@pooflabs/web 0.0.93 → 0.0.94

package/dist/{index.native-DIXtlrL_.js → index.native-CpA5KDvL.js}

@@ -6704,7 +6704,14 @@ async function createSessionWithPrivy(authToken, address, privyIdToken) {
     const appId = config.appId;
     const response = await client.post('/session', {
         appId,
-        authMethod: config.authMethod,
+        // createSessionWithPrivy is, by definition, the Privy session path, so the
+        // server must receive authMethod:'privy' (its branch validates authToken+
+        // idToken+appId). Do NOT read config.authMethod here: on a Phantom-primary app
+        // with the staged Privy email swap, config.authMethod is still 'phantom' at this
+        // point (commitPrivy runs after login() resolves), which routes the request to
+        // the signature/message branch and fails. Hardcoding 'privy' also correctly
+        // covers 'privy-expo', which the backend expects mapped to 'privy'.
+        authMethod: 'privy',
         authToken,
         idToken: privyIdToken,
         address
@@ -9961,6 +9968,14 @@ async function updateIdTokenAndAccessToken(idToken, accessToken, isServer = fals
     await WebSessionManager.updateIdTokenAndAccessToken(idToken, accessToken);
 }
 
+var utils = /*#__PURE__*/Object.freeze({
+	__proto__: null,
+	createAuthHeader: createAuthHeader,
+	getIdToken: getIdToken$1,
+	getRefreshToken: getRefreshToken,
+	updateIdTokenAndAccessToken: updateIdTokenAndAccessToken
+});
+
 const apiClient = globalAxios.create();
 axiosRetry(apiClient, {
     retries: 2,
@@ -10388,7 +10403,7 @@ async function get(path, opts = {}) {
                 // For realtime chains, prefer WebSocket reads (lower latency, already connected)
                 const config = await getConfig();
                 const pathIsDocument = normalizedPath.split("/").length % 2 === 0;
-                if (((_a = config.chain) === null || _a === void 0 ? void 0 : _a.startsWith('realtime_')) && !config.isServer && !opts.prompt && !opts.shape && !opts.cursor) {
+                if (((_a = config.chain) === null || _a === void 0 ? void 0 : _a.startsWith('realtime_')) && !config.isServer && !opts.prompt && !opts.shape && !opts.cursor && !opts.includeSubPaths) {
                     try {
                         const { wsGet, wsQuery, hasActiveConnection } = await Promise.resolve().then(function () { return subscriptionV2; });
                         if (hasActiveConnection()) {
@@ -10619,7 +10634,7 @@ async function set(path, document, options) {
     return result;
 }
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
     // Returns the data that was set, or undefined if the document was already set.
     try {
         const config = await getConfig();
@@ -10662,12 +10677,24 @@ async function setMany(many, options) {
                 try {
                     const { wsSet, hasActiveConnection } = await Promise.resolve().then(function () { return subscriptionV2; });
                     if (hasActiveConnection()) {
+                        // Connection is active — send via WS. If this throws, the write
+                        // may have been applied server-side (ack lost). Do NOT fall through
+                        // to HTTP, as that would double-apply non-idempotent ops (Increment).
                         const wsResult = await wsSet(documents);
-                        // Normalize to same shape as HTTP 200 response so downstream handling is identical
                         setResponse = { data: wsResult, status: 200 };
                     }
                 }
-                catch ( /* fall through to HTTP */_j) { /* fall through to HTTP */ }
+                catch (wsError) {
+                    // Only fall through to HTTP if the request was never sent (connection not available).
+                    // If the request was sent and ack was lost (timeout), the server may have
+                    // applied it — re-sending via HTTP risks double-write for non-idempotent ops.
