@bounded-sh/core 0.0.114 → 0.0.115

package/dist/client/operations.d.ts

@@ -30,6 +30,20 @@ export type RequestOverrides = {
      * deterministically; production builds a `Connection` from `config.rpcUrl`.
      */
     _solanaRpc?: SolanaWriteRpc;
+    /**
+     * @internal The venue grant write lane (venue-grant-write.ts). A single-use grant, not the
+     * caller's session, authenticates the write, so `setMany` also lets the lane refuse the
+     * execution lane a 202 reports, takes the poofnet commit's credential from the lane, and
+     * skips the post-confirm mirror read a grant cannot authorize. App code never sets it.
+     */
+    _grantLane?: GrantLane;
+};
+/** @internal See {@link RequestOverrides._grantLane}. */
+export type GrantLane = {
+    /** Throws to refuse `chain`, the execution lane the 202 reported, before anything is signed. */
+    assertLane(chain: string): void;
+    /** The credential for the poofnet `PUT items/signed` commit. A grant is single use, so each call mints a fresh one. */
+    commitHeaders(): Promise<Record<string, string>>;
 };
 export type SetOptions = {
     shouldSubmitTx?: boolean;

package/dist/client/reconcile.d.ts

@@ -1,3 +1,15 @@
+/**
+ * Reconciliation for a `submitted` write receipt.
+ *
+ * A returned object cannot transition itself, and calling `set` again builds a
+ * FRESH transaction — which is exactly what must not happen while the first
+ * signature may still land. Without this call the `submitted` state is a dead
+ * end and its terminal exits are unreachable.
+ *
+ * Everything here polls the SAME signature. Nothing here ever builds a new
+ * transaction or broadcasts anything.
+ */
+import type { ClientConfig } from './config';
 import type { RequestOverrides } from './operations';
 import type { SetResult } from '../types';
 export type ReconcileSetResultOptions = {
@@ -18,6 +30,12 @@ export type WaitForSetResultOptions = ReconcileSetResultOptions & {
     /** Cancels the wait. The latest `submitted` receipt is returned, never discarded. */
     signal?: AbortSignal;
 };
+/**
+ * The Solana execution lane a client config REQUIRES, or `null` when the config
+ * carries no constraint. Only a positive contradiction rejects a receipt — an
+ * unmapped or unset `chain` is not evidence of a mismatch.
+ */
+export declare function requiredSolanaChain(config: ClientConfig): string | null;
 /**
  * Poll the SAME signature a `submitted` receipt carries and return the
  * resulting `SetResult`.

package/dist/client/venue-grant-write.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The venue grant write lane: create ONE document in another app (an OpenApps venue) as the
+ * wallet signed in here, authorized by a single-use grant instead of a venue session
+ * (VENUE-GRANT-DESIGN.md). The grant only lets the venue build that one transaction for that
+ * wallet; the wallet's own signature, checked by the venue's own rule, is the authority.
+ *
+ * The grant itself is minted by Bounded Auth at `POST {humanAuthApiUrl}/app-token/venue-grant`
+ * (contract: packages/cdk/cloudflare/shared/venue-grant.ts, which this package cannot import
+ * because the SDK packages publish separately). This module only spends one.
+ *
+ * It reuses `setMany`'s request and 202 handling through `_overrides`: the `_config` snapshot is
+ * this app's own config re-pointed at the VENUE app id, so the pre-sign validator (OA-0001) binds
+ * the venue app id and the full expected intent, and the signer stays this app's own AuthProvider
+ * (a Turnkey session or a Wallet Standard wallet). Nothing here is reachable from `createClient()`,
+ * which stays read-only.
+ *
+ * The chain a write runs on is the VENUE's, stated by its 202, never the app's: the app's own
+ * `chain` can only agree with it or be refused, and the transaction is broadcast through the app's
+ * `rpcUrl` only when the app configured that same chain, otherwise through `resolveRpcUrl(chain)`.
