@bounded-sh/core 0.0.58 → 0.0.60

package/dist/{index-DYbzK8YT.mjs → index-BQ6e4MeP.mjs}

@@ -2907,19 +2907,19 @@ async function createSessionWithSignature(address, message, signature, authMetho
 // Note: module-level state is shared across requests in SSR/Node — acceptable
 // since there is only one active session per server instance (same pattern as
 // refreshInFlight in api.ts).
-let refreshInFlight$1 = null;
+let refreshInFlight = null;
 let refreshInFlightToken = null;
 async function refreshSession(refreshToken, issuer) {
     // Dedupe per (issuer, token): the rotating token is single-use, so two
     // concurrent refreshes of the SAME token must share one in-flight request or
     // the second would look like reuse and revoke the family.
     const dedupeKey = `${issuer || ''}::${refreshToken}`;
-    if (refreshInFlight$1 && refreshInFlightToken === dedupeKey) {
-        return refreshInFlight$1;
+    if (refreshInFlight && refreshInFlightToken === dedupeKey) {
+        return refreshInFlight;
     }
     refreshInFlightToken = dedupeKey;
     let currentFlight;
-    currentFlight = refreshInFlight$1 = (async () => {
+    currentFlight = refreshInFlight = (async () => {
         try {
             const config = await getConfig();
             const appId = config.appId;
@@ -2936,13 +2936,13 @@ async function refreshSession(refreshToken, issuer) {
         finally {
             // Only clear if we're still the active in-flight request.
             // A second call with a different token may have replaced us.
-            if (refreshInFlight$1 === currentFlight) {
-                refreshInFlight$1 = null;
+            if (refreshInFlight === currentFlight) {
+                refreshInFlight = null;
                 refreshInFlightToken = null;
             }
         }
     })();
-    return refreshInFlight$1;
+    return refreshInFlight;
 }
 class SessionRevokeError extends Error {
     constructor(message, cause) {
@@ -3027,7 +3027,248 @@ function refreshedTokenMayReplaceStored(newIdToken, storedAddress, decodeBase64U
     return tokenWallet === storedAddress;
 }
 
+/**
+ * The one signal core sends upward when a stored session stops existing.
+ *
+ * `tarobase-core` cannot import `js-sdk` (that would be a cycle), and core has no
+ * event bus, so a session dying inside a session manager used to be invisible to
+ * the SDK: `setCurrentUser(null)` was only ever called by `logout()` and `init()`.
+ * The result was a UI that kept showing a connected wallet long after the session
+ * it was showing had been wiped, which is exactly what let the Solana lab freeze a
+ * review against a wallet the server no longer knew about.
+ *
+ * `js-sdk` registers a handler at init; core fires it ONLY when storage was
+ * actually cleared, never on a failed-but-preserved refresh. Firing on a
+ * preserved session would log people out on a transient network blip.
+ */
+let handlers = [];
+/**
+ * Register a listener for "the stored session is gone".
+ * Returns an unsubscribe function.
+ */
+function onSessionCleared(handler) {
+    handlers.push(handler);
+    return () => {
+        handlers = handlers.filter((h) => h !== handler);
+    };
+}
+/**
+ * Announce that session storage was cleared.
+ *
+ * Call this ONLY after a removal actually happened. Handlers are best-effort: a
+ * throwing listener must not turn a successful clear into a failed one, because
+ * the storage mutation has already committed by this point.
+ */
+function notifySessionCleared() {
+    for (const handler of handlers) {
+        try {
+            handler();
+        }
+        catch (_a) {
+            // A listener's failure cannot un-clear storage; keep notifying the rest.
+        }
+    }
+}
+
+/**
+ * The one protocol every session-storage mutation goes through.
+ *
+ * WHY THIS EXISTS
+ *
+ * `localStorage` is shared by every tab on an origin but offers no atomic
+ * compare-and-set spanning a read and a write, and each tab is a separate JS
+ * realm, so an in-memory guard cannot serialize them. The old code relied on
+ * doing its read → check → write inside one synchronous turn, which is only
+ * atomic *within* a realm.
+ *
+ * That is not a theoretical gap. `REFRESH_REUSE_GRACE_MS` on the issuer is 60s,
+ * so two tabs presenting the same refresh token inside that window BOTH succeed
+ * and BOTH receive the same successor refresh token — while each response mints
+ * its own distinct idToken. Concurrent cross-tab commits are a designed-for
+ * occurrence, not an edge case.
+ *
+ * Two failures follow from an unlocked read-then-write, and both are closed here:
+ *
+ *   1. Lost update / resurrection. Tab A reads, tab B logs in (or logs out), tab A
+ *      writes its stale blob back. B's login is silently replaced, or a logged-out
+ *      session comes back to life.
+ *   2. Spurious "the user changed". Tab B's commit finds tab A's blob, which
+ *      matches neither B's snapshot nor B's own result because the idTokens
+ *      differ — even though it is the same user and the same login.
+ *
+ * THE CRITICAL SECTION IS THE COMMIT, NOT THE NETWORK CALL
+ *
+ * The lock covers read → compare → write only. The refresh POST happens outside
+ * it: holding a cross-tab lock across a 30s network call would serialize every
+ * tab behind the slowest one. This is safe because the snapshot captured before
+ * the network call is used only for COMPARISON. What actually gets written is
+ * decided against storage re-read inside the lock, so a login or logout that lands
+ * during the network call is always observed.
+ *
+ * NO BEST-EFFORT FALLBACK
+ *
+ * A `localStorage` lease was considered and rejected: its own acquire sequence is
+ * a non-atomic read-then-write across realms, and a backgrounded tab can be frozen
+ * past any lease timeout and then resume and write. Both leave exactly the windows
+ * this module exists to close, so a browser without Web Locks fails closed instead.
+ * Absence of `navigator.locks` does NOT imply a single realm — such a browser still
+ * has tabs. Single realm is determined by the absence of `localStorage`.
+ */
+const SESSION_LOCK_NAME = "bounded_session_mutation";
+const UNSUPPORTED_ENVIRONMENT_CODE = "unsupported_environment";
+/**
+ * Thrown when authenticated session work is attempted in a browser that shares
+ * `localStorage` across tabs but cannot serialize access to it. Reads and
+ * anonymous requests are unaffected; only session mutation is refused.
+ */
+class SessionEnvironmentError extends Error {
+    constructor(message) {
+        super(message);
+        this.code = UNSUPPORTED_ENVIRONMENT_CODE;
+        this.name = "SessionEnvironmentError";
+    }
+}
+/**
+ * True when nothing outside this realm can touch session storage.
+ *
+ * Keyed on `localStorage`, not on `window`: React Native defines `window` but
+ * stores sessions through a per-process StorageAdapter, and Node/SSR has neither.
+ * A browser is the only multi-realm case, and `localStorage` is what makes it one.
+ */
+function isSingleRealm() {
+    return typeof localStorage === "undefined";
+}
+function hasWebLocks() {
+    var _a;
+    return typeof navigator !== "undefined"
+        && typeof ((_a = navigator.locks) === null || _a === void 0 ? void 0 : _a.request) === "function";
+}
+/**
+ * Run `fn` with exclusive access to session storage across every tab on this origin.
+ *
+ * Single-realm runtimes execute directly. Browsers serialize through Web Locks.
+ * A browser without Web Locks throws rather than running unserialized.
+ */
+async function withSessionLock(fn) {
+    if (isSingleRealm()) {
+        return await fn();
+    }
+    if (!hasWebLocks()) {
+        throw new SessionEnvironmentError("This browser cannot safely coordinate a Bounded session across tabs " +
+            "(the Web Locks API is unavailable). Authenticated operations are disabled; " +
+            "anonymous reads still work.");
+    }
+    return await navigator.locks.request(SESSION_LOCK_NAME, { mode: "exclusive" }, async () => await fn());
+}
+/**
+ * Opaque per-login identifier stamped into the stored session.
+ *
+ * Minted on every `storeSession` (login, guest upgrade, wallet switch) and
+ * PRESERVED across refresh commits. That is the whole point: it is what makes
+ * "S1 refreshed into S1'" provable and distinguishable from "someone logged in
+ * again", which token equality and address equality both get wrong — token
+ * equality rejects a valid post-refresh retry, and address equality accepts a
+ * same-wallet re-login as if it were the same session.
+ *
+ * The issuer has a server-side `familyId` that would serve, but `/session/refresh`
+ * does not return it, so this is client-side.
+ */
+function mintSessionGeneration() {
+    const c = typeof crypto !== "undefined" ? crypto : undefined;
+    if (typeof (c === null || c === void 0 ? void 0 : c.randomUUID) === "function")
+        return c.randomUUID();
+    if (typeof (c === null || c === void 0 ? void 0 : c.getRandomValues) === "function") {
+        const bytes = c.getRandomValues(new Uint8Array(16));
+        return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+    }
+    // Last resort only; every runtime the SDK targets provides one of the above.
+    return `g${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
+}
+/**
+ * Decide a commit against what storage ACTUALLY holds right now.
+ *
+ * Must be called inside `withSessionLock`, with `current` read inside that same
+ * critical section — comparing against a value read before the network call is
+ * exactly the race this exists to prevent.
