@bounded-sh/core 0.0.55 → 0.0.57

package/dist/client/config.d.ts

@@ -92,6 +92,18 @@ export interface ClientConfig {
         network?: string | null;
         rpcUrl?: string | null;
     };
+    /** LOGIN MODE for the unified login widget (default 'bounded'). 'bounded' runs
+     *  the existing Better Auth email/social/OIDC flows. 'turnkey' opts the email
+     *  lane into Turnkey-native OTP INLINE in the widget (no second Bounded OTP);
+     *  social + wallet lanes are unchanged. A per-call openBoundedWidget({ authMode })
+     *  can override this. */
+    authMode?: 'bounded' | 'turnkey';
+    /** SITE POLICY: require an email on file for every user (default false). Native
+     *  wallet login carries no email, so when true the unified widget suppresses the
+     *  "Continue with wallet" lane (email/social remain). Overrides walletLogin and
+     *  any per-call `wallet: true`. Set `walletLogin: false` to hide the wallet lane
+     *  without requiring email. */
+    requireEmail?: boolean;
     /** Solana WALLET LOGIN provider configuration (advanced). Passing this object
      *  ALSO opts the app into wallet login (equivalent to walletLogin). The slim,
      *  dependency-free "connect wallet" path rides the injected Solana provider a
@@ -141,6 +153,14 @@ export declare const BOUNDED_NETWORKS: Record<string, BoundedEndpoints>;
  * fail-closed production default (audit SDK LOW-7).
  */
 export declare function getWebhookKeysUrl(): string | undefined;
+/**
+ * The app id configured via `init({ appId })`, or `undefined` when none has been set.
+ * Synchronous + non-blocking on purpose (mirrors {@link getWebhookKeysUrl}): a pure webhook
+ * receiver may never call `init()`, and `getConfig()` would block on initialization. Used by
+ * `verifyWebhook` to bind a webhook to THIS app by default (#072) rather than trusting any
+ * app's shared-key-signed delivery.
+ */
+export declare function getConfiguredAppId(): string | undefined;
 /**
  * True when init() configured a Bounded network (the Cloudflare-native stack).
  * Synchronous + non-blocking. Used to route reads/writes that behave differently

package/dist/client/live.d.ts

@@ -21,6 +21,8 @@ export type LiveStatusOptions = {
     timeoutMs?: number;
     /** Extra headers (advanced/testing). */
     headers?: Record<string, string>;
+    /** @internal Per-call auth override used by server WalletClient. */
+    _overrides?: RequestOverrides;
 };
 export type LiveStopReason = 'idle' | 'lifetime' | 'error' | 'manual' | 'evicted' | string;
 export type LiveStatus = {
@@ -71,6 +73,13 @@ export declare function intent(roomPath: string, intent: unknown, opts?: LiveInt
  * This is diagnostic/ops surface. It reports whether the room facet exists,
  * whether it is currently ticking, why it last stopped, which module etag is
  * loaded, and the current generation used after terminal restarts.
+ *
+ * Auth: status attaches the caller's session token WHEN ONE EXISTS (mirroring
+ * `intent`), but does NOT require it. The server gates the DETAILED body on the
+ * room's read rule — an authenticated caller who can read the room gets full
+ * telemetry; an anonymous / unauthorized caller gets only the slim liveness
+ * shape `{available, started, module}` (#102). The caller's own `opts.headers`
+ * may never smuggle in Authorization: only the derived session token sets it.
  */
 export declare function status(roomPath: string, opts?: LiveStatusOptions): Promise<LiveStatus>;
 export type SubscribeViewOptions = {

package/dist/{index-BXvTkFw2.js → index-B30-XpaX.js}

@@ -82,6 +82,16 @@ function getWebhookKeysUrl() {
         return undefined;
     return host.replace(/\/$/, '') + '/.well-known/bounded-webhook-keys.json';
 }
+/**
+ * The app id configured via `init({ appId })`, or `undefined` when none has been set.