+ */
+import { type ClientConfig } from './config';
+import { type SetOptions } from './operations';
+import type { SetResult, SolanaWriteRpc } from '../types';
+export interface VenueGrantWriteOptions {
+    /** The venue app the grant was minted for. The write and its 202 validation bind THIS app id, never the caller's own. */
+    venueAppId: string;
+    /** The single-use grant that authorizes this one create. */
+    grant: string;
+    /**
+     * Mints a fresh grant for the same kind and id. The `PUT items` that built the approval spent the
+     * first, so the poofnet `PUT items/signed` commit needs its own. Called only on poofnet, after the
+     * wallet has signed.
+     */
+    commitGrant: () => Promise<string>;
+    /** As `set`'s `onBroadcast`: persist the signed transaction's receipt before it is broadcast (Solana lanes). */
+    onBroadcast?: SetOptions['onBroadcast'];
+    /**
+     * The RPC for a Solana lane the app did not configure itself: given the chain the venue's 202
+     * reported (`solana_devnet` or `solana_mainnet`), its RPC url, or null for none. The client SDK
+     * passes its platform default. See {@link resolveVenueRpcUrl} for how it ranks against the app's own.
+     */
+    resolveRpcUrl?: (chain: string) => string | null | undefined;
+    /** @internal Test seam, as `RequestOverrides._solanaRpc`. */
+    _solanaRpc?: SolanaWriteRpc;
+}
+/**
+ * The RPC a venue write on Solana lane `chain` is broadcast through, and a saved receipt of it is
+ * reconciled through. The app's own `rpcUrl` counts only when the app also configured this chain
+ * (an `rpcUrl` alone does not say which chain it speaks); otherwise `resolveRpcUrl(chain)`. Null
+ * when neither yields one.
+ *
+ * @internal Shared by the lane and by the client SDK's reconciliation of a saved receipt.
+ */
+export declare function resolveVenueRpcUrl(config: ClientConfig, chain: string, resolveRpcUrl?: (chain: string) => string | null | undefined): string | null;
+/**
+ * Write `document` at `path` in the venue `venueAppId` with a single-use grant. Resolves to the
+ * same discriminated {@link SetResult} as `set`, and throws exactly as `set` does, so the same
+ * `isWriteNotApplied` reading applies.
+ *
+ * @internal Used by `fundVenueEscrow` and `disputeVenueEscrow` in @bounded-sh/client. Not a stable API.
+ */
+export declare function setWithVenueGrant(path: string, document: Record<string, unknown>, options: VenueGrantWriteOptions): Promise<SetResult>;

package/dist/client/write-outcome.d.ts

@@ -14,6 +14,7 @@
  *   `onBroadcast` hook refusing). Nothing was sent.
  * - `broadcast_rejected`: the RPC definitively refused the signed bytes
  *   (preflight simulation, invalid transaction). They never entered the network.
+ *   On poofnet, the realtime worker answering the signed commit with a 4xx.
  * - `failed_onchain`: the transaction landed and failed, so the write reverted.
  *
  * The tag is plain data on the thrown object (`writeOutcome` + `writePhase`),

package/dist/{index--ahzzmm5.js → index-5TMFraRK.js}

@@ -421,6 +421,97 @@ axiosRetry.exponentialDelay = exponentialDelay;
 axiosRetry.linearDelay = linearDelay;
 axiosRetry.isRetryableError = isRetryableError;
 
+// Classify a session-refresh failure as a DEFINITIVE rejection of the credential
+// vs a TRANSPORT failure (DS4-0054).
+//
+// The restore path refreshes an expired token at boot. The old code destroyed the
+// local session on ANY refresh failure, so a network blip - common on mobile -
+// signed the user out. Only a real HTTP rejection of the refresh token proves the
+// session is invalid; anything else is unknown, and the safe move is to RETAIN local
+// state and retry. Keeping a genuinely dead session locally is harmless: every
+// request still fails closed server-side, and the next refresh that reaches the
+// server clears it. Destroying a live session on a blip is user-visible damage.
