@bounded-sh/core 0.0.53 → 0.0.55

package/dist/{index-CbTo1jKG.mjs → index-qcTp-5Mt.mjs}

@@ -3,7 +3,11 @@ import nacl from 'tweetnacl';
 import ReconnectingWebSocket from 'reconnecting-websocket';
 import BN from 'bn.js';
 
-let clientConfig = {
+// The pristine default config. `clientConfig` (the module global) starts as a
+// copy of this and is mutated by init(); createClient() resolves fresh scoped
+// configs from this pristine template so a scoped instance never inherits a
+// prior init()'s state.
+const DEFAULT_CLIENT_CONFIG = {
     // User configured settings
     name: '',
     logoUrl: '',
@@ -28,6 +32,7 @@ let clientConfig = {
     authProvider: null,
     isServer: false,
 };
+let clientConfig = Object.assign({}, DEFAULT_CLIENT_CONFIG);
 let isInitialized = false;
 // Callers awaiting getConfig() before init() completes. Resolved synchronously
 // by init() — the previous 50ms setInterval poll added up to 50ms of latency
@@ -82,9 +87,32 @@ function getWebhookKeysUrl() {
  * Bounded must use the deterministic server aggregation, not the legacy AI query).
  */
 function isBoundedNetwork() {
-    const net = clientConfig.network;
+    return isBoundedNetworkConfig(clientConfig);
+}
+/**
+ * Config-scoped variant of {@link isBoundedNetwork}: reports whether a SPECIFIC
+ * config (e.g. a scoped `createClient()` instance's) targets a Bounded network,
+ * rather than the module global. Used so a scoped client routes count/aggregate
+ * by its OWN network, not the global one.
+ */
+function isBoundedNetworkConfig(config) {
+    const net = config.network;
     return typeof net === 'string' && net in BOUNDED_NETWORKS;
 }
+/**
+ * Merge a partial config over a base config, applying the Bounded endpoint
+ * precedence rule used everywhere: defaults (or `base`) < network preset <
+ * explicit fields. Pure - never touches module state. Shared by `init` (base =
+ * the current global) and `createClient` (base = the pristine defaults) so both
+ * resolve endpoints identically. Throws on an unsupported `network`.
+ */
+function resolveClientConfig(base, newConfig) {
+    if (newConfig.network !== undefined && !(newConfig.network in BOUNDED_NETWORKS)) {
+        throw new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`);
+    }
+    const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
+    return Object.assign(Object.assign(Object.assign({}, base), preset), newConfig);
+}
 function init(newConfig) {
     return new Promise((resolve, reject) => {
         if (!newConfig.appId) {
@@ -96,12 +124,15 @@ function init(newConfig) {
         // passed explicitly wins. No `/config` round-trip; browser SDKs still pass
         // one explicit authMethod so there is no hidden auth-provider fallback.
         //   defaults (bounded-production) < network preset < explicit newConfig
-        if (newConfig.network !== undefined && !(newConfig.network in BOUNDED_NETWORKS)) {
-            reject(new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`));
+        let resolved;
+        try {
+            resolved = resolveClientConfig(clientConfig, newConfig);
+        }
+        catch (error) {
+            reject(error instanceof Error ? error : new Error(String(error)));
             return;
         }
-        const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
-        clientConfig = Object.assign(Object.assign(Object.assign({}, clientConfig), preset), newConfig);
+        clientConfig = resolved;
         isInitialized = true;
         const waiters = initWaiters;
         initWaiters = [];
@@ -3418,7 +3449,7 @@ class ServerSessionManager {
         const address = kp.publicKey.toBase58();
         /* fetch nonce from auth API */
         const nonce = await genAuthNonce();
-        const { genSolanaMessage } = await import('./solana-message-CSjZx5xE.mjs');
+        const { genSolanaMessage } = await import('./solana-message-XxVgbtp2.mjs');
         const message = await genSolanaMessage(address, nonce);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4029,15 +4060,21 @@ async function refreshAuthSessionOnce(appId, isServer) {
     return refreshPromise;
 }
 async function makeApiRequest(method, urlPath, data, _overrides) {
-    var _a, _b, _c, _d, _e, _f;
-    const config = await getConfig();
+    var _a, _b, _c, _d, _e, _f, _g;
+    // A scoped createClient() instance passes its own resolved config; otherwise
+    // fall back to the module-global init() config.
+    const config = (_a = _overrides === null || _overrides === void 0 ? void 0 : _overrides._config) !== null && _a !== void 0 ? _a : await getConfig();
+    const readOnly = (_overrides === null || _overrides === void 0 ? void 0 : _overrides._readOnly) === true;
     async function executeRequest() {
         var _a;
         // When _getAuthHeaders is provided (wallet client), use it as the sole auth source.
