@bounded-sh/core 0.0.55 → 0.0.57

package/dist/{index-qcTp-5Mt.mjs → index-DYbzK8YT.mjs}

@@ -80,6 +80,16 @@ function getWebhookKeysUrl() {
         return undefined;
     return host.replace(/\/$/, '') + '/.well-known/bounded-webhook-keys.json';
 }
+/**
+ * The app id configured via `init({ appId })`, or `undefined` when none has been set.
+ * Synchronous + non-blocking on purpose (mirrors {@link getWebhookKeysUrl}): a pure webhook
+ * receiver may never call `init()`, and `getConfig()` would block on initialization. Used by
+ * `verifyWebhook` to bind a webhook to THIS app by default (#072) rather than trusting any
+ * app's shared-key-signed delivery.
+ */
+function getConfiguredAppId() {
+    return clientConfig.appId || undefined;
+}
 /**
  * True when init() configured a Bounded network (the Cloudflare-native stack).
  * Synchronous + non-blocking. Used to route reads/writes that behave differently
@@ -2793,19 +2803,28 @@ function resolveIssuerBase(issuer, cfg) {
         return want;
     return norm(cfg.authApiUrl);
 }
-let axiosClient;
+// #062: key the auth client by its baseURL. The old single memoized client froze the FIRST
+// environment's authApiUrl, so after re-initializing the SDK to a different issuer (staging->
+// prod, or a custom issuer) the mint calls (/nonce, /auth/nonce, /session) kept hitting the
+// original address forever - a "works only after a full reload" login bug, and in a multi-tenant
+// process one config's address could leak into another's. refresh/revoke already resolve per
+// call via resolveIssuerBase; this makes minting do the same while still caching per URL.
+const axiosClientsByUrl = new Map();
 async function getAxiosAuthClient() {
-    if (!axiosClient) {
-        const config = await getConfig();
-        axiosClient = axios.create({
-            baseURL: config.authApiUrl,
+    const config = await getConfig();
+    const baseURL = config.authApiUrl || '';
+    let client = axiosClientsByUrl.get(baseURL);
+    if (!client) {
+        client = axios.create({
+            baseURL,
             headers: {
                 'Content-Type': 'application/json',
             },
             timeout: 30000, // 30s timeout, matching makeApiRequest
         });
+        axiosClientsByUrl.set(baseURL, client);
     }
-    return axiosClient;
+    return client;
 }
 async function genAuthNonce() {
     const client = await getAxiosAuthClient();
@@ -2970,6 +2989,44 @@ async function revokeSession(refreshToken, issuer) {
 async function signSessionCreateMessage(_signMessageFunction) {
 }
 
+// Shared session-binding guard for the web + React Native session managers, so
+// the cross-principal refresh guard (#220 / #221) lives in ONE place and the two
+// managers can't drift apart. Base64url decoding differs by platform (browser
+// atob vs a configured decoder), so the caller passes its own decoder in.
+/**
+ * Extract the `custom:walletAddress` claim from a JWT idToken. Returns undefined
+ * when the token has no wallet claim or cannot be decoded.
+ */
+function idTokenWalletAddress(idToken, decodeBase64Url) {
+    try {
+        const payloadB64 = idToken.split(".")[1];
+        if (!payloadB64)
+            return undefined;
+        const wallet = JSON.parse(decodeBase64Url(payloadB64))["custom:walletAddress"];
+        return typeof wallet === "string" && wallet.length > 0 ? wallet : undefined;
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+/**
+ * Whether a refreshed idToken may be grafted onto the CURRENTLY-stored session.
+ *
+ * A silent refresh started for user A can complete after storage was replaced
+ * with user B (a login, guest→wallet upgrade, or a cross-tab login). Overwriting
+ * B's tokens with A's — the app-id matches, so the old guard let it through —
+ * installs a genuine-but-WRONG session: the UI shows B while the app authenticates
+ * as A (#220 / #221). Refuse the write when the refreshed token binds to a
+ * DIFFERENT wallet than the one currently stored. A tokenless/addressless session
+ * (guest / opaque) preserves the prior behavior (returns true).
