@bounded-sh/core 0.0.114 → 0.0.116

package/dist/{index-DTTh5Wt5.mjs → index-Db4lrwO6.mjs}

@@ -419,6 +419,97 @@ axiosRetry.exponentialDelay = exponentialDelay;
 axiosRetry.linearDelay = linearDelay;
 axiosRetry.isRetryableError = isRetryableError;
 
+// Classify a session-refresh failure as a DEFINITIVE rejection of the credential
+// vs a TRANSPORT failure (DS4-0054).
+//
+// The restore path refreshes an expired token at boot. The old code destroyed the
+// local session on ANY refresh failure, so a network blip - common on mobile -
+// signed the user out. Only a real HTTP rejection of the refresh token proves the
+// session is invalid; anything else is unknown, and the safe move is to RETAIN local
+// state and retry. Keeping a genuinely dead session locally is harmless: every
+// request still fails closed server-side, and the next refresh that reaches the
+// server clears it. Destroying a live session on a blip is user-visible damage.
+//
+// `/session/refresh` answers 401 (session_revoked / invalid_grant) when the token is
+// dead. 400 (bad request), 408/429 (transient), and 5xx are NOT proof the session is
+// invalid, and a network/DNS/timeout error carries no HTTP response at all.
+//
+// This is the single classifier for every refresh path: the per-request freshness
+// check (auth-token-freshness) and the boot-time restore paths (web + RN session
+// managers) all import it, so "definitive" means the same thing everywhere. It lives
+// in this leaf module to avoid an import cycle between those consumers.
+function isDefinitiveRejection(err) {
+    var _a;
+    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
+    return status === 401 || status === 403;
+}
+// How long past the id token's own `exp` a session may survive purely on
+// transport failures.
+//
+// "Retain on a blip" must not become "retain forever". A statusless failure is
+// unknown, so the first ones are absorbed - but a revoked session, or a gateway
+// that rewrites the issuer's 401 into a 502, would otherwise keep
+// isAuthenticated() reporting a signed-in user for as long as the device never
+// reaches the issuer again. One day covers an offline flight or a bad-network day
+// while making the retention finite: past it, an unrefreshable session is cleared
+// and the user is asked to sign in again.
+const TRANSPORT_RETENTION_GRACE_MS = 24 * 60 * 60 * 1000;
+/**
+ * May a session whose refresh failed WITHOUT a definitive rejection be kept?
+ *
+ * `expSeconds` is the id token's `exp` claim. Fails closed: a missing or
+ * non-numeric expiry is not a usable bound, so such a session is never retained.
+ */
+function mayRetainAfterTransportFailure(expSeconds, now = Date.now()) {
+    if (typeof expSeconds !== 'number' || !Number.isFinite(expSeconds))
+        return false;
+    return now <= expSeconds * 1000 + TRANSPORT_RETENTION_GRACE_MS;
+}
+// Backoff between refresh attempts that failed WITHOUT a definitive rejection.
+//
+// A transport failure retains the session (above), and every authenticated request
+// and the realtime token timer asks for a fresh token - so without a pause, an issuer
+// that answers 503 or 429 gets one refresh per request from every open tab, which is
+// the exact load that keeps it down. After such a failure the same refresh token is
+// not sent again until the backoff passes: 15s, doubling, capped at 10 minutes, or the
+// issuer's own Retry-After when it is longer. Callers inside the window get a
+// non-definitive error at once (`code: 'refresh_backoff'`) and treat it like the
+// failure that started it. A success, or a different token, starts clean.
