@bounded-sh/core 0.0.17 → 0.0.19

package/dist/index.js

@@ -1,8 +1,8 @@
 'use strict';
 
 var axios = require('axios');
-var web3_js = require('@solana/web3.js');
 var nacl = require('tweetnacl');
+var web3_js = require('@solana/web3.js');
 var anchor = require('@coral-xyz/anchor');
 var BN = require('bn.js');
 var ReconnectingWebSocket = require('reconnecting-websocket');
@@ -30,7 +30,6 @@ let clientConfig = {
     // User configured settings
     name: '',
     logoUrl: '',
-    apiKey: '',
     // Bounded production is the out-of-the-box default — a Bounded app needs only
     // `{ appId }`. Pass `network: 'bounded-staging'` to target staging.
     network: 'bounded-production',
@@ -107,7 +106,7 @@ function isBoundedNetwork() {
 }
 function init(newConfig) {
     return new Promise((resolve, reject) => {
-        if (!newConfig.apiKey && !newConfig.appId) {
+        if (!newConfig.appId) {
             reject(new Error('No app ID provided.'));
             return;
         }
@@ -2883,9 +2882,25 @@ async function refreshSession(refreshToken, issuer) {
     })();
     return refreshInFlight$1;
 }
+class SessionRevokeError extends Error {
+    constructor(message, cause) {
+        super(message);
+        this.name = 'SessionRevokeError';
+        this.cause = cause;
+    }
+}
+function revokeFailureMessage(err) {
+    var _a, _b;
+    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
+    const statusText = (_b = err === null || err === void 0 ? void 0 : err.response) === null || _b === void 0 ? void 0 : _b.statusText;
+    const suffix = typeof status === 'number'
+        ? ` (HTTP ${status}${statusText ? ` ${statusText}` : ''})`
+        : '';
+    return `Failed to revoke refresh token server-side${suffix}. The refresh-token family may still be active.`;
+}
 /**
- * Revoke a session's refresh-token family server-side (logout). Best-effort: if the
- * call fails the local logout still proceeds. Routes to the minting issuer.
+ * Revoke a session's refresh-token family server-side (logout). Routes to the
+ * minting issuer and rejects if the revoke request fails.
  */
 async function revokeSession(refreshToken, issuer) {
     if (!refreshToken)
@@ -2898,8 +2913,8 @@ async function revokeSession(refreshToken, issuer) {
             appId: config.appId,
         }, { headers: { 'Content-Type': 'application/json' }, timeout: 15000 });
     }
-    catch (_a) {
-        // best-effort: logout must succeed even if the revoke call doesn't
+    catch (err) {
+        throw new SessionRevokeError(revokeFailureMessage(err), err);
     }
 }
 async function signSessionCreateMessage(_signMessageFunction) {
@@ -3315,231 +3330,6 @@ var sessionManager = /*#__PURE__*/Object.freeze({
     getActiveSessionManager: getActiveSessionManager
 });
 
-var safeBuffer = {exports: {}};
-
-/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
-
-var hasRequiredSafeBuffer;
-
-function requireSafeBuffer () {
-	if (hasRequiredSafeBuffer) return safeBuffer.exports;
-	hasRequiredSafeBuffer = 1;
-	(function (module, exports$1) {
-		/* eslint-disable node/no-deprecated-api */
-		var buffer = requireBuffer();
-		var Buffer = buffer.Buffer;
-
-		// alternative to using Object.keys for old browsers
-		function copyProps (src, dst) {
-		  for (var key in src) {
-		    dst[key] = src[key];
-		  }
-		}
-		if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) {
-		  module.exports = buffer;
-		} else {
-		  // Copy properties from require('buffer')
-		  copyProps(buffer, exports$1);
-		  exports$1.Buffer = SafeBuffer;
-		}
-
-		function SafeBuffer (arg, encodingOrOffset, length) {
-		  return Buffer(arg, encodingOrOffset, length)
-		}
-
-		SafeBuffer.prototype = Object.create(Buffer.prototype);
-
-		// Copy static methods from Buffer
-		copyProps(Buffer, SafeBuffer);
-
-		SafeBuffer.from = function (arg, encodingOrOffset, length) {
-		  if (typeof arg === 'number') {
-		    throw new TypeError('Argument must not be a number')
-		  }
-		  return Buffer(arg, encodingOrOffset, length)
-		};
-
-		SafeBuffer.alloc = function (size, fill, encoding) {
-		  if (typeof size !== 'number') {
-		    throw new TypeError('Argument must be a number')
-		  }
-		  var buf = Buffer(size);
-		  if (fill !== undefined) {
-		    if (typeof encoding === 'string') {
-		      buf.fill(fill, encoding);
-		    } else {
-		      buf.fill(fill);
-		    }
-		  } else {
-		    buf.fill(0);
-		  }
-		  return buf
-		};
-
-		SafeBuffer.allocUnsafe = function (size) {
-		  if (typeof size !== 'number') {
-		    throw new TypeError('Argument must be a number')
-		  }
-		  return Buffer(size)
-		};
-
-		SafeBuffer.allocUnsafeSlow = function (size) {
-		  if (typeof size !== 'number') {
-		    throw new TypeError('Argument must be a number')
-		  }
-		  return buffer.SlowBuffer(size)
-		}; 
-	} (safeBuffer, safeBuffer.exports));
-	return safeBuffer.exports;
-}
-
-var src;
-var hasRequiredSrc;
-
-function requireSrc () {
-	if (hasRequiredSrc) return src;
-	hasRequiredSrc = 1;
-	// base-x encoding / decoding
-	// Copyright (c) 2018 base-x contributors
-	// Copyright (c) 2014-2018 The Bitcoin Core developers (base58.cpp)
-	// Distributed under the MIT software license, see the accompanying
-	// file LICENSE or http://www.opensource.org/licenses/mit-license.php.
-	// @ts-ignore
-	var _Buffer = requireSafeBuffer().Buffer;
-	function base (ALPHABET) {
-	  if (ALPHABET.length >= 255) { throw new TypeError('Alphabet too long') }
-	  var BASE_MAP = new Uint8Array(256);
-	  for (var j = 0; j < BASE_MAP.length; j++) {
-	    BASE_MAP[j] = 255;
-	  }
-	  for (var i = 0; i < ALPHABET.length; i++) {
-	    var x = ALPHABET.charAt(i);
-	    var xc = x.charCodeAt(0);
-	    if (BASE_MAP[xc] !== 255) { throw new TypeError(x + ' is ambiguous') }
-	    BASE_MAP[xc] = i;
-	  }
-	  var BASE = ALPHABET.length;
-	  var LEADER = ALPHABET.charAt(0);
-	  var FACTOR = Math.log(BASE) / Math.log(256); // log(BASE) / log(256), rounded up
-	  var iFACTOR = Math.log(256) / Math.log(BASE); // log(256) / log(BASE), rounded up
-	  function encode (source) {
-	    if (Array.isArray(source) || source instanceof Uint8Array) { source = _Buffer.from(source); }
-	    if (!_Buffer.isBuffer(source)) { throw new TypeError('Expected Buffer') }
-	    if (source.length === 0) { return '' }
-	        // Skip & count leading zeroes.
-	    var zeroes = 0;
-	    var length = 0;
-	    var pbegin = 0;
-	    var pend = source.length;
-	    while (pbegin !== pend && source[pbegin] === 0) {
-	      pbegin++;
-	      zeroes++;
-	    }
-	        // Allocate enough space in big-endian base58 representation.
-	    var size = ((pend - pbegin) * iFACTOR + 1) >>> 0;
-	    var b58 = new Uint8Array(size);
-	        // Process the bytes.
-	    while (pbegin !== pend) {
-	      var carry = source[pbegin];
-	            // Apply "b58 = b58 * 256 + ch".
-	      var i = 0;
-	      for (var it1 = size - 1; (carry !== 0 || i < length) && (it1 !== -1); it1--, i++) {
-	        carry += (256 * b58[it1]) >>> 0;
-	        b58[it1] = (carry % BASE) >>> 0;
-	        carry = (carry / BASE) >>> 0;
-	      }
-	      if (carry !== 0) { throw new Error('Non-zero carry') }
-	      length = i;
-	      pbegin++;
-	    }
-	        // Skip leading zeroes in base58 result.
-	    var it2 = size - length;
-	    while (it2 !== size && b58[it2] === 0) {
-	      it2++;
-	    }
-	        // Translate the result into a string.
-	    var str = LEADER.repeat(zeroes);
-	    for (; it2 < size; ++it2) { str += ALPHABET.charAt(b58[it2]); }
-	    return str
-	  }
-	  function decodeUnsafe (source) {
-	    if (typeof source !== 'string') { throw new TypeError('Expected String') }
-	    if (source.length === 0) { return _Buffer.alloc(0) }
-	    var psz = 0;
-	        // Skip and count leading '1's.
-	    var zeroes = 0;
-	    var length = 0;
-	    while (source[psz] === LEADER) {
-	      zeroes++;
-	      psz++;
-	    }
-	        // Allocate enough space in big-endian base256 representation.
-	    var size = (((source.length - psz) * FACTOR) + 1) >>> 0; // log(58) / log(256), rounded up.
-	    var b256 = new Uint8Array(size);
-	        // Process the characters.
-	    while (psz < source.length) {
-	            // Find code of next character
-	      var charCode = source.charCodeAt(psz);
-	            // Base map can not be indexed using char code
-	      if (charCode > 255) { return }
-	            // Decode character
-	      var carry = BASE_MAP[charCode];
-	            // Invalid character
-	      if (carry === 255) { return }
-	      var i = 0;
-	      for (var it3 = size - 1; (carry !== 0 || i < length) && (it3 !== -1); it3--, i++) {
-	        carry += (BASE * b256[it3]) >>> 0;
-	        b256[it3] = (carry % 256) >>> 0;
-	        carry = (carry / 256) >>> 0;
-	      }
-	      if (carry !== 0) { throw new Error('Non-zero carry') }
-	      length = i;
-	      psz++;
-	    }
-	        // Skip leading zeroes in b256.
-	    var it4 = size - length;
-	    while (it4 !== size && b256[it4] === 0) {
-	      it4++;
-	    }
-	    var vch = _Buffer.allocUnsafe(zeroes + (size - it4));
-	    vch.fill(0x00, 0, zeroes);
-	    var j = zeroes;
-	    while (it4 !== size) {
-	      vch[j++] = b256[it4++];
-	    }
-	    return vch
-	  }
-	  function decode (string) {
-	    var buffer = decodeUnsafe(string);
-	    if (buffer) { return buffer }
-	    throw new Error('Non-base' + BASE + ' character')
-	  }
-	  return {
-	    encode: encode,
-	    decodeUnsafe: decodeUnsafe,
-	    decode: decode
-	  }
-	}
-	src = base;
-	return src;
-}
-
-var bs58$1;
-var hasRequiredBs58;
-
-function requireBs58 () {
-	if (hasRequiredBs58) return bs58$1;
-	hasRequiredBs58 = 1;
-	var basex = requireSrc();
-	var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
-
-	bs58$1 = basex(ALPHABET);
-	return bs58$1;
-}
-
-var bs58Exports = requireBs58();
-var bs58 = /*@__PURE__*/getDefaultExportFromCjs(bs58Exports);
-
 // ─────────────────────────────────────────────────────────────
 // Local implementation of getSimulationComputeUnits
 // (Replaces @solana-developers/helpers to avoid Wallet import issue in browser/ESM builds)
@@ -3797,36 +3587,7 @@ async function buildSetDocumentsTransaction(connection, idl, anchorProvider, pay
     return { tx: vTx, blockhash, lastValidBlockHeight };
 }
 
-/* ------------------------------------------------------------------ */
-/*  ENV helpers                                                       */
-/* ------------------------------------------------------------------ */
-// Canonical `BOUNDED_PRIVATE_KEY` (matches the CLI). Only consulted when no
-// explicit keypair was provided (createWalletClient passes one).
-const ENV_KEYPAIR = "BOUNDED_PRIVATE_KEY";
-const LEGACY_ENV_KEYPAIR = "BOUNDED_SOLANA_KEYPAIR";
-function loadKeypairFromEnv() {
-    if (process.env[LEGACY_ENV_KEYPAIR]) {
-        throw new Error(`${LEGACY_ENV_KEYPAIR} is no longer supported. Set ${ENV_KEYPAIR} instead, ` +
-            `or pass an explicit keypair via createWalletClient({ keypair }).`);
-    }
-    const secret = process.env[ENV_KEYPAIR];
-    if (!secret) {
-        throw new Error(`No server keypair for this top-level call. The top-level get/set/subscribe/etc. use an ` +
-            `AMBIENT session — set ${ENV_KEYPAIR} to a base-58 secret key (or JSON array) to provide one. ` +
-            `If you already created a wallet with createWalletClient({ keypair }), call ITS methods instead ` +
-            `(client.subscribe / client.set / client.get): that client is self-contained and deliberately does ` +
-            `not set the ambient session, so the top-level functions can't see it.`);
-    }
-    try {
-        const secretKey = secret.trim().startsWith("[")
-            ? Uint8Array.from(JSON.parse(secret))
-            : bs58.decode(secret.trim());
-        return web3_js.Keypair.fromSecretKey(secretKey);
-    }
-    catch (err) {
-        throw new Error(`Unable to parse ${ENV_KEYPAIR}. Ensure it is valid base-58 or JSON.`);
-    }
-}
+const NO_AMBIENT_SERVER_SESSION = "Server sessions are not process-global. Use createWalletClient({ keypair }) and call that wallet client's methods.";
 /* ------------------------------------------------------------------ */
 /* SESSION MANAGER                                                     */
 /* ------------------------------------------------------------------ */
@@ -3849,8 +3610,10 @@ class ServerSessionManager {
      * Session creation (instance method)
      * ---------------------------------------------- */
     async createSession() {
-        var _a;
-        const kp = (_a = this.keypair) !== null && _a !== void 0 ? _a : loadKeypairFromEnv();
+        if (!this.keypair) {
+            throw new Error(NO_AMBIENT_SERVER_SESSION);
+        }
+        const kp = this.keypair;
         const address = kp.publicKey.toBase58();
         /* fetch nonce from auth API */
         const nonce = await genAuthNonce();
@@ -3912,7 +3675,7 @@ class ServerSessionManager {
         return (_b = (_a = this.session) === null || _a === void 0 ? void 0 : _a.refreshToken) !== null && _b !== void 0 ? _b : null;
     }
 }
-/* The default singleton instance (reads keypair from env) */
+/* The default singleton exists only so top-level server calls fail closed. */
 ServerSessionManager.instance = new ServerSessionManager();
 
 /**
@@ -3988,9 +3751,7 @@ async function getUserInfo(isServer) {
  *
  * Mirrors the realtime-worker auth.ts identity resolution so the client-side
  * `user` object matches what the backend authenticates as:
- *   - id  = custom:userId when present, else custom:walletAddress (the fallback
- *           keeps wallet/SIWS tokens — which omit userId — AND legacy Better Auth
- *           tokens — which put the account id in custom:walletAddress — working).
