@bounded-sh/core 0.0.53 → 0.0.55

package/dist/{index-DE-xgEvG.js → index-BXvTkFw2.js}

@@ -5,7 +5,11 @@ var nacl = require('tweetnacl');
 var ReconnectingWebSocket = require('reconnecting-websocket');
 var BN = require('bn.js');
 
-let clientConfig = {
+// The pristine default config. `clientConfig` (the module global) starts as a
+// copy of this and is mutated by init(); createClient() resolves fresh scoped
+// configs from this pristine template so a scoped instance never inherits a
+// prior init()'s state.
+const DEFAULT_CLIENT_CONFIG = {
     // User configured settings
     name: '',
     logoUrl: '',
@@ -30,6 +34,7 @@ let clientConfig = {
     authProvider: null,
     isServer: false,
 };
+let clientConfig = Object.assign({}, DEFAULT_CLIENT_CONFIG);
 let isInitialized = false;
 // Callers awaiting getConfig() before init() completes. Resolved synchronously
 // by init() — the previous 50ms setInterval poll added up to 50ms of latency
@@ -84,9 +89,32 @@ function getWebhookKeysUrl() {
  * Bounded must use the deterministic server aggregation, not the legacy AI query).
  */
 function isBoundedNetwork() {
-    const net = clientConfig.network;
+    return isBoundedNetworkConfig(clientConfig);
+}
+/**
+ * Config-scoped variant of {@link isBoundedNetwork}: reports whether a SPECIFIC
+ * config (e.g. a scoped `createClient()` instance's) targets a Bounded network,
+ * rather than the module global. Used so a scoped client routes count/aggregate
+ * by its OWN network, not the global one.
+ */
+function isBoundedNetworkConfig(config) {
+    const net = config.network;
     return typeof net === 'string' && net in BOUNDED_NETWORKS;
 }
+/**
+ * Merge a partial config over a base config, applying the Bounded endpoint
+ * precedence rule used everywhere: defaults (or `base`) < network preset <
+ * explicit fields. Pure - never touches module state. Shared by `init` (base =
+ * the current global) and `createClient` (base = the pristine defaults) so both
+ * resolve endpoints identically. Throws on an unsupported `network`.
+ */
+function resolveClientConfig(base, newConfig) {
+    if (newConfig.network !== undefined && !(newConfig.network in BOUNDED_NETWORKS)) {
+        throw new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`);
+    }
+    const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
+    return Object.assign(Object.assign(Object.assign({}, base), preset), newConfig);
+}
 function init(newConfig) {
     return new Promise((resolve, reject) => {
         if (!newConfig.appId) {
@@ -98,12 +126,15 @@ function init(newConfig) {
         // passed explicitly wins. No `/config` round-trip; browser SDKs still pass
         // one explicit authMethod so there is no hidden auth-provider fallback.
         //   defaults (bounded-production) < network preset < explicit newConfig
-        if (newConfig.network !== undefined && !(newConfig.network in BOUNDED_NETWORKS)) {
-            reject(new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`));
+        let resolved;
+        try {
+            resolved = resolveClientConfig(clientConfig, newConfig);
+        }
+        catch (error) {
+            reject(error instanceof Error ? error : new Error(String(error)));
             return;
         }
-        const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
-        clientConfig = Object.assign(Object.assign(Object.assign({}, clientConfig), preset), newConfig);
+        clientConfig = resolved;
         isInitialized = true;
         const waiters = initWaiters;
         initWaiters = [];
@@ -3420,7 +3451,7 @@ class ServerSessionManager {
         const address = kp.publicKey.toBase58();
         /* fetch nonce from auth API */
         const nonce = await genAuthNonce();
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-C5nbu9zb.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-I9w1TbAj.js'); });
         const message = await genSolanaMessage(address, nonce);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4031,15 +4062,21 @@ async function refreshAuthSessionOnce(appId, isServer) {
     return refreshPromise;
 }
 async function makeApiRequest(method, urlPath, data, _overrides) {
-    var _a, _b, _c, _d, _e, _f;
-    const config = await getConfig();
+    var _a, _b, _c, _d, _e, _f, _g;
+    // A scoped createClient() instance passes its own resolved config; otherwise
+    // fall back to the module-global init() config.
