@bounded-sh/core 0.0.69 → 0.0.71

package/dist/{index-DlJKTmRv.js → index-yT8ZfzrL.js}

@@ -25,7 +25,8 @@ const DEFAULT_CLIENT_CONFIG = {
     // No hidden modal fallback: browser clients start hosted Bounded Auth with
     // loginWithRedirect/loginWithPopup. For crypto/onchain wallet login use
     // authMethod:'phantom' (Solana / Phantom), and use signInAnonymously() for
-    // zero-friction guest accounts. ('wallet' is an unimplemented stub; don't use.)
+    // zero-friction guest accounts. ('wallet' and 'mobile-wallet-adapter' are
+    // accepted spellings of the same lane and canonicalize to 'phantom'.)
     authMethod: 'none',
     chain: '',
     rpcUrl: '',
@@ -642,6 +643,53 @@ async function revokeSession(refreshToken, issuer) {
 async function signSessionCreateMessage(_signMessageFunction) {
 }
 
+// Classify a session-refresh failure as a DEFINITIVE rejection of the credential
+// vs a TRANSPORT failure (DS4-0054).
+//
+// The restore path refreshes an expired token at boot. The old code destroyed the
+// local session on ANY refresh failure, so a network blip - common on mobile -
+// signed the user out. Only a real HTTP rejection of the refresh token proves the
+// session is invalid; anything else is unknown, and the safe move is to RETAIN local
+// state and retry. Keeping a genuinely dead session locally is harmless: every
+// request still fails closed server-side, and the next refresh that reaches the
+// server clears it. Destroying a live session on a blip is user-visible damage.
+//
+// `/session/refresh` answers 401 (session_revoked / invalid_grant) when the token is
+// dead. 400 (bad request), 408/429 (transient), and 5xx are NOT proof the session is
+// invalid, and a network/DNS/timeout error carries no HTTP response at all.
+//
+// This is the single classifier for every refresh path: the per-request freshness
+// check (auth-token-freshness) and the boot-time restore paths (web + RN session
+// managers) all import it, so "definitive" means the same thing everywhere. It lives
+// in this leaf module to avoid an import cycle between those consumers.
+function isDefinitiveRejection(err) {
+    var _a;
+    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
+    return status === 401 || status === 403;
+}
+// How long past the id token's own `exp` a session may survive purely on
+// transport failures.
+//
+// "Retain on a blip" must not become "retain forever". A statusless failure is
+// unknown, so the first ones are absorbed - but a revoked session, or a gateway
+// that rewrites the issuer's 401 into a 502, would otherwise keep
+// isAuthenticated() reporting a signed-in user for as long as the device never
+// reaches the issuer again. One day covers an offline flight or a bad-network day
+// while making the retention finite: past it, an unrefreshable session is cleared
+// and the user is asked to sign in again.
+const TRANSPORT_RETENTION_GRACE_MS = 24 * 60 * 60 * 1000;
+/**
+ * May a session whose refresh failed WITHOUT a definitive rejection be kept?
+ *
+ * `expSeconds` is the id token's `exp` claim. Fails closed: a missing or
+ * non-numeric expiry is not a usable bound, so such a session is never retained.
+ */
+function mayRetainAfterTransportFailure(expSeconds, now = Date.now()) {
+    if (typeof expSeconds !== 'number' || !Number.isFinite(expSeconds))
+        return false;
+    return now <= expSeconds * 1000 + TRANSPORT_RETENTION_GRACE_MS;
+}
+
 // Shared session-binding guard for the web + React Native session managers, so
 // the cross-principal refresh guard (#220 / #221) lives in ONE place and the two
 // managers can't drift apart. Base64url decoding differs by platform (browser
@@ -1023,7 +1071,26 @@ class WebSessionManager {
                     await this.clearSessionIfGeneration(generation);
                     return null;
                 }
-                const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                let refreshed;
+                try {
+                    refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                }
+                catch (refreshErr) {
+                    // DS4-0054: only a DEFINITIVE server rejection (401/403) proves the
+                    // refresh token is dead. A transport failure - offline, DNS, timeout,
+                    // 5xx - is unknown, not proof the session is invalid. Destroying local
+                    // state here signs the user out on a network blip (common on mobile),
+                    // so RETAIN it and return the existing session; the next request will
+                    // retry the refresh. The retention is BOUNDED by the token's own
+                    // expiry plus a grace window, so a revoked session - or an issuer 401
+                    // a gateway rewrote into a 5xx - cannot keep isAuthenticated() true
+                    // forever on a device that never reaches the issuer again.
+                    if (isDefinitiveRejection(refreshErr) || !mayRetainAfterTransportFailure(exp)) {
+                        await this.clearSessionIfGeneration(generation);
+                        return null;
+                    }
+                    return { address: sessionObj.address, session: sessionObj };
+                }
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
                     const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, 
                     // Persist the ROTATED refresh token — the old one is now
@@ -1044,8 +1111,9 @@ class WebSessionManager {
                         return null;
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops, but only
-                // if it is still the session we set out to refresh.
+                // The server answered but issued no usable tokens - a definitive refusal,
+                // not a transport failure - so clear the stale session to stop retry loops,
+                // but only if it is still the session we set out to refresh.
                 await this.clearSessionIfGeneration(generation);
                 return null;
             }
@@ -1431,7 +1499,26 @@ class ReactNativeSessionManager {
                     await this.clearSessionIfGeneration(generation);
                     return null;
                 }
-                const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                let refreshed;
+                try {
+                    refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                }
+                catch (refreshErr) {
+                    // DS4-0054: only a DEFINITIVE server rejection (401/403) proves the
+                    // refresh token is dead. A transport failure - offline, DNS, timeout,
+                    // 5xx - is unknown, not proof the session is invalid. On mobile these
+                    // blips are common, so destroying local state here signs the user out
+                    // on a bad network. RETAIN it and return the existing session; the next
