@bounded-sh/core 0.0.65 → 0.0.67

package/dist/{index-BNOU00XY.mjs → index-TyXiW4Uf.mjs}

@@ -551,22 +551,25 @@ async function createSessionWithSignature(address, message, signature, authMetho
 // Deduplicate concurrent refreshSession calls to prevent multiple code paths
 // (WebSocket reconnection, periodic refresh, API 401 retry) from all hitting
 // /session/refresh simultaneously.
-// Note: module-level state is shared across requests in SSR/Node — acceptable
-// since there is only one active session per server instance (same pattern as
-// refreshInFlight in api.ts).
-let refreshInFlight = null;
-let refreshInFlightToken = null;
+//
+// Keyed PER (issuer, token) in a Map, not one global slot (DS2-0373): the rotating
+// refresh token is single-use, so two concurrent refreshes of the SAME token must
+// share one in-flight request. A single global slot could hold only one token at a
+// time, so an interleaved refresh of a DIFFERENT session's token evicted the first
+// token's in-flight promise; a later second refresh of the first token then missed
+// its own in-flight request and re-POSTed the already-spent token - the issuer sees
+// reuse and revokes the whole family. Keying by token lets unrelated sessions
+// coalesce independently.
+// Note: module-level state is shared across requests in SSR/Node - acceptable since
+// each key is bound to a specific session's token (same pattern as api.ts).
+const refreshInFlightByToken = new Map();
 async function refreshSession(refreshToken, issuer) {
-    // Dedupe per (issuer, token): the rotating token is single-use, so two
-    // concurrent refreshes of the SAME token must share one in-flight request or
-    // the second would look like reuse and revoke the family.
     const dedupeKey = `${issuer || ''}::${refreshToken}`;
-    if (refreshInFlight && refreshInFlightToken === dedupeKey) {
-        return refreshInFlight;
-    }
-    refreshInFlightToken = dedupeKey;
+    const existing = refreshInFlightByToken.get(dedupeKey);
+    if (existing)
+        return existing;
     let currentFlight;
-    currentFlight = refreshInFlight = (async () => {
+    currentFlight = (async () => {
         try {
             const config = await getConfig();
             const appId = config.appId;
@@ -581,15 +584,16 @@ async function refreshSession(refreshToken, issuer) {
             return response.data;
         }
         finally {
-            // Only clear if we're still the active in-flight request.
-            // A second call with a different token may have replaced us.
-            if (refreshInFlight === currentFlight) {
-                refreshInFlight = null;
-                refreshInFlightToken = null;
+            // Only remove our own entry, and only if it is still the active flight
+            // for this token (a later refresh of the same token cannot have replaced
+            // it while we were in flight, but this stays correct if that ever changes).
+            if (refreshInFlightByToken.get(dedupeKey) === currentFlight) {
+                refreshInFlightByToken.delete(dedupeKey);
             }
         }
     })();
-    return refreshInFlight;
+    refreshInFlightByToken.set(dedupeKey, currentFlight);
+    return currentFlight;
 }
 class SessionRevokeError extends Error {
     constructor(message, cause) {
@@ -1003,7 +1007,12 @@ class WebSessionManager {
             // hosted login. The idToken carries the canonical identity (@user.id) + exp.
             const { idToken } = sessionObj;
             const { exp } = JSON.parse(this.decodeBase64Url(idToken.split(".")[1]));
-            if (Date.now() > exp * 1000) {
+            // Treat a MISSING or non-numeric expiry as EXPIRED (fail closed). A bare
+            // `Date.now() > exp * 1000` is NaN -> false when exp is absent/non-numeric,
+            // so a forged or malformed token with no usable expiry would otherwise be
+            // accepted as valid forever.
+            const expired = typeof exp !== "number" || !Number.isFinite(exp) || Date.now() > exp * 1000;
+            if (expired) {
                 const { refreshToken } = sessionObj;
                 // Expired token with no way to refresh — clear the stale session
                 // (mirrors the refresh-failed branch below) so isAuthenticated()
@@ -1109,25 +1118,46 @@ class WebSessionManager {
     /* ------------------------------------------------------------------ */
     /* TOKEN HELPERS                                                      */
     /* ------------------------------------------------------------------ */
+    // These reads are DEFENSIVE (try/catch -> treat a corrupt blob as absent).