+ */
+function refreshedTokenMayReplaceStored(newIdToken, storedAddress, decodeBase64Url) {
+    const tokenWallet = idTokenWalletAddress(newIdToken, decodeBase64Url);
+    if (!tokenWallet || !storedAddress)
+        return true;
+    return tokenWallet === storedAddress;
+}
+
 class WebSessionManager {
     /**
      * Decode a base64url-encoded string (used by JWT payloads).
@@ -3126,16 +3183,27 @@ class WebSessionManager {
         var _a;
         if (typeof window === "undefined")
             return;
+        // Resolve config FIRST so the read → check → write below is one synchronous
+        // turn (an atomic CAS): no `await` can let a concurrent login interleave a
+        // different session between the read and the write (#221).
+        const config = await getConfig();
         const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         if (!session)
             return;
         const sessionObj = JSON.parse(session);
         /* ---------- app-id guard ---------- */
-        const config = await getConfig();
         if (sessionObj.appId && sessionObj.appId !== config.appId) {
             this.clearSession();
             return;
         }
+        /* ---------- cross-principal guard (#221) ---------- */
+        // Refuse to graft a refreshed token onto a DIFFERENT user's stored session
+        // (a stale refresh completing after a login/upgrade replaced storage, incl.
+        // a cross-tab login). Also re-runs the wallet-binding check storeSession does.
+        if (!refreshedTokenMayReplaceStored(idToken, sessionObj.address, (s) => this.decodeBase64Url(s))) {
+            console.warn("[WebSessionManager] updateIdTokenAndAccessToken: refreshed token wallet does not match the stored session address — discarding stale refresh");
+            return;
+        }
         sessionObj.idToken = idToken;
         sessionObj.accessToken = accessToken;
         // Persist the rotated refresh token when the issuer returns a new one.
@@ -3344,16 +3412,27 @@ class ReactNativeSessionManager {
     /* ------------------------------------------------------------------ */
     static async updateIdTokenAndAccessToken(idToken, accessToken, refreshToken) {
         var _a;
+        // Resolve config FIRST so the read → check → write below is one synchronous
+        // turn (an atomic CAS): no `await` can let a concurrent login interleave a
+        // different session between the read and the write (#220).
+        const config = await getConfig();
         const session = this.getStorage().getItem(this.BOUNDED_SESSION_STORAGE_KEY);
         if (!session)
             return;
         const sessionObj = JSON.parse(session);
         /* ---------- app-id guard ---------- */
-        const config = await getConfig();
         if (sessionObj.appId && sessionObj.appId !== config.appId) {
             this.clearSession();
             return;
         }
+        /* ---------- cross-principal guard (#220) ---------- */
+        // Refuse to graft a refreshed token onto a DIFFERENT user's stored session
+        // (a stale refresh completing after a login/upgrade replaced storage). Also
+        // re-runs the wallet-binding check storeSession does.
+        if (!refreshedTokenMayReplaceStored(idToken, sessionObj.address, (s) => this.decodeBase64Url(s))) {
+            console.warn("[ReactNativeSessionManager] updateIdTokenAndAccessToken: refreshed token wallet does not match the stored session address — discarding stale refresh");
+            return;
+        }
         sessionObj.idToken = idToken;
         sessionObj.accessToken = accessToken;
         if (typeof refreshToken === "string" && refreshToken.length > 0) {
@@ -3408,6 +3487,12 @@ class ServerSessionManager {
         this.session = null;
         /* Coalesce concurrent getSession() calls into a single in-flight request */
         this.pendingSession = null;
+        /* Monotonic generation, bumped on clear/set. An in-flight createSession() only
+         * commits its result to the cache if the generation still matches the value it
+         * captured when it started — so a clearSession()/setSession() that happens WHILE
+         * a create is in flight deterministically wins, and the late result can't
+         * silently re-install a session the caller just cleared/replaced (#259). */
+        this.generation = 0;
         this.keypair = keypair !== null && keypair !== void 0 ? keypair : null;
         this.sessionFactory = sessionFactory !== null && sessionFactory !== void 0 ? sessionFactory : null;
     }
@@ -3449,7 +3534,7 @@ class ServerSessionManager {
         const address = kp.publicKey.toBase58();
         /* fetch nonce from auth API */
         const nonce = await genAuthNonce();
-        const { genSolanaMessage } = await import('./solana-message-XxVgbtp2.mjs');
+        const { genSolanaMessage } = await import('./solana-message-C2_VvNX7.mjs');
         const message = await genSolanaMessage(address, nonce);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -3470,9 +3555,13 @@ class ServerSessionManager {
         if (this.pendingSession !== null) {
             return this.pendingSession;
         }
+        const startedGeneration = this.generation;
         this.pendingSession = this.createSession()
             .then((session) => {
-            this.session = session;
+            // Only commit if no clear/set happened while this create was in flight.
