@bounded-sh/core 0.0.69 → 0.0.71

package/dist/client/config.d.ts

@@ -70,6 +70,17 @@ export interface ClientConfig {
      *  'privy-expo' because @privy-io/expo is hook-based and must be rendered by
      *  the RN component tree (see PrivyExpoProvider). */
     privyExpoProvider?: AuthProvider;
+    /** Solana Mobile Wallet Adapter (Saga/Seeker) registration tuning. Wallet
+     *  login already surfaces the device wallet automatically on capable Android
+     *  browsers (the SDK registers MWA as a Wallet-Standard wallet whenever the
+     *  wallet lane is active), so this is OPTIONAL and only overrides defaults:
+     *  appIdentity (defaults to config.name/logoUrl + the page origin; per the
+     *  MWA spec `icon` is a path RELATIVE to `uri`), cluster ('mainnet-beta' |
+     *  'devnet' - the mobile wallet authorizes per cluster and signs on the app's
+     *  chain, so this may NAME the chain a chainless app authorizes on but may
+     *  never contradict `chain`; a contradiction throws), and remoteHostAuthority
+     *  (a reflector websocket authority that additionally enables the desktop
+     *  QR-code "connect your phone" lane). */
     mobileWalletConfig?: {
         appIdentity?: {
             name?: string;
@@ -77,7 +88,7 @@ export interface ClientConfig {
             icon?: string;
         };
         cluster?: string;
-        theme?: 'light' | 'dark';
+        remoteHostAuthority?: string;
     };
     /** OPT-IN gate for Solana WALLET LOGIN (authMethod:'phantom' / 'wallet').
      *  OFF BY DEFAULT — the vast majority of apps never support wallets, so the
@@ -91,6 +102,13 @@ export interface ClientConfig {
         getProvider?: () => any;
         network?: string | null;
         rpcUrl?: string | null;
+        /** Awaited immediately before every wallet operation, after all async
+         *  preparation, so the app can collect a fresh user gesture. Required for
+         *  Solana Mobile (Saga/Seeker): each operation dispatches an Android intent
+         *  through window.location.assign, which Chrome blocks without transient
+         *  activation. Reject to abort the operation. Leave unset for injected
+         *  wallets, which sign in-page. */
+        confirmWalletAction?: (action: 'connect' | 'login' | 'signMessage' | 'signTransaction' | 'signAndSubmitTransaction') => Promise<void>;
     };
     /** LOGIN MODE for the unified login widget (default 'turnkey'). 'turnkey' runs
      *  Turnkey-native email OTP INLINE in the widget (no second Bounded OTP).
@@ -124,6 +142,9 @@ export interface ClientConfig {
         getProvider?: () => any;
         network?: string | null;
         rpcUrl?: string | null;
+        /** See walletLogin.confirmWalletAction - the fresh-gesture hook Solana
+         *  Mobile needs before each wallet operation. */
+        confirmWalletAction?: (action: 'connect' | 'login' | 'signMessage' | 'signTransaction' | 'signAndSubmitTransaction') => Promise<void>;
     };
     /** EVM WALLET LOGIN provider configuration (authMethod:'evm-wallet'). The EVM
      *  twin of injectedWalletConfig: a slim, dependency-free "connect an Ethereum

package/dist/{index-B3aNfGi6.mjs → index-P4eUuhOB.mjs}

@@ -23,7 +23,8 @@ const DEFAULT_CLIENT_CONFIG = {
     // No hidden modal fallback: browser clients start hosted Bounded Auth with
     // loginWithRedirect/loginWithPopup. For crypto/onchain wallet login use
     // authMethod:'phantom' (Solana / Phantom), and use signInAnonymously() for
-    // zero-friction guest accounts. ('wallet' is an unimplemented stub; don't use.)
+    // zero-friction guest accounts. ('wallet' and 'mobile-wallet-adapter' are
+    // accepted spellings of the same lane and canonicalize to 'phantom'.)
     authMethod: 'none',
     chain: '',
     rpcUrl: '',
@@ -640,6 +641,53 @@ async function revokeSession(refreshToken, issuer) {
 async function signSessionCreateMessage(_signMessageFunction) {
 }
 
+// Classify a session-refresh failure as a DEFINITIVE rejection of the credential
+// vs a TRANSPORT failure (DS4-0054).