+ *   - id  = custom:userId only.
  *   - address = custom:walletAddress only (a REAL wallet). NEVER falls back to the
  *           identity: an opaque id is not a spendable onchain address. null for
  *           email-only sessions.
@@ -4015,7 +3776,7 @@ function deriveUserIdentityFromIdToken(idToken) {
         const userIdClaim = payload['custom:userId'];
         const id = (typeof userIdClaim === 'string' && userIdClaim.length > 0)
             ? userIdClaim
-            : address;
+            : null;
         const emailClaim = payload['email'];
         const email = (typeof emailClaim === 'string' && emailClaim.length > 0)
             ? emailClaim.toLowerCase()
@@ -4071,17 +3832,6 @@ async function updateIdTokenAndAccessToken(idToken, accessToken, isServer = fals
     await getActiveSessionManager().updateIdTokenAndAccessToken(idToken, accessToken, refreshToken);
 }
 
-var utils = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    createAuthHeader: createAuthHeader,
-    deriveUserIdentityFromIdToken: deriveUserIdentityFromIdToken,
-    getIdToken: getIdToken,
-    getRefreshToken: getRefreshToken,
-    getSessionIssuer: getSessionIssuer,
-    getUserInfo: getUserInfo,
-    updateIdTokenAndAccessToken: updateIdTokenAndAccessToken
-});
-
 const apiClient = axios.create();
 axiosRetry(apiClient, {
     retries: 2,
@@ -4146,7 +3896,7 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
         const authHeader = (_overrides === null || _overrides === void 0 ? void 0 : _overrides._getAuthHeaders)
             ? await _overrides._getAuthHeaders()
             : await createAuthHeader(config.isServer);
-        const headers = Object.assign({ "Content-Type": "application/json", "X-Public-App-Id": config.appId, "X-App-Id": config.appId }, authHeader);
+        const headers = Object.assign({ "Content-Type": "application/json", "X-App-Id": config.appId }, authHeader);
         // Apply custom headers from _overrides
         if (_overrides === null || _overrides === void 0 ? void 0 : _overrides.headers) {
             Object.assign(headers, _overrides.headers);
@@ -4250,6 +4000,7 @@ const pendingRequests = {};
 const GET_CACHE_TTL = 500; // Adjust this value as needed (in milliseconds)
 // Last time we cleaned up the cache
 let lastCacheCleanup = Date.now();
+let uncacheableReadKeyCounter = 0;
 /**
  * Return the leaf document key (last path segment) for a document path.
  *
@@ -4335,57 +4086,74 @@ function normalizeReadResult(responseData, pathIsDocument) {
     }
     return responseData;
 }
-function hashForKey$2(value) {
+function hashForKey$1(value) {
     let h = 5381;
     for (let i = 0; i < value.length; i++) {
         h = ((h << 5) + h + value.charCodeAt(i)) & 0x7fffffff;
     }
     return h.toString(36);
 }
+function hasAuthHeader(headers) {
+    if (!headers)
+        return false;
+    return (Object.prototype.hasOwnProperty.call(headers, 'Authorization') ||
+        Object.prototype.hasOwnProperty.call(headers, 'authorization'));
+}
 function authValueFromHeaders(headers) {
     return (headers === null || headers === void 0 ? void 0 : headers.Authorization) || (headers === null || headers === void 0 ? void 0 : headers.authorization) || '';
 }
 function principalFromAuthValue(authValue) {
-    return authValue ? `h${hashForKey$2(authValue)}` : 'anon';
+    return authValue ? `h${hashForKey$1(authValue)}` : null;
 }
 function principalFromIdToken$1(idToken) {
-    return idToken ? `t${hashForKey$2(idToken)}` : 'anon';
+    return idToken ? `t${hashForKey$1(idToken)}` : null;
+}
+function uncacheableReadKey(appId, scope) {
+    uncacheableReadKeyCounter += 1;
+    return `${appId}:${scope}-uncacheable-${uncacheableReadKeyCounter}`;
 }
 /**
  * SECURITY (H1): Read caches must be keyed by the caller's principal, not just
  * by path/filter/shape. In a shared process / SSR worker / browser login-switch,
  * keying by path alone lets User B receive User A's cached private read before
- * any server read rule runs. This returns `appId:<principal>` for the identity a
- * given read will actually authenticate as. This intentionally treats JWTs as
- * opaque unverified bearer material — never decoded claims and never caller
- * identity hints such as `_walletAddress`. A forged token that merely claims
- * another user's `sub` must miss that user's cache and go to the server.
+ * any server read rule runs. This returns `appId:<principal>` for the opaque
+ * auth material a given read will actually authenticate with. No-auth reads are
+ * deliberately marked uncacheable instead of sharing an implicit `anon` bucket.
+ * JWTs are intentionally treated as opaque unverified bearer material — never
+ * decoded claims and never caller identity hints such as `_walletAddress`.
  */
 async function getReadPrincipalKey(overrides) {
     const config = await getConfig();
     const appId = config.appId || '';
     // makeApiRequest applies overrides.headers AFTER its computed auth header, so
     // caller-supplied Authorization is the real request auth when present.
-    const directAuth = authValueFromHeaders(overrides === null || overrides === void 0 ? void 0 : overrides.headers);
-    if (directAuth) {
-        return `${appId}:${principalFromAuthValue(directAuth)}`;
+    if (hasAuthHeader(overrides === null || overrides === void 0 ? void 0 : overrides.headers)) {
+        const principal = principalFromAuthValue(authValueFromHeaders(overrides === null || overrides === void 0 ? void 0 : overrides.headers));
+        return principal
+            ? { key: `${appId}:${principal}`, cacheable: true }
+            : { key: uncacheableReadKey(appId, 'h'), cacheable: false };
     }
     // Per-request auth-header override (wallet client). Key by the exact opaque
     // header it produces, not decoded claims or the unverified _walletAddress hint.
     if (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders) {
         try {
             const headers = await overrides._getAuthHeaders();
-            return `${appId}:o${principalFromAuthValue(authValueFromHeaders(headers))}`;
+            const principal = principalFromAuthValue(authValueFromHeaders(headers));
+            return principal
+                ? { key: `${appId}:o${principal}`, cacheable: true }
+                : { key: uncacheableReadKey(appId, 'o'), cacheable: false };
         }
         catch (_a) {
-            // If we can't resolve the override identity, use a unique-ish key so we
-            // never collide with (and serve) another principal's cached entry.
-            return `${appId}:o${hashForKey$2(String(Date.now()) + Math.random())}`;
+            // If we can't resolve the override identity, do not read/write cache.
+            return { key: uncacheableReadKey(appId, 'o'), cacheable: false };
         }
     }
     // Ambient session principal.
     const idToken = await getIdToken(config.isServer);
-    return `${appId}:${principalFromIdToken$1(idToken)}`;
+    const principal = principalFromIdToken$1(idToken);
+    return principal
+        ? { key: `${appId}:${principal}`, cacheable: true }
+        : { key: uncacheableReadKey(appId, 'a'), cacheable: false };
 }
 /**
  * Validates that a field name is a safe identifier (alphanumeric, underscores, dots for nested paths).
@@ -4678,18 +4446,20 @@ async function get(path, opts = {}) {
         // Create cache key combining path, prompt, filter, sort, includeSubPaths,
         // shape, limit, cursor — and (H1) the caller's appId + principal fingerprint,
         // so a private read cached for one user is never served to another in a
-        // shared process / SSR worker / browser login-switch.
+        // shared process / SSR worker / browser login-switch. The cache is opt-in
+        // and disabled for no-auth reads, which get an uncacheable unique key.
         const shapeKey = opts.shape ? JSON.stringify(opts.shape) : '';
         const includeSubPathsKey = opts.includeSubPaths ? ':subpaths' : '';
         const limitKey = opts.limit !== undefined ? `:l${opts.limit}` : '';
-        const cursorKey = opts.cursor ? `:c${hashForKey$2(opts.cursor)}` : '';
-        const filterKey = opts.filter ? `:f${hashForKey$2(JSON.stringify(opts.filter))}` : '';
-        const sortKey = opts.sort ? `:s${hashForKey$2(JSON.stringify(opts.sort))}` : '';
+        const cursorKey = opts.cursor ? `:c${hashForKey$1(opts.cursor)}` : '';
+        const filterKey = opts.filter ? `:f${hashForKey$1(JSON.stringify(opts.filter))}` : '';
+        const sortKey = opts.sort ? `:s${hashForKey$1(JSON.stringify(opts.sort))}` : '';
         const principalKey = await getReadPrincipalKey(opts._overrides);
-        const cacheKey = `${principalKey}|${normalizedPath}:${opts.prompt || ''}${filterKey}${sortKey}${includeSubPathsKey}:${shapeKey}${limitKey}${cursorKey}`;
+        const cacheKey = `${principalKey.key}|${normalizedPath}:${opts.prompt || ''}${filterKey}${sortKey}${includeSubPathsKey}:${shapeKey}${limitKey}${cursorKey}`;
+        const cacheEnabled = opts.cache === true && !opts.bypassCache && principalKey.cacheable;
         const now = Date.now();
-        // Check for valid cache entry if not bypassing cache
-        if (!opts.bypassCache && getCache[cacheKey] && now < getCache[cacheKey].expiresAt) {
+        // Check for valid cache entry when the caller explicitly opted in.
+        if (cacheEnabled && getCache[cacheKey] && now < getCache[cacheKey].expiresAt) {
             return getCache[cacheKey].data;
         }
         // If we're bypassing cache, we should still coalesce identical requests
@@ -4731,8 +4501,8 @@ async function get(path, opts = {}) {
                 //   - collection path → `{ data, nextCursor }` preserved,
                 // with the bare `id` (leaf doc key) attached to every returned row (Bug 1).
                 const responseData = normalizeReadResult(response.data, pathIsDocument);
-                // Cache the response (unless bypassing cache)
-                if (!opts.bypassCache) {
+                // Cache the response only when explicitly requested and principal-bound.
