function";
+}
+/**
+ * Run `fn` with exclusive access to session storage across every tab on this origin.
+ *
+ * Single-realm runtimes execute directly. Browsers serialize through Web Locks.
+ * A browser without Web Locks throws rather than running unserialized.
+ */
+async function withSessionLock(fn) {
+    if (isSingleRealm()) {
+        return await fn();
+    }
+    if (!hasWebLocks()) {
+        throw new SessionEnvironmentError("This browser cannot safely coordinate a Bounded session across tabs " +
+            "(the Web Locks API is unavailable). Authenticated operations are disabled; " +
+            "anonymous reads still work.");
+    }
+    return await navigator.locks.request(SESSION_LOCK_NAME, { mode: "exclusive" }, async () => await fn());
+}
+/**
+ * Opaque per-login identifier stamped into the stored session.
+ *
+ * Minted on every `storeSession` (login, guest upgrade, wallet switch) and
+ * PRESERVED across refresh commits. That is the whole point: it is what makes
+ * "S1 refreshed into S1'" provable and distinguishable from "someone logged in
+ * again", which token equality and address equality both get wrong — token
+ * equality rejects a valid post-refresh retry, and address equality accepts a
+ * same-wallet re-login as if it were the same session.
+ *
+ * The issuer has a server-side `familyId` that would serve, but `/session/refresh`
+ * does not return it, so this is client-side.
+ */
+function mintSessionGeneration() {
+    const c = typeof crypto !== "undefined" ? crypto : undefined;
+    if (typeof (c === null || c === void 0 ? void 0 : c.randomUUID) === "function")
+        return c.randomUUID();
+    if (typeof (c === null || c === void 0 ? void 0 : c.getRandomValues) === "function") {
+        const bytes = c.getRandomValues(new Uint8Array(16));
+        return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+    }
+    // Last resort only; every runtime the SDK targets provides one of the above.
+    return `g${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
+}
+/**
+ * Decide a commit against what storage ACTUALLY holds right now.
+ *
+ * Must be called inside `withSessionLock`, with `current` read inside that same
+ * critical section — comparing against a value read before the network call is
+ * exactly the race this exists to prevent.
+ */
+function decideCommit(current, expected, next) {
+    var _a;
+    // Absence is SUPERSEDED, never "free to write". A logout that lands between a
+    // refresh's read and its write must not be undone by that write. This is the
+    // backstop that makes session resurrection impossible.
+    if (!current)
+        return "superseded";
+    // A caller with no captured generation cannot prove lineage, so it must not
+    // write. Reads mint a generation for legacy sessions before returning them, so
+    // in practice this only catches a request that was in flight across that
+    // upgrade. Fail closed: the caller retries and gets a provable session.
+    if (expected.generation === null)
+        return "superseded";
+    // A different generation means a different LOGIN, which the address-based guard
+    // cannot see when the same wallet signs in again.
+    if (((_a = current.sessionGeneration) !== null && _a !== void 0 ? _a : null) !== expected.generation) {
+        return "superseded";
+    }
+    if (current.idToken === next.idToken && current.refreshToken === next.refreshToken) {
+        return "already-equal";
+    }
+    // Storage is exactly what this caller read before it went to the network, so
+    // nothing has moved underneath and this write is the legitimate one.
+    if (expected.idToken === undefined || current.idToken === expected.idToken) {
+        return "applied";
+    }
+    // Same login, but storage has moved on: another caller's refresh of this same
+    // session already landed. Theirs is the current truth — its rotated refresh
+    // token is the live one — so defer rather than overwrite. Reporting a principal
+    // change here would fail ordinary concurrent requests at expiry, which is the
+    // common case, not a rare one.
+    return "same-generation-winner";
+}
+
 class WebSessionManager {
+    /** Raw read of the stored blob. Callers inside the lock use this, never a cached copy. */
+    static readRaw() {
+        if (typeof window === "undefined")
+            return null;
+        const raw = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+        if (!raw)
+            return null;
+        try {
+            return JSON.parse(raw);
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    static writeRaw(sessionObj) {
+        localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+    }
+    /**
+     * Read the session, stamping a `sessionGeneration` if it predates them.
+     *
+     * Sessions written before generations existed have no lineage marker, so a
+     * later refresh could not prove it descended from them. Minting on read
+     * upgrades them in place; a request already in flight across that mint carries
+     * no generation and fails closed at commit rather than writing unprovably.
+     */
+    static async readSessionWithGeneration() {
+        const existing = this.readRaw();
+        if (!existing)
+            return null;
+        if (existing.sessionGeneration)
+            return existing;
+        return await withSessionLock(() => {
+            // Re-read inside the lock: another tab may have minted one already.
+            const current = this.readRaw();
+            if (!current)
+                return null;
+            if (current.sessionGeneration)
+                return current;
+            const upgraded = Object.assign(Object.assign({}, current), { sessionGeneration: mintSessionGeneration() });
+            this.writeRaw(upgraded);
+            return upgraded;
+        });
+    }
     /**
      * Decode a base64url-encoded string (used by JWT payloads).
      * Normalises base64url → standard base64 before calling browser atob().
@@ -3078,28 +3319,38 @@ class WebSessionManager {
         // the RIGHT /session/refresh. Email overrides with humanAuthApiUrl; all
         // wallet/guest/signature flows default to authApiUrl (the bounded-auth issuer).
         const sessionIssuer = (issuer || config.authApiUrl || "").replace(/\/$/, "");
-        localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(Object.assign({ address,
-            accessToken,
-            idToken,
-            refreshToken, appId: currentAppId }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
+        // A login always starts a NEW generation. Refresh commits preserve it, so
+        // "same generation" means "same login", which is what lets a post-refresh
+        // retry be told apart from a re-login by the same wallet.
+        await withSessionLock(() => {
+            this.writeRaw(Object.assign({ address,
+                accessToken,
+                idToken,
+                refreshToken, appId: currentAppId, sessionGeneration: mintSessionGeneration() }, (sessionIssuer ? { issuer: sessionIssuer } : {})));
+        });
     }
     /* ------------------------------------------------------------------ */
     /* GET                                                                */
     /* ------------------------------------------------------------------ */
     static async getSession() {
+        var _a;
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        if (!session)
+        const sessionObj = await this.readSessionWithGeneration();
+        if (!sessionObj)
             return null;
-        const sessionObj = JSON.parse(session);
+        const generation = (_a = sessionObj.sessionGeneration) !== null && _a !== void 0 ? _a : null;
         /* ---------- validate app-id ---------- */
         const config = await getConfig();
         if (sessionObj.appId && sessionObj.appId !== config.appId) {
-            this.clearSession();
+            await this.clearSessionIfGeneration(generation);
             return null;
         }
         /* ---------- check JWT expiration ---------- */
+        // Deliberately NO skew buffer here, unlike the per-request freshness helper.
+        // This is the restore path: at boot a token already past `exp` is unusable
+        // either way, so clearing it is honest. Preserving it would only make
+        // isAuthenticated() lie about a session that cannot authenticate anything.
         try {
             // Check expiry on the ID TOKEN — it is ALWAYS a JWT. The OIDC access_token for
             // email/social (hosted) logins is an OPAQUE string (not a JWT), so decoding IT
@@ -3113,29 +3364,39 @@ class WebSessionManager {
                 // (mirrors the refresh-failed branch below) so isAuthenticated()
                 // does not stay true and every request does not 401 + retry forever.
                 if (!refreshToken) {
-                    this.clearSession();
+                    await this.clearSessionIfGeneration(generation);
                     return null;
                 }
                 const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
-                    await this.updateIdTokenAndAccessToken(refreshed.idToken, refreshed.accessToken, 
+                    const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, 
                     // Persist the ROTATED refresh token — the old one is now
                     // single-use spent; reusing it would revoke the family.
                     refreshed.refreshToken);
-                    const newSession = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-                    if (!newSession)
+                    // Superseded means a login or logout landed while we were on the
+                    // network. Returning our own stale null here would sign the UI out
+                    // of a session that is now perfectly valid, because init() applies
+                    // whatever restoreSession() returns. Re-read once and report THAT.
