@bounded-sh/core 0.0.15 → 0.0.16

package/dist/index.mjs

@@ -4315,99 +4315,54 @@ function normalizeReadResult(responseData, pathIsDocument) {
     }
     return responseData;
 }
-function hashForKey$1(value) {
+function hashForKey$2(value) {
     let h = 5381;
     for (let i = 0; i < value.length; i++) {
         h = ((h << 5) + h + value.charCodeAt(i)) & 0x7fffffff;
     }
     return h.toString(36);
 }
-/**
- * Derive a stable identity string for the JWT a request will actually present.
- * Prefers the subject-ish claims (sub / custom:walletAddress / address) so the
- * same principal across token refreshes maps to the same fingerprint; falls back
- * to a hash of the raw token if the payload can't be decoded.
- */
+function authValueFromHeaders(headers) {
+    return (headers === null || headers === void 0 ? void 0 : headers.Authorization) || (headers === null || headers === void 0 ? void 0 : headers.authorization) || '';
+}
+function principalFromAuthValue(authValue) {
+    return authValue ? `h${hashForKey$2(authValue)}` : 'anon';
+}
 function principalFromIdToken$1(idToken) {
-    if (!idToken)
-        return 'anon';
-    try {
-        const parts = idToken.split('.');
-        if (parts.length < 2)
-            return `t${hashForKey$1(idToken)}`;
-        const payload = JSON.parse(decodeBase64Url(parts[1]));
-        const subject = 
-        // Prefer the universal identity (@user.id) — it is the stable principal a
-        // request presents (equals the wallet for wallet logins; the account id for
-        // email/social logins, which carry no walletAddress). Keying the read cache
-        // on it keeps an email user's private snapshot scoped to that user.
-        payload['custom:userId'] ||
-            payload['custom:walletAddress'] ||
-            payload.walletAddress ||
-            payload.sub ||
-            payload.address;
-        if (subject)
-            return `s${hashForKey$1(String(subject))}`;
-        return `t${hashForKey$1(idToken)}`;
-    }
-    catch (_a) {
-        return `t${hashForKey$1(idToken)}`;
-    }
+    return idToken ? `t${hashForKey$2(idToken)}` : 'anon';
 }
 /**
  * SECURITY (H1): Read caches must be keyed by the caller's principal, not just
  * by path/filter/shape. In a shared process / SSR worker / browser login-switch,
  * keying by path alone lets User B receive User A's cached private read before
  * any server read rule runs. This returns `appId:<principal>` for the identity a
- * given read will actually authenticate as:
- *   - a per-request `_walletAddress` override → that override's wallet
- *   - a per-request `_getAuthHeaders` override → a hash of the auth header it
- *     produces (so a cross-principal cached entry is never served to it)
- *   - otherwise the ambient logged-in session's idToken subject (or `anon`)
+ * given read will actually authenticate as. This intentionally treats JWTs as
+ * opaque unverified bearer material — never decoded claims and never caller
+ * identity hints such as `_walletAddress`. A forged token that merely claims
+ * another user's `sub` must miss that user's cache and go to the server.
  */
 async function getReadPrincipalKey(overrides) {
-    var _a, _b;
     const config = await getConfig();
     const appId = config.appId || '';
-    // Explicit per-request wallet override — key by that identity.
-    if (overrides === null || overrides === void 0 ? void 0 : overrides._walletAddress) {
-        return `${appId}:w${overrides._walletAddress}`;
+    // makeApiRequest applies overrides.headers AFTER its computed auth header, so
+    // caller-supplied Authorization is the real request auth when present.
+    const directAuth = authValueFromHeaders(overrides === null || overrides === void 0 ? void 0 : overrides.headers);
+    if (directAuth) {
+        return `${appId}:${principalFromAuthValue(directAuth)}`;
     }
-    // Per-request auth-header override (wallet client). Key by the actual header
-    // it produces so an entry cached under one override is never served to another.
+    // Per-request auth-header override (wallet client). Key by the exact opaque
+    // header it produces, not decoded claims or the unverified _walletAddress hint.
     if (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders) {
         try {
             const headers = await overrides._getAuthHeaders();
-            const authValue = (headers === null || headers === void 0 ? void 0 : headers.Authorization) ||
-                (headers === null || headers === void 0 ? void 0 : headers.authorization) ||
-                '';
-            // Decode the bearer token's subject when present for a stable key across
-            // refreshes; otherwise hash whatever header material we were given.