+const REFRESH_BACKOFF_BASE_MS = 15000;
+const REFRESH_BACKOFF_MAX_MS = 10 * 60000;
+const refreshBackoff = new Map();
+function retryAfterMs(err) {
+    var _a, _b;
+    const headers = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.headers;
+    const raw = headers && ((_b = headers['retry-after']) !== null && _b !== void 0 ? _b : headers['Retry-After']);
+    const seconds = Number(raw);
+    return Number.isFinite(seconds) && seconds > 0 ? Math.min(seconds * 1000, REFRESH_BACKOFF_MAX_MS) : 0;
+}
+/** Throws a non-definitive `refresh_backoff` error while `key` is still backing off. */
+function assertRefreshAllowed(key, now = Date.now()) {
+    const entry = refreshBackoff.get(key);
+    if (!entry || now >= entry.until)
+        return;
+    const err = new Error('Session refresh is backing off after a failed attempt');
+    err.code = 'refresh_backoff';
+    err.retryAt = entry.until;
+    throw err;
+}
+/** Record the outcome of a refresh attempt for `key`. */
+function recordRefreshOutcome(key, err, now = Date.now()) {
+    var _a, _b;
+    if (!err || isDefinitiveRejection(err)) {
+        refreshBackoff.delete(key);
+        return;
+    }
+    const failures = ((_b = (_a = refreshBackoff.get(key)) === null || _a === void 0 ? void 0 : _a.failures) !== null && _b !== void 0 ? _b : 0) + 1;
+    const backoff = Math.min(REFRESH_BACKOFF_BASE_MS * 2 ** (failures - 1), REFRESH_BACKOFF_MAX_MS);
+    refreshBackoff.set(key, { failures, until: now + Math.max(backoff, retryAfterMs(err)) });
+    // One entry per refresh token; a long-lived tab rotates through a handful at most.
+    if (refreshBackoff.size > 32)
+        refreshBackoff.delete(refreshBackoff.keys().next().value);
+}
+
 /**
  * Resolve the refresh/revoke base URL to a CONFIGURED issuer only. The session's
  * `issuer` is persisted in client storage; if that storage is tampered (e.g. XSS)
@@ -572,6 +663,9 @@ async function refreshSession(refreshToken, issuer) {
     const existing = refreshInFlightByToken.get(dedupeKey);
     if (existing)
         return existing;
+    // Inside a backoff window this throws at once, so a failing issuer is not asked again
+    // by every request and timer in the page (see refresh-error.ts).
+    assertRefreshAllowed(dedupeKey);
     let currentFlight;
     currentFlight = (async () => {
         try {
@@ -585,8 +679,13 @@ async function refreshSession(refreshToken, issuer) {
                 refreshToken,
                 appId
             }, { headers: { 'Content-Type': 'application/json' }, timeout: 30000 });
+            recordRefreshOutcome(dedupeKey, null);
             return response.data;
         }
+        catch (error) {
+            recordRefreshOutcome(dedupeKey, error);
+            throw error;
+        }
         finally {
             // Only remove our own entry, and only if it is still the active flight
             // for this token (a later refresh of the same token cannot have replaced
@@ -644,53 +743,6 @@ async function revokeSession(refreshToken, issuer) {
 async function signSessionCreateMessage(_signMessageFunction) {
 }
 
-// Classify a session-refresh failure as a DEFINITIVE rejection of the credential
-// vs a TRANSPORT failure (DS4-0054).
-//
-// The restore path refreshes an expired token at boot. The old code destroyed the
-// local session on ANY refresh failure, so a network blip - common on mobile -
-// signed the user out. Only a real HTTP rejection of the refresh token proves the
-// session is invalid; anything else is unknown, and the safe move is to RETAIN local
-// state and retry. Keeping a genuinely dead session locally is harmless: every
-// request still fails closed server-side, and the next refresh that reaches the
-// server clears it. Destroying a live session on a blip is user-visible damage.
-//
-// `/session/refresh` answers 401 (session_revoked / invalid_grant) when the token is
-// dead. 400 (bad request), 408/429 (transient), and 5xx are NOT proof the session is
-// invalid, and a network/DNS/timeout error carries no HTTP response at all.
-//
-// This is the single classifier for every refresh path: the per-request freshness
-// check (auth-token-freshness) and the boot-time restore paths (web + RN session
-// managers) all import it, so "definitive" means the same thing everywhere. It lives
-// in this leaf module to avoid an import cycle between those consumers.
-function isDefinitiveRejection(err) {
-    var _a;
-    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
-    return status === 401 || status === 403;
-}
-// How long past the id token's own `exp` a session may survive purely on
-// transport failures.
-//
-// "Retain on a blip" must not become "retain forever". A statusless failure is
-// unknown, so the first ones are absorbed - but a revoked session, or a gateway
-// that rewrites the issuer's 401 into a 502, would otherwise keep
-// isAuthenticated() reporting a signed-in user for as long as the device never
-// reaches the issuer again. One day covers an offline flight or a bad-network day
-// while making the retention finite: past it, an unrefreshable session is cleared
-// and the user is asked to sign in again.
