@pooflabs/web 0.0.93 → 0.0.94

package/dist/index.esm.js

@@ -1,4 +1,4 @@
-export { J as DEFAULT_TEST_ADDRESS, Q as InsufficientBalanceError, M as MockAuthProvider, O as OffchainAuthProvider, P as PhantomWalletProvider, N as PrivyExpoProvider, I as PrivyWalletProvider, R as ReactNativeSessionManager, T as RealtimeStore, U as ServerSessionManager, S as SolanaMobileWalletProvider, W as WebSessionManager, B as aggregate, V as buildSetDocumentsTransaction, X as clearCache, Y as closeAllSubscriptions, Z as convertRemainingAccounts, A as count, _ as createSessionWithPrivy, $ as createSessionWithSignature, E as deserializeTransaction, m as exportWallet, a0 as genAuthNonce, a1 as genSolanaMessage, n as get, e as getAuthLoading, j as getAuthProvider, a2 as getCachedData, h as getConfig, k as getCurrentAuthMethod, c as getCurrentUser, r as getFiles, F as getIdToken, a3 as getMany, H as getPlatform, a4 as getRealtimeStore, a5 as hasActiveConnection, i as init, K as isMobileWalletAvailable, l as login, f as logout, d as onAuthLoadingChanged, o as onAuthStateChanged, a6 as reconnectWithNewAuth, a7 as refreshSession, L as registerMobileWalletAdapter, a8 as resetRealtimeStore, v as runExpression, w as runExpressionMany, t as runQuery, u as runQueryMany, s as set, q as setFile, p as setMany, G as setPlatform, z as signAndSubmitTransaction, x as signMessage, a9 as signSessionCreateMessage, y as signTransaction, C as subscribe, D as useAuth, aa as wsDelete, ab as wsGet, ac as wsGetMany, ad as wsQuery, ae as wsSet } from './index-DbX66ch3.esm.js';
+export { L as DEFAULT_TEST_ADDRESS, T as InsufficientBalanceError, M as MockAuthProvider, O as OffchainAuthProvider, P as PhantomWalletProvider, R as PrivyExpoProvider, K as PrivyWalletProvider, U as ReactNativeSessionManager, V as RealtimeStore, W as ServerSessionManager, S as SolanaMobileWalletProvider, X as WebSessionManager, D as aggregate, Y as buildSetDocumentsTransaction, Z as clearCache, _ as closeAllSubscriptions, $ as convertRemainingAccounts, C as count, a0 as createSessionWithPrivy, a1 as createSessionWithSignature, G as deserializeTransaction, n as exportWallet, a2 as genAuthNonce, a3 as genSolanaMessage, p as get, f as getAuthLoading, k as getAuthProvider, a4 as getCachedData, j as getConfig, m as getCurrentAuthMethod, d as getCurrentUser, u as getFiles, H as getIdToken, a5 as getMany, J as getPlatform, a6 as getRealtimeStore, a7 as hasActiveConnection, i as init, N as isMobileWalletAvailable, l as login, h as logout, e as onAuthLoadingChanged, o as onAuthStateChanged, a8 as reconnectWithNewAuth, a9 as refreshSession, Q as registerMobileWalletAdapter, aa as resetRealtimeStore, x as runExpression, y as runExpressionMany, v as runQuery, w as runQueryMany, s as set, t as setFile, q as setMany, I as setPlatform, B as signAndSubmitTransaction, z as signMessage, ab as signSessionCreateMessage, A as signTransaction, E as subscribe, F as useAuth, ac as wsDelete, ad as wsGet, ae as wsGetMany, af as wsQuery, ag as wsSet } from './index-Cnx5UBPU.esm.js';
 import 'axios';
 import '@solana/web3.js';
 import '@coral-xyz/anchor';

package/dist/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-BRKarMUo.js');
+var index = require('./index-DOz63COz.js');
 require('axios');
 require('@solana/web3.js');
 require('@coral-xyz/anchor');

package/dist/{index.native-0P9dPMFG.esm.js → index.native-9ugIwvrJ.esm.js}

@@ -1,5 +1,5 @@
 import globalAxios from 'axios';
-import { PublicKey, SystemProgram, TransactionInstruction, ComputeBudgetProgram, Keypair, VersionedTransaction, TransactionMessage, Transaction, Connection } from '@solana/web3.js';