-            const bearer = authValue.startsWith('Bearer ')
-                ? authValue.slice('Bearer '.length)
-                : authValue;
-            const principal = bearer ? principalFromIdToken$1(bearer) : 'anon';
-            return `${appId}:o${principal}`;
-        }
-        catch (_c) {
+            return `${appId}:o${principalFromAuthValue(authValueFromHeaders(headers))}`;
+        }
+        catch (_a) {
             // If we can't resolve the override identity, use a unique-ish key so we
             // never collide with (and serve) another principal's cached entry.
-            return `${appId}:o${hashForKey$1(String(Date.now()) + Math.random())}`;
+            return `${appId}:o${hashForKey$2(String(Date.now()) + Math.random())}`;
         }
     }
-    // Direct per-request header override. makeApiRequest applies overrides.headers
-    // AFTER its computed auth header (api.ts), so a caller-supplied Authorization
-    // is the REAL request auth — key the cache by it so an entry is never served
-    // to a different principal under the ambient key. (Hardening: no in-repo read
-    // caller passes this today, but the cache must never trail the actual auth.)
-    const directAuth = ((_a = overrides === null || overrides === void 0 ? void 0 : overrides.headers) === null || _a === void 0 ? void 0 : _a.Authorization) ||
-        ((_b = overrides === null || overrides === void 0 ? void 0 : overrides.headers) === null || _b === void 0 ? void 0 : _b.authorization);
-    if (directAuth) {
-        const bearer = directAuth.startsWith('Bearer ')
-            ? directAuth.slice('Bearer '.length)
-            : directAuth;
-        return `${appId}:h${bearer ? principalFromIdToken$1(bearer) : hashForKey$1(directAuth)}`;
-    }
     // Ambient session principal.
     const idToken = await getIdToken(config.isServer);
     return `${appId}:${principalFromIdToken$1(idToken)}`;
@@ -4707,9 +4662,9 @@ async function get(path, opts = {}) {
         const shapeKey = opts.shape ? JSON.stringify(opts.shape) : '';
         const includeSubPathsKey = opts.includeSubPaths ? ':subpaths' : '';
         const limitKey = opts.limit !== undefined ? `:l${opts.limit}` : '';
-        const cursorKey = opts.cursor ? `:c${hashForKey$1(opts.cursor)}` : '';
-        const filterKey = opts.filter ? `:f${hashForKey$1(JSON.stringify(opts.filter))}` : '';
-        const sortKey = opts.sort ? `:s${hashForKey$1(JSON.stringify(opts.sort))}` : '';
+        const cursorKey = opts.cursor ? `:c${hashForKey$2(opts.cursor)}` : '';
+        const filterKey = opts.filter ? `:f${hashForKey$2(JSON.stringify(opts.filter))}` : '';
+        const sortKey = opts.sort ? `:s${hashForKey$2(JSON.stringify(opts.sort))}` : '';
         const principalKey = await getReadPrincipalKey(opts._overrides);
         const cacheKey = `${principalKey}|${normalizedPath}:${opts.prompt || ''}${filterKey}${sortKey}${includeSubPathsKey}:${shapeKey}${limitKey}${cursorKey}`;
         const now = Date.now();
@@ -5459,7 +5414,7 @@ let reconnectInProgress = null;
 function generateSubscriptionId() {
     return `sub_${Date.now()}_${Math.random().toString(36).substring(2, 11)}`;
 }
-function hashForKey(value) {
+function hashForKey$1(value) {
     let h = 5381;
     for (let i = 0; i < value.length; i++) {
         h = ((h << 5) + h + value.charCodeAt(i)) & 0x7fffffff;
@@ -5478,49 +5433,23 @@ function getCacheKey(path, prompt, shape, limit, cursor, filter, identity) {
     const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
     const shapeKey = shape && Object.keys(shape).length > 0 ? JSON.stringify(shape) : '';
     const limitKey = limit !== undefined ? `:l${limit}` : '';
-    const cursorKey = cursor ? `:c${hashForKey(cursor)}` : '';
-    const filterKey = filter && Object.keys(filter).length > 0 ? `:f${hashForKey(JSON.stringify(filter))}` : '';
+    const cursorKey = cursor ? `:c${hashForKey$1(cursor)}` : '';
+    const filterKey = filter && Object.keys(filter).length > 0 ? `:f${hashForKey$1(JSON.stringify(filter))}` : '';
     const identityKey = identity || 'anon';
     return `${identityKey}|${normalizedPath}:${prompt || 'default'}:${shapeKey}${limitKey}${cursorKey}${filterKey}`;
 }
 /**
- * Derive a stable identity string for the principal a subscription authenticates
- * as: `<appId>:<principalFingerprint>`. Mirrors the operations.ts logic so HTTP
- * and WS caches scope reads to the same identity.
