@bounded-sh/core 0.0.17 → 0.0.19

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import axios from 'axios';
-import { ComputeBudgetProgram, PublicKey, VersionedTransaction, TransactionMessage, Keypair, SystemProgram, TransactionInstruction, Connection } from '@solana/web3.js';
 import nacl from 'tweetnacl';
+import { ComputeBudgetProgram, PublicKey, VersionedTransaction, TransactionMessage, SystemProgram, TransactionInstruction, Connection } from '@solana/web3.js';
 import * as anchor from '@coral-xyz/anchor';
 import { Program } from '@coral-xyz/anchor';
 import BN from 'bn.js';
@@ -10,7 +10,6 @@ let clientConfig = {
     // User configured settings
     name: '',
     logoUrl: '',
-    apiKey: '',
     // Bounded production is the out-of-the-box default — a Bounded app needs only
     // `{ appId }`. Pass `network: 'bounded-staging'` to target staging.
     network: 'bounded-production',
@@ -87,7 +86,7 @@ function isBoundedNetwork() {
 }
 function init(newConfig) {
     return new Promise((resolve, reject) => {
-        if (!newConfig.apiKey && !newConfig.appId) {
+        if (!newConfig.appId) {
             reject(new Error('No app ID provided.'));
             return;
         }
@@ -2863,9 +2862,25 @@ async function refreshSession(refreshToken, issuer) {
     })();
     return refreshInFlight$1;
 }
+class SessionRevokeError extends Error {
+    constructor(message, cause) {
+        super(message);
+        this.name = 'SessionRevokeError';
+        this.cause = cause;
+    }
+}
+function revokeFailureMessage(err) {
+    var _a, _b;
+    const status = (_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status;
+    const statusText = (_b = err === null || err === void 0 ? void 0 : err.response) === null || _b === void 0 ? void 0 : _b.statusText;
+    const suffix = typeof status === 'number'
+        ? ` (HTTP ${status}${statusText ? ` ${statusText}` : ''})`
+        : '';
+    return `Failed to revoke refresh token server-side${suffix}. The refresh-token family may still be active.`;
+}
 /**
- * Revoke a session's refresh-token family server-side (logout). Best-effort: if the
- * call fails the local logout still proceeds. Routes to the minting issuer.
+ * Revoke a session's refresh-token family server-side (logout). Routes to the
+ * minting issuer and rejects if the revoke request fails.
  */
 async function revokeSession(refreshToken, issuer) {
     if (!refreshToken)
@@ -2878,8 +2893,8 @@ async function revokeSession(refreshToken, issuer) {
             appId: config.appId,
         }, { headers: { 'Content-Type': 'application/json' }, timeout: 15000 });
     }
-    catch (_a) {
-        // best-effort: logout must succeed even if the revoke call doesn't
+    catch (err) {
+        throw new SessionRevokeError(revokeFailureMessage(err), err);
     }
 }
 async function signSessionCreateMessage(_signMessageFunction) {
@@ -3295,231 +3310,6 @@ var sessionManager = /*#__PURE__*/Object.freeze({
     getActiveSessionManager: getActiveSessionManager
 });
 
-var safeBuffer = {exports: {}};
-
-/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
-
-var hasRequiredSafeBuffer;
-
-function requireSafeBuffer () {
-	if (hasRequiredSafeBuffer) return safeBuffer.exports;
-	hasRequiredSafeBuffer = 1;
-	(function (module, exports$1) {
-		/* eslint-disable node/no-deprecated-api */
-		var buffer = requireBuffer();
-		var Buffer = buffer.Buffer;
-
-		// alternative to using Object.keys for old browsers
-		function copyProps (src, dst) {
-		  for (var key in src) {
-		    dst[key] = src[key];
-		  }
-		}
-		if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) {
-		  module.exports = buffer;
-		} else {
-		  // Copy properties from require('buffer')
-		  copyProps(buffer, exports$1);
-		  exports$1.Buffer = SafeBuffer;
-		}
-
-		function SafeBuffer (arg, encodingOrOffset, length) {
-		  return Buffer(arg, encodingOrOffset, length)
-		}
-
-		SafeBuffer.prototype = Object.create(Buffer.prototype);
-
-		// Copy static methods from Buffer
-		copyProps(Buffer, SafeBuffer);
-
-		SafeBuffer.from = function (arg, encodingOrOffset, length) {
-		  if (typeof arg === 'number') {
-		    throw new TypeError('Argument must not be a number')
-		  }
-		  return Buffer(arg, encodingOrOffset, length)
-		};
-
-		SafeBuffer.alloc = function (size, fill, encoding) {
-		  if (typeof size !== 'number') {
-		    throw new TypeError('Argument must be a number')
-		  }
-		  var buf = Buffer(size);
-		  if (fill !== undefined) {
-		    if (typeof encoding === 'string') {
-		      buf.fill(fill, encoding);
-		    } else {
-		      buf.fill(fill);
-		    }
-		  } else {
-		    buf.fill(0);
-		  }
-		  return buf
-		};
-
-		SafeBuffer.allocUnsafe = function (size) {
-		  if (typeof size !== 'number') {
-		    throw new TypeError('Argument must be a number')
-		  }
-		  return Buffer(size)
-		};
-
-		SafeBuffer.allocUnsafeSlow = function (size) {
-		  if (typeof size !== 'number') {
-		    throw new TypeError('Argument must be a number')
-		  }
-		  return buffer.SlowBuffer(size)
-		}; 
-	} (safeBuffer, safeBuffer.exports));
-	return safeBuffer.exports;
-}
-
-var src;
-var hasRequiredSrc;
-
-function requireSrc () {
-	if (hasRequiredSrc) return src;
-	hasRequiredSrc = 1;
-	// base-x encoding / decoding
-	// Copyright (c) 2018 base-x contributors
-	// Copyright (c) 2014-2018 The Bitcoin Core developers (base58.cpp)
-	// Distributed under the MIT software license, see the accompanying
-	// file LICENSE or http://www.opensource.org/licenses/mit-license.php.
-	// @ts-ignore
-	var _Buffer = requireSafeBuffer().Buffer;
-	function base (ALPHABET) {
-	  if (ALPHABET.length >= 255) { throw new TypeError('Alphabet too long') }
-	  var BASE_MAP = new Uint8Array(256);
-	  for (var j = 0; j < BASE_MAP.length; j++) {
-	    BASE_MAP[j] = 255;
-	  }
-	  for (var i = 0; i < ALPHABET.length; i++) {
-	    var x = ALPHABET.charAt(i);
-	    var xc = x.charCodeAt(0);
-	    if (BASE_MAP[xc] !== 255) { throw new TypeError(x + ' is ambiguous') }
-	    BASE_MAP[xc] = i;
-	  }
-	  var BASE = ALPHABET.length;
-	  var LEADER = ALPHABET.charAt(0);
-	  var FACTOR = Math.log(BASE) / Math.log(256); // log(BASE) / log(256), rounded up
-	  var iFACTOR = Math.log(256) / Math.log(BASE); // log(256) / log(BASE), rounded up
-	  function encode (source) {
-	    if (Array.isArray(source) || source instanceof Uint8Array) { source = _Buffer.from(source); }
-	    if (!_Buffer.isBuffer(source)) { throw new TypeError('Expected Buffer') }
-	    if (source.length === 0) { return '' }
-	        // Skip & count leading zeroes.
-	    var zeroes = 0;
-	    var length = 0;
-	    var pbegin = 0;
-	    var pend = source.length;
-	    while (pbegin !== pend && source[pbegin] === 0) {
-	      pbegin++;
-	      zeroes++;
-	    }
-	        // Allocate enough space in big-endian base58 representation.
-	    var size = ((pend - pbegin) * iFACTOR + 1) >>> 0;
-	    var b58 = new Uint8Array(size);
-	        // Process the bytes.
-	    while (pbegin !== pend) {
-	      var carry = source[pbegin];
-	            // Apply "b58 = b58 * 256 + ch".
-	      var i = 0;
-	      for (var it1 = size - 1; (carry !== 0 || i < length) && (it1 !== -1); it1--, i++) {
-	        carry += (256 * b58[it1]) >>> 0;
-	        b58[it1] = (carry % BASE) >>> 0;
-	        carry = (carry / BASE) >>> 0;
-	      }
-	      if (carry !== 0) { throw new Error('Non-zero carry') }
-	      length = i;
-	      pbegin++;
-	    }
-	        // Skip leading zeroes in base58 result.
-	    var it2 = size - length;
-	    while (it2 !== size && b58[it2] === 0) {
-	      it2++;
-	    }
-	        // Translate the result into a string.
-	    var str = LEADER.repeat(zeroes);
-	    for (; it2 < size; ++it2) { str += ALPHABET.charAt(b58[it2]); }
-	    return str
-	  }
-	  function decodeUnsafe (source) {
-	    if (typeof source !== 'string') { throw new TypeError('Expected String') }
-	    if (source.length === 0) { return _Buffer.alloc(0) }
-	    var psz = 0;
-	        // Skip and count leading '1's.
-	    var zeroes = 0;
-	    var length = 0;
-	    while (source[psz] === LEADER) {
-	      zeroes++;
-	      psz++;
-	    }
-	        // Allocate enough space in big-endian base256 representation.
-	    var size = (((source.length - psz) * FACTOR) + 1) >>> 0; // log(58) / log(256), rounded up.
-	    var b256 = new Uint8Array(size);
-	        // Process the characters.
-	    while (psz < source.length) {
-	            // Find code of next character
-	      var charCode = source.charCodeAt(psz);
-	            // Base map can not be indexed using char code
-	      if (charCode > 255) { return }
-	            // Decode character
-	      var carry = BASE_MAP[charCode];
-	            // Invalid character
-	      if (carry === 255) { return }
-	      var i = 0;
-	      for (var it3 = size - 1; (carry !== 0 || i < length) && (it3 !== -1); it3--, i++) {
-	        carry += (BASE * b256[it3]) >>> 0;
-	        b256[it3] = (carry % 256) >>> 0;
-	        carry = (carry / 256) >>> 0;
-	      }
-	      if (carry !== 0) { throw new Error('Non-zero carry') }
-	      length = i;
-	      psz++;
-	    }
-	        // Skip leading zeroes in b256.
-	    var it4 = size - length;
-	    while (it4 !== size && b256[it4] === 0) {
-	      it4++;
-	    }
-	    var vch = _Buffer.allocUnsafe(zeroes + (size - it4));
-	    vch.fill(0x00, 0, zeroes);
-	    var j = zeroes;
-	    while (it4 !== size) {
-	      vch[j++] = b256[it4++];
-	    }
-	    return vch
-	  }
-	  function decode (string) {
-	    var buffer = decodeUnsafe(string);
-	    if (buffer) { return buffer }
-	    throw new Error('Non-base' + BASE + ' character')
-	  }
-	  return {
-	    encode: encode,
-	    decodeUnsafe: decodeUnsafe,
-	    decode: decode
-	  }
-	}
-	src = base;
-	return src;
-}
-
-var bs58$1;
-var hasRequiredBs58;
-
-function requireBs58 () {
-	if (hasRequiredBs58) return bs58$1;
-	hasRequiredBs58 = 1;
-	var basex = requireSrc();
-	var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
-
-	bs58$1 = basex(ALPHABET);
-	return bs58$1;
-}
-
-var bs58Exports = requireBs58();
-var bs58 = /*@__PURE__*/getDefaultExportFromCjs(bs58Exports);
-
 // ─────────────────────────────────────────────────────────────
 // Local implementation of getSimulationComputeUnits
 // (Replaces @solana-developers/helpers to avoid Wallet import issue in browser/ESM builds)
@@ -3777,36 +3567,7 @@ async function buildSetDocumentsTransaction(connection, idl, anchorProvider, pay
     return { tx: vTx, blockhash, lastValidBlockHeight };
 }
 
-/* ------------------------------------------------------------------ */
-/*  ENV helpers                                                       */
-/* ------------------------------------------------------------------ */
-// Canonical `BOUNDED_PRIVATE_KEY` (matches the CLI). Only consulted when no
-// explicit keypair was provided (createWalletClient passes one).
-const ENV_KEYPAIR = "BOUNDED_PRIVATE_KEY";
-const LEGACY_ENV_KEYPAIR = "BOUNDED_SOLANA_KEYPAIR";
-function loadKeypairFromEnv() {
-    if (process.env[LEGACY_ENV_KEYPAIR]) {
-        throw new Error(`${LEGACY_ENV_KEYPAIR} is no longer supported. Set ${ENV_KEYPAIR} instead, ` +
-            `or pass an explicit keypair via createWalletClient({ keypair }).`);
-    }
-    const secret = process.env[ENV_KEYPAIR];
-    if (!secret) {
-        throw new Error(`No server keypair for this top-level call. The top-level get/set/subscribe/etc. use an ` +
-            `AMBIENT session — set ${ENV_KEYPAIR} to a base-58 secret key (or JSON array) to provide one. ` +
-            `If you already created a wallet with createWalletClient({ keypair }), call ITS methods instead ` +
-            `(client.subscribe / client.set / client.get): that client is self-contained and deliberately does ` +
-            `not set the ambient session, so the top-level functions can't see it.`);
-    }
-    try {
-        const secretKey = secret.trim().startsWith("[")
-            ? Uint8Array.from(JSON.parse(secret))
-            : bs58.decode(secret.trim());
-        return Keypair.fromSecretKey(secretKey);
-    }
-    catch (err) {
-        throw new Error(`Unable to parse ${ENV_KEYPAIR}. Ensure it is valid base-58 or JSON.`);
-    }
-}
+const NO_AMBIENT_SERVER_SESSION = "Server sessions are not process-global. Use createWalletClient({ keypair }) and call that wallet client's methods.";
 /* ------------------------------------------------------------------ */
 /* SESSION MANAGER                                                     */
 /* ------------------------------------------------------------------ */
@@ -3829,8 +3590,10 @@ class ServerSessionManager {
      * Session creation (instance method)
      * ---------------------------------------------- */
     async createSession() {
-        var _a;
-        const kp = (_a = this.keypair) !== null && _a !== void 0 ? _a : loadKeypairFromEnv();
+        if (!this.keypair) {
+            throw new Error(NO_AMBIENT_SERVER_SESSION);
+        }
+        const kp = this.keypair;
         const address = kp.publicKey.toBase58();
         /* fetch nonce from auth API */
         const nonce = await genAuthNonce();
@@ -3892,7 +3655,7 @@ class ServerSessionManager {
         return (_b = (_a = this.session) === null || _a === void 0 ? void 0 : _a.refreshToken) !== null && _b !== void 0 ? _b : null;
     }
 }
-/* The default singleton instance (reads keypair from env) */
+/* The default singleton exists only so top-level server calls fail closed. */
 ServerSessionManager.instance = new ServerSessionManager();
 
 /**
@@ -3968,9 +3731,7 @@ async function getUserInfo(isServer) {
  *
  * Mirrors the realtime-worker auth.ts identity resolution so the client-side
  * `user` object matches what the backend authenticates as:
- *   - id  = custom:userId when present, else custom:walletAddress (the fallback
- *           keeps wallet/SIWS tokens — which omit userId — AND legacy Better Auth
- *           tokens — which put the account id in custom:walletAddress — working).