+import { PublicKey, SystemProgram, TransactionInstruction, Connection, VersionedTransaction, ComputeBudgetProgram, Keypair, TransactionMessage, Transaction } from '@solana/web3.js';
 import * as anchor from '@coral-xyz/anchor';
 import { Program } from '@coral-xyz/anchor';
 import * as React from 'react';
@@ -6683,7 +6683,14 @@ async function createSessionWithPrivy(authToken, address, privyIdToken) {
     const appId = config.appId;
     const response = await client.post('/session', {
         appId,
-        authMethod: config.authMethod,
+        // createSessionWithPrivy is, by definition, the Privy session path, so the
+        // server must receive authMethod:'privy' (its branch validates authToken+
+        // idToken+appId). Do NOT read config.authMethod here: on a Phantom-primary app
+        // with the staged Privy email swap, config.authMethod is still 'phantom' at this
+        // point (commitPrivy runs after login() resolves), which routes the request to
+        // the signature/message branch and fails. Hardcoding 'privy' also correctly
+        // covers 'privy-expo', which the backend expects mapped to 'privy'.
+        authMethod: 'privy',
         authToken,
         idToken: privyIdToken,
         address
@@ -9940,6 +9947,14 @@ async function updateIdTokenAndAccessToken(idToken, accessToken, isServer = fals
     await WebSessionManager.updateIdTokenAndAccessToken(idToken, accessToken);
 }
 
+var utils = /*#__PURE__*/Object.freeze({
+	__proto__: null,
+	createAuthHeader: createAuthHeader,
+	getIdToken: getIdToken$1,
+	getRefreshToken: getRefreshToken,
+	updateIdTokenAndAccessToken: updateIdTokenAndAccessToken
+});
+
 const apiClient = globalAxios.create();
 axiosRetry(apiClient, {
     retries: 2,
@@ -10367,7 +10382,7 @@ async function get(path, opts = {}) {
                 // For realtime chains, prefer WebSocket reads (lower latency, already connected)
                 const config = await getConfig();
                 const pathIsDocument = normalizedPath.split("/").length % 2 === 0;
-                if (((_a = config.chain) === null || _a === void 0 ? void 0 : _a.startsWith('realtime_')) && !config.isServer && !opts.prompt && !opts.shape && !opts.cursor) {
+                if (((_a = config.chain) === null || _a === void 0 ? void 0 : _a.startsWith('realtime_')) && !config.isServer && !opts.prompt && !opts.shape && !opts.cursor && !opts.includeSubPaths) {
                     try {
                         const { wsGet, wsQuery, hasActiveConnection } = await Promise.resolve().then(function () { return subscriptionV2; });
                         if (hasActiveConnection()) {
@@ -10598,7 +10613,7 @@ async function set(path, document, options) {
     return result;
 }
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
     // Returns the data that was set, or undefined if the document was already set.
     try {
         const config = await getConfig();
@@ -10641,12 +10656,24 @@ async function setMany(many, options) {
                 try {
                     const { wsSet, hasActiveConnection } = await Promise.resolve().then(function () { return subscriptionV2; });
                     if (hasActiveConnection()) {
+                        // Connection is active — send via WS. If this throws, the write
+                        // may have been applied server-side (ack lost). Do NOT fall through
+                        // to HTTP, as that would double-apply non-idempotent ops (Increment).