+                if (cacheEnabled) {
                     getCache[cacheKey] = {
                         data: responseData,
                         expiresAt: now + GET_CACHE_TTL
@@ -4770,6 +4540,213 @@ function cleanupExpiredCache() {
     });
     lastCacheCleanup = now;
 }
+const BOUNDED_PROGRAM_MAINNET = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
+const BOUNDED_PROGRAM_DEVNET = 'taro6CvKqwrYrDc16ufYgzQ2NZcyyVKStffbtudrhRu';
+const COMPUTE_BUDGET_PROGRAM = 'ComputeBudget111111111111111111111111111111';
+const SYSTEM_PROGRAM_ID = '11111111111111111111111111111111';
+const ALLOWED_SERVER_TX_PROGRAMS = new Set([
+    BOUNDED_PROGRAM_MAINNET,
+    BOUNDED_PROGRAM_DEVNET,
+    COMPUTE_BUDGET_PROGRAM,
+    SYSTEM_PROGRAM_ID,
+]);
+const SET_DOCUMENTS_DISCRIMINATOR = '79,46,72,73,24,79,66,245';
+const SET_DOCUMENTS_V2_DISCRIMINATOR = '22,236,242,185,145,61,26,39';
+const ALLOWED_BOUNDED_SET_DISCRIMINATORS = new Set([
+    SET_DOCUMENTS_DISCRIMINATOR,
+    SET_DOCUMENTS_V2_DISCRIMINATOR,
+]);
+class BorshCursor {
+    constructor(data, offset, label) {
+        this.data = data;
+        this.offset = offset;
+        this.label = label;
+    }
+    requireBytes(length, field) {
+        if (this.offset + length > this.data.length) {
+            throw new Error(`${this.label} has malformed Bounded instruction data while reading ${field}`);
+        }
+    }
+    readU8(field) {
+        this.requireBytes(1, field);
+        return this.data[this.offset++];
+    }
+    readU32(field) {
+        this.requireBytes(4, field);
+        const value = this.data[this.offset] |
+            (this.data[this.offset + 1] << 8) |
+            (this.data[this.offset + 2] << 16) |
+            (this.data[this.offset + 3] << 24);
+        this.offset += 4;
+        return value >>> 0;
+    }
+    skip(length, field) {
+        this.requireBytes(length, field);
+        this.offset += length;
+    }
+    readString(field) {
+        const length = this.readU32(`${field} length`);
+        this.requireBytes(length, field);
+        const raw = this.data.slice(this.offset, this.offset + length);
+        this.offset += length;
+        return bufferExports.Buffer.from(raw).toString('utf8');
+    }
+    skipBytes(field) {
+        const length = this.readU32(`${field} length`);
+        this.skip(length, field);
+    }
+    isAtEnd() {
+        return this.offset === this.data.length;
+    }
+}
+function discriminatorKey(data) {
+    return Array.from(data.slice(0, 8)).join(',');
+}
+function skipBoundedFieldValue(cursor) {
+    const option = cursor.readU8('operation value option');
+    if (option === 0)
+        return;
+    if (option !== 1) {
+        throw new Error('Server transaction has malformed Bounded field value option');
+    }
+    const variant = cursor.readU8('operation value variant');
+    switch (variant) {
+        case 0: // u64Val
+        case 1: // i64Val
+            cursor.skip(8, 'operation numeric value');
+            return;
+        case 2: // boolVal
+            cursor.skip(1, 'operation bool value');
+            return;
+        case 3: // stringVal
+            cursor.readString('operation string value');
+            return;
+        case 4: // addressVal
+            cursor.skip(32, 'operation address value');
+            return;
+        default:
+            throw new Error(`Server transaction has unsupported Bounded field value variant: ${variant}`);
+    }
+}
+function skipBoundedFieldOperation(cursor) {
+    cursor.readString('operation key');
+    skipBoundedFieldValue(cursor);
+    cursor.skip(1, 'operation kind');
+}
+function skipBoundedTxData(cursor, isV2) {
+    cursor.readString('txData plugin function key');
+    cursor.skipBytes('txData bytes');
+    if (isV2) {
+        cursor.skipBytes('txData raIndices');
+        return;
+    }
+    const raIndexCount = cursor.readU32('txData raIndices length');
+    cursor.skip(raIndexCount * 8, 'txData raIndices');
+}
+function normalizeOnchainPath(path) {
+    let normalized = path.startsWith('/') ? path.slice(1) : path;
+    if (normalized.endsWith('*') && normalized.length > 1) {
+        normalized = normalized.slice(0, -1);
+    }
+    if (normalized.endsWith('/')) {
+        normalized = normalized.slice(0, -1);
+    }
+    return normalized;
+}
+function parseBoundedSetDocumentsInstruction(data, label) {
+    if (data.length < 8) {
+        throw new Error(`${label} has malformed Bounded instruction data`);
+    }
+    const discriminator = discriminatorKey(data);
+    if (!ALLOWED_BOUNDED_SET_DISCRIMINATORS.has(discriminator)) {
+        throw new Error(`${label} contains unsupported Bounded instruction`);
+    }
+    const isV2 = discriminator === SET_DOCUMENTS_V2_DISCRIMINATOR;
+    const cursor = new BorshCursor(data, 8, label);
+    const appId = cursor.readString('appId');
+    const documentPaths = [];
+    const documentCount = cursor.readU32('documents length');
+    for (let i = 0; i < documentCount; i++) {
+        documentPaths.push(normalizeOnchainPath(cursor.readString('document path')));
+        const operationCount = cursor.readU32('operations length');
+        for (let j = 0; j < operationCount; j++) {
+            skipBoundedFieldOperation(cursor);
+        }
+    }
+    const deletePaths = [];
+    const deleteCount = cursor.readU32('delete paths length');
+    for (let i = 0; i < deleteCount; i++) {
+        deletePaths.push(normalizeOnchainPath(cursor.readString('delete path')));
+    }
+    const txDataCount = cursor.readU32('txData length');
+    for (let i = 0; i < txDataCount; i++) {
+        skipBoundedTxData(cursor, isV2);
+    }
+    const simulate = cursor.readU8('simulate');
+    if (simulate !== 0 && simulate !== 1) {
+        throw new Error(`${label} has malformed Bounded simulate flag`);
+    }
+    if (!cursor.isAtEnd()) {
+        throw new Error(`${label} has trailing Bounded instruction data`);
+    }
+    return { appId, documentPaths, deletePaths };
+}
+function assertSamePathSet(label, expectedPaths, actualPaths) {
+    const expected = new Set(expectedPaths.map(normalizeOnchainPath).filter(Boolean));
+    const actual = new Set(actualPaths.map(normalizeOnchainPath).filter(Boolean));
+    const missing = [...expected].filter(path => !actual.has(path));
+    const extra = [...actual].filter(path => !expected.has(path));
+    if (missing.length > 0 || extra.length > 0) {
+        const details = [
+            missing.length ? `missing paths: ${missing.join(', ')}` : '',
+            extra.length ? `unexpected paths: ${extra.join(', ')}` : '',
+        ].filter(Boolean).join('; ');
+        throw new Error(`${label} Bounded instruction paths do not match requested write paths (${details})`);
+    }
+}
+function validateServerSuppliedVersionedTransaction(transaction, options) {
+    var _a;
+    const { label, expectedAppId, expectedWritePaths } = options;
+    const accountKeys = transaction.message.staticAccountKeys;
+    let boundedInstructionCount = 0;
+    const actualWritePaths = [];
+    for (const ix of transaction.message.compiledInstructions) {
+        if (ix.programIdIndex >= accountKeys.length) {
+            throw new Error(`${label} has program ID in lookup table (not allowed)`);
+        }
+        const programId = accountKeys[ix.programIdIndex].toBase58();
+        if (!ALLOWED_SERVER_TX_PROGRAMS.has(programId)) {
+            throw new Error(`${label} contains unauthorized program: ${programId}`);
+        }
+        const data = ix.data instanceof Uint8Array ? ix.data : bufferExports.Buffer.from((_a = ix.data) !== null && _a !== void 0 ? _a : []);
+        if (programId === SYSTEM_PROGRAM_ID) {
+            throw new Error(`${label} contains unauthorized System Program instruction`);
+        }
+        if (programId === BOUNDED_PROGRAM_MAINNET || programId === BOUNDED_PROGRAM_DEVNET) {
+            boundedInstructionCount += 1;
+            const parsed = parseBoundedSetDocumentsInstruction(data, label);
+            if (parsed.appId !== expectedAppId) {
+                throw new Error(`${label} Bounded instruction appId does not match configured appId`);
+            }
+            actualWritePaths.push(...parsed.documentPaths, ...parsed.deletePaths);
+        }
+    }
+    if (boundedInstructionCount !== 1) {
+        throw new Error(`${label} must contain exactly one Bounded set-documents instruction`);
+    }
+    assertSamePathSet(label, expectedWritePaths, actualWritePaths);
+}
+function deserializeAndValidateServerTransaction(serializedTransaction, options) {
+    const txBytes = bufferExports.Buffer.from(serializedTransaction, 'base64');
+    const transaction = web3_js.VersionedTransaction.deserialize(txBytes);
+    validateServerSuppliedVersionedTransaction(transaction, options);
+    return transaction;
+}
+function assertAllowedServerPreInstruction(ix, label) {
+    if (ix.programId.equals(web3_js.SystemProgram.programId)) {
+        throw new Error(`${label} contains unauthorized System Program preInstruction`);
+    }
+}
 function classifyGetManyBatchError(error) {
     var _a, _b, _c;
     const err = error;
@@ -4814,13 +4791,14 @@ async function getMany(paths, opts = {}) {
     // H1: principal-scope getMany cache keys so one user's batch reads are never
     // served to another. Same `<appId:principal>|<path>:` shape used by get().
     const principalKey = await getReadPrincipalKey(opts._overrides);
+    const cacheEnabled = opts.cache === true && !opts.bypassCache && principalKey.cacheable;
     const results = new Array(paths.length);
     const uncachedIndices = [];
     const uncachedPaths = [];
     for (let i = 0; i < normalizedPaths.length; i++) {
         const normalizedPath = normalizedPaths[i];
-        const cacheKey = `${principalKey}|${normalizedPath}:`;
-        if (!opts.bypassCache && getCache[cacheKey] && now < getCache[cacheKey].expiresAt) {
+        const cacheKey = `${principalKey.key}|${normalizedPath}:`;
+        if (cacheEnabled && getCache[cacheKey] && now < getCache[cacheKey].expiresAt) {
             results[i] = { path: normalizedPath, data: getCache[cacheKey].data };
         }
         else {
@@ -4856,8 +4834,8 @@ async function getMany(paths, opts = {}) {
                         ? serverResult
                         : Object.assign(Object.assign({}, serverResult), { data: withBareId(serverResult.data) });
                     results[originalIndex] = normalizedResult;
-                    if (!normalizedResult.error && !opts.bypassCache) {
-                        const cacheKey = `${principalKey}|${normalizedPath}:`;
+                    if (!normalizedResult.error && cacheEnabled) {
+                        const cacheKey = `${principalKey.key}|${normalizedPath}:`;
                         getCache[cacheKey] = {
                             data: normalizedResult.data,
                             expiresAt: now + GET_CACHE_TTL
@@ -4872,7 +4850,7 @@ async function getMany(paths, opts = {}) {
                     };
                 }
             }
-            if (now - lastCacheCleanup > 5000) {
+            if (cacheEnabled && now - lastCacheCleanup > 5000) {
                 cleanupExpiredCache();
                 lastCacheCleanup = now;
             }
@@ -5023,11 +5001,12 @@ async function setMany(many, options) {
             }
             const curTx = transactions[0];
             let transactionResult;
+            const expectedWritePaths = documents.map(d => d.destinationPath);
             if (curTx.serializedTransaction) {
-                transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options);
+                transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             else {
-                transactionResult = await handleSolanaTransaction(curTx, authProvider, options);
+                transactionResult = await handleSolanaTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             // Sync items after all transactions are confirmed
             // Wait for 1.5 seconds to ensure all transactions are confirmed
@@ -5061,7 +5040,7 @@ async function setMany(many, options) {
     catch (error) {
         throw error;
     }
-    async function handleSolanaTransaction(tx, authProvider, options) {
+    async function handleSolanaTransaction(tx, authProvider, options, expectedWritePaths) {
         var _a, _b, _c, _d, _e;
         // NOTE (backwards-compat revert): a program-allowlist on server-supplied
         // `preInstructions` was tried here for the audit-8 SOL-drain concern, but it
@@ -5109,13 +5088,20 @@ async function setMany(many, options) {
             }))) !== null && _b !== void 0 ? _b : [],
         };
         const config = await getConfig();
+        if (tx.signedTransaction) {
+            deserializeAndValidateServerTransaction(tx.signedTransaction, {
+                label: 'Server signedTransaction',
+                expectedAppId: config.appId,
+                expectedWritePaths,
+            });
+        }
         const solTransaction = {
             appId: config.appId,
             txArgs: [solTransactionData],
             lutKey: (_c = tx.lutAddress) !== null && _c !== void 0 ? _c : null,
             additionalLutAddresses: tx.additionalLutAddresses,
             network: tx.network,
-            preInstructions: (_e = (_d = tx.preInstructions) === null || _d === void 0 ? void 0 : _d.map((ix) => {
+            preInstructions: (_e = (_d = tx.preInstructions) === null || _d === void 0 ? void 0 : _d.map((ix, index) => {
                 var _a;
                 const keys = (_a = ix.keys) === null || _a === void 0 ? void 0 : _a.map((k) => ({
                     pubkey: new web3_js.PublicKey(k.pubkey),
@@ -5126,11 +5112,13 @@ async function setMany(many, options) {
                     ? web3_js.SystemProgram.programId // prettier to use the constant
                     : new web3_js.PublicKey(ix.programId);
                 const data = bufferExports.Buffer.from(ix.data);
-                return new web3_js.TransactionInstruction({
+                const instruction = new web3_js.TransactionInstruction({
                     keys,
                     programId,
                     data,
                 });
+                assertAllowedServerPreInstruction(instruction, `Server preInstruction[${index}]`);
+                return instruction;
             })) !== null && _e !== void 0 ? _e : [],
             // Server co-signed transaction (when CPI tx_data is present)
             signedTransaction: tx.signedTransaction,
@@ -5138,45 +5126,22 @@ async function setMany(many, options) {
         const transactionResult = await authProvider.runTransaction(undefined, solTransaction, options);
         return transactionResult;
     }
-    async function handlePreBuiltTransaction(tx, authProvider, options) {
-        var _a, _b;
+    async function handlePreBuiltTransaction(tx, authProvider, options, expectedWritePaths) {
+        var _a, _b, _c;
         const config = await getConfig();
-        const rpcUrl = config.rpcUrl || (tx.network === 'solana_devnet'
-            ? 'https://api.devnet.solana.com'
-            : 'https://api.mainnet-beta.solana.com');
-        const connection = new web3_js.Connection(rpcUrl, 'confirmed');
-        const txBytes = bufferExports.Buffer.from(tx.serializedTransaction, 'base64');
-        const transaction = web3_js.VersionedTransaction.deserialize(txBytes);
-        // Validate the transaction before signing: ensure only allowed programs
-        // and no unauthorized System program instructions (e.g., SOL transfers)
-        const BOUNDED_PROGRAM = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
-        const COMPUTE_BUDGET = 'ComputeBudget111111111111111111111111111111';
-        const SYSTEM_PROGRAM = '11111111111111111111111111111111';
-        const ALLOWED_PROGRAMS = new Set([BOUNDED_PROGRAM, COMPUTE_BUDGET, SYSTEM_PROGRAM]);
-        // System program instruction discriminators (first 4 bytes, little-endian u32)
-        const SYSTEM_TRANSFER = 2; // Transfer instruction index
-        const SYSTEM_TRANSFER_WITH_SEED = 11;
-        const accountKeys = transaction.message.staticAccountKeys;
-        for (const ix of transaction.message.compiledInstructions) {
-            if (ix.programIdIndex >= accountKeys.length) {
-                throw new Error('Pre-built transaction has program ID in lookup table (not allowed)');
-            }
-            const programId = accountKeys[ix.programIdIndex].toBase58();
-            if (!ALLOWED_PROGRAMS.has(programId)) {
-                throw new Error(`Pre-built transaction contains unauthorized program: ${programId}`);
-            }
-            // Block System program transfer instructions — a compromised DO could
-            // embed a SOL drain. Only allow createAccount/allocate (needed for PDA init).