+    const config = (_a = _overrides === null || _overrides === void 0 ? void 0 : _overrides._config) !== null && _a !== void 0 ? _a : await getConfig();
+    const readOnly = (_overrides === null || _overrides === void 0 ? void 0 : _overrides._readOnly) === true;
     async function executeRequest() {
         var _a;
         // When _getAuthHeaders is provided (wallet client), use it as the sole auth source.
-        // Otherwise use the global createAuthHeader (default path).
+        // A read-only scoped instance omits auth entirely. Otherwise use the
+        // global createAuthHeader (default path).
         const authHeader = (_overrides === null || _overrides === void 0 ? void 0 : _overrides._getAuthHeaders)
             ? await _overrides._getAuthHeaders()
-            : await createAuthHeader(config.isServer);
+            : readOnly
+                ? {}
+                : await createAuthHeader(config.isServer);
         const headers = Object.assign({ "Content-Type": "application/json", "X-App-Id": config.appId }, authHeader);
         // Apply custom headers from _overrides
         if (_overrides === null || _overrides === void 0 ? void 0 : _overrides.headers) {
@@ -4068,7 +4105,12 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
         return await executeRequest();
     }
     catch (error) {
-        if (((_a = error.response) === null || _a === void 0 ? void 0 : _a.status) === 401) {
+        if (((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) === 401) {
+            // Read-only scoped instance: it holds no session, so there is nothing
+            // to refresh. Surface the 401 without touching the global session.
+            if (readOnly) {
+                throw error;
+            }
             // Wallet client path: use client-specific retry, skip global fallback entirely
             if (_overrides === null || _overrides === void 0 ? void 0 : _overrides._clearAuth) {
                 await _overrides._clearAuth();
@@ -4083,18 +4125,18 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
                 }
                 return await executeRequest();
             }
-            catch (_g) {
+            catch (_h) {
                 throw error;
             }
         }
-        if (((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) == 404) {
+        if (((_c = error.response) === null || _c === void 0 ? void 0 : _c.status) == 404) {
             return { data: null, status: 404 };
         }
-        if ((_c = error.response) === null || _c === void 0 ? void 0 : _c.data) {
+        if ((_d = error.response) === null || _d === void 0 ? void 0 : _d.data) {
             const responseData = typeof error.response.data === 'object'
                 ? error.response.data
                 : { message: String(error.response.data) };
-            const httpStatus = (_d = error.response) === null || _d === void 0 ? void 0 : _d.status;
+            const httpStatus = (_e = error.response) === null || _e === void 0 ? void 0 : _e.status;
             // A policy/invariant denial (403 rule / 409 invariant) is surfaced as
             // a first-class BoundedDeclineError carrying `.decline`; every other
             // failure stays a bare enriched Error (unchanged behavior).
@@ -4109,9 +4151,9 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
             // `if (e.code === 'invariant_violation')`) without parsing the message.
             // `code` is a stable category ('policy_denied' | 'invariant_violation');
             // `status` is the HTTP status; `requestId` correlates with the decision log.
-            apiError.code = (_e = responseData.code) !== null && _e !== void 0 ? _e : apiError.code;
+            apiError.code = (_f = responseData.code) !== null && _f !== void 0 ? _f : apiError.code;
             apiError.status = httpStatus !== null && httpStatus !== void 0 ? httpStatus : responseData.status;
-            apiError.requestId = (_f = responseData.requestId) !== null && _f !== void 0 ? _f : apiError.requestId;
+            apiError.requestId = (_g = responseData.requestId) !== null && _g !== void 0 ? _g : apiError.requestId;
             if (decline) {
                 // Re-assert decline-owned fields after the envelope copy, then
                 // notify the browser widget. Fire-and-forget: never delays or
@@ -4275,7 +4317,12 @@ async function canSendAuthenticatedLiveIntent(connection, isServer) {
         return false;
     return connectionMatchesAuthToken(connection, currentToken);
 }
-async function getSubscriptionIdentity(effectiveAppId, isServer, overrides) {
+async function getSubscriptionIdentity(effectiveAppId, isServer, overrides, anonymous) {
+    // A read-only scoped instance is unauthenticated by construction. Key it as
+    // anonymous and never read the ambient global session (a different app's).