+ *   - id  = custom:userId only.
  *   - address = custom:walletAddress only (a REAL wallet). NEVER falls back to the
  *           identity: an opaque id is not a spendable onchain address. null for
  *           email-only sessions.
@@ -3995,7 +3756,7 @@ function deriveUserIdentityFromIdToken(idToken) {
         const userIdClaim = payload['custom:userId'];
         const id = (typeof userIdClaim === 'string' && userIdClaim.length > 0)
             ? userIdClaim
-            : address;
+            : null;
         const emailClaim = payload['email'];
         const email = (typeof emailClaim === 'string' && emailClaim.length > 0)
             ? emailClaim.toLowerCase()
@@ -4051,17 +3812,6 @@ async function updateIdTokenAndAccessToken(idToken, accessToken, isServer = fals
     await getActiveSessionManager().updateIdTokenAndAccessToken(idToken, accessToken, refreshToken);
 }
 
-var utils = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    createAuthHeader: createAuthHeader,
-    deriveUserIdentityFromIdToken: deriveUserIdentityFromIdToken,
-    getIdToken: getIdToken,
-    getRefreshToken: getRefreshToken,
-    getSessionIssuer: getSessionIssuer,
-    getUserInfo: getUserInfo,
-    updateIdTokenAndAccessToken: updateIdTokenAndAccessToken
-});
-
 const apiClient = axios.create();
 axiosRetry(apiClient, {
     retries: 2,
@@ -4126,7 +3876,7 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
         const authHeader = (_overrides === null || _overrides === void 0 ? void 0 : _overrides._getAuthHeaders)
             ? await _overrides._getAuthHeaders()
             : await createAuthHeader(config.isServer);
-        const headers = Object.assign({ "Content-Type": "application/json", "X-Public-App-Id": config.appId, "X-App-Id": config.appId }, authHeader);
+        const headers = Object.assign({ "Content-Type": "application/json", "X-App-Id": config.appId }, authHeader);
         // Apply custom headers from _overrides
         if (_overrides === null || _overrides === void 0 ? void 0 : _overrides.headers) {
             Object.assign(headers, _overrides.headers);
@@ -4230,6 +3980,7 @@ const pendingRequests = {};
 const GET_CACHE_TTL = 500; // Adjust this value as needed (in milliseconds)
 // Last time we cleaned up the cache
 let lastCacheCleanup = Date.now();
+let uncacheableReadKeyCounter = 0;
 /**
  * Return the leaf document key (last path segment) for a document path.
  *
@@ -4315,57 +4066,74 @@ function normalizeReadResult(responseData, pathIsDocument) {
     }
     return responseData;
 }
-function hashForKey$2(value) {
+function hashForKey$1(value) {
     let h = 5381;
     for (let i = 0; i < value.length; i++) {
         h = ((h << 5) + h + value.charCodeAt(i)) & 0x7fffffff;
     }
     return h.toString(36);
 }
+function hasAuthHeader(headers) {
+    if (!headers)
+        return false;
+    return (Object.prototype.hasOwnProperty.call(headers, 'Authorization') ||
+        Object.prototype.hasOwnProperty.call(headers, 'authorization'));
+}
 function authValueFromHeaders(headers) {
     return (headers === null || headers === void 0 ? void 0 : headers.Authorization) || (headers === null || headers === void 0 ? void 0 : headers.authorization) || '';
 }
 function principalFromAuthValue(authValue) {
-    return authValue ? `h${hashForKey$2(authValue)}` : 'anon';
+    return authValue ? `h${hashForKey$1(authValue)}` : null;
 }
 function principalFromIdToken$1(idToken) {
-    return idToken ? `t${hashForKey$2(idToken)}` : 'anon';
+    return idToken ? `t${hashForKey$1(idToken)}` : null;
+}
+function uncacheableReadKey(appId, scope) {
+    uncacheableReadKeyCounter += 1;
+    return `${appId}:${scope}-uncacheable-${uncacheableReadKeyCounter}`;
 }
 /**
  * SECURITY (H1): Read caches must be keyed by the caller's principal, not just
  * by path/filter/shape. In a shared process / SSR worker / browser login-switch,
  * keying by path alone lets User B receive User A's cached private read before
- * any server read rule runs. This returns `appId:<principal>` for the identity a
- * given read will actually authenticate as. This intentionally treats JWTs as
- * opaque unverified bearer material — never decoded claims and never caller
- * identity hints such as `_walletAddress`. A forged token that merely claims
- * another user's `sub` must miss that user's cache and go to the server.
+ * any server read rule runs. This returns `appId:<principal>` for the opaque
+ * auth material a given read will actually authenticate with. No-auth reads are
+ * deliberately marked uncacheable instead of sharing an implicit `anon` bucket.
+ * JWTs are intentionally treated as opaque unverified bearer material — never
+ * decoded claims and never caller identity hints such as `_walletAddress`.
  */
 async function getReadPrincipalKey(overrides) {
     const config = await getConfig();
     const appId = config.appId || '';
     // makeApiRequest applies overrides.headers AFTER its computed auth header, so
     // caller-supplied Authorization is the real request auth when present.
-    const directAuth = authValueFromHeaders(overrides === null || overrides === void 0 ? void 0 : overrides.headers);
-    if (directAuth) {
-        return `${appId}:${principalFromAuthValue(directAuth)}`;
+    if (hasAuthHeader(overrides === null || overrides === void 0 ? void 0 : overrides.headers)) {
+        const principal = principalFromAuthValue(authValueFromHeaders(overrides === null || overrides === void 0 ? void 0 : overrides.headers));
+        return principal
+            ? { key: `${appId}:${principal}`, cacheable: true }
+            : { key: uncacheableReadKey(appId, 'h'), cacheable: false };
     }
     // Per-request auth-header override (wallet client). Key by the exact opaque
     // header it produces, not decoded claims or the unverified _walletAddress hint.
     if (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders) {
         try {
             const headers = await overrides._getAuthHeaders();
-            return `${appId}:o${principalFromAuthValue(authValueFromHeaders(headers))}`;
+            const principal = principalFromAuthValue(authValueFromHeaders(headers));
+            return principal
+                ? { key: `${appId}:o${principal}`, cacheable: true }
+                : { key: uncacheableReadKey(appId, 'o'), cacheable: false };
         }
         catch (_a) {
-            // If we can't resolve the override identity, use a unique-ish key so we
-            // never collide with (and serve) another principal's cached entry.
-            return `${appId}:o${hashForKey$2(String(Date.now()) + Math.random())}`;
+            // If we can't resolve the override identity, do not read/write cache.
+            return { key: uncacheableReadKey(appId, 'o'), cacheable: false };
         }
     }
     // Ambient session principal.
     const idToken = await getIdToken(config.isServer);
-    return `${appId}:${principalFromIdToken$1(idToken)}`;
+    const principal = principalFromIdToken$1(idToken);
+    return principal
+        ? { key: `${appId}:${principal}`, cacheable: true }
+        : { key: uncacheableReadKey(appId, 'a'), cacheable: false };
 }
 /**
  * Validates that a field name is a safe identifier (alphanumeric, underscores, dots for nested paths).
@@ -4658,18 +4426,20 @@ async function get(path, opts = {}) {
         // Create cache key combining path, prompt, filter, sort, includeSubPaths,
         // shape, limit, cursor — and (H1) the caller's appId + principal fingerprint,
         // so a private read cached for one user is never served to another in a
-        // shared process / SSR worker / browser login-switch.
+        // shared process / SSR worker / browser login-switch. The cache is opt-in
+        // and disabled for no-auth reads, which get an uncacheable unique key.
         const shapeKey = opts.shape ? JSON.stringify(opts.shape) : '';
         const includeSubPathsKey = opts.includeSubPaths ? ':subpaths' : '';
         const limitKey = opts.limit !== undefined ? `:l${opts.limit}` : '';
-        const cursorKey = opts.cursor ? `:c${hashForKey$2(opts.cursor)}` : '';
-        const filterKey = opts.filter ? `:f${hashForKey$2(JSON.stringify(opts.filter))}` : '';
-        const sortKey = opts.sort ? `:s${hashForKey$2(JSON.stringify(opts.sort))}` : '';
+        const cursorKey = opts.cursor ? `:c${hashForKey$1(opts.cursor)}` : '';
+        const filterKey = opts.filter ? `:f${hashForKey$1(JSON.stringify(opts.filter))}` : '';
+        const sortKey = opts.sort ? `:s${hashForKey$1(JSON.stringify(opts.sort))}` : '';
         const principalKey = await getReadPrincipalKey(opts._overrides);
-        const cacheKey = `${principalKey}|${normalizedPath}:${opts.prompt || ''}${filterKey}${sortKey}${includeSubPathsKey}:${shapeKey}${limitKey}${cursorKey}`;
+        const cacheKey = `${principalKey.key}|${normalizedPath}:${opts.prompt || ''}${filterKey}${sortKey}${includeSubPathsKey}:${shapeKey}${limitKey}${cursorKey}`;
+        const cacheEnabled = opts.cache === true && !opts.bypassCache && principalKey.cacheable;
         const now = Date.now();
-        // Check for valid cache entry if not bypassing cache
-        if (!opts.bypassCache && getCache[cacheKey] && now < getCache[cacheKey].expiresAt) {
+        // Check for valid cache entry when the caller explicitly opted in.
+        if (cacheEnabled && getCache[cacheKey] && now < getCache[cacheKey].expiresAt) {
             return getCache[cacheKey].data;
         }
         // If we're bypassing cache, we should still coalesce identical requests
@@ -4711,8 +4481,8 @@ async function get(path, opts = {}) {
                 //   - collection path → `{ data, nextCursor }` preserved,
                 // with the bare `id` (leaf doc key) attached to every returned row (Bug 1).
                 const responseData = normalizeReadResult(response.data, pathIsDocument);
-                // Cache the response (unless bypassing cache)
-                if (!opts.bypassCache) {
+                // Cache the response only when explicitly requested and principal-bound.