+    // logout() reads the refresh token + issuer BEFORE the session is cleared; if a
+    // corrupt (non-JSON) blob threw out of the read, logout would abort with the
+    // credential still in storage while isAuthenticated() kept reporting true, so
+    // sign-out could never complete. A corrupt blob is unusable either way, so
+    // reporting "no token" lets the clear path proceed and finish the sign-out.
     static getIdToken() {
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        return session ? JSON.parse(session).idToken : null;
+        try {
+            const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return session ? JSON.parse(session).idToken : null;
+        }
+        catch (_a) {
+            return null;
+        }
     }
     static getRefreshToken() {
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        return session ? JSON.parse(session).refreshToken : null;
+        try {
+            const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return session ? JSON.parse(session).refreshToken : null;
+        }
+        catch (_a) {
+            return null;
+        }
     }
     /** The issuer base that minted this session (for routing silent refresh). */
     static getIssuer() {
         var _a;
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        return session ? ((_a = JSON.parse(session).issuer) !== null && _a !== void 0 ? _a : null) : null;
+        try {
+            const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return session ? ((_a = JSON.parse(session).issuer) !== null && _a !== void 0 ? _a : null) : null;
+        }
+        catch (_b) {
+            return null;
+        }
     }
     /* ------------------------------------------------------------------ */
     /* UPDATE TOKENS                                                      */
@@ -1385,7 +1415,12 @@ class ReactNativeSessionManager {
             // logins is opaque, so decoding it threw → the catch wiped a valid session.
             const { idToken } = sessionObj;
             const { exp } = JSON.parse(this.decodeBase64Url(idToken.split(".")[1]));
-            if (Date.now() > exp * 1000) {
+            // Treat a MISSING or non-numeric expiry as EXPIRED (fail closed). A bare
+            // `Date.now() > exp * 1000` is NaN -> false when exp is absent/non-numeric,
+            // so a forged or malformed token with no usable expiry would otherwise be
+            // accepted as valid forever.
+            const expired = typeof exp !== "number" || !Number.isFinite(exp) || Date.now() > exp * 1000;
+            if (expired) {
                 const { refreshToken } = sessionObj;
                 // Expired token with no way to refresh — clear the stale session
                 // (mirrors the refresh-failed branch below) so isAuthenticated()
@@ -4008,7 +4043,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-VZBGvV0S.mjs');
+        const { genSolanaMessage } = await import('./solana-message-DXXwC95Z.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4100,18 +4135,31 @@ ServerSessionManager.instance = new ServerSessionManager();
  *
  * These are used instead of bare `atob()`/`btoa()` so the core package
  * works in React Native without requiring the consumer to polyfill globals.
+ *
+ * Both directions are UTF-8-safe: bare btoa / Buffer('binary') are LATIN-1 and
+ * throw (surrogate-pair emoji) or silently mangle (accents, CJK) any code point
+ * > 0xFF, corrupting user text - e.g. an AI-query `prompt` - before it is sent.
+ * safeBtoa base64s the UTF-8 bytes; safeAtob is its exact inverse, and the
+ * realtime worker decodes the same bytes as UTF-8 (src/utf8-base64.ts). ASCII is
+ * byte-identical either way, so JWT (decodeBase64Url) decoding is unaffected.
  */
 function safeAtob(input) {
     if (typeof globalThis.atob === 'function') {
-        return globalThis.atob(input);
+        const binary = globalThis.atob(input);
+        const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+        return new TextDecoder().decode(bytes);
     }
-    return bufferExports.Buffer.from(input, 'base64').toString('binary');
+    return bufferExports.Buffer.from(input, 'base64').toString('utf-8');
 }
 function safeBtoa(input) {
+    const bytes = new TextEncoder().encode(input);
     if (typeof globalThis.btoa === 'function') {
-        return globalThis.btoa(input);
+        let binary = '';
+        for (let i = 0; i < bytes.length; i++)
+            binary += String.fromCharCode(bytes[i]);
+        return globalThis.btoa(binary);
     }
-    return bufferExports.Buffer.from(input, 'binary').toString('base64');
+    return bufferExports.Buffer.from(bytes).toString('base64');
 }
 /**
  * Decode a base64url-encoded string (used by JWT payloads).
@@ -6727,7 +6775,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-mzFJ8bHE.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-CpbnXM7q.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -7401,17 +7449,6 @@ function assertEvmTransactionMatchesWrite(transaction, context) {
     }
 }
 
-var __rest$1 = (undefined && undefined.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
 /**
  * Thrown when a user's wallet doesn't have enough SOL to cover the transaction.
