@bounded-sh/core 0.0.69 → 0.0.70

package/dist/{index-DlJKTmRv.js → index-CqTl6vHg.js}

@@ -4045,7 +4045,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-DnV4FQ__.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-BecAT47y.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -5406,6 +5406,35 @@ async function getWsAuthToken(isServer) {
         throw rememberAmbientAuthFailure(normalizeAuthExpiredError(error, 'Authentication expired and refresh failed'));
     }
 }
+/**
+ * The server refused the token sent on the auth frame: its error frame arrives
+ * while the auth ack is still pending, just before the 1008 close. Local expiry
+ * had vouched for that exact token (unexpired but invalid - e.g. a rotated
+ * issuer key), so re-sending it would only be refused again. Force a genuinely
+ * new one: a definitive issuer rejection clears the session inside the shared
+ * helper (firing notifySessionCleared, which signs the UI out), a successful
+ * refresh commits a new token - and the ordinary reconnect loop picks up either
+ * outcome on its own. Fresh token: authenticates. No token: connects
+ * anonymously and public reads replay instead of erroring forever.
+ */
+async function recoverFromServerAuthRejection(connection) {
+    const rejected = connection.pendingAuthToken;
+    if (!rejected)
+        return;
+    // One forced refresh per distinct rejected token value: a transiently
+    // unreachable issuer must not turn the reconnect loop into a refresh storm.
+    if (connection.serverRejectedAuthToken === rejected)
+        return;
+    connection.serverRejectedAuthToken = rejected;
+    try {
+        await getFreshAuthToken(connection.isServer, { force: true });
+    }
+    catch (_a) {
+        // Every failure mode is already handled inside the helper: a dead
+        // session was cleared (auth listeners notified), a transient refresh
+        // failure keeps the session and the latch above stops the storm.
+    }
+}
 async function getConnectionAuthToken(isServer, authTokenProvider, anonymous) {
     // A read-only scoped instance connects anonymously: no auth frame, and it
     // must never read (or refresh) the ambient global session - that session
@@ -5729,6 +5758,8 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         authFailure: null,
         source,
         anonymous,
+        isServer,
+        serverRejectedAuthToken: null,
     };
     connections.set(connKey, connection);
     // URL provider for reconnection with fresh tokens
@@ -5994,6 +6025,16 @@ function handleServerMessage(connection, message) {
         }
         case 'error': {
             console.error('[WS v2] Server error:', message.code, message.message);
+            // The auth frame was just refused: while the auth ack is pending the
+            // server sends no other error frame, and this one is immediately
+            // followed by its 1008 close. Kick the forced-refresh recovery - the
+            // ordinary reconnect loop then re-auths with a fresh token or, once a
+            // definitively dead session is cleared, connects anonymously so
+            // public reads still replay. Ambient connections only: wallet-scoped
+            // connections refresh through their own provider.
+            if (connection.isAuthenticating && connection.pendingAuthToken && !connection.authTokenProvider && !connection.anonymous) {
+                void recoverFromServerAuthRejection(connection);
+            }
             // Build an Error that ALSO carries the stable `code` as a structured
             // field (not just string-interpolated into the message) so callers can
             // branch on it — e.g. `catch (e) { if (e.code === 'invariant_violation') }`
@@ -6777,7 +6818,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-CkgpUOrE.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-DfeKV55-.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8220,7 +8261,7 @@ async function setMany(many, options) {
                         'Nothing was signed or submitted.');
                 }
                 const solanaChain = workerChain;
-                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-DPul1dWo.js'); });
+                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-uN89eqO2.js'); });
                 const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
                 // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
                 // and there is nothing to mirror, so no synchronization is attempted.
@@ -9661,7 +9702,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-DnV4FQ__.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-BecAT47y.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -10222,4 +10263,4 @@ exports.toMillis = toMillis;
 exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
-//# sourceMappingURL=index-DlJKTmRv.js.map
+//# sourceMappingURL=index-CqTl6vHg.js.map