+                if (cacheEnabled) {
                     getCache[cacheKey] = {
                         data: responseData,
                         expiresAt: now + GET_CACHE_TTL
@@ -4750,6 +4520,213 @@ function cleanupExpiredCache() {
     });
     lastCacheCleanup = now;
 }
+const BOUNDED_PROGRAM_MAINNET = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
+const BOUNDED_PROGRAM_DEVNET = 'taro6CvKqwrYrDc16ufYgzQ2NZcyyVKStffbtudrhRu';
+const COMPUTE_BUDGET_PROGRAM = 'ComputeBudget111111111111111111111111111111';
+const SYSTEM_PROGRAM_ID = '11111111111111111111111111111111';
+const ALLOWED_SERVER_TX_PROGRAMS = new Set([
+    BOUNDED_PROGRAM_MAINNET,
+    BOUNDED_PROGRAM_DEVNET,
+    COMPUTE_BUDGET_PROGRAM,
+    SYSTEM_PROGRAM_ID,
+]);
+const SET_DOCUMENTS_DISCRIMINATOR = '79,46,72,73,24,79,66,245';
+const SET_DOCUMENTS_V2_DISCRIMINATOR = '22,236,242,185,145,61,26,39';
+const ALLOWED_BOUNDED_SET_DISCRIMINATORS = new Set([
+    SET_DOCUMENTS_DISCRIMINATOR,
+    SET_DOCUMENTS_V2_DISCRIMINATOR,
+]);
+class BorshCursor {
+    constructor(data, offset, label) {
+        this.data = data;
+        this.offset = offset;
+        this.label = label;
+    }
+    requireBytes(length, field) {
+        if (this.offset + length > this.data.length) {
+            throw new Error(`${this.label} has malformed Bounded instruction data while reading ${field}`);
+        }
+    }
+    readU8(field) {
+        this.requireBytes(1, field);
+        return this.data[this.offset++];
+    }
+    readU32(field) {
+        this.requireBytes(4, field);
+        const value = this.data[this.offset] |
+            (this.data[this.offset + 1] << 8) |
+            (this.data[this.offset + 2] << 16) |
+            (this.data[this.offset + 3] << 24);
+        this.offset += 4;
+        return value >>> 0;
+    }
+    skip(length, field) {
+        this.requireBytes(length, field);
+        this.offset += length;
+    }
+    readString(field) {
+        const length = this.readU32(`${field} length`);
+        this.requireBytes(length, field);
+        const raw = this.data.slice(this.offset, this.offset + length);
+        this.offset += length;
+        return bufferExports.Buffer.from(raw).toString('utf8');
+    }
+    skipBytes(field) {
+        const length = this.readU32(`${field} length`);
+        this.skip(length, field);
+    }
+    isAtEnd() {
+        return this.offset === this.data.length;
+    }
+}
+function discriminatorKey(data) {
+    return Array.from(data.slice(0, 8)).join(',');
+}
+function skipBoundedFieldValue(cursor) {
+    const option = cursor.readU8('operation value option');
+    if (option === 0)
+        return;
+    if (option !== 1) {
+        throw new Error('Server transaction has malformed Bounded field value option');
+    }
+    const variant = cursor.readU8('operation value variant');
+    switch (variant) {
+        case 0: // u64Val
+        case 1: // i64Val
+            cursor.skip(8, 'operation numeric value');
+            return;
+        case 2: // boolVal
+            cursor.skip(1, 'operation bool value');
+            return;
+        case 3: // stringVal
+            cursor.readString('operation string value');
+            return;
+        case 4: // addressVal
+            cursor.skip(32, 'operation address value');
+            return;
+        default:
+            throw new Error(`Server transaction has unsupported Bounded field value variant: ${variant}`);
+    }
+}
+function skipBoundedFieldOperation(cursor) {
+    cursor.readString('operation key');
+    skipBoundedFieldValue(cursor);
+    cursor.skip(1, 'operation kind');
+}
+function skipBoundedTxData(cursor, isV2) {
+    cursor.readString('txData plugin function key');
+    cursor.skipBytes('txData bytes');
+    if (isV2) {
+        cursor.skipBytes('txData raIndices');
+        return;
+    }
+    const raIndexCount = cursor.readU32('txData raIndices length');
+    cursor.skip(raIndexCount * 8, 'txData raIndices');
+}
+function normalizeOnchainPath(path) {
+    let normalized = path.startsWith('/') ? path.slice(1) : path;
+    if (normalized.endsWith('*') && normalized.length > 1) {
+        normalized = normalized.slice(0, -1);
+    }
+    if (normalized.endsWith('/')) {
+        normalized = normalized.slice(0, -1);
+    }
+    return normalized;
+}
+function parseBoundedSetDocumentsInstruction(data, label) {
+    if (data.length < 8) {
+        throw new Error(`${label} has malformed Bounded instruction data`);
+    }
+    const discriminator = discriminatorKey(data);
+    if (!ALLOWED_BOUNDED_SET_DISCRIMINATORS.has(discriminator)) {
+        throw new Error(`${label} contains unsupported Bounded instruction`);
+    }
+    const isV2 = discriminator === SET_DOCUMENTS_V2_DISCRIMINATOR;
+    const cursor = new BorshCursor(data, 8, label);
+    const appId = cursor.readString('appId');
+    const documentPaths = [];
+    const documentCount = cursor.readU32('documents length');
+    for (let i = 0; i < documentCount; i++) {
+        documentPaths.push(normalizeOnchainPath(cursor.readString('document path')));
+        const operationCount = cursor.readU32('operations length');
+        for (let j = 0; j < operationCount; j++) {
+            skipBoundedFieldOperation(cursor);
+        }
+    }
+    const deletePaths = [];
+    const deleteCount = cursor.readU32('delete paths length');
+    for (let i = 0; i < deleteCount; i++) {
+        deletePaths.push(normalizeOnchainPath(cursor.readString('delete path')));
+    }
+    const txDataCount = cursor.readU32('txData length');
+    for (let i = 0; i < txDataCount; i++) {
+        skipBoundedTxData(cursor, isV2);
+    }
+    const simulate = cursor.readU8('simulate');
+    if (simulate !== 0 && simulate !== 1) {
+        throw new Error(`${label} has malformed Bounded simulate flag`);
+    }
+    if (!cursor.isAtEnd()) {
+        throw new Error(`${label} has trailing Bounded instruction data`);
+    }
+    return { appId, documentPaths, deletePaths };
+}
+function assertSamePathSet(label, expectedPaths, actualPaths) {
+    const expected = new Set(expectedPaths.map(normalizeOnchainPath).filter(Boolean));
+    const actual = new Set(actualPaths.map(normalizeOnchainPath).filter(Boolean));
+    const missing = [...expected].filter(path => !actual.has(path));
+    const extra = [...actual].filter(path => !expected.has(path));
+    if (missing.length > 0 || extra.length > 0) {
+        const details = [
+            missing.length ? `missing paths: ${missing.join(', ')}` : '',
+            extra.length ? `unexpected paths: ${extra.join(', ')}` : '',
+        ].filter(Boolean).join('; ');
+        throw new Error(`${label} Bounded instruction paths do not match requested write paths (${details})`);
+    }
+}
+function validateServerSuppliedVersionedTransaction(transaction, options) {
+    var _a;
+    const { label, expectedAppId, expectedWritePaths } = options;
+    const accountKeys = transaction.message.staticAccountKeys;
+    let boundedInstructionCount = 0;
+    const actualWritePaths = [];
+    for (const ix of transaction.message.compiledInstructions) {
+        if (ix.programIdIndex >= accountKeys.length) {
+            throw new Error(`${label} has program ID in lookup table (not allowed)`);
+        }
+        const programId = accountKeys[ix.programIdIndex].toBase58();
+        if (!ALLOWED_SERVER_TX_PROGRAMS.has(programId)) {
+            throw new Error(`${label} contains unauthorized program: ${programId}`);
+        }
+        const data = ix.data instanceof Uint8Array ? ix.data : bufferExports.Buffer.from((_a = ix.data) !== null && _a !== void 0 ? _a : []);
+        if (programId === SYSTEM_PROGRAM_ID) {
+            throw new Error(`${label} contains unauthorized System Program instruction`);
+        }
+        if (programId === BOUNDED_PROGRAM_MAINNET || programId === BOUNDED_PROGRAM_DEVNET) {
+            boundedInstructionCount += 1;
+            const parsed = parseBoundedSetDocumentsInstruction(data, label);
+            if (parsed.appId !== expectedAppId) {
+                throw new Error(`${label} Bounded instruction appId does not match configured appId`);
+            }
+            actualWritePaths.push(...parsed.documentPaths, ...parsed.deletePaths);
+        }
+    }
+    if (boundedInstructionCount !== 1) {
+        throw new Error(`${label} must contain exactly one Bounded set-documents instruction`);
+    }
+    assertSamePathSet(label, expectedWritePaths, actualWritePaths);
+}
+function deserializeAndValidateServerTransaction(serializedTransaction, options) {
+    const txBytes = bufferExports.Buffer.from(serializedTransaction, 'base64');
+    const transaction = VersionedTransaction.deserialize(txBytes);
+    validateServerSuppliedVersionedTransaction(transaction, options);
+    return transaction;
+}
+function assertAllowedServerPreInstruction(ix, label) {
+    if (ix.programId.equals(SystemProgram.programId)) {
+        throw new Error(`${label} contains unauthorized System Program preInstruction`);
+    }
+}
 function classifyGetManyBatchError(error) {
     var _a, _b, _c;
     const err = error;
@@ -4794,13 +4771,14 @@ async function getMany(paths, opts = {}) {
     // H1: principal-scope getMany cache keys so one user's batch reads are never
     // served to another. Same `<appId:principal>|<path>:` shape used by get().
     const principalKey = await getReadPrincipalKey(opts._overrides);
+    const cacheEnabled = opts.cache === true && !opts.bypassCache && principalKey.cacheable;
     const results = new Array(paths.length);
     const uncachedIndices = [];
     const uncachedPaths = [];
     for (let i = 0; i < normalizedPaths.length; i++) {
         const normalizedPath = normalizedPaths[i];
-        const cacheKey = `${principalKey}|${normalizedPath}:`;
-        if (!opts.bypassCache && getCache[cacheKey] && now < getCache[cacheKey].expiresAt) {
+        const cacheKey = `${principalKey.key}|${normalizedPath}:`;
+        if (cacheEnabled && getCache[cacheKey] && now < getCache[cacheKey].expiresAt) {
             results[i] = { path: normalizedPath, data: getCache[cacheKey].data };
         }
         else {
@@ -4836,8 +4814,8 @@ async function getMany(paths, opts = {}) {
                         ? serverResult
                         : Object.assign(Object.assign({}, serverResult), { data: withBareId(serverResult.data) });
                     results[originalIndex] = normalizedResult;
-                    if (!normalizedResult.error && !opts.bypassCache) {
-                        const cacheKey = `${principalKey}|${normalizedPath}:`;
+                    if (!normalizedResult.error && cacheEnabled) {
+                        const cacheKey = `${principalKey.key}|${normalizedPath}:`;
                         getCache[cacheKey] = {
                             data: normalizedResult.data,
                             expiresAt: now + GET_CACHE_TTL
@@ -4852,7 +4830,7 @@ async function getMany(paths, opts = {}) {
                     };
                 }
             }
-            if (now - lastCacheCleanup > 5000) {
+            if (cacheEnabled && now - lastCacheCleanup > 5000) {
                 cleanupExpiredCache();
                 lastCacheCleanup = now;
             }
@@ -5003,11 +4981,12 @@ async function setMany(many, options) {
             }
             const curTx = transactions[0];
             let transactionResult;
+            const expectedWritePaths = documents.map(d => d.destinationPath);
             if (curTx.serializedTransaction) {
-                transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options);
+                transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             else {
-                transactionResult = await handleSolanaTransaction(curTx, authProvider, options);
+                transactionResult = await handleSolanaTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             // Sync items after all transactions are confirmed
             // Wait for 1.5 seconds to ensure all transactions are confirmed
@@ -5041,7 +5020,7 @@ async function setMany(many, options) {
     catch (error) {
         throw error;
     }
-    async function handleSolanaTransaction(tx, authProvider, options) {
+    async function handleSolanaTransaction(tx, authProvider, options, expectedWritePaths) {
         var _a, _b, _c, _d, _e;
         // NOTE (backwards-compat revert): a program-allowlist on server-supplied
         // `preInstructions` was tried here for the audit-8 SOL-drain concern, but it
@@ -5089,13 +5068,20 @@ async function setMany(many, options) {
             }))) !== null && _b !== void 0 ? _b : [],
         };
         const config = await getConfig();
+        if (tx.signedTransaction) {
+            deserializeAndValidateServerTransaction(tx.signedTransaction, {
+                label: 'Server signedTransaction',
+                expectedAppId: config.appId,
+                expectedWritePaths,
+            });
+        }
         const solTransaction = {
             appId: config.appId,
             txArgs: [solTransactionData],
             lutKey: (_c = tx.lutAddress) !== null && _c !== void 0 ? _c : null,
             additionalLutAddresses: tx.additionalLutAddresses,
             network: tx.network,
-            preInstructions: (_e = (_d = tx.preInstructions) === null || _d === void 0 ? void 0 : _d.map((ix) => {
+            preInstructions: (_e = (_d = tx.preInstructions) === null || _d === void 0 ? void 0 : _d.map((ix, index) => {
                 var _a;
                 const keys = (_a = ix.keys) === null || _a === void 0 ? void 0 : _a.map((k) => ({
                     pubkey: new PublicKey(k.pubkey),
@@ -5106,11 +5092,13 @@ async function setMany(many, options) {
                     ? SystemProgram.programId // prettier to use the constant
                     : new PublicKey(ix.programId);
                 const data = bufferExports.Buffer.from(ix.data);
-                return new TransactionInstruction({
+                const instruction = new TransactionInstruction({
                     keys,
                     programId,
                     data,
                 });
+                assertAllowedServerPreInstruction(instruction, `Server preInstruction[${index}]`);
+                return instruction;
             })) !== null && _e !== void 0 ? _e : [],
             // Server co-signed transaction (when CPI tx_data is present)
             signedTransaction: tx.signedTransaction,
@@ -5118,45 +5106,22 @@ async function setMany(many, options) {
         const transactionResult = await authProvider.runTransaction(undefined, solTransaction, options);
         return transactionResult;
     }
-    async function handlePreBuiltTransaction(tx, authProvider, options) {
-        var _a, _b;
+    async function handlePreBuiltTransaction(tx, authProvider, options, expectedWritePaths) {
+        var _a, _b, _c;
         const config = await getConfig();
-        const rpcUrl = config.rpcUrl || (tx.network === 'solana_devnet'
-            ? 'https://api.devnet.solana.com'
-            : 'https://api.mainnet-beta.solana.com');
-        const connection = new Connection(rpcUrl, 'confirmed');
-        const txBytes = bufferExports.Buffer.from(tx.serializedTransaction, 'base64');
-        const transaction = VersionedTransaction.deserialize(txBytes);
-        // Validate the transaction before signing: ensure only allowed programs
-        // and no unauthorized System program instructions (e.g., SOL transfers)
-        const BOUNDED_PROGRAM = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
-        const COMPUTE_BUDGET = 'ComputeBudget111111111111111111111111111111';
-        const SYSTEM_PROGRAM = '11111111111111111111111111111111';
-        const ALLOWED_PROGRAMS = new Set([BOUNDED_PROGRAM, COMPUTE_BUDGET, SYSTEM_PROGRAM]);
-        // System program instruction discriminators (first 4 bytes, little-endian u32)
-        const SYSTEM_TRANSFER = 2; // Transfer instruction index
-        const SYSTEM_TRANSFER_WITH_SEED = 11;
-        const accountKeys = transaction.message.staticAccountKeys;
-        for (const ix of transaction.message.compiledInstructions) {
-            if (ix.programIdIndex >= accountKeys.length) {
-                throw new Error('Pre-built transaction has program ID in lookup table (not allowed)');
-            }
-            const programId = accountKeys[ix.programIdIndex].toBase58();
-            if (!ALLOWED_PROGRAMS.has(programId)) {
-                throw new Error(`Pre-built transaction contains unauthorized program: ${programId}`);
-            }
-            // Block System program transfer instructions — a compromised DO could
-            // embed a SOL drain. Only allow createAccount/allocate (needed for PDA init).