+ * Derive an opaque identity string for the bearer material a subscription sends.
+ * JWT payloads are deliberately not trusted here: cache isolation must happen
+ * before the server has verified any claims.
  */
 function principalFromIdToken(idToken) {
-    if (!idToken)
-        return 'anon';
-    try {
-        const parts = idToken.split('.');
-        if (parts.length < 2)
-            return `t${hashForKey(idToken)}`;
-        const payload = JSON.parse(decodeBase64Url(parts[1]));
-        const subject = 
-        // Universal identity (@user.id) first — the stable principal a request
-        // presents (the account id for email/social logins, which carry no
-        // walletAddress). Keeps the H1 response-cache scoping correct for them.
-        payload['custom:userId'] ||
-            payload['custom:walletAddress'] ||
-            payload.walletAddress ||
-            payload.sub ||
-            payload.address;
-        if (subject)
-            return `s${hashForKey(String(subject))}`;
-        return `t${hashForKey(idToken)}`;
-    }
-    catch (_a) {
-        return `t${hashForKey(idToken)}`;
-    }
+    return idToken ? `t${hashForKey$1(idToken)}` : 'anon';
 }
 async function getSubscriptionIdentity(effectiveAppId, isServer, overrides) {
-    // Per-subscription wallet override (server WalletClient.subscribe): key by the
-    // wallet's own token, mirroring getReadPrincipalKey, so a wallet client never
-    // consults — and never crashes on — the absent ambient env keypair, and its
-    // cached snapshots are never crossed with another principal's.
-    if (overrides === null || overrides === void 0 ? void 0 : overrides._walletAddress) {
-        return `${effectiveAppId}:w${overrides._walletAddress}`;
-    }
+    // Per-subscription wallet override (server WalletClient.subscribe): key by
+    // the wallet's own opaque token material, mirroring getReadPrincipalKey. Do
+    // not trust decoded claims or the unverified _walletAddress hint.
     if (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders) {
         try {
             const bearer = bearerFromAuthHeaders(await overrides._getAuthHeaders());
@@ -5891,7 +5820,7 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
     return connection;
 }
 function handleServerMessage(connection, message) {
-    var _a, _b;
+    var _a;
     switch (message.type) {
         case 'authenticated': {
             connection.isAuthenticating = false;
@@ -5985,28 +5914,27 @@ function handleServerMessage(connection, message) {
                     err.subscriptionId = message.subscriptionId;
                 return err;
             };
+            const wsError = buildWsError();
             // Handle CRUD request errors (requestId present)
             if (message.requestId) {
                 const pendingReq = connection.pendingRequests.get(message.requestId);
                 if (pendingReq) {
                     connection.pendingRequests.delete(message.requestId);
                     clearTimeout(pendingReq.timer);
-                    pendingReq.reject(buildWsError());
+                    pendingReq.reject(wsError);
                 }
             }
             if (message.subscriptionId) {
                 // Reject pending subscription if this is a subscription error
                 const pending = connection.pendingSubscriptions.get(message.subscriptionId);
                 if (pending) {
-                    pending.reject(buildWsError());
+                    pending.reject(wsError);
                     connection.pendingSubscriptions.delete(message.subscriptionId);
                 }
                 // Notify error callbacks for this subscription
                 const subscription = connection.subscriptions.get(message.subscriptionId);
                 if (subscription) {
-                    for (const callback of subscription.callbacks) {
-                        (_b = callback.onError) === null || _b === void 0 ? void 0 : _b.call(callback, buildWsError());
-                    }
+                    notifyErrorCallbacks(subscription, wsError);
                 }
             }
             break;
@@ -6059,6 +5987,25 @@ function notifyCallbacks(subscription, data) {
         }
     }
 }
+function notifyErrorCallbacks(subscription, error) {
+    let delivered = false;