+ */
+function decideCommit(current, expected, next) {
+    var _a;
+    // Absence is SUPERSEDED, never "free to write". A logout that lands between a
+    // refresh's read and its write must not be undone by that write. This is the
+    // backstop that makes session resurrection impossible.
+    if (!current)
+        return "superseded";
+    // A caller with no captured generation cannot prove lineage, so it must not
+    // write. Reads mint a generation for legacy sessions before returning them, so
+    // in practice this only catches a request that was in flight across that
+    // upgrade. Fail closed: the caller retries and gets a provable session.
+    if (expected.generation === null)
+        return "superseded";
+    // A different generation means a different LOGIN, which the address-based guard
+    // cannot see when the same wallet signs in again.
+    if (((_a = current.sessionGeneration) !== null && _a !== void 0 ? _a : null) !== expected.generation) {
+        return "superseded";
+    }
+    if (current.idToken === next.idToken && current.refreshToken === next.refreshToken) {
+        return "already-equal";
+    }
+    // Storage is exactly what this caller read before it went to the network, so
+    // nothing has moved underneath and this write is the legitimate one.
+    if (expected.idToken === undefined || current.idToken === expected.idToken) {
+        return "applied";
+    }
+    // Same login, but storage has moved on: another caller's refresh of this same
+    // session already landed. Theirs is the current truth — its rotated refresh
+    // token is the live one — so defer rather than overwrite. Reporting a principal
+    // change here would fail ordinary concurrent requests at expiry, which is the
+    // common case, not a rare one.
+    return "same-generation-winner";
+}
+
 class WebSessionManager {
+    /** Raw read of the stored blob. Callers inside the lock use this, never a cached copy. */
+    static readRaw() {
+        if (typeof window === "undefined")
+            return null;
+        const raw = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+        if (!raw)
+            return null;
+        try {
+            return JSON.parse(raw);
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    static writeRaw(sessionObj) {
+        localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+    }
+    /**
+     * Read the session, stamping a `sessionGeneration` if it predates them.
+     *
+     * Sessions written before generations existed have no lineage marker, so a
+     * later refresh could not prove it descended from them. Minting on read
+     * upgrades them in place; a request already in flight across that mint carries
+     * no generation and fails closed at commit rather than writing unprovably.
+     */
+    static async readSessionWithGeneration() {
+        const existing = this.readRaw();
+        if (!existing)
+            return null;
+        if (existing.sessionGeneration)
+            return existing;
+        return await withSessionLock(() => {
+            // Re-read inside the lock: another tab may have minted one already.
+            const current = this.readRaw();
+            if (!current)
+                return null;
+            if (current.sessionGeneration)
+                return current;
+            const upgraded = Object.assign(Object.assign({}, current), { sessionGeneration: mintSessionGeneration() });
+            this.writeRaw(upgraded);
+            return upgraded;
+        });
+    }
     /**
      * Decode a base64url-encoded string (used by JWT payloads).
      * Normalises base64url → standard base64 before calling browser atob().
@@ -3076,28 +3317,38 @@ class WebSessionManager {
         // the RIGHT /session/refresh. Email overrides with humanAuthApiUrl; all
         // wallet/guest/signature flows default to authApiUrl (the bounded-auth issuer).
         const sessionIssuer = (issuer || config.authApiUrl || "").replace(/\/$/, "");
-        localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(Object.assign({ address,
-            accessToken,
-            idToken,
-            refreshToken, appId: currentAppId }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
+        // A login always starts a NEW generation. Refresh commits preserve it, so
+        // "same generation" means "same login", which is what lets a post-refresh
+        // retry be told apart from a re-login by the same wallet.
+        await withSessionLock(() => {
+            this.writeRaw(Object.assign({ address,
+                accessToken,
+                idToken,
+                refreshToken, appId: currentAppId, sessionGeneration: mintSessionGeneration() }, (sessionIssuer ? { issuer: sessionIssuer } : {})));
+        });
     }
     /* ------------------------------------------------------------------ */
     /* GET                                                                */
     /* ------------------------------------------------------------------ */
     static async getSession() {
+        var _a;
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        if (!session)
+        const sessionObj = await this.readSessionWithGeneration();
+        if (!sessionObj)
             return null;
-        const sessionObj = JSON.parse(session);
+        const generation = (_a = sessionObj.sessionGeneration) !== null && _a !== void 0 ? _a : null;
         /* ---------- validate app-id ---------- */
         const config = await getConfig();
         if (sessionObj.appId && sessionObj.appId !== config.appId) {
-            this.clearSession();
+            await this.clearSessionIfGeneration(generation);
             return null;
         }
         /* ---------- check JWT expiration ---------- */
+        // Deliberately NO skew buffer here, unlike the per-request freshness helper.
+        // This is the restore path: at boot a token already past `exp` is unusable
+        // either way, so clearing it is honest. Preserving it would only make
+        // isAuthenticated() lie about a session that cannot authenticate anything.
         try {
             // Check expiry on the ID TOKEN — it is ALWAYS a JWT. The OIDC access_token for
             // email/social (hosted) logins is an OPAQUE string (not a JWT), so decoding IT
@@ -3111,29 +3362,39 @@ class WebSessionManager {
                 // (mirrors the refresh-failed branch below) so isAuthenticated()
                 // does not stay true and every request does not 401 + retry forever.
                 if (!refreshToken) {
-                    this.clearSession();
+                    await this.clearSessionIfGeneration(generation);
                     return null;
                 }
                 const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
-                    await this.updateIdTokenAndAccessToken(refreshed.idToken, refreshed.accessToken, 
+                    const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, 
                     // Persist the ROTATED refresh token — the old one is now
                     // single-use spent; reusing it would revoke the family.
                     refreshed.refreshToken);
-                    const newSession = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-                    if (!newSession)
+                    // Superseded means a login or logout landed while we were on the
+                    // network. Returning our own stale null here would sign the UI out
+                    // of a session that is now perfectly valid, because init() applies
+                    // whatever restoreSession() returns. Re-read once and report THAT.
+                    if (committed.outcome === "superseded") {
+                        const current = this.readRaw();
+                        if (!current)
+                            return null;
+                        return { address: current.address, session: current };
+                    }
+                    const newObj = committed.session;
+                    if (!newObj)
                         return null;
-                    const newObj = JSON.parse(newSession);
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops
-                this.clearSession();
+                // Refresh failed — clear stale session to prevent retry loops, but only
+                // if it is still the session we set out to refresh.
+                await this.clearSessionIfGeneration(generation);
                 return null;
             }
         }
         catch (err) {
             // Token decode or refresh failed — clear stale session to prevent retry loops
-            this.clearSession();
+            await this.clearSessionIfGeneration(generation);
             return null;
         }
         return { address: sessionObj.address, session: sessionObj };
@@ -3141,10 +3402,55 @@ class WebSessionManager {
     /* ------------------------------------------------------------------ */
     /* CLEAR                                                              */
     /* ------------------------------------------------------------------ */
-    static clearSession() {
+    /**
+     * Remove the session unconditionally (logout, app-id mismatch, dead refresh).
+     *
+     * ASYNC AND LOCKED, and callers MUST await it. Two failure modes hang on this:
+     *
+     *  - Removing outside the lock lets a refresh that read before the logout write
+     *    the session back afterwards, resurrecting a logged-out session.
+     *  - Not awaiting lets `logout()` return while the credential is still in
+     *    storage, so the very next request authenticates as the user who just left.
+     */
+    static async clearSession() {
+        if (typeof window === "undefined")
+            return;
+        const removed = await withSessionLock(() => {
+            if (localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY) === null)
+                return false;
+            localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return true;
+        });
+        // Only announce a clear that actually happened, so a no-op cannot sign out
+        // a UI that was already signed out.
+        if (removed)
+            notifySessionCleared();
+    }
+    /**
+     * Remove the session only if it is still the one identified by `generation`.
+     *
+     * Used by every failure path that wants to drop a dead session without
+     * trampling a newer login that landed while the failure was in flight.
+     */
+    static async clearSessionIfGeneration(generation) {
         if (typeof window === "undefined")
             return;
-        localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+        const removed = await withSessionLock(() => {
+            var _a;
+            const current = this.readRaw();
+            if (!current)
+                return false;
+            // No captured generation means no proof this is the session we meant to
+            // drop. Leave it alone rather than risk removing a replacement.
+            if (generation === null)
+                return false;
+            if (((_a = current.sessionGeneration) !== null && _a !== void 0 ? _a : null) !== generation)
+                return false;
+            localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return true;
+        });
+        if (removed)
+            notifySessionCleared();
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
@@ -3179,39 +3485,63 @@ class WebSessionManager {
     /* ------------------------------------------------------------------ */
     /* UPDATE TOKENS                                                      */
     /* ------------------------------------------------------------------ */
-    static async updateIdTokenAndAccessToken(idToken, accessToken, refreshToken) {
-        var _a;
+    /**
+     * Commit refreshed tokens, bound to the session generation they were minted for.
+     *
+     * Returns WHICH of the four outcomes happened, and the session the caller must
+     * actually use. The old version returned void and silently dropped a refused
+     * write, so `getFreshAuthToken` handed back the refreshed token regardless — a
+     * request could then execute as the previous user while storage and the UI had
+     * already moved to a new one.