-            if (programId === SYSTEM_PROGRAM && ix.data.length >= 4) {
-                const ixIndex = ix.data[0] | (ix.data[1] << 8) | (ix.data[2] << 16) | (ix.data[3] << 24);
-                if (ixIndex === SYSTEM_TRANSFER || ixIndex === SYSTEM_TRANSFER_WITH_SEED) {
-                    throw new Error('Pre-built transaction contains unauthorized System transfer instruction');
-                }
-            }
+        const transaction = deserializeAndValidateServerTransaction(tx.serializedTransaction, {
+            label: 'Pre-built transaction',
+            expectedAppId: config.appId,
+            expectedWritePaths,
+        });
+        const shouldSubmit = (options === null || options === void 0 ? void 0 : options.shouldSubmitTx) !== false;
+        const rpcUrl = (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+        if (shouldSubmit && !rpcUrl) {
+            throw new Error(`Pre-built Solana transaction submission requires init({ rpcUrl }) for ${tx.network}`);
         }
         const signedTx = await authProvider.signTransaction(transaction);
         const rawTx = signedTx.serialize();
-        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+        if (!shouldSubmit) {
             return {
                 transactionSignature: '',
                 signedTransaction: bufferExports.Buffer.from(rawTx).toString('base64'),
@@ -5164,6 +5129,7 @@ async function setMany(many, options) {
                 gasUsed: '0',
             };
         }
+        const connection = new Connection(rpcUrl, 'confirmed');
         const signature = await connection.sendRawTransaction(rawTx, {
             skipPreflight: false,
             maxRetries: 3,
@@ -5176,7 +5142,7 @@ async function setMany(many, options) {
         return {
             transactionSignature: signature,
             signedTransaction: bufferExports.Buffer.from(rawTx).toString('base64'),
-            blockNumber: (_b = (_a = confirmation.context) === null || _a === void 0 ? void 0 : _a.slot) !== null && _b !== void 0 ? _b : 0,
+            blockNumber: (_c = (_b = confirmation.context) === null || _b === void 0 ? void 0 : _b.slot) !== null && _c !== void 0 ? _c : 0,
             gasUsed: '0',
         };
     }
@@ -5393,7 +5359,7 @@ const MIN_RECONNECT_DELAY_JITTER_MS = 1000;
 const MAX_RECONNECT_DELAY_MS = 300000;
 const RECONNECT_DELAY_GROW_FACTOR = 1.8;
 const MIN_BROWSER_RECONNECT_INTERVAL_MS = 5000;
-const MAX_AUTH_REFRESH_RETRIES = 5;
+const WS_AUTH_EXPIRED_CODE = 'auth_expired';
 const WS_CONFIG = {
     // Keep retrying indefinitely so long outages recover without page refresh.
     maxRetries: Infinity,
@@ -5410,11 +5376,12 @@ const WS_V2_PATH = '/ws/v2';
 let browserReconnectHooksAttached = false;
 let lastBrowserTriggeredReconnectAt = 0;
 let reconnectInProgress = null;
+let ambientAuthFailure = null;
 // ============ Helper Functions ============
 function generateSubscriptionId() {
     return `sub_${Date.now()}_${Math.random().toString(36).substring(2, 11)}`;
 }
-function hashForKey$1(value) {
+function hashForKey(value) {
     let h = 5381;
     for (let i = 0; i < value.length; i++) {
         h = ((h << 5) + h + value.charCodeAt(i)) & 0x7fffffff;
@@ -5426,17 +5393,17 @@ function hashForKey$1(value) {
  * just the path/filter/shape. The `identity` prefix (`<appId>:<principal>`) keeps
  * a private subscription snapshot cached for one user from being delivered to a
  * different user who subscribes with the same options (shared process / SSR worker
- * / browser login-switch; this cache has a 5-minute TTL). When omitted (legacy
- * read-only helpers) we fall back to an `anon` scope.
+ * / browser login-switch; this cache has a 5-minute TTL). Callers must opt in
+ * before entries are read or written; no-auth subscriptions never populate an
+ * implicit anonymous cache bucket.
  */
 function getCacheKey(path, prompt, shape, limit, cursor, filter, identity) {
     const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
     const shapeKey = shape && Object.keys(shape).length > 0 ? JSON.stringify(shape) : '';
     const limitKey = limit !== undefined ? `:l${limit}` : '';
-    const cursorKey = cursor ? `:c${hashForKey$1(cursor)}` : '';
-    const filterKey = filter && Object.keys(filter).length > 0 ? `:f${hashForKey$1(JSON.stringify(filter))}` : '';
-    const identityKey = identity || 'anon';
-    return `${identityKey}|${normalizedPath}:${prompt || 'default'}:${shapeKey}${limitKey}${cursorKey}${filterKey}`;
+    const cursorKey = cursor ? `:c${hashForKey(cursor)}` : '';
+    const filterKey = filter && Object.keys(filter).length > 0 ? `:f${hashForKey(JSON.stringify(filter))}` : '';
+    return `${identity}|${normalizedPath}:${prompt || 'default'}:${shapeKey}${limitKey}${cursorKey}${filterKey}`;
 }
 /**
  * Derive an opaque identity string for the bearer material a subscription sends.
@@ -5444,7 +5411,7 @@ function getCacheKey(path, prompt, shape, limit, cursor, filter, identity) {
  * before the server has verified any claims.
  */
 function principalFromIdToken(idToken) {
-    return idToken ? `t${hashForKey$1(idToken)}` : 'anon';
+    return idToken ? `t${hashForKey(idToken)}` : null;
 }
 async function getSubscriptionIdentity(effectiveAppId, isServer, overrides) {
     // Per-subscription wallet override (server WalletClient.subscribe): key by
@@ -5453,16 +5420,21 @@ async function getSubscriptionIdentity(effectiveAppId, isServer, overrides) {
     if (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders) {
         try {
             const bearer = bearerFromAuthHeaders(await overrides._getAuthHeaders());
-            return `${effectiveAppId}:o${bearer ? principalFromIdToken(bearer) : 'anon'}`;
+            const principal = principalFromIdToken(bearer);
+            return principal
+                ? { key: `${effectiveAppId}:o${principal}`, cacheable: true }
+                : { key: `${effectiveAppId}:oanon`, cacheable: false };
         }
         catch (_a) {
-            // Couldn't resolve the override identity — use a unique key so we never
-            // collide with another principal's cached entry.
-            return `${effectiveAppId}:o${principalFromIdToken(null)}-${safeBtoa(String(connectionEpoch++))}`;
+            // Couldn't resolve the override identity — do not use response cache.
+            return { key: `${effectiveAppId}:o-uncacheable-${safeBtoa(String(connectionEpoch++))}`, cacheable: false };
         }
     }
     const idToken = await getIdToken(isServer);
-    return `${effectiveAppId}:${principalFromIdToken(idToken)}`;
+    const principal = principalFromIdToken(idToken);
+    return principal
+        ? { key: `${effectiveAppId}:${principal}`, cacheable: true }
+        : { key: `${effectiveAppId}:anon`, cacheable: false };
 }
 /** Extract the bare bearer token from a `{ Authorization: 'Bearer <jwt>' }` map. */
 function bearerFromAuthHeaders(headers) {
@@ -5492,6 +5464,41 @@ function getTokenExpirationTime(token) {
         return null;
     }
 }
+function makeAuthExpiredError(message, status) {
+    const err = new Error(`${WS_AUTH_EXPIRED_CODE}: ${message}`);
+    err.code = WS_AUTH_EXPIRED_CODE;
+    if (status !== undefined)
+        err.status = status;
+    return err;
+}
+function isAuthExpiredError(error) {
+    return !!error && typeof error === 'object' && error.code === WS_AUTH_EXPIRED_CODE;
+}
+function normalizeAuthExpiredError(error, fallbackMessage) {
+    var _a, _b;
+    if (isAuthExpiredError(error))
+        return error;
+    const status = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.code;
+    return makeAuthExpiredError(fallbackMessage, status);
+}
+function rememberAmbientAuthFailure(error) {
+    ambientAuthFailure = error;
+    return error;
+}
+function failConnectionAuth(connection, error) {
+    connection.authFailure = error;
+    connection.pendingAuthToken = null;
+    connection.isConnecting = false;
+    connection.isConnected = false;
+    connection.isAuthenticating = false;
+    for (const [, pending] of connection.pendingSubscriptions) {
+        pending.reject(error);
+    }
+    connection.pendingSubscriptions.clear();
+    for (const subscription of connection.subscriptions.values()) {
+        notifyErrorCallbacks(subscription, error);
+    }
+}
 function scheduleTokenRefresh(connection, isServer) {
     // Clear any existing timer
     if (connection.tokenRefreshTimer) {
@@ -5559,23 +5566,32 @@ async function getFreshAuthToken(isServer) {
     var _a, _b, _c, _d, _e;
     const currentToken = await getIdToken(isServer);
     if (!currentToken) {
+        if (ambientAuthFailure) {
+            throw ambientAuthFailure;
+        }
         return null;
     }
     if (!isTokenExpired(currentToken)) {
+        ambientAuthFailure = null;
         return currentToken;
     }
+    if (ambientAuthFailure) {
+        throw ambientAuthFailure;
+    }
     // Token is expired — attempt refresh
+    const refreshToken = await getRefreshToken(isServer);
+    if (!refreshToken) {
+        console.warn('[WS v2] Token expired but no refresh token available');
+        throw rememberAmbientAuthFailure(makeAuthExpiredError('Authentication expired and no refresh token is available'));
+    }
     try {
-        const refreshToken = await getRefreshToken(isServer);
-        if (!refreshToken) {
-            console.warn('[WS v2] Token expired but no refresh token available');
-            return null;
-        }
         const refreshData = await refreshSession(refreshToken, getSessionIssuer(isServer));
         if (refreshData && refreshData.idToken && refreshData.accessToken) {
             await updateIdTokenAndAccessToken(refreshData.idToken, refreshData.accessToken, isServer, refreshData.refreshToken);
+            ambientAuthFailure = null;
             return refreshData.idToken;
         }
+        throw makeAuthExpiredError('Authentication refresh returned an incomplete session');
     }
     catch (error) {
         // Log only the status — the raw axios error carries config.data (the refresh
@@ -5592,12 +5608,22 @@ async function getFreshAuthToken(isServer) {
                 console.warn('[WS v2] Failed to clear stale session:', clearError);
             }
         }
+        throw rememberAmbientAuthFailure(normalizeAuthExpiredError(error, 'Authentication expired and refresh failed'));
+    }
+}
+async function getConnectionAuthToken(isServer, authTokenProvider) {
+    if (!authTokenProvider) {
+        return getFreshAuthToken(isServer);
+    }
+    try {
+        const token = await authTokenProvider();
+        if (token)
+            return token;
+        throw makeAuthExpiredError('Authenticated websocket token provider returned no token');
+    }
+    catch (error) {
+        throw normalizeAuthExpiredError(error, 'Authenticated websocket token provider failed');
     }
-    // Return null instead of the expired token to prevent infinite 401 reconnect storms.
-    // The server accepts unauthenticated connections; auth-required subscriptions will
-    // receive per-subscription errors via onError callbacks.
-    console.warn('[WS v2] Token refresh failed, connecting without auth to prevent reconnect storm');
-    return null;
 }
 function hasDisconnectedActiveConnections() {
     for (const connection of connections.values()) {
@@ -5672,13 +5698,26 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
     const roomKey = roomKeyFromRoutePath(routePath);
     // A wallet-scoped subscription (server WalletClient) gets its OWN connection
     // keyed by the wallet identity, so its WS authenticates as that wallet and
-    // never shares a connection (or token) with the ambient env identity.
+    // never shares a connection (or token) with any top-level server caller.
     const base = roomKey ? `${appId}#room#${roomKey}` : appId;
     const connKey = principalKey ? `${base}#id#${principalKey}` : base;
     let connection = connections.get(connKey);
     if (connection && connection.ws) {
+        if (connection.authFailure) {
+            throw connection.authFailure;
+        }
+        try {
+            await getConnectionAuthToken(isServer, authTokenProvider);
+        }
+        catch (error) {
+            const authError = normalizeAuthExpiredError(error, 'Authentication expired and refresh failed');
+            failConnectionAuth(connection, authError);
+            throw authError;
+        }
+        connection.authFailure = null;
         return connection;
     }
+    let initialAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
     // Create new connection
     connection = {
         ws: null,
@@ -5696,6 +5735,7 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         pendingAuthToken: null,
         tokenRefreshTimer: null,
         consecutiveAuthFailures: 0,
+        authFailure: null,
     };
     connections.set(connKey, connection);
     // URL provider for reconnection with fresh tokens
@@ -5715,29 +5755,25 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         }
         // Resolve auth token if available. A wallet-scoped connection resolves
         // its token from the wallet's own session (self-refreshing); all others
-        // use the ambient env/web session. The token is sent as the first WS
+        // use the browser session or fail closed for top-level server calls. The token is sent as the first WS
         // frame after open, never as a URL query parameter.
-        const authToken = connection.authTokenProvider
-            ? await connection.authTokenProvider().catch(() => null)
-            : await getFreshAuthToken(isServer);
+        let authToken;
+        try {
+            authToken = initialAuthToken !== undefined
+                ? initialAuthToken
+                : await getConnectionAuthToken(isServer, connection.authTokenProvider);
+            initialAuthToken = undefined;
+        }
+        catch (error) {
+            const authError = normalizeAuthExpiredError(error, 'Authentication expired and refresh failed');
+            failConnectionAuth(connection, authError);
+            throw authError;
+        }
         connection.pendingAuthToken = authToken || null;
         if (authToken) {
             // Successful token acquisition — reset failure counter
             connection.consecutiveAuthFailures = 0;
-        }
-        else {
-            // Check if user WAS authenticated (had a token that expired).
-            // If so, retry with exponential backoff before falling back to unauthenticated.
-            const expiredToken = await getIdToken(isServer);
-            if (expiredToken && isTokenExpired(expiredToken)) {
-                connection.consecutiveAuthFailures++;
-                if (connection.consecutiveAuthFailures <= MAX_AUTH_REFRESH_RETRIES) {
-                    console.warn(`[WS v2] Auth refresh failed (attempt ${connection.consecutiveAuthFailures}/${MAX_AUTH_REFRESH_RETRIES}), retrying with backoff`);
-                    throw new Error('Auth token refresh failed, retrying with backoff');
-                }
-                console.warn('[WS v2] Auth refresh retries exhausted, falling back to unauthenticated connection');
-            }
-            // No token at all (never authenticated) or retries exhausted — connect without auth
+            connection.authFailure = null;
         }
         return wsUrl.toString();
     };
@@ -5751,15 +5787,7 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         connection.isConnecting = false;
         connection.isConnected = true;
         // NOTE: Do NOT reset consecutiveAuthFailures here. It is reset when a
-        // fresh auth token is actually obtained (in urlProvider, line ~389) or on
-        // an explicit auth change (reconnectWithNewAuthV2, line ~854). Resetting
-        // on every 'open' event created an infinite loop: auth fails 5x → connect
-        // without auth → open resets counter → disconnect → auth fails 5x again →
-        // repeat forever, hammering /session/refresh and causing 429s.
-        //
-        // An elevated counter is safe for anonymous/guest sessions: when there's no
-        // token at all (getIdToken returns null), the counter is never checked —
-        // urlProvider skips straight to unauthenticated connection.
+        // fresh auth token is actually obtained or on an explicit auth change.