-const TRANSPORT_RETENTION_GRACE_MS = 24 * 60 * 60 * 1000;
-/**
- * May a session whose refresh failed WITHOUT a definitive rejection be kept?
- *
- * `expSeconds` is the id token's `exp` claim. Fails closed: a missing or
- * non-numeric expiry is not a usable bound, so such a session is never retained.
- */
-function mayRetainAfterTransportFailure(expSeconds, now = Date.now()) {
-    if (typeof expSeconds !== 'number' || !Number.isFinite(expSeconds))
-        return false;
-    return now <= expSeconds * 1000 + TRANSPORT_RETENTION_GRACE_MS;
-}
-
 // Shared session-binding guard for the web + React Native session managers, so
 // the cross-principal refresh guard (#220 / #221) lives in ONE place and the two
 // managers can't drift apart. Base64url decoding differs by platform (browser
@@ -772,6 +824,63 @@ function notifySessionCleared() {
     }
 }
 
+// Same-tab session change signal.
+//
+// A page can run more than one copy of the SDK: the app's own bundle and the hosted widget
+// bounded-router injects (which bundles its own, pinned copy). They share one session record in
+// localStorage, keyed by issuer and app id, but the browser fires `storage` events only in OTHER
+// tabs, so a copy that signs in never tells the other copy in the same tab. Until a reload, the
+// app stayed signed out after a widget sign-in and the widget stayed signed out after an app
+// sign-in (observed on staging, 2026-10-07).
+//
+// This announces "the record changed" on a BroadcastChannel, which reaches every other channel
+// on the origin, same tab included, and never the announcing instance itself. The message is a
+// nudge, not an authority: it carries no token and no identity, and a listener only re-reads the
+// record through its ordinary restore path. Nothing signs in or out because of the message alone.
+const SESSION_SIGNAL_CHANNEL = "bounded.session";
+let channel;
+function openChannel() {
+    var _a;
+    if (channel !== undefined)
+        return channel;
+    try {
+        channel = typeof BroadcastChannel === "function" ? new BroadcastChannel(SESSION_SIGNAL_CHANNEL) : null;
+        // Node's BroadcastChannel holds the event loop open until closed; a Node consumer (tests,
+        // tarobase-server) must not hang on exit because of a nudge channel. Browsers have no unref.
+        (_a = channel === null || channel === void 0 ? void 0 : channel.unref) === null || _a === void 0 ? void 0 : _a.call(channel);
+    }
+    catch (_b) {
+        channel = null;
+    }
+    return channel;
+}
+/** Tell the other SDK copies on this origin that the session record under `key` changed. */
+function announceSessionChange(key) {
+    const ch = openChannel();
+    if (!ch)
+        return;
+    try {
+        ch.postMessage({ type: "session-changed", key });
+    }
+    catch (_a) {
+        // A closed or unavailable channel loses the nudge; the record itself is unaffected.
+    }
+}
+/** Run `listener` when another SDK copy announces a session change. Returns the unsubscribe. */
+function onSessionChange(listener) {
+    const ch = openChannel();
+    if (!ch)
+        return () => { };
+    const handler = (event) => {
+        const data = event.data;
+        if (!data || data.type !== "session-changed" || typeof data.key !== "string")
+            return;
+        listener(data.key);
+    };
+    ch.addEventListener("message", handler);
+    return () => ch.removeEventListener("message", handler);
+}
+
 /**
  * The one protocol every session-storage mutation goes through.
  *
@@ -968,6 +1077,7 @@ class WebSessionManager {
     }
     static writeRaw(sessionObj) {
         localStorage.setItem(this.BOUNDED_SESSION_STORAGE_KEY, JSON.stringify(sessionObj));
+        announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
     }
     /**
      * Read the session, stamping a `sessionGeneration` if it predates them.
@@ -1064,6 +1174,7 @@ class WebSessionManager {
                 idToken,
                 refreshToken, appId: currentAppId, sessionGeneration: generation }, (sessionIssuer ? { issuer: sessionIssuer } : {}))));
         });
+        announceSessionChange(storageKey);
         // Adoption can fail after persistence (for example, logout while the
         // provider is loading). Remove only this incomplete login, even if the
         // caller has since switched app configuration or another tab signed in.