+    if (anonymous) {
+        return { key: `${effectiveAppId}:anon`, cacheable: false, token: null };
+    }
     // Per-subscription wallet override (server WalletClient.subscribe): key by
     // the wallet's own opaque token material, mirroring getReadPrincipalKey. Do
     // not trust decoded claims or the unverified _walletAddress hint.
@@ -4477,7 +4524,13 @@ async function getFreshAuthToken(isServer) {
         throw rememberAmbientAuthFailure(normalizeAuthExpiredError(error, 'Authentication expired and refresh failed'));
     }
 }
-async function getConnectionAuthToken(isServer, authTokenProvider) {
+async function getConnectionAuthToken(isServer, authTokenProvider, anonymous) {
+    // A read-only scoped instance connects anonymously: no auth frame, and it
+    // must never read (or refresh) the ambient global session - that session
+    // belongs to a different app and would be rejected by this app's worker.
+    if (anonymous) {
+        return null;
+    }
     if (!authTokenProvider) {
         return getFreshAuthToken(isServer);
     }
@@ -4565,9 +4618,12 @@ function replaySubscriptions(connection) {
  * exact bearer so two distinct tokens never share a flight or a lease, even
  * when their compact `#id#<principalKey>` hashes collide.
  */
-function connectionLeaseKey(appId, routePath, principalKey, principalToken) {
+function connectionLeaseKey(appId, routePath, principalKey, principalToken, anonymous) {
     const roomKey = roomKeyFromRoutePath(routePath);
-    const base = roomKey ? `${appId}#room#${roomKey}` : appId;
+    // A read-only scoped instance is anonymous and must never share a socket with
+    // the authenticated global path even when it targets the same appId.
+    const appKey = anonymous ? `${appId}#ro` : appId;
+    const base = roomKey ? `${appKey}#room#${roomKey}` : appKey;
     if (!principalKey)
         return base;
     const bucket = `${base}#id#${principalKey}`;
@@ -4634,9 +4690,9 @@ function scheduleConnectionCloseIfIdle(connection) {
  * reuse. The lease is released once the caller has registered its
  * subscription/callback.
  */
-async function acquireConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken) {
+async function acquireConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, source) {
     var _a;
-    const leaseKey = connectionLeaseKey(appId, routePath, principalKey, principalToken);
+    const leaseKey = connectionLeaseKey(appId, routePath, principalKey, principalToken, source === null || source === void 0 ? void 0 : source.anonymous);
     connectionAcquisitions.set(leaseKey, ((_a = connectionAcquisitions.get(leaseKey)) !== null && _a !== void 0 ? _a : 0) + 1);
     let released = false;
     let releaseTimer = null;
@@ -4658,7 +4714,7 @@ async function acquireConnection(appId, isServer, routePath, authTokenProvider,
             scheduleConnectionCloseIfIdle(connection);
     };
     try {
-        const connection = await getOrCreateConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken);
+        const connection = await getOrCreateConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, source);
         const releaseConnection = () => release(connection);
         // Registration is synchronous after the caller's await. This fail-safe
         // releases on the next task even if an option getter/callback throws
@@ -4671,15 +4727,15 @@ async function acquireConnection(appId, isServer, routePath, authTokenProvider,
         throw error;
     }
 }
-async function getOrCreateConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken) {
+async function getOrCreateConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, source) {
     // Singleflight: concurrent first-use of the same routing target shares one
     // in-flight connection rather than each creating an orphan socket. Keyed by
     // the identity-bucket lease key so distinct wallet tokens never coalesce.