-            if (programId === SYSTEM_PROGRAM && ix.data.length >= 4) {
-                const ixIndex = ix.data[0] | (ix.data[1] << 8) | (ix.data[2] << 16) | (ix.data[3] << 24);
-                if (ixIndex === SYSTEM_TRANSFER || ixIndex === SYSTEM_TRANSFER_WITH_SEED) {
-                    throw new Error('Pre-built transaction contains unauthorized System transfer instruction');
-                }
-            }
+        const transaction = deserializeAndValidateServerTransaction(tx.serializedTransaction, {
+            label: 'Pre-built transaction',
+            expectedAppId: config.appId,
+            expectedWritePaths,
+        });
+        const shouldSubmit = (options === null || options === void 0 ? void 0 : options.shouldSubmitTx) !== false;
+        const rpcUrl = (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+        if (shouldSubmit && !rpcUrl) {
+            throw new Error(`Pre-built Solana transaction submission requires init({ rpcUrl }) for ${tx.network}`);
         }
         const signedTx = await authProvider.signTransaction(transaction);
         const rawTx = signedTx.serialize();
-        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+        if (!shouldSubmit) {
             return {
                 transactionSignature: '',
                 signedTransaction: bufferExports.Buffer.from(rawTx).toString('base64'),
@@ -5184,6 +5149,7 @@ async function setMany(many, options) {
                 gasUsed: '0',
             };
         }
+        const connection = new web3_js.Connection(rpcUrl, 'confirmed');
         const signature = await connection.sendRawTransaction(rawTx, {
             skipPreflight: false,
             maxRetries: 3,
@@ -5196,7 +5162,7 @@ async function setMany(many, options) {
         return {
             transactionSignature: signature,
             signedTransaction: bufferExports.Buffer.from(rawTx).toString('base64'),
-            blockNumber: (_b = (_a = confirmation.context) === null || _a === void 0 ? void 0 : _a.slot) !== null && _b !== void 0 ? _b : 0,
+            blockNumber: (_c = (_b = confirmation.context) === null || _b === void 0 ? void 0 : _b.slot) !== null && _c !== void 0 ? _c : 0,
             gasUsed: '0',
         };
     }
@@ -5413,7 +5379,7 @@ const MIN_RECONNECT_DELAY_JITTER_MS = 1000;
 const MAX_RECONNECT_DELAY_MS = 300000;
 const RECONNECT_DELAY_GROW_FACTOR = 1.8;
 const MIN_BROWSER_RECONNECT_INTERVAL_MS = 5000;
-const MAX_AUTH_REFRESH_RETRIES = 5;
+const WS_AUTH_EXPIRED_CODE = 'auth_expired';
 const WS_CONFIG = {
     // Keep retrying indefinitely so long outages recover without page refresh.
     maxRetries: Infinity,
@@ -5430,11 +5396,12 @@ const WS_V2_PATH = '/ws/v2';
 let browserReconnectHooksAttached = false;
 let lastBrowserTriggeredReconnectAt = 0;
 let reconnectInProgress = null;
+let ambientAuthFailure = null;
 // ============ Helper Functions ============
 function generateSubscriptionId() {
     return `sub_${Date.now()}_${Math.random().toString(36).substring(2, 11)}`;
 }
-function hashForKey$1(value) {
+function hashForKey(value) {
     let h = 5381;
     for (let i = 0; i < value.length; i++) {
         h = ((h << 5) + h + value.charCodeAt(i)) & 0x7fffffff;
@@ -5446,17 +5413,17 @@ function hashForKey$1(value) {
  * just the path/filter/shape. The `identity` prefix (`<appId>:<principal>`) keeps
  * a private subscription snapshot cached for one user from being delivered to a
  * different user who subscribes with the same options (shared process / SSR worker
- * / browser login-switch; this cache has a 5-minute TTL). When omitted (legacy
- * read-only helpers) we fall back to an `anon` scope.
+ * / browser login-switch; this cache has a 5-minute TTL). Callers must opt in
+ * before entries are read or written; no-auth subscriptions never populate an
+ * implicit anonymous cache bucket.
  */
 function getCacheKey(path, prompt, shape, limit, cursor, filter, identity) {
     const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
     const shapeKey = shape && Object.keys(shape).length > 0 ? JSON.stringify(shape) : '';
     const limitKey = limit !== undefined ? `:l${limit}` : '';
-    const cursorKey = cursor ? `:c${hashForKey$1(cursor)}` : '';
-    const filterKey = filter && Object.keys(filter).length > 0 ? `:f${hashForKey$1(JSON.stringify(filter))}` : '';
-    const identityKey = identity || 'anon';
-    return `${identityKey}|${normalizedPath}:${prompt || 'default'}:${shapeKey}${limitKey}${cursorKey}${filterKey}`;
+    const cursorKey = cursor ? `:c${hashForKey(cursor)}` : '';
+    const filterKey = filter && Object.keys(filter).length > 0 ? `:f${hashForKey(JSON.stringify(filter))}` : '';
+    return `${identity}|${normalizedPath}:${prompt || 'default'}:${shapeKey}${limitKey}${cursorKey}${filterKey}`;
 }
 /**
  * Derive an opaque identity string for the bearer material a subscription sends.
@@ -5464,7 +5431,7 @@ function getCacheKey(path, prompt, shape, limit, cursor, filter, identity) {
  * before the server has verified any claims.
  */
 function principalFromIdToken(idToken) {
-    return idToken ? `t${hashForKey$1(idToken)}` : 'anon';
+    return idToken ? `t${hashForKey(idToken)}` : null;
 }
 async function getSubscriptionIdentity(effectiveAppId, isServer, overrides) {
     // Per-subscription wallet override (server WalletClient.subscribe): key by
@@ -5473,16 +5440,21 @@ async function getSubscriptionIdentity(effectiveAppId, isServer, overrides) {
     if (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders) {
         try {
             const bearer = bearerFromAuthHeaders(await overrides._getAuthHeaders());
-            return `${effectiveAppId}:o${bearer ? principalFromIdToken(bearer) : 'anon'}`;
+            const principal = principalFromIdToken(bearer);
+            return principal
+                ? { key: `${effectiveAppId}:o${principal}`, cacheable: true }
+                : { key: `${effectiveAppId}:oanon`, cacheable: false };
         }
         catch (_a) {
-            // Couldn't resolve the override identity — use a unique key so we never
-            // collide with another principal's cached entry.
-            return `${effectiveAppId}:o${principalFromIdToken(null)}-${safeBtoa(String(connectionEpoch++))}`;
+            // Couldn't resolve the override identity — do not use response cache.
+            return { key: `${effectiveAppId}:o-uncacheable-${safeBtoa(String(connectionEpoch++))}`, cacheable: false };
         }
     }
     const idToken = await getIdToken(isServer);
-    return `${effectiveAppId}:${principalFromIdToken(idToken)}`;
+    const principal = principalFromIdToken(idToken);
+    return principal
+        ? { key: `${effectiveAppId}:${principal}`, cacheable: true }
+        : { key: `${effectiveAppId}:anon`, cacheable: false };
 }
 /** Extract the bare bearer token from a `{ Authorization: 'Bearer <jwt>' }` map. */
 function bearerFromAuthHeaders(headers) {
@@ -5512,6 +5484,41 @@ function getTokenExpirationTime(token) {
         return null;
     }
 }
+function makeAuthExpiredError(message, status) {
+    const err = new Error(`${WS_AUTH_EXPIRED_CODE}: ${message}`);
+    err.code = WS_AUTH_EXPIRED_CODE;
+    if (status !== undefined)
+        err.status = status;
+    return err;
+}
+function isAuthExpiredError(error) {
+    return !!error && typeof error === 'object' && error.code === WS_AUTH_EXPIRED_CODE;
+}
+function normalizeAuthExpiredError(error, fallbackMessage) {
+    var _a, _b;
+    if (isAuthExpiredError(error))
+        return error;
+    const status = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code;
+    return makeAuthExpiredError(fallbackMessage, status);
+}
+function rememberAmbientAuthFailure(error) {
+    ambientAuthFailure = error;
+    return error;
+}
+function failConnectionAuth(connection, error) {
+    connection.authFailure = error;
+    connection.pendingAuthToken = null;
+    connection.isConnecting = false;
+    connection.isConnected = false;
+    connection.isAuthenticating = false;
+    for (const [, pending] of connection.pendingSubscriptions) {
+        pending.reject(error);
+    }
+    connection.pendingSubscriptions.clear();
+    for (const subscription of connection.subscriptions.values()) {
+        notifyErrorCallbacks(subscription, error);
+    }
+}
 function scheduleTokenRefresh(connection, isServer) {
     // Clear any existing timer
     if (connection.tokenRefreshTimer) {
@@ -5579,23 +5586,32 @@ async function getFreshAuthToken(isServer) {
     var _a, _b, _c, _d, _e;
     const currentToken = await getIdToken(isServer);
     if (!currentToken) {
+        if (ambientAuthFailure) {
+            throw ambientAuthFailure;
+        }
         return null;
     }
     if (!isTokenExpired(currentToken)) {
+        ambientAuthFailure = null;
         return currentToken;
     }
+    if (ambientAuthFailure) {
+        throw ambientAuthFailure;
+    }
     // Token is expired — attempt refresh
+    const refreshToken = await getRefreshToken(isServer);
+    if (!refreshToken) {
+        console.warn('[WS v2] Token expired but no refresh token available');
+        throw rememberAmbientAuthFailure(makeAuthExpiredError('Authentication expired and no refresh token is available'));
+    }
     try {
-        const refreshToken = await getRefreshToken(isServer);
-        if (!refreshToken) {
-            console.warn('[WS v2] Token expired but no refresh token available');
-            return null;
-        }
         const refreshData = await refreshSession(refreshToken, getSessionIssuer(isServer));
         if (refreshData && refreshData.idToken && refreshData.accessToken) {
             await updateIdTokenAndAccessToken(refreshData.idToken, refreshData.accessToken, isServer, refreshData.refreshToken);
+            ambientAuthFailure = null;
             return refreshData.idToken;
         }
+        throw makeAuthExpiredError('Authentication refresh returned an incomplete session');
     }
     catch (error) {
         // Log only the status — the raw axios error carries config.data (the refresh
@@ -5612,12 +5628,22 @@ async function getFreshAuthToken(isServer) {
                 console.warn('[WS v2] Failed to clear stale session:', clearError);
             }
         }
+        throw rememberAmbientAuthFailure(normalizeAuthExpiredError(error, 'Authentication expired and refresh failed'));
+    }
+}
+async function getConnectionAuthToken(isServer, authTokenProvider) {
+    if (!authTokenProvider) {
+        return getFreshAuthToken(isServer);
+    }
+    try {
+        const token = await authTokenProvider();
+        if (token)
+            return token;
+        throw makeAuthExpiredError('Authenticated websocket token provider returned no token');
+    }
+    catch (error) {
+        throw normalizeAuthExpiredError(error, 'Authenticated websocket token provider failed');
     }
-    // Return null instead of the expired token to prevent infinite 401 reconnect storms.
-    // The server accepts unauthenticated connections; auth-required subscriptions will
-    // receive per-subscription errors via onError callbacks.
-    console.warn('[WS v2] Token refresh failed, connecting without auth to prevent reconnect storm');
-    return null;
 }
 function hasDisconnectedActiveConnections() {
     for (const connection of connections.values()) {
@@ -5692,13 +5718,26 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
     const roomKey = roomKeyFromRoutePath(routePath);
     // A wallet-scoped subscription (server WalletClient) gets its OWN connection
     // keyed by the wallet identity, so its WS authenticates as that wallet and
-    // never shares a connection (or token) with the ambient env identity.
+    // never shares a connection (or token) with any top-level server caller.
     const base = roomKey ? `${appId}#room#${roomKey}` : appId;
     const connKey = principalKey ? `${base}#id#${principalKey}` : base;
     let connection = connections.get(connKey);
     if (connection && connection.ws) {
+        if (connection.authFailure) {
+            throw connection.authFailure;
+        }
+        try {
+            await getConnectionAuthToken(isServer, authTokenProvider);
+        }
+        catch (error) {
+            const authError = normalizeAuthExpiredError(error, 'Authentication expired and refresh failed');
+            failConnectionAuth(connection, authError);
+            throw authError;
+        }
+        connection.authFailure = null;
         return connection;
     }
+    let initialAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
     // Create new connection
     connection = {
         ws: null,
@@ -5716,6 +5755,7 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         pendingAuthToken: null,
         tokenRefreshTimer: null,
         consecutiveAuthFailures: 0,
+        authFailure: null,
     };
     connections.set(connKey, connection);
     // URL provider for reconnection with fresh tokens
@@ -5735,29 +5775,25 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         }
         // Resolve auth token if available. A wallet-scoped connection resolves
         // its token from the wallet's own session (self-refreshing); all others
-        // use the ambient env/web session. The token is sent as the first WS
+        // use the browser session or fail closed for top-level server calls. The token is sent as the first WS
         // frame after open, never as a URL query parameter.
-        const authToken = connection.authTokenProvider
-            ? await connection.authTokenProvider().catch(() => null)
-            : await getFreshAuthToken(isServer);
+        let authToken;
+        try {
+            authToken = initialAuthToken !== undefined
+                ? initialAuthToken
+                : await getConnectionAuthToken(isServer, connection.authTokenProvider);
+            initialAuthToken = undefined;
+        }
+        catch (error) {
+            const authError = normalizeAuthExpiredError(error, 'Authentication expired and refresh failed');
+            failConnectionAuth(connection, authError);
+            throw authError;
+        }
         connection.pendingAuthToken = authToken || null;
         if (authToken) {
             // Successful token acquisition — reset failure counter
             connection.consecutiveAuthFailures = 0;
-        }
-        else {
-            // Check if user WAS authenticated (had a token that expired).
-            // If so, retry with exponential backoff before falling back to unauthenticated.
-            const expiredToken = await getIdToken(isServer);
-            if (expiredToken && isTokenExpired(expiredToken)) {
-                connection.consecutiveAuthFailures++;
-                if (connection.consecutiveAuthFailures <= MAX_AUTH_REFRESH_RETRIES) {
-                    console.warn(`[WS v2] Auth refresh failed (attempt ${connection.consecutiveAuthFailures}/${MAX_AUTH_REFRESH_RETRIES}), retrying with backoff`);
-                    throw new Error('Auth token refresh failed, retrying with backoff');
-                }
-                console.warn('[WS v2] Auth refresh retries exhausted, falling back to unauthenticated connection');
-            }
-            // No token at all (never authenticated) or retries exhausted — connect without auth
+            connection.authFailure = null;
         }
         return wsUrl.toString();
     };
@@ -5771,15 +5807,7 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         connection.isConnecting = false;
         connection.isConnected = true;
         // NOTE: Do NOT reset consecutiveAuthFailures here. It is reset when a
-        // fresh auth token is actually obtained (in urlProvider, line ~389) or on
-        // an explicit auth change (reconnectWithNewAuthV2, line ~854). Resetting
-        // on every 'open' event created an infinite loop: auth fails 5x → connect
-        // without auth → open resets counter → disconnect → auth fails 5x again →
-        // repeat forever, hammering /session/refresh and causing 429s.