-        // Otherwise use the global createAuthHeader (default path).
+        // A read-only scoped instance omits auth entirely. Otherwise use the
+        // global createAuthHeader (default path).
         const authHeader = (_overrides === null || _overrides === void 0 ? void 0 : _overrides._getAuthHeaders)
             ? await _overrides._getAuthHeaders()
-            : await createAuthHeader(config.isServer);
+            : readOnly
+                ? {}
+                : await createAuthHeader(config.isServer);
         const headers = Object.assign({ "Content-Type": "application/json", "X-App-Id": config.appId }, authHeader);
         // Apply custom headers from _overrides
         if (_overrides === null || _overrides === void 0 ? void 0 : _overrides.headers) {
@@ -4066,7 +4103,12 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
         return await executeRequest();
     }
     catch (error) {
-        if (((_a = error.response) === null || _a === void 0 ? void 0 : _a.status) === 401) {
+        if (((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) === 401) {
+            // Read-only scoped instance: it holds no session, so there is nothing
+            // to refresh. Surface the 401 without touching the global session.
+            if (readOnly) {
+                throw error;
+            }
             // Wallet client path: use client-specific retry, skip global fallback entirely
             if (_overrides === null || _overrides === void 0 ? void 0 : _overrides._clearAuth) {
                 await _overrides._clearAuth();
@@ -4081,18 +4123,18 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
                 }
                 return await executeRequest();
             }
-            catch (_g) {
+            catch (_h) {
                 throw error;
             }
         }
-        if (((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) == 404) {
+        if (((_c = error.response) === null || _c === void 0 ? void 0 : _c.status) == 404) {
             return { data: null, status: 404 };
         }
-        if ((_c = error.response) === null || _c === void 0 ? void 0 : _c.data) {
+        if ((_d = error.response) === null || _d === void 0 ? void 0 : _d.data) {
             const responseData = typeof error.response.data === 'object'
                 ? error.response.data
                 : { message: String(error.response.data) };
-            const httpStatus = (_d = error.response) === null || _d === void 0 ? void 0 : _d.status;
+            const httpStatus = (_e = error.response) === null || _e === void 0 ? void 0 : _e.status;
             // A policy/invariant denial (403 rule / 409 invariant) is surfaced as
             // a first-class BoundedDeclineError carrying `.decline`; every other
             // failure stays a bare enriched Error (unchanged behavior).
@@ -4107,9 +4149,9 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
             // `if (e.code === 'invariant_violation')`) without parsing the message.
             // `code` is a stable category ('policy_denied' | 'invariant_violation');
             // `status` is the HTTP status; `requestId` correlates with the decision log.
-            apiError.code = (_e = responseData.code) !== null && _e !== void 0 ? _e : apiError.code;
+            apiError.code = (_f = responseData.code) !== null && _f !== void 0 ? _f : apiError.code;
             apiError.status = httpStatus !== null && httpStatus !== void 0 ? httpStatus : responseData.status;
-            apiError.requestId = (_f = responseData.requestId) !== null && _f !== void 0 ? _f : apiError.requestId;
+            apiError.requestId = (_g = responseData.requestId) !== null && _g !== void 0 ? _g : apiError.requestId;
             if (decline) {
                 // Re-assert decline-owned fields after the envelope copy, then
                 // notify the browser widget. Fire-and-forget: never delays or
@@ -4273,7 +4315,12 @@ async function canSendAuthenticatedLiveIntent(connection, isServer) {
         return false;
     return connectionMatchesAuthToken(connection, currentToken);
 }
-async function getSubscriptionIdentity(effectiveAppId, isServer, overrides) {
+async function getSubscriptionIdentity(effectiveAppId, isServer, overrides, anonymous) {
+    // A read-only scoped instance is unauthenticated by construction. Key it as
+    // anonymous and never read the ambient global session (a different app's).
+    if (anonymous) {
+        return { key: `${effectiveAppId}:anon`, cacheable: false, token: null };
+    }
     // Per-subscription wallet override (server WalletClient.subscribe): key by
     // the wallet's own opaque token material, mirroring getReadPrincipalKey. Do
     // not trust decoded claims or the unverified _walletAddress hint.
@@ -4475,7 +4522,13 @@ async function getFreshAuthToken(isServer) {
         throw rememberAmbientAuthFailure(normalizeAuthExpiredError(error, 'Authentication expired and refresh failed'));
     }
 }
-async function getConnectionAuthToken(isServer, authTokenProvider) {
+async function getConnectionAuthToken(isServer, authTokenProvider, anonymous) {
+    // A read-only scoped instance connects anonymously: no auth frame, and it
+    // must never read (or refresh) the ambient global session - that session
+    // belongs to a different app and would be rejected by this app's worker.