+ * Synchronous + non-blocking on purpose (mirrors {@link getWebhookKeysUrl}): a pure webhook
+ * receiver may never call `init()`, and `getConfig()` would block on initialization. Used by
+ * `verifyWebhook` to bind a webhook to THIS app by default (#072) rather than trusting any
+ * app's shared-key-signed delivery.
+ */
+function getConfiguredAppId() {
+    return clientConfig.appId || undefined;
+}
 /**
  * True when init() configured a Bounded network (the Cloudflare-native stack).
  * Synchronous + non-blocking. Used to route reads/writes that behave differently
@@ -2795,19 +2805,28 @@ function resolveIssuerBase(issuer, cfg) {
         return want;
     return norm(cfg.authApiUrl);
 }
-let axiosClient;
+// #062: key the auth client by its baseURL. The old single memoized client froze the FIRST
+// environment's authApiUrl, so after re-initializing the SDK to a different issuer (staging->
+// prod, or a custom issuer) the mint calls (/nonce, /auth/nonce, /session) kept hitting the
+// original address forever - a "works only after a full reload" login bug, and in a multi-tenant
+// process one config's address could leak into another's. refresh/revoke already resolve per
+// call via resolveIssuerBase; this makes minting do the same while still caching per URL.
+const axiosClientsByUrl = new Map();
 async function getAxiosAuthClient() {
-    if (!axiosClient) {
-        const config = await getConfig();
-        axiosClient = axios.create({
-            baseURL: config.authApiUrl,
+    const config = await getConfig();
+    const baseURL = config.authApiUrl || '';
+    let client = axiosClientsByUrl.get(baseURL);
+    if (!client) {
+        client = axios.create({
+            baseURL,
             headers: {
                 'Content-Type': 'application/json',
             },
             timeout: 30000, // 30s timeout, matching makeApiRequest
         });
+        axiosClientsByUrl.set(baseURL, client);
     }
-    return axiosClient;
+    return client;
 }
 async function genAuthNonce() {
     const client = await getAxiosAuthClient();
@@ -2972,6 +2991,44 @@ async function revokeSession(refreshToken, issuer) {
 async function signSessionCreateMessage(_signMessageFunction) {
 }
 
+// Shared session-binding guard for the web + React Native session managers, so
+// the cross-principal refresh guard (#220 / #221) lives in ONE place and the two
+// managers can't drift apart. Base64url decoding differs by platform (browser
+// atob vs a configured decoder), so the caller passes its own decoder in.
+/**
+ * Extract the `custom:walletAddress` claim from a JWT idToken. Returns undefined
+ * when the token has no wallet claim or cannot be decoded.
+ */
+function idTokenWalletAddress(idToken, decodeBase64Url) {
+    try {
+        const payloadB64 = idToken.split(".")[1];
+        if (!payloadB64)
+            return undefined;
+        const wallet = JSON.parse(decodeBase64Url(payloadB64))["custom:walletAddress"];
+        return typeof wallet === "string" && wallet.length > 0 ? wallet : undefined;
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+/**
+ * Whether a refreshed idToken may be grafted onto the CURRENTLY-stored session.
+ *
+ * A silent refresh started for user A can complete after storage was replaced
+ * with user B (a login, guest→wallet upgrade, or a cross-tab login). Overwriting
+ * B's tokens with A's — the app-id matches, so the old guard let it through —
+ * installs a genuine-but-WRONG session: the UI shows B while the app authenticates
+ * as A (#220 / #221). Refuse the write when the refreshed token binds to a
+ * DIFFERENT wallet than the one currently stored. A tokenless/addressless session
+ * (guest / opaque) preserves the prior behavior (returns true).
+ */
+function refreshedTokenMayReplaceStored(newIdToken, storedAddress, decodeBase64Url) {
+    const tokenWallet = idTokenWalletAddress(newIdToken, decodeBase64Url);
+    if (!tokenWallet || !storedAddress)
+        return true;
+    return tokenWallet === storedAddress;
+}
+
 class WebSessionManager {
     /**
      * Decode a base64url-encoded string (used by JWT payloads).
@@ -3128,16 +3185,27 @@ class WebSessionManager {
         var _a;
         if (typeof window === "undefined")
             return;
+        // Resolve config FIRST so the read → check → write below is one synchronous
+        // turn (an atomic CAS): no `await` can let a concurrent login interleave a
+        // different session between the read and the write (#221).