-        //
-        // An elevated counter is safe for anonymous/guest sessions: when there's no
-        // token at all (getIdToken returns null), the counter is never checked —
-        // urlProvider skips straight to unauthenticated connection.
+        // fresh auth token is actually obtained or on an explicit auth change.
         // Schedule periodic token freshness checks
         scheduleTokenRefresh(connection, isServer);
         if (connection.pendingAuthToken) {
@@ -5854,8 +5882,10 @@ function handleServerMessage(connection, message) {
                 // If we already received data for this subscription, treat subscribed
                 // as an ack only and avoid regressing to an older snapshot.
                 if (subscription.lastData === undefined) {
-                    const cacheKey = getCacheKey(subscription.path, subscription.prompt, subscription.shape, subscription.limit, subscription.cursor, subscription.filter, subscription.identity);
-                    responseCache.set(cacheKey, { data: message.data, timestamp: Date.now() });
+                    if (subscription.cache) {
+                        const cacheKey = getCacheKey(subscription.path, subscription.prompt, subscription.shape, subscription.limit, subscription.cursor, subscription.filter, subscription.identity);
+                        responseCache.set(cacheKey, { data: message.data, timestamp: Date.now() });
+                    }
                     subscription.lastData = message.data;
                     notifyCallbacks(subscription, message.data);
                 }
@@ -5881,8 +5911,10 @@ function handleServerMessage(connection, message) {
             const subscription = connection.subscriptions.get(message.subscriptionId);
             if (subscription) {
                 // Update cache
-                const cacheKey = getCacheKey(subscription.path, subscription.prompt, subscription.shape, subscription.limit, subscription.cursor, subscription.filter, subscription.identity);
-                responseCache.set(cacheKey, { data: message.data, timestamp: Date.now() });
+                if (subscription.cache) {
+                    const cacheKey = getCacheKey(subscription.path, subscription.prompt, subscription.shape, subscription.limit, subscription.cursor, subscription.filter, subscription.identity);
+                    responseCache.set(cacheKey, { data: message.data, timestamp: Date.now() });
+                }
                 // Store last data
                 subscription.lastData = message.data;
                 // Notify callbacks
@@ -6094,26 +6126,43 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
     // subscribes with identical options (shared process / SSR / login-switch).
     // Per-subscription wallet override (server WalletClient.subscribe). When set,
     // the connection authenticates + caches under the wallet's identity instead of
-    // the ambient env keypair — so a `createWalletClient` caller can subscribe
-    // without setting BOUNDED_PRIVATE_KEY (and never crashes resolving it).
+    // any top-level server caller — so a `createWalletClient` caller can
+    // subscribe through its explicit wallet session.
     const overrides = subscriptionOptions._overrides;
     const authTokenProvider = (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders)
         ? async () => bearerFromAuthHeaders(await overrides._getAuthHeaders()) || null
         : undefined;
-    const identity = await getSubscriptionIdentity(effectiveAppId, config.isServer, overrides);
+    const identityInfo = await getSubscriptionIdentity(effectiveAppId, config.isServer, overrides);
+    const identity = identityInfo.key;
+    const responseCacheEnabled = subscriptionOptions.cache === true && identityInfo.cacheable;
     const principalKey = authTokenProvider ? identity : undefined;
-    const cacheKey = getCacheKey(normalizedPath, subscriptionOptions.prompt, subscriptionOptions.shape, subscriptionOptions.limit, subscriptionOptions.cursor, subscriptionOptions.filter, identity);
-    // Deliver cached data immediately if available
-    const cachedEntry = responseCache.get(cacheKey);
+    const cacheKey = responseCacheEnabled
+        ? getCacheKey(normalizedPath, subscriptionOptions.prompt, subscriptionOptions.shape, subscriptionOptions.limit, subscriptionOptions.cursor, subscriptionOptions.filter, identity)
+        : null;
+    // Get or create connection for this routing target (room-scoped when a
+    // room route is supplied by the live helper, else the app-level connection).
+    let connection;
+    try {
+        connection = await getOrCreateConnection(effectiveAppId, config.isServer, roomRoutePath, authTokenProvider, principalKey);
+    }
+    catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        if (subscriptionOptions.onError) {
+            subscriptionOptions.onError(err);
+            return async () => { };
+        }
+        throw err;
+    }
+    // Deliver cached data immediately if available, but only after connection
+    // auth preflight has succeeded. An expired authenticated session must receive
+    // an auth error, not a stale private snapshot followed by a failed connect.
+    const cachedEntry = cacheKey ? responseCache.get(cacheKey) : undefined;
     if (cachedEntry && Date.now() - cachedEntry.timestamp < CACHE_TTL && subscriptionOptions.onData) {
         setTimeout(() => {
             var _a;
             (_a = subscriptionOptions.onData) === null || _a === void 0 ? void 0 : _a.call(subscriptionOptions, addIdsToSubscriptionData(cachedEntry.data));
         }, 0);
     }
-    // Get or create connection for this routing target (room-scoped when a
-    // room route is supplied by the live helper, else the app-level connection).
-    const connection = await getOrCreateConnection(effectiveAppId, config.isServer, roomRoutePath, authTokenProvider, principalKey);
     // Check if we already have a subscription for this path+prompt+shape+limit+cursor+filter+sort
     const shapeKey = subscriptionOptions.shape ? JSON.stringify(subscriptionOptions.shape) : '';
     const filterKey = subscriptionOptions.filter ? JSON.stringify(subscriptionOptions.filter) : '';
@@ -6132,10 +6181,18 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
         }
     }
     if (existingSubscription) {
+        if (responseCacheEnabled) {
+            existingSubscription.cache = true;
+        }
         // Add callback to existing subscription
         existingSubscription.callbacks.push(subscriptionOptions);
-        // Deliver last known data immediately
-        if (existingSubscription.lastData !== undefined && subscriptionOptions.onData) {
+        // Deliver last known data immediately only for explicit, principal-bound
+        // cache opt-in. Otherwise joining an existing subscription can replay a
+        // stale private snapshot without a fresh server auth result.
+        if (responseCacheEnabled &&
+            existingSubscription.cache &&
+            existingSubscription.lastData !== undefined &&
+            subscriptionOptions.onData) {
             setTimeout(() => {
                 var _a;
                 (_a = subscriptionOptions.onData) === null || _a === void 0 ? void 0 : _a.call(subscriptionOptions, addIdsToSubscriptionData(existingSubscription.lastData));
@@ -6159,6 +6216,7 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
         includeSubPaths: (_b = subscriptionOptions.includeSubPaths) !== null && _b !== void 0 ? _b : false,
         callbacks: [subscriptionOptions],
         lastData: undefined,
+        cache: responseCacheEnabled,
         identity,
     };
     connection.subscriptions.set(subscriptionId, subscription);
@@ -6290,19 +6348,21 @@ function clearCacheV2(path) {
  */
 function getCachedDataV2(path, prompt) {
     const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-    // H1: response caches are identity-scoped (`<identity>|<path>:...`). Resolve
-    // the caller's identity from an active subscription for this path (sync) so
-    // an authenticated user gets THEIR cached snapshot rather than the 'anon'
-    // bucket (which would wrongly return null). No matching sub → null (safe).
+    // H1: response caches are identity-scoped (`<identity>|<path>:...`) and
+    // opt-in. Resolve the caller's identity from an active cache-enabled
+    // subscription for this path. No matching sub → null (safe).
     let identity;
     outer: for (const connection of connections.values()) {
         for (const sub of connection.subscriptions.values()) {
-            if (sub.path === normalizedPath && sub.prompt === prompt) {
+            if (sub.cache && sub.path === normalizedPath && sub.prompt === prompt) {
                 identity = sub.identity;
                 break outer;
             }
         }
     }
+    if (!identity) {
+        return null;
+    }
     const cacheKey = getCacheKey(path, prompt, undefined, undefined, undefined, undefined, identity);
     const cachedEntry = responseCache.get(cacheKey);
     if (cachedEntry && Date.now() - cachedEntry.timestamp < CACHE_TTL) {
@@ -6334,6 +6394,7 @@ async function reconnectWithNewAuthV2() {
     }
 }
 async function doReconnectWithNewAuth() {
+    ambientAuthFailure = null;
     // SECURITY (H1): the logged-in identity is changing (login / logout / switch).
     // Wipe ALL principal-scoped read caches so the new identity can never observe
     // data cached for the previous one. Clear both the WS response cache and the
@@ -6355,7 +6416,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return realtimeStore; });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-Ck_VgTcv.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -6375,6 +6436,7 @@ async function doReconnectWithNewAuth() {
         connection.pendingUnsubscriptions.clear();
         // Reset auth failure counter — this is a proactive reconnect (login, token refresh)
         connection.consecutiveAuthFailures = 0;
+        connection.authFailure = null;
         // Close the WebSocket (this triggers reconnection in ReconnectingWebSocket)
         // We use reconnect() which will close and re-open with fresh URL (including new token)
         try {
@@ -6385,7 +6447,7 @@ async function doReconnectWithNewAuth() {
         }
     }
 }
-// ============ CRUD over WebSocket ============
+// ============ WebSocket request helpers ============
 const WS_REQUEST_TIMEOUT_MS = 30000;
 function generateRequestId() {
     return `req_${Date.now()}_${Math.random().toString(36).substring(2, 11)}`;
@@ -6401,104 +6463,6 @@ function hasActiveConnection() {
     }
     return false;
 }
-async function waitForConnectionAuthenticated(connection) {
-    if (!connection.isAuthenticating || !connection.ws)
-        return;
-    const ws = connection.ws;
-    await new Promise((resolve, reject) => {
-        let timeout;
-        let cleanup = () => { };
-        const onMessage = (event) => {
-            try {
-                const message = JSON.parse(event.data);
-                if ((message === null || message === void 0 ? void 0 : message.type) === 'authenticated') {
-                    cleanup();
-                    resolve();
-                }
-            }
-            catch (_a) {
-                // Other frames are handled by the main listener.
-            }
-        };
-        const onClose = () => {
-            cleanup();
-            reject(new Error('WebSocket disconnected during authentication'));
-        };
-        const onError = () => {
-            cleanup();
-            reject(new Error('WebSocket authentication failed'));
-        };
-        cleanup = () => {
-            clearTimeout(timeout);
-            ws.removeEventListener('message', onMessage);
-            ws.removeEventListener('close', onClose);
-            ws.removeEventListener('error', onError);
-        };
-        timeout = setTimeout(() => {
-            cleanup();
-            reject(new Error('WebSocket authentication timeout'));
-        }, 10000);
-        if (!connection.isAuthenticating) {
-            cleanup();
-            resolve();
-            return;
-        }
-        ws.addEventListener('message', onMessage);
-        ws.addEventListener('close', onClose);
-        ws.addEventListener('error', onError);
-    });
-}
-async function sendRequest(msgBuilder) {
-    const config = await getConfig();
-    const appId = config.appId;
-    const connection = await getOrCreateConnection(appId, config.isServer);
-    // Wait for the connection to be open (getOrCreateConnection may return
-    // while still connecting).
-    if (!connection.isConnected && connection.ws) {
-        await new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                var _a;
-                (_a = connection.ws) === null || _a === void 0 ? void 0 : _a.removeEventListener('open', onOpen);
-                reject(new Error('WebSocket connection timeout'));
-            }, 10000);
-            const onOpen = () => { clearTimeout(timeout); resolve(); };
-            if (connection.isConnected) {
-                clearTimeout(timeout);
-                resolve();
-                return;
-            }
-            connection.ws.addEventListener('open', onOpen);
-        });
-    }
-    if (!connection.ws || !connection.isConnected) {
-        throw new Error('WebSocket connection not available');
-    }
-    await waitForConnectionAuthenticated(connection);
-    const requestId = generateRequestId();
-    const message = msgBuilder(requestId);
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            connection.pendingRequests.delete(requestId);
-            reject(new Error(`WebSocket request timed out after ${WS_REQUEST_TIMEOUT_MS}ms`));
-        }, WS_REQUEST_TIMEOUT_MS);
-        connection.pendingRequests.set(requestId, { resolve, reject, timer });
-        try {
-            connection.ws.send(JSON.stringify(message));
-        }
-        catch (error) {
-            connection.pendingRequests.delete(requestId);
-            clearTimeout(timer);
-            reject(error);
-        }
-    });
-}
-async function wsGet(path) {
-    return sendRequest((requestId) => ({
-        type: 'get',
-        requestId,
-        path,
-    }));
-}
 /**
  * Send a live-room intent over the EXISTING per-room socket (fire-and-forget).
  * Returns true if it was sent over an open connection, false if there is no
@@ -6557,31 +6521,6 @@ function wsIntentReliable(appId, roomRoutePath, intent) {
         }
     });
 }
-async function wsSet(documents) {
-    return sendRequest((requestId) => ({
-        type: 'set',
-        requestId,
-        documents,
-    }));
-}
-async function wsQuery(path, opts) {
-    return sendRequest((requestId) => (Object.assign(Object.assign(Object.assign(Object.assign({ type: 'query', requestId,
-        path }, ((opts === null || opts === void 0 ? void 0 : opts.filter) ? { filter: opts.filter } : {})), ((opts === null || opts === void 0 ? void 0 : opts.sort) ? { sort: opts.sort } : {})), ((opts === null || opts === void 0 ? void 0 : opts.limit) !== undefined ? { limit: opts.limit } : {})), ((opts === null || opts === void 0 ? void 0 : opts.includeSubPaths) ? { includeSubPaths: opts.includeSubPaths } : {}))));
-}
-async function wsDelete(path) {
-    return sendRequest((requestId) => ({
-        type: 'delete',
-        requestId,
-        path,
-    }));
-}
-async function wsGetMany(paths) {
-    return sendRequest((requestId) => ({
-        type: 'getMany',
-        requestId,
-        paths,
-    }));
-}
 
 /**
  * WebSocket Subscription Module
@@ -6762,1008 +6701,6 @@ function toMillis(seconds) {
     return seconds * 1000;
 }
 
-// ---------------------------------------------------------------------------
-// realtime-store.ts — Client-side state manager for realtime apps.
-//
-// Manages: WS connection, in-memory state, IDB persistence, optimistic
-// writes, delta accumulation, loading states, ephemeral/durable tiers.