+     *
+     * Never hand back `idToken` directly: use `result.session`.
+     */
+    static async commitRefreshedTokens(expected, idToken, accessToken, refreshToken) {
         if (typeof window === "undefined")
-            return;
-        // Resolve config FIRST so the read → check → write below is one synchronous
-        // turn (an atomic CAS): no `await` can let a concurrent login interleave a
-        // different session between the read and the write (#221).
+            return { outcome: "superseded", session: null };
+        // Resolve config BEFORE taking the lock: no awaits are allowed inside the
+        // critical section, or another realm could interleave between read and write.
         const config = await getConfig();
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        if (!session)
-            return;
-        const sessionObj = JSON.parse(session);
-        /* ---------- app-id guard ---------- */
-        if (sessionObj.appId && sessionObj.appId !== config.appId) {
-            this.clearSession();
-            return;
-        }
-        /* ---------- cross-principal guard (#221) ---------- */
-        // Refuse to graft a refreshed token onto a DIFFERENT user's stored session
-        // (a stale refresh completing after a login/upgrade replaced storage, incl.
-        // a cross-tab login). Also re-runs the wallet-binding check storeSession does.
-        if (!refreshedTokenMayReplaceStored(idToken, sessionObj.address, (s) => this.decodeBase64Url(s))) {
-            console.warn("[WebSessionManager] updateIdTokenAndAccessToken: refreshed token wallet does not match the stored session address — discarding stale refresh");
-            return;
-        }
-        sessionObj.idToken = idToken;
-        sessionObj.accessToken = accessToken;
-        // Persist the rotated refresh token when the issuer returns a new one.
-        if (typeof refreshToken === "string" && refreshToken.length > 0) {
-            sessionObj.refreshToken = refreshToken;
-        }
-        (_a = sessionObj.appId) !== null && _a !== void 0 ? _a : (sessionObj.appId = config.appId);
-        localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        const result = await withSessionLock(() => {
+            var _a;
+            // Read INSIDE the lock. The snapshot the caller captured before its
+            // network refresh is only a comparison key; what gets written is decided
+            // against what storage holds right now.
+            const current = this.readRaw();
+            /* ---------- app-id guard ---------- */
+            if ((current === null || current === void 0 ? void 0 : current.appId) && current.appId !== config.appId) {
+                localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+                return { outcome: "superseded", session: null, cleared: true };
+            }
+            const next = Object.assign(Object.assign(Object.assign({}, (current !== null && current !== void 0 ? current : {})), { idToken,
+                accessToken }), (typeof refreshToken === "string" && refreshToken.length > 0
+                ? { refreshToken }
+                : {}));
+            const outcome = decideCommit(current, expected, next);
+            if (outcome === "superseded")
+                return { outcome, session: null };
+            // Another caller's refresh of this same login already landed. Theirs is
+            // the truth; reporting a principal change here would fail every ordinary
+            // concurrent request at expiry, which is the common case.
+            if (outcome === "same-generation-winner")
+                return { outcome, session: current };
+            if (outcome === "already-equal")
+                return { outcome, session: current };
+            /* ---------- cross-principal guard (#221) ---------- */
+            // Belt-and-braces alongside the generation check: refuse to graft a
+            // refreshed token onto a DIFFERENT wallet's stored session. Generations
+            // catch a same-wallet re-login, which this address check cannot.
+            if (!refreshedTokenMayReplaceStored(idToken, current.address, (s) => this.decodeBase64Url(s))) {
+                console.warn("[WebSessionManager] commitRefreshedTokens: refreshed token wallet does not match the stored session address — discarding stale refresh");
+                return { outcome: "superseded", session: null };
+            }
+            (_a = next.appId) !== null && _a !== void 0 ? _a : (next.appId = config.appId);
+            this.writeRaw(next);
+            return { outcome, session: next };
+        });
+        if (result.cleared)
+            notifySessionCleared();
+        return { outcome: result.outcome, session: result.session };
     }
 }
 WebSessionManager.BOUNDED_SESSION_STORAGE_KEY = "bounded_session_storage";
@@ -3308,26 +3638,65 @@ class ReactNativeSessionManager {
         // Issuer base for silent refresh (email overrides w/ humanAuthApiUrl; wallet/
         // guest default to authApiUrl). See WebSessionManager for the rationale.
         const sessionIssuer = (issuer || config.authApiUrl || "").replace(/\/$/, "");
-        this.getStorage().setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(Object.assign({ address,
-            accessToken,
-            idToken,
-            refreshToken, appId: currentAppId }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
+        // A login always starts a NEW generation; refresh commits preserve it.
+        // See WebSessionManager for why lineage cannot be inferred from tokens or
+        // address. RN is single-realm, so the lock resolves to direct execution.
+        await withSessionLock(() => {
+            this.writeRaw(Object.assign({ address,
+                accessToken,
+                idToken,
+                refreshToken, appId: currentAppId, sessionGeneration: mintSessionGeneration() }, (sessionIssuer ? { issuer: sessionIssuer } : {})));
+        });
+    }
+    /** Raw read of the stored blob. Callers inside the lock use this, never a cached copy. */
+    static readRaw() {
+        try {
+            const raw = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return raw ? JSON.parse(raw) : null;
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    static writeRaw(sessionObj) {
+        this.getStorage().setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+    }
+    /** Mirror of WebSessionManager.readSessionWithGeneration. */
+    static async readSessionWithGeneration() {
+        const existing = this.readRaw();
+        if (!existing)
+            return null;
+        if (existing.sessionGeneration)
+            return existing;
+        return await withSessionLock(() => {
+            const current = this.readRaw();
+            if (!current)
+                return null;
+            if (current.sessionGeneration)
+                return current;
+            const upgraded = Object.assign(Object.assign({}, current), { sessionGeneration: mintSessionGeneration() });
+            this.writeRaw(upgraded);
+            return upgraded;
+        });
     }
     /* ------------------------------------------------------------------ */
     /* GET                                                                */
     /* ------------------------------------------------------------------ */
     static async getSession() {
-        const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        if (!session)
+        var _a;
+        const sessionObj = await this.readSessionWithGeneration();
+        if (!sessionObj)
             return null;
-        const sessionObj = JSON.parse(session);
+        const generation = (_a = sessionObj.sessionGeneration) !== null && _a !== void 0 ? _a : null;
         /* ---------- validate app-id ---------- */
         const config = await getConfig();
         if (sessionObj.appId && sessionObj.appId !== config.appId) {
-            this.clearSession();
+            await this.clearSessionIfGeneration(generation);
             return null;
         }
         /* ---------- check JWT expiration ---------- */
+        // No skew buffer, deliberately: this is the restore path, and at boot a token
+        // already past `exp` cannot authenticate anything. See WebSessionManager.
         try {
             // Expiry on the ID TOKEN (always a JWT). The OIDC access_token for email/social
             // logins is opaque, so decoding it threw → the catch wiped a valid session.
@@ -3339,26 +3708,35 @@ class ReactNativeSessionManager {
                 // (mirrors the refresh-failed branch below) so isAuthenticated()
                 // does not stay true and every request does not 401 + retry forever.
                 if (!refreshToken) {
-                    this.clearSession();
+                    await this.clearSessionIfGeneration(generation);
                     return null;
                 }
                 const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
-                    await this.updateIdTokenAndAccessToken(refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
-                    const newSession = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-                    if (!newSession)
+                    const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
+                    // Superseded means a login or logout landed mid-refresh. Returning
+                    // our stale null would sign the UI out of a session that is now
+                    // valid, since init() applies whatever restoreSession() returns.
+                    if (committed.outcome === "superseded") {
+                        const current = this.readRaw();
+                        if (!current)
+                            return null;
+                        return { address: current.address, session: current };
+                    }
+                    const newObj = committed.session;
+                    if (!newObj)
                         return null;
-                    const newObj = JSON.parse(newSession);
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops
-                this.clearSession();
+                // Refresh failed — clear stale session to prevent retry loops, but only
+                // if it is still the session we set out to refresh.
+                await this.clearSessionIfGeneration(generation);
                 return null;
             }
         }
         catch (err) {
             // Token decode or refresh failed — clear stale session to prevent retry loops
-            this.clearSession();
+            await this.clearSessionIfGeneration(generation);
             return null;
         }
         return { address: sessionObj.address, session: sessionObj };
@@ -3366,8 +3744,37 @@ class ReactNativeSessionManager {
     /* ------------------------------------------------------------------ */
     /* CLEAR                                                              */
     /* ------------------------------------------------------------------ */
-    static clearSession() {
-        this.getStorage().removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+    /**
+     * Remove the session unconditionally. Async and awaited for the same reason as
+     * the web manager: a caller that does not await lets logout() return while the
+     * credential is still readable.