+    const callbacks = subscription.callbacks.slice();
+    for (const callback of callbacks) {
+        if (!callback.onError)
+            continue;
+        delivered = true;
+        try {
+            callback.onError(error);
+        }
+        catch (callbackError) {
+            console.error('[WS v2] Error in subscription error callback:', callbackError);
+        }
+    }
+    if (delivered) {
+        error.__boundedDeliveredToOnError = true;
+    }
+    return delivered;
+}
 // WebSocket readyState constants
 const WS_READY_STATE_OPEN = 1;
 const WS_READY_STATE_CLOSED = 3;
@@ -6133,10 +6080,8 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
     const authTokenProvider = (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders)
         ? async () => bearerFromAuthHeaders(await overrides._getAuthHeaders()) || null
         : undefined;
-    const principalKey = (overrides === null || overrides === void 0 ? void 0 : overrides._walletAddress)
-        ? `w${overrides._walletAddress}`
-        : (authTokenProvider ? `o${principalFromIdToken(await authTokenProvider())}` : undefined);
     const identity = await getSubscriptionIdentity(effectiveAppId, config.isServer, overrides);
+    const principalKey = authTokenProvider ? identity : undefined;
     const cacheKey = getCacheKey(normalizedPath, subscriptionOptions.prompt, subscriptionOptions.shape, subscriptionOptions.limit, subscriptionOptions.cursor, subscriptionOptions.filter, identity);
     // Deliver cached data immediately if available
     const cachedEntry = responseCache.get(cacheKey);
@@ -6215,7 +6160,18 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
             await subscriptionPromise;
         }
         catch (error) {
-            console.warn('[WS v2] Subscription confirmation failed, keeping for reconnect recovery:', error);
+            const err = error instanceof Error ? error : new Error(String(error));
+            if (!err.__boundedDeliveredToOnError) {
+                notifyErrorCallbacks(subscription, err);
+            }
+            if (!subscriptionOptions.onError) {
+                connection.pendingSubscriptions.delete(subscriptionId);
+                connection.subscriptions.delete(subscriptionId);
+                throw err;
+            }
+            if (!err.__boundedDeliveredToOnError) {
+                console.warn('[WS v2] Subscription confirmation failed, keeping for reconnect recovery:', error);
+            }
         }
     }
     // Return unsubscribe function
@@ -6378,6 +6334,13 @@ async function doReconnectWithNewAuth() {
     catch (error) {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
+    try {
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return realtimeStore; });
+        await reconnectRealtimeStoreWithNewAuth();
+    }
+    catch (error) {
+        console.warn('[WS v2] Failed to reset legacy realtime store on auth change:', error);
+    }
     for (const [appId, connection] of connections) {
         if (!connection.ws) {
             continue;
@@ -6845,6 +6808,16 @@ async function idbSet(key, value) {
 // RealtimeStore
 // ---------------------------------------------------------------------------
 let nextRequestId = 1;
+function hashForKey(value) {
+    let h = 5381;
+    for (let i = 0; i < value.length; i++) {
+        h = ((h << 5) + h + value.charCodeAt(i)) & 0x7fffffff;
+    }
+    return h.toString(36);
+}
+function principalFromToken(token) {
+    return token ? `t${hashForKey(token)}` : 'anon';
+}
 class RealtimeStore {
     constructor() {
         this.ws = null;
@@ -6860,7 +6833,9 @@ class RealtimeStore {
         this.idbDirtyKeys = new Set();
         this.closed = false;
         this.authToken = null;
+        this.authPrincipalKey = 'anon';
         this.authenticating = false;
+        this.suppressNextReconnect = false;
         this.isServer = false;
         this.tokenRefreshTimer = null;
         // -----------------------------------------------------------------------
@@ -6880,34 +6855,98 @@ class RealtimeStore {
         this.startTokenRefresh();
     }
     async refreshToken() {
+        let token = null;
         try {
             const { getIdToken } = await Promise.resolve().then(function () { return utils; });
-            const token = await getIdToken(this.isServer);
-            if (token)