+//
+// The restore path refreshes an expired token at boot. The old code destroyed the
+// local session on ANY refresh failure, so a network blip - common on mobile -
+// signed the user out. Only a real HTTP rejection of the refresh token proves the
+// session is invalid; anything else is unknown, and the safe move is to RETAIN local
+// state and retry. Keeping a genuinely dead session locally is harmless: every
+// request still fails closed server-side, and the next refresh that reaches the
+// server clears it. Destroying a live session on a blip is user-visible damage.
+//
+// `/session/refresh` answers 401 (session_revoked / invalid_grant) when the token is
+// dead. 400 (bad request), 408/429 (transient), and 5xx are NOT proof the session is
+// invalid, and a network/DNS/timeout error carries no HTTP response at all.
+//
+// This is the single classifier for every refresh path: the per-request freshness
+// check (auth-token-freshness) and the boot-time restore paths (web + RN session
+// managers) all import it, so "definitive" means the same thing everywhere. It lives
+// in this leaf module to avoid an import cycle between those consumers.
+function isDefinitiveRejection(err) {
+    var _a;
+    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
+    return status === 401 || status === 403;
+}
+// How long past the id token's own `exp` a session may survive purely on
+// transport failures.
+//
+// "Retain on a blip" must not become "retain forever". A statusless failure is
+// unknown, so the first ones are absorbed - but a revoked session, or a gateway
+// that rewrites the issuer's 401 into a 502, would otherwise keep
+// isAuthenticated() reporting a signed-in user for as long as the device never
+// reaches the issuer again. One day covers an offline flight or a bad-network day
+// while making the retention finite: past it, an unrefreshable session is cleared
+// and the user is asked to sign in again.
+const TRANSPORT_RETENTION_GRACE_MS = 24 * 60 * 60 * 1000;
+/**
+ * May a session whose refresh failed WITHOUT a definitive rejection be kept?
+ *
+ * `expSeconds` is the id token's `exp` claim. Fails closed: a missing or
+ * non-numeric expiry is not a usable bound, so such a session is never retained.
+ */
+function mayRetainAfterTransportFailure(expSeconds, now = Date.now()) {
+    if (typeof expSeconds !== 'number' || !Number.isFinite(expSeconds))
+        return false;
+    return now <= expSeconds * 1000 + TRANSPORT_RETENTION_GRACE_MS;
+}
+
 // Shared session-binding guard for the web + React Native session managers, so
 // the cross-principal refresh guard (#220 / #221) lives in ONE place and the two
 // managers can't drift apart. Base64url decoding differs by platform (browser
@@ -1021,7 +1069,26 @@ class WebSessionManager {
                     await this.clearSessionIfGeneration(generation);
                     return null;
                 }
-                const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                let refreshed;
+                try {
+                    refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                }
+                catch (refreshErr) {
+                    // DS4-0054: only a DEFINITIVE server rejection (401/403) proves the
+                    // refresh token is dead. A transport failure - offline, DNS, timeout,
+                    // 5xx - is unknown, not proof the session is invalid. Destroying local
+                    // state here signs the user out on a network blip (common on mobile),
+                    // so RETAIN it and return the existing session; the next request will
+                    // retry the refresh. The retention is BOUNDED by the token's own
+                    // expiry plus a grace window, so a revoked session - or an issuer 401
+                    // a gateway rewrote into a 5xx - cannot keep isAuthenticated() true
+                    // forever on a device that never reaches the issuer again.
+                    if (isDefinitiveRejection(refreshErr) || !mayRetainAfterTransportFailure(exp)) {
+                        await this.clearSessionIfGeneration(generation);
+                        return null;
+                    }
+                    return { address: sessionObj.address, session: sessionObj };
+                }
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
                     const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, 
                     // Persist the ROTATED refresh token — the old one is now
@@ -1042,8 +1109,9 @@ class WebSessionManager {
                         return null;
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops, but only
-                // if it is still the session we set out to refresh.