+    if (anonymous) {
+        return null;
+    }
     if (!authTokenProvider) {
         return getFreshAuthToken(isServer);
     }
@@ -4563,9 +4616,12 @@ function replaySubscriptions(connection) {
  * exact bearer so two distinct tokens never share a flight or a lease, even
  * when their compact `#id#<principalKey>` hashes collide.
  */
-function connectionLeaseKey(appId, routePath, principalKey, principalToken) {
+function connectionLeaseKey(appId, routePath, principalKey, principalToken, anonymous) {
     const roomKey = roomKeyFromRoutePath(routePath);
-    const base = roomKey ? `${appId}#room#${roomKey}` : appId;
+    // A read-only scoped instance is anonymous and must never share a socket with
+    // the authenticated global path even when it targets the same appId.
+    const appKey = anonymous ? `${appId}#ro` : appId;
+    const base = roomKey ? `${appKey}#room#${roomKey}` : appKey;
     if (!principalKey)
         return base;
     const bucket = `${base}#id#${principalKey}`;
@@ -4632,9 +4688,9 @@ function scheduleConnectionCloseIfIdle(connection) {
  * reuse. The lease is released once the caller has registered its
  * subscription/callback.
  */
-async function acquireConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken) {
+async function acquireConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, source) {
     var _a;
-    const leaseKey = connectionLeaseKey(appId, routePath, principalKey, principalToken);
+    const leaseKey = connectionLeaseKey(appId, routePath, principalKey, principalToken, source === null || source === void 0 ? void 0 : source.anonymous);
     connectionAcquisitions.set(leaseKey, ((_a = connectionAcquisitions.get(leaseKey)) !== null && _a !== void 0 ? _a : 0) + 1);
     let released = false;
     let releaseTimer = null;
@@ -4656,7 +4712,7 @@ async function acquireConnection(appId, isServer, routePath, authTokenProvider,
             scheduleConnectionCloseIfIdle(connection);
     };
     try {
-        const connection = await getOrCreateConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken);
+        const connection = await getOrCreateConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, source);
         const releaseConnection = () => release(connection);
         // Registration is synchronous after the caller's await. This fail-safe
         // releases on the next task even if an option getter/callback throws
@@ -4669,15 +4725,15 @@ async function acquireConnection(appId, isServer, routePath, authTokenProvider,
         throw error;
     }
 }
-async function getOrCreateConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken) {
+async function getOrCreateConnection(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, source) {
     // Singleflight: concurrent first-use of the same routing target shares one
     // in-flight connection rather than each creating an orphan socket. Keyed by
     // the identity-bucket lease key so distinct wallet tokens never coalesce.
-    const leaseKey = connectionLeaseKey(appId, routePath, principalKey, principalToken);
+    const leaseKey = connectionLeaseKey(appId, routePath, principalKey, principalToken, source === null || source === void 0 ? void 0 : source.anonymous);
     const activeFlight = connectionFlights.get(leaseKey);
     if (activeFlight)
         return activeFlight;
-    const flight = getOrCreateConnectionOnce(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, leaseKey);
+    const flight = getOrCreateConnectionOnce(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, leaseKey, source);
     connectionFlights.set(leaseKey, flight);
     try {
         return await flight;
@@ -4688,8 +4744,9 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         }
     }
 }
-async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, leaseKey) {
+async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenProvider, principalKey, principalToken, leaseKey, source) {
     attachBrowserReconnectHooksOnce();
+    const anonymous = (source === null || source === void 0 ? void 0 : source.anonymous) === true;
     // A per-room subscription gets its OWN connection routed to the room DO; all
     // other subscriptions share the app-level connection (project DO). The worker
     // derives the room from the `?path=` we attach below and is the final routing
@@ -4697,8 +4754,11 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
     const roomKey = roomKeyFromRoutePath(routePath);
     // A wallet-scoped subscription (server WalletClient) gets its OWN connection
     // keyed by the wallet identity, so its WS authenticates as that wallet and
-    // never shares a connection (or token) with any top-level server caller.
-    const base = roomKey ? `${appId}#room#${roomKey}` : appId;
+    // never shares a connection (or token) with any top-level server caller. A
+    // read-only scoped (anonymous) instance is likewise isolated by an `#ro`
+    // marker so it never shares the authenticated global socket on the same appId.
