@bounded-sh/server 0.0.56 → 0.0.57

package/dist/sanitize-headers.d.ts

@@ -0,0 +1 @@
+export declare function stripCallerAuthHeaders(headers?: Record<string, string>): Record<string, string> | undefined;

package/dist/wallet-client.d.ts

@@ -19,11 +19,12 @@ export declare class WalletClient {
     };
     constructor(provider: AuthProvider, sessionManager: ServerSessionManager, address: string, evmTransactionPolicy?: EvmTransactionPolicy);
     private buildOverrides;
-    /** Strip Authorization from caller headers to prevent overriding wallet token */
+    /** #023: strip caller Authorization (any casing) so operations run as the isolated wallet. */
     private sanitizeHeaders;
     private mergeSetOverrides;
     private mergeReadOverrides;
     private mergeLiveIntentOptions;
+    private mergeLiveStatusOptions;
     set(path: string, document: any, options?: SetOptions): Promise<any>;
     setMany(many: {
         path: string;

package/dist/webhooks.d.ts

@@ -58,8 +58,23 @@ export interface VerifyWebhookOptions {
      * Expected Bounded app id for this receiver. When set, a validly signed
      * webhook for another app is rejected instead of relying on every caller to
      * compare `payload.appId` manually.
+     *
+     * #072: when this is OMITTED, verifyWebhook now binds to the SDK's init()-time
+     * app id by DEFAULT (secure-by-default). Because Bounded signs every app's
+     * webhooks with one shared platform key, a valid signature only proves "from
+     * Bounded", not "from YOUR app" - so a bind is required to stop cross-app
+     * forgery. If no app id can be resolved (this option unset AND no init()-time
+     * app id), verifyWebhook FAILS CLOSED. Multi-app receivers must set
+     * {@link allowAnyAppId} to accept any app deliberately.
      */
     expectedAppId?: string;
+    /**
+     * Opt out of the app binding to accept a validly-signed webhook from ANY app
+     * (the rare multi-app receiver). #072: this MUST be set explicitly - the safe
+     * default binds to the SDK's app id. Ignored when {@link expectedAppId} is set
+     * (an explicit expected id always enforces a match).
+     */
+    allowAnyAppId?: boolean;
     /**
      * Replay store. By default, verifyWebhook uses a process-local in-memory
      * store and rejects exact signed-delivery replays within the skew window.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bounded-sh/server",
-    "version": "0.0.56",
+    "version": "0.0.57",
     "description": "Node and server SDK for Bounded, the full-stack app builder and runtime for AI-built apps: keypair-authenticated data, files and search, functions, realtime, webhook verification, and atomic writes.",
     "homepage": "https://bounded.sh/docs/sdk",
     "main": "./dist/index.js",
@@ -15,7 +15,7 @@
     },
     "scripts": {
         "build": "rm -rf ./dist ./.rollup-tmp && tsc -p tsconfig.build.json --outDir .rollup-tmp --declarationDir .rollup-tmp --emitDeclarationOnly false && rollup -c && tsc -p tsconfig.build.json --emitDeclarationOnly --declarationDir dist && rm -rf ./.rollup-tmp",
-        "test": "node src/auth/providers/run-solana-keypair-blockhash-test.mjs && node src/auth/providers/evm-keypair-provider.source.test.mjs && node src/run-server-global-provider-test.mjs",
+        "test": "node src/auth/providers/run-solana-keypair-blockhash-test.mjs && node src/auth/providers/evm-keypair-provider.source.test.mjs && node src/run-server-global-provider-test.mjs && node --test src/webhooks.test.mjs",
         "watch": "rollup -c -w",
         "prepare": "npm run build"
     },
@@ -44,13 +44,14 @@
         "@rollup/plugin-commonjs": "28.0.9",
         "@rollup/plugin-json": "6.1.0",
         "@rollup/plugin-node-resolve": "15.3.1",
+        "esbuild": "0.23.1",
         "rollup": "4.60.1",
         "rollup-plugin-peer-deps-external": "2.2.4",
         "rollup-plugin-typescript2": "0.36.0",
         "typescript": "5.9.3"
     },
     "dependencies": {
-        "@bounded-sh/core": "0.0.56",
+        "@bounded-sh/core": "0.0.57",
         "@coral-xyz/anchor": "0.31.1",
         "@solana/web3.js": "1.98.4",
         "axios": "1.18.1",