+                    const msg = (_d = wsError === null || wsError === void 0 ? void 0 : wsError.message) !== null && _d !== void 0 ? _d : '';
+                    const neverSent = msg.includes('not available') || msg.includes('connection timeout');
+                    if (!neverSent) {
+                        throw wsError;
+                    }
+                    // Safe to retry via HTTP — request was never sent
+                }
             }
             if (!setResponse) {
                 setResponse = await makeApiRequest('PUT', `items`, { documents }, options === null || options === void 0 ? void 0 : options._overrides);
@@ -10675,9 +10702,9 @@ async function setMany(many, options) {
         }
         catch (error) {
             if ((error === null || error === void 0 ? void 0 : error.statusCode) === 402 && (error === null || error === void 0 ? void 0 : error.error) === 'INSUFFICIENT_BALANCE') {
-                const deficitLamports = Number((_d = error.deficitLamports) !== null && _d !== void 0 ? _d : 0);
-                const deficitSol = Number((_e = error.deficitSol) !== null && _e !== void 0 ? _e : deficitLamports / 1000000000);
-                throw new InsufficientBalanceError(String((_f = error.address) !== null && _f !== void 0 ? _f : ''), Number((_g = error.balanceLamports) !== null && _g !== void 0 ? _g : 0), Number((_h = error.estimatedCostLamports) !== null && _h !== void 0 ? _h : 0), deficitLamports, deficitSol);
+                const deficitLamports = Number((_e = error.deficitLamports) !== null && _e !== void 0 ? _e : 0);
+                const deficitSol = Number((_f = error.deficitSol) !== null && _f !== void 0 ? _f : deficitLamports / 1000000000);
+                throw new InsufficientBalanceError(String((_g = error.address) !== null && _g !== void 0 ? _g : ''), Number((_h = error.balanceLamports) !== null && _h !== void 0 ? _h : 0), Number((_j = error.estimatedCostLamports) !== null && _j !== void 0 ? _j : 0), deficitLamports, deficitSol);
             }
             throw error;
         }
@@ -10699,7 +10726,13 @@ async function setMany(many, options) {
             let signedTransaction = undefined;
             for (let i = 0; i < transactions.length; i++) {
                 const curTx = transactions[i];
-                const transactionResult = await handleSolanaTransaction(curTx, authProvider, options);
+                let transactionResult;
+                if (curTx.serializedTransaction) {
+                    transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options);
+                }
+                else {
+                    transactionResult = await handleSolanaTransaction(curTx, authProvider, options);
+                }
                 lastTxSignature = transactionResult.transactionSignature;
                 signedTransaction = transactionResult.signedTransaction;
             }
@@ -10805,6 +10838,68 @@ async function setMany(many, options) {
         const transactionResult = await authProvider.runTransaction(undefined, solTransaction, options);
         return transactionResult;
     }
+    async function handlePreBuiltTransaction(tx, authProvider, options) {
+        var _a, _b;
+        const config = await getConfig();
+        const rpcUrl = config.rpcUrl || (tx.network === 'solana_devnet'
+            ? 'https://api.devnet.solana.com'
+            : 'https://api.mainnet-beta.solana.com');
+        const connection = new web3_js.Connection(rpcUrl, 'confirmed');
+        const txBytes = bufferExports.Buffer.from(tx.serializedTransaction, 'base64');
+        const transaction = web3_js.VersionedTransaction.deserialize(txBytes);
+        // Validate the transaction before signing: ensure only allowed programs
+        // and no unauthorized System program instructions (e.g., SOL transfers)
+        const TAROBASE_PROGRAM = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
+        const COMPUTE_BUDGET = 'ComputeBudget111111111111111111111111111111';
+        const SYSTEM_PROGRAM = '11111111111111111111111111111111';
+        const ALLOWED_PROGRAMS = new Set([TAROBASE_PROGRAM, COMPUTE_BUDGET, SYSTEM_PROGRAM]);
+        // System program instruction discriminators (first 4 bytes, little-endian u32)
+        const SYSTEM_TRANSFER = 2; // Transfer instruction index
+        const SYSTEM_TRANSFER_WITH_SEED = 11;
+        const accountKeys = transaction.message.staticAccountKeys;
+        for (const ix of transaction.message.compiledInstructions) {
+            if (ix.programIdIndex >= accountKeys.length) {
+                throw new Error('Pre-built transaction has program ID in lookup table (not allowed)');
+            }
+            const programId = accountKeys[ix.programIdIndex].toBase58();
+            if (!ALLOWED_PROGRAMS.has(programId)) {
+                throw new Error(`Pre-built transaction contains unauthorized program: ${programId}`);
+            }
+            // Block System program transfer instructions — a compromised DO could
+            // embed a SOL drain. Only allow createAccount/allocate (needed for PDA init).