+    const appKey = anonymous ? `${appId}#ro` : appId;
+    const base = roomKey ? `${appKey}#room#${roomKey}` : appKey;
     const identityBucketKey = principalKey
         ? `${base}#id#${principalKey}`
         : base;
@@ -4736,7 +4796,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         }
         let currentAuthToken;
         try {
-            currentAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
+            currentAuthToken = await getConnectionAuthToken(isServer, authTokenProvider, anonymous);
         }
         catch (error) {
             const authError = normalizeAuthExpiredError(error, 'Authentication expired and refresh failed');
@@ -4754,7 +4814,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         }
         connection.authFailure = null;
     }
-    let initialAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
+    let initialAuthToken = await getConnectionAuthToken(isServer, authTokenProvider, anonymous);
     // Create new connection
     connection = {
         ws: null,
@@ -4780,18 +4840,25 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         idleCloseTimer: null,
         consecutiveAuthFailures: 0,
         authFailure: null,
+        source,
+        anonymous,
     };
     connections.set(connKey, connection);
     // URL provider for reconnection with fresh tokens
     const urlProvider = async () => {
-        const config = await getConfig();
-        const wsUrl = new URL(config.wsApiUrl);
+        var _a;
+        // A scoped createClient() connection targets its own realtime endpoint;
+        // the default path reads the module-global config.
+        const wsApiUrl = (_a = source === null || source === void 0 ? void 0 : source.wsApiUrl) !== null && _a !== void 0 ? _a : (await getConfig()).wsApiUrl;
+        const wsUrl = new URL(wsApiUrl);
         // Always use v2 path
         wsUrl.pathname = WS_V2_PATH;
         // Set appId from the configured SDK source, or an explicit per-call
         // override passed through subscribeV2. Do not consult ambient globals:
         // app identity must come from init({ appId }) or an explicit call option.
-        wsUrl.searchParams.append('appId', appId || config.appId);
+        // `appId` here is already the resolved effectiveAppId; fall back to the
+        // global only on the default path when it was somehow empty.
+        wsUrl.searchParams.append('appId', appId || (await getConfig()).appId);
         // Per-room connection: carry the room path so the worker routes this WS
         // to the room DO (appId#room#roomId) where the live view fan-out lives.
         if (connection.routePath) {
@@ -4805,7 +4872,7 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         try {
             authToken = initialAuthToken !== undefined
                 ? initialAuthToken
-                : await getConnectionAuthToken(isServer, connection.authTokenProvider);
+                : await getConnectionAuthToken(isServer, connection.authTokenProvider, connection.anonymous);
             initialAuthToken = undefined;
         }
         catch (error) {
@@ -4834,8 +4901,12 @@ async function getOrCreateConnectionOnce(appId, isServer, routePath, authTokenPr
         connection.isConnected = true;
         // NOTE: Do NOT reset consecutiveAuthFailures here. It is reset when a
         // fresh auth token is actually obtained or on an explicit auth change.
-        // Schedule periodic token freshness checks
-        scheduleTokenRefresh(connection, isServer);
+        // Schedule periodic token freshness checks. An anonymous (read-only
+        // scoped) connection holds no token and must never poll or refresh the
+        // ambient global session, so it is skipped.
+        if (!connection.anonymous) {
+            scheduleTokenRefresh(connection, isServer);
+        }
         if (connection.pendingAuthToken) {
             connection.isAuthenticating = true;
             try {
@@ -5407,9 +5478,19 @@ function sendUnsubscribe(connection, subscriptionId) {
  *   the subscription onto, since a WS connection routes to a single DO.
  */
 async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
-    var _a, _b, _c, _d, _e;
-    const config = await getConfig();
+    var _a, _b, _c, _d, _e, _f;
+    const overrides = subscriptionOptions._overrides;
+    // A scoped createClient() instance passes its own resolved config; the
+    // default path reads the module-global init() config.
+    const config = (_a = overrides === null || overrides === void 0 ? void 0 : overrides._config) !== null && _a !== void 0 ? _a : await getConfig();
     const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
+    // A read-only scoped instance connects anonymously to its own realtime
+    // endpoint - never sharing a socket, token, or the ambient session with the
+    // global (default) app.
+    const anonymous = (overrides === null || overrides === void 0 ? void 0 : overrides._readOnly) === true;
+    const source = (overrides === null || overrides === void 0 ? void 0 : overrides._config)
+        ? { wsApiUrl: overrides._config.wsApiUrl, anonymous }
+        : undefined;
     // Use explicit appId override if provided, otherwise fall back to config
     const effectiveAppId = subscriptionOptions.appId || config.appId;
     // H1: scope the response cache to the caller's identity so a private snapshot
@@ -5418,12 +5499,12 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
     // Per-subscription wallet override (server WalletClient.subscribe). When set,
     // the connection authenticates + caches under the wallet's identity instead of
     // any top-level server caller — so a `createWalletClient` caller can
-    // subscribe through its explicit wallet session.
