@bounded-sh/core 0.0.114 → 0.0.116

package/dist/{index--ahzzmm5.js → index-CjiaT9AT.js}

@@ -421,6 +421,97 @@ axiosRetry.exponentialDelay = exponentialDelay;
 axiosRetry.linearDelay = linearDelay;
 axiosRetry.isRetryableError = isRetryableError;
 
+// Classify a session-refresh failure as a DEFINITIVE rejection of the credential
+// vs a TRANSPORT failure (DS4-0054).
+//
+// The restore path refreshes an expired token at boot. The old code destroyed the
+// local session on ANY refresh failure, so a network blip - common on mobile -
+// signed the user out. Only a real HTTP rejection of the refresh token proves the
+// session is invalid; anything else is unknown, and the safe move is to RETAIN local
+// state and retry. Keeping a genuinely dead session locally is harmless: every
+// request still fails closed server-side, and the next refresh that reaches the
+// server clears it. Destroying a live session on a blip is user-visible damage.
+//
+// `/session/refresh` answers 401 (session_revoked / invalid_grant) when the token is
+// dead. 400 (bad request), 408/429 (transient), and 5xx are NOT proof the session is
+// invalid, and a network/DNS/timeout error carries no HTTP response at all.
+//
+// This is the single classifier for every refresh path: the per-request freshness
+// check (auth-token-freshness) and the boot-time restore paths (web + RN session
+// managers) all import it, so "definitive" means the same thing everywhere. It lives
+// in this leaf module to avoid an import cycle between those consumers.
+function isDefinitiveRejection(err) {
+    var _a;
+    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
+    return status === 401 || status === 403;
+}
+// How long past the id token's own `exp` a session may survive purely on
+// transport failures.
+//
+// "Retain on a blip" must not become "retain forever". A statusless failure is
+// unknown, so the first ones are absorbed - but a revoked session, or a gateway
+// that rewrites the issuer's 401 into a 502, would otherwise keep
+// isAuthenticated() reporting a signed-in user for as long as the device never
+// reaches the issuer again. One day covers an offline flight or a bad-network day
+// while making the retention finite: past it, an unrefreshable session is cleared
+// and the user is asked to sign in again.
+const TRANSPORT_RETENTION_GRACE_MS = 24 * 60 * 60 * 1000;
+/**
+ * May a session whose refresh failed WITHOUT a definitive rejection be kept?
+ *
+ * `expSeconds` is the id token's `exp` claim. Fails closed: a missing or
+ * non-numeric expiry is not a usable bound, so such a session is never retained.
+ */
+function mayRetainAfterTransportFailure(expSeconds, now = Date.now()) {
+    if (typeof expSeconds !== 'number' || !Number.isFinite(expSeconds))
+        return false;
+    return now <= expSeconds * 1000 + TRANSPORT_RETENTION_GRACE_MS;
+}
+// Backoff between refresh attempts that failed WITHOUT a definitive rejection.
+//
+// A transport failure retains the session (above), and every authenticated request
+// and the realtime token timer asks for a fresh token - so without a pause, an issuer
+// that answers 503 or 429 gets one refresh per request from every open tab, which is
+// the exact load that keeps it down. After such a failure the same refresh token is
+// not sent again until the backoff passes: 15s, doubling, capped at 10 minutes, or the
+// issuer's own Retry-After when it is longer. Callers inside the window get a
+// non-definitive error at once (`code: 'refresh_backoff'`) and treat it like the
+// failure that started it. A success, or a different token, starts clean.