+        const config = await getConfig();
         const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         if (!session)
             return;
         const sessionObj = JSON.parse(session);
         /* ---------- app-id guard ---------- */
-        const config = await getConfig();
         if (sessionObj.appId && sessionObj.appId !== config.appId) {
             this.clearSession();
             return;
         }
+        /* ---------- cross-principal guard (#221) ---------- */
+        // Refuse to graft a refreshed token onto a DIFFERENT user's stored session
+        // (a stale refresh completing after a login/upgrade replaced storage, incl.
+        // a cross-tab login). Also re-runs the wallet-binding check storeSession does.
+        if (!refreshedTokenMayReplaceStored(idToken, sessionObj.address, (s) => this.decodeBase64Url(s))) {
+            console.warn("[WebSessionManager] updateIdTokenAndAccessToken: refreshed token wallet does not match the stored session address — discarding stale refresh");
+            return;
+        }
         sessionObj.idToken = idToken;
         sessionObj.accessToken = accessToken;
         // Persist the rotated refresh token when the issuer returns a new one.
@@ -3346,16 +3414,27 @@ class ReactNativeSessionManager {
     /* ------------------------------------------------------------------ */
     static async updateIdTokenAndAccessToken(idToken, accessToken, refreshToken) {
         var _a;
+        // Resolve config FIRST so the read → check → write below is one synchronous
+        // turn (an atomic CAS): no `await` can let a concurrent login interleave a
+        // different session between the read and the write (#220).
+        const config = await getConfig();
         const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         if (!session)
             return;
         const sessionObj = JSON.parse(session);
         /* ---------- app-id guard ---------- */
-        const config = await getConfig();
         if (sessionObj.appId && sessionObj.appId !== config.appId) {
             this.clearSession();
             return;
         }
+        /* ---------- cross-principal guard (#220) ---------- */
+        // Refuse to graft a refreshed token onto a DIFFERENT user's stored session
+        // (a stale refresh completing after a login/upgrade replaced storage). Also
+        // re-runs the wallet-binding check storeSession does.
+        if (!refreshedTokenMayReplaceStored(idToken, sessionObj.address, (s) => this.decodeBase64Url(s))) {
+            console.warn("[ReactNativeSessionManager] updateIdTokenAndAccessToken: refreshed token wallet does not match the stored session address — discarding stale refresh");
+            return;
+        }
         sessionObj.idToken = idToken;
         sessionObj.accessToken = accessToken;
         if (typeof refreshToken === "string" && refreshToken.length > 0) {
@@ -3410,6 +3489,12 @@ class ServerSessionManager {
         this.session = null;
         /* Coalesce concurrent getSession() calls into a single in-flight request */
         this.pendingSession = null;
+        /* Monotonic generation, bumped on clear/set. An in-flight createSession() only
+         * commits its result to the cache if the generation still matches the value it
+         * captured when it started — so a clearSession()/setSession() that happens WHILE
+         * a create is in flight deterministically wins, and the late result can't
+         * silently re-install a session the caller just cleared/replaced (#259). */
+        this.generation = 0;
         this.keypair = keypair !== null && keypair !== void 0 ? keypair : null;
         this.sessionFactory = sessionFactory !== null && sessionFactory !== void 0 ? sessionFactory : null;
     }
@@ -3451,7 +3536,7 @@ class ServerSessionManager {
         const address = kp.publicKey.toBase58();
         /* fetch nonce from auth API */
         const nonce = await genAuthNonce();
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-I9w1TbAj.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-DKOPPJwk.js'); });
         const message = await genSolanaMessage(address, nonce);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -3472,9 +3557,13 @@ class ServerSessionManager {
         if (this.pendingSession !== null) {
             return this.pendingSession;
         }
+        const startedGeneration = this.generation;
         this.pendingSession = this.createSession()
             .then((session) => {
-            this.session = session;
+            // Only commit if no clear/set happened while this create was in flight.
