@bounded-sh/core 0.0.71 → 0.0.73

package/dist/{index-P4eUuhOB.mjs → index-DXV0ETfH.mjs}

@@ -4131,7 +4131,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-x8ElgC9P.mjs');
+        const { genSolanaMessage } = await import('./solana-message-DHKm-c_x.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -6899,7 +6899,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-Bcnv3f0g.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-6rndRLaa.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8325,7 +8325,11 @@ async function setMany(many, options) {
             if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
                 throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
             }
-            const expectedWritePaths = documents.map(d => d.destinationPath);
+            // All requested paths (writes AND deletes), in request order. Used for the
+            // post-confirm mirror read-back, which correlates every requested path.
+            // The pre-sign validation derives its own full expected intent from
+            // `documents` (see below) and needs nothing from this list.
+            const requestedPaths = documents.map(d => d.destinationPath);
             const requestedDocuments = buildRequestedDocuments(documents);
             const appId = config.appId;
             // The lane comes verbatim from the worker, and is read BEFORE anything is
@@ -8342,8 +8346,13 @@ async function setMany(many, options) {
                         'Nothing was signed or submitted.');
                 }
                 const solanaChain = workerChain;
-                const { handlePreBuiltTransaction } = await import('./solana-operations-DEWIxJS8.mjs');
-                const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
+                const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-DiM6_8z7.mjs');
+                // OA-0001: derive the expected intent from OUR OWN request (the one
+                // ground truth a tampered builder response cannot change) so the
+                // validator can reject any transaction whose operation semantics
+                // diverge from it BEFORE the wallet is asked to sign.
+                const expectedIntent = buildExpectedWriteIntent(documents);
+                const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent);
                 // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
                 // and there is nothing to mirror, so no synchronization is attempted.
                 if (solanaOutcome.outcome === 'signed') {
@@ -8365,7 +8374,7 @@ async function setMany(many, options) {
                 }
                 // Confirmed: the receipt is already complete, so the mirror read is a
                 // best-effort enrichment reported in `mirrorSync`, never a rejection.
-                const mirrorSync = await attemptMirrorSync(expectedWritePaths, options);
+                const mirrorSync = await attemptMirrorSync(requestedPaths, options);
                 return {
                     status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
                     transactionId: solanaOutcome.transactionSignature,
@@ -9783,7 +9792,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-x8ElgC9P.mjs');
+    const implementation = await import('./solana-message-DHKm-c_x.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -10259,4 +10268,4 @@ function defineLiveModule(mod) {
 }
 
 export { getSessionGeneration as $, closeAllSubscriptions as A, clearCache as B, getCachedData as C, reconnectWithNewAuth as D, createClient as E, subscribeQuery as F, closeAllQuerySubscriptions as G, canonicalizeArgs as H, InsufficientBalanceError as I, canonicalizeResult as J, DEFAULT_QUERY_POLL_INTERVAL_MS as K, BoundedDeclineError as L, MIN_QUERY_POLL_INTERVAL_MS as M, deriveDecline as N, dispatchDeclineEvent as O, DECLINE_EVENT_NAME as P, dispatchRateLimitEvent as Q, RATE_LIMIT_EVENT_NAME as R, ScopedClientReadOnlyError as S, hasActiveConnection as T, increment as U, serverTimestamp as V, now as W, toSeconds as X, toMillis as Y, getIdToken as Z, deriveUserIdentityFromIdToken as _, getWebhookKeysUrl as a, WebSessionManager as a0, ReactNativeSessionManager as a1, getActiveSessionManager as a2, onSessionCleared as a3, SessionEnvironmentError as a4, UNSUPPORTED_ENVIRONMENT_CODE as a5, AUTH_CHANGED_CODE as a6, AUTH_EXPIRED_CODE as a7, isAuthExpiredError as a8, getFreshAuthToken as a9, ServerSessionManager as aa, createSessionWithSignature as ab, refreshSession as ac, revokeSession as ad, signSessionCreateMessage as ae, genAuthNonce as af, genSolanaMessage as ag, genSiweMessage as ah, normalizeEvmAddress as ai, toLowerEvmAddress as aj, functions as ak, invoke as al, FunctionInvokeError as am, live as an, intent as ao, status as ap, subscribeView as aq, LiveIntentError as ar, withEffects as as, isEffectResult as at, defineLiveModule as au, EFFECT_INTENT_ADDRESS as av, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, runQueryMany as m, runExpression as n, runExpressionMany as o, signMessage as p, queryAggregate as q, runQuery as r, set as s, signTransaction as t, signAndSubmitTransaction as u, count as v, aggregate as w, reconcileSetResult as x, waitForSetResult as y, subscribe as z };
-//# sourceMappingURL=index-P4eUuhOB.mjs.map
+//# sourceMappingURL=index-DXV0ETfH.mjs.map