+            if (this.generation === startedGeneration) {
+                this.session = session;
+            }
             return session;
         })
             .finally(() => {
@@ -3484,12 +3573,14 @@ class ServerSessionManager {
      * STORE  (overwrites the cached value)
      * ---------------------------------------------- */
     setSession(session) {
+        this.generation++;
         this.session = session;
     }
     /* ---------------------------------------------- *
      * CLEAR  (e.g. after explicit logout)
      * ---------------------------------------------- */
     clearSession() {
+        this.generation++;
         this.session = null;
         this.pendingSession = null;
     }
@@ -4023,8 +4114,27 @@ axiosRetry(apiClient, {
     },
 });
 const refreshInFlight = new Map();
+// Short, bounded, non-secret fingerprint of a refresh token — used only to KEY the
+// in-flight de-dup map (never logged, never the raw secret).
+function refreshTokenFingerprint(token) {
+    let h = 5381;
+    for (let i = 0; i < token.length; i++)
+        h = ((h << 5) + h + token.charCodeAt(i)) >>> 0;
+    return h.toString(16);
+}
 async function refreshAuthSessionOnce(appId, isServer) {
-    const key = `${isServer ? "server" : "web"}:${appId}`;
+    // Capture the CURRENT session's refresh token up front and key the in-flight
+    // refresh by it, not just by the app. Keyed by app only, a refresh started for
+    // user A would be reused for a request issued after switching to user B (guest→
+    // wallet upgrade, logout/login), so B's 401 recovery would piggyback on A's
+    // refresh (#112). Per-session keying keeps de-dup for the SAME session while
+    // making a post-switch refresh a distinct entry. (The token WRITE is separately
+    // guarded per-principal in the session managers, #220/#221.)
+    const refreshToken = await getRefreshToken(isServer);
+    if (!refreshToken) {
+        return false;
+    }
+    const key = `${isServer ? "server" : "web"}:${appId}:${refreshTokenFingerprint(refreshToken)}`;
     const existing = refreshInFlight.get(key);
     if (existing) {
         return existing;
@@ -4032,10 +4142,6 @@ async function refreshAuthSessionOnce(appId, isServer) {
     const refreshPromise = (async () => {
         var _a, _b;
         try {
-            const refreshToken = await getRefreshToken(isServer);
-            if (!refreshToken) {
-                return false;
-            }
             const refreshData = await refreshSession(refreshToken, getSessionIssuer(isServer));
             if (!(refreshData === null || refreshData === void 0 ? void 0 : refreshData.idToken) || !(refreshData === null || refreshData === void 0 ? void 0 : refreshData.accessToken)) {
                 return false;
@@ -4076,9 +4182,21 @@ async function makeApiRequest(method, urlPath, data, _overrides) {
                 ? {}
                 : await createAuthHeader(config.isServer);
         const headers = Object.assign({ "Content-Type": "application/json", "X-App-Id": config.appId }, authHeader);
-        // Apply custom headers from _overrides
+        // Apply custom headers from _overrides. #022/#023: HTTP header names are
+        // case-insensitive, so normalize any override `authorization` (in any casing) onto the
+        // single canonical `Authorization` key - never send two differently-cased Authorization
+        // headers, and keep the credential the request sends identical to the one the read
+        // cache key is derived from.