+            if (this.generation === startedGeneration) {
+                this.session = session;
+            }
             return session;
         })
             .finally(() => {
@@ -3486,12 +3575,14 @@ class ServerSessionManager {
      * STORE  (overwrites the cached value)
      * ---------------------------------------------- */
     setSession(session) {
+        this.generation++;
         this.session = session;
     }
     /* ---------------------------------------------- *
      * CLEAR  (e.g. after explicit logout)
      * ---------------------------------------------- */
     clearSession() {
+        this.generation++;
         this.session = null;
         this.pendingSession = null;
     }
@@ -4025,8 +4116,27 @@ axiosRetry(apiClient, {
     },
 });
 const refreshInFlight = new Map();
+// Short, bounded, non-secret fingerprint of a refresh token — used only to KEY the
+// in-flight de-dup map (never logged, never the raw secret).
+function refreshTokenFingerprint(token) {
+    let h = 5381;
+    for (let i = 0; i < token.length; i++)
+        h = ((h << 5) + h + token.charCodeAt(i)) >>> 0;
+    return h.toString(16);
+}
 async function refreshAuthSessionOnce(appId, isServer) {
-    const key = `${isServer ? "server" : "web"}:${appId}`;
+    // Capture the CURRENT session's refresh token up front and key the in-flight
+    // refresh by it, not just by the app. Keyed by app only, a refresh started for
+    // user A would be reused for a request issued after switching to user B (guest→
+    // wallet upgrade, logout/login), so B's 401 recovery would piggyback on A's
+    // refresh (#112). Per-session keying keeps de-dup for the SAME session while
+    // making a post-switch refresh a distinct entry. (The token WRITE is separately
+    // guarded per-principal in the session managers, #220/#221.)
+    const refreshToken = await getRefreshToken(isServer);
+    if (!refreshToken) {
+        return false;
+    }
+    const key = `${isServer ? "server" : "web"}:${appId}:${refreshTokenFingerprint(refreshToken)}`;
     const existing = refreshInFlight.get(key);
     if (existing) {
         return existing;
@@ -4034,10 +4144,6 @@ async function refreshAuthSessionOnce(appId, isServer) {
     const refreshPromise = (async () => {
         var _a, _b;
         try {
-            const refreshToken = await getRefreshToken(isServer);
-            if (!refreshToken) {
-                return false;
-            }
             const refreshData = await refreshSession(refreshToken, getSessionIssuer(isServer));
             if (!(refreshData === null || refreshData === void 0 ? void 0 : refreshData.idToken) || !(refreshData === null || refreshData === void 0 ? void 0 : refreshData.accessToken)) {
                 return false;
@@ -4078,9 +4184,21 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
                 ? {}
                 : await createAuthHeader(config.isServer);
         const headers = Object.assign({ "Content-Type": "application/json", "X-App-Id": config.appId }, authHeader);
-        // Apply custom headers from _overrides
+        // Apply custom headers from _overrides. #022/#023: HTTP header names are
+        // case-insensitive, so normalize any override `authorization` (in any casing) onto the
+        // single canonical `Authorization` key - never send two differently-cased Authorization
+        // headers, and keep the credential the request sends identical to the one the read
+        // cache key is derived from.
         if (_overrides === null || _overrides === void 0 ? void 0 : _overrides.headers) {
-            Object.assign(headers, _overrides.headers);
+            for (const [name, value] of Object.entries(_overrides.headers)) {
+                if (name.toLowerCase() === "authorization") {
+                    delete headers["authorization"];
+                    headers["Authorization"] = value;
+                }
+                else {
+                    headers[name] = value;
+                }
+            }
         }
         // Writes (PUT/POST/DELETE) can take significantly longer than reads —
         // server-side they may trigger ad-hoc LUT creation (create + extend +
@@ -5892,7 +6010,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-DmzboN-H.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-BpQsQYhl.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -6717,14 +6835,25 @@ function hashForKeyCached(value) {
     principalHashCache.set(value, h);
     return h;
 }
-function hasAuthHeader(headers) {
+// #022: HTTP header names are case-insensitive on the wire, so recognize `authorization`
+// in ANY casing when deriving the per-user cache key. Otherwise a caller-supplied
+// `AUTHORIZATION: <token B>` rides into the request while the cache key is computed from
+// the ambient token A - filing B's data under A's identity. The cache key must always be
+// derived from the same credential the request authenticates with.