+const REFRESH_BACKOFF_BASE_MS = 15000;
+const REFRESH_BACKOFF_MAX_MS = 10 * 60000;
+const refreshBackoff = new Map();
+function retryAfterMs(err) {
+    var _a, _b;
+    const headers = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.headers;
+    const raw = headers && ((_b = headers['retry-after']) !== null && _b !== void 0 ? _b : headers['Retry-After']);
+    const seconds = Number(raw);
+    return Number.isFinite(seconds) && seconds > 0 ? Math.min(seconds * 1000, REFRESH_BACKOFF_MAX_MS) : 0;
+}
+/** Throws a non-definitive `refresh_backoff` error while `key` is still backing off. */
+function assertRefreshAllowed(key, now = Date.now()) {
+    const entry = refreshBackoff.get(key);
+    if (!entry || now >= entry.until)
+        return;
+    const err = new Error('Session refresh is backing off after a failed attempt');
+    err.code = 'refresh_backoff';
+    err.retryAt = entry.until;
+    throw err;
+}
+/** Record the outcome of a refresh attempt for `key`. */
+function recordRefreshOutcome(key, err, now = Date.now()) {
+    var _a, _b;
+    if (!err || isDefinitiveRejection(err)) {
+        refreshBackoff.delete(key);
+        return;
+    }
+    const failures = ((_b = (_a = refreshBackoff.get(key)) === null || _a === void 0 ? void 0 : _a.failures) !== null && _b !== void 0 ? _b : 0) + 1;
+    const backoff = Math.min(REFRESH_BACKOFF_BASE_MS * 2 ** (failures - 1), REFRESH_BACKOFF_MAX_MS);
+    refreshBackoff.set(key, { failures, until: now + Math.max(backoff, retryAfterMs(err)) });
+    // One entry per refresh token; a long-lived tab rotates through a handful at most.
+    if (refreshBackoff.size > 32)
+        refreshBackoff.delete(refreshBackoff.keys().next().value);
+}
+
 /**
  * Resolve the refresh/revoke base URL to a CONFIGURED issuer only. The session's
  * `issuer` is persisted in client storage; if that storage is tampered (e.g. XSS)
@@ -574,6 +665,9 @@ async function refreshSession(refreshToken, issuer) {
     const existing = refreshInFlightByToken.get(dedupeKey);
     if (existing)
         return existing;
+    // Inside a backoff window this throws at once, so a failing issuer is not asked again
+    // by every request and timer in the page (see refresh-error.ts).
+    assertRefreshAllowed(dedupeKey);
     let currentFlight;
     currentFlight = (async () => {
         try {
@@ -587,8 +681,13 @@ async function refreshSession(refreshToken, issuer) {
                 refreshToken,
                 appId
             }, { headers: { 'Content-Type': 'application/json' }, timeout: 30000 });
+            recordRefreshOutcome(dedupeKey, null);
             return response.data;
         }
+        catch (error) {
+            recordRefreshOutcome(dedupeKey, error);
+            throw error;
+        }
         finally {
             // Only remove our own entry, and only if it is still the active flight
             // for this token (a later refresh of the same token cannot have replaced
@@ -646,53 +745,6 @@ async function revokeSession(refreshToken, issuer) {
 async function signSessionCreateMessage(_signMessageFunction) {
 }
 
-// Classify a session-refresh failure as a DEFINITIVE rejection of the credential
-// vs a TRANSPORT failure (DS4-0054).
-//
-// The restore path refreshes an expired token at boot. The old code destroyed the
-// local session on ANY refresh failure, so a network blip - common on mobile -
-// signed the user out. Only a real HTTP rejection of the refresh token proves the
-// session is invalid; anything else is unknown, and the safe move is to RETAIN local
-// state and retry. Keeping a genuinely dead session locally is harmless: every
-// request still fails closed server-side, and the next refresh that reaches the
-// server clears it. Destroying a live session on a blip is user-visible damage.
-//
-// `/session/refresh` answers 401 (session_revoked / invalid_grant) when the token is
-// dead. 400 (bad request), 408/429 (transient), and 5xx are NOT proof the session is
-// invalid, and a network/DNS/timeout error carries no HTTP response at all.
-//
-// This is the single classifier for every refresh path: the per-request freshness
-// check (auth-token-freshness) and the boot-time restore paths (web + RN session
-// managers) all import it, so "definitive" means the same thing everywhere. It lives
-// in this leaf module to avoid an import cycle between those consumers.
-function isDefinitiveRejection(err) {
-    var _a;
-    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
-    return status === 401 || status === 403;
-}
-// How long past the id token's own `exp` a session may survive purely on
-// transport failures.
-//
-// "Retain on a blip" must not become "retain forever". A statusless failure is
-// unknown, so the first ones are absorbed - but a revoked session, or a gateway
-// that rewrites the issuer's 401 into a 502, would otherwise keep
-// isAuthenticated() reporting a signed-in user for as long as the device never
-// reaches the issuer again. One day covers an offline flight or a bad-network day
-// while making the retention finite: past it, an unrefreshable session is cleared
-// and the user is asked to sign in again.
-const TRANSPORT_RETENTION_GRACE_MS = 24 * 60 * 60 * 1000;
-/**
- * May a session whose refresh failed WITHOUT a definitive rejection be kept?