         if (_overrides === null || _overrides === void 0 ? void 0 : _overrides.headers) {
-            Object.assign(headers, _overrides.headers);
+            for (const [name, value] of Object.entries(_overrides.headers)) {
+                if (name.toLowerCase() === "authorization") {
+                    delete headers["authorization"];
+                    headers["Authorization"] = value;
+                }
+                else {
+                    headers[name] = value;
+                }
+            }
         }
         // Writes (PUT/POST/DELETE) can take significantly longer than reads —
         // server-side they may trigger ad-hoc LUT creation (create + extend +
@@ -5890,7 +6008,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-BzKEmyxq.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-BSuV-Vyr.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -6715,14 +6833,25 @@ function hashForKeyCached(value) {
     principalHashCache.set(value, h);
     return h;
 }
-function hasAuthHeader(headers) {
+// #022: HTTP header names are case-insensitive on the wire, so recognize `authorization`
+// in ANY casing when deriving the per-user cache key. Otherwise a caller-supplied
+// `AUTHORIZATION: <token B>` rides into the request while the cache key is computed from
+// the ambient token A - filing B's data under A's identity. The cache key must always be
+// derived from the same credential the request authenticates with.
+function authHeaderEntry(headers) {
     if (!headers)
-        return false;
-    return (Object.prototype.hasOwnProperty.call(headers, 'Authorization') ||
-        Object.prototype.hasOwnProperty.call(headers, 'authorization'));
+        return undefined;
+    for (const name of Object.keys(headers)) {
+        if (name.toLowerCase() === 'authorization')
+            return headers[name];
+    }
+    return undefined;
+}
+function hasAuthHeader(headers) {
+    return authHeaderEntry(headers) !== undefined;
 }
 function authValueFromHeaders(headers) {
-    return (headers === null || headers === void 0 ? void 0 : headers.Authorization) || (headers === null || headers === void 0 ? void 0 : headers.authorization) || '';
+    return authHeaderEntry(headers) || '';
 }
 function principalFromAuthValue(authValue) {
     return authValue ? `h${hashForKeyCached(authValue)}` : null;
@@ -7435,8 +7564,16 @@ async function runExpressionMany(many) {
         let queries = [];
         let overrides = undefined;
         for (const { expression, queryArgs, returnType, _overrides } of many) {
-            // Collect overrides from first query that has them (all queries share same request)
-            if (_overrides && !overrides) {
+            // All batched queries ride ONE request, so they must run under ONE credential.
+            // Reject mixed per-entry _overrides (fail closed) instead of silently running
+            // every query under the FIRST credential — that would evaluate a query meant
+            // for user B as whoever came first (e.g. an admin), a cross-principal
+            // authorization confusion the caller can't detect (#103). Split the batch by
+            // credential to run under different identities.
+            if (_overrides) {
+                if (overrides && overrides !== _overrides) {
+                    throw new Error("[bounded-sdk] runExpressionMany: batched queries carry different _overrides; all queries in one batch share a single request and credential. Split the batch so each request uses one credential.");
+                }
                 overrides = _overrides;
             }
             queries.push({ queryArgs, expression, returnType });
@@ -7578,11 +7715,11 @@ async function setMany(many, options) {
                 transactionResult = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
             }
             else if (curTx.serializedTransaction) {
-                const { handlePreBuiltTransaction } = await import('./solana-operations-ehEsfO5g.mjs');
+                const { handlePreBuiltTransaction } = await import('./solana-operations-CuYFYlyN.mjs');
                 transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             else {
-                const { handleSolanaTransaction } = await import('./solana-operations-ehEsfO5g.mjs');
+                const { handleSolanaTransaction } = await import('./solana-operations-CuYFYlyN.mjs');
                 transactionResult = await handleSolanaTransaction(curTx, authProvider, options, expectedWritePaths);
             }
             // Sync items after all transactions are confirmed
@@ -8108,17 +8245,25 @@ function isQueryLevelError(error) {
     return (error === null || error === void 0 ? void 0 : error.isQueryError) === true || (error === null || error === void 0 ? void 0 : error.isBoundedDecline) === true || (error === null || error === void 0 ? void 0 : error.decline) != null;
 }
 /**
- * A RECOGNIZED transient transport failure that a retry might clear (HTTP status like
- * 429/5xx, a network/abort error). These back off SILENTLY - surfacing them per-poll
- * would rebuild the 429 noise. Anything else (a bad path, a malformed response - things
- * a retry won't fix) is NOT transient, so it gets surfaced once to onError instead of a
- * silently-dead subscription.