-    const overrides = subscriptionOptions._overrides;
-    const authTokenProvider = (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders)
+    // subscribe through its explicit wallet session. A read-only scoped instance
+    // is anonymous, so it never carries an auth-token provider.
+    const authTokenProvider = (!anonymous && (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders))
         ? async () => bearerFromAuthHeaders(await overrides._getAuthHeaders()) || null
         : undefined;
-    const identityInfo = await getSubscriptionIdentity(effectiveAppId, config.isServer, overrides);
+    const identityInfo = await getSubscriptionIdentity(effectiveAppId, config.isServer, overrides, anonymous);
     const identity = identityInfo.key;
     const identityToken = identityInfo.token;
     const responseCacheEnabled = subscriptionOptions.cache === true && identityInfo.cacheable;
@@ -5443,7 +5524,7 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
     let connection;
     let releaseConnection;
     try {
-        const acquisition = await acquireConnection(effectiveAppId, config.isServer, roomRoutePath, authTokenProvider, principalKey, principalToken);
+        const acquisition = await acquireConnection(effectiveAppId, config.isServer, roomRoutePath, authTokenProvider, principalKey, principalToken, source);
         connection = acquisition.connection;
         releaseConnection = acquisition.release;
     }
@@ -5465,16 +5546,16 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
         // (previously each new subscribe re-stringified every existing
         // subscription's shape/filter/sort — O(N²) with many live hooks).
         specKey = JSON.stringify([
-            (_a = subscriptionOptions.shape) !== null && _a !== void 0 ? _a : null,
-            (_b = subscriptionOptions.filter) !== null && _b !== void 0 ? _b : null,
-            (_c = subscriptionOptions.sort) !== null && _c !== void 0 ? _c : null,
+            (_b = subscriptionOptions.shape) !== null && _b !== void 0 ? _b : null,
+            (_c = subscriptionOptions.filter) !== null && _c !== void 0 ? _c : null,
+            (_d = subscriptionOptions.sort) !== null && _d !== void 0 ? _d : null,
         ]);
         for (const sub of connection.subscriptions.values()) {
             // H1: also require the same principal identity (compact hash AND exact
             // token) — a different logged-in user must not piggy-back on (and
             // inherit lastData from) another user's existing subscription, even
             // with identical path/prompt/shape/filter/sort.
-            if (sub.identity === identity && sub.identityToken === identityToken && sub.path === normalizedPath && sub.prompt === subscriptionOptions.prompt && sub.specKey === specKey && sub.includeSubPaths === ((_d = subscriptionOptions.includeSubPaths) !== null && _d !== void 0 ? _d : false) && sub.limit === subscriptionOptions.limit && sub.cursor === subscriptionOptions.cursor) {
+            if (sub.identity === identity && sub.identityToken === identityToken && sub.path === normalizedPath && sub.prompt === subscriptionOptions.prompt && sub.specKey === specKey && sub.includeSubPaths === ((_e = subscriptionOptions.includeSubPaths) !== null && _e !== void 0 ? _e : false) && sub.limit === subscriptionOptions.limit && sub.cursor === subscriptionOptions.cursor) {
                 existingSubscription = sub;
                 break;
             }
@@ -5567,7 +5648,7 @@ async function subscribeV2(path, subscriptionOptions, roomRoutePath) {
             shape: subscriptionOptions.shape,
             limit: subscriptionOptions.limit,
             cursor: subscriptionOptions.cursor,
-            includeSubPaths: (_e = subscriptionOptions.includeSubPaths) !== null && _e !== void 0 ? _e : false,
+            includeSubPaths: (_f = subscriptionOptions.includeSubPaths) !== null && _f !== void 0 ? _f : false,
             callbacks: [subscriptionOptions],
             lastData: undefined,
             dataRevision: 0,
@@ -5809,7 +5890,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-DLErbHL_.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-BzKEmyxq.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -6664,8 +6745,15 @@ function uncacheableReadKey(appId, scope) {
  * decoded claims and never caller identity hints such as `_walletAddress`.
  */
 async function getReadPrincipalKey(overrides) {
-    const config = await getConfig();
+    var _a;
+    const config = (_a = overrides === null || overrides === void 0 ? void 0 : overrides._config) !== null && _a !== void 0 ? _a : await getConfig();
     const appId = config.appId || '';
+    // A scoped read-only instance sends no auth and must never consult the ambient
+    // global session for a principal - its reads are always uncacheable (no
+    // per-user cache reuse, but also no cross-app/cross-user leak).