+     */
+    static async clearSession() {
+        const removed = await withSessionLock(() => {
+            if (this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY) === null)
+                return false;
+            this.getStorage().removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return true;
+        });
+        if (removed)
+            notifySessionCleared();
+    }
+    /** Remove only if the stored session is still the one identified by `generation`. */
+    static async clearSessionIfGeneration(generation) {
+        const removed = await withSessionLock(() => {
+            var _a;
+            const current = this.readRaw();
+            if (!current)
+                return false;
+            if (generation === null)
+                return false;
+            if (((_a = current.sessionGeneration) !== null && _a !== void 0 ? _a : null) !== generation)
+                return false;
+            this.getStorage().removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return true;
+        });
+        if (removed)
+            notifySessionCleared();
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
@@ -3410,36 +3817,44 @@ class ReactNativeSessionManager {
     /* ------------------------------------------------------------------ */
     /* UPDATE TOKENS                                                      */
     /* ------------------------------------------------------------------ */
-    static async updateIdTokenAndAccessToken(idToken, accessToken, refreshToken) {
-        var _a;
-        // Resolve config FIRST so the read → check → write below is one synchronous
-        // turn (an atomic CAS): no `await` can let a concurrent login interleave a
-        // different session between the read and the write (#220).
+    /**
+     * Commit refreshed tokens bound to the generation they were minted for.
+     * Mirror of WebSessionManager.commitRefreshedTokens; see it for the rationale.
+     */
+    static async commitRefreshedTokens(expected, idToken, accessToken, refreshToken) {
+        // Resolve config BEFORE the lock: no awaits inside the critical section.
         const config = await getConfig();
-        const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        if (!session)
-            return;
-        const sessionObj = JSON.parse(session);
-        /* ---------- app-id guard ---------- */
-        if (sessionObj.appId && sessionObj.appId !== config.appId) {
-            this.clearSession();
-            return;
-        }
-        /* ---------- cross-principal guard (#220) ---------- */
-        // Refuse to graft a refreshed token onto a DIFFERENT user's stored session
-        // (a stale refresh completing after a login/upgrade replaced storage). Also
-        // re-runs the wallet-binding check storeSession does.
-        if (!refreshedTokenMayReplaceStored(idToken, sessionObj.address, (s) => this.decodeBase64Url(s))) {
-            console.warn("[ReactNativeSessionManager] updateIdTokenAndAccessToken: refreshed token wallet does not match the stored session address — discarding stale refresh");
-            return;
-        }
-        sessionObj.idToken = idToken;
-        sessionObj.accessToken = accessToken;
-        if (typeof refreshToken === "string" && refreshToken.length > 0) {
-            sessionObj.refreshToken = refreshToken;
-        }
-        (_a = sessionObj.appId) !== null && _a !== void 0 ? _a : (sessionObj.appId = config.appId);
-        this.getStorage().setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        const result = await withSessionLock(() => {
+            var _a;
+            const current = this.readRaw();
+            /* ---------- app-id guard ---------- */
+            if ((current === null || current === void 0 ? void 0 : current.appId) && current.appId !== config.appId) {
+                this.getStorage().removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
+                return { outcome: "superseded", session: null, cleared: true };
+            }
+            const next = Object.assign(Object.assign(Object.assign({}, (current !== null && current !== void 0 ? current : {})), { idToken,
+                accessToken }), (typeof refreshToken === "string" && refreshToken.length > 0
+                ? { refreshToken }
+                : {}));
+            const outcome = decideCommit(current, expected, next);
+            if (outcome === "superseded")
+                return { outcome, session: null };
+            if (outcome === "same-generation-winner")
+                return { outcome, session: current };
+            if (outcome === "already-equal")
+                return { outcome, session: current };
+            /* ---------- cross-principal guard (#220) ---------- */
+            if (!refreshedTokenMayReplaceStored(idToken, current.address, (s) => this.decodeBase64Url(s))) {
+                console.warn("[ReactNativeSessionManager] commitRefreshedTokens: refreshed token wallet does not match the stored session address — discarding stale refresh");
+                return { outcome: "superseded", session: null };
+            }
+            (_a = next.appId) !== null && _a !== void 0 ? _a : (next.appId = config.appId);
+            this.writeRaw(next);
+            return { outcome, session: next };
+        });
+        if (result.cleared)
+            notifySessionCleared();
+        return { outcome: result.outcome, session: result.session };
     }
 }
 ReactNativeSessionManager.BOUNDED_SESSION_STORAGE_KEY = "bounded_session_storage";
@@ -3472,11 +3887,6 @@ function getActiveSessionManager() {
         : WebSessionManager;
 }
 
-var sessionManager = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    getActiveSessionManager: getActiveSessionManager
-});
-
 const NO_AMBIENT_SERVER_SESSION = "Server sessions are not process-global. Use createWalletClient({ keypair }) and call that wallet client's methods.";
 /* ------------------------------------------------------------------ */
 /* SESSION MANAGER                                                     */
@@ -3534,7 +3944,7 @@ class ServerSessionManager {
         const address = kp.publicKey.toBase58();
         /* fetch nonce from auth API */
         const nonce = await genAuthNonce();
-        const { genSolanaMessage } = await import('./solana-message-C2_VvNX7.mjs');
+        const { genSolanaMessage } = await import('./solana-message-QUfJi1Qm.mjs');
         const message = await genSolanaMessage(address, nonce);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -3764,16 +4174,262 @@ function normalizeEvmAddress(raw) {
     return /^0x[0-9a-f]{40}$/.test(v) ? v : null;
 }
 
-async function createBearerToken(isServer) {
+/**
+ * The one place a caller turns "I need a credential" into a usable token.
+ *
+ * Both transports go through this. The WebSocket path grew a good version of this
+ * logic first; the HTTP path had none at all and simply sent whatever was in
+ * storage, which is what let an expired token reach the server and come back as a
+ * misleading policy denial.
+ *
+ * THE CONTRACT, which callers depend on:
+ *
+ *   returns null  -> there is no session. Send the request anonymously; public
+ *                    reads must keep working for logged-out visitors.
+ *   returns token -> use exactly this token.
+ *   throws        -> there IS a session and it is unusable. NEVER fall back to an
+ *                    anonymous request, or the caller lands in policy as an
+ *                    anonymous user and gets the same misleading 403 this whole
+ *                    change exists to remove.
+ *
+ * Four corrections over the WebSocket original, each of which was a real defect:
+ *
+ *   - No sticky module-global failure. The original latched any refresh failure
+ *     into `ambientAuthFailure` and rethrew it on every later call, so ONE
+ *     transient network blip disabled refresh until an unrelated auth-state
+ *     change reset it.
+ *   - "Expiring soon" and "already expired" are different. The original collapsed
+ *     both behind a 60s buffer, so a transient refresh failure threw away a token
+ *     that was still valid for another 59 seconds.
+ *   - A missing or non-numeric `exp` is unusable, not fresh. `payload.exp * 1000`
+ *     is NaN, and `now > NaN` is false, so such a token read as perfectly fresh.
+ *   - Storage is cleared only on a DEFINITIVE rejection, never on a transient one.
+ */
+/**
+ * Stable machine code for "there is a session and it cannot be used".
+ *
+ * The VALUE is deliberately unchanged from when this lived in subscription-v2 as
+ * `WS_AUTH_EXPIRED_CODE`: it is public surface that consumers branch on
+ * (`e.code === 'auth_expired'`), so renaming it would break them for no gain. Only
+ * the identifier lost its `WS_` prefix, now that HTTP raises it too.
+ *
+ * The realtime worker's 401 body uses `invalid_or_expired_session` for the same
+ * condition on the wire; this is the client-side counterpart.
+ */
+const AUTH_EXPIRED_CODE = 'auth_expired';
+/** The principal changed under a request that was already in flight. */
+const AUTH_CHANGED_CODE = 'auth_changed';
+function makeAuthExpiredError(message, status) {
+    const err = new Error(`${AUTH_EXPIRED_CODE}: ${message}`);
+    err.code = AUTH_EXPIRED_CODE;
+    if (status !== undefined)
+        err.status = status;
+    return err;
+}
+function makeAuthChangedError(message) {
+    const err = new Error(`${AUTH_CHANGED_CODE}: ${message}`);
+    err.code = AUTH_CHANGED_CODE;
+    return err;
+}
+function isAuthExpiredError(error) {
+    const code = error === null || error === void 0 ? void 0 : error.code;
+    return !!error && typeof error === 'object'
+        && (code === AUTH_EXPIRED_CODE || code === AUTH_CHANGED_CODE);
+}
+function normalizeAuthExpiredError(error, fallbackMessage) {
+    var _a, _b;
+    if (isAuthExpiredError(error))
+        return error;
+    const status = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code;
+    return makeAuthExpiredError(fallbackMessage, status);
+}
+/** Refresh this many ms before `exp`, so a token cannot die mid-flight. */
+const TOKEN_EXPIRY_SKEW_MS = 60000;
+function classifyToken(token, nowMs = Date.now()) {
+    let exp;
+    try {
+        const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
+        exp = payload === null || payload === void 0 ? void 0 : payload.exp;
+    }
+    catch (_a) {
+        return 'unusable';
+    }
+    // A token with no numeric exp used to compare against NaN and read as fresh.
+    if (typeof exp !== 'number' || !Number.isFinite(exp))
+        return 'unusable';
+    const expiresAtMs = exp * 1000;
+    if (nowMs >= expiresAtMs)
+        return 'expired';
+    if (nowMs >= expiresAtMs - TOKEN_EXPIRY_SKEW_MS)
+        return 'expiring-soon';
+    return 'fresh';
+}
+/** Short, non-secret fingerprint used only to key the in-flight map. Never logged. */
+function tokenFingerprint(token) {
+    let h = 5381;
+    for (let i = 0; i < token.length; i++)
+        h = ((h << 5) + h + token.charCodeAt(i)) >>> 0;
+    return h.toString(16);
+}
+/**
+ * In-flight refresh TRANSACTIONS, keyed by the session they act on.