-                this.authToken = token;
+            token = await getIdToken(this.isServer);
         }
         catch ( /* no auth available */_a) { /* no auth available */ }
+        this.authToken = token !== null && token !== void 0 ? token : null;
+        this.authPrincipalKey = principalFromToken(this.authToken);
     }
     startTokenRefresh() {
         if (this.tokenRefreshTimer)
             return;
         this.tokenRefreshTimer = setInterval(async () => {
-            var _a;
-            const prevToken = this.authToken;
+            const prevPrincipal = this.authPrincipalKey;
             await this.refreshToken();
-            if (this.authToken && this.authToken !== prevToken && ((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN) {
-                // Token changed — reconnect with fresh token
-                this.ws.close(1000, 'Token refreshed');
+            if (this.authPrincipalKey !== prevPrincipal) {
+                await this.applyAuthPrincipalChange();
+                if (this.subscriptions.size > 0) {
+                    await this.ensureConnected().catch(() => {
+                        this.setAllSubscriptionStatus('error');
+                    });
+                }
             }
         }, 5 * 60 * 1000); // Check every 5 minutes
     }
+    async ensureInitialized() {
+        if (this.appId)
+            return;
+        if (!this.initPromise)
+            this.initPromise = this.init();
+        await this.initPromise;
+    }
+    async ensureCurrentAuth() {
+        await this.ensureInitialized();
+        const prevPrincipal = this.authPrincipalKey;
+        await this.refreshToken();
+        if (this.authPrincipalKey !== prevPrincipal) {
+            await this.applyAuthPrincipalChange();
+        }
+    }
+    rekeySubscriptionsForPrincipal() {
+        const subs = Array.from(this.subscriptions.values());
+        this.subscriptions.clear();
+        for (const sub of subs) {
+            this.subscriptions.set(this.getSubKey(sub.path, sub.options), sub);
+        }
+    }
+    async applyAuthPrincipalChange() {
+        if (this.idbFlushTimer) {
+            clearTimeout(this.idbFlushTimer);
+            this.idbFlushTimer = null;
+        }
+        this.idbDirtyKeys.clear();
+        this.rekeySubscriptionsForPrincipal();
+        for (const sub of this.subscriptions.values()) {
+            sub.docs.clear();
+            sub.ref.current = sub.docs;
+            sub.error = null;
+            sub.isStale = false;
+            let loaded = false;
+            if (sub.tier !== 'ephemeral') {
+                const cached = await idbGet(this.idbKey(sub.path));
+                if (cached && Array.isArray(cached)) {
+                    for (const doc of cached) {
+                        if (doc && doc._id)
+                            sub.docs.set(doc._id, doc);
+                    }
+                    sub.ref.current = sub.docs;
+                    loaded = sub.docs.size > 0;
+                }
+            }
+            sub.status = loaded ? 'cached' : 'loading';
+            sub.isStale = loaded;
+            if (loaded)
+                this.notifySubscription(sub);
+            else
+                this.notifyState(sub);
+        }
+        if (this.ws) {
+            const ws = this.ws;
+            this.ws = null;
+            this.connectPromise = null;
+            this.suppressNextReconnect = true;
+            try {
+                ws.close(1000, 'Auth changed');
+            }
+            catch ( /* ignore */_a) { /* ignore */ }
+        }
+    }
     async ensureConnected() {
         var _a;
-        if (!this.appId) {
-            if (!this.initPromise)
-                this.initPromise = this.init();
-            await this.initPromise;
-        }
+        await this.ensureCurrentAuth();
         if (((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN && !this.authenticating)
             return;
         if (this.connectPromise)
@@ -6991,11 +7030,20 @@ class RealtimeStore {
             ws.addEventListener('close', () => {
                 if (authTimer)
                     clearTimeout(authTimer);
+                if (this.ws !== ws) {
+                    if (this.suppressNextReconnect)
+                        this.suppressNextReconnect = false;
+                    return;
