@pooflabs/web 0.0.83 → 0.0.85-rc1

package/dist/{index.native-CyEwEeKr.esm.js → index.native-BPQqeP6_.esm.js}

@@ -4,21 +4,6 @@ import * as anchor from '@coral-xyz/anchor';
 import { Program } from '@coral-xyz/anchor';
 import * as React from 'react';
 
-function _mergeNamespaces(n, m) {
-	m.forEach(function (e) {
-		e && typeof e !== 'string' && !Array.isArray(e) && Object.keys(e).forEach(function (k) {
-			if (k !== 'default' && !(k in n)) {
-				var d = Object.getOwnPropertyDescriptor(e, k);
-				Object.defineProperty(n, k, d.get ? d : {
-					enumerable: true,
-					get: function () { return e[k]; }
-				});
-			}
-		});
-	});
-	return Object.freeze(n);
-}
-
 function getDefaultExportFromCjs$1 (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 }
@@ -6764,6 +6749,28 @@ class WebSessionManager {
     static async storeSession(address, accessToken, idToken, refreshToken) {
         if (typeof window === "undefined")
             return;
+        // JWT-wallet binding: refuse to store a session whose idToken is bound
+        // to a different wallet than `address`. Prevents races that would otherwise
+        // leave localStorage with mismatched address/token state.
+        try {
+            const payloadB64 = idToken.split(".")[1];
+            if (payloadB64) {
+                const payload = JSON.parse(this.decodeBase64Url(payloadB64));
+                const tokenWallet = payload["custom:walletAddress"];
+                if (tokenWallet && tokenWallet !== address) {
+                    throw new Error(`[WebSessionManager] Refusing to store session: address (${address}) does not match idToken custom:walletAddress (${tokenWallet})`);
+                }
+                if (!tokenWallet) {
+                    console.warn("[WebSessionManager] storeSession: idToken has no custom:walletAddress claim — writing without validation");
+                }
+            }
+        }
+        catch (err) {
+            if (typeof (err === null || err === void 0 ? void 0 : err.message) === "string" && err.message.includes("Refusing to store session")) {
+                throw err;
+            }
+            console.warn("[WebSessionManager] storeSession: failed to decode idToken for validation:", err);
+        }
         const config = await getConfig();
         const currentAppId = config.appId;
         localStorage.setItem(this.TAROBASE_SESSION_STORAGE_KEY, JSON.stringify({
@@ -9462,11 +9469,11 @@ function requireSrc$1 () {
 }
 
 var bs58$1;
-var hasRequiredBs58$1;
+var hasRequiredBs58;
 
-function requireBs58$1 () {
-	if (hasRequiredBs58$1) return bs58$1;
-	hasRequiredBs58$1 = 1;
+function requireBs58 () {
+	if (hasRequiredBs58) return bs58$1;
+	hasRequiredBs58 = 1;
 	var basex = requireSrc$1();
 	var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
 
@@ -9474,8 +9481,8 @@ function requireBs58$1 () {
 	return bs58$1;
 }
 
-var bs58Exports$1 = requireBs58$1();
-var bs58$2 = /*@__PURE__*/getDefaultExportFromCjs(bs58Exports$1);
+var bs58Exports = requireBs58();
+var bs58 = /*@__PURE__*/getDefaultExportFromCjs(bs58Exports);
 
 // ─────────────────────────────────────────────────────────────
 // Local implementation of getSimulationComputeUnits
@@ -9737,7 +9744,7 @@ function loadKeypairFromEnv() {
     try {
         const secretKey = secret.trim().startsWith("[")
             ? Uint8Array.from(JSON.parse(secret))
-            : bs58$2.decode(secret.trim());
+            : bs58.decode(secret.trim());
         return Keypair.fromSecretKey(secretKey);
     }
     catch (err) {
@@ -11682,6 +11689,28 @@ class ReactNativeSessionManager {
     /* STORE                                                              */
     /* ------------------------------------------------------------------ */
     static async storeSession(address, accessToken, idToken, refreshToken) {
+        // JWT-wallet binding: refuse to store a session whose idToken is bound
+        // to a different wallet than `address`. Prevents races that would otherwise
+        // leave storage with mismatched address/token state.
+        try {
+            const payloadB64 = idToken.split(".")[1];
+            if (payloadB64) {
+                const payload = JSON.parse(this.decodeBase64Url(payloadB64));
+                const tokenWallet = payload["custom:walletAddress"];
+                if (tokenWallet && tokenWallet !== address) {
+                    throw new Error(`[ReactNativeSessionManager] Refusing to store session: address (${address}) does not match idToken custom:walletAddress (${tokenWallet})`);
+                }
+                if (!tokenWallet) {
+                    console.warn("[ReactNativeSessionManager] storeSession: idToken has no custom:walletAddress claim — writing without validation");
+                }
+            }
+        }
+        catch (err) {
+            if (typeof (err === null || err === void 0 ? void 0 : err.message) === "string" && err.message.includes("Refusing to store session")) {
+                throw err;
+            }
+            console.warn("[ReactNativeSessionManager] storeSession: failed to decode idToken for validation:", err);
+        }
         const config = await getConfig();
         const currentAppId = config.appId;
         this.getStorage().setItem(this.TAROBASE_SESSION_STORAGE_KEY, JSON.stringify({
@@ -12836,15 +12865,15 @@ function clearIncompatibleSession() {
 // Lazy loaders for web-only providers.
 // Using dynamic import() ensures Metro (RN) never resolves these modules.
 async function loadPrivyWalletProvider() {
-    const mod = await import('./privy-wallet-provider-CpHAxPcv.esm.js');
+    const mod = await import('./privy-wallet-provider-D15Au3j8.esm.js');
     return mod.PrivyWalletProvider;
 }
 async function loadPhantomWalletProvider() {
-    const mod = await import('./phantom-wallet-provider-fkcFbwPk.esm.js');
+    const mod = await import('./phantom-wallet-provider-DheGhOp4.esm.js');
     return { PhantomWalletProvider: mod.PhantomWalletProvider };
 }
 async function loadSolanaMobileWalletProvider() {
-    const mod = await import('./solana-mobile-wallet-provider-DGyWHJVI.esm.js');
+    const mod = await import('./solana-mobile-wallet-provider-ChHh-U_p.esm.js');
     return mod.SolanaMobileWalletProvider;
 }
 async function hotSwapToPrivyProvider(config) {
@@ -15840,26 +15869,16 @@ function requireSrc () {
 	return src;
 }
 