+//
+// `/session/refresh` answers 401 (session_revoked / invalid_grant) when the token is
+// dead. 400 (bad request), 408/429 (transient), and 5xx are NOT proof the session is
+// invalid, and a network/DNS/timeout error carries no HTTP response at all.
+//
+// This is the single classifier for every refresh path: the per-request freshness
+// check (auth-token-freshness) and the boot-time restore paths (web + RN session
+// managers) all import it, so "definitive" means the same thing everywhere. It lives
+// in this leaf module to avoid an import cycle between those consumers.
+function isDefinitiveRejection(err) {
+    var _a;
+    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
+    return status === 401 || status === 403;
+}
+// How long past the id token's own `exp` a session may survive purely on
+// transport failures.
+//
+// "Retain on a blip" must not become "retain forever". A statusless failure is
+// unknown, so the first ones are absorbed - but a revoked session, or a gateway
+// that rewrites the issuer's 401 into a 502, would otherwise keep
+// isAuthenticated() reporting a signed-in user for as long as the device never
+// reaches the issuer again. One day covers an offline flight or a bad-network day
+// while making the retention finite: past it, an unrefreshable session is cleared
+// and the user is asked to sign in again.
+const TRANSPORT_RETENTION_GRACE_MS = 24 * 60 * 60 * 1000;
+/**
+ * May a session whose refresh failed WITHOUT a definitive rejection be kept?
+ *
+ * `expSeconds` is the id token's `exp` claim. Fails closed: a missing or
+ * non-numeric expiry is not a usable bound, so such a session is never retained.
+ */
+function mayRetainAfterTransportFailure(expSeconds, now = Date.now()) {
+    if (typeof expSeconds !== 'number' || !Number.isFinite(expSeconds))
+        return false;
+    return now <= expSeconds * 1000 + TRANSPORT_RETENTION_GRACE_MS;
+}
+// Backoff between refresh attempts that failed WITHOUT a definitive rejection.
+//
+// A transport failure retains the session (above), and every authenticated request
+// and the realtime token timer asks for a fresh token - so without a pause, an issuer
+// that answers 503 or 429 gets one refresh per request from every open tab, which is
+// the exact load that keeps it down. After such a failure the same refresh token is
+// not sent again until the backoff passes: 15s, doubling, capped at 10 minutes, or the
+// issuer's own Retry-After when it is longer. Callers inside the window get a
+// non-definitive error at once (`code: 'refresh_backoff'`) and treat it like the
+// failure that started it. A success, or a different token, starts clean.
+const REFRESH_BACKOFF_BASE_MS = 15000;
+const REFRESH_BACKOFF_MAX_MS = 10 * 60000;
+const refreshBackoff = new Map();
+function retryAfterMs(err) {
+    var _a, _b;
+    const headers = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.headers;
+    const raw = headers && ((_b = headers['retry-after']) !== null && _b !== void 0 ? _b : headers['Retry-After']);
+    const seconds = Number(raw);
+    return Number.isFinite(seconds) && seconds > 0 ? Math.min(seconds * 1000, REFRESH_BACKOFF_MAX_MS) : 0;
+}
+/** Throws a non-definitive `refresh_backoff` error while `key` is still backing off. */
+function assertRefreshAllowed(key, now = Date.now()) {
+    const entry = refreshBackoff.get(key);
+    if (!entry || now >= entry.until)
+        return;
+    const err = new Error('Session refresh is backing off after a failed attempt');
+    err.code = 'refresh_backoff';
+    err.retryAt = entry.until;
+    throw err;
+}
+/** Record the outcome of a refresh attempt for `key`. */
+function recordRefreshOutcome(key, err, now = Date.now()) {
+    var _a, _b;
+    if (!err || isDefinitiveRejection(err)) {
+        refreshBackoff.delete(key);
+        return;
+    }
+    const failures = ((_b = (_a = refreshBackoff.get(key)) === null || _a === void 0 ? void 0 : _a.failures) !== null && _b !== void 0 ? _b : 0) + 1;
+    const backoff = Math.min(REFRESH_BACKOFF_BASE_MS * 2 ** (failures - 1), REFRESH_BACKOFF_MAX_MS);
+    refreshBackoff.set(key, { failures, until: now + Math.max(backoff, retryAfterMs(err)) });
+    // One entry per refresh token; a long-lived tab rotates through a handful at most.