+                }
                 this.authenticating = false;
                 this.ws = null;
                 this.connectPromise = null;
                 this.rejectAllPending('WebSocket closed');
                 this.setAllSubscriptionStatus('reconnecting');
+                if (this.suppressNextReconnect) {
+                    this.suppressNextReconnect = false;
+                    return;
+                }
                 this.scheduleReconnect();
             });
         });
@@ -7171,14 +7219,34 @@ class RealtimeStore {
         }
     }
     handleError(msg) {
-        var _a;
+        var _a, _b, _c;
+        const error = new Error((_a = msg.message) !== null && _a !== void 0 ? _a : (msg.code ? `${msg.code}: Server error` : 'Server error'));
+        if (msg.code)
+            error.code = msg.code;
+        if (msg.subscriptionId || msg.id)
+            error.subscriptionId = (_b = msg.subscriptionId) !== null && _b !== void 0 ? _b : msg.id;
         const requestId = msg.requestId;
         if (requestId) {
             const pending = this.pendingRequests.get(requestId);
             if (pending) {
                 this.pendingRequests.delete(requestId);
                 clearTimeout(pending.timeout);
-                pending.reject(new Error((_a = msg.message) !== null && _a !== void 0 ? _a : 'Server error'));
+                pending.reject(error);
+            }
+        }
+        const subId = (_c = msg.subscriptionId) !== null && _c !== void 0 ? _c : msg.id;
+        if (subId) {
+            const sub = this.findSubscriptionById(subId);
+            if (sub) {
+                sub.status = 'error';
+                sub.error = error;
+                this.notifyState(sub);
+                for (const callback of Array.from(sub.errorCallbacks)) {
+                    try {
+                        callback(error);
+                    }
+                    catch ( /* swallow */_d) { /* swallow */ }
+                }
             }
         }
     }
@@ -7187,6 +7255,7 @@ class RealtimeStore {
     // -----------------------------------------------------------------------
     async subscribe(path, opts = {}) {
         var _a;
+        await this.ensureCurrentAuth();
         const tier = (_a = opts.tier) !== null && _a !== void 0 ? _a : 'durable';
         const subKey = this.getSubKey(path, opts);
         let sub = this.subscriptions.get(subKey);
@@ -7196,6 +7265,8 @@ class RealtimeStore {
                 sub.callbacks.add(opts.onData);
             if (opts.onState)
                 sub.stateCallbacks.add(opts.onState);
+            if (opts.onError)
+                sub.errorCallbacks.add(opts.onError);
             // Immediately deliver current state
             if (opts.onData && sub.docs.size > 0) {
                 opts.onData(this.docsToArray(sub));
@@ -7203,7 +7274,7 @@ class RealtimeStore {
             if (opts.onState) {
                 opts.onState(this.getState(sub));
             }
-            return this.createUnsubscribe(subKey, opts.onData, opts.onState);
+            return this.createUnsubscribe(subKey, sub.id, opts.onData, opts.onState, opts.onError);
         }
         // New subscription
         const subId = `sub_${nextRequestId++}`;
@@ -7218,6 +7289,7 @@ class RealtimeStore {
             error: null,
             callbacks: new Set(opts.onData ? [opts.onData] : []),
             stateCallbacks: new Set(opts.onState ? [opts.onState] : []),
+            errorCallbacks: new Set(opts.onError ? [opts.onError] : []),
             ref: { current: new Map() },
         };
         this.subscriptions.set(subKey, sub);
@@ -7247,7 +7319,7 @@ class RealtimeStore {
             sub.error = new Error('Connection failed');
             this.notifyState(sub);
         }
-        return this.createUnsubscribe(subKey, opts.onData, opts.onState);
+        return this.createUnsubscribe(subKey, sub.id, opts.onData, opts.onState, opts.onError);
     }
     getRef(path, opts = {}) {
         var _a;
@@ -7321,6 +7393,7 @@ class RealtimeStore {
         }
     }
     async get(path) {
+        await this.ensureCurrentAuth();
         const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
         // Check local subscriptions first
         const collectionPath = this.getCollectionPath(normalizedPath);