+ * A RECOGNIZED transient transport failure that a retry might clear (HTTP 408/429/5xx, a
+ * network/abort error). These back off SILENTLY - surfacing them per-poll would rebuild the
+ * 429 noise. Anything else (a bad path 404, a permission/config 401/403, a malformed request
+ * 400 - things a retry won't fix) is NOT transient, so it gets surfaced once to onError
+ * instead of a silently-dead subscription.
  */
 function isTransientTransportError(error) {
     if (error == null)
         return true; // unknown - be conservative and keep retrying
-    if (typeof error.status === 'number' || typeof error.statusCode === 'number')
-        return true;
+    // #060: classify by the actual status, not merely by "has a status". Almost every HTTP
+    // failure carries a status, including the TERMINAL ones (400/401/403/404); the old
+    // `typeof status === 'number'` check lumped them all into "transient" and retried them
+    // forever with no onError - the exact silently-dead subscription this is meant to avoid.
+    const status = typeof error.status === 'number' ? error.status
+        : typeof error.statusCode === 'number' ? error.statusCode
+            : undefined;
+    if (status !== undefined) {
+        return status === 408 || status === 429 || status >= 500;
+    }
     const code = error.code;
     if (code === 'ECONNABORTED' || code === 'ERR_NETWORK' || code === 'ETIMEDOUT' || code === 'ERR_CANCELED')
         return true;
@@ -8668,12 +8813,12 @@ function toMillis(seconds) {
 
 /** Load the Anchor/Web3 transaction builder only when an onchain write uses it. */
 async function buildSetDocumentsTransaction(connection, idl, programProvider, payerPublicKey, args, remainingAccounts, lutKey, preInstructions, simulate, additionalLutAddresses) {
-    const implementation = await import('./sol-utils-BhjxvQUj.mjs');
+    const implementation = await import('./sol-utils-DVjPeoMy.mjs');
     return implementation.buildSetDocumentsTransaction(connection, idl, programProvider, payerPublicKey, args, remainingAccounts, lutKey, preInstructions, simulate, additionalLutAddresses);
 }
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-XxVgbtp2.mjs');
+    const implementation = await import('./solana-message-C2_VvNX7.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
@@ -9064,6 +9209,13 @@ async function intent(roomPath, intent, opts = {}) {
  * This is diagnostic/ops surface. It reports whether the room facet exists,
  * whether it is currently ticking, why it last stopped, which module etag is
  * loaded, and the current generation used after terminal restarts.
+ *
+ * Auth: status attaches the caller's session token WHEN ONE EXISTS (mirroring
+ * `intent`), but does NOT require it. The server gates the DETAILED body on the
+ * room's read rule — an authenticated caller who can read the room gets full
+ * telemetry; an anonymous / unauthorized caller gets only the slim liveness
+ * shape `{available, started, module}` (#102). The caller's own `opts.headers`
+ * may never smuggle in Authorization: only the derived session token sets it.
  */
 async function status(roomPath, opts = {}) {
     var _a, _b, _c, _d, _e;
@@ -9073,7 +9225,10 @@ async function status(roomPath, opts = {}) {
     const normalizedRoomPath = roomPath.replace(/\/$/, '');
     const config = await getConfig();
     const base = realtimeHttpBase(config.wsApiUrl);
-    const headers = Object.assign({ 'X-App-Id': config.appId }, ((_a = opts.headers) !== null && _a !== void 0 ? _a : {}));
+    const authHeader = await liveAuthHeader(config.isServer, opts._overrides);
+    const extraHeaders = withoutAuthorization(opts.headers);
+    const overrideHeaders = withoutAuthorization((_a = opts._overrides) === null || _a === void 0 ? void 0 : _a.headers);
+    const headers = Object.assign(Object.assign(Object.assign({ 'X-App-Id': config.appId }, (overrideHeaders !== null && overrideHeaders !== void 0 ? overrideHeaders : {})), (extraHeaders !== null && extraHeaders !== void 0 ? extraHeaders : {})), (hasAuthorization(authHeader) ? authHeader : {}));