@@ -1075,6 +1186,8 @@ class WebSessionManager {
                 localStorage.removeItem(storageKey);
                 return true;
             });
+            if (removed)
+                announceSessionChange(storageKey);
             if (removed)
                 notifySessionCleared();
         };
@@ -1204,8 +1317,10 @@ class WebSessionManager {
         });
         // Only announce a clear that actually happened, so a no-op cannot sign out
         // a UI that was already signed out.
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(key);
+        }
     }
     /**
      * Remove the session only if it is still the one identified by `generation`.
@@ -1230,8 +1345,10 @@ class WebSessionManager {
             localStorage.removeItem(this.BOUNDED_SESSION_STORAGE_KEY);
             return true;
         });
-        if (removed)
+        if (removed) {
             notifySessionCleared();
+            announceSessionChange(this.BOUNDED_SESSION_STORAGE_KEY);
+        }
     }
     /* ------------------------------------------------------------------ */
     /* IS-AUTH                                                            */
@@ -4188,7 +4305,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-BwPW9Fst.mjs');
+        const { genSolanaMessage } = await import('./solana-message-BO6Dtgbv.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4537,6 +4654,16 @@ function classifyToken(token, nowMs = Date.now(), skewMs = TOKEN_EXPIRY_SKEW_MS)
         return 'expiring-soon';
     return 'fresh';
 }
+function tokenExpSeconds(token) {
+    var _a;
+    try {
+        const exp = (_a = JSON.parse(decodeBase64Url(token.split('.')[1]))) === null || _a === void 0 ? void 0 : _a.exp;
+        return typeof exp === 'number' ? exp : undefined;
+    }
+    catch (_b) {
+        return undefined;
+    }
+}
 /** Short, non-secret fingerprint used only to key the in-flight map. Never logged. */
 function tokenFingerprint(token) {
     let h = 5381;
@@ -4665,6 +4792,12 @@ async function getFreshAuthToken(isServer = false, options = {}) {
             // it is valid right now, so use it rather than failing the request.
             if (stillUsable)
                 return idToken;
+            // ...but not forever: past its expiry plus the same grace the restore path
+            // allows, a session that still cannot refresh is dropped, so an open tab stops
+            // asking an issuer that will never answer it.
+            if (!mayRetainAfterTransportFailure(tokenExpSeconds(idToken))) {
+                await clearDeadSession(isServer, generation);
+            }
             throw makeAuthExpiredError('Authentication expired and refresh failed', status);
         }
         finally {
@@ -7531,7 +7664,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-Bcra04TH.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-CNs5zURZ.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8909,7 +9042,7 @@ async function set(path, document, options) {
  * state appears only under `observation`/`mirrorSync` once actually observed.
  */
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
     // Returns the data that was set, or undefined if the document was already set.
     try {
         // A server WalletClient threads its immutable config snapshot; the default
@@ -9023,13 +9156,15 @@ async function setMany(many, options) {
                     throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
                         'Nothing was signed or submitted.');
                 }
+                const grantLane = (_l = options === null || options === void 0 ? void 0 : options._overrides) === null || _l === void 0 ? void 0 : _l._grantLane;
+                grantLane === null || grantLane === void 0 ? void 0 : grantLane.assertLane(workerChain);
                 if (workerChain === 'realtime_offchain') {
                     // Poofnet: the wallet signs the worker's unsendable approval message and
                     // the worker verifies and commits it. Nothing is submitted to any chain.
                     if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
                         throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
                     }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-BBQllFVm.mjs');
+                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-DDt4CzRR.mjs');
                     const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
                     // Signing-only, exactly as on a real chain: signed and NOT committed.
                     if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
@@ -9039,12 +9174,25 @@ async function setMany(many, options) {
                             poofnetIntentId: curTx.poofnetIntentId,
                         };
                     }
-                    // The commit PUT is the one ambiguous step of this lane: a lost response
-                    // may follow a commit, so its failures stay untagged (read the path back).
+                    // A grant lane's first credential is spent by the PUT that built this approval, so the
+                    // commit's is minted now, before `sending`: failing to mint sends nothing.