- *
- * `expSeconds` is the id token's `exp` claim. Fails closed: a missing or
- * non-numeric expiry is not a usable bound, so such a session is never retained.
- */
-function mayRetainAfterTransportFailure(expSeconds, now = Date.now()) {
-    if (typeof expSeconds !== 'number' || !Number.isFinite(expSeconds))
-        return false;
-    return now <= expSeconds * 1000 + TRANSPORT_RETENTION_GRACE_MS;
-}
-
 // Shared session-binding guard for the web + React Native session managers, so
 // the cross-principal refresh guard (#220 / #221) lives in ONE place and the two
 // managers can't drift apart. Base64url decoding differs by platform (browser
@@ -774,6 +826,63 @@ function notifySessionCleared() {
     }
 }
 
+// Same-tab session change signal.
+//
+// A page can run more than one copy of the SDK: the app's own bundle and the hosted widget
+// bounded-router injects (which bundles its own, pinned copy). They share one session record in
+// localStorage, keyed by issuer and app id, but the browser fires `storage` events only in OTHER
+// tabs, so a copy that signs in never tells the other copy in the same tab. Until a reload, the
+// app stayed signed out after a widget sign-in and the widget stayed signed out after an app
+// sign-in (observed on staging, 2026-10-07).
+//
+// This announces "the record changed" on a BroadcastChannel, which reaches every other channel
+// on the origin, same tab included, and never the announcing instance itself. The message is a
+// nudge, not an authority: it carries no token and no identity, and a listener only re-reads the
+// record through its ordinary restore path. Nothing signs in or out because of the message alone.
+const SESSION_SIGNAL_CHANNEL = "bounded.session";
+let channel;
+function openChannel() {
+    var _a;
+    if (channel !== undefined)
+        return channel;
+    try {
+        channel = typeof BroadcastChannel === "function" ? new BroadcastChannel(SESSION_SIGNAL_CHANNEL) : null;
+        // Node's BroadcastChannel holds the event loop open until closed; a Node consumer (tests,
+        // tarobase-server) must not hang on exit because of a nudge channel. Browsers have no unref.
+        (_a = channel === null || channel === void 0 ? void 0 : channel.unref) === null || _a === void 0 ? void 0 : _a.call(channel);
+    }
+    catch (_b) {
+        channel = null;
+    }
+    return channel;
+}
+/** Tell the other SDK copies on this origin that the session record under `key` changed. */
+function announceSessionChange(key) {
+    const ch = openChannel();
+    if (!ch)
+        return;
+    try {
+        ch.postMessage({ type: "session-changed", key });
+    }
+    catch (_a) {
+        // A closed or unavailable channel loses the nudge; the record itself is unaffected.
+    }
+}
+/** Run `listener` when another SDK copy announces a session change. Returns the unsubscribe. */
+function onSessionChange(listener) {
+    const ch = openChannel();
+    if (!ch)
+        return () => { };
+    const handler = (event) => {
+        const data = event.data;
+        if (!data || data.type !== "session-changed" || typeof data.key !== "string")
+            return;
+        listener(data.key);
+    };
+    ch.addEventListener("message", handler);
+    return () => ch.removeEventListener("message", handler);
+}
+
 /**
  * The one protocol every session-storage mutation goes through.
  *
@@ -970,6 +1079,7 @@ class WebSessionManager {
     }
     static writeRaw(sessionObj) {
         localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
     }
     /**
      * Read the session, stamping a `sessionGeneration` if it predates them.
@@ -1066,6 +1176,7 @@ class WebSessionManager {
                 idToken,
                 refreshToken, appId: currentAppId, sessionGeneration: generation }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
         });
+        announceSessionChange(storageKey);
         // Adoption can fail after persistence (for example, logout while the
         // provider is loading). Remove only this incomplete login, even if the
         // caller has since switched app configuration or another tab signed in.
@@ -1077,6 +1188,8 @@ class WebSessionManager {
                 localStorage.removeItem(storageKey);
                 return true;
             });
+            if (removed)
+                announceSessionChange(storageKey);
             if (removed)
                 notifySessionCleared();
         };
@@ -1206,8 +1319,10 @@ class WebSessionManager {
         });
         // Only announce a clear that actually happened, so a no-op cannot sign out
         // a UI that was already signed out.
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(key);
+        }
     }
     /**
      * Remove the session only if it is still the one identified by `generation`.