-    const leaseKey = connectionLeaseKey(appId, routePath, principalKey, principalToken);
+    const leaseKey = connectionLeaseKey(appId, routePath, principalKey, principalToken, source === null || source === void 0 ? void 0 : source.anonymous);
     const activeFlight = connectionFlights.get(leaseKey);
     if (activeFlight)
         return activeFlight;
-    const flight = getOrCreateConnectionOnce(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, leaseKey);
+    const flight = getOrCreateConnectionOnce(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, leaseKey, source);
     connectionFlights.set(leaseKey, flight);
     try {
         return await flight;
@@ -4690,8 +4746,9 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         }
     }
 }
-async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, leaseKey) {
+async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, leaseKey, source) {
     attachBrowserReconnectHooksOnce();
+    const anonymous = (source === null || source === void 0 ? void 0 : source.anonymous) === true;
     // A per-room subscription gets its OWN connection routed to the room DO; all
     // other subscriptions share the app-level connection (project DO). The worker
     // derives the room from the `?path=` we attach below and is the final routing
@@ -4699,8 +4756,11 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
     const roomKey = roomKeyFromRoutePath(routePath);
     // A wallet-scoped subscription (server WalletClient) gets its OWN connection
     // keyed by the wallet identity, so its WS authenticates as that wallet and
-    // never shares a connection (or token) with any top-level server caller.
-    const base = roomKey ? `${appId}#room#${roomKey}` : appId;
+    // never shares a connection (or token) with any top-level server caller. A
+    // read-only scoped (anonymous) instance is likewise isolated by an `#ro`
+    // marker so it never shares the authenticated global socket on the same appId.
+    const appKey = anonymous ? `${appId}#ro` : appId;
+    const base = roomKey ? `${appKey}#room#${roomKey}` : appKey;
     const identityBucketKey = principalKey
         ? `${base}#id#${principalKey}`
         : base;
@@ -4738,7 +4798,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         }
         let currentAuthToken;
         try {
-            currentAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
+            currentAuthToken = await getConnectionAuthToken(isServer, authTokenProvider, anonymous);
         }
         catch (error) {
             const authError = normalizeAuthExpiredError(error, 'Authentication expired and refresh failed');
@@ -4756,7 +4816,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         }
         connection.authFailure = null;
     }
-    let initialAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
+    let initialAuthToken = await getConnectionAuthToken(isServer, authTokenProvider, anonymous);
     // Create new connection
     connection = {
         ws: null,
@@ -4782,18 +4842,25 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         idleCloseTimer: null,
         consecutiveAuthFailures: 0,
         authFailure: null,
+        source,
+        anonymous,
     };
     connections.set(connKey, connection);
     // URL provider for reconnection with fresh tokens
     const urlProvider = async () => {
-        const config = await getConfig();
-        const wsUrl = new URL(config.wsApiUrl);
+        var _a;
+        // A scoped createClient() connection targets its own realtime endpoint;
+        // the default path reads the module-global config.
+        const wsApiUrl = (_a = source === null || source === void 0 ? void 0 : source.wsApiUrl) !== null && _a !== void 0 ? _a : (await getConfig()).wsApiUrl;
+        const wsUrl = new URL(wsApiUrl);
         // Always use v2 path
         wsUrl.pathname = WS_V2_PATH;
         // Set appId from the configured SDK source, or an explicit per-call
         // override passed through subscribeV2. Do not consult ambient globals:
         // app identity must come from init({ appId }) or an explicit call option.
-        wsUrl.searchParams.append('appId', appId || config.appId);
+        // `appId` here is already the resolved effectiveAppId; fall back to the
+        // global only on the default path when it was somehow empty.
+        wsUrl.searchParams.append('appId', appId || (await getConfig()).appId);
         // Per-room connection: carry the room path so the worker routes this WS
         // to the room DO (appId#room#roomId) where the live view fan-out lives.
         if (connection.routePath) {
@@ -4807,7 +4874,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         try {
             authToken = initialAuthToken !== undefined
                 ? initialAuthToken
-                : await getConnectionAuthToken(isServer, connection.authTokenProvider);
+                : await getConnectionAuthToken(isServer, connection.authTokenProvider, connection.anonymous);
             initialAuthToken = undefined;
         }
         catch (error) {
@@ -4836,8 +4903,12 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         connection.isConnected = true;
         // NOTE: Do NOT reset consecutiveAuthFailures here. It is reset when a
         // fresh auth token is actually obtained or on an explicit auth change.
-        // Schedule periodic token freshness checks
-        scheduleTokenRefresh(connection, isServer);
+        // Schedule periodic token freshness checks. An anonymous (read-only
+        // scoped) connection holds no token and must never poll or refresh the
+        // ambient global session, so it is skipped.