+function authHeaderEntry(headers) {
     if (!headers)
-        return false;
-    return (Object.prototype.hasOwnProperty.call(headers, 'Authorization') ||
-        Object.prototype.hasOwnProperty.call(headers, 'authorization'));
+        return undefined;
+    for (const name of Object.keys(headers)) {
+        if (name.toLowerCase() === 'authorization')
+            return headers[name];
+    }
+    return undefined;
+}
+function hasAuthHeader(headers) {
+    return authHeaderEntry(headers) !== undefined;
 }
 function authValueFromHeaders(headers) {
-    return (headers === null || headers === void 0 ? void 0 : headers.Authorization) || (headers === null || headers === void 0 ? void 0 : headers.authorization) || '';
+    return authHeaderEntry(headers) || '';
 }
 function principalFromAuthValue(authValue) {
     return authValue ? `h${hashForKeyCached(authValue)}` : null;
@@ -7437,8 +7566,16 @@ async function runExpressionMany(many) {
         let queries = [];
         let overrides = undefined;
         for (const { expression, queryArgs, returnType, _overrides } of many) {
-            // Collect overrides from first query that has them (all queries share same request)
-            if (_overrides && !overrides) {
+            // All batched queries ride ONE request, so they must run under ONE credential.
+            // Reject mixed per-entry _overrides (fail closed) instead of silently running
+            // every query under the FIRST credential — that would evaluate a query meant
+            // for user B as whoever came first (e.g. an admin), a cross-principal
+            // authorization confusion the caller can't detect (#103). Split the batch by
+            // credential to run under different identities.
+            if (_overrides) {
+                if (overrides && overrides !== _overrides) {
+                    throw new Error("[bounded-sdk] runExpressionMany: batched queries carry different _overrides; all queries in one batch share a single request and credential. Split the batch so each request uses one credential.");
+                }
                 overrides = _overrides;
             }
             queries.push({ queryArgs, expression, returnType });
@@ -7580,11 +7717,11 @@ async function setMany(many, options) {
                 transactionResult = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
             }
             else if (curTx.serializedTransaction) {
-                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-BUJkyVxN.js'); });
+                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-BOKHbEuy.js'); });
                 transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             else {
-                const { handleSolanaTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-BUJkyVxN.js'); });
+                const { handleSolanaTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-BOKHbEuy.js'); });
                 transactionResult = await handleSolanaTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             // Sync items after all transactions are confirmed
@@ -8110,17 +8247,25 @@ function isQueryLevelError(error) {
     return (error === null || error === void 0 ? void 0 : error.isQueryError) === true || (error === null || error === void 0 ? void 0 : error.isBoundedDecline) === true || (error === null || error === void 0 ? void 0 : error.decline) != null;
 }
 /**
- * A RECOGNIZED transient transport failure that a retry might clear (HTTP status like
- * 429/5xx, a network/abort error). These back off SILENTLY - surfacing them per-poll
- * would rebuild the 429 noise. Anything else (a bad path, a malformed response - things
- * a retry won't fix) is NOT transient, so it gets surfaced once to onError instead of a
- * silently-dead subscription.
+ * A RECOGNIZED transient transport failure that a retry might clear (HTTP 408/429/5xx, a
+ * network/abort error). These back off SILENTLY - surfacing them per-poll would rebuild the
+ * 429 noise. Anything else (a bad path 404, a permission/config 401/403, a malformed request
+ * 400 - things a retry won't fix) is NOT transient, so it gets surfaced once to onError
+ * instead of a silently-dead subscription.
  */
 function isTransientTransportError(error) {
     if (error == null)
         return true; // unknown - be conservative and keep retrying
-    if (typeof error.status === 'number' || typeof error.statusCode === 'number')
-        return true;
+    // #060: classify by the actual status, not merely by "has a status". Almost every HTTP
+    // failure carries a status, including the TERMINAL ones (400/401/403/404); the old
+    // `typeof status === 'number'` check lumped them all into "transient" and retried them
+    // forever with no onError - the exact silently-dead subscription this is meant to avoid.