+ *
+ * The issuer-level dedupe in `refreshSession` shares only the network response;
+ * each caller then commits independently. With a generation check that means the
+ * first commit wins and every other caller sees storage it does not recognise —
+ * so a burst of ordinary requests at expiry would all fail as "the user changed".
+ * Deduping the WHOLE snapshot -> refresh -> commit makes them share one outcome.
+ *
+ * Keyed by generation as well as app, so a caller that arrives after a re-login
+ * starts its own transaction instead of joining a stale one.
+ */
+const refreshTransactions = new Map();
+function transactionKey(scope, appId, generation, refreshToken) {
+    return `${scope}:${appId}:${generation !== null && generation !== void 0 ? generation : 'none'}:${tokenFingerprint(refreshToken)}`;
+}
+function isDefinitiveRejection(error) {
+    var _a;
+    const status = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status;
+    return status === 401 || status === 403;
+}
+async function readSessionParts(isServer) {
+    var _a, _b, _c, _d, _e, _f;
     if (isServer) {
-        const sessionMgr = ServerSessionManager.instance;
-        const session = await sessionMgr.getSession();
-        if (!(session === null || session === void 0 ? void 0 : session.idToken)) {
-            return null;
+        const session = await ServerSessionManager.instance.getSession();
+        return {
+            idToken: (_a = session === null || session === void 0 ? void 0 : session.idToken) !== null && _a !== void 0 ? _a : null,
+            refreshToken: (_b = session === null || session === void 0 ? void 0 : session.refreshToken) !== null && _b !== void 0 ? _b : null,
+            issuer: undefined,
+            generation: null,
+        };
+    }
+    const mgr = getActiveSessionManager();
+    const session = await mgr.readSessionWithGeneration();
+    return {
+        idToken: (_c = session === null || session === void 0 ? void 0 : session.idToken) !== null && _c !== void 0 ? _c : null,
+        refreshToken: (_d = session === null || session === void 0 ? void 0 : session.refreshToken) !== null && _d !== void 0 ? _d : null,
+        issuer: (_e = session === null || session === void 0 ? void 0 : session.issuer) !== null && _e !== void 0 ? _e : undefined,
+        generation: (_f = session === null || session === void 0 ? void 0 : session.sessionGeneration) !== null && _f !== void 0 ? _f : null,
+    };
+}
+async function commit(isServer, expected, refreshed) {
+    var _a, _b;
+    if (isServer) {
+        const mgr = ServerSessionManager.instance;
+        const session = await mgr.getSession();
+        if (!session)
+            return { outcome: 'superseded', token: null };
+        const next = Object.assign(Object.assign(Object.assign({}, session), { idToken: refreshed.idToken, accessToken: refreshed.accessToken }), (refreshed.refreshToken ? { refreshToken: refreshed.refreshToken } : {}));
+        mgr.setSession(next);
+        return { outcome: 'applied', token: next.idToken };
+    }
+    const result = await getActiveSessionManager().commitRefreshedTokens(expected, refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
+    // NEVER return refreshed.idToken directly. When the commit is refused or lost,
+    // that token was not stored, and using it would authenticate the request as
+    // whoever the refresh was for rather than whoever the session now belongs to.
+    return { outcome: result.outcome, token: (_b = (_a = result.session) === null || _a === void 0 ? void 0 : _a.idToken) !== null && _b !== void 0 ? _b : null };
+}
+/**
+ * Get a token that is safe to send right now, refreshing if needed.
+ *
+ * `null` means anonymous is fine. A throw means there is a session that cannot be
+ * used; the caller must surface it rather than downgrade to anonymous.
+ */
+async function getFreshAuthToken(isServer = false, options = {}) {
+    const { idToken, refreshToken, issuer, generation } = await readSessionParts(isServer);
+    // No session at all: anonymous is legitimate.
+    if (!idToken)
+        return null;
+    const force = options.force === true;
+    const freshness = classifyToken(idToken);
+    if (!force && freshness === 'fresh')
+        return idToken;
+    // Still valid for a little longer, so a failed refresh can fall back to it —
+    // but never when forced, since the server has already refused this exact token.
+    const stillUsable = !force && freshness === 'expiring-soon';
+    if (!refreshToken) {
+        if (stillUsable)
+            return idToken;
+        // Nothing can revive this session. Drop it so isAuthenticated() stops lying
+        // and the UI is told, then fail loudly instead of going anonymous.
+        await clearDeadSession(isServer, generation);
+        throw makeAuthExpiredError('Authentication expired and no refresh token is available');
+    }
+    const config = await getConfig();
+    const key = transactionKey(isServer ? 'server' : 'web', config.appId, generation, refreshToken);
+    const existing = refreshTransactions.get(key);
+    if (existing)
+        return await existing;
+    const transaction = (async () => {
+        var _a, _b, _c;
+        try {
+            const refreshed = await refreshSession(refreshToken, issuer);
+            if (!(refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) || !(refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
+                throw makeAuthExpiredError('Authentication refresh returned an incomplete session');
+            }
+            const { outcome, token } = await commit(isServer, { generation, idToken }, refreshed);
+            if (outcome === 'superseded') {
+                // A login or logout landed while we were on the network. Refuse rather
+                // than authenticate this request as the principal that just left.
+                throw makeAuthChangedError('The signed-in account changed while this request was in flight');
+            }
+            // applied / already-equal / same-generation-winner are all successes: the
+            // stored session is valid for this same login either way.
+            if (!token) {
+                throw makeAuthExpiredError('Authentication refresh produced no usable token');
+            }
+            return token;
+        }
+        catch (error) {
+            if (isAuthExpiredError(error))
+                throw error;
+            // Log the STATUS only: the axios error carries config.data, which holds
+            // the refresh token, and must never reach a console or log sink.
+            const status = (_c = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code) !== null && _c !== void 0 ? _c : 'unknown';
+            if (isDefinitiveRejection(error)) {
+                // The issuer says this refresh token is dead. Drop the session.
+                await clearDeadSession(isServer, generation);
+                throw makeAuthExpiredError('Authentication expired and refresh was rejected', status);
+            }
+            // TRANSIENT: network blip, 5xx, timeout. Keep the session — it may well
+            // work in a moment. If the access token is still inside its skew window
+            // it is valid right now, so use it rather than failing the request.
+            if (stillUsable)
+                return idToken;
+            throw makeAuthExpiredError('Authentication expired and refresh failed', status);
+        }
+        finally {
+            refreshTransactions.delete(key);
+        }
+    })();
+    refreshTransactions.set(key, transaction);
+    return await transaction;
+}
+async function clearDeadSession(isServer, generation) {
+    if (isServer) {
+        try {
+            ServerSessionManager.instance.clearSession();
         }
-        return `Bearer ${session.idToken}`;
+        catch ( /* best effort */_a) { /* best effort */ }
+        return;
+    }
+    try {
+        // Conditional: never remove a session that a concurrent login already replaced.
+        await getActiveSessionManager().clearSessionIfGeneration(generation);
     }
-    const idToken = getActiveSessionManager().getIdToken();
+    catch ( /* a clear failure must not mask the auth error we are about to throw */_b) { /* a clear failure must not mask the auth error we are about to throw */ }
+}
+
+async function createBearerToken(isServer) {
+    // Both branches go through the freshness helper now. The web branch used to read
+    // localStorage synchronously and send whatever was there, so an expired token was
+    // handed to the server on every request and only recovered from AFTER a 401 —
+    // and until the worker started returning 401 for a rejected bearer, never.
+    //
+    // A throw here is deliberate and must propagate: it means a session exists but
+    // cannot be used. Swallowing it and sending the request anonymously would put
+    // the caller back in policy as an anonymous user, which is the original bug.
+    const idToken = await getFreshAuthToken(isServer);
     if (!idToken) {
         return null;
     }
@@ -3857,41 +4513,18 @@ async function getIdToken(isServer) {
     }
     return getActiveSessionManager().getIdToken();
 }
-async function getRefreshToken(isServer) {
-    if (isServer) {
-        const sessionMgr = ServerSessionManager.instance;
-        const session = await sessionMgr.getSession();
-        return session === null || session === void 0 ? void 0 : session.refreshToken;
-    }
-    return getActiveSessionManager().getRefreshToken();
-}
-/** The auth issuer base that minted the active client session, so a refresh POSTs
- *  to the right /session/refresh. Undefined on the server (keypair, no refresh). */
-function getSessionIssuer(isServer) {
+/**
+ * Read the active session's generation, minting one for a pre-generation session.
+ *
+ * The server manager is a single in-memory session per process, so it has no
+ * cross-realm lineage problem and reports null.
+ */
+async function getSessionGeneration(isServer = false) {
     var _a;
     if (isServer)
-        return undefined;
-    return (_a = getActiveSessionManager().getIssuer()) !== null && _a !== void 0 ? _a : undefined;
-}
-async function updateIdTokenAndAccessToken(idToken, accessToken, isServer = false, refreshToken) {
-    if (isServer) {
-        const sessionMgr = ServerSessionManager.instance;
-        // Ensure we have a session to update; if missing, let lazy creation happen on next request.