+        if (!connection.anonymous) {
+            scheduleTokenRefresh(connection, isServer);
+        }
         if (connection.pendingAuthToken) {
             connection.isAuthenticating = true;
             try {
@@ -5409,9 +5480,19 @@ function sendUnsubscribe(connection, subscriptionId) {
  *   the subscription onto, since a WS connection routes to a single DO.
  */
 async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
-    var _a, _b, _c, _d, _e;
-    const config = await getConfig();
+    var _a, _b, _c, _d, _e, _f;
+    const overrides = subscriptionOptions._overrides;
+    // A scoped createClient() instance passes its own resolved config; the
+    // default path reads the module-global init() config.
+    const config = (_a = overrides === null || overrides === void 0 ? void 0 : overrides._config) !== null && _a !== void 0 ? _a : await getConfig();
     const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
+    // A read-only scoped instance connects anonymously to its own realtime
+    // endpoint - never sharing a socket, token, or the ambient session with the
+    // global (default) app.
+    const anonymous = (overrides === null || overrides === void 0 ? void 0 : overrides._readOnly) === true;
+    const source = (overrides === null || overrides === void 0 ? void 0 : overrides._config)
+        ? { wsApiUrl: overrides._config.wsApiUrl, anonymous }
+        : undefined;
     // Use explicit appId override if provided, otherwise fall back to config
     const effectiveAppId = subscriptionOptions.appId || config.appId;
     // H1: scope the response cache to the caller's identity so a private snapshot
@@ -5420,12 +5501,12 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
     // Per-subscription wallet override (server WalletClient.subscribe). When set,
     // the connection authenticates + caches under the wallet's identity instead of
     // any top-level server caller — so a `createWalletClient` caller can
-    // subscribe through its explicit wallet session.
-    const overrides = subscriptionOptions._overrides;
-    const authTokenProvider = (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders)
+    // subscribe through its explicit wallet session. A read-only scoped instance
+    // is anonymous, so it never carries an auth-token provider.
+    const authTokenProvider = (!anonymous && (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders))
         ? async () => bearerFromAuthHeaders(await overrides._getAuthHeaders()) || null
         : undefined;
-    const identityInfo = await getSubscriptionIdentity(effectiveAppId, config.isServer, overrides);
+    const identityInfo = await getSubscriptionIdentity(effectiveAppId, config.isServer, overrides, anonymous);
     const identity = identityInfo.key;
     const identityToken = identityInfo.token;
     const responseCacheEnabled = subscriptionOptions.cache === true && identityInfo.cacheable;
@@ -5445,7 +5526,7 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
     let connection;
     let releaseConnection;
     try {
-        const acquisition = await acquireConnection(effectiveAppId, config.isServer, roomRoutePath, authTokenProvider, principalKey, principalToken);
+        const acquisition = await acquireConnection(effectiveAppId, config.isServer, roomRoutePath, authTokenProvider, principalKey, principalToken, source);
         connection = acquisition.connection;
         releaseConnection = acquisition.release;
     }
@@ -5467,16 +5548,16 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
         // (previously each new subscribe re-stringified every existing
         // subscription's shape/filter/sort — O(N²) with many live hooks).
         specKey = JSON.stringify([
-            (_a = subscriptionOptions.shape) !== null && _a !== void 0 ? _a : null,
-            (_b = subscriptionOptions.filter) !== null && _b !== void 0 ? _b : null,
-            (_c = subscriptionOptions.sort) !== null && _c !== void 0 ? _c : null,
+            (_b = subscriptionOptions.shape) !== null && _b !== void 0 ? _b : null,
+            (_c = subscriptionOptions.filter) !== null && _c !== void 0 ? _c : null,
+            (_d = subscriptionOptions.sort) !== null && _d !== void 0 ? _d : null,
         ]);
         for (const sub of connection.subscriptions.values()) {
             // H1: also require the same principal identity (compact hash AND exact
             // token) — a different logged-in user must not piggy-back on (and
             // inherit lastData from) another user's existing subscription, even
             // with identical path/prompt/shape/filter/sort.