+                    const commitHeaders = await (grantLane === null || grantLane === void 0 ? void 0 : grantLane.commitHeaders());
+                    // The commit PUT is the one ambiguous step of this lane: a lost response may follow a
+                    // commit, so a transport failure or a 5xx stays untagged (read the path back). A 4xx is
+                    // realtime stating it committed nothing (the intent expired or was taken, the signer did
+                    // not match, a rule refused it), as for the first PUT. 408 and 499 are a proxy's words,
+                    // not realtime's, and may follow a commit, so they stay ambiguous too.
                     sending = true;
-                    const commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, options === null || options === void 0 ? void 0 : options._overrides);
-                    if (commitResponse.status !== 200) {
-                        throw new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`);
+                    let commitResponse;
+                    try {
+                        commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, commitHeaders ? Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _getAuthHeaders: async () => commitHeaders }) : options === null || options === void 0 ? void 0 : options._overrides);
+                        if (commitResponse.status !== 200) {
+                            throw Object.assign(new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`), { statusCode: commitResponse.status });
+                        }
+                    }
+                    catch (error) {
+                        const status = Number(error === null || error === void 0 ? void 0 : error.statusCode);
+                        throw status >= 400 && status < 500 && status !== 408 && status !== 499 ? markWriteNotApplied(error, 'broadcast_rejected') : error;
                     }
                     return directCommitResult(commitResponse, documents);
                 }
@@ -9054,7 +9202,7 @@ async function setMany(many, options) {
                             'Nothing was signed or submitted.');
                     }
                     const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-BBQllFVm.mjs');
+                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-DDt4CzRR.mjs');
                     // OA-0001: derive the expected intent from OUR OWN request (the one
                     // ground truth a tampered builder response cannot change) so the
                     // validator can reject any transaction whose operation semantics
@@ -9093,7 +9241,9 @@ async function setMany(many, options) {
                     }
                     // Confirmed: the receipt is already complete, so the mirror read is a
                     // best-effort enrichment reported in `mirrorSync`, never a rejection.
-                    const mirrorSync = await attemptMirrorSync(requestedPaths, options);
+                    const mirrorSync = grantLane
+                        ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
+                        : await attemptMirrorSync(requestedPaths, options);
                     return {
                         status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
                         transactionId: solanaOutcome.transactionSignature,
@@ -10116,6 +10266,84 @@ function createAppTokenAuthHeaders(options) {
     };
 }
 
+/**
+ * The venue grant write lane: create ONE document in another app (an OpenApps venue) as the
+ * wallet signed in here, authorized by a single-use grant instead of a venue session
+ * (VENUE-GRANT-DESIGN.md). The grant only lets the venue build that one transaction for that
+ * wallet; the wallet's own signature, checked by the venue's own rule, is the authority.
+ *
+ * The grant itself is minted by Bounded Auth at `POST {humanAuthApiUrl}/app-token/venue-grant`
+ * (contract: packages/cdk/cloudflare/shared/venue-grant.ts, which this package cannot import
+ * because the SDK packages publish separately). This module only spends one.
+ *
+ * It reuses `setMany`'s request and 202 handling through `_overrides`: the `_config` snapshot is
+ * this app's own config re-pointed at the VENUE app id, so the pre-sign validator (OA-0001) binds
+ * the venue app id and the full expected intent, and the signer stays this app's own AuthProvider
+ * (a Turnkey session or a Wallet Standard wallet). Nothing here is reachable from `createClient()`,
+ * which stays read-only.
+ *
+ * The chain a write runs on is the VENUE's, stated by its 202, never the app's: the app's own
+ * `chain` can only agree with it or be refused, and the transaction is broadcast through the app's
+ * `rpcUrl` only when the app configured that same chain, otherwise through `resolveRpcUrl(chain)`.
+ */
+function laneError(code, message) {
+    return Object.assign(new Error(message), { code });
+}
+const isSolanaLane = (chain) => chain === 'solana_devnet' || chain === 'solana_mainnet';
+/**
+ * The RPC a venue write on Solana lane `chain` is broadcast through, and a saved receipt of it is
+ * reconciled through. The app's own `rpcUrl` counts only when the app also configured this chain
+ * (an `rpcUrl` alone does not say which chain it speaks); otherwise `resolveRpcUrl(chain)`. Null
+ * when neither yields one.
+ *
+ * @internal Shared by the lane and by the client SDK's reconciliation of a saved receipt.