+    if (refreshBackoff.size > 32)
+        refreshBackoff.delete(refreshBackoff.keys().next().value);
+}
+
 /**
  * Resolve the refresh/revoke base URL to a CONFIGURED issuer only. The session's
  * `issuer` is persisted in client storage; if that storage is tampered (e.g. XSS)
@@ -574,6 +665,9 @@ async function refreshSession(refreshToken, issuer) {
     const existing = refreshInFlightByToken.get(dedupeKey);
     if (existing)
         return existing;
+    // Inside a backoff window this throws at once, so a failing issuer is not asked again
+    // by every request and timer in the page (see refresh-error.ts).
+    assertRefreshAllowed(dedupeKey);
     let currentFlight;
     currentFlight = (async () => {
         try {
@@ -587,8 +681,13 @@ async function refreshSession(refreshToken, issuer) {
                 refreshToken,
                 appId
             }, { headers: { 'Content-Type': 'application/json' }, timeout: 30000 });
+            recordRefreshOutcome(dedupeKey, null);
             return response.data;
         }
+        catch (error) {
+            recordRefreshOutcome(dedupeKey, error);
+            throw error;
+        }
         finally {
             // Only remove our own entry, and only if it is still the active flight
             // for this token (a later refresh of the same token cannot have replaced
@@ -646,53 +745,6 @@ async function revokeSession(refreshToken, issuer) {
 async function signSessionCreateMessage(_signMessageFunction) {
 }
 
-// Classify a session-refresh failure as a DEFINITIVE rejection of the credential
-// vs a TRANSPORT failure (DS4-0054).
-//
-// The restore path refreshes an expired token at boot. The old code destroyed the
-// local session on ANY refresh failure, so a network blip - common on mobile -
-// signed the user out. Only a real HTTP rejection of the refresh token proves the
-// session is invalid; anything else is unknown, and the safe move is to RETAIN local
-// state and retry. Keeping a genuinely dead session locally is harmless: every
-// request still fails closed server-side, and the next refresh that reaches the
-// server clears it. Destroying a live session on a blip is user-visible damage.
-//
-// `/session/refresh` answers 401 (session_revoked / invalid_grant) when the token is
-// dead. 400 (bad request), 408/429 (transient), and 5xx are NOT proof the session is
-// invalid, and a network/DNS/timeout error carries no HTTP response at all.
-//
-// This is the single classifier for every refresh path: the per-request freshness
-// check (auth-token-freshness) and the boot-time restore paths (web + RN session
-// managers) all import it, so "definitive" means the same thing everywhere. It lives
-// in this leaf module to avoid an import cycle between those consumers.
-function isDefinitiveRejection(err) {
-    var _a;
-    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
-    return status === 401 || status === 403;
-}
-// How long past the id token's own `exp` a session may survive purely on
-// transport failures.
-//
-// "Retain on a blip" must not become "retain forever". A statusless failure is
-// unknown, so the first ones are absorbed - but a revoked session, or a gateway
-// that rewrites the issuer's 401 into a 502, would otherwise keep
-// isAuthenticated() reporting a signed-in user for as long as the device never
-// reaches the issuer again. One day covers an offline flight or a bad-network day
-// while making the retention finite: past it, an unrefreshable session is cleared
-// and the user is asked to sign in again.
-const TRANSPORT_RETENTION_GRACE_MS = 24 * 60 * 60 * 1000;
-/**
- * May a session whose refresh failed WITHOUT a definitive rejection be kept?
- *
- * `expSeconds` is the id token's `exp` claim. Fails closed: a missing or
- * non-numeric expiry is not a usable bound, so such a session is never retained.