+    if (overrides === null || overrides === void 0 ? void 0 : overrides._readOnly) {
+        return { key: uncacheableReadKey(appId, 'ro'), cacheable: false, principalValue: null };
+    }
     // makeApiRequest applies overrides.headers AFTER its computed auth header, so
     // caller-supplied Authorization is the real request auth when present.
     if (hasAuthHeader(overrides === null || overrides === void 0 ? void 0 : overrides.headers)) {
@@ -6686,7 +6774,7 @@ async function getReadPrincipalKey(overrides) {
                 ? { key: `${appId}:o${principal}`, cacheable: true, principalValue: authValue }
                 : { key: uncacheableReadKey(appId, 'o'), cacheable: false, principalValue: null };
         }
-        catch (_a) {
+        catch (_b) {
             // If we can't resolve the override identity, do not read/write cache.
             return { key: uncacheableReadKey(appId, 'o'), cacheable: false, principalValue: null };
         }
@@ -6758,12 +6846,17 @@ function parseAggregateValue(result) {
  * @param opts - Optional filter prompt and overrides
  * @returns AggregateResult with the count value
  */
+/** Whether these opts target a Bounded network - honoring a scoped instance's
+ *  own config (`_overrides._config`) rather than the module global. */
+function optsTargetBounded(overrides) {
+    return (overrides === null || overrides === void 0 ? void 0 : overrides._config) ? isBoundedNetworkConfig(overrides._config) : isBoundedNetwork();
+}
 async function count(path, opts = {}) {
     var _a, _b;
     // On Bounded, the worker has no AI query engine — a prompt-based count returns
     // the raw documents, not an aggregation. Use the deterministic server
     // aggregation (queryAggregate) instead.
-    if (isBoundedNetwork()) {
+    if (optsTargetBounded(opts._overrides)) {
         const rows = await queryAggregate(path, { count: true }, { filter: opts.filter, _overrides: opts._overrides });
         return { value: (_b = (_a = rows[0]) === null || _a === void 0 ? void 0 : _a.count) !== null && _b !== void 0 ? _b : 0 };
     }
@@ -6824,7 +6917,7 @@ async function boundedAggregate(path, operation, opts) {
 async function aggregate(path, operation, opts = {}) {
     // On Bounded, route through the deterministic server aggregation — the legacy
     // AI-prompt path returns raw documents on the worker (no AI query engine).
-    if (isBoundedNetwork()) {
+    if (optsTargetBounded(opts._overrides)) {
         return { value: await boundedAggregate(path, operation, opts) };
     }
     let prefix;
@@ -7485,11 +7578,11 @@ async function setMany(many, options) {
                 transactionResult = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
             }
             else if (curTx.serializedTransaction) {
-                const { handlePreBuiltTransaction } = await import('./solana-operations-Bx91DDCy.mjs');
+                const { handlePreBuiltTransaction } = await import('./solana-operations-ehEsfO5g.mjs');
                 transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             else {
-                const { handleSolanaTransaction } = await import('./solana-operations-Bx91DDCy.mjs');
+                const { handleSolanaTransaction } = await import('./solana-operations-ehEsfO5g.mjs');
                 transactionResult = await handleSolanaTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             // Sync items after all transactions are confirmed
@@ -7818,6 +7911,100 @@ async function reconnectWithNewAuth() {
     return reconnectWithNewAuthV2();
 }
 
+/**
+ * Scoped multi-app client factory.
+ *
+ * `createClient()` returns an isolated, READ-ONLY client bound to one Bounded
+ * app, independent of the module-global `init()` client. It exists so a single
+ * frontend can hold its normal authenticated client for its own app AND a
+ * read-only client for a SECOND Bounded app (e.g. a shared steward/runtime app),
+ * with live subscriptions on both and zero interference between them.
+ *
+ * Each instance carries its OWN fully-resolved config (endpoints + appId) and
+ * routes through the SAME shared transport/subscription implementation as the
+ * global path - it never forks that code. Isolation comes from threading the
+ * instance config (and a read-only marker) through the existing per-request /
+ * per-subscription override channel, plus the websocket layer already keying
+ * connections by appId.
+ *
+ * ## v1 scope: read-only, unauthenticated
+ *
+ * A scoped instance is UNAUTHENTICATED. It sends no auth, never reads or
+ * refreshes the global session, and connects to its app's realtime endpoint
+ * anonymously. It is therefore only useful against collections a Bounded app
+ * exposes with a public read rule (`read: true`) - private/per-user reads will
+ * be denied by the target app's policy, exactly as an anonymous caller would be.