-        let session = null;
-        try {
-            session = await sessionMgr.getSession();
-        }
-        catch (_a) {
-            return;
-        }
-        if (!session) {
-            return;
-        }
-        sessionMgr.setSession(Object.assign(Object.assign(Object.assign({}, session), { idToken,
-            accessToken }), (refreshToken ? { refreshToken } : {})));
-        return;
-    }
-    await getActiveSessionManager().updateIdTokenAndAccessToken(idToken, accessToken, refreshToken);
+        return null;
+    const session = await getActiveSessionManager().readSessionWithGeneration();
+    return (_a = session === null || session === void 0 ? void 0 : session.sessionGeneration) !== null && _a !== void 0 ? _a : null;
 }
 
 // ---------------------------------------------------------------------------
@@ -4113,57 +4746,44 @@ axiosRetry(apiClient, {
         }
     },
 });
-const refreshInFlight = new Map();
-// Short, bounded, non-secret fingerprint of a refresh token — used only to KEY the
-// in-flight de-dup map (never logged, never the raw secret).
-function refreshTokenFingerprint(token) {
-    let h = 5381;
-    for (let i = 0; i < token.length; i++)
-        h = ((h << 5) + h + token.charCodeAt(i)) >>> 0;
-    return h.toString(16);
-}
-async function refreshAuthSessionOnce(appId, isServer) {
-    // Capture the CURRENT session's refresh token up front and key the in-flight
-    // refresh by it, not just by the app. Keyed by app only, a refresh started for
-    // user A would be reused for a request issued after switching to user B (guest→
-    // wallet upgrade, logout/login), so B's 401 recovery would piggyback on A's
-    // refresh (#112). Per-session keying keeps de-dup for the SAME session while
-    // making a post-switch refresh a distinct entry. (The token WRITE is separately
-    // guarded per-principal in the session managers, #220/#221.)
-    const refreshToken = await getRefreshToken(isServer);
-    if (!refreshToken) {
-        return false;
+/**
+ * Recover from a 401, bound to the session that authenticated the ORIGINAL attempt.
+ *
+ * The dedupe, rotation and conditional-clear all live in `getFreshAuthToken` now;
+ * this only adds the principal binding a reactive retry needs.
+ *
+ * Why the binding matters: `createAuthHeader` is acquired inside `executeRequest`,
+ * so a retry re-reads whatever session is current at retry time. If B logs in while
+ * A's request is in flight, A's 401 handler used to refresh B's session and replay
+ * A's exact request as B — writing data under the wrong principal. Making a rejected
+ * bearer return 401 turned that from a near-impossible race into the normal recovery
+ * path, so it has to be closed here.
+ *
+ * Returns true only when the retry may proceed under the SAME login.
+ */
+async function refreshAuthSessionOnce(capturedGeneration, isServer) {
+    try {
+        // force: the server just rejected the stored token, so a locally-fresh-looking
+        // one is not evidence of anything. Without this, a 401 caused by anything the
+        // client cannot see (revoked family, app mismatch, key rotation) would be
+        // "recovered" by replaying the exact same credential.
+        const token = await getFreshAuthToken(isServer, { force: true });
+        if (!token)
+            return false;
+        // Equal generation covers both "unchanged" and "refreshed descendant": a
+        // refresh preserves the generation, a re-login mints a new one. Comparing
+        // tokens instead would reject a perfectly good retry whenever a concurrent
+        // request refreshed first, which at expiry is the common case.
+        const currentGeneration = await getSessionGeneration(isServer);
+        if (currentGeneration !== capturedGeneration)
+            return false;
+        return true;
     }
-    const key = `${isServer ? "server" : "web"}:${appId}:${refreshTokenFingerprint(refreshToken)}`;
-    const existing = refreshInFlight.get(key);
-    if (existing) {
-        return existing;
+    catch (_a) {
+        // Includes auth_changed and a definitively rejected refresh. Either way the
+        // retry must not proceed; the caller surfaces the original 401.
+        return false;
     }
-    const refreshPromise = (async () => {
-        var _a, _b;
-        try {
-            const refreshData = await refreshSession(refreshToken, getSessionIssuer(isServer));
-            if (!(refreshData === null || refreshData === void 0 ? void 0 : refreshData.idToken) || !(refreshData === null || refreshData === void 0 ? void 0 : refreshData.accessToken)) {
-                return false;
-            }
-            await updateIdTokenAndAccessToken(refreshData.idToken, refreshData.accessToken, isServer, 
-            // Persist the ROTATED refresh token — the old one is single-use spent.
-            refreshData.refreshToken);
-            return true;
-        }
-        catch (error) {
-            if (!isServer && (((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) === 401 || ((_b = error === null || error === void 0 ? void 0 : error.response) === null || _b === void 0 ? void 0 : _b.status) === 403)) {
-                const { getActiveSessionManager } = await Promise.resolve().then(function () { return sessionManager; });
-                getActiveSessionManager().clearSession();
-            }
-            return false;
-        }
-        finally {
-            refreshInFlight.delete(key);
-        }
-    })();
-    refreshInFlight.set(key, refreshPromise);
-    return refreshPromise;
 }
 async function makeApiRequest(method, urlPath, data, _overrides) {
     var _a, _b, _c, _d, _e, _f, _g;
@@ -4171,6 +4791,24 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
     // fall back to the module-global init() config.
     const config = (_a = _overrides === null || _overrides === void 0 ? void 0 : _overrides._config) !== null && _a !== void 0 ? _a : await getConfig();
     const readOnly = (_overrides === null || _overrides === void 0 ? void 0 : _overrides._readOnly) === true;
+    // CREDENTIAL PROVENANCE.
+    //
+    // Only a MANAGED credential — one this SDK minted from the global session — may
+    // trigger global-session recovery. A caller that supplies its own Authorization
+    // (via `_overrides.headers` or a wallet client's `_getAuthHeaders`) owns that
+    // token; refreshing or clearing the global session because THAT token got a 401
+    // would sign out an unrelated user. Rare before, because a rejected bearer used
+    // to come back as 403; routine now that it is a 401.
+    const usesOverrideAuthHeader = !!(_overrides === null || _overrides === void 0 ? void 0 : _overrides.headers)
+        && Object.keys(_overrides.headers).some((name) => name.toLowerCase() === "authorization");
+    const isManagedCredential = !readOnly
+        && !(_overrides === null || _overrides === void 0 ? void 0 : _overrides._getAuthHeaders)
+        && !usesOverrideAuthHeader;
+    // The session that authenticated the FIRST attempt. 401 recovery is bound to it
+    // so a retry can never execute under a principal that replaced it mid-flight.
+    const capturedGeneration = isManagedCredential
+        ? await getSessionGeneration(config.isServer)
+        : null;
     async function executeRequest() {
         var _a;
         // When _getAuthHeaders is provided (wallet client), use it as the sole auth source.
@@ -4220,30 +4858,50 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
     try {
         return await executeRequest();
     }
-    catch (error) {
+    catch (initialError) {
+        // The error that ultimately gets normalized below. A retry REPLACES it, so a
+        // genuine post-refresh policy denial surfaces as itself.
+        //
+        // Both retry paths used to `return await executeRequest()` from inside this
+        // catch, which meant a retry that failed skipped the whole normalization
+        // block further down. The default path additionally swallowed the retry error
+        // and rethrew the ORIGINAL 401 — so `401 -> refresh succeeds -> retry is
+        // genuinely denied 403` reached the caller as a 401, contradicting the point
+        // of returning 401 for expired credentials in the first place.
+        let error = initialError;
         if (((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) === 401) {
             // Read-only scoped instance: it holds no session, so there is nothing
             // to refresh. Surface the 401 without touching the global session.
             if (readOnly) {
                 throw error;
             }
-            // Wallet client path: use client-specific retry, skip global fallback entirely
             if (_overrides === null || _overrides === void 0 ? void 0 : _overrides._clearAuth) {
+                // Wallet client path: client-specific retry, never the global session.
                 await _overrides._clearAuth();
-                return await executeRequest();
-                // If this throws, let it propagate — do NOT clear global ServerSessionManager
-            }
-            // Default path (no wallet client): refresh global session
-            try {
-                const refreshed = await refreshAuthSessionOnce(config.appId, config.isServer);
-                if (!refreshed) {
-                    throw new Error("Unable to refresh auth session");
+                try {
+                    return await executeRequest();
+                }
+                catch (retryError) {
+                    // Normalize the RETRY's own failure. Still no global auth touched.
+                    error = retryError;
                 }
-                return await executeRequest();
             }
-            catch (_h) {
-                throw error;
+            else if (isManagedCredential) {
+                // Default path: recover the global session, bound to the principal
+                // that authenticated the first attempt.
+                const recovered = await refreshAuthSessionOnce(capturedGeneration, config.isServer);
+                if (recovered) {
+                    try {
+                        return await executeRequest();
+                    }
+                    catch (retryError) {
+                        error = retryError;
+                    }
+                }
+                // Not recovered: keep the original 401 for normalization below.
