@terminal3/t3n-sdk 0.12.1 → 0.13.1

package/dist/src/client/config.d.ts

@@ -2,7 +2,7 @@
  * Configuration types for T3n Client
  */
 import { WasmComponent } from "../wasm";
-import { SessionId, GuestToHostHandlers } from "../types";
+import { GuestToHostHandlers } from "../types";
 import { Logger, LogLevel } from "../utils/logger";
 import { Transport } from "./transport";
 /**
@@ -15,8 +15,6 @@ export interface T3nClientConfig {
     wasmComponent: WasmComponent;
     /** Optional transport layer - if not provided, uses HttpTransport with baseUrl */
     transport?: Transport;
-    /** Optional session ID - will be generated if not provided */
-    sessionId?: SessionId;
     /** Optional request timeout in milliseconds (default: 30000) - used for HttpTransport */
     timeout?: number;
     /** Optional custom headers to include in requests */

package/dist/src/client/t3n-client.d.ts

@@ -12,7 +12,22 @@ import { SessionId, Did, SessionStatus, AuthInput, HandshakeResult } from "../ty
 export declare class T3nClient {
     private readonly config;
     private readonly transport;
-    private readonly sessionId;
+    /**
+     * Server-minted session ID, set by {@link handshake} from the
+     * `Session-Id` response header (pentest M-1 / MAT-983). `null`
+     * until the handshake completes. Client code cannot set it — the
+     * former `config.sessionId` hook was the session-fixation vector
+     * this fix closes.
+     */
+    private sessionId;
+    /**
+     * Set by {@link sendRpcRequest} when an `auth.handshake` RPC is
+     * actually issued. Decouples the "flow completed without talking
+     * to a server" case (unit-test mocks that only exercise handler
+     * delegation) from the real "server must mint the id" invariant:
+     * we only enforce the mint requirement when a round-trip happened.
+     */
+    private handshakeSentRpc;
     private readonly logger;
     private readonly encryption;
     private status;
@@ -71,7 +86,11 @@ export declare class T3nClient {
      * Execute an action on the T3n node
      */
     execute(payload: unknown): Promise<string>;
-    getSessionId(): SessionId;
+    /**
+     * The server-minted session ID once handshake has completed, or
+     * `null` beforehand (pentest M-1 / MAT-983).
+     */
+    getSessionId(): SessionId | null;
     getStatus(): SessionStatus;
     getDid(): Did | null;
     getLastSetCookie(): string | null;
@@ -129,6 +148,16 @@ export declare class T3nClient {
      * Send an RPC request with automatic encryption/decryption
      */
     private sendRpcRequest;
+    /**
+     * Capture the server-minted `Session-Id` from the last handshake
+     * response headers (pentest M-1 / MAT-983). Validates shape so a
+     * broken or MITM'd response fails loudly instead of leaving a
+     * garbage value in the client. Idempotent: only the first valid
+     * mint per session is honoured — subsequent handshake RPC legs
+     * (none exist today, but the state-machine loop can iterate) do
+     * not overwrite an already-set value.
+     */
+    private captureMintedSessionId;
     /**
      * Get the finalized session blob (for `session.encrypt` calls).
      * Populated by `tryFinalize` once the handshake state machine

package/dist/src/client/transport.d.ts

@@ -76,15 +76,25 @@ export declare class HttpTransport implements Transport {
  */
 export declare class MockTransport implements Transport {
     private responses;
+    private responseHeaders;
+    private lastResponseHeaders;
     private requests;
     /**
      * Mock a response for a specific method
      */
     mockResponse(method: string, response: Partial<JsonRpcResponse>): void;
+    /**
+     * Mock response headers for a specific method. Used by tests to
+     * simulate the server-minted `Session-Id` header the SDK picks up
+     * from the `auth.handshake` response (MAT-983). Unset methods
+     * default to no headers.
+     */
+    mockResponseHeaders(method: string, headers: Record<string, string>): void;
     /**
      * Mock an error response for a specific method
      */
     mockError(method: string, code: number, message: string, data?: unknown): void;
+    getLastResponseHeaders(): Record<string, string>;
     /**
      * Get all requests that were sent
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@terminal3/t3n-sdk",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "type": "module",
   "description": "T3n TypeScript SDK - A minimal SDK that mirrors the server's RPC handler approach",
   "main": "dist/index.js",