@@ -1232,8 +1347,10 @@ class WebSessionManager {
             localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
             return true;
         });
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
+        }
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
@@ -4190,7 +4307,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-DPR9uw0N.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-CXuLc7NX.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4539,6 +4656,16 @@ function classifyToken(token, nowMs = Date.now(), skewMs = TOKEN_EXPIRY_SKEW_MS)
         return 'expiring-soon';
     return 'fresh';
 }
+function tokenExpSeconds(token) {
+    var _a;
+    try {
+        const exp = (_a = JSON.parse(decodeBase64Url(token.split('.')[1]))) === null || _a === void 0 ? void 0 : _a.exp;
+        return typeof exp === 'number' ? exp : undefined;
+    }
+    catch (_b) {
+        return undefined;
+    }
+}
 /** Short, non-secret fingerprint used only to key the in-flight map. Never logged. */
 function tokenFingerprint(token) {
     let h = 5381;
@@ -4667,6 +4794,12 @@ async function getFreshAuthToken(isServer = false, options = {}) {
             // it is valid right now, so use it rather than failing the request.
             if (stillUsable)
                 return idToken;
+            // ...but not forever: past its expiry plus the same grace the restore path
+            // allows, a session that still cannot refresh is dropped, so an open tab stops
+            // asking an issuer that will never answer it.
+            if (!mayRetainAfterTransportFailure(tokenExpSeconds(idToken))) {
+                await clearDeadSession(isServer, generation);
+            }
             throw makeAuthExpiredError('Authentication expired and refresh failed', status);
         }
         finally {
@@ -7533,7 +7666,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-CR80Jac5.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-IPPwUhJc.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8911,7 +9044,7 @@ async function set(path, document, options) {
  * state appears only under `observation`/`mirrorSync` once actually observed.
  */
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
     // Returns the data that was set, or undefined if the document was already set.
     try {
         // A server WalletClient threads its immutable config snapshot; the default
@@ -9025,13 +9158,15 @@ async function setMany(many, options) {
                     throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
                         'Nothing was signed or submitted.');
                 }
+                const grantLane = (_l = options === null || options === void 0 ? void 0 : options._overrides) === null || _l === void 0 ? void 0 : _l._grantLane;
+                grantLane === null || grantLane === void 0 ? void 0 : grantLane.assertLane(workerChain);
                 if (workerChain === 'realtime_offchain') {
                     // Poofnet: the wallet signs the worker's unsendable approval message and
                     // the worker verifies and commits it. Nothing is submitted to any chain.
                     if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
                         throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
                     }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-BMB6sq_i.js'); });
+                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-CghJe0_7.js'); });
                     const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
                     // Signing-only, exactly as on a real chain: signed and NOT committed.
                     if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
@@ -9041,12 +9176,25 @@ async function setMany(many, options) {
                             poofnetIntentId: curTx.poofnetIntentId,
                         };
                     }
-                    // The commit PUT is the one ambiguous step of this lane: a lost response
-                    // may follow a commit, so its failures stay untagged (read the path back).
+                    // A grant lane's first credential is spent by the PUT that built this approval, so the
+                    // commit's is minted now, before `sending`: failing to mint sends nothing.
+                    const commitHeaders = await (grantLane === null || grantLane === void 0 ? void 0 : grantLane.commitHeaders());
+                    // The commit PUT is the one ambiguous step of this lane: a lost response may follow a
+                    // commit, so a transport failure or a 5xx stays untagged (read the path back). A 4xx is
+                    // realtime stating it committed nothing (the intent expired or was taken, the signer did
+                    // not match, a rule refused it), as for the first PUT. 408 and 499 are a proxy's words,
+                    // not realtime's, and may follow a commit, so they stay ambiguous too.
                     sending = true;
-                    const commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, options === null || options === void 0 ? void 0 : options._overrides);
-                    if (commitResponse.status !== 200) {
-                        throw new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`);
+                    let commitResponse;
+                    try {
+                        commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, commitHeaders ? Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _getAuthHeaders: async () => commitHeaders }) : options === null || options === void 0 ? void 0 : options._overrides);
+                        if (commitResponse.status !== 200) {
+                            throw Object.assign(new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`), { statusCode: commitResponse.status });
+                        }
+                    }
+                    catch (error) {
+                        const status = Number(error === null || error === void 0 ? void 0 : error.statusCode);
+                        throw status >= 400 && status < 500 && status !== 408 && status !== 499 ? markWriteNotApplied(error, 'broadcast_rejected') : error;
                     }
                     return directCommitResult(commitResponse, documents);
                 }
@@ -9056,7 +9204,7 @@ async function setMany(many, options) {
                             'Nothing was signed or submitted.');
                     }
                     const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-BMB6sq_i.js'); });
+                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-CghJe0_7.js'); });
                     // OA-0001: derive the expected intent from OUR OWN request (the one
                     // ground truth a tampered builder response cannot change) so the
                     // validator can reject any transaction whose operation semantics
@@ -9095,7 +9243,9 @@ async function setMany(many, options) {
                     }
                     // Confirmed: the receipt is already complete, so the mirror read is a
                     // best-effort enrichment reported in `mirrorSync`, never a rejection.