@@ -7501,7 +7574,7 @@ class RealtimeStore {
         return docPath;
     }
     getSubKey(path, opts) {
-        const parts = [path];
+        const parts = [this.appId, this.authPrincipalKey, path];
         if (opts.filter)
             parts.push(JSON.stringify(opts.filter));
         if (opts.prompt)
@@ -7511,7 +7584,7 @@ class RealtimeStore {
         return parts.join('::');
     }
     idbKey(path) {
-        return `${this.appId}:${path}`;
+        return `${this.appId}:${this.authPrincipalKey}:${path}`;
     }
     markIdbDirty(path) {
         const sub = this.findSubscriptionByPath(path);
@@ -7536,18 +7609,23 @@ class RealtimeStore {
             }
         }
     }
-    createUnsubscribe(subKey, onData, onState) {
+    createUnsubscribe(subKey, subId, onData, onState, onError) {
         return async () => {
-            const sub = this.subscriptions.get(subKey);
+            var _a;
+            const sub = (_a = this.subscriptions.get(subKey)) !== null && _a !== void 0 ? _a : this.findSubscriptionById(subId);
             if (!sub)
                 return;
+            const currentSubKey = this.getSubKey(sub.path, sub.options);
             if (onData)
                 sub.callbacks.delete(onData);
             if (onState)
                 sub.stateCallbacks.delete(onState);
+            if (onError)
+                sub.errorCallbacks.delete(onError);
             // If no more callbacks, unsubscribe entirely
-            if (sub.callbacks.size === 0 && sub.stateCallbacks.size === 0) {
+            if (sub.callbacks.size === 0 && sub.stateCallbacks.size === 0 && sub.errorCallbacks.size === 0) {
                 this.subscriptions.delete(subKey);
+                this.subscriptions.delete(currentSubKey);
                 if (this.ws && this.ws.readyState === WebSocket.OPEN) {
                     this.ws.send(JSON.stringify({
                         type: 'unsubscribe',
@@ -7619,6 +7697,22 @@ class RealtimeStore {
         this.rejectAllPending('Store closed');
         this.subscriptions.clear();
     }
+    async reconnectWithNewAuth() {
+        if (this.closed)
+            return;
+        await this.ensureInitialized();
+        await this.refreshToken();
+        await this.applyAuthPrincipalChange();
+        if (this.subscriptions.size > 0) {
+            await this.ensureConnected().catch((error) => {
+                this.setAllSubscriptionStatus('error');
+                for (const sub of this.subscriptions.values()) {
+                    sub.error = error instanceof Error ? error : new Error(String(error));
+                    this.notifyState(sub);
+                }
+            });
+        }
+    }
 }
 // ---------------------------------------------------------------------------
 // Singleton instance
@@ -7636,6 +7730,19 @@ function resetRealtimeStore() {
         storeInstance = null;
     }
 }
+async function reconnectRealtimeStoreWithNewAuth() {
+    if (storeInstance) {
+        await storeInstance.reconnectWithNewAuth();
+    }
+}
+
+var realtimeStore = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    RealtimeStore: RealtimeStore,
+    getRealtimeStore: getRealtimeStore,
+    reconnectRealtimeStoreWithNewAuth: reconnectRealtimeStoreWithNewAuth,
+    resetRealtimeStore: resetRealtimeStore
+});
 
 // ---------------------------------------------------------------------------
 // functions.ts -- Bounded Functions client (the imperative escape hatch).
@@ -7791,6 +7898,23 @@ function realtimeHttpBase(wsApiUrl) {
     // Strip trailing slash from the resulting origin+path.
     return url.toString().replace(/\/$/, '');
 }
+function withoutAuthorization(headers) {
+    if (!headers)
+        return undefined;
+    const clean = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === 'authorization')
+            continue;
+        clean[key] = value;
+    }
+    return Object.keys(clean).length > 0 ? clean : undefined;
+}
+async function liveAuthHeader(configIsServer, overrides) {
+    if (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders) {
+        return overrides._getAuthHeaders();
+    }
+    return createAuthHeader(configIsServer);
+}
 /**
  * Send a player intent to a running live room. Returns `{ ok: true }`.
  *
@@ -7805,7 +7929,7 @@ function realtimeHttpBase(wsApiUrl) {
  * transport error / timeout.