         // Schedule periodic token freshness checks
         scheduleTokenRefresh(connection, isServer);
         if (connection.pendingAuthToken) {
@@ -5834,8 +5862,10 @@ function handleServerMessage(connection, message) {
                 // If we already received data for this subscription, treat subscribed
                 // as an ack only and avoid regressing to an older snapshot.
                 if (subscription.lastData === undefined) {
-                    const cacheKey = getCacheKey(subscription.path, subscription.prompt, subscription.shape, subscription.limit, subscription.cursor, subscription.filter, subscription.identity);
-                    responseCache.set(cacheKey, { data: message.data, timestamp: Date.now() });
+                    if (subscription.cache) {
+                        const cacheKey = getCacheKey(subscription.path, subscription.prompt, subscription.shape, subscription.limit, subscription.cursor, subscription.filter, subscription.identity);
+                        responseCache.set(cacheKey, { data: message.data, timestamp: Date.now() });
+                    }
                     subscription.lastData = message.data;
                     notifyCallbacks(subscription, message.data);
                 }
@@ -5861,8 +5891,10 @@ function handleServerMessage(connection, message) {
             const subscription = connection.subscriptions.get(message.subscriptionId);
             if (subscription) {
                 // Update cache
-                const cacheKey = getCacheKey(subscription.path, subscription.prompt, subscription.shape, subscription.limit, subscription.cursor, subscription.filter, subscription.identity);
-                responseCache.set(cacheKey, { data: message.data, timestamp: Date.now() });
+                if (subscription.cache) {
+                    const cacheKey = getCacheKey(subscription.path, subscription.prompt, subscription.shape, subscription.limit, subscription.cursor, subscription.filter, subscription.identity);
+                    responseCache.set(cacheKey, { data: message.data, timestamp: Date.now() });
+                }
                 // Store last data
                 subscription.lastData = message.data;
                 // Notify callbacks
@@ -6074,26 +6106,43 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
     // subscribes with identical options (shared process / SSR / login-switch).
     // Per-subscription wallet override (server WalletClient.subscribe). When set,
     // the connection authenticates + caches under the wallet's identity instead of
-    // the ambient env keypair — so a `createWalletClient` caller can subscribe
-    // without setting BOUNDED_PRIVATE_KEY (and never crashes resolving it).
+    // any top-level server caller — so a `createWalletClient` caller can
+    // subscribe through its explicit wallet session.
     const overrides = subscriptionOptions._overrides;
     const authTokenProvider = (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders)
         ? async () => bearerFromAuthHeaders(await overrides._getAuthHeaders()) || null
         : undefined;
-    const identity = await getSubscriptionIdentity(effectiveAppId, config.isServer, overrides);
+    const identityInfo = await getSubscriptionIdentity(effectiveAppId, config.isServer, overrides);
+    const identity = identityInfo.key;
+    const responseCacheEnabled = subscriptionOptions.cache === true && identityInfo.cacheable;
     const principalKey = authTokenProvider ? identity : undefined;
-    const cacheKey = getCacheKey(normalizedPath, subscriptionOptions.prompt, subscriptionOptions.shape, subscriptionOptions.limit, subscriptionOptions.cursor, subscriptionOptions.filter, identity);
-    // Deliver cached data immediately if available
-    const cachedEntry = responseCache.get(cacheKey);
+    const cacheKey = responseCacheEnabled
+        ? getCacheKey(normalizedPath, subscriptionOptions.prompt, subscriptionOptions.shape, subscriptionOptions.limit, subscriptionOptions.cursor, subscriptionOptions.filter, identity)
+        : null;
+    // Get or create connection for this routing target (room-scoped when a
+    // room route is supplied by the live helper, else the app-level connection).
+    let connection;
+    try {
+        connection = await getOrCreateConnection(effectiveAppId, config.isServer, roomRoutePath, authTokenProvider, principalKey);
+    }
+    catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        if (subscriptionOptions.onError) {
+            subscriptionOptions.onError(err);
+            return async () => { };
+        }
+        throw err;
+    }
+    // Deliver cached data immediately if available, but only after connection
+    // auth preflight has succeeded. An expired authenticated session must receive
+    // an auth error, not a stale private snapshot followed by a failed connect.
+    const cachedEntry = cacheKey ? responseCache.get(cacheKey) : undefined;
     if (cachedEntry && Date.now() - cachedEntry.timestamp < CACHE_TTL && subscriptionOptions.onData) {
         setTimeout(() => {
             var _a;
             (_a = subscriptionOptions.onData) === null || _a === void 0 ? void 0 : _a.call(subscriptionOptions, addIdsToSubscriptionData(cachedEntry.data));
         }, 0);
     }
-    // Get or create connection for this routing target (room-scoped when a
-    // room route is supplied by the live helper, else the app-level connection).
-    const connection = await getOrCreateConnection(effectiveAppId, config.isServer, roomRoutePath, authTokenProvider, principalKey);
     // Check if we already have a subscription for this path+prompt+shape+limit+cursor+filter+sort
     const shapeKey = subscriptionOptions.shape ? JSON.stringify(subscriptionOptions.shape) : '';
     const filterKey = subscriptionOptions.filter ? JSON.stringify(subscriptionOptions.filter) : '';
@@ -6112,10 +6161,18 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
         }
     }
     if (existingSubscription) {
+        if (responseCacheEnabled) {
+            existingSubscription.cache = true;
+        }
         // Add callback to existing subscription
         existingSubscription.callbacks.push(subscriptionOptions);
-        // Deliver last known data immediately
-        if (existingSubscription.lastData !== undefined && subscriptionOptions.onData) {
+        // Deliver last known data immediately only for explicit, principal-bound
+        // cache opt-in. Otherwise joining an existing subscription can replay a
+        // stale private snapshot without a fresh server auth result.
+        if (responseCacheEnabled &&
+            existingSubscription.cache &&
+            existingSubscription.lastData !== undefined &&
+            subscriptionOptions.onData) {
             setTimeout(() => {
                 var _a;
                 (_a = subscriptionOptions.onData) === null || _a === void 0 ? void 0 : _a.call(subscriptionOptions, addIdsToSubscriptionData(existingSubscription.lastData));
@@ -6139,6 +6196,7 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
         includeSubPaths: (_b = subscriptionOptions.includeSubPaths) !== null && _b !== void 0 ? _b : false,
         callbacks: [subscriptionOptions],
         lastData: undefined,
+        cache: responseCacheEnabled,
         identity,
     };
     connection.subscriptions.set(subscriptionId, subscription);
@@ -6270,19 +6328,21 @@ function clearCacheV2(path) {
  */
 function getCachedDataV2(path, prompt) {
     const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-    // H1: response caches are identity-scoped (`<identity>|<path>:...`). Resolve
-    // the caller's identity from an active subscription for this path (sync) so
-    // an authenticated user gets THEIR cached snapshot rather than the 'anon'
-    // bucket (which would wrongly return null). No matching sub → null (safe).
+    // H1: response caches are identity-scoped (`<identity>|<path>:...`) and
+    // opt-in. Resolve the caller's identity from an active cache-enabled
+    // subscription for this path. No matching sub → null (safe).
     let identity;
     outer: for (const connection of connections.values()) {
         for (const sub of connection.subscriptions.values()) {
-            if (sub.path === normalizedPath && sub.prompt === prompt) {
+            if (sub.cache && sub.path === normalizedPath && sub.prompt === prompt) {
                 identity = sub.identity;
                 break outer;
             }
         }
     }
+    if (!identity) {
+        return null;
+    }
     const cacheKey = getCacheKey(path, prompt, undefined, undefined, undefined, undefined, identity);
     const cachedEntry = responseCache.get(cacheKey);
     if (cachedEntry && Date.now() - cachedEntry.timestamp < CACHE_TTL) {
@@ -6314,6 +6374,7 @@ async function reconnectWithNewAuthV2() {
     }
 }
 async function doReconnectWithNewAuth() {
+    ambientAuthFailure = null;
     // SECURITY (H1): the logged-in identity is changing (login / logout / switch).
     // Wipe ALL principal-scoped read caches so the new identity can never observe
     // data cached for the previous one. Clear both the WS response cache and the
@@ -6335,7 +6396,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return realtimeStore; });
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-D3t7PyZl.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -6355,6 +6416,7 @@ async function doReconnectWithNewAuth() {
         connection.pendingUnsubscriptions.clear();
         // Reset auth failure counter — this is a proactive reconnect (login, token refresh)
         connection.consecutiveAuthFailures = 0;
+        connection.authFailure = null;
         // Close the WebSocket (this triggers reconnection in ReconnectingWebSocket)
         // We use reconnect() which will close and re-open with fresh URL (including new token)
         try {
@@ -6365,7 +6427,7 @@ async function doReconnectWithNewAuth() {
         }
     }
 }
-// ============ CRUD over WebSocket ============
+// ============ WebSocket request helpers ============
 const WS_REQUEST_TIMEOUT_MS = 30000;
 function generateRequestId() {
     return `req_${Date.now()}_${Math.random().toString(36).substring(2, 11)}`;
@@ -6381,104 +6443,6 @@ function hasActiveConnection() {
     }
     return false;
 }
-async function waitForConnectionAuthenticated(connection) {
-    if (!connection.isAuthenticating || !connection.ws)
-        return;
-    const ws = connection.ws;
-    await new Promise((resolve, reject) => {
-        let timeout;
-        let cleanup = () => { };
-        const onMessage = (event) => {
-            try {
-                const message = JSON.parse(event.data);
-                if ((message === null || message === void 0 ? void 0 : message.type) === 'authenticated') {
-                    cleanup();
-                    resolve();
-                }
-            }
-            catch (_a) {
-                // Other frames are handled by the main listener.
-            }
-        };
-        const onClose = () => {
-            cleanup();
-            reject(new Error('WebSocket disconnected during authentication'));
-        };
-        const onError = () => {
-            cleanup();
-            reject(new Error('WebSocket authentication failed'));
-        };
-        cleanup = () => {
-            clearTimeout(timeout);
-            ws.removeEventListener('message', onMessage);
-            ws.removeEventListener('close', onClose);
-            ws.removeEventListener('error', onError);
-        };
-        timeout = setTimeout(() => {
-            cleanup();
-            reject(new Error('WebSocket authentication timeout'));
-        }, 10000);
-        if (!connection.isAuthenticating) {
-            cleanup();
-            resolve();
-            return;
-        }
-        ws.addEventListener('message', onMessage);
-        ws.addEventListener('close', onClose);
-        ws.addEventListener('error', onError);
-    });
-}
-async function sendRequest(msgBuilder) {
-    const config = await getConfig();
-    const appId = config.appId;
-    const connection = await getOrCreateConnection(appId, config.isServer);
-    // Wait for the connection to be open (getOrCreateConnection may return
-    // while still connecting).
-    if (!connection.isConnected && connection.ws) {
-        await new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                var _a;
-                (_a = connection.ws) === null || _a === void 0 ? void 0 : _a.removeEventListener('open', onOpen);
-                reject(new Error('WebSocket connection timeout'));
-            }, 10000);
-            const onOpen = () => { clearTimeout(timeout); resolve(); };
-            if (connection.isConnected) {
-                clearTimeout(timeout);
-                resolve();
-                return;
-            }
-            connection.ws.addEventListener('open', onOpen);
-        });
-    }
-    if (!connection.ws || !connection.isConnected) {
-        throw new Error('WebSocket connection not available');
-    }
-    await waitForConnectionAuthenticated(connection);
-    const requestId = generateRequestId();
-    const message = msgBuilder(requestId);
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            connection.pendingRequests.delete(requestId);
-            reject(new Error(`WebSocket request timed out after ${WS_REQUEST_TIMEOUT_MS}ms`));
-        }, WS_REQUEST_TIMEOUT_MS);
-        connection.pendingRequests.set(requestId, { resolve, reject, timer });
-        try {
-            connection.ws.send(JSON.stringify(message));
-        }
-        catch (error) {
-            connection.pendingRequests.delete(requestId);
-            clearTimeout(timer);
-            reject(error);
-        }
-    });
-}
-async function wsGet(path) {
-    return sendRequest((requestId) => ({
-        type: 'get',
-        requestId,
-        path,
-    }));
-}
 /**
  * Send a live-room intent over the EXISTING per-room socket (fire-and-forget).
  * Returns true if it was sent over an open connection, false if there is no
@@ -6537,31 +6501,6 @@ function wsIntentReliable(appId, roomRoutePath, intent) {
         }
     });
 }
-async function wsSet(documents) {
-    return sendRequest((requestId) => ({
-        type: 'set',
-        requestId,
-        documents,
-    }));
-}
-async function wsQuery(path, opts) {
-    return sendRequest((requestId) => (Object.assign(Object.assign(Object.assign(Object.assign({ type: 'query', requestId,
-        path }, ((opts === null || opts === void 0 ? void 0 : opts.filter) ? { filter: opts.filter } : {})), ((opts === null || opts === void 0 ? void 0 : opts.sort) ? { sort: opts.sort } : {})), ((opts === null || opts === void 0 ? void 0 : opts.limit) !== undefined ? { limit: opts.limit } : {})), ((opts === null || opts === void 0 ? void 0 : opts.includeSubPaths) ? { includeSubPaths: opts.includeSubPaths } : {}))));
-}
-async function wsDelete(path) {
-    return sendRequest((requestId) => ({
-        type: 'delete',
-        requestId,
-        path,
-    }));
-}
-async function wsGetMany(paths) {
-    return sendRequest((requestId) => ({
-        type: 'getMany',
-        requestId,
-        paths,
-    }));
-}
 
 /**
  * WebSocket Subscription Module
@@ -6742,1008 +6681,6 @@ function toMillis(seconds) {
     return seconds * 1000;
 }
 
-// ---------------------------------------------------------------------------
-// realtime-store.ts — Client-side state manager for realtime apps.
-//
-// Manages: WS connection, in-memory state, IDB persistence, optimistic
-// writes, delta accumulation, loading states, ephemeral/durable tiers.