-                    const mirrorSync = await attemptMirrorSync(requestedPaths, options);
+                    const mirrorSync = grantLane
+                        ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
+                        : await attemptMirrorSync(requestedPaths, options);
                     return {
                         status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
                         transactionId: solanaOutcome.transactionSignature,
@@ -10118,6 +10268,84 @@ function createAppTokenAuthHeaders(options) {
     };
 }
 
+/**
+ * The venue grant write lane: create ONE document in another app (an OpenApps venue) as the
+ * wallet signed in here, authorized by a single-use grant instead of a venue session
+ * (VENUE-GRANT-DESIGN.md). The grant only lets the venue build that one transaction for that
+ * wallet; the wallet's own signature, checked by the venue's own rule, is the authority.
+ *
+ * The grant itself is minted by Bounded Auth at `POST {humanAuthApiUrl}/app-token/venue-grant`
+ * (contract: packages/cdk/cloudflare/shared/venue-grant.ts, which this package cannot import
+ * because the SDK packages publish separately). This module only spends one.
+ *
+ * It reuses `setMany`'s request and 202 handling through `_overrides`: the `_config` snapshot is
+ * this app's own config re-pointed at the VENUE app id, so the pre-sign validator (OA-0001) binds
+ * the venue app id and the full expected intent, and the signer stays this app's own AuthProvider
+ * (a Turnkey session or a Wallet Standard wallet). Nothing here is reachable from `createClient()`,
+ * which stays read-only.
+ *
+ * The chain a write runs on is the VENUE's, stated by its 202, never the app's: the app's own
+ * `chain` can only agree with it or be refused, and the transaction is broadcast through the app's
+ * `rpcUrl` only when the app configured that same chain, otherwise through `resolveRpcUrl(chain)`.
+ */
+function laneError(code, message) {
+    return Object.assign(new Error(message), { code });
+}
+const isSolanaLane = (chain) => chain === 'solana_devnet' || chain === 'solana_mainnet';
+/**
+ * The RPC a venue write on Solana lane `chain` is broadcast through, and a saved receipt of it is
+ * reconciled through. The app's own `rpcUrl` counts only when the app also configured this chain
+ * (an `rpcUrl` alone does not say which chain it speaks); otherwise `resolveRpcUrl(chain)`. Null
+ * when neither yields one.
+ *
+ * @internal Shared by the lane and by the client SDK's reconciliation of a saved receipt.
+ */
+function resolveVenueRpcUrl(config, chain, resolveRpcUrl) {
+    var _a, _b;
+    const own = requiredSolanaChain(config) === chain ? (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim() : '';
+    return own || ((_b = resolveRpcUrl === null || resolveRpcUrl === void 0 ? void 0 : resolveRpcUrl(chain)) === null || _b === void 0 ? void 0 : _b.trim()) || null;
+}
+/**
+ * Refuse, before the wallet is asked to sign, a 202 whose execution lane this app is not
+ * configured for: a mainnet app must never sign a devnet or poofnet approval (a poofnet "funding"
+ * moves no real USDC). Then point the Solana lane's broadcast at the RPC for the venue's chain.
+ * Poofnet broadcasts nothing, so it needs no RPC.