-            if (sub.identity === identity && sub.identityToken === identityToken && sub.path === normalizedPath && sub.prompt === subscriptionOptions.prompt && sub.specKey === specKey && sub.includeSubPaths === ((_d = subscriptionOptions.includeSubPaths) !== null && _d !== void 0 ? _d : false) && sub.limit === subscriptionOptions.limit && sub.cursor === subscriptionOptions.cursor) {
+            if (sub.identity === identity && sub.identityToken === identityToken && sub.path === normalizedPath && sub.prompt === subscriptionOptions.prompt && sub.specKey === specKey && sub.includeSubPaths === ((_e = subscriptionOptions.includeSubPaths) !== null && _e !== void 0 ? _e : false) && sub.limit === subscriptionOptions.limit && sub.cursor === subscriptionOptions.cursor) {
                 existingSubscription = sub;
                 break;
             }
@@ -5569,7 +5650,7 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
             shape: subscriptionOptions.shape,
             limit: subscriptionOptions.limit,
             cursor: subscriptionOptions.cursor,
-            includeSubPaths: (_e = subscriptionOptions.includeSubPaths) !== null && _e !== void 0 ? _e : false,
+            includeSubPaths: (_f = subscriptionOptions.includeSubPaths) !== null && _f !== void 0 ? _f : false,
             callbacks: [subscriptionOptions],
             lastData: undefined,
             dataRevision: 0,
@@ -5811,7 +5892,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-B_Zaa1FL.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-DmzboN-H.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -6666,8 +6747,15 @@ function uncacheableReadKey(appId, scope) {
  * decoded claims and never caller identity hints such as `_walletAddress`.
  */
 async function getReadPrincipalKey(overrides) {
-    const config = await getConfig();
+    var _a;
+    const config = (_a = overrides === null || overrides === void 0 ? void 0 : overrides._config) !== null && _a !== void 0 ? _a : await getConfig();
     const appId = config.appId || '';
+    // A scoped read-only instance sends no auth and must never consult the ambient
+    // global session for a principal - its reads are always uncacheable (no
+    // per-user cache reuse, but also no cross-app/cross-user leak).
+    if (overrides === null || overrides === void 0 ? void 0 : overrides._readOnly) {
+        return { key: uncacheableReadKey(appId, 'ro'), cacheable: false, principalValue: null };
+    }
     // makeApiRequest applies overrides.headers AFTER its computed auth header, so
     // caller-supplied Authorization is the real request auth when present.
     if (hasAuthHeader(overrides === null || overrides === void 0 ? void 0 : overrides.headers)) {
@@ -6688,7 +6776,7 @@ async function getReadPrincipalKey(overrides) {
                 ? { key: `${appId}:o${principal}`, cacheable: true, principalValue: authValue }
                 : { key: uncacheableReadKey(appId, 'o'), cacheable: false, principalValue: null };
         }
-        catch (_a) {
+        catch (_b) {
             // If we can't resolve the override identity, do not read/write cache.
             return { key: uncacheableReadKey(appId, 'o'), cacheable: false, principalValue: null };
         }
@@ -6760,12 +6848,17 @@ function parseAggregateValue(result) {
  * @param opts - Optional filter prompt and overrides
  * @returns AggregateResult with the count value
  */
+/** Whether these opts target a Bounded network - honoring a scoped instance's
+ *  own config (`_overrides._config`) rather than the module global. */
+function optsTargetBounded(overrides) {
+    return (overrides === null || overrides === void 0 ? void 0 : overrides._config) ? isBoundedNetworkConfig(overrides._config) : isBoundedNetwork();
+}
 async function count(path, opts = {}) {
     var _a, _b;
     // On Bounded, the worker has no AI query engine — a prompt-based count returns
     // the raw documents, not an aggregation. Use the deterministic server
     // aggregation (queryAggregate) instead.
-    if (isBoundedNetwork()) {
+    if (optsTargetBounded(opts._overrides)) {
         const rows = await queryAggregate(path, { count: true }, { filter: opts.filter, _overrides: opts._overrides });
         return { value: (_b = (_a = rows[0]) === null || _a === void 0 ? void 0 : _a.count) !== null && _b !== void 0 ? _b : 0 };
     }
@@ -6826,7 +6919,7 @@ async function boundedAggregate(path, operation, opts) {
 async function aggregate(path, operation, opts = {}) {
     // On Bounded, route through the deterministic server aggregation — the legacy
     // AI-prompt path returns raw documents on the worker (no AI query engine).