             }
+            // Unmanaged credential (caller-supplied Authorization): its 401 is the
+            // caller's to handle. Never refresh or clear the global session for it.
         }
         if (((_c = error.response) === null || _c === void 0 ? void 0 : _c.status) == 404) {
             return { data: null, status: 404 };
@@ -4332,7 +4990,6 @@ const MIN_RECONNECT_DELAY_JITTER_MS = 1000;
 const MAX_RECONNECT_DELAY_MS = 300000;
 const RECONNECT_DELAY_GROW_FACTOR = 1.8;
 const MIN_BROWSER_RECONNECT_INTERVAL_MS = 5000;
-const WS_AUTH_EXPIRED_CODE = 'auth_expired';
 // React runs old-route effect cleanup before new-route effects. Keep an
 // otherwise-idle socket for one short handoff window so the new route can
 // cancel teardown and reuse it; genuinely idle sockets still close promptly.
@@ -4468,19 +5125,11 @@ function bearerFromAuthHeaders(headers) {
 }
 // Monotonic counter for unique-ish fallback identity keys (no Date.now in some envs).
 let connectionEpoch = 0;
-function isTokenExpired(token) {
-    var _a;
-    try {
-        const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
-        const expirationTime = payload.exp * 1000;
-        const currentTime = Date.now();
-        return currentTime > (expirationTime - 60000); // 60 second buffer
-    }
-    catch (error) {
-        console.error('[WS v2] Error checking token expiration. reason:', (_a = error === null || error === void 0 ? void 0 : error.name) !== null && _a !== void 0 ? _a : 'decode_failed');
-        return true;
-    }
-}
+// isTokenExpired / makeAuthExpiredError / isAuthExpiredError /
+// normalizeAuthExpiredError now live in utils/auth-token-freshness so the HTTP and
+// WebSocket paths cannot drift apart. `classifyToken` replaces the old boolean,
+// which collapsed "expiring soon" and "already expired" into one answer and read a
+// token with no numeric `exp` as fresh.
 function getTokenExpirationTime(token) {
     try {
         const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
@@ -4490,27 +5139,34 @@ function getTokenExpirationTime(token) {
         return null;
     }
 }
-function makeAuthExpiredError(message, status) {
-    const err = new Error(`${WS_AUTH_EXPIRED_CODE}: ${message}`);
-    err.code = WS_AUTH_EXPIRED_CODE;
-    if (status !== undefined)
-        err.status = status;
-    return err;
-}
-function isAuthExpiredError(error) {
-    return !!error && typeof error === 'object' && error.code === WS_AUTH_EXPIRED_CODE;
-}
-function normalizeAuthExpiredError(error, fallbackMessage) {
-    var _a, _b;
-    if (isAuthExpiredError(error))
-        return error;
-    const status = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code;
-    return makeAuthExpiredError(fallbackMessage, status);
-}
+/**
+ * Latch a failure so a dead session does not re-hammer /session/refresh every tick.
+ *
+ * NOT latched when the failure came with the session being cleared or replaced.
+ * The clear notifies auth-state listeners, which kicks a reconnect that resets this
+ * — and if we re-latched afterwards, `getConnectionAuthToken` would keep throwing
+ * even though storage is now empty, so an ordinary expiry left WebSocket
+ * acquisition permanently broken instead of falling back to an anonymous socket.
+ */
 function rememberAmbientAuthFailure(error) {
+    if ((error === null || error === void 0 ? void 0 : error.code) === AUTH_CHANGED_CODE)
+        return error;
+    // The session is gone: the right next move is an anonymous connection, not a
+    // remembered failure.
+    if (!getIdTokenSync())
+        return error;
     ambientAuthFailure = error;
     return error;
 }
+/** Best-effort synchronous peek, only for deciding whether a session still exists. */
+function getIdTokenSync() {
+    try {
+        return getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        return null;
+    }
+}
 function failConnectionAuth(connection, error) {
     connection.authFailure = error;
     connection.pendingAuthToken = null;
@@ -4538,7 +5194,7 @@ function scheduleTokenRefresh(connection, isServer) {
     // This replaces the old single setTimeout approach which was unreliable for long
     // delays (browsers throttle/suspend timers in background tabs).
     connection.tokenRefreshTimer = setInterval(async () => {
-        var _a, _b, _c, _d, _e, _f, _g, _h;
+        var _a, _b, _c, _d, _e;
         try {
             const currentToken = await getIdToken(isServer);
             if (!currentToken)
@@ -4553,90 +5209,70 @@ function scheduleTokenRefresh(connection, isServer) {
                 // verifies JWT at $connect time, so the existing connection continues
                 // working. The fresh token is picked up by urlProvider the next time
                 // a reconnect naturally happens (network drop, keepalive timeout, etc.).
+                //
+                // Routed through the shared transaction. This used to read a refresh
+                // token, call refreshSession, and write the result with nothing binding
+                // it to the session it started from — so a timer that fired for S1 and
+                // completed after a same-wallet re-login could overwrite S2's rotated
+                // token, and the next refresh would trip the issuer's reuse detection
+                // and revoke the whole family.
                 try {
-                    const currentRefreshToken = await getRefreshToken(isServer);
-                    if (!currentRefreshToken) {
-                        console.warn('[WS v2] No refresh token available for proactive refresh');
-                        return;
-                    }
-                    const refreshData = await refreshSession(currentRefreshToken, getSessionIssuer(isServer));
-                    if (refreshData && refreshData.idToken && refreshData.accessToken) {
-                        await updateIdTokenAndAccessToken(refreshData.idToken, refreshData.accessToken, isServer, refreshData.refreshToken);
-                        console.info('[WS v2] Token refreshed successfully, stored for next connection');
-                    }
-                    else {
-                        console.warn('[WS v2] Proactive token refresh returned incomplete data');
-                    }
+                    await getFreshAuthToken(isServer);
+                    console.info('[WS v2] Token refreshed successfully, stored for next connection');
                 }
                 catch (refreshError) {
-                    // If the refresh token itself is invalid (401/403), stop retrying —
-                    // the token won't magically become valid next interval, and continuing
-                    // to hammer /session/refresh causes 429 rate-limit storms.
-                    if (((_a = refreshError === null || refreshError === void 0 ? void 0 : refreshError.response) === null || _a === void 0 ? void 0 : _a.status) === 401 || ((_b = refreshError === null || refreshError === void 0 ? void 0 : refreshError.response) === null || _b === void 0 ? void 0 : _b.status) === 403) {
-                        console.warn('[WS v2] Refresh token rejected (401/403), stopping periodic refresh');
+                    const definitive = (refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) === AUTH_EXPIRED_CODE
+                        || (refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) === AUTH_CHANGED_CODE;
+                    if (definitive) {
+                        // The session is dead or belongs to someone else now. The shared
+                        // helper has already cleared storage and notified auth-state
+                        // listeners, so the UI stops showing a connection that is gone —
+                        // this branch used to just stop the timer and leave the UI
+                        // claiming to be connected.
+                        console.warn('[WS v2] Session no longer usable, stopping periodic refresh');
                         if (connection.tokenRefreshTimer) {
                             clearInterval(connection.tokenRefreshTimer);
                             connection.tokenRefreshTimer = null;
                         }
                         return;
                     }
-                    // Log only the status — the raw axios error carries config.data
-                    // (the refresh token) and must never hit the console / log sinks.
-                    console.warn('[WS v2] Proactive token refresh failed, will retry next interval. status:', (_e = (_d = (_c = refreshError === null || refreshError === void 0 ? void 0 : refreshError.response) === null || _c === void 0 ? void 0 : _c.status) !== null && _d !== void 0 ? _d : refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) !== null && _e !== void 0 ? _e : 'unknown');
+                    // Transient: keep the session and try again next interval.
+                    // Status only — the raw axios error carries config.data (the refresh
+                    // token) and must never hit the console / log sinks.
+                    console.warn('[WS v2] Proactive token refresh failed, will retry next interval. status:', (_b = (_a = refreshError === null || refreshError === void 0 ? void 0 : refreshError.status) !== null && _a !== void 0 ? _a : refreshError === null || refreshError === void 0 ? void 0 : refreshError.code) !== null && _b !== void 0 ? _b : 'unknown');
                 }
             }
         }
         catch (error) {
-            console.error('[WS v2] Error in periodic token check. status:', (_h = (_g = (_f = error === null || error === void 0 ? void 0 : error.response) === null || _f === void 0 ? void 0 : _f.status) !== null && _g !== void 0 ? _g : error === null || error === void 0 ? void 0 : error.code) !== null && _h !== void 0 ? _h : 'unknown');
+            console.error('[WS v2] Error in periodic token check. status:', (_e = (_d = (_c = error === null || error === void 0 ? void 0 : error.response) === null || _c === void 0 ? void 0 : _c.status) !== null && _d !== void 0 ? _d : error === null || error === void 0 ? void 0 : error.code) !== null && _e !== void 0 ? _e : 'unknown');
         }
     }, TOKEN_CHECK_INTERVAL);
 }
-async function getFreshAuthToken(isServer) {
-    var _a, _b, _c, _d, _e;
-    const currentToken = await getIdToken(isServer);
-    if (!currentToken) {
-        if (ambientAuthFailure) {
-            throw ambientAuthFailure;
-        }
-        return null;
-    }
-    if (!isTokenExpired(currentToken)) {
-        ambientAuthFailure = null;
-        return currentToken;
-    }
-    if (ambientAuthFailure) {
+/**
+ * WS-local wrapper around the shared freshness helper.