+ */
+function resolveVenueRpcUrl(config, chain, resolveRpcUrl) {
+    var _a, _b;
+    const own = requiredSolanaChain(config) === chain ? (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim() : '';
+    return own || ((_b = resolveRpcUrl === null || resolveRpcUrl === void 0 ? void 0 : resolveRpcUrl(chain)) === null || _b === void 0 ? void 0 : _b.trim()) || null;
+}
+/**
+ * Refuse, before the wallet is asked to sign, a 202 whose execution lane this app is not
+ * configured for: a mainnet app must never sign a devnet or poofnet approval (a poofnet "funding"
+ * moves no real USDC). Then point the Solana lane's broadcast at the RPC for the venue's chain.
+ * Poofnet broadcasts nothing, so it needs no RPC.
+ */
+function assertExecutionLane(config, chain, options) {
+    const required = requiredSolanaChain(config);
+    if (required && chain !== required) {
+        throw laneError('chain_mismatch', `The venue answered on "${chain}" but this app is configured for "${config.chain}". Nothing was signed.`);
+    }
+    if (!isSolanaLane(chain))
+        return;
+    const rpcUrl = resolveVenueRpcUrl(config, chain, options.resolveRpcUrl);
+    if (rpcUrl)
+        config.rpcUrl = rpcUrl;
+    else if (!options._solanaRpc) {
+        throw laneError('chain_not_configured', `The venue runs on ${chain}, but no RPC could be resolved to broadcast through. ` +
+            `Pass chain: '${chain}' and an rpcUrl to init(). Nothing was signed.`);
+    }
+}
+/**
+ * Write `document` at `path` in the venue `venueAppId` with a single-use grant. Resolves to the
+ * same discriminated {@link SetResult} as `set`, and throws exactly as `set` does, so the same
+ * `isWriteNotApplied` reading applies.
+ *
+ * @internal Used by `fundVenueEscrow` and `disputeVenueEscrow` in @bounded-sh/client. Not a stable API.
+ */
+async function setWithVenueGrant(path, document, options) {
+    // A private copy of this app's config for this one write: the lane fills in its RPC below.
+    const config = Object.assign(Object.assign({}, (await getConfig())), { appId: options.venueAppId });
+    const headers = (grant) => ({ Authorization: `Bearer ${grant}` });
+    return setMany([{ path, document }], {
+        onBroadcast: options.onBroadcast,
+        _overrides: Object.assign({ _config: config, _getAuthHeaders: async () => headers(options.grant), _grantLane: {
+                assertLane: (chain) => assertExecutionLane(config, chain, options),
+                commitHeaders: async () => headers(await options.commitGrant()),
+            } }, (options._solanaRpc ? { _solanaRpc: options._solanaRpc } : {})),
+    });
+}
+
 /**
  * Live named-query subscriptions (subscribeQuery) - HTTP client poller (v1).
  *
@@ -10818,7 +11046,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-BwPW9Fst.mjs');
+    const implementation = await import('./solana-message-BO6Dtgbv.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11367,5 +11595,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { increment as $, isWriteNotApplied as A, writeNotAppliedPhase as B, subscribe as C, closeAllSubscriptions as D, clearCache as E, getCachedData as F, reconnectWithNewAuth as G, createClient as H, InsufficientBalanceError as I, exchangeAppToken as J, clearAppTokenCache as K, createAppTokenAuthHeaders as L, AppTokenExchangeError as M, subscribeQuery as N, closeAllQuerySubscriptions as O, canonicalizeArgs as P, canonicalizeResult as Q, DEFAULT_QUERY_POLL_INTERVAL_MS as R, ScopedClientReadOnlyError as S, MIN_QUERY_POLL_INTERVAL_MS as T, BoundedDeclineError as U, deriveDecline as V, dispatchDeclineEvent as W, DECLINE_EVENT_NAME as X, dispatchRateLimitEvent as Y, RATE_LIMIT_EVENT_NAME as Z, hasActiveConnection as _, getWebhookKeysUrl as a, serverTimestamp as a0, now as a1, toSeconds as a2, toMillis as