                         const wsResult = await wsSet(documents);
-                        // Normalize to same shape as HTTP 200 response so downstream handling is identical
                         setResponse = { data: wsResult, status: 200 };
                     }
                 }
-                catch ( /* fall through to HTTP */_j) { /* fall through to HTTP */ }
+                catch (wsError) {
+                    // Only fall through to HTTP if the request was never sent (connection not available).
+                    // If the request was sent and ack was lost (timeout), the server may have
+                    // applied it — re-sending via HTTP risks double-write for non-idempotent ops.
+                    const msg = (_d = wsError === null || wsError === void 0 ? void 0 : wsError.message) !== null && _d !== void 0 ? _d : '';
+                    const neverSent = msg.includes('not available') || msg.includes('connection timeout');
+                    if (!neverSent) {
+                        throw wsError;
+                    }
+                    // Safe to retry via HTTP — request was never sent
+                }
             }
             if (!setResponse) {
                 setResponse = await makeApiRequest('PUT', `items`, { documents }, options === null || options === void 0 ? void 0 : options._overrides);
@@ -10654,9 +10681,9 @@ async function setMany(many, options) {
         }
         catch (error) {
             if ((error === null || error === void 0 ? void 0 : error.statusCode) === 402 && (error === null || error === void 0 ? void 0 : error.error) === 'INSUFFICIENT_BALANCE') {
-                const deficitLamports = Number((_d = error.deficitLamports) !== null && _d !== void 0 ? _d : 0);
-                const deficitSol = Number((_e = error.deficitSol) !== null && _e !== void 0 ? _e : deficitLamports / 1000000000);
-                throw new InsufficientBalanceError(String((_f = error.address) !== null && _f !== void 0 ? _f : ''), Number((_g = error.balanceLamports) !== null && _g !== void 0 ? _g : 0), Number((_h = error.estimatedCostLamports) !== null && _h !== void 0 ? _h : 0), deficitLamports, deficitSol);
+                const deficitLamports = Number((_e = error.deficitLamports) !== null && _e !== void 0 ? _e : 0);
+                const deficitSol = Number((_f = error.deficitSol) !== null && _f !== void 0 ? _f : deficitLamports / 1000000000);
+                throw new InsufficientBalanceError(String((_g = error.address) !== null && _g !== void 0 ? _g : ''), Number((_h = error.balanceLamports) !== null && _h !== void 0 ? _h : 0), Number((_j = error.estimatedCostLamports) !== null && _j !== void 0 ? _j : 0), deficitLamports, deficitSol);
             }
             throw error;
         }
@@ -10678,7 +10705,13 @@ async function setMany(many, options) {
             let signedTransaction = undefined;
             for (let i = 0; i < transactions.length; i++) {
                 const curTx = transactions[i];
-                const transactionResult = await handleSolanaTransaction(curTx, authProvider, options);
+                let transactionResult;
+                if (curTx.serializedTransaction) {
+                    transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options);
+                }
+                else {
+                    transactionResult = await handleSolanaTransaction(curTx, authProvider, options);
+                }
                 lastTxSignature = transactionResult.transactionSignature;
                 signedTransaction = transactionResult.signedTransaction;
             }
@@ -10784,6 +10817,68 @@ async function setMany(many, options) {
         const transactionResult = await authProvider.runTransaction(undefined, solTransaction, options);
         return transactionResult;
     }
+    async function handlePreBuiltTransaction(tx, authProvider, options) {
+        var _a, _b;