+                    if (committed.outcome === "superseded") {
+                        const current = this.readRaw();
+                        if (!current)
+                            return null;
+                        return { address: current.address, session: current };
+                    }
+                    const newObj = committed.session;
+                    if (!newObj)
                         return null;
-                    const newObj = JSON.parse(newSession);
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops
-                this.clearSession();
+                // Refresh failed — clear stale session to prevent retry loops, but only
+                // if it is still the session we set out to refresh.
+                await this.clearSessionIfGeneration(generation);
                 return null;
             }
         }
         catch (err) {
             // Token decode or refresh failed — clear stale session to prevent retry loops
-            this.clearSession();
+            await this.clearSessionIfGeneration(generation);
             return null;
         }
         return { address: sessionObj.address, session: sessionObj };
@@ -3143,10 +3404,55 @@ class WebSessionManager {
     /* ------------------------------------------------------------------ */
     /* CLEAR                                                              */
     /* ------------------------------------------------------------------ */
-    static clearSession() {
+    /**
+     * Remove the session unconditionally (logout, app-id mismatch, dead refresh).
+     *
+     * ASYNC AND LOCKED, and callers MUST await it. Two failure modes hang on this:
+     *
+     *  - Removing outside the lock lets a refresh that read before the logout write
+     *    the session back afterwards, resurrecting a logged-out session.
+     *  - Not awaiting lets `logout()` return while the credential is still in
+     *    storage, so the very next request authenticates as the user who just left.
+     */
+    static async clearSession() {
+        if (typeof window === "undefined")
+            return;
+        const removed = await withSessionLock(() => {
+            if (localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY) === null)
+                return false;
+            localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return true;
+        });
+        // Only announce a clear that actually happened, so a no-op cannot sign out
+        // a UI that was already signed out.
+        if (removed)
+            notifySessionCleared();
+    }
+    /**
+     * Remove the session only if it is still the one identified by `generation`.
+     *
+     * Used by every failure path that wants to drop a dead session without
+     * trampling a newer login that landed while the failure was in flight.
+     */
+    static async clearSessionIfGeneration(generation) {
         if (typeof window === "undefined")
             return;
-        localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+        const removed = await withSessionLock(() => {
+            var _a;
+            const current = this.readRaw();
+            if (!current)
+                return false;
+            // No captured generation means no proof this is the session we meant to
+            // drop. Leave it alone rather than risk removing a replacement.
+            if (generation === null)
+                return false;
+            if (((_a = current.sessionGeneration) !== null && _a !== void 0 ? _a : null) !== generation)
+                return false;
+            localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return true;
+        });
+        if (removed)
+            notifySessionCleared();
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
@@ -3181,39 +3487,63 @@ class WebSessionManager {
     /* ------------------------------------------------------------------ */
     /* UPDATE TOKENS                                                      */
     /* ------------------------------------------------------------------ */
-    static async updateIdTokenAndAccessToken(idToken, accessToken, refreshToken) {
-        var _a;
+    /**
+     * Commit refreshed tokens, bound to the session generation they were minted for.
+     *
+     * Returns WHICH of the four outcomes happened, and the session the caller must
+     * actually use. The old version returned void and silently dropped a refused
+     * write, so `getFreshAuthToken` handed back the refreshed token regardless — a
+     * request could then execute as the previous user while storage and the UI had
+     * already moved to a new one.
+     *
+     * Never hand back `idToken` directly: use `result.session`.
+     */
+    static async commitRefreshedTokens(expected, idToken, accessToken, refreshToken) {
         if (typeof window === "undefined")
-            return;
-        // Resolve config FIRST so the read → check → write below is one synchronous
-        // turn (an atomic CAS): no `await` can let a concurrent login interleave a
-        // different session between the read and the write (#221).
+            return { outcome: "superseded", session: null };
+        // Resolve config BEFORE taking the lock: no awaits are allowed inside the
+        // critical section, or another realm could interleave between read and write.
         const config = await getConfig();
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        if (!session)
-            return;
-        const sessionObj = JSON.parse(session);
-        /* ---------- app-id guard ---------- */
-        if (sessionObj.appId && sessionObj.appId !== config.appId) {
-            this.clearSession();
-            return;
-        }
-        /* ---------- cross-principal guard (#221) ---------- */
-        // Refuse to graft a refreshed token onto a DIFFERENT user's stored session
-        // (a stale refresh completing after a login/upgrade replaced storage, incl.
-        // a cross-tab login). Also re-runs the wallet-binding check storeSession does.
-        if (!refreshedTokenMayReplaceStored(idToken, sessionObj.address, (s) => this.decodeBase64Url(s))) {
-            console.warn("[WebSessionManager] updateIdTokenAndAccessToken: refreshed token wallet does not match the stored session address — discarding stale refresh");
-            return;
-        }
-        sessionObj.idToken = idToken;
-        sessionObj.accessToken = accessToken;
-        // Persist the rotated refresh token when the issuer returns a new one.
-        if (typeof refreshToken === "string" && refreshToken.length > 0) {
-            sessionObj.refreshToken = refreshToken;
-        }
-        (_a = sessionObj.appId) !== null && _a !== void 0 ? _a : (sessionObj.appId = config.appId);
-        localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        const result = await withSessionLock(() => {
+            var _a;
+            // Read INSIDE the lock. The snapshot the caller captured before its
+            // network refresh is only a comparison key; what gets written is decided
+            // against what storage holds right now.
+            const current = this.readRaw();
+            /* ---------- app-id guard ---------- */
+            if ((current === null || current === void 0 ? void 0 : current.appId) && current.appId !== config.appId) {
+                localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+                return { outcome: "superseded", session: null, cleared: true };
+            }
+            const next = Object.assign(Object.assign(Object.assign({}, (current !== null && current !== void 0 ? current : {})), { idToken,
+                accessToken }), (typeof refreshToken === "string" && refreshToken.length > 0
+                ? { refreshToken }
+                : {}));
+            const outcome = decideCommit(current, expected, next);
+            if (outcome === "superseded")
+                return { outcome, session: null };
+            // Another caller's refresh of this same login already landed. Theirs is
+            // the truth; reporting a principal change here would fail every ordinary
+            // concurrent request at expiry, which is the common case.
+            if (outcome === "same-generation-winner")
+                return { outcome, session: current };
+            if (outcome === "already-equal")
+                return { outcome, session: current };
+            /* ---------- cross-principal guard (#221) ---------- */
+            // Belt-and-braces alongside the generation check: refuse to graft a
+            // refreshed token onto a DIFFERENT wallet's stored session. Generations
+            // catch a same-wallet re-login, which this address check cannot.
+            if (!refreshedTokenMayReplaceStored(idToken, current.address, (s) => this.decodeBase64Url(s))) {
+                console.warn("[WebSessionManager] commitRefreshedTokens: refreshed token wallet does not match the stored session address — discarding stale refresh");
+                return { outcome: "superseded", session: null };
+            }
+            (_a = next.appId) !== null && _a !== void 0 ? _a : (next.appId = config.appId);
+            this.writeRaw(next);
+            return { outcome, session: next };
+        });
+        if (result.cleared)
+            notifySessionCleared();
+        return { outcome: result.outcome, session: result.session };
     }
 }
 WebSessionManager.BOUNDED_SESSION_STORAGE_KEY = "bounded_session_storage";
@@ -3310,26 +3640,65 @@ class ReactNativeSessionManager {
         // Issuer base for silent refresh (email overrides w/ humanAuthApiUrl; wallet/
         // guest default to authApiUrl). See WebSessionManager for the rationale.
         const sessionIssuer = (issuer || config.authApiUrl || "").replace(/\/$/, "");
-        this.getStorage().setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(Object.assign({ address,
-            accessToken,
-            idToken,
-            refreshToken, appId: currentAppId }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
+        // A login always starts a NEW generation; refresh commits preserve it.
+        // See WebSessionManager for why lineage cannot be inferred from tokens or
+        // address. RN is single-realm, so the lock resolves to direct execution.