-// ---------------------------------------------------------------------------
-// ---------------------------------------------------------------------------
-// IDB helpers (lazy-loaded, non-blocking)
-// ---------------------------------------------------------------------------
-const IDB_NAME = 'bounded-realtime';
-const IDB_STORE = 'subscriptions';
-const IDB_VERSION = 1;
-let idbPromise = null;
-function getIDB() {
-    if (idbPromise)
-        return idbPromise;
-    if (typeof indexedDB === 'undefined') {
-        return Promise.reject(new Error('IndexedDB not available'));
-    }
-    idbPromise = new Promise((resolve, reject) => {
-        const req = indexedDB.open(IDB_NAME, IDB_VERSION);
-        req.onupgradeneeded = () => {
-            const db = req.result;
-            if (!db.objectStoreNames.contains(IDB_STORE)) {
-                db.createObjectStore(IDB_STORE);
-            }
-        };
-        req.onsuccess = () => resolve(req.result);
-        req.onerror = () => reject(req.error);
-    });
-    return idbPromise;
-}
-async function idbGet(key) {
-    try {
-        const db = await getIDB();
-        return new Promise((resolve) => {
-            const tx = db.transaction(IDB_STORE, 'readonly');
-            const store = tx.objectStore(IDB_STORE);
-            const req = store.get(key);
-            req.onsuccess = () => { var _a; return resolve((_a = req.result) !== null && _a !== void 0 ? _a : null); };
-            req.onerror = () => resolve(null);
-        });
-    }
-    catch (_a) {
-        return null;
-    }
-}
-async function idbSet(key, value) {
-    try {
-        const db = await getIDB();
-        return new Promise((resolve) => {
-            const tx = db.transaction(IDB_STORE, 'readwrite');
-            const store = tx.objectStore(IDB_STORE);
-            store.put(value, key);
-            tx.oncomplete = () => resolve();
-            tx.onerror = () => resolve();
-        });
-    }
-    catch (_a) {
-        // Best-effort persistence
-    }
-}
-// ---------------------------------------------------------------------------
-// RealtimeStore
-// ---------------------------------------------------------------------------
-let nextRequestId = 1;
-function hashForKey(value) {
-    let h = 5381;
-    for (let i = 0; i < value.length; i++) {
-        h = ((h << 5) + h + value.charCodeAt(i)) & 0x7fffffff;
-    }
-    return h.toString(36);
-}
-function principalFromToken(token) {
-    return token ? `t${hashForKey(token)}` : 'anon';
-}
-class RealtimeStore {
-    constructor() {
-        this.ws = null;
-        this.wsUrl = '';
-        this.appId = '';
-        this.subscriptions = new Map();
-        this.pendingRequests = new Map();
-        this.connectPromise = null;
-        this.reconnectTimer = null;
-        this.reconnectDelay = 1000;
-        this.maxReconnectDelay = 30000;
-        this.idbFlushTimer = null;
-        this.idbDirtyKeys = new Set();
-        this.closed = false;
-        this.authToken = null;
-        this.authPrincipalKey = 'anon';
-        this.authenticating = false;
-        this.suppressNextReconnect = false;
-        this.isServer = false;
-        this.tokenRefreshTimer = null;
-        // -----------------------------------------------------------------------
-        // WebSocket connection
-        // -----------------------------------------------------------------------
-        this.initPromise = null;
-    }
-    // -----------------------------------------------------------------------
-    // Initialization
-    // -----------------------------------------------------------------------
-    async init() {
-        const config = await getConfig();
-        this.appId = config.appId;
-        this.wsUrl = config.wsApiUrl;
-        this.isServer = config.isServer;
-        await this.refreshToken();
-        this.startTokenRefresh();
-    }
-    async refreshToken() {
-        let token = null;
-        try {
-            const { getIdToken } = await Promise.resolve().then(function () { return utils; });
-            token = await getIdToken(this.isServer);
-        }
-        catch ( /* no auth available */_a) { /* no auth available */ }
-        this.authToken = token !== null && token !== void 0 ? token : null;
-        this.authPrincipalKey = principalFromToken(this.authToken);
-    }
-    startTokenRefresh() {
-        if (this.tokenRefreshTimer)
-            return;
-        this.tokenRefreshTimer = setInterval(async () => {
-            const prevPrincipal = this.authPrincipalKey;
-            await this.refreshToken();
-            if (this.authPrincipalKey !== prevPrincipal) {
-                await this.applyAuthPrincipalChange();
-                if (this.subscriptions.size > 0) {
-                    await this.ensureConnected().catch(() => {
-                        this.setAllSubscriptionStatus('error');
-                    });
-                }
-            }
-        }, 5 * 60 * 1000); // Check every 5 minutes
-    }
-    async ensureInitialized() {
-        if (this.appId)
-            return;
-        if (!this.initPromise)
-            this.initPromise = this.init();
-        await this.initPromise;
-    }
-    async ensureCurrentAuth() {
-        await this.ensureInitialized();
-        const prevPrincipal = this.authPrincipalKey;
-        await this.refreshToken();
-        if (this.authPrincipalKey !== prevPrincipal) {
-            await this.applyAuthPrincipalChange();
-        }
-    }
-    rekeySubscriptionsForPrincipal() {
-        const subs = Array.from(this.subscriptions.values());
-        this.subscriptions.clear();
-        for (const sub of subs) {
-            this.subscriptions.set(this.getSubKey(sub.path, sub.options), sub);
-        }
-    }
-    async applyAuthPrincipalChange() {
-        if (this.idbFlushTimer) {
-            clearTimeout(this.idbFlushTimer);
-            this.idbFlushTimer = null;
-        }
-        this.idbDirtyKeys.clear();
-        this.rekeySubscriptionsForPrincipal();
-        for (const sub of this.subscriptions.values()) {
-            sub.docs.clear();
-            sub.ref.current = sub.docs;
-            sub.error = null;
-            sub.isStale = false;
-            let loaded = false;
-            if (sub.tier !== 'ephemeral') {
-                const cached = await idbGet(this.idbKey(sub.path));
-                if (cached && Array.isArray(cached)) {
-                    for (const doc of cached) {
-                        if (doc && doc._id)
-                            sub.docs.set(doc._id, doc);
-                    }
-                    sub.ref.current = sub.docs;
-                    loaded = sub.docs.size > 0;
-                }
-            }
-            sub.status = loaded ? 'cached' : 'loading';
-            sub.isStale = loaded;
-            if (loaded)
-                this.notifySubscription(sub);
-            else
-                this.notifyState(sub);
-        }
-        if (this.ws) {
-            const ws = this.ws;
-            this.ws = null;
-            this.connectPromise = null;
-            this.suppressNextReconnect = true;
-            try {
-                ws.close(1000, 'Auth changed');
-            }
-            catch ( /* ignore */_a) { /* ignore */ }
-        }
-    }
-    async ensureConnected() {
-        var _a;
-        await this.ensureCurrentAuth();
-        if (((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN && !this.authenticating)
-            return;
-        if (this.connectPromise)
-            return this.connectPromise;
-        this.connectPromise = this.connect();
-        return this.connectPromise;
-    }
-    connect() {
-        return new Promise((resolve, reject) => {
-            if (this.closed) {
-                reject(new Error('Store closed'));
-                return;
-            }
-            const params = new URLSearchParams();
-            params.set('apiKey', this.appId);
-            const url = `${this.wsUrl}?${params.toString()}`;
-            const ws = new WebSocket(url);
-            this.ws = ws;
-            let authTimer = null;
-            const finishConnected = () => {
-                if (authTimer) {
-                    clearTimeout(authTimer);
-                    authTimer = null;
-                }
-                this.authenticating = false;
-                ws.removeEventListener('error', onError);
-                this.reconnectDelay = 1000;
-                this.connectPromise = null;
-                this.resubscribeAll();
-                resolve();
-            };
-            const onOpen = () => {
-                if (!this.authToken) {
-                    finishConnected();
-                    return;
-                }
-                this.authenticating = true;
-                authTimer = setTimeout(() => {
-                    this.authenticating = false;
-                    this.connectPromise = null;
-                    try {
-                        ws.close(1008, 'Authentication timeout');
-                    }
-                    catch ( /* ignore */_a) { /* ignore */ }
-                    reject(new Error('WebSocket authentication timeout'));
-                }, 10000);
-                try {
-                    ws.send(JSON.stringify({ type: 'auth', token: this.authToken }));
-                }
-                catch (e) {
-                    if (authTimer)
-                        clearTimeout(authTimer);
-                    this.authenticating = false;
-                    this.connectPromise = null;
-                    reject(e);
-                }
-            };
-            const onError = (e) => {
-                if (authTimer)
-                    clearTimeout(authTimer);
-                this.authenticating = false;
-                ws.removeEventListener('open', onOpen);
-                this.connectPromise = null;
-                reject(new Error('WebSocket connection failed'));
-            };
-            ws.addEventListener('open', onOpen, { once: true });
-            ws.addEventListener('error', onError, { once: true });
-            ws.addEventListener('message', (event) => {
-                if (this.authenticating) {
-                    try {
-                        const msg = JSON.parse(typeof event.data === 'string' ? event.data : new TextDecoder().decode(event.data));
-                        if ((msg === null || msg === void 0 ? void 0 : msg.type) === 'authenticated') {
-                            finishConnected();
-                            return;
-                        }
-                    }
-                    catch ( /* fall through to normal handling */_a) { /* fall through to normal handling */ }
-                }
-                this.handleMessage(event.data);
-            });
-            ws.addEventListener('close', () => {
-                if (authTimer)
-                    clearTimeout(authTimer);
-                if (this.ws !== ws) {
-                    if (this.suppressNextReconnect)
-                        this.suppressNextReconnect = false;
-                    return;
-                }
-                this.authenticating = false;
-                this.ws = null;
-                this.connectPromise = null;
-                this.rejectAllPending('WebSocket closed');
-                this.setAllSubscriptionStatus('reconnecting');
-                if (this.suppressNextReconnect) {
-                    this.suppressNextReconnect = false;
-                    return;
-                }
-                this.scheduleReconnect();
-            });
-        });
-    }
-    scheduleReconnect() {
-        if (this.closed)
-            return;
-        if (this.reconnectTimer)
-            clearTimeout(this.reconnectTimer);
-        this.reconnectTimer = setTimeout(() => {
-            this.ensureConnected().catch(() => {
-                this.reconnectDelay = Math.min(this.reconnectDelay * 2, this.maxReconnectDelay);
-                this.scheduleReconnect();
-            });
-        }, this.reconnectDelay);
-    }
-    resubscribeAll() {
-        for (const sub of this.subscriptions.values()) {
-            this.sendSubscribe(sub);
-        }
-    }
-    // -----------------------------------------------------------------------
-    // Message handling
-    // -----------------------------------------------------------------------
-    handleMessage(raw) {
-        const text = typeof raw === 'string' ? raw : new TextDecoder().decode(raw);
-        let msg;
-        try {
-            msg = JSON.parse(text);
-        }
-        catch (_a) {
-            return;
-        }
-        switch (msg.type) {
-            case 'snapshot':
-                this.handleSnapshot(msg);
-                break;
-            case 'delta':
-                this.handleDelta(msg);
-                break;
-            case 'result':
-                this.handleResult(msg);
-                break;
-            case 'error':
-                this.handleError(msg);
-                break;
-            case 'pong':
-                break;
-            case 'authenticated':
-                break;
-            // v1 compat: handle legacy message types during transition
-            case 'subscribed':
-                this.handleSnapshot(Object.assign(Object.assign({}, msg), { type: 'snapshot', docs: msg.data }));
-                break;
-            case 'data':
-                // Legacy full-snapshot delta — treat as snapshot replacement
-                this.handleLegacyData(msg);
-                break;
-            case 'response':
-                this.handleResult(Object.assign(Object.assign({}, msg), { type: 'result', ok: msg.status === 200, doc: msg.data }));
-                break;
-        }
-    }
-    handleSnapshot(msg) {
-        var _a, _b, _c;
-        const subId = (_a = msg.id) !== null && _a !== void 0 ? _a : msg.subscriptionId;
-        if (!subId)
-            return;
-        const sub = this.findSubscriptionById(subId);
-        if (!sub)
-            return;
-        const docs = (_c = (_b = msg.docs) !== null && _b !== void 0 ? _b : msg.data) !== null && _c !== void 0 ? _c : [];
-        const docsArray = Array.isArray(docs) ? docs : [docs];
-        sub.docs.clear();
-        for (const doc of docsArray) {
-            if (doc && doc._id) {
-                sub.docs.set(doc._id, doc);
-            }
-        }
-        sub.ref.current = sub.docs;
-        sub.status = 'live';
-        sub.isStale = false;
-        sub.error = null;
-        this.notifySubscription(sub);
-        this.markIdbDirty(sub.path);
-    }
-    handleDelta(msg) {
-        var _a, _b;
-        const subId = (_a = msg.id) !== null && _a !== void 0 ? _a : msg.subscriptionId;
-        if (!subId)
-            return;
-        const sub = this.findSubscriptionById(subId);
-        if (!sub)
-            return;
-        if (sub.tier === 'ephemeral') {
-            // Ephemeral: just overwrite, no accumulation logic
-            if (msg.change === 'removed' && msg.docId) {
-                sub.docs.delete(msg.docId);
-            }
-            else if (msg.doc && msg.doc._id) {
-                sub.docs.set(msg.doc._id, msg.doc);
-            }
-            sub.ref.current = sub.docs;
-            if (sub.options.mode !== 'ref') {
-                this.notifySubscription(sub);
-            }
-            return;
-        }
-        // Durable/checkpointed: full delta handling
-        switch (msg.change) {
-            case 'added':
-            case 'modified':