a3, getIdToken as a4, deriveUserIdentityFromIdToken as a5, getSessionGeneration as a6, WebSessionManager as a7, ReactNativeSessionManager as a8, getActiveSessionManager as a9, live as aA, intent as aB, status as aC, subscribeView as aD, LiveIntentError as aE, withEffects as aF, isEffectResult as aG, defineLiveModule as aH, EFFECT_INTENT_ADDRESS as aI, onSessionCleared as aa, SessionEnvironmentError as ab, UNSUPPORTED_ENVIRONMENT_CODE as ac, AUTH_CHANGED_CODE as ad, AUTH_EXPIRED_CODE as ae, isAuthExpiredError as af, getFreshAuthToken as ag, ServerSessionManager as ah, createSessionWithSignature as ai, refreshSession as aj, revokeSession as ak, signSessionCreateMessage as al, genAuthNonce as am, genSolanaMessage as an, createSolanaSignInRequest as ao, createSolanaSignInMessageText as ap, genSolanaSignInRequest as aq, genSolanaSignInMessage as ar, browserSignInDomain as as, SOLANA_SIGN_IN_STATEMENT as at, genSiweMessage as au, normalizeEvmAddress as av, toLowerEvmAddress as aw, functions as ax, invoke as ay, FunctionInvokeError as az, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, markWriteNotApplied as m, runQueryMany as n, runExpression as o, runExpressionMany as p, queryAggregate as q, runQuery as r, set as s, signMessage as t, signTransaction as u, signAndSubmitTransaction as v, count as w, aggregate as x, reconcileSetResult as y, waitForSetResult as z };
-//# sourceMappingURL=index-DTTh5Wt5.mjs.map
+export { RATE_LIMIT_EVENT_NAME as $, isWriteNotApplied as A, writeNotAppliedPhase as B, subscribe as C, closeAllSubscriptions as D, clearCache as E, getCachedData as F, reconnectWithNewAuth as G, createClient as H, InsufficientBalanceError as I, exchangeAppToken as J, clearAppTokenCache as K, createAppTokenAuthHeaders as L, AppTokenExchangeError as M, setWithVenueGrant as N, resolveVenueRpcUrl as O, subscribeQuery as P, closeAllQuerySubscriptions as Q, canonicalizeArgs as R, ScopedClientReadOnlyError as S, canonicalizeResult as T, DEFAULT_QUERY_POLL_INTERVAL_MS as U, MIN_QUERY_POLL_INTERVAL_MS as V, BoundedDeclineError as W, deriveDecline as X, dispatchDeclineEvent as Y, DECLINE_EVENT_NAME as Z, dispatchRateLimitEvent as _, getWebhookKeysUrl as a, hasActiveConnection as a0, increment as a1, serverTimestamp as a2, now as a3, toSeconds as a4, toMillis as a5, getIdToken as a6, deriveUserIdentityFromIdToken as a7, getSessionGeneration as a8, WebSessionManager as a9, normalizeEvmAddress as aA, toLowerEvmAddress as aB, functions as aC, invoke as aD, FunctionInvokeError as aE, live as aF, intent as aG, status as aH, subscribeView as aI, LiveIntentError as aJ, withEffects as aK, isEffectResult as aL, defineLiveModule as aM, EFFECT_INTENT_ADDRESS as aN, ReactNativeSessionManager as aa, getActiveSessionManager as ab, onSessionCleared as ac, announceSessionChange as ad, onSessionChange as ae, SESSION_SIGNAL_CHANNEL as af, SessionEnvironmentError as ag, UNSUPPORTED_ENVIRONMENT_CODE as ah, AUTH_CHANGED_CODE as ai, AUTH_EXPIRED_CODE as aj, isAuthExpiredError as ak, getFreshAuthToken as al, ServerSessionManager as am, createSessionWithSignature as an, refreshSession as ao, revokeSession as ap, signSessionCreateMessage as aq, genAuthNonce as ar, genSolanaMessage as as, createSolanaSignInRequest as at, createSolanaSignInMessageText as au, genSolanaSignInRequest as av, genSolanaSignInMessage as aw, browserSignInDomain as ax, SOLANA_SIGN_IN_STATEMENT as ay, genSiweMessage as az, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, markWriteNotApplied as m, runQueryMany as n, runExpression as o, runExpressionMany as p, queryAggregate as q, runQuery as r, set as s, signMessage as t, signTransaction as u, signAndSubmitTransaction as v, count as w, aggregate as x, reconcileSetResult as y, waitForSetResult as z };
+//# sourceMappingURL=index-Db4lrwO6.mjs.map