- */
-function mayRetainAfterTransportFailure(expSeconds, now = Date.now()) {
-    if (typeof expSeconds !== 'number' || !Number.isFinite(expSeconds))
-        return false;
-    return now <= expSeconds * 1000 + TRANSPORT_RETENTION_GRACE_MS;
-}
-
 // Shared session-binding guard for the web + React Native session managers, so
 // the cross-principal refresh guard (#220 / #221) lives in ONE place and the two
 // managers can't drift apart. Base64url decoding differs by platform (browser
@@ -4190,7 +4242,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-DPR9uw0N.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-BVwD6WVm.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4539,6 +4591,16 @@ function classifyToken(token, nowMs = Date.now(), skewMs = TOKEN_EXPIRY_SKEW_MS)
         return 'expiring-soon';
     return 'fresh';
 }
+function tokenExpSeconds(token) {
+    var _a;
+    try {
+        const exp = (_a = JSON.parse(decodeBase64Url(token.split('.')[1]))) === null || _a === void 0 ? void 0 : _a.exp;
+        return typeof exp === 'number' ? exp : undefined;
+    }
+    catch (_b) {
+        return undefined;
+    }
+}
 /** Short, non-secret fingerprint used only to key the in-flight map. Never logged. */
 function tokenFingerprint(token) {
     let h = 5381;
@@ -4667,6 +4729,12 @@ async function getFreshAuthToken(isServer = false, options = {}) {
             // it is valid right now, so use it rather than failing the request.
             if (stillUsable)
                 return idToken;
+            // ...but not forever: past its expiry plus the same grace the restore path
+            // allows, a session that still cannot refresh is dropped, so an open tab stops
+            // asking an issuer that will never answer it.
+            if (!mayRetainAfterTransportFailure(tokenExpSeconds(idToken))) {
+                await clearDeadSession(isServer, generation);
+            }
             throw makeAuthExpiredError('Authentication expired and refresh failed', status);
         }
         finally {
@@ -7533,7 +7601,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-CR80Jac5.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-BiChlioj.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8911,7 +8979,7 @@ async function set(path, document, options) {
  * state appears only under `observation`/`mirrorSync` once actually observed.
  */
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
     // Returns the data that was set, or undefined if the document was already set.
     try {
         // A server WalletClient threads its immutable config snapshot; the default
@@ -9025,13 +9093,15 @@ async function setMany(many, options) {
                     throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
                         'Nothing was signed or submitted.');
                 }
+                const grantLane = (_l = options === null || options === void 0 ? void 0 : options._overrides) === null || _l === void 0 ? void 0 : _l._grantLane;
+                grantLane === null || grantLane === void 0 ? void 0 : grantLane.assertLane(workerChain);
                 if (workerChain === 'realtime_offchain') {
                     // Poofnet: the wallet signs the worker's unsendable approval message and
                     // the worker verifies and commits it. Nothing is submitted to any chain.
                     if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
                         throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
                     }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-BMB6sq_i.js'); });
+                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-B3u6Arbf.js'); });
                     const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
                     // Signing-only, exactly as on a real chain: signed and NOT committed.
                     if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
@@ -9041,12 +9111,25 @@ async function setMany(many, options) {
                             poofnetIntentId: curTx.poofnetIntentId,
                         };
                     }
-                    // The commit PUT is the one ambiguous step of this lane: a lost response
-                    // may follow a commit, so its failures stay untagged (read the path back).
+                    // A grant lane's first credential is spent by the PUT that built this approval, so the
+                    // commit's is minted now, before `sending`: failing to mint sends nothing.
