@bounded-sh/core 0.0.70 → 0.0.72

package/dist/{index-CqTl6vHg.js → index-yT8ZfzrL.js}

@@ -25,7 +25,8 @@ const DEFAULT_CLIENT_CONFIG = {
     // No hidden modal fallback: browser clients start hosted Bounded Auth with
     // loginWithRedirect/loginWithPopup. For crypto/onchain wallet login use
     // authMethod:'phantom' (Solana / Phantom), and use signInAnonymously() for
-    // zero-friction guest accounts. ('wallet' is an unimplemented stub; don't use.)
+    // zero-friction guest accounts. ('wallet' and 'mobile-wallet-adapter' are
+    // accepted spellings of the same lane and canonicalize to 'phantom'.)
     authMethod: 'none',
     chain: '',
     rpcUrl: '',
@@ -642,6 +643,53 @@ async function revokeSession(refreshToken, issuer) {
 async function signSessionCreateMessage(_signMessageFunction) {
 }
 
+// Classify a session-refresh failure as a DEFINITIVE rejection of the credential
+// vs a TRANSPORT failure (DS4-0054).
+//
+// The restore path refreshes an expired token at boot. The old code destroyed the
+// local session on ANY refresh failure, so a network blip - common on mobile -
+// signed the user out. Only a real HTTP rejection of the refresh token proves the
+// session is invalid; anything else is unknown, and the safe move is to RETAIN local
+// state and retry. Keeping a genuinely dead session locally is harmless: every
+// request still fails closed server-side, and the next refresh that reaches the
+// server clears it. Destroying a live session on a blip is user-visible damage.
+//
+// `/session/refresh` answers 401 (session_revoked / invalid_grant) when the token is
+// dead. 400 (bad request), 408/429 (transient), and 5xx are NOT proof the session is
+// invalid, and a network/DNS/timeout error carries no HTTP response at all.
+//
+// This is the single classifier for every refresh path: the per-request freshness
+// check (auth-token-freshness) and the boot-time restore paths (web + RN session
+// managers) all import it, so "definitive" means the same thing everywhere. It lives
+// in this leaf module to avoid an import cycle between those consumers.
+function isDefinitiveRejection(err) {
+    var _a;
+    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
+    return status === 401 || status === 403;
+}
+// How long past the id token's own `exp` a session may survive purely on
+// transport failures.
+//
+// "Retain on a blip" must not become "retain forever". A statusless failure is
+// unknown, so the first ones are absorbed - but a revoked session, or a gateway
+// that rewrites the issuer's 401 into a 502, would otherwise keep
+// isAuthenticated() reporting a signed-in user for as long as the device never
+// reaches the issuer again. One day covers an offline flight or a bad-network day
+// while making the retention finite: past it, an unrefreshable session is cleared
+// and the user is asked to sign in again.
+const TRANSPORT_RETENTION_GRACE_MS = 24 * 60 * 60 * 1000;
+/**
+ * May a session whose refresh failed WITHOUT a definitive rejection be kept?
+ *
+ * `expSeconds` is the id token's `exp` claim. Fails closed: a missing or
+ * non-numeric expiry is not a usable bound, so such a session is never retained.
+ */
+function mayRetainAfterTransportFailure(expSeconds, now = Date.now()) {
+    if (typeof expSeconds !== 'number' || !Number.isFinite(expSeconds))
+        return false;
+    return now <= expSeconds * 1000 + TRANSPORT_RETENTION_GRACE_MS;
+}
+
 // Shared session-binding guard for the web + React Native session managers, so
 // the cross-principal refresh guard (#220 / #221) lives in ONE place and the two
 // managers can't drift apart. Base64url decoding differs by platform (browser
@@ -1023,7 +1071,26 @@ class WebSessionManager {
                     await this.clearSessionIfGeneration(generation);
                     return null;
                 }
-                const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                let refreshed;
+                try {
+                    refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                }
+                catch (refreshErr) {
+                    // DS4-0054: only a DEFINITIVE server rejection (401/403) proves the
+                    // refresh token is dead. A transport failure - offline, DNS, timeout,
+                    // 5xx - is unknown, not proof the session is invalid. Destroying local
+                    // state here signs the user out on a network blip (common on mobile),
+                    // so RETAIN it and return the existing session; the next request will
+                    // retry the refresh. The retention is BOUNDED by the token's own
+                    // expiry plus a grace window, so a revoked session - or an issuer 401
+                    // a gateway rewrote into a 5xx - cannot keep isAuthenticated() true
+                    // forever on a device that never reaches the issuer again.
+                    if (isDefinitiveRejection(refreshErr) || !mayRetainAfterTransportFailure(exp)) {
+                        await this.clearSessionIfGeneration(generation);
+                        return null;
+                    }
+                    return { address: sessionObj.address, session: sessionObj };
+                }
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
                     const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, 