+                    // request retries the refresh. The retention is BOUNDED by the token's
+                    // own expiry plus a grace window, so a revoked session - or an issuer
+                    // 401 a gateway rewrote into a 5xx - cannot keep isAuthenticated() true
+                    // forever on a device that never reaches the issuer again.
+                    if (isDefinitiveRejection(refreshErr) || !mayRetainAfterTransportFailure(exp)) {
+                        await this.clearSessionIfGeneration(generation);
+                        return null;
+                    }
+                    return { address: sessionObj.address, session: sessionObj };
+                }
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
                     const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
                     // Superseded means a login or logout landed mid-refresh. Returning
@@ -1448,8 +1535,9 @@ class ReactNativeSessionManager {
                         return null;
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops, but only
-                // if it is still the session we set out to refresh.
+                // The server answered but issued no usable tokens - a definitive refusal,
+                // not a transport failure - so clear the stale session to stop retry loops,
+                // but only if it is still the session we set out to refresh.
                 await this.clearSessionIfGeneration(generation);
                 return null;
             }
@@ -4045,7 +4133,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-DnV4FQ__.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-Dh9ryO-Y.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4417,11 +4505,6 @@ const refreshTransactions = new Map();
 function transactionKey(scope, appId, generation, refreshToken) {
     return `${scope}:${appId}:${generation !== null && generation !== void 0 ? generation : 'none'}:${tokenFingerprint(refreshToken)}`;
 }
-function isDefinitiveRejection(error) {
-    var _a;
-    const status = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status;
-    return status === 401 || status === 403;
-}
 async function readSessionParts(isServer) {
     var _a, _b, _c, _d, _e, _f;
     if (isServer) {
@@ -5406,6 +5489,35 @@ async function getWsAuthToken(isServer) {
         throw rememberAmbientAuthFailure(normalizeAuthExpiredError(error, 'Authentication expired and refresh failed'));
     }
 }
+/**
+ * The server refused the token sent on the auth frame: its error frame arrives
+ * while the auth ack is still pending, just before the 1008 close. Local expiry
+ * had vouched for that exact token (unexpired but invalid - e.g. a rotated
+ * issuer key), so re-sending it would only be refused again. Force a genuinely
+ * new one: a definitive issuer rejection clears the session inside the shared
+ * helper (firing notifySessionCleared, which signs the UI out), a successful
+ * refresh commits a new token - and the ordinary reconnect loop picks up either
+ * outcome on its own. Fresh token: authenticates. No token: connects
+ * anonymously and public reads replay instead of erroring forever.
+ */
+async function recoverFromServerAuthRejection(connection) {
+    const rejected = connection.pendingAuthToken;
+    if (!rejected)
+        return;
+    // One forced refresh per distinct rejected token value: a transiently
+    // unreachable issuer must not turn the reconnect loop into a refresh storm.
+    if (connection.serverRejectedAuthToken === rejected)
+        return;
+    connection.serverRejectedAuthToken = rejected;
+    try {
+        await getFreshAuthToken(connection.isServer, { force: true });
+    }
+    catch (_a) {
+        // Every failure mode is already handled inside the helper: a dead
+        // session was cleared (auth listeners notified), a transient refresh
+        // failure keeps the session and the latch above stops the storm.
+    }
+}
 async function getConnectionAuthToken(isServer, authTokenProvider, anonymous) {
     // A read-only scoped instance connects anonymously: no auth frame, and it
     // must never read (or refresh) the ambient global session - that session
@@ -5729,6 +5841,8 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         authFailure: null,
         source,
         anonymous,
+        isServer,
+        serverRejectedAuthToken: null,
     };
     connections.set(connKey, connection);
     // URL provider for reconnection with fresh tokens
@@ -5994,6 +6108,16 @@ function handleServerMessage(connection, message) {
         }
         case 'error': {
             console.error('[WS v2] Server error:', message.code, message.message);
+            // The auth frame was just refused: while the auth ack is pending the
+            // server sends no other error frame, and this one is immediately
+            // followed by its 1008 close. Kick the forced-refresh recovery - the
+            // ordinary reconnect loop then re-auths with a fresh token or, once a
+            // definitively dead session is cleared, connects anonymously so
+            // public reads still replay. Ambient connections only: wallet-scoped
+            // connections refresh through their own provider.
+            if (connection.isAuthenticating && connection.pendingAuthToken && !connection.authTokenProvider && !connection.anonymous) {
+                void recoverFromServerAuthRejection(connection);
+            }
             // Build an Error that ALSO carries the stable `code` as a structured
             // field (not just string-interpolated into the message) so callers can
             // branch on it — e.g. `catch (e) { if (e.code === 'invariant_violation') }`
@@ -6777,7 +6901,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-CkgpUOrE.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-BDpIOFMH.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8220,7 +8344,7 @@ async function setMany(many, options) {
                         'Nothing was signed or submitted.');
                 }
                 const solanaChain = workerChain;
-                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-DPul1dWo.js'); });
+                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-DGEGqFd9.js'); });
                 const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
                 // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
                 // and there is nothing to mirror, so no synchronization is attempted.
@@ -9661,7 +9785,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-DnV4FQ__.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-Dh9ryO-Y.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -10222,4 +10346,4 @@ exports.toMillis = toMillis;
 exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
-//# sourceMappingURL=index-DlJKTmRv.js.map
+//# sourceMappingURL=index-yT8ZfzrL.js.map