fix: reject inbound messages on expired sessions (WAPI-1130)

[chakra-guy]

Summary

• Adds session expiry check to the inbound message handler in BaseClient, closing a gap where only outbound messages were checked for expiry
• Expired inbound messages are silently discarded with an error event emitted and disconnect triggered
• Consolidates the duplicate isSessionExpired / checkSessionExpiry methods into a single checkSessionExpiry that returns a boolean, reused by both the inbound and outbound paths

Background

The Cyfrin audit identified that while sendMessage() checks for session expiry before sending, the transport.on("message", ...) handler did not perform any expiry check. This meant a message arriving on an expired session would still be decrypted and processed.

Changes

• packages/core/src/base-client.ts: Unified checkSessionExpiry() method (returns boolean, handles disconnect + error emission). Used in both the inbound message handler (early return) and sendMessage (throws after check).
• packages/core/src/base-client.integration.test.ts: New test case for expired session message rejection
• apps/integration-tests/src/end-to-end.integration.test.ts: New E2E test verifying messages sent to an expired receiver are dropped and trigger SESSION_EXPIRED

Test plan

• yarn build passes
• yarn test:unit passes (63/63 tests)
• yarn lint passes (no new warnings)
• Integration tests pass (8/8 tests, including new expired session test)

---

Note

Medium Risk
Touches core session lifecycle behavior for all inbound messages; could introduce unexpected disconnects or error emissions if expiry timing/clock skew is mishandled, though changes are small and covered by new tests.

Overview
Inbound message handling now enforces session expiry. BaseClient checks expiry on every transport message event and, if expired, triggers disconnect cleanup and emits a SESSION_EXPIRED error instead of decrypting/processing the payload.

checkSessionExpiry() is refactored to return a boolean (expired vs not) and is reused by both inbound handling and sendMessage() (which now throws when the check reports expiry). New integration and E2E tests cover dropping inbound messages to an expired receiver, and the core changelog is updated.

^{Written by Cursor Bugbot for commit 5c38e3b. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[adonesky1]

LGTM!