                     // Persist the ROTATED refresh token — the old one is now
@@ -1044,8 +1111,9 @@ class WebSessionManager {
                         return null;
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops, but only
-                // if it is still the session we set out to refresh.
+                // The server answered but issued no usable tokens - a definitive refusal,
+                // not a transport failure - so clear the stale session to stop retry loops,
+                // but only if it is still the session we set out to refresh.
                 await this.clearSessionIfGeneration(generation);
                 return null;
             }
@@ -1431,7 +1499,26 @@ class ReactNativeSessionManager {
                     await this.clearSessionIfGeneration(generation);
                     return null;
                 }
-                const refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                let refreshed;
+                try {
+                    refreshed = await refreshSession(refreshToken, sessionObj.issuer);
+                }
+                catch (refreshErr) {
+                    // DS4-0054: only a DEFINITIVE server rejection (401/403) proves the
+                    // refresh token is dead. A transport failure - offline, DNS, timeout,
+                    // 5xx - is unknown, not proof the session is invalid. On mobile these
+                    // blips are common, so destroying local state here signs the user out
+                    // on a bad network. RETAIN it and return the existing session; the next
+                    // request retries the refresh. The retention is BOUNDED by the token's
+                    // own expiry plus a grace window, so a revoked session - or an issuer
+                    // 401 a gateway rewrote into a 5xx - cannot keep isAuthenticated() true
+                    // forever on a device that never reaches the issuer again.
+                    if (isDefinitiveRejection(refreshErr) || !mayRetainAfterTransportFailure(exp)) {
+                        await this.clearSessionIfGeneration(generation);
+                        return null;
+                    }
+                    return { address: sessionObj.address, session: sessionObj };
+                }
                 if ((refreshed === null || refreshed === void 0 ? void 0 : refreshed.idToken) && (refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken)) {
                     const committed = await this.commitRefreshedTokens({ generation, idToken: sessionObj.idToken }, refreshed.idToken, refreshed.accessToken, refreshed.refreshToken);
                     // Superseded means a login or logout landed mid-refresh. Returning
@@ -1448,8 +1535,9 @@ class ReactNativeSessionManager {
                         return null;
                     return { address: newObj.address, session: newObj };
                 }
-                // Refresh failed — clear stale session to prevent retry loops, but only
-                // if it is still the session we set out to refresh.
+                // The server answered but issued no usable tokens - a definitive refusal,
+                // not a transport failure - so clear the stale session to stop retry loops,
+                // but only if it is still the session we set out to refresh.
                 await this.clearSessionIfGeneration(generation);
                 return null;
             }
@@ -4045,7 +4133,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-BecAT47y.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-Dh9ryO-Y.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4417,11 +4505,6 @@ const refreshTransactions = new Map();
 function transactionKey(scope, appId, generation, refreshToken) {
     return `${scope}:${appId}:${generation !== null && generation !== void 0 ? generation : 'none'}:${tokenFingerprint(refreshToken)}`;
 }
-function isDefinitiveRejection(error) {
-    var _a;
-    const status = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status;
-    return status === 401 || status === 403;
-}
 async function readSessionParts(isServer) {
     var _a, _b, _c, _d, _e, _f;
     if (isServer) {
@@ -6818,7 +6901,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-DfeKV55-.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-BDpIOFMH.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8261,7 +8344,7 @@ async function setMany(many, options) {
                         'Nothing was signed or submitted.');
                 }
                 const solanaChain = workerChain;
-                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-uN89eqO2.js'); });
+                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-DGEGqFd9.js'); });
                 const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
                 // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
                 // and there is nothing to mirror, so no synchronization is attempted.
@@ -9702,7 +9785,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-BecAT47y.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-Dh9ryO-Y.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -10263,4 +10346,4 @@ exports.toMillis = toMillis;
 exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
-//# sourceMappingURL=index-CqTl6vHg.js.map
+//# sourceMappingURL=index-yT8ZfzrL.js.map