+            if (programId === SYSTEM_PROGRAM && ix.data.length >= 4) {
+                const ixIndex = ix.data[0] | (ix.data[1] << 8) | (ix.data[2] << 16) | (ix.data[3] << 24);
+                if (ixIndex === SYSTEM_TRANSFER || ixIndex === SYSTEM_TRANSFER_WITH_SEED) {
+                    throw new Error('Pre-built transaction contains unauthorized System transfer instruction');
+                }
+            }
+        }
+        const signedTx = await authProvider.signTransaction(transaction);
+        const rawTx = signedTx.serialize();
+        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+            return {
+                transactionSignature: '',
+                signedTransaction: bufferExports.Buffer.from(rawTx).toString('base64'),
+                blockNumber: 0,
+                gasUsed: '0',
+            };
+        }
+        const signature = await connection.sendRawTransaction(rawTx, {
+            skipPreflight: false,
+            maxRetries: 3,
+        });
+        const confirmation = await connection.confirmTransaction({
+            signature,
+            blockhash: tx.blockhash,
+            lastValidBlockHeight: tx.lastValidBlockHeight,
+        }, 'confirmed');
+        return {
+            transactionSignature: signature,
+            signedTransaction: bufferExports.Buffer.from(rawTx).toString('base64'),
+            blockNumber: (_b = (_a = confirmation.context) === null || _a === void 0 ? void 0 : _a.slot) !== null && _b !== void 0 ? _b : 0,
+            gasUsed: '0',
+        };
+    }
     async function handleOffchainTransaction(tx, authProvider, options) {
         var _a, _b, _c, _d, _e, _f;
         const config = await getConfig();
@@ -12117,30 +12212,53 @@ class RealtimeStore {
         this.idbDirtyKeys = new Set();
         this.closed = false;
         this.authToken = null;
+        this.isServer = false;
+        this.tokenRefreshTimer = null;
+        // -----------------------------------------------------------------------
+        // WebSocket connection
+        // -----------------------------------------------------------------------
+        this.initPromise = null;
     }
     // -----------------------------------------------------------------------
     // Initialization
     // -----------------------------------------------------------------------
     async init() {
-        var _a, _b;
         const config = await getConfig();
         this.appId = config.appId;
         this.wsUrl = config.wsApiUrl;
-        if (config.authProvider) {
-            try {
-                const headers = await ((_b = (_a = config.authProvider).getAuthHeaders) === null || _b === void 0 ? void 0 : _b.call(_a));
-                if (headers === null || headers === void 0 ? void 0 : headers.Authorization) {
-                    this.authToken = headers.Authorization.replace('Bearer ', '');
-                }
-            }
-            catch ( /* no auth */_c) { /* no auth */ }
+        this.isServer = config.isServer;
+        await this.refreshToken();
+        this.startTokenRefresh();
+    }
+    async refreshToken() {
+        try {
+            const { getIdToken } = await Promise.resolve().then(function () { return utils; });
+            const token = await getIdToken(this.isServer);
+            if (token)
+                this.authToken = token;
         }
+        catch ( /* no auth available */_a) { /* no auth available */ }
+    }
+    startTokenRefresh() {
+        if (this.tokenRefreshTimer)
+            return;
+        this.tokenRefreshTimer = setInterval(async () => {
+            var _a;
+            const prevToken = this.authToken;
+            await this.refreshToken();
+            if (this.authToken && this.authToken !== prevToken && ((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN) {
+                // Token changed — reconnect with fresh token
+                this.ws.close(1000, 'Token refreshed');
+            }
+        }, 5 * 60 * 1000); // Check every 5 minutes
     }
-    // -----------------------------------------------------------------------
-    // WebSocket connection
-    // -----------------------------------------------------------------------
     async ensureConnected() {
         var _a;
+        if (!this.appId) {
+            if (!this.initPromise)
+                this.initPromise = this.init();
+            await this.initPromise;
+        }
         if (((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN)
             return;
         if (this.connectPromise)
@@ -12156,10 +12274,12 @@ class RealtimeStore {
             }
             const params = new URLSearchParams();
             params.set('apiKey', this.appId);
-            // Auth token sent via subprotocol to avoid leaking in URL/logs
+            if (this.authToken)
+                params.set('authorization', this.authToken);
+            // Note: token in URL is required until DO server supports subprotocol auth.