-                if (msg.doc && msg.doc._id) {
-                    sub.docs.set(msg.doc._id, msg.doc);
-                }
-                break;
-            case 'removed':
-                if (msg.docId) {
-                    sub.docs.delete(msg.docId);
-                }
-                else if ((_b = msg.doc) === null || _b === void 0 ? void 0 : _b._id) {
-                    sub.docs.delete(msg.doc._id);
-                }
-                break;
-        }
-        sub.ref.current = sub.docs;
-        this.notifySubscription(sub);
-        this.markIdbDirty(sub.path);
-    }
-    handleLegacyData(msg) {
-        // Legacy v1 format: 'data' message with full snapshot or single doc
-        const subId = msg.subscriptionId;
-        if (!subId)
-            return;
-        const sub = this.findSubscriptionById(subId);
-        if (!sub)
-            return;
-        if (Array.isArray(msg.data)) {
-            // Full snapshot replacement
-            sub.docs.clear();
-            for (const doc of msg.data) {
-                if (doc && doc._id)
-                    sub.docs.set(doc._id, doc);
-            }
-        }
-        else if (msg.data && msg.data._id) {
-            // Single doc update
-            sub.docs.set(msg.data._id, msg.data);
-        }
-        else if (msg.data === null) ;
-        sub.ref.current = sub.docs;
-        sub.status = 'live';
-        sub.isStale = false;
-        this.notifySubscription(sub);
-        this.markIdbDirty(sub.path);
-    }
-    handleResult(msg) {
-        var _a, _b, _c, _d;
-        const requestId = msg.requestId;
-        if (!requestId)
-            return;
-        const pending = this.pendingRequests.get(requestId);
-        if (!pending)
-            return;
-        this.pendingRequests.delete(requestId);
-        clearTimeout(pending.timeout);
-        const ok = (_a = msg.ok) !== null && _a !== void 0 ? _a : (msg.status === 200);
-        if (ok) {
-            pending.resolve((_c = (_b = msg.doc) !== null && _b !== void 0 ? _b : msg.data) !== null && _c !== void 0 ? _c : true);
-        }
-        else {
-            pending.reject(new Error((_d = msg.error) !== null && _d !== void 0 ? _d : 'Operation failed'));
-        }
-    }
-    handleError(msg) {
-        var _a, _b, _c;
-        const error = new Error((_a = msg.message) !== null && _a !== void 0 ? _a : (msg.code ? `${msg.code}: Server error` : 'Server error'));
-        if (msg.code)
-            error.code = msg.code;
-        if (msg.subscriptionId || msg.id)
-            error.subscriptionId = (_b = msg.subscriptionId) !== null && _b !== void 0 ? _b : msg.id;
-        const requestId = msg.requestId;
-        if (requestId) {
-            const pending = this.pendingRequests.get(requestId);
-            if (pending) {
-                this.pendingRequests.delete(requestId);
-                clearTimeout(pending.timeout);
-                pending.reject(error);
-            }
-        }
-        const subId = (_c = msg.subscriptionId) !== null && _c !== void 0 ? _c : msg.id;
-        if (subId) {
-            const sub = this.findSubscriptionById(subId);
-            if (sub) {
-                sub.status = 'error';
-                sub.error = error;
-                this.notifyState(sub);
-                for (const callback of Array.from(sub.errorCallbacks)) {
-                    try {
-                        callback(error);
-                    }
-                    catch ( /* swallow */_d) { /* swallow */ }
-                }
-            }
-        }
-    }
-    // -----------------------------------------------------------------------
-    // Subscribe
-    // -----------------------------------------------------------------------
-    async subscribe(path, opts = {}) {
-        var _a;
-        await this.ensureCurrentAuth();
-        const tier = (_a = opts.tier) !== null && _a !== void 0 ? _a : 'durable';
-        const subKey = this.getSubKey(path, opts);
-        let sub = this.subscriptions.get(subKey);
-        if (sub) {
-            // Existing subscription — add callback
-            if (opts.onData)
-                sub.callbacks.add(opts.onData);
-            if (opts.onState)
-                sub.stateCallbacks.add(opts.onState);
-            if (opts.onError)
-                sub.errorCallbacks.add(opts.onError);
-            // Immediately deliver current state
-            if (opts.onData && sub.docs.size > 0) {
-                opts.onData(this.docsToArray(sub));
-            }
-            if (opts.onState) {
-                opts.onState(this.getState(sub));
-            }
-            return this.createUnsubscribe(subKey, sub.id, opts.onData, opts.onState, opts.onError);
-        }
-        // New subscription
-        const subId = `sub_${nextRequestId++}`;
-        sub = {
-            id: subId,
-            path,
-            tier,
-            options: opts,
-            docs: new Map(),
-            status: 'idle',
-            isStale: false,
-            error: null,
-            callbacks: new Set(opts.onData ? [opts.onData] : []),
-            stateCallbacks: new Set(opts.onState ? [opts.onState] : []),
-            errorCallbacks: new Set(opts.onError ? [opts.onError] : []),
-            ref: { current: new Map() },
-        };
-        this.subscriptions.set(subKey, sub);
-        // Step 1: Load from IDB (durable/checkpointed only)
-        if (tier !== 'ephemeral') {
-            const cached = await idbGet(this.idbKey(path));
-            if (cached && Array.isArray(cached)) {
-                for (const doc of cached) {
-                    if (doc && doc._id)
-                        sub.docs.set(doc._id, doc);
-                }
-                sub.ref.current = sub.docs;
-                sub.status = 'cached';
-                sub.isStale = true;
-                this.notifySubscription(sub);
-            }
-        }
-        // Step 2: Connect and subscribe via WS
-        sub.status = sub.docs.size > 0 ? 'cached' : 'loading';
-        this.notifyState(sub);
-        try {
-            await this.ensureConnected();
-            this.sendSubscribe(sub);
-        }
-        catch (_b) {
-            sub.status = 'error';
-            sub.error = new Error('Connection failed');
-            this.notifyState(sub);
-        }
-        return this.createUnsubscribe(subKey, sub.id, opts.onData, opts.onState, opts.onError);
-    }
-    getRef(path, opts = {}) {
-        var _a;
-        const subKey = this.getSubKey(path, opts);
-        const sub = this.subscriptions.get(subKey);
-        if (sub)
-            return sub.ref;
-        // Auto-subscribe in ref mode
-        const ref = { current: new Map() };
-        this.subscribe(path, Object.assign(Object.assign({}, opts), { mode: 'ref', tier: 'ephemeral' })).catch(() => { });
-        const newSub = this.subscriptions.get(this.getSubKey(path, Object.assign(Object.assign({}, opts), { tier: 'ephemeral' })));
-        return (_a = newSub === null || newSub === void 0 ? void 0 : newSub.ref) !== null && _a !== void 0 ? _a : ref;
-    }
-    // -----------------------------------------------------------------------
-    // CRUD operations
-    // -----------------------------------------------------------------------
-    async set(path, doc) {
-        var _a;
-        await this.ensureConnected();
-        // Resolve operations (Increment, Time.Now) client-side for optimistic update
-        const resolvedDoc = this.resolveOperations(doc, path);
-        // Optimistic update: apply to local state immediately
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        const collectionPath = this.getCollectionPath(normalizedPath);
-        const optimisticDoc = Object.assign(Object.assign({ _id: normalizedPath, pathId: normalizedPath }, resolvedDoc), { 
-            // System timestamp field name: the Bounded worker stamps the neutral
-            // `_updatedAt`; the underscore-prefixed `_updated_at` metadata mirror.
-            // Match it so the optimistic doc lines up with the server's confirmation.
-            [isBoundedNetwork() ? '_updatedAt' : '_updated_at']: Date.now() });
-        const sub = this.findSubscriptionByPath(collectionPath);
-        let prevDoc = null;
-        if (sub) {
-            prevDoc = (_a = sub.docs.get(normalizedPath)) !== null && _a !== void 0 ? _a : null;
-            sub.docs.set(normalizedPath, optimisticDoc);
-            sub.ref.current = sub.docs;
-            this.notifySubscription(sub);
-        }
-        // Send to server
-        const requestId = `r_${nextRequestId++}`;
-        try {
-            const result = await this.sendRequest(requestId, {
-                type: 'set',
-                requestId,
-                documents: [{ destinationPath: normalizedPath, document: doc }],
-            });
-            // Replace optimistic doc with server-confirmed version
-            if (sub && result && typeof result === 'object') {
-                const serverDoc = Array.isArray(result) ? result[0] : result;
-                if (serverDoc && serverDoc._id) {
-                    sub.docs.set(serverDoc._id, serverDoc);
-                    sub.ref.current = sub.docs;
-                    this.notifySubscription(sub);
-                    this.markIdbDirty(collectionPath);
-                }
-            }
-            return Array.isArray(result) ? result[0] : result;
-        }
-        catch (err) {
-            // Revert optimistic update
-            if (sub) {
-                if (prevDoc) {
-                    sub.docs.set(normalizedPath, prevDoc);
-                }
-                else {
-                    sub.docs.delete(normalizedPath);
-                }
-                sub.ref.current = sub.docs;
-                this.notifySubscription(sub);
-            }
-            throw err;
-        }
-    }
-    async get(path) {
-        await this.ensureCurrentAuth();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        // Check local subscriptions first
-        const collectionPath = this.getCollectionPath(normalizedPath);
-        const sub = this.findSubscriptionByPath(collectionPath);
-        if (sub && sub.status === 'live') {
-            const doc = sub.docs.get(normalizedPath);
-            return doc !== null && doc !== void 0 ? doc : null;
-        }
-        // One-shot WS fetch
-        await this.ensureConnected();
-        const requestId = `r_${nextRequestId++}`;
-        return this.sendRequest(requestId, {
-            type: 'get',
-            requestId,
-            path: normalizedPath,
-        });
-    }
-    async getMany(paths) {
-        await this.ensureConnected();
-        const normalizedPaths = paths.map(p => p.startsWith('/') ? p.slice(1) : p);
-        const requestId = `r_${nextRequestId++}`;
-        return this.sendRequest(requestId, {
-            type: 'getMany',
-            requestId,
-            paths: normalizedPaths,
-        });
-    }
-    async delete(path) {
-        var _a;
-        await this.ensureConnected();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        // Optimistic: remove from local state
-        const collectionPath = this.getCollectionPath(normalizedPath);
-        const sub = this.findSubscriptionByPath(collectionPath);
-        let prevDoc = null;
-        if (sub) {
-            prevDoc = (_a = sub.docs.get(normalizedPath)) !== null && _a !== void 0 ? _a : null;
-            sub.docs.delete(normalizedPath);
-            sub.ref.current = sub.docs;
-            this.notifySubscription(sub);
-        }
-        const requestId = `r_${nextRequestId++}`;
-        try {
-            await this.sendRequest(requestId, {
-                type: 'delete',
-                requestId,
-                path: normalizedPath,
-            });
-            if (sub)
-                this.markIdbDirty(collectionPath);
-        }
-        catch (err) {
-            // Revert
-            if (sub && prevDoc) {
-                sub.docs.set(normalizedPath, prevDoc);
-                sub.ref.current = sub.docs;
-                this.notifySubscription(sub);
-            }
-            throw err;
-        }
-    }
-    async query(path, opts) {
-        await this.ensureConnected();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        const requestId = `r_${nextRequestId++}`;
-        return this.sendRequest(requestId, Object.assign(Object.assign(Object.assign(Object.assign({ type: 'query', requestId, path: normalizedPath }, ((opts === null || opts === void 0 ? void 0 : opts.filter) ? { filter: opts.filter } : {})), ((opts === null || opts === void 0 ? void 0 : opts.sort) ? { sort: opts.sort } : {})), ((opts === null || opts === void 0 ? void 0 : opts.limit) !== undefined ? { limit: opts.limit } : {})), ((opts === null || opts === void 0 ? void 0 : opts.includeSubPaths) ? { includeSubPaths: true } : {})));
-    }
-    async count(path) {
-        var _a;
-        await this.ensureConnected();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        const requestId = `r_${nextRequestId++}`;
-        const result = await this.sendRequest(requestId, {
-            type: 'count',
-            requestId,
-            path: normalizedPath,
-        });
-        return typeof result === 'number' ? result : ((_a = result === null || result === void 0 ? void 0 : result.value) !== null && _a !== void 0 ? _a : 0);
-    }
-    async aggregate(path, operation, opts) {
-        await this.ensureConnected();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        const requestId = `r_${nextRequestId++}`;
-        return this.sendRequest(requestId, Object.assign({ type: 'aggregate', requestId, path: normalizedPath, operation }, ((opts === null || opts === void 0 ? void 0 : opts.field) ? { field: opts.field } : {})));
-    }
-    // -----------------------------------------------------------------------
-    // Helpers
-    // -----------------------------------------------------------------------
-    sendSubscribe(sub) {
-        if (!this.ws || this.ws.readyState !== WebSocket.OPEN)
-            return;
-        const msg = {
-            type: 'subscribe',
-            subscriptionId: sub.id,
-            path: sub.path,
-        };
-        if (sub.options.filter)
-            msg.filter = sub.options.filter;
-        if (sub.options.includeSubPaths)
-            msg.includeSubPaths = true;
-        if (sub.options.limit)
-            msg.limit = sub.options.limit;
-        if (sub.options.prompt)
-            msg.prompt = sub.options.prompt;
-        this.ws.send(JSON.stringify(msg));
-    }
-    sendRequest(requestId, msg) {
-        return new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                this.pendingRequests.delete(requestId);
-                reject(new Error('Request timed out'));
-            }, 30000);
-            this.pendingRequests.set(requestId, { resolve, reject, timeout });
-            if (this.ws && this.ws.readyState === WebSocket.OPEN) {
-                this.ws.send(JSON.stringify(msg));
-            }
-            else {
-                this.pendingRequests.delete(requestId);
-                clearTimeout(timeout);
-                reject(new Error('WebSocket not connected'));
-            }
-        });
-    }
-    notifySubscription(sub) {
-        const data = this.docsToArray(sub);
-        const callbacks = Array.from(sub.callbacks);
-        for (const cb of callbacks) {
-            try {
-                cb(data);
-            }
-            catch ( /* swallow callback errors */_a) { /* swallow callback errors */ }