+        await withSessionLock(() => {
+            this.writeRaw(Object.assign({ address,
+                accessToken,
+                idToken,
+                refreshToken, appId: currentAppId, sessionGeneration: mintSessionGeneration() }, (sessionIssuer ? { issuer: sessionIssuer } : {})));
+        });
+    }
+    /** Raw read of the stored blob. Callers inside the lock use this, never a cached copy. */
+    static readRaw() {
+        try {
+            const raw = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return raw ? JSON.parse(raw) : null;
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    static writeRaw(sessionObj) {
+        this.getStorage().setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+    }
+    /** Mirror of WebSessionManager.readSessionWithGeneration. */
+    static async readSessionWithGeneration() {
+        const existing = this.readRaw();
+        if (!existing)
+            return null;
+        if (existing.sessionGeneration)
+            return existing;
+        return await withSessionLock(() => {
+            const current = this.readRaw();
+            if (!current)
+                return null;
+            if (current.sessionGeneration)
+                return current;
+            const upgraded = Object.assign(Object.assign({}, current), { sessionGeneration: mintSessionGeneration() });
+            this.writeRaw(upgraded);
+            return upgraded;
+        });
     }
     /* ------------------------------------------------------------------ */
     /* GET                                                                */
     /* ------------------------------------------------------------------ */
     static async getSession() {
-        const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        if (!session)
+        var _a;
+        const sessionObj = await this.readSessionWithGeneration();
+        if (!sessionObj)
             return null;
-        const sessionObj = JSON.parse(session);
+        const generation = (_a = sessionObj.sessionGeneration) !== null && _a !== void 0 ? _a : null;
         /* ---------- validate app-id ---------- */
         const config = await getConfig();
         if (sessionObj.appId && sessionObj.appId !== config.appId) {
-            this.clearSession();
+            await this.clearSessionIfGeneration(generation);
             return null;
         }
         /* ---------- check JWT expiration ---------- */
+        // No skew buffer, deliberately: this is the restore path, and at boot a token
+        // already past `exp` cannot authenticate anything. See WebSessionManager.
         try {
             // Expiry on the ID TOKEN (always a JWT). The OIDC access_token for email/social
             // logins is opaque, so decoding it threw → the catch wiped a valid session.
@@ -3341,26 +3710,35 @@ class ReactNativeSessionManager {
                 // (mirrors the refresh-failed branch below) so isAuthenticated()
                 // does not stay true and every request does not 401 + retry forever.
                 if (!refreshToken) {
-                    this.clearSession();
+                    await this.clearSessionIfGeneration(generation);
                     return null;
                 }
                 const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
-                    await this.updateIdTokenAndAccessToken(refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
-                    const newSession = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-                    if (!newSession)
+                    const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
+                    // Superseded means a login or logout landed mid-refresh. Returning
+                    // our stale null would sign the UI out of a session that is now
+                    // valid, since init() applies whatever restoreSession() returns.
+                    if (committed.outcome === "superseded") {
+                        const current = this.readRaw();
+                        if (!current)
+                            return null;
+                        return { address: current.address, session: current };
+                    }
+                    const newObj = committed.session;
+                    if (!newObj)
                         return null;
-                    const newObj = JSON.parse(newSession);
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops
-                this.clearSession();
+                // Refresh failed — clear stale session to prevent retry loops, but only
+                // if it is still the session we set out to refresh.
+                await this.clearSessionIfGeneration(generation);
                 return null;
             }
         }
         catch (err) {
             // Token decode or refresh failed — clear stale session to prevent retry loops
-            this.clearSession();
+            await this.clearSessionIfGeneration(generation);
             return null;
         }
         return { address: sessionObj.address, session: sessionObj };
@@ -3368,8 +3746,37 @@ class ReactNativeSessionManager {
     /* ------------------------------------------------------------------ */
     /* CLEAR                                                              */
     /* ------------------------------------------------------------------ */
-    static clearSession() {
-        this.getStorage().removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+    /**
+     * Remove the session unconditionally. Async and awaited for the same reason as
+     * the web manager: a caller that does not await lets logout() return while the
+     * credential is still readable.
+     */
+    static async clearSession() {
+        const removed = await withSessionLock(() => {
+            if (this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY) === null)
+                return false;
+            this.getStorage().removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return true;
+        });
+        if (removed)
+            notifySessionCleared();
+    }
+    /** Remove only if the stored session is still the one identified by `generation`. */
+    static async clearSessionIfGeneration(generation) {
+        const removed = await withSessionLock(() => {
+            var _a;
+            const current = this.readRaw();
+            if (!current)
+                return false;
+            if (generation === null)
+                return false;
+            if (((_a = current.sessionGeneration) !== null && _a !== void 0 ? _a : null) !== generation)
+                return false;
+            this.getStorage().removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return true;
+        });
+        if (removed)
+            notifySessionCleared();
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
@@ -3412,36 +3819,44 @@ class ReactNativeSessionManager {
     /* ------------------------------------------------------------------ */
     /* UPDATE TOKENS                                                      */
     /* ------------------------------------------------------------------ */
-    static async updateIdTokenAndAccessToken(idToken, accessToken, refreshToken) {
-        var _a;
-        // Resolve config FIRST so the read → check → write below is one synchronous
-        // turn (an atomic CAS): no `await` can let a concurrent login interleave a
-        // different session between the read and the write (#220).
+    /**
+     * Commit refreshed tokens bound to the generation they were minted for.
+     * Mirror of WebSessionManager.commitRefreshedTokens; see it for the rationale.
+     */
+    static async commitRefreshedTokens(expected, idToken, accessToken, refreshToken) {
+        // Resolve config BEFORE the lock: no awaits inside the critical section.
         const config = await getConfig();
-        const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        if (!session)
-            return;
-        const sessionObj = JSON.parse(session);
-        /* ---------- app-id guard ---------- */
-        if (sessionObj.appId && sessionObj.appId !== config.appId) {
-            this.clearSession();
-            return;
-        }
-        /* ---------- cross-principal guard (#220) ---------- */
-        // Refuse to graft a refreshed token onto a DIFFERENT user's stored session
-        // (a stale refresh completing after a login/upgrade replaced storage). Also
-        // re-runs the wallet-binding check storeSession does.
-        if (!refreshedTokenMayReplaceStored(idToken, sessionObj.address, (s) => this.decodeBase64Url(s))) {
-            console.warn("[ReactNativeSessionManager] updateIdTokenAndAccessToken: refreshed token wallet does not match the stored session address — discarding stale refresh");
-            return;
-        }
-        sessionObj.idToken = idToken;
-        sessionObj.accessToken = accessToken;
-        if (typeof refreshToken === "string" && refreshToken.length > 0) {
-            sessionObj.refreshToken = refreshToken;
-        }
-        (_a = sessionObj.appId) !== null && _a !== void 0 ? _a : (sessionObj.appId = config.appId);
-        this.getStorage().setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        const result = await withSessionLock(() => {
+            var _a;
+            const current = this.readRaw();
+            /* ---------- app-id guard ---------- */
+            if ((current === null || current === void 0 ? void 0 : current.appId) && current.appId !== config.appId) {
+                this.getStorage().removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+                return { outcome: "superseded", session: null, cleared: true };
+            }
+            const next = Object.assign(Object.assign(Object.assign({}, (current !== null && current !== void 0 ? current : {})), { idToken,
+                accessToken }), (typeof refreshToken === "string" && refreshToken.length > 0
+                ? { refreshToken }
+                : {}));
+            const outcome = decideCommit(current, expected, next);
+            if (outcome === "superseded")
+                return { outcome, session: null };
+            if (outcome === "same-generation-winner")
+                return { outcome, session: current };
+            if (outcome === "already-equal")
+                return { outcome, session: current };
+            /* ---------- cross-principal guard (#220) ---------- */
+            if (!refreshedTokenMayReplaceStored(idToken, current.address, (s) => this.decodeBase64Url(s))) {
+                console.warn("[ReactNativeSessionManager] commitRefreshedTokens: refreshed token wallet does not match the stored session address — discarding stale refresh");
+                return { outcome: "superseded", session: null };
+            }
+            (_a = next.appId) !== null && _a !== void 0 ? _a : (next.appId = config.appId);
+            this.writeRaw(next);
+            return { outcome, session: next };
+        });
+        if (result.cleared)
+            notifySessionCleared();
+        return { outcome: result.outcome, session: result.session };
     }
 }
 ReactNativeSessionManager.BOUNDED_SESSION_STORAGE_KEY = "bounded_session_storage";
@@ -3474,11 +3889,6 @@ function getActiveSessionManager() {
         : WebSessionManager;
 }
 
-var sessionManager = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    getActiveSessionManager: getActiveSessionManager
-});
-
 const NO_AMBIENT_SERVER_SESSION = "Server sessions are not process-global. Use createWalletClient({ keypair }) and call that wallet client's methods.";
 /* ------------------------------------------------------------------ */
 /* SESSION MANAGER                                                     */
@@ -3536,7 +3946,7 @@ class ServerSessionManager {
         const address = kp.publicKey.toBase58();
         /* fetch nonce from auth API */
         const nonce = await genAuthNonce();
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-DKOPPJwk.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-B0NoE4nC.js'); });
         const message = await genSolanaMessage(address, nonce);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -3766,16 +4176,262 @@ function normalizeEvmAddress(raw) {
     return /^0x[0-9a-f]{40}$/.test(v) ? v : null;
 }
 
-async function createBearerToken(isServer) {
+/**
+ * The one place a caller turns "I need a credential" into a usable token.