-// ---------------------------------------------------------------------------
-// ---------------------------------------------------------------------------
-// IDB helpers (lazy-loaded, non-blocking)
-// ---------------------------------------------------------------------------
-const IDB_NAME = 'bounded-realtime';
-const IDB_STORE = 'subscriptions';
-const IDB_VERSION = 1;
-let idbPromise = null;
-function getIDB() {
-    if (idbPromise)
-        return idbPromise;
-    if (typeof indexedDB === 'undefined') {
-        return Promise.reject(new Error('IndexedDB not available'));
-    }
-    idbPromise = new Promise((resolve, reject) => {
-        const req = indexedDB.open(IDB_NAME, IDB_VERSION);
-        req.onupgradeneeded = () => {
-            const db = req.result;
-            if (!db.objectStoreNames.contains(IDB_STORE)) {
-                db.createObjectStore(IDB_STORE);
-            }
-        };
-        req.onsuccess = () => resolve(req.result);
-        req.onerror = () => reject(req.error);
-    });
-    return idbPromise;
-}
-async function idbGet(key) {
-    try {
-        const db = await getIDB();
-        return new Promise((resolve) => {
-            const tx = db.transaction(IDB_STORE, 'readonly');
-            const store = tx.objectStore(IDB_STORE);
-            const req = store.get(key);
-            req.onsuccess = () => { var _a; return resolve((_a = req.result) !== null && _a !== void 0 ? _a : null); };
-            req.onerror = () => resolve(null);
-        });
-    }
-    catch (_a) {
-        return null;
-    }
-}
-async function idbSet(key, value) {
-    try {
-        const db = await getIDB();
-        return new Promise((resolve) => {
-            const tx = db.transaction(IDB_STORE, 'readwrite');
-            const store = tx.objectStore(IDB_STORE);
-            store.put(value, key);
-            tx.oncomplete = () => resolve();
-            tx.onerror = () => resolve();
-        });
-    }
-    catch (_a) {
-        // Best-effort persistence
-    }
-}
-// ---------------------------------------------------------------------------
-// RealtimeStore
-// ---------------------------------------------------------------------------
-let nextRequestId = 1;
-function hashForKey(value) {
-    let h = 5381;
-    for (let i = 0; i < value.length; i++) {
-        h = ((h << 5) + h + value.charCodeAt(i)) & 0x7fffffff;
-    }
-    return h.toString(36);
-}
-function principalFromToken(token) {
-    return token ? `t${hashForKey(token)}` : 'anon';
-}
-class RealtimeStore {
-    constructor() {
-        this.ws = null;
-        this.wsUrl = '';
-        this.appId = '';
-        this.subscriptions = new Map();
-        this.pendingRequests = new Map();
-        this.connectPromise = null;
-        this.reconnectTimer = null;
-        this.reconnectDelay = 1000;
-        this.maxReconnectDelay = 30000;
-        this.idbFlushTimer = null;
-        this.idbDirtyKeys = new Set();
-        this.closed = false;
-        this.authToken = null;
-        this.authPrincipalKey = 'anon';
-        this.authenticating = false;
-        this.suppressNextReconnect = false;
-        this.isServer = false;
-        this.tokenRefreshTimer = null;
-        // -----------------------------------------------------------------------
-        // WebSocket connection
-        // -----------------------------------------------------------------------
-        this.initPromise = null;
-    }
-    // -----------------------------------------------------------------------
-    // Initialization
-    // -----------------------------------------------------------------------
-    async init() {
-        const config = await getConfig();
-        this.appId = config.appId;
-        this.wsUrl = config.wsApiUrl;
-        this.isServer = config.isServer;
-        await this.refreshToken();
-        this.startTokenRefresh();
-    }
-    async refreshToken() {
-        let token = null;
-        try {
-            const { getIdToken } = await Promise.resolve().then(function () { return utils; });
-            token = await getIdToken(this.isServer);
-        }
-        catch ( /* no auth available */_a) { /* no auth available */ }
-        this.authToken = token !== null && token !== void 0 ? token : null;
-        this.authPrincipalKey = principalFromToken(this.authToken);
-    }
-    startTokenRefresh() {
-        if (this.tokenRefreshTimer)
-            return;
-        this.tokenRefreshTimer = setInterval(async () => {
-            const prevPrincipal = this.authPrincipalKey;
-            await this.refreshToken();
-            if (this.authPrincipalKey !== prevPrincipal) {
-                await this.applyAuthPrincipalChange();
-                if (this.subscriptions.size > 0) {
-                    await this.ensureConnected().catch(() => {
-                        this.setAllSubscriptionStatus('error');
-                    });
-                }
-            }
-        }, 5 * 60 * 1000); // Check every 5 minutes
-    }
-    async ensureInitialized() {
-        if (this.appId)
-            return;
-        if (!this.initPromise)
-            this.initPromise = this.init();
-        await this.initPromise;
-    }
-    async ensureCurrentAuth() {
-        await this.ensureInitialized();
-        const prevPrincipal = this.authPrincipalKey;
-        await this.refreshToken();
-        if (this.authPrincipalKey !== prevPrincipal) {
-            await this.applyAuthPrincipalChange();
-        }
-    }
-    rekeySubscriptionsForPrincipal() {
-        const subs = Array.from(this.subscriptions.values());
-        this.subscriptions.clear();
-        for (const sub of subs) {
-            this.subscriptions.set(this.getSubKey(sub.path, sub.options), sub);
-        }
-    }
-    async applyAuthPrincipalChange() {
-        if (this.idbFlushTimer) {
-            clearTimeout(this.idbFlushTimer);
-            this.idbFlushTimer = null;
-        }
-        this.idbDirtyKeys.clear();
-        this.rekeySubscriptionsForPrincipal();
-        for (const sub of this.subscriptions.values()) {
-            sub.docs.clear();
-            sub.ref.current = sub.docs;
-            sub.error = null;
-            sub.isStale = false;
-            let loaded = false;
-            if (sub.tier !== 'ephemeral') {
-                const cached = await idbGet(this.idbKey(sub.path));
-                if (cached && Array.isArray(cached)) {
-                    for (const doc of cached) {
-                        if (doc && doc._id)
-                            sub.docs.set(doc._id, doc);
-                    }
-                    sub.ref.current = sub.docs;
-                    loaded = sub.docs.size > 0;
-                }
-            }
-            sub.status = loaded ? 'cached' : 'loading';
-            sub.isStale = loaded;
-            if (loaded)
-                this.notifySubscription(sub);
-            else
-                this.notifyState(sub);
-        }
-        if (this.ws) {
-            const ws = this.ws;
-            this.ws = null;
-            this.connectPromise = null;
-            this.suppressNextReconnect = true;
-            try {
-                ws.close(1000, 'Auth changed');
-            }
-            catch ( /* ignore */_a) { /* ignore */ }
-        }
-    }
-    async ensureConnected() {
-        var _a;
-        await this.ensureCurrentAuth();
-        if (((_a = this.ws) === null || _a === void 0 ? void 0 : _a.readyState) === WebSocket.OPEN && !this.authenticating)
-            return;
-        if (this.connectPromise)
-            return this.connectPromise;
-        this.connectPromise = this.connect();
-        return this.connectPromise;
-    }
-    connect() {
-        return new Promise((resolve, reject) => {
-            if (this.closed) {
-                reject(new Error('Store closed'));
-                return;
-            }
-            const params = new URLSearchParams();
-            params.set('apiKey', this.appId);
-            const url = `${this.wsUrl}?${params.toString()}`;
-            const ws = new WebSocket(url);
-            this.ws = ws;
-            let authTimer = null;
-            const finishConnected = () => {
-                if (authTimer) {
-                    clearTimeout(authTimer);
-                    authTimer = null;
-                }
-                this.authenticating = false;
-                ws.removeEventListener('error', onError);
-                this.reconnectDelay = 1000;
-                this.connectPromise = null;
-                this.resubscribeAll();
-                resolve();
-            };
-            const onOpen = () => {
-                if (!this.authToken) {
-                    finishConnected();
-                    return;
-                }
-                this.authenticating = true;
-                authTimer = setTimeout(() => {
-                    this.authenticating = false;
-                    this.connectPromise = null;
-                    try {
-                        ws.close(1008, 'Authentication timeout');
-                    }
-                    catch ( /* ignore */_a) { /* ignore */ }
-                    reject(new Error('WebSocket authentication timeout'));
-                }, 10000);
-                try {
-                    ws.send(JSON.stringify({ type: 'auth', token: this.authToken }));
-                }
-                catch (e) {
-                    if (authTimer)
-                        clearTimeout(authTimer);
-                    this.authenticating = false;
-                    this.connectPromise = null;
-                    reject(e);
-                }
-            };
-            const onError = (e) => {
-                if (authTimer)
-                    clearTimeout(authTimer);
-                this.authenticating = false;
-                ws.removeEventListener('open', onOpen);
-                this.connectPromise = null;
-                reject(new Error('WebSocket connection failed'));
-            };
-            ws.addEventListener('open', onOpen, { once: true });
-            ws.addEventListener('error', onError, { once: true });
-            ws.addEventListener('message', (event) => {
-                if (this.authenticating) {
-                    try {
-                        const msg = JSON.parse(typeof event.data === 'string' ? event.data : new TextDecoder().decode(event.data));
-                        if ((msg === null || msg === void 0 ? void 0 : msg.type) === 'authenticated') {
-                            finishConnected();
-                            return;
-                        }
-                    }
-                    catch ( /* fall through to normal handling */_a) { /* fall through to normal handling */ }
-                }
-                this.handleMessage(event.data);
-            });
-            ws.addEventListener('close', () => {
-                if (authTimer)
-                    clearTimeout(authTimer);
-                if (this.ws !== ws) {
-                    if (this.suppressNextReconnect)
-                        this.suppressNextReconnect = false;
-                    return;
-                }
-                this.authenticating = false;
-                this.ws = null;
-                this.connectPromise = null;
-                this.rejectAllPending('WebSocket closed');
-                this.setAllSubscriptionStatus('reconnecting');
-                if (this.suppressNextReconnect) {
-                    this.suppressNextReconnect = false;
-                    return;
-                }
-                this.scheduleReconnect();
-            });
-        });
-    }
-    scheduleReconnect() {
-        if (this.closed)
-            return;
-        if (this.reconnectTimer)
-            clearTimeout(this.reconnectTimer);
-        this.reconnectTimer = setTimeout(() => {
-            this.ensureConnected().catch(() => {
-                this.reconnectDelay = Math.min(this.reconnectDelay * 2, this.maxReconnectDelay);
-                this.scheduleReconnect();
-            });
-        }, this.reconnectDelay);
-    }
-    resubscribeAll() {
-        for (const sub of this.subscriptions.values()) {
-            this.sendSubscribe(sub);
-        }
-    }
-    // -----------------------------------------------------------------------
-    // Message handling
-    // -----------------------------------------------------------------------
-    handleMessage(raw) {
-        const text = typeof raw === 'string' ? raw : new TextDecoder().decode(raw);
-        let msg;
-        try {
-            msg = JSON.parse(text);
-        }
-        catch (_a) {
-            return;
-        }
-        switch (msg.type) {
-            case 'snapshot':
-                this.handleSnapshot(msg);
-                break;
-            case 'delta':
-                this.handleDelta(msg);
-                break;
-            case 'result':
-                this.handleResult(msg);
-                break;
-            case 'error':
-                this.handleError(msg);
-                break;
-            case 'pong':
-                break;
-            case 'authenticated':
-                break;
-            // v1 compat: handle legacy message types during transition
-            case 'subscribed':
-                this.handleSnapshot(Object.assign(Object.assign({}, msg), { type: 'snapshot', docs: msg.data }));
-                break;
-            case 'data':
-                // Legacy full-snapshot delta — treat as snapshot replacement
-                this.handleLegacyData(msg);
-                break;
-            case 'response':
-                this.handleResult(Object.assign(Object.assign({}, msg), { type: 'result', ok: msg.status === 200, doc: msg.data }));
-                break;
-        }
-    }
-    handleSnapshot(msg) {
-        var _a, _b, _c;
-        const subId = (_a = msg.id) !== null && _a !== void 0 ? _a : msg.subscriptionId;
-        if (!subId)
-            return;
-        const sub = this.findSubscriptionById(subId);
-        if (!sub)
-            return;
-        const docs = (_c = (_b = msg.docs) !== null && _b !== void 0 ? _b : msg.data) !== null && _c !== void 0 ? _c : [];
-        const docsArray = Array.isArray(docs) ? docs : [docs];
-        sub.docs.clear();
-        for (const doc of docsArray) {
-            if (doc && doc._id) {
-                sub.docs.set(doc._id, doc);
-            }
-        }
-        sub.ref.current = sub.docs;
-        sub.status = 'live';
-        sub.isStale = false;
-        sub.error = null;
-        this.notifySubscription(sub);
-        this.markIdbDirty(sub.path);
-    }
-    handleDelta(msg) {
-        var _a, _b;
-        const subId = (_a = msg.id) !== null && _a !== void 0 ? _a : msg.subscriptionId;
-        if (!subId)
-            return;
-        const sub = this.findSubscriptionById(subId);
-        if (!sub)
-            return;
-        if (sub.tier === 'ephemeral') {
-            // Ephemeral: just overwrite, no accumulation logic
-            if (msg.change === 'removed' && msg.docId) {
-                sub.docs.delete(msg.docId);
-            }
-            else if (msg.doc && msg.doc._id) {
-                sub.docs.set(msg.doc._id, msg.doc);
-            }
-            sub.ref.current = sub.docs;
-            if (sub.options.mode !== 'ref') {
-                this.notifySubscription(sub);
-            }
-            return;
-        }
-        // Durable/checkpointed: full delta handling
-        switch (msg.change) {
-            case 'added':
-            case 'modified':
-                if (msg.doc && msg.doc._id) {
-                    sub.docs.set(msg.doc._id, msg.doc);
-                }
-                break;
-            case 'removed':
-                if (msg.docId) {
-                    sub.docs.delete(msg.docId);