+        const config = await getConfig();
+        const rpcUrl = config.rpcUrl || (tx.network === 'solana_devnet'
+            ? 'https://api.devnet.solana.com'
+            : 'https://api.mainnet-beta.solana.com');
+        const connection = new Connection(rpcUrl, 'confirmed');
+        const txBytes = bufferExports.Buffer.from(tx.serializedTransaction, 'base64');
+        const transaction = VersionedTransaction.deserialize(txBytes);
+        // Validate the transaction before signing: ensure only allowed programs
+        // and no unauthorized System program instructions (e.g., SOL transfers)
+        const TAROBASE_PROGRAM = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
+        const COMPUTE_BUDGET = 'ComputeBudget111111111111111111111111111111';
+        const SYSTEM_PROGRAM = '11111111111111111111111111111111';
+        const ALLOWED_PROGRAMS = new Set([TAROBASE_PROGRAM, COMPUTE_BUDGET, SYSTEM_PROGRAM]);
+        // System program instruction discriminators (first 4 bytes, little-endian u32)
+        const SYSTEM_TRANSFER = 2; // Transfer instruction index
+        const SYSTEM_TRANSFER_WITH_SEED = 11;
+        const accountKeys = transaction.message.staticAccountKeys;
+        for (const ix of transaction.message.compiledInstructions) {
+            if (ix.programIdIndex >= accountKeys.length) {
+                throw new Error('Pre-built transaction has program ID in lookup table (not allowed)');
+            }
+            const programId = accountKeys[ix.programIdIndex].toBase58();
+            if (!ALLOWED_PROGRAMS.has(programId)) {
+                throw new Error(`Pre-built transaction contains unauthorized program: ${programId}`);
+            }
+            // Block System program transfer instructions — a compromised DO could
+            // embed a SOL drain. Only allow createAccount/allocate (needed for PDA init).
+            if (programId === SYSTEM_PROGRAM && ix.data.length >= 4) {
+                const ixIndex = ix.data[0] | (ix.data[1] << 8) | (ix.data[2] << 16) | (ix.data[3] << 24);
+                if (ixIndex === SYSTEM_TRANSFER || ixIndex === SYSTEM_TRANSFER_WITH_SEED) {
+                    throw new Error('Pre-built transaction contains unauthorized System transfer instruction');
+                }
+            }
+        }
+        const signedTx = await authProvider.signTransaction(transaction);
+        const rawTx = signedTx.serialize();
+        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+            return {
+                transactionSignature: '',
+                signedTransaction: bufferExports.Buffer.from(rawTx).toString('base64'),
+                blockNumber: 0,
+                gasUsed: '0',
+            };
+        }
+        const signature = await connection.sendRawTransaction(rawTx, {
+            skipPreflight: false,
+            maxRetries: 3,
+        });
+        const confirmation = await connection.confirmTransaction({
+            signature,
+            blockhash: tx.blockhash,
+            lastValidBlockHeight: tx.lastValidBlockHeight,
+        }, 'confirmed');
+        return {
+            transactionSignature: signature,
+            signedTransaction: bufferExports.Buffer.from(rawTx).toString('base64'),
+            blockNumber: (_b = (_a = confirmation.context) === null || _a === void 0 ? void 0 : _a.slot) !== null && _b !== void 0 ? _b : 0,
+            gasUsed: '0',
+        };
+    }
     async function handleOffchainTransaction(tx, authProvider, options) {
         var _a, _b, _c, _d, _e, _f;
         const config = await getConfig();
@@ -12096,30 +12191,53 @@ class RealtimeStore {
         this.idbDirtyKeys = new Set();
         this.closed = false;
         this.authToken = null;
+        this.isServer = false;
+        this.tokenRefreshTimer = null;
+        // -----------------------------------------------------------------------
+        // WebSocket connection