-var bs58;
-var hasRequiredBs58;
-
-function requireBs58 () {
-	if (hasRequiredBs58) return bs58;
-	hasRequiredBs58 = 1;
-	var basex = requireSrc();
-	var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
-
-	bs58 = basex(ALPHABET);
-	return bs58;
-}
+var srcExports = requireSrc();
+var basex = /*@__PURE__*/getDefaultExportFromCjs$1(srcExports);
 
-var bs58Exports = requireBs58();
-var base58 = /*@__PURE__*/getDefaultExportFromCjs$1(bs58Exports);
+var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+var base58 = basex(ALPHABET);
 
-var index = /*#__PURE__*/_mergeNamespaces({
+var index = /*#__PURE__*/Object.freeze({
 	__proto__: null,
 	default: base58
-}, [bs58Exports]);
+});
 
 /**
  * Privy Expo Auth Provider — React Native implementation of AuthProvider.
@@ -16200,5 +16219,5 @@ class PrivyExpoProvider {
     }
 }
 
-export { ReactNativeSessionManager as $, getAuthProvider as A, get as B, set as C, setMany as D, setFile as E, getFiles as F, runQuery as G, runQueryMany as H, runExpression as I, runExpressionMany as J, signMessage as K, signTransaction as L, signAndSubmitTransaction as M, count as N, aggregate as O, subscribe as P, useAuth as Q, deserializeTransaction as R, SOLANA_MAINNET_RPC_URL as S, getIdToken as T, setPlatform as U, MockAuthProvider as V, WebSessionManager as W, DEFAULT_TEST_ADDRESS as X, OffchainAuthProvider as Y, PrivyExpoProvider as Z, InsufficientBalanceError as _, SOLANA_DEVNET_RPC_URL as a, ServerSessionManager as a0, clearCache as a1, closeAllSubscriptions as a2, getCachedData as a3, getMany as a4, reconnectWithNewAuth as a5, refreshSession as a6, signSessionCreateMessage as a7, buildSetDocumentsTransaction as b, convertRemainingAccounts as c, base58 as d, confirmAndCheckTransaction as e, createSessionWithPrivy as f, getPlatform as g, SURFNET_RPC_URL$1 as h, index as i, detectMobile as j, detectAndroid as k, setAuthLoading as l, genAuthNonce as m, genSolanaMessage as n, createSessionWithSignature as o, getDefaultExportFromCjs$1 as p, init as q, requireBuffer as r, setCurrentUser as s, getCurrentUser as t, onAuthStateChanged as u, onAuthLoadingChanged as v, getAuthLoading as w, login as x, logout as y, getConfig as z };
-//# sourceMappingURL=index.native-CyEwEeKr.esm.js.map
+export { ServerSessionManager as $, get as A, set as B, setMany as C, setFile as D, getFiles as E, runQuery as F, runQueryMany as G, runExpression as H, runExpressionMany as I, signMessage as J, signTransaction as K, signAndSubmitTransaction as L, count as M, aggregate as N, subscribe as O, useAuth as P, deserializeTransaction as Q, getIdToken as R, SOLANA_MAINNET_RPC_URL as S, setPlatform as T, MockAuthProvider as U, DEFAULT_TEST_ADDRESS as V, WebSessionManager as W, OffchainAuthProvider as X, PrivyExpoProvider as Y, InsufficientBalanceError as Z, ReactNativeSessionManager as _, SOLANA_DEVNET_RPC_URL as a, clearCache as a0, closeAllSubscriptions as a1, getCachedData as a2, getMany as a3, reconnectWithNewAuth as a4, refreshSession as a5, signSessionCreateMessage as a6, index as a7, buildSetDocumentsTransaction as b, convertRemainingAccounts as c, base58 as d, confirmAndCheckTransaction as e, createSessionWithPrivy as f, getPlatform as g, SURFNET_RPC_URL$1 as h, detectMobile as i, detectAndroid as j, setAuthLoading as k, genAuthNonce as l, genSolanaMessage as m, createSessionWithSignature as n, getDefaultExportFromCjs$1 as o, init as p, getCurrentUser as q, requireBuffer as r, setCurrentUser as s, onAuthStateChanged as t, onAuthLoadingChanged as u, getAuthLoading as v, login as w, logout as x, getConfig as y, getAuthProvider as z };
+//# sourceMappingURL=index.native-BPQqeP6_.esm.js.map