-    if (isBoundedNetwork()) {
+    if (optsTargetBounded(opts._overrides)) {
         return { value: await boundedAggregate(path, operation, opts) };
     }
     let prefix;
@@ -7487,11 +7580,11 @@ async function setMany(many, options) {
                 transactionResult = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
             }
             else if (curTx.serializedTransaction) {
-                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-Dtsk6xFc.js'); });
+                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-BUJkyVxN.js'); });
                 transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             else {
-                const { handleSolanaTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-Dtsk6xFc.js'); });
+                const { handleSolanaTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-BUJkyVxN.js'); });
                 transactionResult = await handleSolanaTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             // Sync items after all transactions are confirmed
@@ -7820,6 +7913,100 @@ async function reconnectWithNewAuth() {
     return reconnectWithNewAuthV2();
 }
 
+/**
+ * Scoped multi-app client factory.
+ *
+ * `createClient()` returns an isolated, READ-ONLY client bound to one Bounded
+ * app, independent of the module-global `init()` client. It exists so a single
+ * frontend can hold its normal authenticated client for its own app AND a
+ * read-only client for a SECOND Bounded app (e.g. a shared steward/runtime app),
+ * with live subscriptions on both and zero interference between them.
+ *
+ * Each instance carries its OWN fully-resolved config (endpoints + appId) and
+ * routes through the SAME shared transport/subscription implementation as the
+ * global path - it never forks that code. Isolation comes from threading the
+ * instance config (and a read-only marker) through the existing per-request /
+ * per-subscription override channel, plus the websocket layer already keying
+ * connections by appId.
+ *
+ * ## v1 scope: read-only, unauthenticated
+ *
+ * A scoped instance is UNAUTHENTICATED. It sends no auth, never reads or
+ * refreshes the global session, and connects to its app's realtime endpoint
+ * anonymously. It is therefore only useful against collections a Bounded app
+ * exposes with a public read rule (`read: true`) - private/per-user reads will
+ * be denied by the target app's policy, exactly as an anonymous caller would be.
+ *
+ * Writes and any auth-requiring surface are NOT supported on a scoped instance
+ * and throw a clear error. Per-instance authentication is a planned follow-up.
+ */
+/** Error thrown when an unsupported (write / auth-requiring) call is made on a
+ *  read-only scoped client. */
+class ScopedClientReadOnlyError extends Error {
+    constructor(operation) {
+        super(`createClient() instances are read-only in v1: "${operation}" is not supported. ` +
+            `Use the global init() client for authenticated writes, or read only public ` +
+            `(read: true) collections on this scoped instance.`);
+        this.name = 'ScopedClientReadOnlyError';
+    }
+}
+/**
+ * Create a read-only client scoped to a single Bounded app.
+ *
+ * @example
+ * ```ts
+ * // Global client stays the venue's own authenticated app:
+ * await init({ appId: VENUE_APP, network: 'bounded-production', authMethod: 'email' });
+ *
+ * // A second, read-only client for the steward runtime app:
+ * const steward = createClient({ appId: STEWARD_APP, network: 'bounded-production' });
+ * const state = await steward.get('runtime/current');
+ * const stop = await steward.subscribe('runtime/current', (d) => render(d));
+ * ```
+ */
+function createClient(config) {
+    if (!config || !config.appId) {
+        throw new Error('createClient requires an appId.');
+    }
+    // Resolve from the PRISTINE defaults (never the mutated global) so a scoped
+    // instance is fully independent of any prior init(). Same precedence as init:
+    // defaults < network preset < explicit fields.
+    const resolved = resolveClientConfig(DEFAULT_CLIENT_CONFIG, config);
+    // The override channel that carries this instance's identity through the
+    // shared transport and subscription code. `_config` retargets endpoints +
+    // appId; `_readOnly` omits auth and blocks ambient-session/global-cache reads.
+    const instanceOverrides = () => ({ _config: resolved, _readOnly: true });
+    // Merge caller-supplied opts with the instance overrides. The instance
+    // `_config`/`_readOnly` are applied LAST so app code can never override the
+    // routing/identity of a scoped call (but may still pass e.g. an AbortSignal).