+        // -----------------------------------------------------------------------
+        this.initPromise = null;
     }
     // -----------------------------------------------------------------------
     // Initialization
     // -----------------------------------------------------------------------
     async init() {
-        var _a, _b;
         const config = await getConfig();
         this.appId = config.appId;
         this.wsUrl = config.wsApiUrl;
-        if (config.authProvider) {
-            try {
-                const headers = await ((_b = (_a = config.authProvider).getAuthHeaders) === null || _b === void 0 ? void 0 : _b.call(_a));
-                if (headers === null || headers === void 0 ? void 0 : headers.Authorization) {
-                    this.authToken = headers.Authorization.replace('Bearer ', '');
-                }
-            }
-            catch ( /* no auth */_c) { /* no auth */ }
+        this.isServer = config.isServer;
+        await this.refreshToken();
+        this.startTokenRefresh();
+    }
+    async refreshToken() {
+        try {
+            const { getIdToken } = await Promise.resolve().then(function () { return utils; });
+            const token = await getIdToken(this.isServer);
+            if (token)
+                this.authToken = token;
         }
+        catch ( /* no auth available */_a) { /* no auth available */ }
+    }
+    startTokenRefresh() {
+        if (this.tokenRefreshTimer)
+            return;
+        this.tokenRefreshTimer = setInterval(async () => {
+            var _a;
+            const prevToken = this.authToken;
+            await this.refreshToken();
+            if (this.authToken && this.authToken !== prevToken && ((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN) {
+                // Token changed — reconnect with fresh token
+                this.ws.close(1000, 'Token refreshed');
+            }
+        }, 5 * 60 * 1000); // Check every 5 minutes
     }
-    // -----------------------------------------------------------------------
-    // WebSocket connection
-    // -----------------------------------------------------------------------
     async ensureConnected() {
         var _a;
+        if (!this.appId) {
+            if (!this.initPromise)
+                this.initPromise = this.init();
+            await this.initPromise;
+        }
         if (((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN)
             return;
         if (this.connectPromise)
@@ -12135,10 +12253,12 @@ class RealtimeStore {
             }
             const params = new URLSearchParams();
             params.set('apiKey', this.appId);
-            // Auth token sent via subprotocol to avoid leaking in URL/logs
+            if (this.authToken)
+                params.set('authorization', this.authToken);
+            // Note: token in URL is required until DO server supports subprotocol auth.
+            // WSS encrypts the full URL including query params on the wire.
             const url = `${this.wsUrl}?${params.toString()}`;
-            const protocols = this.authToken ? [`bearer-${this.authToken}`] : undefined;
-            const ws = protocols ? new WebSocket(url, protocols) : new WebSocket(url);
+            const ws = new WebSocket(url);
             this.ws = ws;
             const onOpen = () => {
                 ws.removeEventListener('error', onError);
@@ -12769,6 +12889,8 @@ class RealtimeStore {
             clearTimeout(this.reconnectTimer);
         if (this.idbFlushTimer)
             clearTimeout(this.idbFlushTimer);
+        if (this.tokenRefreshTimer)
+            clearInterval(this.tokenRefreshTimer);
         this.flushIdb();
         if (this.ws) {
             this.ws.close(1000, 'Store closed');
@@ -13878,15 +14000,15 @@ function clearIncompatibleSession() {
 // Lazy loaders for web-only providers.
 // Using dynamic import() ensures Metro (RN) never resolves these modules.