+                // The server answered but issued no usable tokens - a definitive refusal,
+                // not a transport failure - so clear the stale session to stop retry loops,
+                // but only if it is still the session we set out to refresh.
                 await this.clearSessionIfGeneration(generation);
                 return null;
             }
@@ -1429,7 +1497,26 @@ class ReactNativeSessionManager {
                     await this.clearSessionIfGeneration(generation);
                     return null;
                 }
-                const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                let refreshed;
+                try {
+                    refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                }
+                catch (refreshErr) {
+                    // DS4-0054: only a DEFINITIVE server rejection (401/403) proves the
+                    // refresh token is dead. A transport failure - offline, DNS, timeout,
+                    // 5xx - is unknown, not proof the session is invalid. On mobile these
+                    // blips are common, so destroying local state here signs the user out
+                    // on a bad network. RETAIN it and return the existing session; the next
+                    // request retries the refresh. The retention is BOUNDED by the token's
+                    // own expiry plus a grace window, so a revoked session - or an issuer
+                    // 401 a gateway rewrote into a 5xx - cannot keep isAuthenticated() true
+                    // forever on a device that never reaches the issuer again.
+                    if (isDefinitiveRejection(refreshErr) || !mayRetainAfterTransportFailure(exp)) {
+                        await this.clearSessionIfGeneration(generation);
+                        return null;
+                    }
+                    return { address: sessionObj.address, session: sessionObj };
+                }
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
                     const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
                     // Superseded means a login or logout landed mid-refresh. Returning
@@ -1446,8 +1533,9 @@ class ReactNativeSessionManager {
                         return null;
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops, but only
-                // if it is still the session we set out to refresh.
+                // The server answered but issued no usable tokens - a definitive refusal,
+                // not a transport failure - so clear the stale session to stop retry loops,
+                // but only if it is still the session we set out to refresh.
                 await this.clearSessionIfGeneration(generation);
                 return null;
             }
@@ -4043,7 +4131,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-AXfv2U1S.mjs');
+        const { genSolanaMessage } = await import('./solana-message-x8ElgC9P.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4415,11 +4503,6 @@ const refreshTransactions = new Map();
 function transactionKey(scope, appId, generation, refreshToken) {
     return `${scope}:${appId}:${generation !== null && generation !== void 0 ? generation : 'none'}:${tokenFingerprint(refreshToken)}`;
 }
-function isDefinitiveRejection(error) {
-    var _a;
-    const status = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status;
-    return status === 401 || status === 403;
-}
 async function readSessionParts(isServer) {
     var _a, _b, _c, _d, _e, _f;
     if (isServer) {
@@ -5404,6 +5487,35 @@ async function getWsAuthToken(isServer) {
         throw rememberAmbientAuthFailure(normalizeAuthExpiredError(error, 'Authentication expired and refresh failed'));
     }
 }
+/**
+ * The server refused the token sent on the auth frame: its error frame arrives
+ * while the auth ack is still pending, just before the 1008 close. Local expiry
+ * had vouched for that exact token (unexpired but invalid - e.g. a rotated
+ * issuer key), so re-sending it would only be refused again. Force a genuinely
+ * new one: a definitive issuer rejection clears the session inside the shared
+ * helper (firing notifySessionCleared, which signs the UI out), a successful
+ * refresh commits a new token - and the ordinary reconnect loop picks up either
+ * outcome on its own. Fresh token: authenticates. No token: connects
+ * anonymously and public reads replay instead of erroring forever.
+ */
+async function recoverFromServerAuthRejection(connection) {
+    const rejected = connection.pendingAuthToken;
+    if (!rejected)
+        return;
+    // One forced refresh per distinct rejected token value: a transiently
+    // unreachable issuer must not turn the reconnect loop into a refresh storm.
+    if (connection.serverRejectedAuthToken === rejected)
+        return;
+    connection.serverRejectedAuthToken = rejected;
+    try {
+        await getFreshAuthToken(connection.isServer, { force: true });
+    }
+    catch (_a) {
+        // Every failure mode is already handled inside the helper: a dead
+        // session was cleared (auth listeners notified), a transient refresh
+        // failure keeps the session and the latch above stops the storm.