+ *
+ * Writes and any auth-requiring surface are NOT supported on a scoped instance
+ * and throw a clear error. Per-instance authentication is a planned follow-up.
+ */
+/** Error thrown when an unsupported (write / auth-requiring) call is made on a
+ *  read-only scoped client. */
+class ScopedClientReadOnlyError extends Error {
+    constructor(operation) {
+        super(`createClient() instances are read-only in v1: "${operation}" is not supported. ` +
+            `Use the global init() client for authenticated writes, or read only public ` +
+            `(read: true) collections on this scoped instance.`);
+        this.name = 'ScopedClientReadOnlyError';
+    }
+}
+/**
+ * Create a read-only client scoped to a single Bounded app.
+ *
+ * @example
+ * ```ts
+ * // Global client stays the venue's own authenticated app:
+ * await init({ appId: VENUE_APP, network: 'bounded-production', authMethod: 'email' });
+ *
+ * // A second, read-only client for the steward runtime app:
+ * const steward = createClient({ appId: STEWARD_APP, network: 'bounded-production' });
+ * const state = await steward.get('runtime/current');
+ * const stop = await steward.subscribe('runtime/current', (d) => render(d));
+ * ```
+ */
+function createClient(config) {
+    if (!config || !config.appId) {
+        throw new Error('createClient requires an appId.');
+    }
+    // Resolve from the PRISTINE defaults (never the mutated global) so a scoped
+    // instance is fully independent of any prior init(). Same precedence as init:
+    // defaults < network preset < explicit fields.
+    const resolved = resolveClientConfig(DEFAULT_CLIENT_CONFIG, config);
+    // The override channel that carries this instance's identity through the
+    // shared transport and subscription code. `_config` retargets endpoints +
+    // appId; `_readOnly` omits auth and blocks ambient-session/global-cache reads.
+    const instanceOverrides = () => ({ _config: resolved, _readOnly: true });
+    // Merge caller-supplied opts with the instance overrides. The instance
+    // `_config`/`_readOnly` are applied LAST so app code can never override the
+    // routing/identity of a scoped call (but may still pass e.g. an AbortSignal).
+    const withOverrides = (opts) => {
+        var _a;
+        const base = (opts !== null && opts !== void 0 ? opts : {});
+        return Object.assign(Object.assign({}, base), { _overrides: Object.assign(Object.assign({}, ((_a = base._overrides) !== null && _a !== void 0 ? _a : {})), instanceOverrides()) });
+    };
+    return {
+        appId: resolved.appId,
+        getConfig: () => (Object.assign({}, resolved)),
+        get: (path, opts) => get(path, withOverrides(opts)),
+        getMany: (paths, opts) => getMany(paths, withOverrides(opts)),
+        search: (path, query, opts) => search(path, query, withOverrides(opts)),
+        queryAggregate: (path, spec, opts) => queryAggregate(path, spec, withOverrides(opts)),
+        count: (path, opts) => count(path, withOverrides(opts)),
+        aggregate: (path, operation, opts) => aggregate(path, operation, withOverrides(opts)),
+        runQuery: (absolutePath, queryName, queryArgs, opts) => runQuery(absolutePath, queryName, queryArgs, withOverrides(opts)),
+        runQueryMany: (many, opts) => runQueryMany(many, withOverrides(opts)),
+        subscribe: (path, options) => {
+            var _a;
+            const opts = typeof options === 'function' ? { onData: options } : Object.assign({}, options);
+            // Force this instance's scoped, read-only routing onto the subscription.
+            opts._overrides = Object.assign(Object.assign({}, ((_a = opts._overrides) !== null && _a !== void 0 ? _a : {})), { _config: resolved, _readOnly: true });
+            return subscribe(path, opts);
+        },
+        set: () => { throw new ScopedClientReadOnlyError('set'); },
+        setMany: () => { throw new ScopedClientReadOnlyError('setMany'); },
+    };
+}
+
 /**
  * Live named-query subscriptions (subscribeQuery) - HTTP client poller (v1).