     const controller = new AbortController();
     const timeoutMs = (_b = opts.timeoutMs) !== null && _b !== void 0 ? _b : 15000;
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -9205,5 +9360,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { ServerSessionManager as $, reconnectWithNewAuth as A, createClient as B, subscribeQuery as C, closeAllQuerySubscriptions as D, canonicalizeArgs as E, canonicalizeResult as F, DEFAULT_QUERY_POLL_INTERVAL_MS as G, BoundedDeclineError as H, InsufficientBalanceError as I, deriveDecline as J, dispatchDeclineEvent as K, DECLINE_EVENT_NAME as L, MIN_QUERY_POLL_INTERVAL_MS as M, dispatchRateLimitEvent as N, hasActiveConnection as O, increment as P, serverTimestamp as Q, RATE_LIMIT_EVENT_NAME as R, ScopedClientReadOnlyError as S, now as T, toSeconds as U, toMillis as V, getIdToken as W, deriveUserIdentityFromIdToken as X, WebSessionManager as Y, ReactNativeSessionManager as Z, getActiveSessionManager as _, getWebhookKeysUrl as a, createSessionWithSignature as a0, refreshSession as a1, revokeSession as a2, signSessionCreateMessage as a3, genAuthNonce as a4, buildSetDocumentsTransaction as a5, convertRemainingAccounts as a6, genSolanaMessage as a7, genSiweMessage as a8, normalizeEvmAddress as a9, toLowerEvmAddress as aa, assertCanonicalBoundedRuntimeWriteCalldata as ab, assertEvmTransactionMatchesWrite as ac, BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR as ad, BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR as ae, functions as af, invoke as ag, FunctionInvokeError as ah, live as ai, intent as aj, status as ak, subscribeView as al, LiveIntentError as am, withEffects as an, isEffectResult as ao, defineLiveModule as ap, EFFECT_INTENT_ADDRESS as aq, bufferExports as b, get as c, getMany as d, docId as e, setMany as f, getConfig as g, setFile as h, init as i, getFiles as j, search as k, runQueryMany as l, runExpression as m, runExpressionMany as n, signMessage as o, signTransaction as p, queryAggregate as q, runQuery as r, set as s, signAndSubmitTransaction as t, count as u, aggregate as v, subscribe as w, closeAllSubscriptions as x, clearCache as y, getCachedData as z };
-//# sourceMappingURL=index-qcTp-5Mt.mjs.map
+export { getActiveSessionManager as $, getCachedData as A, reconnectWithNewAuth as B, createClient as C, subscribeQuery as D, closeAllQuerySubscriptions as E, canonicalizeArgs as F, canonicalizeResult as G, DEFAULT_QUERY_POLL_INTERVAL_MS as H, InsufficientBalanceError as I, BoundedDeclineError as J, deriveDecline as K, dispatchDeclineEvent as L, MIN_QUERY_POLL_INTERVAL_MS as M, DECLINE_EVENT_NAME as N, dispatchRateLimitEvent as O, hasActiveConnection as P, increment as Q, RATE_LIMIT_EVENT_NAME as R, ScopedClientReadOnlyError as S, serverTimestamp as T, now as U, toSeconds as V, toMillis as W, getIdToken as X, deriveUserIdentityFromIdToken as Y, WebSessionManager as Z, ReactNativeSessionManager as _, getWebhookKeysUrl as a, ServerSessionManager as a0, createSessionWithSignature as a1, refreshSession as a2, revokeSession as a3, signSessionCreateMessage as a4, genAuthNonce as a5, buildSetDocumentsTransaction as a6, convertRemainingAccounts as a7, genSolanaMessage as a8, genSiweMessage as a9, normalizeEvmAddress as aa, toLowerEvmAddress as ab, assertCanonicalBoundedRuntimeWriteCalldata as ac, assertEvmTransactionMatchesWrite as ad, BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR as ae, BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR as af, functions as ag, invoke as ah, FunctionInvokeError as ai, live as aj, intent as ak, status as al, subscribeView as am, LiveIntentError as an, withEffects as ao, isEffectResult as ap, defineLiveModule as aq, EFFECT_INTENT_ADDRESS as ar, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, runQueryMany as m, runExpression as n, runExpressionMany as o, signMessage as p, queryAggregate as q, runQuery as r, set as s, signTransaction as t, signAndSubmitTransaction as u, count as v, aggregate as w, subscribe as x, closeAllSubscriptions as y, clearCache as z };
+//# sourceMappingURL=index-DYbzK8YT.mjs.map