+ *
+ * Both transports go through this. The WebSocket path grew a good version of this
+ * logic first; the HTTP path had none at all and simply sent whatever was in
+ * storage, which is what let an expired token reach the server and come back as a
+ * misleading policy denial.
+ *
+ * THE CONTRACT, which callers depend on:
+ *
+ *   returns null  -> there is no session. Send the request anonymously; public
+ *                    reads must keep working for logged-out visitors.
+ *   returns token -> use exactly this token.
+ *   throws        -> there IS a session and it is unusable. NEVER fall back to an
+ *                    anonymous request, or the caller lands in policy as an
+ *                    anonymous user and gets the same misleading 403 this whole
+ *                    change exists to remove.
+ *
+ * Four corrections over the WebSocket original, each of which was a real defect:
+ *
+ *   - No sticky module-global failure. The original latched any refresh failure
+ *     into `ambientAuthFailure` and rethrew it on every later call, so ONE
+ *     transient network blip disabled refresh until an unrelated auth-state
+ *     change reset it.
+ *   - "Expiring soon" and "already expired" are different. The original collapsed
+ *     both behind a 60s buffer, so a transient refresh failure threw away a token
+ *     that was still valid for another 59 seconds.
+ *   - A missing or non-numeric `exp` is unusable, not fresh. `payload.exp * 1000`
+ *     is NaN, and `now > NaN` is false, so such a token read as perfectly fresh.
+ *   - Storage is cleared only on a DEFINITIVE rejection, never on a transient one.
+ */
+/**
+ * Stable machine code for "there is a session and it cannot be used".
+ *
+ * The VALUE is deliberately unchanged from when this lived in subscription-v2 as
+ * `WS_AUTH_EXPIRED_CODE`: it is public surface that consumers branch on
+ * (`e.code === 'auth_expired'`), so renaming it would break them for no gain. Only
+ * the identifier lost its `WS_` prefix, now that HTTP raises it too.
+ *
+ * The realtime worker's 401 body uses `invalid_or_expired_session` for the same
+ * condition on the wire; this is the client-side counterpart.
+ */
+const AUTH_EXPIRED_CODE = 'auth_expired';
+/** The principal changed under a request that was already in flight. */
+const AUTH_CHANGED_CODE = 'auth_changed';
+function makeAuthExpiredError(message, status) {
+    const err = new Error(`${AUTH_EXPIRED_CODE}: ${message}`);
+    err.code = AUTH_EXPIRED_CODE;
+    if (status !== undefined)
+        err.status = status;
+    return err;
+}
+function makeAuthChangedError(message) {
+    const err = new Error(`${AUTH_CHANGED_CODE}: ${message}`);
+    err.code = AUTH_CHANGED_CODE;
+    return err;
+}
+function isAuthExpiredError(error) {
+    const code = error === null || error === void 0 ? void 0 : error.code;
+    return !!error && typeof error === 'object'
+        && (code === AUTH_EXPIRED_CODE || code === AUTH_CHANGED_CODE);
+}
+function normalizeAuthExpiredError(error, fallbackMessage) {
+    var _a, _b;
+    if (isAuthExpiredError(error))
+        return error;
+    const status = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code;
+    return makeAuthExpiredError(fallbackMessage, status);
+}
+/** Refresh this many ms before `exp`, so a token cannot die mid-flight. */
+const TOKEN_EXPIRY_SKEW_MS = 60000;
+function classifyToken(token, nowMs = Date.now()) {
+    let exp;
+    try {
+        const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
+        exp = payload === null || payload === void 0 ? void 0 : payload.exp;
+    }
+    catch (_a) {
+        return 'unusable';
+    }
+    // A token with no numeric exp used to compare against NaN and read as fresh.
+    if (typeof exp !== 'number' || !Number.isFinite(exp))
+        return 'unusable';
+    const expiresAtMs = exp * 1000;
+    if (nowMs >= expiresAtMs)
+        return 'expired';
+    if (nowMs >= expiresAtMs - TOKEN_EXPIRY_SKEW_MS)
+        return 'expiring-soon';
+    return 'fresh';
+}
+/** Short, non-secret fingerprint used only to key the in-flight map. Never logged. */
+function tokenFingerprint(token) {
+    let h = 5381;
+    for (let i = 0; i < token.length; i++)
+        h = ((h << 5) + h + token.charCodeAt(i)) >>> 0;
+    return h.toString(16);
+}
+/**
+ * In-flight refresh TRANSACTIONS, keyed by the session they act on.
+ *
+ * The issuer-level dedupe in `refreshSession` shares only the network response;
+ * each caller then commits independently. With a generation check that means the
+ * first commit wins and every other caller sees storage it does not recognise —
+ * so a burst of ordinary requests at expiry would all fail as "the user changed".
+ * Deduping the WHOLE snapshot -> refresh -> commit makes them share one outcome.
+ *
+ * Keyed by generation as well as app, so a caller that arrives after a re-login
+ * starts its own transaction instead of joining a stale one.
+ */
+const refreshTransactions = new Map();
+function transactionKey(scope, appId, generation, refreshToken) {
+    return `${scope}:${appId}:${generation !== null && generation !== void 0 ? generation : 'none'}:${tokenFingerprint(refreshToken)}`;
+}
+function isDefinitiveRejection(error) {
+    var _a;
+    const status = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status;
+    return status === 401 || status === 403;
+}
+async function readSessionParts(isServer) {
+    var _a, _b, _c, _d, _e, _f;
     if (isServer) {
-        const sessionMgr = ServerSessionManager.instance;
-        const session = await sessionMgr.getSession();
-        if (!(session === null || session === void 0 ? void 0 : session.idToken)) {
-            return null;
+        const session = await ServerSessionManager.instance.getSession();
+        return {
+            idToken: (_a = session === null || session === void 0 ? void 0 : session.idToken) !== null && _a !== void 0 ? _a : null,
+            refreshToken: (_b = session === null || session === void 0 ? void 0 : session.refreshToken) !== null && _b !== void 0 ? _b : null,
+            issuer: undefined,
+            generation: null,
+        };
+    }
+    const mgr = getActiveSessionManager();
+    const session = await mgr.readSessionWithGeneration();
+    return {
+        idToken: (_c = session === null || session === void 0 ? void 0 : session.idToken) !== null && _c !== void 0 ? _c : null,
+        refreshToken: (_d = session === null || session === void 0 ? void 0 : session.refreshToken) !== null && _d !== void 0 ? _d : null,
+        issuer: (_e = session === null || session === void 0 ? void 0 : session.issuer) !== null && _e !== void 0 ? _e : undefined,
+        generation: (_f = session === null || session === void 0 ? void 0 : session.sessionGeneration) !== null && _f !== void 0 ? _f : null,
+    };
+}
+async function commit(isServer, expected, refreshed) {
+    var _a, _b;
+    if (isServer) {
+        const mgr = ServerSessionManager.instance;
+        const session = await mgr.getSession();
+        if (!session)
+            return { outcome: 'superseded', token: null };
+        const next = Object.assign(Object.assign(Object.assign({}, session), { idToken: refreshed.idToken, accessToken: refreshed.accessToken }), (refreshed.refreshToken ? { refreshToken: refreshed.refreshToken } : {}));
+        mgr.setSession(next);
+        return { outcome: 'applied', token: next.idToken };
+    }
+    const result = await getActiveSessionManager().commitRefreshedTokens(expected, refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
+    // NEVER return refreshed.idToken directly. When the commit is refused or lost,
+    // that token was not stored, and using it would authenticate the request as
+    // whoever the refresh was for rather than whoever the session now belongs to.