+    const withOverrides = (opts) => {
+        var _a;
+        const base = (opts !== null && opts !== void 0 ? opts : {});
+        return Object.assign(Object.assign({}, base), { _overrides: Object.assign(Object.assign({}, ((_a = base._overrides) !== null && _a !== void 0 ? _a : {})), instanceOverrides()) });
+    };
+    return {
+        appId: resolved.appId,
+        getConfig: () => (Object.assign({}, resolved)),
+        get: (path, opts) => get(path, withOverrides(opts)),
+        getMany: (paths, opts) => getMany(paths, withOverrides(opts)),
+        search: (path, query, opts) => search(path, query, withOverrides(opts)),
+        queryAggregate: (path, spec, opts) => queryAggregate(path, spec, withOverrides(opts)),
+        count: (path, opts) => count(path, withOverrides(opts)),
+        aggregate: (path, operation, opts) => aggregate(path, operation, withOverrides(opts)),
+        runQuery: (absolutePath, queryName, queryArgs, opts) => runQuery(absolutePath, queryName, queryArgs, withOverrides(opts)),
+        runQueryMany: (many, opts) => runQueryMany(many, withOverrides(opts)),
+        subscribe: (path, options) => {
+            var _a;
+            const opts = typeof options === 'function' ? { onData: options } : Object.assign({}, options);
+            // Force this instance's scoped, read-only routing onto the subscription.
+            opts._overrides = Object.assign(Object.assign({}, ((_a = opts._overrides) !== null && _a !== void 0 ? _a : {})), { _config: resolved, _readOnly: true });
+            return subscribe(path, opts);
+        },
+        set: () => { throw new ScopedClientReadOnlyError('set'); },
+        setMany: () => { throw new ScopedClientReadOnlyError('setMany'); },
+    };
+}
+
 /**
  * Live named-query subscriptions (subscribeQuery) - HTTP client poller (v1).
  *
@@ -8483,12 +8670,12 @@ function toMillis(seconds) {
 
 /** Load the Anchor/Web3 transaction builder only when an onchain write uses it. */
 async function buildSetDocumentsTransaction(connection, idl, programProvider, payerPublicKey, args, remainingAccounts, lutKey, preInstructions, simulate, additionalLutAddresses) {
-    const implementation = await Promise.resolve().then(function () { return require('./sol-utils-Dni65Z63.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./sol-utils-oBMCMbe_.js'); });
     return implementation.buildSetDocumentsTransaction(connection, idl, programProvider, payerPublicKey, args, remainingAccounts, lutKey, preInstructions, simulate, additionalLutAddresses);
 }
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-C5nbu9zb.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-I9w1TbAj.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
@@ -9032,6 +9219,7 @@ exports.LiveIntentError = LiveIntentError;
 exports.MIN_QUERY_POLL_INTERVAL_MS = MIN_QUERY_POLL_INTERVAL_MS;
 exports.RATE_LIMIT_EVENT_NAME = RATE_LIMIT_EVENT_NAME;
 exports.ReactNativeSessionManager = ReactNativeSessionManager;
+exports.ScopedClientReadOnlyError = ScopedClientReadOnlyError;
 exports.ServerSessionManager = ServerSessionManager;
 exports.WebSessionManager = WebSessionManager;
 exports.aggregate = aggregate;
@@ -9046,6 +9234,7 @@ exports.closeAllQuerySubscriptions = closeAllQuerySubscriptions;
 exports.closeAllSubscriptions = closeAllSubscriptions;
 exports.convertRemainingAccounts = convertRemainingAccounts;
 exports.count = count;
+exports.createClient = createClient;
 exports.createSessionWithSignature = createSessionWithSignature;
 exports.defineLiveModule = defineLiveModule;
 exports.deriveDecline = deriveDecline;
@@ -9099,4 +9288,4 @@ exports.toLowerEvmAddress = toLowerEvmAddress;
 exports.toMillis = toMillis;
 exports.toSeconds = toSeconds;
 exports.withEffects = withEffects;
-//# sourceMappingURL=index-DE-xgEvG.js.map
+//# sourceMappingURL=index-BXvTkFw2.js.map