-                }
-                else if ((_b = msg.doc) === null || _b === void 0 ? void 0 : _b._id) {
-                    sub.docs.delete(msg.doc._id);
-                }
-                break;
-        }
-        sub.ref.current = sub.docs;
-        this.notifySubscription(sub);
-        this.markIdbDirty(sub.path);
-    }
-    handleLegacyData(msg) {
-        // Legacy v1 format: 'data' message with full snapshot or single doc
-        const subId = msg.subscriptionId;
-        if (!subId)
-            return;
-        const sub = this.findSubscriptionById(subId);
-        if (!sub)
-            return;
-        if (Array.isArray(msg.data)) {
-            // Full snapshot replacement
-            sub.docs.clear();
-            for (const doc of msg.data) {
-                if (doc && doc._id)
-                    sub.docs.set(doc._id, doc);
-            }
-        }
-        else if (msg.data && msg.data._id) {
-            // Single doc update
-            sub.docs.set(msg.data._id, msg.data);
-        }
-        else if (msg.data === null) ;
-        sub.ref.current = sub.docs;
-        sub.status = 'live';
-        sub.isStale = false;
-        this.notifySubscription(sub);
-        this.markIdbDirty(sub.path);
-    }
-    handleResult(msg) {
-        var _a, _b, _c, _d;
-        const requestId = msg.requestId;
-        if (!requestId)
-            return;
-        const pending = this.pendingRequests.get(requestId);
-        if (!pending)
-            return;
-        this.pendingRequests.delete(requestId);
-        clearTimeout(pending.timeout);
-        const ok = (_a = msg.ok) !== null && _a !== void 0 ? _a : (msg.status === 200);
-        if (ok) {
-            pending.resolve((_c = (_b = msg.doc) !== null && _b !== void 0 ? _b : msg.data) !== null && _c !== void 0 ? _c : true);
-        }
-        else {
-            pending.reject(new Error((_d = msg.error) !== null && _d !== void 0 ? _d : 'Operation failed'));
-        }
-    }
-    handleError(msg) {
-        var _a, _b, _c;
-        const error = new Error((_a = msg.message) !== null && _a !== void 0 ? _a : (msg.code ? `${msg.code}: Server error` : 'Server error'));
-        if (msg.code)
-            error.code = msg.code;
-        if (msg.subscriptionId || msg.id)
-            error.subscriptionId = (_b = msg.subscriptionId) !== null && _b !== void 0 ? _b : msg.id;
-        const requestId = msg.requestId;
-        if (requestId) {
-            const pending = this.pendingRequests.get(requestId);
-            if (pending) {
-                this.pendingRequests.delete(requestId);
-                clearTimeout(pending.timeout);
-                pending.reject(error);
-            }
-        }
-        const subId = (_c = msg.subscriptionId) !== null && _c !== void 0 ? _c : msg.id;
-        if (subId) {
-            const sub = this.findSubscriptionById(subId);
-            if (sub) {
-                sub.status = 'error';
-                sub.error = error;
-                this.notifyState(sub);
-                for (const callback of Array.from(sub.errorCallbacks)) {
-                    try {
-                        callback(error);
-                    }
-                    catch ( /* swallow */_d) { /* swallow */ }
-                }
-            }
-        }
-    }
-    // -----------------------------------------------------------------------
-    // Subscribe
-    // -----------------------------------------------------------------------
-    async subscribe(path, opts = {}) {
-        var _a;
-        await this.ensureCurrentAuth();
-        const tier = (_a = opts.tier) !== null && _a !== void 0 ? _a : 'durable';
-        const subKey = this.getSubKey(path, opts);
-        let sub = this.subscriptions.get(subKey);
-        if (sub) {
-            // Existing subscription — add callback
-            if (opts.onData)
-                sub.callbacks.add(opts.onData);
-            if (opts.onState)
-                sub.stateCallbacks.add(opts.onState);
-            if (opts.onError)
-                sub.errorCallbacks.add(opts.onError);
-            // Immediately deliver current state
-            if (opts.onData && sub.docs.size > 0) {
-                opts.onData(this.docsToArray(sub));
-            }
-            if (opts.onState) {
-                opts.onState(this.getState(sub));
-            }
-            return this.createUnsubscribe(subKey, sub.id, opts.onData, opts.onState, opts.onError);
-        }
-        // New subscription
-        const subId = `sub_${nextRequestId++}`;
-        sub = {
-            id: subId,
-            path,
-            tier,
-            options: opts,
-            docs: new Map(),
-            status: 'idle',
-            isStale: false,
-            error: null,
-            callbacks: new Set(opts.onData ? [opts.onData] : []),
-            stateCallbacks: new Set(opts.onState ? [opts.onState] : []),
-            errorCallbacks: new Set(opts.onError ? [opts.onError] : []),
-            ref: { current: new Map() },
-        };
-        this.subscriptions.set(subKey, sub);
-        // Step 1: Load from IDB (durable/checkpointed only)
-        if (tier !== 'ephemeral') {
-            const cached = await idbGet(this.idbKey(path));
-            if (cached && Array.isArray(cached)) {
-                for (const doc of cached) {
-                    if (doc && doc._id)
-                        sub.docs.set(doc._id, doc);
-                }
-                sub.ref.current = sub.docs;
-                sub.status = 'cached';
-                sub.isStale = true;
-                this.notifySubscription(sub);
-            }
-        }
-        // Step 2: Connect and subscribe via WS
-        sub.status = sub.docs.size > 0 ? 'cached' : 'loading';
-        this.notifyState(sub);
-        try {
-            await this.ensureConnected();
-            this.sendSubscribe(sub);
-        }
-        catch (_b) {
-            sub.status = 'error';
-            sub.error = new Error('Connection failed');
-            this.notifyState(sub);
-        }
-        return this.createUnsubscribe(subKey, sub.id, opts.onData, opts.onState, opts.onError);
-    }
-    getRef(path, opts = {}) {
-        var _a;
-        const subKey = this.getSubKey(path, opts);
-        const sub = this.subscriptions.get(subKey);
-        if (sub)
-            return sub.ref;
-        // Auto-subscribe in ref mode
-        const ref = { current: new Map() };
-        this.subscribe(path, Object.assign(Object.assign({}, opts), { mode: 'ref', tier: 'ephemeral' })).catch(() => { });
-        const newSub = this.subscriptions.get(this.getSubKey(path, Object.assign(Object.assign({}, opts), { tier: 'ephemeral' })));
-        return (_a = newSub === null || newSub === void 0 ? void 0 : newSub.ref) !== null && _a !== void 0 ? _a : ref;
-    }
-    // -----------------------------------------------------------------------
-    // CRUD operations
-    // -----------------------------------------------------------------------
-    async set(path, doc) {
-        var _a;
-        await this.ensureConnected();
-        // Resolve operations (Increment, Time.Now) client-side for optimistic update
-        const resolvedDoc = this.resolveOperations(doc, path);
-        // Optimistic update: apply to local state immediately
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        const collectionPath = this.getCollectionPath(normalizedPath);
-        const optimisticDoc = Object.assign(Object.assign({ _id: normalizedPath, pathId: normalizedPath }, resolvedDoc), { 
-            // System timestamp field name: the Bounded worker stamps the neutral
-            // `_updatedAt`; the underscore-prefixed `_updated_at` metadata mirror.
-            // Match it so the optimistic doc lines up with the server's confirmation.
-            [isBoundedNetwork() ? '_updatedAt' : '_updated_at']: Date.now() });
-        const sub = this.findSubscriptionByPath(collectionPath);
-        let prevDoc = null;
-        if (sub) {
-            prevDoc = (_a = sub.docs.get(normalizedPath)) !== null && _a !== void 0 ? _a : null;
-            sub.docs.set(normalizedPath, optimisticDoc);
-            sub.ref.current = sub.docs;
-            this.notifySubscription(sub);
-        }
-        // Send to server
-        const requestId = `r_${nextRequestId++}`;
-        try {
-            const result = await this.sendRequest(requestId, {
-                type: 'set',
-                requestId,
-                documents: [{ destinationPath: normalizedPath, document: doc }],
-            });
-            // Replace optimistic doc with server-confirmed version
-            if (sub && result && typeof result === 'object') {
-                const serverDoc = Array.isArray(result) ? result[0] : result;
-                if (serverDoc && serverDoc._id) {
-                    sub.docs.set(serverDoc._id, serverDoc);
-                    sub.ref.current = sub.docs;
-                    this.notifySubscription(sub);
-                    this.markIdbDirty(collectionPath);
-                }
-            }
-            return Array.isArray(result) ? result[0] : result;
-        }
-        catch (err) {
-            // Revert optimistic update
-            if (sub) {
-                if (prevDoc) {
-                    sub.docs.set(normalizedPath, prevDoc);
-                }
-                else {
-                    sub.docs.delete(normalizedPath);
-                }
-                sub.ref.current = sub.docs;
-                this.notifySubscription(sub);
-            }
-            throw err;
-        }
-    }
-    async get(path) {
-        await this.ensureCurrentAuth();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        // Check local subscriptions first
-        const collectionPath = this.getCollectionPath(normalizedPath);
-        const sub = this.findSubscriptionByPath(collectionPath);
-        if (sub && sub.status === 'live') {
-            const doc = sub.docs.get(normalizedPath);
-            return doc !== null && doc !== void 0 ? doc : null;
-        }
-        // One-shot WS fetch
-        await this.ensureConnected();
-        const requestId = `r_${nextRequestId++}`;
-        return this.sendRequest(requestId, {
-            type: 'get',
-            requestId,
-            path: normalizedPath,
-        });
-    }
-    async getMany(paths) {
-        await this.ensureConnected();
-        const normalizedPaths = paths.map(p => p.startsWith('/') ? p.slice(1) : p);
-        const requestId = `r_${nextRequestId++}`;
-        return this.sendRequest(requestId, {
-            type: 'getMany',
-            requestId,
-            paths: normalizedPaths,
-        });
-    }
-    async delete(path) {
-        var _a;
-        await this.ensureConnected();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        // Optimistic: remove from local state
-        const collectionPath = this.getCollectionPath(normalizedPath);
-        const sub = this.findSubscriptionByPath(collectionPath);
-        let prevDoc = null;
-        if (sub) {
-            prevDoc = (_a = sub.docs.get(normalizedPath)) !== null && _a !== void 0 ? _a : null;
-            sub.docs.delete(normalizedPath);
-            sub.ref.current = sub.docs;
-            this.notifySubscription(sub);
-        }
-        const requestId = `r_${nextRequestId++}`;
-        try {
-            await this.sendRequest(requestId, {
-                type: 'delete',
-                requestId,
-                path: normalizedPath,
-            });
-            if (sub)
-                this.markIdbDirty(collectionPath);
-        }
-        catch (err) {
-            // Revert
-            if (sub && prevDoc) {
-                sub.docs.set(normalizedPath, prevDoc);
-                sub.ref.current = sub.docs;
-                this.notifySubscription(sub);
-            }
-            throw err;
-        }
-    }
-    async query(path, opts) {
-        await this.ensureConnected();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        const requestId = `r_${nextRequestId++}`;
-        return this.sendRequest(requestId, Object.assign(Object.assign(Object.assign(Object.assign({ type: 'query', requestId, path: normalizedPath }, ((opts === null || opts === void 0 ? void 0 : opts.filter) ? { filter: opts.filter } : {})), ((opts === null || opts === void 0 ? void 0 : opts.sort) ? { sort: opts.sort } : {})), ((opts === null || opts === void 0 ? void 0 : opts.limit) !== undefined ? { limit: opts.limit } : {})), ((opts === null || opts === void 0 ? void 0 : opts.includeSubPaths) ? { includeSubPaths: true } : {})));
-    }
-    async count(path) {
-        var _a;
-        await this.ensureConnected();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        const requestId = `r_${nextRequestId++}`;
-        const result = await this.sendRequest(requestId, {
-            type: 'count',
-            requestId,
-            path: normalizedPath,
-        });
-        return typeof result === 'number' ? result : ((_a = result === null || result === void 0 ? void 0 : result.value) !== null && _a !== void 0 ? _a : 0);
-    }
-    async aggregate(path, operation, opts) {
-        await this.ensureConnected();
-        const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-        const requestId = `r_${nextRequestId++}`;
-        return this.sendRequest(requestId, Object.assign({ type: 'aggregate', requestId, path: normalizedPath, operation }, ((opts === null || opts === void 0 ? void 0 : opts.field) ? { field: opts.field } : {})));
-    }
-    // -----------------------------------------------------------------------
-    // Helpers
-    // -----------------------------------------------------------------------
-    sendSubscribe(sub) {
-        if (!this.ws || this.ws.readyState !== WebSocket.OPEN)
-            return;
-        const msg = {
-            type: 'subscribe',
-            subscriptionId: sub.id,
-            path: sub.path,
-        };
-        if (sub.options.filter)
-            msg.filter = sub.options.filter;
-        if (sub.options.includeSubPaths)
-            msg.includeSubPaths = true;
-        if (sub.options.limit)
-            msg.limit = sub.options.limit;
-        if (sub.options.prompt)
-            msg.prompt = sub.options.prompt;
-        this.ws.send(JSON.stringify(msg));
-    }
-    sendRequest(requestId, msg) {
-        return new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                this.pendingRequests.delete(requestId);
-                reject(new Error('Request timed out'));
-            }, 30000);
-            this.pendingRequests.set(requestId, { resolve, reject, timeout });
-            if (this.ws && this.ws.readyState === WebSocket.OPEN) {
-                this.ws.send(JSON.stringify(msg));
-            }
-            else {
-                this.pendingRequests.delete(requestId);
-                clearTimeout(timeout);
-                reject(new Error('WebSocket not connected'));
-            }
-        });
-    }
-    notifySubscription(sub) {
-        const data = this.docsToArray(sub);
-        const callbacks = Array.from(sub.callbacks);
-        for (const cb of callbacks) {
-            try {
-                cb(data);
-            }
-            catch ( /* swallow callback errors */_a) { /* swallow callback errors */ }
-        }
-        this.notifyState(sub);
-    }
-    notifyState(sub) {
-        const state = this.getState(sub);
-        const callbacks = Array.from(sub.stateCallbacks);
-        for (const cb of callbacks) {
-            try {
-                cb(state);
-            }
-            catch ( /* swallow */_a) { /* swallow */ }
-        }
-    }
-    getState(sub) {
-        return {
-            data: this.docsToArray(sub),