+    return { outcome: result.outcome, token: (_b = (_a = result.session) === null || _a === void 0 ? void 0 : _a.idToken) !== null && _b !== void 0 ? _b : null };
+}
+/**
+ * Get a token that is safe to send right now, refreshing if needed.
+ *
+ * `null` means anonymous is fine. A throw means there is a session that cannot be
+ * used; the caller must surface it rather than downgrade to anonymous.
+ */
+async function getFreshAuthToken(isServer = false, options = {}) {
+    const { idToken, refreshToken, issuer, generation } = await readSessionParts(isServer);
+    // No session at all: anonymous is legitimate.
+    if (!idToken)
+        return null;
+    const force = options.force === true;
+    const freshness = classifyToken(idToken);
+    if (!force && freshness === 'fresh')
+        return idToken;
+    // Still valid for a little longer, so a failed refresh can fall back to it —
+    // but never when forced, since the server has already refused this exact token.
+    const stillUsable = !force && freshness === 'expiring-soon';
+    if (!refreshToken) {
+        if (stillUsable)
+            return idToken;
+        // Nothing can revive this session. Drop it so isAuthenticated() stops lying
+        // and the UI is told, then fail loudly instead of going anonymous.
+        await clearDeadSession(isServer, generation);
+        throw makeAuthExpiredError('Authentication expired and no refresh token is available');
+    }
+    const config = await getConfig();
+    const key = transactionKey(isServer ? 'server' : 'web', config.appId, generation, refreshToken);
+    const existing = refreshTransactions.get(key);
+    if (existing)
+        return await existing;
+    const transaction = (async () => {
+        var _a, _b, _c;
+        try {
+            const refreshed = await refreshSession(refreshToken, issuer);
+            if (!(refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) || !(refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
+                throw makeAuthExpiredError('Authentication refresh returned an incomplete session');
+            }
+            const { outcome, token } = await commit(isServer, { generation, idToken }, refreshed);
+            if (outcome === 'superseded') {
+                // A login or logout landed while we were on the network. Refuse rather
+                // than authenticate this request as the principal that just left.
+                throw makeAuthChangedError('The signed-in account changed while this request was in flight');
+            }
+            // applied / already-equal / same-generation-winner are all successes: the
+            // stored session is valid for this same login either way.
+            if (!token) {
+                throw makeAuthExpiredError('Authentication refresh produced no usable token');
+            }
+            return token;
+        }
+        catch (error) {
+            if (isAuthExpiredError(error))
+                throw error;
+            // Log the STATUS only: the axios error carries config.data, which holds
+            // the refresh token, and must never reach a console or log sink.
+            const status = (_c = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code) !== null && _c !== void 0 ? _c : 'unknown';
+            if (isDefinitiveRejection(error)) {
+                // The issuer says this refresh token is dead. Drop the session.
+                await clearDeadSession(isServer, generation);
+                throw makeAuthExpiredError('Authentication expired and refresh was rejected', status);
+            }
+            // TRANSIENT: network blip, 5xx, timeout. Keep the session — it may well
+            // work in a moment. If the access token is still inside its skew window
+            // it is valid right now, so use it rather than failing the request.
+            if (stillUsable)
+                return idToken;
+            throw makeAuthExpiredError('Authentication expired and refresh failed', status);
+        }
+        finally {
+            refreshTransactions.delete(key);
+        }
+    })();
+    refreshTransactions.set(key, transaction);
+    return await transaction;
+}
+async function clearDeadSession(isServer, generation) {
+    if (isServer) {
+        try {
+            ServerSessionManager.instance.clearSession();
         }
-        return `Bearer ${session.idToken}`;
+        catch ( /* best effort */_a) { /* best effort */ }
+        return;
+    }
+    try {
+        // Conditional: never remove a session that a concurrent login already replaced.
+        await getActiveSessionManager().clearSessionIfGeneration(generation);
     }
-    const idToken = getActiveSessionManager().getIdToken();
+    catch ( /* a clear failure must not mask the auth error we are about to throw */_b) { /* a clear failure must not mask the auth error we are about to throw */ }
+}
+
+async function createBearerToken(isServer) {
+    // Both branches go through the freshness helper now. The web branch used to read
+    // localStorage synchronously and send whatever was there, so an expired token was
+    // handed to the server on every request and only recovered from AFTER a 401 —
+    // and until the worker started returning 401 for a rejected bearer, never.
+    //
+    // A throw here is deliberate and must propagate: it means a session exists but
+    // cannot be used. Swallowing it and sending the request anonymously would put
+    // the caller back in policy as an anonymous user, which is the original bug.
+    const idToken = await getFreshAuthToken(isServer);
     if (!idToken) {
         return null;
     }
@@ -3859,41 +4515,18 @@ async function getIdToken(isServer) {
     }
     return getActiveSessionManager().getIdToken();
 }
-async function getRefreshToken(isServer) {
-    if (isServer) {
-        const sessionMgr = ServerSessionManager.instance;
-        const session = await sessionMgr.getSession();
-        return session === null || session === void 0 ? void 0 : session.refreshToken;
-    }
-    return getActiveSessionManager().getRefreshToken();
-}
-/** The auth issuer base that minted the active client session, so a refresh POSTs
- *  to the right /session/refresh. Undefined on the server (keypair, no refresh). */
-function getSessionIssuer(isServer) {
+/**
+ * Read the active session's generation, minting one for a pre-generation session.
+ *
+ * The server manager is a single in-memory session per process, so it has no
+ * cross-realm lineage problem and reports null.
+ */
+async function getSessionGeneration(isServer = false) {
     var _a;
     if (isServer)
-        return undefined;
-    return (_a = getActiveSessionManager().getIssuer()) !== null && _a !== void 0 ? _a : undefined;
-}
-async function updateIdTokenAndAccessToken(idToken, accessToken, isServer = false, refreshToken) {
-    if (isServer) {
-        const sessionMgr = ServerSessionManager.instance;
-        // Ensure we have a session to update; if missing, let lazy creation happen on next request.
-        let session = null;
-        try {
-            session = await sessionMgr.getSession();
-        }
-        catch (_a) {
-            return;
-        }
-        if (!session) {
-            return;
-        }
-        sessionMgr.setSession(Object.assign(Object.assign(Object.assign({}, session), { idToken,
-            accessToken }), (refreshToken ? { refreshToken } : {})));
-        return;
-    }
-    await getActiveSessionManager().updateIdTokenAndAccessToken(idToken, accessToken, refreshToken);
+        return null;
+    const session = await getActiveSessionManager().readSessionWithGeneration();
+    return (_a = session === null || session === void 0 ? void 0 : session.sessionGeneration) !== null && _a !== void 0 ? _a : null;
 }
 
 // ---------------------------------------------------------------------------
@@ -4115,57 +4748,44 @@ axiosRetry(apiClient, {
         }
     },
 });
-const refreshInFlight = new Map();
-// Short, bounded, non-secret fingerprint of a refresh token — used only to KEY the
-// in-flight de-dup map (never logged, never the raw secret).