+ */
+function assertExecutionLane(config, chain, options) {
+    const required = requiredSolanaChain(config);
+    if (required && chain !== required) {
+        throw laneError('chain_mismatch', `The venue answered on "${chain}" but this app is configured for "${config.chain}". Nothing was signed.`);
+    }
+    if (!isSolanaLane(chain))
+        return;
+    const rpcUrl = resolveVenueRpcUrl(config, chain, options.resolveRpcUrl);
+    if (rpcUrl)
+        config.rpcUrl = rpcUrl;
+    else if (!options._solanaRpc) {
+        throw laneError('chain_not_configured', `The venue runs on ${chain}, but no RPC could be resolved to broadcast through. ` +
+            `Pass chain: '${chain}' and an rpcUrl to init(). Nothing was signed.`);
+    }
+}
+/**
+ * Write `document` at `path` in the venue `venueAppId` with a single-use grant. Resolves to the
+ * same discriminated {@link SetResult} as `set`, and throws exactly as `set` does, so the same
+ * `isWriteNotApplied` reading applies.
+ *
+ * @internal Used by `fundVenueEscrow` and `disputeVenueEscrow` in @bounded-sh/client. Not a stable API.
+ */
+async function setWithVenueGrant(path, document, options) {
+    // A private copy of this app's config for this one write: the lane fills in its RPC below.
+    const config = Object.assign(Object.assign({}, (await getConfig())), { appId: options.venueAppId });
+    const headers = (grant) => ({ Authorization: `Bearer ${grant}` });
+    return setMany([{ path, document }], {
+        onBroadcast: options.onBroadcast,
+        _overrides: Object.assign({ _config: config, _getAuthHeaders: async () => headers(options.grant), _grantLane: {
+                assertLane: (chain) => assertExecutionLane(config, chain, options),
+                commitHeaders: async () => headers(await options.commitGrant()),
+            } }, (options._solanaRpc ? { _solanaRpc: options._solanaRpc } : {})),
+    });
+}
+
 /**
  * Live named-query subscriptions (subscribeQuery) - HTTP client poller (v1).
  *
@@ -10820,7 +11048,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-DPR9uw0N.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-CXuLc7NX.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11382,6 +11610,7 @@ exports.LiveIntentError = LiveIntentError;
 exports.MIN_QUERY_POLL_INTERVAL_MS = MIN_QUERY_POLL_INTERVAL_MS;
 exports.RATE_LIMIT_EVENT_NAME = RATE_LIMIT_EVENT_NAME;
 exports.ReactNativeSessionManager = ReactNativeSessionManager;
+exports.SESSION_SIGNAL_CHANNEL = SESSION_SIGNAL_CHANNEL;
 exports.SOLANA_SIGN_IN_STATEMENT = SOLANA_SIGN_IN_STATEMENT;
 exports.ScopedClientReadOnlyError = ScopedClientReadOnlyError;
 exports.ServerSessionManager = ServerSessionManager;
@@ -11389,6 +11618,7 @@ exports.SessionEnvironmentError = SessionEnvironmentError;
 exports.UNSUPPORTED_ENVIRONMENT_CODE = UNSUPPORTED_ENVIRONMENT_CODE;
 exports.WebSessionManager = WebSessionManager;
 exports.aggregate = aggregate;
+exports.announceSessionChange = announceSessionChange;
 exports.browserSignInDomain = browserSignInDomain;
 exports.bufferExports = bufferExports;
 exports.canonicalizeArgs = canonicalizeArgs;
@@ -11439,11 +11669,13 @@ exports.live = live;
 exports.markWriteNotApplied = markWriteNotApplied;
 exports.normalizeEvmAddress = normalizeEvmAddress;
 exports.now = now;
+exports.onSessionChange = onSessionChange;
 exports.onSessionCleared = onSessionCleared;
 exports.queryAggregate = queryAggregate;
 exports.reconcileSetResult = reconcileSetResult;
 exports.reconnectWithNewAuth = reconnectWithNewAuth;
 exports.refreshSession = refreshSession;
+exports.resolveVenueRpcUrl = resolveVenueRpcUrl;
 exports.revokeSession = revokeSession;
 exports.runExpression = runExpression;
 exports.runExpressionMany = runExpressionMany;
@@ -11454,6 +11686,7 @@ exports.serverTimestamp = serverTimestamp;
 exports.set = set;
 exports.setFile = setFile;
 exports.setMany = setMany;
+exports.setWithVenueGrant = setWithVenueGrant;
 exports.signAndSubmitTransaction = signAndSubmitTransaction;
 exports.signMessage = signMessage;
 exports.signSessionCreateMessage = signSessionCreateMessage;
@@ -11468,4 +11701,4 @@ exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
 exports.writeNotAppliedPhase = writeNotAppliedPhase;
-//# sourceMappingURL=index--ahzzmm5.js.map
+//# sourceMappingURL=index-CjiaT9AT.js.map