  */
 async function intent(roomPath, intent, opts = {}) {
-    var _a, _b, _c, _d, _e;
+    var _a, _b, _c, _d, _e, _f, _g;
     if (!roomPath || typeof roomPath !== 'string') {
         throw new LiveIntentError('A room path is required');
     }
@@ -7826,37 +7950,48 @@ async function intent(roomPath, intent, opts = {}) {
     // (e.g. the first join before subscribeView's WS connects) — HTTP also throws
     // on a non-2xx, so errors are surfaced there too.
     const normalizedRoomPath = roomPath.replace(/\/$/, '');
-    if (opts.fireAndForget) {
-        if (wsIntent(config.appId, normalizedRoomPath, intent))
-            return { ok: true };
-    }
-    else {
-        const ack = wsIntentReliable(config.appId, normalizedRoomPath, intent);
-        if (ack)
-            return await ack;
+    const hasAuthOverride = !!((_a = opts._overrides) === null || _a === void 0 ? void 0 : _a._getAuthHeaders);
+    if (!hasAuthOverride) {
+        if (opts.fireAndForget) {
+            if (wsIntent(config.appId, normalizedRoomPath, intent))
+                return { ok: true };
+        }
+        else {
+            const ack = wsIntentReliable(config.appId, normalizedRoomPath, intent);
+            if (ack)
+                return await ack;
+        }
     }
     const base = realtimeHttpBase(config.wsApiUrl);
-    // Attach the caller's session token automatically (same token as data calls).
-    const authHeader = await createAuthHeader(config.isServer);
-    const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, (authHeader !== null && authHeader !== void 0 ? authHeader : {})), ((_a = opts.headers) !== null && _a !== void 0 ? _a : {}));
+    const extraHeaders = withoutAuthorization(opts.headers);
+    const overrideHeaders = withoutAuthorization((_b = opts._overrides) === null || _b === void 0 ? void 0 : _b.headers);
+    const buildHeaders = async () => {
+        const authHeader = await liveAuthHeader(config.isServer, opts._overrides);
+        return Object.assign(Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, (overrideHeaders !== null && overrideHeaders !== void 0 ? overrideHeaders : {})), (extraHeaders !== null && extraHeaders !== void 0 ? extraHeaders : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
+    };
     const controller = new AbortController();
-    const timeoutMs = (_b = opts.timeoutMs) !== null && _b !== void 0 ? _b : 60000;
+    const timeoutMs = (_c = opts.timeoutMs) !== null && _c !== void 0 ? _c : 60000;
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     let res;
     try {
-        res = await fetch(`${base}/live/intent`, {
+        const send = async () => fetch(`${base}/live/intent`, {
             method: 'POST',
-            headers,
+            headers: await buildHeaders(),
             body: JSON.stringify({ path: normalizedRoomPath, intent }),
             signal: controller.signal,
         });
+        res = await send();
+        if (res.status === 401 && ((_d = opts._overrides) === null || _d === void 0 ? void 0 : _d._clearAuth)) {
+            await opts._overrides._clearAuth();
+            res = await send();
+        }
     }
     catch (err) {
         clearTimeout(timer);
         if ((err === null || err === void 0 ? void 0 : err.name) === 'AbortError') {
             throw new LiveIntentError(`Live intent to "${roomPath}" timed out after ${timeoutMs}ms`);
         }
-        throw new LiveIntentError(`Failed to reach the realtime worker: ${(_c = err === null || err === void 0 ? void 0 : err.message) !== null && _c !== void 0 ? _c : String(err)}`);
+        throw new LiveIntentError(`Failed to reach the realtime worker: ${(_e = err === null || err === void 0 ? void 0 : err.message) !== null && _e !== void 0 ? _e : String(err)}`);
     }
     clearTimeout(timer);
     let body = null;
@@ -7865,12 +8000,12 @@ async function intent(roomPath, intent, opts = {}) {
         try {
             body = JSON.parse(text);
         }
-        catch (_f) {
+        catch (_h) {
             body = { raw: text };
         }
     }
     if (!res.ok) {
-        const message = (_e = (_d = body === null || body === void 0 ? void 0 : body.error) !== null && _d !== void 0 ? _d : body === null || body === void 0 ? void 0 : body.message) !== null && _e !== void 0 ? _e : `Live intent failed with HTTP ${res.status}`;
+        const message = (_g = (_f = body === null || body === void 0 ? void 0 : body.error) !== null && _f !== void 0 ? _f : body === null || body === void 0 ? void 0 : body.message) !== null && _g !== void 0 ? _g : `Live intent failed with HTTP ${res.status}`;
         throw new LiveIntentError(message, res.status, body);
     }
     return (body !== null && body !== void 0 ? body : { ok: true });