-function refreshTokenFingerprint(token) {
-    let h = 5381;
-    for (let i = 0; i < token.length; i++)
-        h = ((h << 5) + h + token.charCodeAt(i)) >>> 0;
-    return h.toString(16);
-}
-async function refreshAuthSessionOnce(appId, isServer) {
-    // Capture the CURRENT session's refresh token up front and key the in-flight
-    // refresh by it, not just by the app. Keyed by app only, a refresh started for
-    // user A would be reused for a request issued after switching to user B (guest→
-    // wallet upgrade, logout/login), so B's 401 recovery would piggyback on A's
-    // refresh (#112). Per-session keying keeps de-dup for the SAME session while
-    // making a post-switch refresh a distinct entry. (The token WRITE is separately
-    // guarded per-principal in the session managers, #220/#221.)
-    const refreshToken = await getRefreshToken(isServer);
-    if (!refreshToken) {
-        return false;
+/**
+ * Recover from a 401, bound to the session that authenticated the ORIGINAL attempt.
+ *
+ * The dedupe, rotation and conditional-clear all live in `getFreshAuthToken` now;
+ * this only adds the principal binding a reactive retry needs.
+ *
+ * Why the binding matters: `createAuthHeader` is acquired inside `executeRequest`,
+ * so a retry re-reads whatever session is current at retry time. If B logs in while
+ * A's request is in flight, A's 401 handler used to refresh B's session and replay
+ * A's exact request as B — writing data under the wrong principal. Making a rejected
+ * bearer return 401 turned that from a near-impossible race into the normal recovery
+ * path, so it has to be closed here.
+ *
+ * Returns true only when the retry may proceed under the SAME login.
+ */
+async function refreshAuthSessionOnce(capturedGeneration, isServer) {
+    try {
+        // force: the server just rejected the stored token, so a locally-fresh-looking
+        // one is not evidence of anything. Without this, a 401 caused by anything the
+        // client cannot see (revoked family, app mismatch, key rotation) would be
+        // "recovered" by replaying the exact same credential.
+        const token = await getFreshAuthToken(isServer, { force: true });
+        if (!token)
+            return false;
+        // Equal generation covers both "unchanged" and "refreshed descendant": a
+        // refresh preserves the generation, a re-login mints a new one. Comparing
+        // tokens instead would reject a perfectly good retry whenever a concurrent
+        // request refreshed first, which at expiry is the common case.
+        const currentGeneration = await getSessionGeneration(isServer);
+        if (currentGeneration !== capturedGeneration)
+            return false;
+        return true;
     }
-    const key = `${isServer ? "server" : "web"}:${appId}:${refreshTokenFingerprint(refreshToken)}`;
-    const existing = refreshInFlight.get(key);
-    if (existing) {
-        return existing;
+    catch (_a) {
+        // Includes auth_changed and a definitively rejected refresh. Either way the
+        // retry must not proceed; the caller surfaces the original 401.
+        return false;
     }
-    const refreshPromise = (async () => {
-        var _a, _b;
-        try {
-            const refreshData = await refreshSession(refreshToken, getSessionIssuer(isServer));
-            if (!(refreshData === null || refreshData === void 0 ? void 0 : refreshData.idToken) || !(refreshData === null || refreshData === void 0 ? void 0 : refreshData.accessToken)) {
-                return false;
-            }
-            await updateIdTokenAndAccessToken(refreshData.idToken, refreshData.accessToken, isServer, 
-            // Persist the ROTATED refresh token — the old one is single-use spent.
-            refreshData.refreshToken);
-            return true;
-        }
-        catch (error) {
-            if (!isServer && (((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) === 401 || ((_b = error === null || error === void 0 ? void 0 : error.response) === null || _b === void 0 ? void 0 : _b.status) === 403)) {
-                const { getActiveSessionManager } = await Promise.resolve().then(function () { return sessionManager; });
-                getActiveSessionManager().clearSession();
-            }
-            return false;
-        }
-        finally {
-            refreshInFlight.delete(key);
-        }
-    })();
-    refreshInFlight.set(key, refreshPromise);
-    return refreshPromise;
 }
 async function makeApiRequest(method, urlPath, data, _overrides) {
     var _a, _b, _c, _d, _e, _f, _g;
@@ -4173,6 +4793,24 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
     // fall back to the module-global init() config.
     const config = (_a = _overrides === null || _overrides === void 0 ? void 0 : _overrides._config) !== null && _a !== void 0 ? _a : await getConfig();
     const readOnly = (_overrides === null || _overrides === void 0 ? void 0 : _overrides._readOnly) === true;
+    // CREDENTIAL PROVENANCE.
+    //
+    // Only a MANAGED credential — one this SDK minted from the global session — may
+    // trigger global-session recovery. A caller that supplies its own Authorization
+    // (via `_overrides.headers` or a wallet client's `_getAuthHeaders`) owns that
+    // token; refreshing or clearing the global session because THAT token got a 401
+    // would sign out an unrelated user. Rare before, because a rejected bearer used
+    // to come back as 403; routine now that it is a 401.
+    const usesOverrideAuthHeader = !!(_overrides === null || _overrides === void 0 ? void 0 : _overrides.headers)
+        && Object.keys(_overrides.headers).some((name) => name.toLowerCase() === "authorization");
+    const isManagedCredential = !readOnly
+        && !(_overrides === null || _overrides === void 0 ? void 0 : _overrides._getAuthHeaders)
+        && !usesOverrideAuthHeader;
+    // The session that authenticated the FIRST attempt. 401 recovery is bound to it
+    // so a retry can never execute under a principal that replaced it mid-flight.
+    const capturedGeneration = isManagedCredential
+        ? await getSessionGeneration(config.isServer)
+        : null;
     async function executeRequest() {
         var _a;
         // When _getAuthHeaders is provided (wallet client), use it as the sole auth source.
@@ -4222,30 +4860,50 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
     try {
         return await executeRequest();
     }
-    catch (error) {
+    catch (initialError) {
+        // The error that ultimately gets normalized below. A retry REPLACES it, so a
+        // genuine post-refresh policy denial surfaces as itself.
+        //
+        // Both retry paths used to `return await executeRequest()` from inside this
+        // catch, which meant a retry that failed skipped the whole normalization
+        // block further down. The default path additionally swallowed the retry error
+        // and rethrew the ORIGINAL 401 — so `401 -> refresh succeeds -> retry is
+        // genuinely denied 403` reached the caller as a 401, contradicting the point
+        // of returning 401 for expired credentials in the first place.
+        let error = initialError;
         if (((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) === 401) {
             // Read-only scoped instance: it holds no session, so there is nothing
             // to refresh. Surface the 401 without touching the global session.
             if (readOnly) {
                 throw error;
             }
-            // Wallet client path: use client-specific retry, skip global fallback entirely
             if (_overrides === null || _overrides === void 0 ? void 0 : _overrides._clearAuth) {
+                // Wallet client path: client-specific retry, never the global session.
                 await _overrides._clearAuth();
-                return await executeRequest();
-                // If this throws, let it propagate — do NOT clear global ServerSessionManager
-            }
-            // Default path (no wallet client): refresh global session
-            try {
-                const refreshed = await refreshAuthSessionOnce(config.appId, config.isServer);
-                if (!refreshed) {
-                    throw new Error("Unable to refresh auth session");
+                try {
+                    return await executeRequest();
+                }
+                catch (retryError) {
+                    // Normalize the RETRY's own failure. Still no global auth touched.
+                    error = retryError;
                 }
-                return await executeRequest();
             }
-            catch (_h) {
-                throw error;
+            else if (isManagedCredential) {
+                // Default path: recover the global session, bound to the principal
+                // that authenticated the first attempt.
+                const recovered = await refreshAuthSessionOnce(capturedGeneration, config.isServer);
+                if (recovered) {
+                    try {
+                        return await executeRequest();
+                    }
+                    catch (retryError) {
+                        error = retryError;
+                    }
+                }
+                // Not recovered: keep the original 401 for normalization below.
