@wishknish/knishio-client-ts 1.1.0 → 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wishknish/knishio-client-ts",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "productName": "Knish.IO TypeScript SDK Client",
   "description": "TypeScript implementation of the Knish.IO SDK to consume Knish.IO GraphQL APIs with enhanced type safety.",
   "license": "GPL-3.0-or-later",
@@ -81,7 +81,11 @@
     "vitest": "^4.1.11"
   },
   "resolutions": {
-    "wonka": "6.3.6"
+    "wonka": "6.3.6",
+    "esbuild": "^0.28.1"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1"
   },
   "browserslist": [
     "> 1%",

package/src/KnishIOClient.ts

@@ -2572,6 +2572,7 @@ export default class KnishIOClient {
         pubkey: response.pubKey()
       }, wallet)
       this.setAuthToken(authToken)
+      this.lastMoleculeQuery = null
     } else {
       throw new AuthorizationRejectedException(
         `KnishIOClient::requestProfileAuthToken() - Authorization attempt rejected by ledger. Reason: ${response.reason()}`

package/src/index.ts

@@ -403,7 +403,7 @@ export {
 // MUST equal package.json's "version". The CI `version consistency` job enforces this via
 // .github/scripts/check-version.sh, which parses this exact line — keep the literal form
 // `export const SDK_VERSION = '<semver>'` intact so the gate can read it.
-export const SDK_VERSION = '1.1.0'
+export const SDK_VERSION = '1.2.1'
 export const SDK_NAME = 'KnishIO-Client-TS'
 export const COMPATIBLE_SERVER_VERSIONS = [4, 5]
 

package/src/libraries/GraphQLClient.ts

@@ -55,6 +55,7 @@ import {
 } from '@urql/core'
 import { createClient as createWSClient } from 'graphql-ws'
 import { pipe, subscribe } from 'wonka'
+import { CodeException } from '@/exception'
 import type {
   GraphQLClient as IGraphQLClient,
   GraphQLRequest,
@@ -200,17 +201,29 @@ export default class GraphQLClient implements IGraphQLClient {
   private async cipherFetch(input: any, init: any): Promise<Response> {
     const wallet = this.$__wallet
     const serverPubkey = this.$__pubkey
-    let encryptedRequest = false
+    // Non-null only on the encrypted path, so the response decrypt needs no assertion.
+    let cipherWallet: Wallet | null = null
     let requestInit = init
 
-    if (wallet && serverPubkey && init && typeof init.body === 'string' && this.shouldEncrypt(init.body)) {
+    // Decide the bypass FIRST, then demand the keys: a bypassed operation (`__schema`,
+    // `ContinuId`, `AccessToken`, U-isotope `ProposeMolecule`) must still go out in plaintext or
+    // the auth bootstrap would deadlock encrypting to a server pubkey it has not learned yet.
+    // Anything else on an encryption-enabled client fails closed rather than silently
+    // downgrading to plaintext (matches PHP Cipher.php / Kotlin HttpClient).
+    if (init && typeof init.body === 'string' && this.shouldEncrypt(init.body)) {
+      if (!wallet) {
+        throw new CodeException('Authorized wallet missing.')
+      }
+      if (!serverPubkey) {
+        throw new CodeException('Server public key missing.')
+      }
       const hashVar = await wallet.encryptStringML(init.body, serverPubkey)
       requestInit = { ...init, body: JSON.stringify({ query: CIPHER_HASH_QUERY, variables: { Hash: hashVar } }) }
-      encryptedRequest = true
+      cipherWallet = wallet
     }
 
     const response = await fetch(input, requestInit)
-    if (!encryptedRequest) {
+    if (!cipherWallet) {
       return response
     }
 
@@ -228,7 +241,7 @@ export default class GraphQLClient implements IGraphQLClient {
       // Plaintext (e.g. a validator-side error response) — pass through unchanged.
       return new Response(text, init2)
     }
-    const decrypted = await wallet!.decryptMyMessageML(JSON.parse(hash))
+    const decrypted = await cipherWallet.decryptMyMessageML(JSON.parse(hash))
     return new Response(decrypted != null ? decrypted : text, init2)
   }
 

package/src/response/ResponseProposeMolecule.ts

@@ -169,7 +169,8 @@ export default class ResponseProposeMolecule extends Response {
         code: 'HASH_MISMATCH'
       })
     }
-    if (/ots.*position.*reuse|position.*already.*used|ots.*verification/.test(lc)) {
+    // Validator 0.5.0 words the same rejection as "OTS key reuse rejected ... is already consumed".
+    if (/ots.*(?:position|key).*reuse|position.*already.*(?:used|consumed)|ots.*verification/.test(lc)) {
       return new SignatureMismatchException(reason, {
         details: { reason },
         code: 'OTS_VERIFICATION_FAILED'