+    }
+}
 async function getConnectionAuthToken(isServer, authTokenProvider, anonymous) {
     // A read-only scoped instance connects anonymously: no auth frame, and it
     // must never read (or refresh) the ambient global session - that session
@@ -5727,6 +5839,8 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         authFailure: null,
         source,
         anonymous,
+        isServer,
+        serverRejectedAuthToken: null,
     };
     connections.set(connKey, connection);
     // URL provider for reconnection with fresh tokens
@@ -5992,6 +6106,16 @@ function handleServerMessage(connection, message) {
         }
         case 'error': {
             console.error('[WS v2] Server error:', message.code, message.message);
+            // The auth frame was just refused: while the auth ack is pending the
+            // server sends no other error frame, and this one is immediately
+            // followed by its 1008 close. Kick the forced-refresh recovery - the
+            // ordinary reconnect loop then re-auths with a fresh token or, once a
+            // definitively dead session is cleared, connects anonymously so
+            // public reads still replay. Ambient connections only: wallet-scoped
+            // connections refresh through their own provider.
+            if (connection.isAuthenticating && connection.pendingAuthToken && !connection.authTokenProvider && !connection.anonymous) {
+                void recoverFromServerAuthRejection(connection);
+            }
             // Build an Error that ALSO carries the stable `code` as a structured
             // field (not just string-interpolated into the message) so callers can
             // branch on it — e.g. `catch (e) { if (e.code === 'invariant_violation') }`
@@ -6775,7 +6899,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-i8pxSuZE.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-Bcnv3f0g.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8218,7 +8342,7 @@ async function setMany(many, options) {
                         'Nothing was signed or submitted.');
                 }
                 const solanaChain = workerChain;
-                const { handlePreBuiltTransaction } = await import('./solana-operations-Bte92rmq.mjs');
+                const { handlePreBuiltTransaction } = await import('./solana-operations-DEWIxJS8.mjs');
                 const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
                 // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
                 // and there is nothing to mirror, so no synchronization is attempted.
@@ -9659,7 +9783,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-AXfv2U1S.mjs');
+    const implementation = await import('./solana-message-x8ElgC9P.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -10135,4 +10259,4 @@ function defineLiveModule(mod) {
 }
 
 export { getSessionGeneration as $, closeAllSubscriptions as A, clearCache as B, getCachedData as C, reconnectWithNewAuth as D, createClient as E, subscribeQuery as F, closeAllQuerySubscriptions as G, canonicalizeArgs as H, InsufficientBalanceError as I, canonicalizeResult as J, DEFAULT_QUERY_POLL_INTERVAL_MS as K, BoundedDeclineError as L, MIN_QUERY_POLL_INTERVAL_MS as M, deriveDecline as N, dispatchDeclineEvent as O, DECLINE_EVENT_NAME as P, dispatchRateLimitEvent as Q, RATE_LIMIT_EVENT_NAME as R, ScopedClientReadOnlyError as S, hasActiveConnection as T, increment as U, serverTimestamp as V, now as W, toSeconds as X, toMillis as Y, getIdToken as Z, deriveUserIdentityFromIdToken as _, getWebhookKeysUrl as a, WebSessionManager as a0, ReactNativeSessionManager as a1, getActiveSessionManager as a2, onSessionCleared as a3, SessionEnvironmentError as a4, UNSUPPORTED_ENVIRONMENT_CODE as a5, AUTH_CHANGED_CODE as a6, AUTH_EXPIRED_CODE as a7, isAuthExpiredError as a8, getFreshAuthToken as a9, ServerSessionManager as aa, createSessionWithSignature as ab, refreshSession as ac, revokeSession as ad, signSessionCreateMessage as ae, genAuthNonce as af, genSolanaMessage as ag, genSiweMessage as ah, normalizeEvmAddress as ai, toLowerEvmAddress as aj, functions as ak, invoke as al, FunctionInvokeError as am, live as an, intent as ao, status as ap, subscribeView as aq, LiveIntentError as ar, withEffects as as, isEffectResult as at, defineLiveModule as au, EFFECT_INTENT_ADDRESS as av, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, runQueryMany as m, runExpression as n, runExpressionMany as o, signMessage as p, queryAggregate as q, runQuery as r, set as s, signTransaction as t, signAndSubmitTransaction as u, count as v, aggregate as w, reconcileSetResult as x, waitForSetResult as y, subscribe as z };
-//# sourceMappingURL=index-B3aNfGi6.mjs.map
+//# sourceMappingURL=index-P4eUuhOB.mjs.map