+ *
+ * The shared helper owns expiry classification, the deduplicated
+ * snapshot -> refresh -> commit transaction, and conditional clearing. This adds
+ * only the WS-specific storm guard: without it, a dead session would retry the
+ * refresh on every reconnect attempt and every 5-minute tick.
+ */
+async function getWsAuthToken(isServer) {
+    var _a, _b;
+    // A remembered failure short-circuits, but only while a session still exists.
+    // See rememberAmbientAuthFailure: once storage is cleared the correct next move
+    // is an anonymous connection, not a replayed error.
+    if (ambientAuthFailure && getIdTokenSync()) {
         throw ambientAuthFailure;
     }
-    // Token is expired — attempt refresh
-    const refreshToken = await getRefreshToken(isServer);
-    if (!refreshToken) {
-        console.warn('[WS v2] Token expired but no refresh token available');
-        throw rememberAmbientAuthFailure(makeAuthExpiredError('Authentication expired and no refresh token is available'));
-    }
     try {
-        const refreshData = await refreshSession(refreshToken, getSessionIssuer(isServer));
-        if (refreshData && refreshData.idToken && refreshData.accessToken) {
-            await updateIdTokenAndAccessToken(refreshData.idToken, refreshData.accessToken, isServer, refreshData.refreshToken);
-            ambientAuthFailure = null;
-            return refreshData.idToken;
-        }
-        throw makeAuthExpiredError('Authentication refresh returned an incomplete session');
+        const token = await getFreshAuthToken(isServer);
+        ambientAuthFailure = null;
+        return token;
     }
     catch (error) {
-        // Log only the status — the raw axios error carries config.data (the refresh
-        // token) and must never reach the console / log sinks.
-        console.error('[WS v2] Error refreshing token. status:', (_c = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code) !== null && _c !== void 0 ? _c : 'unknown');
-        // If the refresh token is permanently invalid (401/403), clear the stale
-        // session from storage so future attempts don't keep retrying with it.
-        if (!isServer && (((_d = error === null || error === void 0 ? void 0 : error.response) === null || _d === void 0 ? void 0 : _d.status) === 401 || ((_e = error === null || error === void 0 ? void 0 : error.response) === null || _e === void 0 ? void 0 : _e.status) === 403)) {
-            try {
-                const { getActiveSessionManager } = await Promise.resolve().then(function () { return sessionManager; });
-                getActiveSessionManager().clearSession();
-            }
-            catch (clearError) {
-                console.warn('[WS v2] Failed to clear stale session:', clearError);
-            }
-        }
+        // Status only — the raw axios error carries config.data (the refresh token)
+        // and must never reach a console or log sink.
+        console.error('[WS v2] Error acquiring auth token. status:', (_b = (_a = error === null || error === void 0 ? void 0 : error.status) !== null && _a !== void 0 ? _a : error === null || error === void 0 ? void 0 : error.code) !== null && _b !== void 0 ? _b : 'unknown');
         throw rememberAmbientAuthFailure(normalizeAuthExpiredError(error, 'Authentication expired and refresh failed'));
     }
 }
@@ -4648,7 +5284,10 @@ async function getConnectionAuthToken(isServer, authTokenProvider, anonymous) {
         return null;
     }
     if (!authTokenProvider) {
-        return getFreshAuthToken(isServer);
+        // getWsAuthToken, not the shared helper directly: the wrapper carries the
+        // reconnect-storm guard that keeps a dead session from re-refreshing on
+        // every reconnect attempt.
+        return getWsAuthToken(isServer);
     }
     try {
         const token = await authTokenProvider();
@@ -6008,7 +6647,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-BSuV-Vyr.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-DKngqviG.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -7715,11 +8354,11 @@ async function setMany(many, options) {
                 transactionResult = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
             }
             else if (curTx.serializedTransaction) {
-                const { handlePreBuiltTransaction } = await import('./solana-operations-CuYFYlyN.mjs');
+                const { handlePreBuiltTransaction } = await import('./solana-operations-B2Oy9T7D.mjs');
                 transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             else {
-                const { handleSolanaTransaction } = await import('./solana-operations-CuYFYlyN.mjs');
+                const { handleSolanaTransaction } = await import('./solana-operations-B2Oy9T7D.mjs');
                 transactionResult = await handleSolanaTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             // Sync items after all transactions are confirmed
@@ -8818,7 +9457,7 @@ async function buildSetDocumentsTransaction(connection, idl, programProvider, pa
 }
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-C2_VvNX7.mjs');
+    const implementation = await import('./solana-message-QUfJi1Qm.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
@@ -9360,5 +9999,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { getActiveSessionManager as $, getCachedData as A, reconnectWithNewAuth as B, createClient as C, subscribeQuery as D, closeAllQuerySubscriptions as E, canonicalizeArgs as F, canonicalizeResult as G, DEFAULT_QUERY_POLL_INTERVAL_MS as H, InsufficientBalanceError as I, BoundedDeclineError as J, deriveDecline as K, dispatchDeclineEvent as L, MIN_QUERY_POLL_INTERVAL_MS as M, DECLINE_EVENT_NAME as N, dispatchRateLimitEvent as O, hasActiveConnection as P, increment as Q, RATE_LIMIT_EVENT_NAME as R, ScopedClientReadOnlyError as S, serverTimestamp as T, now as U, toSeconds as V, toMillis as W, getIdToken as X, deriveUserIdentityFromIdToken as Y, WebSessionManager as Z, ReactNativeSessionManager as _, getWebhookKeysUrl as a, ServerSessionManager as a0, createSessionWithSignature as a1, refreshSession as a2, revokeSession as a3, signSessionCreateMessage as a4, genAuthNonce as a5, buildSetDocumentsTransaction as a6, convertRemainingAccounts as a7, genSolanaMessage as a8, genSiweMessage as a9, normalizeEvmAddress as aa, toLowerEvmAddress as ab, assertCanonicalBoundedRuntimeWriteCalldata as ac, assertEvmTransactionMatchesWrite as ad, BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR as ae, BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR as af, functions as ag, invoke as ah, FunctionInvokeError as ai, live as aj, intent as ak, status as al, subscribeView as am, LiveIntentError as an, withEffects as ao, isEffectResult as ap, defineLiveModule as aq, EFFECT_INTENT_ADDRESS as ar, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, runQueryMany as m, runExpression as n, runExpressionMany as o, signMessage as p, queryAggregate as q, runQuery as r, set as s, signTransaction as t, signAndSubmitTransaction as u, count as v, aggregate as w, subscribe as x, closeAllSubscriptions as y, clearCache as z };
-//# sourceMappingURL=index-DYbzK8YT.mjs.map
+export { getActiveSessionManager as $, getCachedData as A, reconnectWithNewAuth as B, createClient as C, subscribeQuery as D, closeAllQuerySubscriptions as E, canonicalizeArgs as F, canonicalizeResult as G, DEFAULT_QUERY_POLL_INTERVAL_MS as H, InsufficientBalanceError as I, BoundedDeclineError as J, deriveDecline as K, dispatchDeclineEvent as L, MIN_QUERY_POLL_INTERVAL_MS as M, DECLINE_EVENT_NAME as N, dispatchRateLimitEvent as O, hasActiveConnection as P, increment as Q, RATE_LIMIT_EVENT_NAME as R, ScopedClientReadOnlyError as S, serverTimestamp as T, now as U, toSeconds as V, toMillis as W, getIdToken as X, deriveUserIdentityFromIdToken as Y, WebSessionManager as Z, ReactNativeSessionManager as _, getWebhookKeysUrl as a, onSessionCleared as a0, SessionEnvironmentError as a1, UNSUPPORTED_ENVIRONMENT_CODE as a2, AUTH_CHANGED_CODE as a3, AUTH_EXPIRED_CODE as a4, isAuthExpiredError as a5, ServerSessionManager as a6, createSessionWithSignature as a7, refreshSession as a8, revokeSession as a9, signSessionCreateMessage as aa, genAuthNonce as ab, buildSetDocumentsTransaction as ac, convertRemainingAccounts as ad, genSolanaMessage as ae, genSiweMessage as af, normalizeEvmAddress as ag, toLowerEvmAddress as ah, assertCanonicalBoundedRuntimeWriteCalldata as ai, assertEvmTransactionMatchesWrite as aj, BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR as ak, BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR as al, functions as am, invoke as an, FunctionInvokeError as ao, live as ap, intent as aq, status as ar, subscribeView as as, LiveIntentError as at, withEffects as au, isEffectResult as av, defineLiveModule as aw, EFFECT_INTENT_ADDRESS as ax, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, runQueryMany as m, runExpression as n, runExpressionMany as o, signMessage as p, queryAggregate as q, runQuery as r, set as s, signTransaction as t, signAndSubmitTransaction as u, count as v, aggregate as w, subscribe as x, closeAllSubscriptions as y, clearCache as z };
+//# sourceMappingURL=index-BQ6e4MeP.mjs.map