-            status: sub.status,
-            isStale: sub.isStale,
-            error: sub.error,
-        };
-    }
-    docsToArray(sub) {
-        return Array.from(sub.docs.values());
-    }
-    findSubscriptionById(id) {
-        for (const sub of this.subscriptions.values()) {
-            if (sub.id === id)
-                return sub;
-        }
-        return undefined;
-    }
-    findSubscriptionByPath(collectionPath) {
-        for (const sub of this.subscriptions.values()) {
-            const subPath = sub.path.startsWith('/') ? sub.path.slice(1) : sub.path;
-            if (subPath === collectionPath)
-                return sub;
-            if (collectionPath.startsWith(subPath + '/'))
-                return sub;
-        }
-        return undefined;
-    }
-    getCollectionPath(docPath) {
-        const segments = docPath.split('/');
-        if (segments.length % 2 === 0) {
-            return segments.slice(0, -1).join('/');
-        }
-        return docPath;
-    }
-    getSubKey(path, opts) {
-        const parts = [this.appId, this.authPrincipalKey, path];
-        if (opts.filter)
-            parts.push(JSON.stringify(opts.filter));
-        if (opts.prompt)
-            parts.push(opts.prompt);
-        if (opts.tier)
-            parts.push(opts.tier);
-        return parts.join('::');
-    }
-    idbKey(path) {
-        return `${this.appId}:${this.authPrincipalKey}:${path}`;
-    }
-    markIdbDirty(path) {
-        const sub = this.findSubscriptionByPath(path);
-        if (sub && sub.tier === 'ephemeral')
-            return;
-        this.idbDirtyKeys.add(path);
-        if (!this.idbFlushTimer) {
-            this.idbFlushTimer = setTimeout(() => {
-                this.flushIdb();
-                this.idbFlushTimer = null;
-            }, 500);
-        }
-    }
-    async flushIdb() {
-        const keys = Array.from(this.idbDirtyKeys);
-        this.idbDirtyKeys.clear();
-        for (const path of keys) {
-            const sub = this.findSubscriptionByPath(path);
-            if (sub && sub.tier !== 'ephemeral') {
-                const docs = this.docsToArray(sub);
-                await idbSet(this.idbKey(path), docs);
-            }
-        }
-    }
-    createUnsubscribe(subKey, subId, onData, onState, onError) {
-        return async () => {
-            var _a;
-            const sub = (_a = this.subscriptions.get(subKey)) !== null && _a !== void 0 ? _a : this.findSubscriptionById(subId);
-            if (!sub)
-                return;
-            const currentSubKey = this.getSubKey(sub.path, sub.options);
-            if (onData)
-                sub.callbacks.delete(onData);
-            if (onState)
-                sub.stateCallbacks.delete(onState);
-            if (onError)
-                sub.errorCallbacks.delete(onError);
-            // If no more callbacks, unsubscribe entirely
-            if (sub.callbacks.size === 0 && sub.stateCallbacks.size === 0 && sub.errorCallbacks.size === 0) {
-                this.subscriptions.delete(subKey);
-                this.subscriptions.delete(currentSubKey);
-                if (this.ws && this.ws.readyState === WebSocket.OPEN) {
-                    this.ws.send(JSON.stringify({
-                        type: 'unsubscribe',
-                        subscriptionId: sub.id,
-                    }));
-                }
-            }
-        };
-    }
-    resolveOperations(doc, path) {
-        var _a;
-        if (!doc || typeof doc !== 'object')
-            return doc;
-        const resolved = {};
-        for (const [key, value] of Object.entries(doc)) {
-            if (value && typeof value === 'object' && !Array.isArray(value) && value.operation) {
-                const op = value;
-                if (op.operation === 'time' && op.value === 'now') {
-                    resolved[key] = Math.floor(Date.now() / 1000);
-                }
-                else if (op.operation === 'increment') {
-                    // For optimistic: get current value and add
-                    const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
-                    const collectionPath = this.getCollectionPath(normalizedPath);
-                    const sub = this.findSubscriptionByPath(collectionPath);
-                    const existing = sub === null || sub === void 0 ? void 0 : sub.docs.get(normalizedPath);
-                    const current = (_a = existing === null || existing === void 0 ? void 0 : existing[key]) !== null && _a !== void 0 ? _a : 0;
-                    resolved[key] = (typeof current === 'number' ? current : 0) + op.value;
-                }
-                else {
-                    resolved[key] = value;
-                }
-            }
-            else {
-                resolved[key] = value;
-            }
-        }
-        return resolved;
-    }
-    rejectAllPending(reason) {
-        for (const [requestId, pending] of this.pendingRequests) {
-            clearTimeout(pending.timeout);
-            pending.reject(new Error(reason));
-        }
-        this.pendingRequests.clear();
-    }
-    setAllSubscriptionStatus(status) {
-        for (const sub of this.subscriptions.values()) {
-            sub.status = status;
-            this.notifyState(sub);
-        }
-    }
-    // -----------------------------------------------------------------------
-    // Lifecycle
-    // -----------------------------------------------------------------------
-    close() {
-        this.closed = true;
-        if (this.reconnectTimer)
-            clearTimeout(this.reconnectTimer);
-        if (this.idbFlushTimer)
-            clearTimeout(this.idbFlushTimer);
-        if (this.tokenRefreshTimer)
-            clearInterval(this.tokenRefreshTimer);
-        this.flushIdb();
-        if (this.ws) {
-            this.ws.close(1000, 'Store closed');
-            this.ws = null;
-        }
-        this.rejectAllPending('Store closed');
-        this.subscriptions.clear();
-    }
-    async reconnectWithNewAuth() {
-        if (this.closed)
-            return;
-        await this.ensureInitialized();
-        await this.refreshToken();
-        await this.applyAuthPrincipalChange();
-        if (this.subscriptions.size > 0) {
-            await this.ensureConnected().catch((error) => {
-                this.setAllSubscriptionStatus('error');
-                for (const sub of this.subscriptions.values()) {
-                    sub.error = error instanceof Error ? error : new Error(String(error));
-                    this.notifyState(sub);
-                }
-            });
-        }
-    }
-}
-// ---------------------------------------------------------------------------
-// Singleton instance
-// ---------------------------------------------------------------------------
-let storeInstance = null;
-function getRealtimeStore() {
-    if (!storeInstance) {
-        storeInstance = new RealtimeStore();
-    }
-    return storeInstance;
-}
-function resetRealtimeStore() {
-    if (storeInstance) {
-        storeInstance.close();
-        storeInstance = null;
-    }
-}
-async function reconnectRealtimeStoreWithNewAuth() {
-    if (storeInstance) {
-        await storeInstance.reconnectWithNewAuth();
-    }
-}
-
-var realtimeStore = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    RealtimeStore: RealtimeStore,
-    getRealtimeStore: getRealtimeStore,
-    reconnectRealtimeStoreWithNewAuth: reconnectRealtimeStoreWithNewAuth,
-    resetRealtimeStore: resetRealtimeStore
-});
-
 // ---------------------------------------------------------------------------
 // functions.ts -- Bounded Functions client (the imperative escape hatch).
 //
@@ -7799,11 +6736,12 @@ async function invoke(name, args = {}, opts = {}) {
     const base = (config.functionsUrl || DEFAULT_FUNCTIONS_URL).replace(/\/$/, '');
     // Attach the caller's session token automatically (same token as data calls).
     // A wallet-scoped call (server WalletClient.invoke) resolves the token from the
-    // wallet's own session; all others use the ambient env/web session.
+    // wallet's own session; browser calls use the active web session. Top-level
+    // server calls fail closed because there is no ambient server signer.
     const authHeader = ((_a = opts._overrides) === null || _a === void 0 ? void 0 : _a._getAuthHeaders)
         ? await opts._overrides._getAuthHeaders()
         : await createAuthHeader(config.isServer);
-    const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, ((_b = stripAuthHeaders(opts.headers)) !== null && _b !== void 0 ? _b : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
+    const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId }, ((_b = stripAuthHeaders(opts.headers)) !== null && _b !== void 0 ? _b : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
     const controller = new AbortController();
     const timeoutMs = (_c = opts.timeoutMs) !== null && _c !== void 0 ? _c : 60000;
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -7872,8 +6810,8 @@ const functions = { invoke };
 // Subscribing to your view: a per-player view doc lives at
 // `<roomPath>/view/<myUserId>` (the policy declares
 // `rooms/$roomId/view/$userId` ephemeral with `read: $userId == @user.id`).
-// Wallet-address keyed view paths remain supported through opts.address for
-// older policies, but new live rooms should key views by @user.id.
+// View paths key only by @user.id; wallet-address aliases are intentionally not
+// accepted by this helper.
 // ---------------------------------------------------------------------------
 class LiveIntentError extends Error {
     constructor(message, statusCode, details) {
@@ -7967,7 +6905,7 @@ async function intent(roomPath, intent, opts = {}) {
     const overrideHeaders = withoutAuthorization((_b = opts._overrides) === null || _b === void 0 ? void 0 : _b.headers);
     const buildHeaders = async () => {
         const authHeader = await liveAuthHeader(config.isServer, opts._overrides);
-        return Object.assign(Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, (overrideHeaders !== null && overrideHeaders !== void 0 ? overrideHeaders : {})), (extraHeaders !== null && extraHeaders !== void 0 ? extraHeaders : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
+        return Object.assign(Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId }, (overrideHeaders !== null && overrideHeaders !== void 0 ? overrideHeaders : {})), (extraHeaders !== null && extraHeaders !== void 0 ? extraHeaders : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
     };
     const controller = new AbortController();
     const timeoutMs = (_c = opts.timeoutMs) !== null && _c !== void 0 ? _c : 60000;
@@ -8028,7 +6966,7 @@ async function status(roomPath, opts = {}) {
     const normalizedRoomPath = roomPath.replace(/\/$/, '');
     const config = await getConfig();
     const base = realtimeHttpBase(config.wsApiUrl);
-    const headers = Object.assign({ 'X-App-Id': config.appId, 'X-Public-App-Id': config.appId }, ((_a = opts.headers) !== null && _a !== void 0 ? _a : {}));
+    const headers = Object.assign({ 'X-App-Id': config.appId }, ((_a = opts.headers) !== null && _a !== void 0 ? _a : {}));
     const controller = new AbortController();
     const timeoutMs = (_b = opts.timeoutMs) !== null && _b !== void 0 ? _b : 15000;
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -8070,29 +7008,27 @@ async function status(roomPath, opts = {}) {
  *   subscribe('<roomPath>/view/<myUserId>', { onData, onError })
  *
  * The view id defaults to the logged-in user's @user.id (from the session token
- * claims); pass `opts.userId` to override. `opts.address` is kept as a legacy
- * alias for older wallet-address keyed policies. Returns the unsubscribe
- * function (a Promise<() => Promise<void>>, same as `subscribe`).
+ * claims); pass `opts.userId` to override. Returns the unsubscribe function
+ * (a Promise<() => Promise<void>>, same as `subscribe`).
  *
  * Note: this is a browser-first helper (the WS subscription manager is
  * browser-oriented). Server consumers should use `live.intent`.
  */
 async function subscribeView(roomPath, opts) {
-    var _a, _b, _c;
     if (!roomPath || typeof roomPath !== 'string') {
         throw new LiveIntentError('A room path is required');
     }
     if (!opts || typeof opts.onData !== 'function') {
         throw new LiveIntentError('subscribeView requires an onData callback');
     }
-    let viewUserId = (_a = opts.userId) !== null && _a !== void 0 ? _a : opts.address;
+    let viewUserId = opts.userId;
     if (!viewUserId) {
         const config = await getConfig();
         const info = await getUserInfo(config.isServer);
         // getUserInfo returns the RAW idToken payload. The universal live view key
-        // is @user.id (`custom:userId`); wallet-address keyed views are still
-        // resolved as a compatibility fallback for older policies.
-        viewUserId = (_c = (_b = info === null || info === void 0 ? void 0 : info['custom:userId']) !== null && _b !== void 0 ? _b : info === null || info === void 0 ? void 0 : info['custom:walletAddress']) !== null && _c !== void 0 ? _c : info === null || info === void 0 ? void 0 : info.address;
+        // is @user.id (`custom:userId`); wallet-address keyed compatibility aliases
+        // are intentionally not accepted.
+        viewUserId = info === null || info === void 0 ? void 0 : info['custom:userId'];
     }
     if (!viewUserId || typeof viewUserId !== 'string') {
         throw new LiveIntentError('Could not resolve a player view id for subscribeView; pass opts.userId or log in first');
@@ -8162,5 +7098,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { EFFECT_INTENT_ADDRESS, FunctionInvokeError, InsufficientBalanceError, LiveIntentError, ReactNativeSessionManager, RealtimeStore, ServerSessionManager, WebSessionManager, aggregate, buildSetDocumentsTransaction, clearCache, closeAllSubscriptions, convertRemainingAccounts, count, createSessionWithSignature, defineLiveModule, deriveUserIdentityFromIdToken, docId, functions, genAuthNonce, genSolanaMessage, get, getActiveSessionManager, getCachedData, getConfig, getFiles, getIdToken, getMany, getRealtimeStore, getWebhookKeysUrl, hasActiveConnection, increment, init, invoke as invokeFunction, isEffectResult, live, intent as liveIntent, status as liveStatus, now, queryAggregate, reconnectWithNewAuth, refreshSession, resetRealtimeStore, revokeSession, runExpression, runExpressionMany, runQuery, runQueryMany, search, serverTimestamp, set, setFile, setMany, signAndSubmitTransaction, signMessage, signSessionCreateMessage, signTransaction, subscribe, subscribeView as subscribeLiveView, toMillis, toSeconds, withEffects, wsDelete, wsGet, wsGetMany, wsQuery, wsSet };
+export { EFFECT_INTENT_ADDRESS, FunctionInvokeError, InsufficientBalanceError, LiveIntentError, ReactNativeSessionManager, ServerSessionManager, WebSessionManager, aggregate, buildSetDocumentsTransaction, clearCache, closeAllSubscriptions, convertRemainingAccounts, count, createSessionWithSignature, defineLiveModule, deriveUserIdentityFromIdToken, docId, functions, genAuthNonce, genSolanaMessage, get, getActiveSessionManager, getCachedData, getConfig, getFiles, getIdToken, getMany, getWebhookKeysUrl, hasActiveConnection, increment, init, invoke as invokeFunction, isEffectResult, live, intent as liveIntent, status as liveStatus, now, queryAggregate, reconnectWithNewAuth, refreshSession, revokeSession, runExpression, runExpressionMany, runQuery, runQueryMany, search, serverTimestamp, set, setFile, setMany, signAndSubmitTransaction, signMessage, signSessionCreateMessage, signTransaction, subscribe, subscribeView as subscribeLiveView, toMillis, toSeconds, withEffects };
 //# sourceMappingURL=index.mjs.map