+                    const commitHeaders = await (grantLane === null || grantLane === void 0 ? void 0 : grantLane.commitHeaders());
+                    // The commit PUT is the one ambiguous step of this lane: a lost response may follow a
+                    // commit, so a transport failure or a 5xx stays untagged (read the path back). A 4xx is
+                    // realtime stating it committed nothing (the intent expired or was taken, the signer did
+                    // not match, a rule refused it), as for the first PUT. 408 and 499 are a proxy's words,
+                    // not realtime's, and may follow a commit, so they stay ambiguous too.
                     sending = true;
-                    const commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, options === null || options === void 0 ? void 0 : options._overrides);
-                    if (commitResponse.status !== 200) {
-                        throw new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`);
+                    let commitResponse;
+                    try {
+                        commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, commitHeaders ? Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _getAuthHeaders: async () => commitHeaders }) : options === null || options === void 0 ? void 0 : options._overrides);
+                        if (commitResponse.status !== 200) {
+                            throw Object.assign(new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`), { statusCode: commitResponse.status });
+                        }
+                    }
+                    catch (error) {
+                        const status = Number(error === null || error === void 0 ? void 0 : error.statusCode);
+                        throw status >= 400 && status < 500 && status !== 408 && status !== 499 ? markWriteNotApplied(error, 'broadcast_rejected') : error;
                     }
                     return directCommitResult(commitResponse, documents);
                 }
@@ -9056,7 +9139,7 @@ async function setMany(many, options) {
                             'Nothing was signed or submitted.');
                     }
                     const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-BMB6sq_i.js'); });
+                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-B3u6Arbf.js'); });
                     // OA-0001: derive the expected intent from OUR OWN request (the one
                     // ground truth a tampered builder response cannot change) so the
                     // validator can reject any transaction whose operation semantics
@@ -9095,7 +9178,9 @@ async function setMany(many, options) {
                     }
                     // Confirmed: the receipt is already complete, so the mirror read is a
                     // best-effort enrichment reported in `mirrorSync`, never a rejection.
-                    const mirrorSync = await attemptMirrorSync(requestedPaths, options);
+                    const mirrorSync = grantLane
+                        ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
+                        : await attemptMirrorSync(requestedPaths, options);
                     return {
                         status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
                         transactionId: solanaOutcome.transactionSignature,
@@ -10118,6 +10203,84 @@ function createAppTokenAuthHeaders(options) {
     };
 }
 
+/**
+ * The venue grant write lane: create ONE document in another app (an OpenApps venue) as the
+ * wallet signed in here, authorized by a single-use grant instead of a venue session
+ * (VENUE-GRANT-DESIGN.md). The grant only lets the venue build that one transaction for that
+ * wallet; the wallet's own signature, checked by the venue's own rule, is the authority.
+ *
+ * The grant itself is minted by Bounded Auth at `POST {humanAuthApiUrl}/app-token/venue-grant`
+ * (contract: packages/cdk/cloudflare/shared/venue-grant.ts, which this package cannot import
+ * because the SDK packages publish separately). This module only spends one.
+ *
+ * It reuses `setMany`'s request and 202 handling through `_overrides`: the `_config` snapshot is
+ * this app's own config re-pointed at the VENUE app id, so the pre-sign validator (OA-0001) binds
+ * the venue app id and the full expected intent, and the signer stays this app's own AuthProvider
+ * (a Turnkey session or a Wallet Standard wallet). Nothing here is reachable from `createClient()`,
+ * which stays read-only.
+ *
+ * The chain a write runs on is the VENUE's, stated by its 202, never the app's: the app's own
+ * `chain` can only agree with it or be refused, and the transaction is broadcast through the app's
+ * `rpcUrl` only when the app configured that same chain, otherwise through `resolveRpcUrl(chain)`.
+ */
+function laneError(code, message) {
+    return Object.assign(new Error(message), { code });
+}
+const isSolanaLane = (chain) => chain === 'solana_devnet' || chain === 'solana_mainnet';
+/**
+ * The RPC a venue write on Solana lane `chain` is broadcast through, and a saved receipt of it is
+ * reconciled through. The app's own `rpcUrl` counts only when the app also configured this chain
+ * (an `rpcUrl` alone does not say which chain it speaks); otherwise `resolveRpcUrl(chain)`. Null
+ * when neither yields one.
+ *
+ * @internal Shared by the lane and by the client SDK's reconciliation of a saved receipt.