+    const status = typeof error.status === 'number' ? error.status
+        : typeof error.statusCode === 'number' ? error.statusCode
+            : undefined;
+    if (status !== undefined) {
+        return status === 408 || status === 429 || status >= 500;
+    }
     const code = error.code;
     if (code === 'ECONNABORTED' || code === 'ERR_NETWORK' || code === 'ETIMEDOUT' || code === 'ERR_CANCELED')
         return true;
@@ -8670,12 +8815,12 @@ function toMillis(seconds) {
 
 /** Load the Anchor/Web3 transaction builder only when an onchain write uses it. */
 async function buildSetDocumentsTransaction(connection, idl, programProvider, payerPublicKey, args, remainingAccounts, lutKey, preInstructions, simulate, additionalLutAddresses) {
-    const implementation = await Promise.resolve().then(function () { return require('./sol-utils-oBMCMbe_.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./sol-utils-Cwxyl2h6.js'); });
     return implementation.buildSetDocumentsTransaction(connection, idl, programProvider, payerPublicKey, args, remainingAccounts, lutKey, preInstructions, simulate, additionalLutAddresses);
 }
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-I9w1TbAj.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-DKOPPJwk.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
@@ -9066,6 +9211,13 @@ async function intent(roomPath, intent, opts = {}) {
  * This is diagnostic/ops surface. It reports whether the room facet exists,
  * whether it is currently ticking, why it last stopped, which module etag is
  * loaded, and the current generation used after terminal restarts.
+ *
+ * Auth: status attaches the caller's session token WHEN ONE EXISTS (mirroring
+ * `intent`), but does NOT require it. The server gates the DETAILED body on the
+ * room's read rule — an authenticated caller who can read the room gets full
+ * telemetry; an anonymous / unauthorized caller gets only the slim liveness
+ * shape `{available, started, module}` (#102). The caller's own `opts.headers`
+ * may never smuggle in Authorization: only the derived session token sets it.
  */
 async function status(roomPath, opts = {}) {
     var _a, _b, _c, _d, _e;
@@ -9075,7 +9227,10 @@ async function status(roomPath, opts = {}) {
     const normalizedRoomPath = roomPath.replace(/\/$/, '');
     const config = await getConfig();
     const base = realtimeHttpBase(config.wsApiUrl);
-    const headers = Object.assign({ 'X-App-Id': config.appId }, ((_a = opts.headers) !== null && _a !== void 0 ? _a : {}));
+    const authHeader = await liveAuthHeader(config.isServer, opts._overrides);
+    const extraHeaders = withoutAuthorization(opts.headers);
+    const overrideHeaders = withoutAuthorization((_a = opts._overrides) === null || _a === void 0 ? void 0 : _a.headers);
+    const headers = Object.assign(Object.assign(Object.assign({ 'X-App-Id': config.appId }, (overrideHeaders !== null && overrideHeaders !== void 0 ? overrideHeaders : {})), (extraHeaders !== null && extraHeaders !== void 0 ? extraHeaders : {})), (hasAuthorization(authHeader) ? authHeader : {}));
     const controller = new AbortController();
     const timeoutMs = (_b = opts.timeoutMs) !== null && _b !== void 0 ? _b : 15000;
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -9250,6 +9405,7 @@ exports.get = get;
 exports.getActiveSessionManager = getActiveSessionManager;
 exports.getCachedData = getCachedData;
 exports.getConfig = getConfig;
+exports.getConfiguredAppId = getConfiguredAppId;
 exports.getFiles = getFiles;
 exports.getIdToken = getIdToken;
 exports.getMany = getMany;
@@ -9288,4 +9444,4 @@ exports.toLowerEvmAddress = toLowerEvmAddress;
 exports.toMillis = toMillis;
 exports.toSeconds = toSeconds;
 exports.withEffects = withEffects;
-//# sourceMappingURL=index-BXvTkFw2.js.map
+//# sourceMappingURL=index-B30-XpaX.js.map