  *
@@ -8481,12 +8668,12 @@ function toMillis(seconds) {
 
 /** Load the Anchor/Web3 transaction builder only when an onchain write uses it. */
 async function buildSetDocumentsTransaction(connection, idl, programProvider, payerPublicKey, args, remainingAccounts, lutKey, preInstructions, simulate, additionalLutAddresses) {
-    const implementation = await import('./sol-utils-v8cCs2pm.mjs');
+    const implementation = await import('./sol-utils-BhjxvQUj.mjs');
     return implementation.buildSetDocumentsTransaction(connection, idl, programProvider, payerPublicKey, args, remainingAccounts, lutKey, preInstructions, simulate, additionalLutAddresses);
 }
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-CSjZx5xE.mjs');
+    const implementation = await import('./solana-message-XxVgbtp2.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
@@ -9018,5 +9205,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { refreshSession as $, reconnectWithNewAuth as A, subscribeQuery as B, closeAllQuerySubscriptions as C, canonicalizeArgs as D, canonicalizeResult as E, DEFAULT_QUERY_POLL_INTERVAL_MS as F, BoundedDeclineError as G, deriveDecline as H, InsufficientBalanceError as I, dispatchDeclineEvent as J, DECLINE_EVENT_NAME as K, dispatchRateLimitEvent as L, MIN_QUERY_POLL_INTERVAL_MS as M, hasActiveConnection as N, increment as O, serverTimestamp as P, now as Q, RATE_LIMIT_EVENT_NAME as R, toSeconds as S, toMillis as T, getIdToken as U, deriveUserIdentityFromIdToken as V, WebSessionManager as W, ReactNativeSessionManager as X, getActiveSessionManager as Y, ServerSessionManager as Z, createSessionWithSignature as _, getWebhookKeysUrl as a, revokeSession as a0, signSessionCreateMessage as a1, genAuthNonce as a2, buildSetDocumentsTransaction as a3, convertRemainingAccounts as a4, genSolanaMessage as a5, genSiweMessage as a6, normalizeEvmAddress as a7, toLowerEvmAddress as a8, assertCanonicalBoundedRuntimeWriteCalldata as a9, assertEvmTransactionMatchesWrite as aa, BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR as ab, BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR as ac, functions as ad, invoke as ae, FunctionInvokeError as af, live as ag, intent as ah, status as ai, subscribeView as aj, LiveIntentError as ak, withEffects as al, isEffectResult as am, defineLiveModule as an, EFFECT_INTENT_ADDRESS as ao, bufferExports as b, get as c, getMany as d, docId as e, setMany as f, getConfig as g, setFile as h, init as i, getFiles as j, search as k, runQueryMany as l, runExpression as m, runExpressionMany as n, signMessage as o, signTransaction as p, queryAggregate as q, runQuery as r, set as s, signAndSubmitTransaction as t, count as u, aggregate as v, subscribe as w, closeAllSubscriptions as x, clearCache as y, getCachedData as z };
-//# sourceMappingURL=index-CbTo1jKG.mjs.map
+export { ServerSessionManager as $, reconnectWithNewAuth as A, createClient as B, subscribeQuery as C, closeAllQuerySubscriptions as D, canonicalizeArgs as E, canonicalizeResult as F, DEFAULT_QUERY_POLL_INTERVAL_MS as G, BoundedDeclineError as H, InsufficientBalanceError as I, deriveDecline as J, dispatchDeclineEvent as K, DECLINE_EVENT_NAME as L, MIN_QUERY_POLL_INTERVAL_MS as M, dispatchRateLimitEvent as N, hasActiveConnection as O, increment as P, serverTimestamp as Q, RATE_LIMIT_EVENT_NAME as R, ScopedClientReadOnlyError as S, now as T, toSeconds as U, toMillis as V, getIdToken as W, deriveUserIdentityFromIdToken as X, WebSessionManager as Y, ReactNativeSessionManager as Z, getActiveSessionManager as _, getWebhookKeysUrl as a, createSessionWithSignature as a0, refreshSession as a1, revokeSession as a2, signSessionCreateMessage as a3, genAuthNonce as a4, buildSetDocumentsTransaction as a5, convertRemainingAccounts as a6, genSolanaMessage as a7, genSiweMessage as a8, normalizeEvmAddress as a9, toLowerEvmAddress as aa, assertCanonicalBoundedRuntimeWriteCalldata as ab, assertEvmTransactionMatchesWrite as ac, BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR as ad, BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR as ae, functions as af, invoke as ag, FunctionInvokeError as ah, live as ai, intent as aj, status as ak, subscribeView as al, LiveIntentError as am, withEffects as an, isEffectResult as ao, defineLiveModule as ap, EFFECT_INTENT_ADDRESS as aq, bufferExports as b, get as c, getMany as d, docId as e, setMany as f, getConfig as g, setFile as h, init as i, getFiles as j, search as k, runQueryMany as l, runExpression as m, runExpressionMany as n, signMessage as o, signTransaction as p, queryAggregate as q, runQuery as r, set as s, signAndSubmitTransaction as t, count as u, aggregate as v, subscribe as w, closeAllSubscriptions as x, clearCache as y, getCachedData as z };
+//# sourceMappingURL=index-qcTp-5Mt.mjs.map