+ */
+function resolveVenueRpcUrl(config, chain, resolveRpcUrl) {
+    var _a, _b;
+    const own = requiredSolanaChain(config) === chain ? (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim() : '';
+    return own || ((_b = resolveRpcUrl === null || resolveRpcUrl === void 0 ? void 0 : resolveRpcUrl(chain)) === null || _b === void 0 ? void 0 : _b.trim()) || null;
+}
+/**
+ * Refuse, before the wallet is asked to sign, a 202 whose execution lane this app is not
+ * configured for: a mainnet app must never sign a devnet or poofnet approval (a poofnet "funding"
+ * moves no real USDC). Then point the Solana lane's broadcast at the RPC for the venue's chain.
+ * Poofnet broadcasts nothing, so it needs no RPC.
+ */
+function assertExecutionLane(config, chain, options) {
+    const required = requiredSolanaChain(config);
+    if (required && chain !== required) {
+        throw laneError('chain_mismatch', `The venue answered on "${chain}" but this app is configured for "${config.chain}". Nothing was signed.`);
+    }
+    if (!isSolanaLane(chain))
+        return;
+    const rpcUrl = resolveVenueRpcUrl(config, chain, options.resolveRpcUrl);
+    if (rpcUrl)
+        config.rpcUrl = rpcUrl;
+    else if (!options._solanaRpc) {
+        throw laneError('chain_not_configured', `The venue runs on ${chain}, but no RPC could be resolved to broadcast through. ` +
+            `Pass chain: '${chain}' and an rpcUrl to init(). Nothing was signed.`);
+    }
+}
+/**
+ * Write `document` at `path` in the venue `venueAppId` with a single-use grant. Resolves to the
+ * same discriminated {@link SetResult} as `set`, and throws exactly as `set` does, so the same
+ * `isWriteNotApplied` reading applies.
+ *
+ * @internal Used by `fundVenueEscrow` and `disputeVenueEscrow` in @bounded-sh/client. Not a stable API.
+ */
+async function setWithVenueGrant(path, document, options) {
+    // A private copy of this app's config for this one write: the lane fills in its RPC below.
+    const config = Object.assign(Object.assign({}, (await getConfig())), { appId: options.venueAppId });
+    const headers = (grant) => ({ Authorization: `Bearer ${grant}` });
+    return setMany([{ path, document }], {
+        onBroadcast: options.onBroadcast,
+        _overrides: Object.assign({ _config: config, _getAuthHeaders: async () => headers(options.grant), _grantLane: {
+                assertLane: (chain) => assertExecutionLane(config, chain, options),
+                commitHeaders: async () => headers(await options.commitGrant()),
+            } }, (options._solanaRpc ? { _solanaRpc: options._solanaRpc } : {})),
+    });
+}
+
 /**
  * Live named-query subscriptions (subscribeQuery) - HTTP client poller (v1).
  *
@@ -10820,7 +10983,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-DPR9uw0N.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-BVwD6WVm.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11444,6 +11607,7 @@ exports.queryAggregate = queryAggregate;
 exports.reconcileSetResult = reconcileSetResult;
 exports.reconnectWithNewAuth = reconnectWithNewAuth;
 exports.refreshSession = refreshSession;
+exports.resolveVenueRpcUrl = resolveVenueRpcUrl;
 exports.revokeSession = revokeSession;
 exports.runExpression = runExpression;
 exports.runExpressionMany = runExpressionMany;
@@ -11454,6 +11618,7 @@ exports.serverTimestamp = serverTimestamp;
 exports.set = set;
 exports.setFile = setFile;
 exports.setMany = setMany;
+exports.setWithVenueGrant = setWithVenueGrant;
 exports.signAndSubmitTransaction = signAndSubmitTransaction;
 exports.signMessage = signMessage;
 exports.signSessionCreateMessage = signSessionCreateMessage;
@@ -11468,4 +11633,4 @@ exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
 exports.writeNotAppliedPhase = writeNotAppliedPhase;
-//# sourceMappingURL=index--ahzzmm5.js.map
+//# sourceMappingURL=index-5TMFraRK.js.map