             }
+            // Unmanaged credential (caller-supplied Authorization): its 401 is the
+            // caller's to handle. Never refresh or clear the global session for it.
         }
         if (((_c = error.response) === null || _c === void 0 ? void 0 : _c.status) == 404) {
             return { data: null, status: 404 };
@@ -4334,7 +4992,6 @@ const MIN_RECONNECT_DELAY_JITTER_MS = 1000;
 const MAX_RECONNECT_DELAY_MS = 300000;
 const RECONNECT_DELAY_GROW_FACTOR = 1.8;
 const MIN_BROWSER_RECONNECT_INTERVAL_MS = 5000;
-const WS_AUTH_EXPIRED_CODE = 'auth_expired';
 // React runs old-route effect cleanup before new-route effects. Keep an
 // otherwise-idle socket for one short handoff window so the new route can
 // cancel teardown and reuse it; genuinely idle sockets still close promptly.
@@ -4470,19 +5127,11 @@ function bearerFromAuthHeaders(headers) {
 }
 // Monotonic counter for unique-ish fallback identity keys (no Date.now in some envs).
 let connectionEpoch = 0;
-function isTokenExpired(token) {
-    var _a;
-    try {
-        const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
-        const expirationTime = payload.exp * 1000;
-        const currentTime = Date.now();
-        return currentTime > (expirationTime - 60000); // 60 second buffer
-    }
-    catch (error) {
-        console.error('[WS v2] Error checking token expiration. reason:', (_a = error === null || error === void 0 ? void 0 : error.name) !== null && _a !== void 0 ? _a : 'decode_failed');
-        return true;
-    }
-}
+// isTokenExpired / makeAuthExpiredError / isAuthExpiredError /
+// normalizeAuthExpiredError now live in utils/auth-token-freshness so the HTTP and
+// WebSocket paths cannot drift apart. `classifyToken` replaces the old boolean,
+// which collapsed "expiring soon" and "already expired" into one answer and read a
+// token with no numeric `exp` as fresh.
 function getTokenExpirationTime(token) {
     try {
         const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
@@ -4492,27 +5141,34 @@ function getTokenExpirationTime(token) {
         return null;
     }
 }
-function makeAuthExpiredError(message, status) {
-    const err = new Error(`${WS_AUTH_EXPIRED_CODE}: ${message}`);
-    err.code = WS_AUTH_EXPIRED_CODE;
-    if (status !== undefined)
-        err.status = status;
-    return err;
-}
-function isAuthExpiredError(error) {
-    return !!error && typeof error === 'object' && error.code === WS_AUTH_EXPIRED_CODE;
-}
-function normalizeAuthExpiredError(error, fallbackMessage) {
-    var _a, _b;
-    if (isAuthExpiredError(error))
-        return error;
-    const status = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code;
-    return makeAuthExpiredError(fallbackMessage, status);
-}
+/**
+ * Latch a failure so a dead session does not re-hammer /session/refresh every tick.
+ *
+ * NOT latched when the failure came with the session being cleared or replaced.
+ * The clear notifies auth-state listeners, which kicks a reconnect that resets this
+ * — and if we re-latched afterwards, `getConnectionAuthToken` would keep throwing
+ * even though storage is now empty, so an ordinary expiry left WebSocket
+ * acquisition permanently broken instead of falling back to an anonymous socket.
+ */
 function rememberAmbientAuthFailure(error) {
+    if ((error === null || error === void 0 ? void 0 : error.code) === AUTH_CHANGED_CODE)
+        return error;
+    // The session is gone: the right next move is an anonymous connection, not a
+    // remembered failure.
+    if (!getIdTokenSync())
+        return error;
     ambientAuthFailure = error;
     return error;
 }
+/** Best-effort synchronous peek, only for deciding whether a session still exists. */
+function getIdTokenSync() {
+    try {
+        return getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        return null;
+    }
+}
 function failConnectionAuth(connection, error) {
     connection.authFailure = error;
     connection.pendingAuthToken = null;
@@ -4540,7 +5196,7 @@ function scheduleTokenRefresh(connection, isServer) {
     // This replaces the old single setTimeout approach which was unreliable for long
     // delays (browsers throttle/suspend timers in background tabs).
     connection.tokenRefreshTimer = setInterval(async () => {
-        var _a, _b, _c, _d, _e, _f, _g, _h;
+        var _a, _b, _c, _d, _e;
         try {
             const currentToken = await getIdToken(isServer);
             if (!currentToken)
@@ -4555,90 +5211,70 @@ function scheduleTokenRefresh(connection, isServer) {
                 // verifies JWT at $connect time, so the existing connection continues
                 // working. The fresh token is picked up by urlProvider the next time
                 // a reconnect naturally happens (network drop, keepalive timeout, etc.).
+                //
+                // Routed through the shared transaction. This used to read a refresh
+                // token, call refreshSession, and write the result with nothing binding
+                // it to the session it started from — so a timer that fired for S1 and
+                // completed after a same-wallet re-login could overwrite S2's rotated
+                // token, and the next refresh would trip the issuer's reuse detection
+                // and revoke the whole family.
                 try {
-                    const currentRefreshToken = await getRefreshToken(isServer);
-                    if (!currentRefreshToken) {
-                        console.warn('[WS v2] No refresh token available for proactive refresh');
-                        return;
-                    }
-                    const refreshData = await refreshSession(currentRefreshToken, getSessionIssuer(isServer));
-                    if (refreshData && refreshData.idToken && refreshData.accessToken) {
-                        await updateIdTokenAndAccessToken(refreshData.idToken, refreshData.accessToken, isServer, refreshData.refreshToken);
-                        console.info('[WS v2] Token refreshed successfully, stored for next connection');
-                    }
-                    else {
-                        console.warn('[WS v2] Proactive token refresh returned incomplete data');
-                    }
+                    await getFreshAuthToken(isServer);
+                    console.info('[WS v2] Token refreshed successfully, stored for next connection');
                 }
                 catch (refreshError) {
-                    // If the refresh token itself is invalid (401/403), stop retrying —
-                    // the token won't magically become valid next interval, and continuing
-                    // to hammer /session/refresh causes 429 rate-limit storms.
-                    if (((_a = refreshError === null || refreshError === void 0 ? void 0 : refreshError.response) === null || _a === void 0 ? void 0 : _a.status) === 401 || ((_b = refreshError === null || refreshError === void 0 ? void 0 : refreshError.response) === null || _b === void 0 ? void 0 : _b.status) === 403) {
-                        console.warn('[WS v2] Refresh token rejected (401/403), stopping periodic refresh');
+                    const definitive = (refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) === AUTH_EXPIRED_CODE
+                        || (refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) === AUTH_CHANGED_CODE;
+                    if (definitive) {
+                        // The session is dead or belongs to someone else now. The shared
+                        // helper has already cleared storage and notified auth-state
+                        // listeners, so the UI stops showing a connection that is gone —
+                        // this branch used to just stop the timer and leave the UI
+                        // claiming to be connected.
+                        console.warn('[WS v2] Session no longer usable, stopping periodic refresh');
                         if (connection.tokenRefreshTimer) {
                             clearInterval(connection.tokenRefreshTimer);
                             connection.tokenRefreshTimer = null;
                         }
                         return;
                     }
-                    // Log only the status — the raw axios error carries config.data
-                    // (the refresh token) and must never hit the console / log sinks.
-                    console.warn('[WS v2] Proactive token refresh failed, will retry next interval. status:', (_e = (_d = (_c = refreshError === null || refreshError === void 0 ? void 0 : refreshError.response) === null || _c === void 0 ? void 0 : _c.status) !== null && _d !== void 0 ? _d : refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) !== null && _e !== void 0 ? _e : 'unknown');
+                    // Transient: keep the session and try again next interval.
+                    // Status only — the raw axios error carries config.data (the refresh
+                    // token) and must never hit the console / log sinks.