+            // WSS encrypts the full URL including query params on the wire.
             const url = `${this.wsUrl}?${params.toString()}`;
-            const protocols = this.authToken ? [`bearer-${this.authToken}`] : undefined;
-            const ws = protocols ? new WebSocket(url, protocols) : new WebSocket(url);
+            const ws = new WebSocket(url);
             this.ws = ws;
             const onOpen = () => {
                 ws.removeEventListener('error', onError);
@@ -12790,6 +12910,8 @@ class RealtimeStore {
             clearTimeout(this.reconnectTimer);
         if (this.idbFlushTimer)
             clearTimeout(this.idbFlushTimer);
+        if (this.tokenRefreshTimer)
+            clearInterval(this.tokenRefreshTimer);
         this.flushIdb();
         if (this.ws) {
             this.ws.close(1000, 'Store closed');
@@ -13899,15 +14021,15 @@ function clearIncompatibleSession() {
 // Lazy loaders for web-only providers.
 // Using dynamic import() ensures Metro (RN) never resolves these modules.
 async function loadPrivyWalletProvider() {
-    const mod = await Promise.resolve().then(function () { return require('./privy-wallet-provider-CQnyjLEI.js'); });
+    const mod = await Promise.resolve().then(function () { return require('./privy-wallet-provider-DsHSkIJJ.js'); });
     return mod.PrivyWalletProvider;
 }
 async function loadPhantomWalletProvider() {
-    const mod = await Promise.resolve().then(function () { return require('./phantom-wallet-provider-DV12qfW6.js'); });
+    const mod = await Promise.resolve().then(function () { return require('./phantom-wallet-provider-LGxBWZXy.js'); });
     return { PhantomWalletProvider: mod.PhantomWalletProvider };
 }
 async function loadSolanaMobileWalletProvider() {
-    const mod = await Promise.resolve().then(function () { return require('./solana-mobile-wallet-provider-BmXTQow5.js'); });
+    const mod = await Promise.resolve().then(function () { return require('./solana-mobile-wallet-provider-EkUSbs-q.js'); });
     return mod.SolanaMobileWalletProvider;
 }
 async function hotSwapToPrivyProvider(config) {
@@ -17339,6 +17461,7 @@ exports.base58 = base58;
 exports.buildSetDocumentsTransaction = buildSetDocumentsTransaction;
 exports.clearCache = clearCache;
 exports.closeAllSubscriptions = closeAllSubscriptions;
+exports.commonjsRequire = commonjsRequire;
 exports.confirmAndCheckTransaction = confirmAndCheckTransaction;
 exports.convertRemainingAccounts = convertRemainingAccounts;
 exports.count = count;
@@ -17370,6 +17493,7 @@ exports.onAuthLoadingChanged = onAuthLoadingChanged;
 exports.onAuthStateChanged = onAuthStateChanged;
 exports.reconnectWithNewAuth = reconnectWithNewAuth;
 exports.refreshSession = refreshSession;
+exports.require$$0 = require$$0;
 exports.requireBuffer = requireBuffer;
 exports.resetRealtimeStore = resetRealtimeStore;
 exports.runExpression = runExpression;
@@ -17393,4 +17517,4 @@ exports.wsGet = wsGet;
 exports.wsGetMany = wsGetMany;
 exports.wsQuery = wsQuery;
 exports.wsSet = wsSet;
-//# sourceMappingURL=index.native-DIXtlrL_.js.map
+//# sourceMappingURL=index.native-CpA5KDvL.js.map