 async function loadPrivyWalletProvider() {
-    const mod = await import('./privy-wallet-provider-CzoLQPiq.esm.js');
+    const mod = await import('./privy-wallet-provider-B3bghDWY.esm.js');
     return mod.PrivyWalletProvider;
 }
 async function loadPhantomWalletProvider() {
-    const mod = await import('./phantom-wallet-provider-44BDf-tk.esm.js');
+    const mod = await import('./phantom-wallet-provider-wskKKVNr.esm.js');
     return { PhantomWalletProvider: mod.PhantomWalletProvider };
 }
 async function loadSolanaMobileWalletProvider() {
-    const mod = await import('./solana-mobile-wallet-provider-BbvaCCuE.esm.js');
+    const mod = await import('./solana-mobile-wallet-provider-CFYL4aOO.esm.js');
     return mod.SolanaMobileWalletProvider;
 }
 async function hotSwapToPrivyProvider(config) {
@@ -17301,5 +17423,5 @@ class PrivyExpoProvider {
     }
 }
 
-export { RealtimeStore as $, get as A, set as B, setMany as C, setFile as D, getFiles as E, runQuery as F, runQueryMany as G, runExpression as H, runExpressionMany as I, signMessage as J, signTransaction as K, signAndSubmitTransaction as L, count as M, aggregate as N, subscribe as O, useAuth as P, deserializeTransaction as Q, getIdToken as R, SOLANA_MAINNET_RPC_URL as S, setPlatform as T, MockAuthProvider as U, DEFAULT_TEST_ADDRESS as V, WebSessionManager as W, OffchainAuthProvider as X, PrivyExpoProvider as Y, InsufficientBalanceError as Z, ReactNativeSessionManager as _, SOLANA_DEVNET_RPC_URL as a, ServerSessionManager as a0, clearCache as a1, closeAllSubscriptions as a2, getCachedData as a3, getMany as a4, getRealtimeStore as a5, hasActiveConnection as a6, reconnectWithNewAuth as a7, refreshSession as a8, resetRealtimeStore as a9, signSessionCreateMessage as aa, wsDelete as ab, wsGet as ac, wsGetMany as ad, wsQuery as ae, wsSet as af, index as ag, buildSetDocumentsTransaction as b, convertRemainingAccounts as c, base58 as d, confirmAndCheckTransaction as e, createSessionWithPrivy as f, getPlatform as g, SURFNET_RPC_URL$1 as h, detectMobile as i, detectAndroid as j, setAuthLoading as k, genAuthNonce as l, genSolanaMessage as m, createSessionWithSignature as n, getDefaultExportFromCjs$1 as o, init as p, getCurrentUser as q, requireBuffer as r, setCurrentUser as s, onAuthStateChanged as t, onAuthLoadingChanged as u, getAuthLoading as v, login as w, logout as x, getConfig as y, getAuthProvider as z };
-//# sourceMappingURL=index.native-0P9dPMFG.esm.js.map
+export { InsufficientBalanceError as $, getConfig as A, getAuthProvider as B, get as C, set as D, setMany as E, setFile as F, getFiles as G, runQuery as H, runQueryMany as I, runExpression as J, runExpressionMany as K, signMessage as L, signTransaction as M, signAndSubmitTransaction as N, count as O, aggregate as P, subscribe as Q, useAuth as R, SOLANA_MAINNET_RPC_URL as S, deserializeTransaction as T, getIdToken as U, setPlatform as V, WebSessionManager as W, MockAuthProvider as X, DEFAULT_TEST_ADDRESS as Y, OffchainAuthProvider as Z, PrivyExpoProvider as _, SOLANA_DEVNET_RPC_URL as a, ReactNativeSessionManager as a0, RealtimeStore as a1, ServerSessionManager as a2, clearCache as a3, closeAllSubscriptions as a4, getCachedData as a5, getMany as a6, getRealtimeStore as a7, hasActiveConnection as a8, reconnectWithNewAuth as a9, refreshSession as aa, resetRealtimeStore as ab, signSessionCreateMessage as ac, wsDelete as ad, wsGet as ae, wsGetMany as af, wsQuery as ag, wsSet as ah, index as ai, buildSetDocumentsTransaction as b, convertRemainingAccounts as c, base58 as d, confirmAndCheckTransaction as e, createSessionWithPrivy as f, getPlatform as g, SURFNET_RPC_URL$1 as h, detectMobile as i, detectAndroid as j, setAuthLoading as k, genAuthNonce as l, genSolanaMessage as m, createSessionWithSignature as n, commonjsRequire as o, require$$0 as p, getDefaultExportFromCjs$1 as q, requireBuffer as r, setCurrentUser as s, init as t, getCurrentUser as u, onAuthStateChanged as v, onAuthLoadingChanged as w, getAuthLoading as x, login as y, logout as z };
+//# sourceMappingURL=index.native-9ugIwvrJ.esm.js.map