+                    console.warn('[WS v2] Proactive token refresh failed, will retry next interval. status:', (_b = (_a = refreshError === null || refreshError === void 0 ? void 0 : refreshError.status) !== null && _a !== void 0 ? _a : refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) !== null && _b !== void 0 ? _b : 'unknown');
                 }
             }
         }
         catch (error) {
-            console.error('[WS v2] Error in periodic token check. status:', (_h = (_g = (_f = error === null || error === void 0 ? void 0 : error.response) === null || _f === void 0 ? void 0 : _f.status) !== null && _g !== void 0 ? _g : error === null || error === void 0 ? void 0 : error.code) !== null && _h !== void 0 ? _h : 'unknown');
+            console.error('[WS v2] Error in periodic token check. status:', (_e = (_d = (_c = error === null || error === void 0 ? void 0 : error.response) === null || _c === void 0 ? void 0 : _c.status) !== null && _d !== void 0 ? _d : error === null || error === void 0 ? void 0 : error.code) !== null && _e !== void 0 ? _e : 'unknown');
         }
     }, TOKEN_CHECK_INTERVAL);
 }
-async function getFreshAuthToken(isServer) {
-    var _a, _b, _c, _d, _e;
-    const currentToken = await getIdToken(isServer);
-    if (!currentToken) {
-        if (ambientAuthFailure) {
-            throw ambientAuthFailure;
-        }
-        return null;
-    }
-    if (!isTokenExpired(currentToken)) {
-        ambientAuthFailure = null;
-        return currentToken;
-    }
-    if (ambientAuthFailure) {
+/**
+ * WS-local wrapper around the shared freshness helper.
+ *
+ * The shared helper owns expiry classification, the deduplicated
+ * snapshot -> refresh -> commit transaction, and conditional clearing. This adds
+ * only the WS-specific storm guard: without it, a dead session would retry the
+ * refresh on every reconnect attempt and every 5-minute tick.
+ */
+async function getWsAuthToken(isServer) {
+    var _a, _b;
+    // A remembered failure short-circuits, but only while a session still exists.
+    // See rememberAmbientAuthFailure: once storage is cleared the correct next move
+    // is an anonymous connection, not a replayed error.
+    if (ambientAuthFailure && getIdTokenSync()) {
         throw ambientAuthFailure;
     }
-    // Token is expired — attempt refresh
-    const refreshToken = await getRefreshToken(isServer);
-    if (!refreshToken) {
-        console.warn('[WS v2] Token expired but no refresh token available');
-        throw rememberAmbientAuthFailure(makeAuthExpiredError('Authentication expired and no refresh token is available'));
-    }
     try {
-        const refreshData = await refreshSession(refreshToken, getSessionIssuer(isServer));
-        if (refreshData && refreshData.idToken && refreshData.accessToken) {
-            await updateIdTokenAndAccessToken(refreshData.idToken, refreshData.accessToken, isServer, refreshData.refreshToken);
-            ambientAuthFailure = null;
-            return refreshData.idToken;
-        }
-        throw makeAuthExpiredError('Authentication refresh returned an incomplete session');
+        const token = await getFreshAuthToken(isServer);
+        ambientAuthFailure = null;
+        return token;
     }
     catch (error) {
-        // Log only the status — the raw axios error carries config.data (the refresh
-        // token) and must never reach the console / log sinks.
-        console.error('[WS v2] Error refreshing token. status:', (_c = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code) !== null && _c !== void 0 ? _c : 'unknown');
-        // If the refresh token is permanently invalid (401/403), clear the stale
-        // session from storage so future attempts don't keep retrying with it.
-        if (!isServer && (((_d = error === null || error === void 0 ? void 0 : error.response) === null || _d === void 0 ? void 0 : _d.status) === 401 || ((_e = error === null || error === void 0 ? void 0 : error.response) === null || _e === void 0 ? void 0 : _e.status) === 403)) {
-            try {
-                const { getActiveSessionManager } = await Promise.resolve().then(function () { return sessionManager; });
-                getActiveSessionManager().clearSession();
-            }
-            catch (clearError) {
-                console.warn('[WS v2] Failed to clear stale session:', clearError);
-            }
-        }
+        // Status only — the raw axios error carries config.data (the refresh token)
+        // and must never reach a console or log sink.
+        console.error('[WS v2] Error acquiring auth token. status:', (_b = (_a = error === null || error === void 0 ? void 0 : error.status) !== null && _a !== void 0 ? _a : error === null || error === void 0 ? void 0 : error.code) !== null && _b !== void 0 ? _b : 'unknown');
         throw rememberAmbientAuthFailure(normalizeAuthExpiredError(error, 'Authentication expired and refresh failed'));
     }
 }
@@ -4650,7 +5286,10 @@ async function getConnectionAuthToken(isServer, authTokenProvider, anonymous) {
         return null;
     }
     if (!authTokenProvider) {
-        return getFreshAuthToken(isServer);
+        // getWsAuthToken, not the shared helper directly: the wrapper carries the
+        // reconnect-storm guard that keeps a dead session from re-refreshing on
+        // every reconnect attempt.
+        return getWsAuthToken(isServer);
     }
     try {
         const token = await authTokenProvider();
@@ -6010,7 +6649,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-BpQsQYhl.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-Bz4Ob6K6.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -7717,11 +8356,11 @@ async function setMany(many, options) {
                 transactionResult = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
             }
             else if (curTx.serializedTransaction) {
-                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-BOKHbEuy.js'); });
+                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-ngqIkN9W.js'); });
                 transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             else {
-                const { handleSolanaTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-BOKHbEuy.js'); });
+                const { handleSolanaTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-ngqIkN9W.js'); });
                 transactionResult = await handleSolanaTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             // Sync items after all transactions are confirmed
@@ -8820,7 +9459,7 @@ async function buildSetDocumentsTransaction(connection, idl, programProvider, pa
 }
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-DKOPPJwk.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-B0NoE4nC.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
@@ -9362,6 +10001,8 @@ function defineLiveModule(mod) {
     return mod;
 }
 
+exports.AUTH_CHANGED_CODE = AUTH_CHANGED_CODE;
+exports.AUTH_EXPIRED_CODE = AUTH_EXPIRED_CODE;
 exports.BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR = BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR;
 exports.BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR = BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR;
 exports.BoundedDeclineError = BoundedDeclineError;
@@ -9376,6 +10017,8 @@ exports.RATE_LIMIT_EVENT_NAME = RATE_LIMIT_EVENT_NAME;
 exports.ReactNativeSessionManager = ReactNativeSessionManager;
 exports.ScopedClientReadOnlyError = ScopedClientReadOnlyError;
 exports.ServerSessionManager = ServerSessionManager;
+exports.SessionEnvironmentError = SessionEnvironmentError;
+exports.UNSUPPORTED_ENVIRONMENT_CODE = UNSUPPORTED_ENVIRONMENT_CODE;
 exports.WebSessionManager = WebSessionManager;
 exports.aggregate = aggregate;
 exports.assertCanonicalBoundedRuntimeWriteCalldata = assertCanonicalBoundedRuntimeWriteCalldata;
@@ -9415,10 +10058,12 @@ exports.increment = increment;
 exports.init = init;
 exports.intent = intent;
 exports.invoke = invoke;
+exports.isAuthExpiredError = isAuthExpiredError;
 exports.isEffectResult = isEffectResult;
 exports.live = live;
 exports.normalizeEvmAddress = normalizeEvmAddress;
 exports.now = now;
+exports.onSessionCleared = onSessionCleared;
 exports.queryAggregate = queryAggregate;
 exports.reconnectWithNewAuth = reconnectWithNewAuth;
 exports.refreshSession = refreshSession;
@@ -9444,4 +10089,4 @@ exports.toLowerEvmAddress = toLowerEvmAddress;
 exports.toMillis = toMillis;
 exports.toSeconds = toSeconds;
 exports.withEffects = withEffects;
-//# sourceMappingURL=index-B30-XpaX.js.map
+//# sourceMappingURL=index-BIdD2yUB.js.map