-        }
-        this.notifyState(sub);
-    }
-    notifyState(sub) {
-        const state = this.getState(sub);
-        const callbacks = Array.from(sub.stateCallbacks);
-        for (const cb of callbacks) {
-            try {
-                cb(state);
-            }
-            catch ( /* swallow */_a) { /* swallow */ }
-        }
-    }
-    getState(sub) {
-        return {
-            data: this.docsToArray(sub),
-            status: sub.status,
-            isStale: sub.isStale,
-            error: sub.error,
-        };
-    }
-    docsToArray(sub) {
-        return Array.from(sub.docs.values());
-    }
-    findSubscriptionById(id) {
-        for (const sub of this.subscriptions.values()) {
-            if (sub.id === id)
-                return sub;
-        }
-        return undefined;
-    }
-    findSubscriptionByPath(collectionPath) {
-        for (const sub of this.subscriptions.values()) {
-            const subPath = sub.path.startsWith('/') ? sub.path.slice(1) : sub.path;
-            if (subPath === collectionPath)
-                return sub;
-            if (collectionPath.startsWith(subPath + '/'))
-                return sub;
-        }
-        return undefined;
-    }
-    getCollectionPath(docPath) {
-        const segments = docPath.split('/');
-        if (segments.length % 2 === 0) {
-            return segments.slice(0, -1).join('/');
-        }
-        return docPath;
-    }
-    getSubKey(path, opts) {
-        const parts = [this.appId, this.authPrincipalKey, path];
-        if (opts.filter)
-            parts.push(JSON.stringify(opts.filter));
-        if (opts.prompt)
-            parts.push(opts.prompt);
-        if (opts.tier)
-            parts.push(opts.tier);
-        return parts.join('::');
-    }
-    idbKey(path) {
-        return `${this.appId}:${this.authPrincipalKey}:${path}`;
-    }
-    markIdbDirty(path) {
-        const sub = this.findSubscriptionByPath(path);
-        if (sub && sub.tier === 'ephemeral')
-            return;
-        this.idbDirtyKeys.add(path);
-        if (!this.idbFlushTimer) {
-            this.idbFlushTimer = setTimeout(() => {
-                this.flushIdb();
-                this.idbFlushTimer = null;
-            }, 500);
-        }
-    }
-    async flushIdb() {
-        const keys = Array.from(this.idbDirtyKeys);
-        this.idbDirtyKeys.clear();
-        for (const path of keys) {
-            const sub = this.findSubscriptionByPath(path);
-            if (sub && sub.tier !== 'ephemeral') {
-                const docs = this.docsToArray(sub);
-                await idbSet(this.idbKey(path), docs);
-            }
-        }
-    }
-    createUnsubscribe(subKey, subId, onData, onState, onError) {
-        return async () => {
-            var _a;
-            const sub = (_a = this.subscriptions.get(subKey)) !== null && _a !== void 0 ? _a : this.findSubscriptionById(subId);
-            if (!sub)
-                return;
-            const currentSubKey = this.getSubKey(sub.path, sub.options);
-            if (onData)
-                sub.callbacks.delete(onData);
-            if (onState)
-                sub.stateCallbacks.delete(onState);
-            if (onError)
-                sub.errorCallbacks.delete(onError);
-            // If no more callbacks, unsubscribe entirely
-            if (sub.callbacks.size === 0 && sub.stateCallbacks.size === 0 && sub.errorCallbacks.size === 0) {
-                this.subscriptions.delete(subKey);
-                this.subscriptions.delete(currentSubKey);
-                if (this.ws && this.ws.readyState === WebSocket.OPEN) {
-                    this.ws.send(JSON.stringify({
-                        type: 'unsubscribe',
-                        subscriptionId: sub.id,
-                    }));
-                }
-            }
-        };
-    }
-    resolveOperations(doc, path) {
-        var _a;
-        if (!doc || typeof doc !== 'object')
-            return doc;
-        const resolved = {};
-        for (const [key, value] of Object.entries(doc)) {
-            if (value && typeof value === 'object' && !Array.isArray(value) && value.operation) {
-                const op = value;
-                if (op.operation === 'time' && op.value === 'now') {
-                    resolved[key] = Math.floor(Date.now() / 1000);
-                }
-                else if (op.operation === 'increment') {
-                    // For optimistic: get current value and add
-                    const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-                    const collectionPath = this.getCollectionPath(normalizedPath);
-                    const sub = this.findSubscriptionByPath(collectionPath);
-                    const existing = sub === null || sub === void 0 ? void 0 : sub.docs.get(normalizedPath);
-                    const current = (_a = existing === null || existing === void 0 ? void 0 : existing[key]) !== null && _a !== void 0 ? _a : 0;
-                    resolved[key] = (typeof current === 'number' ? current : 0) + op.value;
-                }
-                else {
-                    resolved[key] = value;
-                }
-            }
-            else {
-                resolved[key] = value;
-            }
-        }
-        return resolved;
-    }
-    rejectAllPending(reason) {
-        for (const [requestId, pending] of this.pendingRequests) {
-            clearTimeout(pending.timeout);
-            pending.reject(new Error(reason));
-        }
-        this.pendingRequests.clear();
-    }
-    setAllSubscriptionStatus(status) {
-        for (const sub of this.subscriptions.values()) {
-            sub.status = status;
-            this.notifyState(sub);
-        }
-    }
-    // -----------------------------------------------------------------------
-    // Lifecycle
-    // -----------------------------------------------------------------------
-    close() {
-        this.closed = true;
-        if (this.reconnectTimer)
-            clearTimeout(this.reconnectTimer);
-        if (this.idbFlushTimer)
-            clearTimeout(this.idbFlushTimer);
-        if (this.tokenRefreshTimer)
-            clearInterval(this.tokenRefreshTimer);
-        this.flushIdb();
-        if (this.ws) {
-            this.ws.close(1000, 'Store closed');
-            this.ws = null;
-        }
-        this.rejectAllPending('Store closed');
-        this.subscriptions.clear();
-    }
-    async reconnectWithNewAuth() {
-        if (this.closed)
-            return;
-        await this.ensureInitialized();
-        await this.refreshToken();
-        await this.applyAuthPrincipalChange();
-        if (this.subscriptions.size > 0) {
-            await this.ensureConnected().catch((error) => {
-                this.setAllSubscriptionStatus('error');
-                for (const sub of this.subscriptions.values()) {
-                    sub.error = error instanceof Error ? error : new Error(String(error));
-                    this.notifyState(sub);
-                }
-            });
-        }
-    }
-}
-// ---------------------------------------------------------------------------
-// Singleton instance
-// ---------------------------------------------------------------------------
-let storeInstance = null;
-function getRealtimeStore() {
-    if (!storeInstance) {
-        storeInstance = new RealtimeStore();
-    }
-    return storeInstance;
-}
-function resetRealtimeStore() {
-    if (storeInstance) {
-        storeInstance.close();
-        storeInstance = null;
-    }
-}
-async function reconnectRealtimeStoreWithNewAuth() {
-    if (storeInstance) {
-        await storeInstance.reconnectWithNewAuth();
-    }
-}
-
-var realtimeStore = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    RealtimeStore: RealtimeStore,
-    getRealtimeStore: getRealtimeStore,
-    reconnectRealtimeStoreWithNewAuth: reconnectRealtimeStoreWithNewAuth,
-    resetRealtimeStore: resetRealtimeStore
-});
-
 // ---------------------------------------------------------------------------
 // functions.ts -- Bounded Functions client (the imperative escape hatch).
 //
@@ -7819,11 +6756,12 @@ async function invoke(name, args = {}, opts = {}) {
     const base = (config.functionsUrl || DEFAULT_FUNCTIONS_URL).replace(/\/$/, '');
     // Attach the caller's session token automatically (same token as data calls).
     // A wallet-scoped call (server WalletClient.invoke) resolves the token from the
-    // wallet's own session; all others use the ambient env/web session.
+    // wallet's own session; browser calls use the active web session. Top-level
+    // server calls fail closed because there is no ambient server signer.
     const authHeader = ((_a = opts._overrides) === null || _a === void 0 ? void 0 : _a._getAuthHeaders)
         ? await opts._overrides._getAuthHeaders()
         : await createAuthHeader(config.isServer);
-    const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, ((_b = stripAuthHeaders(opts.headers)) !== null && _b !== void 0 ? _b : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
+    const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId }, ((_b = stripAuthHeaders(opts.headers)) !== null && _b !== void 0 ? _b : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
     const controller = new AbortController();
     const timeoutMs = (_c = opts.timeoutMs) !== null && _c !== void 0 ? _c : 60000;
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -7892,8 +6830,8 @@ const functions = { invoke };
 // Subscribing to your view: a per-player view doc lives at
 // `<roomPath>/view/<myUserId>` (the policy declares
 // `rooms/$roomId/view/$userId` ephemeral with `read: $userId == @user.id`).
-// Wallet-address keyed view paths remain supported through opts.address for
-// older policies, but new live rooms should key views by @user.id.
+// View paths key only by @user.id; wallet-address aliases are intentionally not
+// accepted by this helper.
 // ---------------------------------------------------------------------------
 class LiveIntentError extends Error {
     constructor(message, statusCode, details) {
@@ -7987,7 +6925,7 @@ async function intent(roomPath, intent, opts = {}) {
     const overrideHeaders = withoutAuthorization((_b = opts._overrides) === null || _b === void 0 ? void 0 : _b.headers);
     const buildHeaders = async () => {
         const authHeader = await liveAuthHeader(config.isServer, opts._overrides);
-        return Object.assign(Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, (overrideHeaders !== null && overrideHeaders !== void 0 ? overrideHeaders : {})), (extraHeaders !== null && extraHeaders !== void 0 ? extraHeaders : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
+        return Object.assign(Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId }, (overrideHeaders !== null && overrideHeaders !== void 0 ? overrideHeaders : {})), (extraHeaders !== null && extraHeaders !== void 0 ? extraHeaders : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
     };
     const controller = new AbortController();
     const timeoutMs = (_c = opts.timeoutMs) !== null && _c !== void 0 ? _c : 60000;
@@ -8048,7 +6986,7 @@ async function status(roomPath, opts = {}) {
     const normalizedRoomPath = roomPath.replace(/\/$/, '');
     const config = await getConfig();
     const base = realtimeHttpBase(config.wsApiUrl);
-    const headers = Object.assign({ 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, ((_a = opts.headers) !== null && _a !== void 0 ? _a : {}));
+    const headers = Object.assign({ 'X-App-Id': config.appId }, ((_a = opts.headers) !== null && _a !== void 0 ? _a : {}));
     const controller = new AbortController();
     const timeoutMs = (_b = opts.timeoutMs) !== null && _b !== void 0 ? _b : 15000;
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -8090,29 +7028,27 @@ async function status(roomPath, opts = {}) {
  *   subscribe('<roomPath>/view/<myUserId>', { onData, onError })
  *
  * The view id defaults to the logged-in user's @user.id (from the session token
- * claims); pass `opts.userId` to override. `opts.address` is kept as a legacy
- * alias for older wallet-address keyed policies. Returns the unsubscribe
- * function (a Promise<() => Promise<void>>, same as `subscribe`).
+ * claims); pass `opts.userId` to override. Returns the unsubscribe function
+ * (a Promise<() => Promise<void>>, same as `subscribe`).
  *
  * Note: this is a browser-first helper (the WS subscription manager is
  * browser-oriented). Server consumers should use `live.intent`.
  */
 async function subscribeView(roomPath, opts) {
-    var _a, _b, _c;
     if (!roomPath || typeof roomPath !== 'string') {
         throw new LiveIntentError('A room path is required');
     }
     if (!opts || typeof opts.onData !== 'function') {
         throw new LiveIntentError('subscribeView requires an onData callback');
     }
-    let viewUserId = (_a = opts.userId) !== null && _a !== void 0 ? _a : opts.address;
+    let viewUserId = opts.userId;
     if (!viewUserId) {
         const config = await getConfig();
         const info = await getUserInfo(config.isServer);
         // getUserInfo returns the RAW idToken payload. The universal live view key
-        // is @user.id (`custom:userId`); wallet-address keyed views are still
-        // resolved as a compatibility fallback for older policies.
-        viewUserId = (_c = (_b = info === null || info === void 0 ? void 0 : info['custom:userId']) !== null && _b !== void 0 ? _b : info === null || info === void 0 ? void 0 : info['custom:walletAddress']) !== null && _c !== void 0 ? _c : info === null || info === void 0 ? void 0 : info.address;
+        // is @user.id (`custom:userId`); wallet-address keyed compatibility aliases
+        // are intentionally not accepted.
+        viewUserId = info === null || info === void 0 ? void 0 : info['custom:userId'];
     }
     if (!viewUserId || typeof viewUserId !== 'string') {
         throw new LiveIntentError('Could not resolve a player view id for subscribeView; pass opts.userId or log in first');
@@ -8187,7 +7123,6 @@ exports.FunctionInvokeError = FunctionInvokeError;
 exports.InsufficientBalanceError = InsufficientBalanceError;
 exports.LiveIntentError = LiveIntentError;
 exports.ReactNativeSessionManager = ReactNativeSessionManager;
-exports.RealtimeStore = RealtimeStore;
 exports.ServerSessionManager = ServerSessionManager;
 exports.WebSessionManager = WebSessionManager;
 exports.aggregate = aggregate;
@@ -8210,7 +7145,6 @@ exports.getConfig = getConfig;
 exports.getFiles = getFiles;
 exports.getIdToken = getIdToken;
 exports.getMany = getMany;
-exports.getRealtimeStore = getRealtimeStore;
 exports.getWebhookKeysUrl = getWebhookKeysUrl;
 exports.hasActiveConnection = hasActiveConnection;
 exports.increment = increment;
@@ -8224,7 +7158,6 @@ exports.now = now;
 exports.queryAggregate = queryAggregate;
 exports.reconnectWithNewAuth = reconnectWithNewAuth;
 exports.refreshSession = refreshSession;
-exports.resetRealtimeStore = resetRealtimeStore;
 exports.revokeSession = revokeSession;
 exports.runExpression = runExpression;
 exports.runExpressionMany = runExpressionMany;
@@ -8244,9 +7177,4 @@ exports.subscribeLiveView = subscribeView;
 exports.toMillis = toMillis;
 exports.toSeconds = toSeconds;
 exports.withEffects = withEffects;
-exports.wsDelete = wsDelete;
-exports.wsGet = wsGet;
-exports.wsGetMany = wsGetMany;
-exports.wsQuery = wsQuery;
-exports.wsSet = wsSet;
 //# sourceMappingURL=index.js.map