  * Apps can catch this to trigger an onramp/funding flow.
@@ -7989,7 +8026,11 @@ async function get(path, opts = {}) {
                 }
                 else {
                     const path = encodeURIComponent(normalizedPath);
-                    const promptQueryParam = (opts === null || opts === void 0 ? void 0 : opts.prompt) ? `&prompt=${safeBtoa(opts.prompt)}` : "";
+                    // encodeURIComponent the base64: safeBtoa emits standard base64 (with '+' '/' '='),
+                    // and a raw '+' in a query string decodes to a space on the server
+                    // (url.searchParams.get), corrupting the exact non-ASCII prompts DS2-0463 fixed. The
+                    // server percent-decodes back to the original base64 before decodeUtf8Base64. (DS2-0463)
+                    const promptQueryParam = (opts === null || opts === void 0 ? void 0 : opts.prompt) ? `&prompt=${encodeURIComponent(safeBtoa(opts.prompt))}` : "";
                     const apiPath = `items?path=${path}${promptQueryParam}${filterParam}${sortParam}${includeSubPathsParam}${shapeParam}${limitParam}${cursorParam}`;
                     response = await makeApiRequest('GET', apiPath, null, opts._overrides);
                 }
@@ -8330,20 +8371,200 @@ async function runExpressionMany(many) {
         throw error;
     }
 }
+/* ===================== WRITE RECEIPT HELPERS (W4) ======================== */
+/**
+ * Settle delay before the best-effort mirror read on an on-chain write. It is
+ * an optimization, not a correctness guarantee: the receipt is captured first
+ * and returned regardless of what the mirror read reports.
+ */
+const MIRROR_SYNC_SETTLE_MS = 1500;
+const SOLANA_CHAIN_TAGS = new Set(['solana_devnet', 'solana_mainnet']);
+/**
+ * Read the execution-lane tag the WORKER reported. The SDK never infers it: a
+ * batch touching only unflagged collections in a `realtime_devnet` app commits
+ * offchain, so the app's protocol is not the lane. Several field names are
+ * accepted (batch-level receipt first, then the per-transaction Solana
+ * `network` tag that predates it), but no value is ever manufactured.
+ */
+function readWorkerChainTag(...sources) {
+    for (const source of sources) {
+        if (!source || typeof source !== 'object')
+            continue;
+        for (const key of ['chain', 'executionChain', 'network']) {
+            const value = source[key];
+            if (typeof value === 'string' && value.trim().length > 0)
+                return value.trim();
+        }
+    }
+    return null;
+}
+/** Path-keyed echo of what the caller asked for. NEVER authoritative state. */
+function buildRequestedDocuments(documents) {
+    return documents.map(entry => {
+        var _a;
+        return ({
+            path: entry.destinationPath,
+            document: ((_a = entry.document) !== null && _a !== void 0 ? _a : null),
+        });
+    });
+}
+/** Look a concrete path up in a path-keyed map, tolerating a leading slash. */
+function pickPathDocument(source, path) {
+    if (Object.prototype.hasOwnProperty.call(source, path))
+        return source[path];
+    const withSlash = path.startsWith('/') ? path : `/${path}`;
+    if (Object.prototype.hasOwnProperty.call(source, withSlash))
+        return source[withSlash];
+    const withoutSlash = path.startsWith('/') ? path.slice(1) : path;
+    if (Object.prototype.hasOwnProperty.call(source, withoutSlash))
+        return source[withoutSlash];
+    return undefined;
+}
+/**
+ * `observed: true` only when EVERY requested concrete path was read back as a
+ * real document. The sync endpoint answers `null` for a document that is
+ * absent, lagging, or read-denied, and a deleted path reads back as `null` too
+ * — none of those are evidence of synchronization.
+ */
+function validatePathKeyedDocuments(paths, source) {
+    if (!source || typeof source !== 'object' || Array.isArray(source)) {
+        return { observed: false, reason: 'the synchronization response was not a path-keyed document map' };
+    }
+    const map = source;
+    const documents = [];
+    const unobserved = [];
+    for (const path of paths) {
+        const document = pickPathDocument(map, path);
+        if (document == null || typeof document !== 'object' || Array.isArray(document)) {
+            unobserved.push(path);
+            documents.push({ path, document: null });
+            continue;
+        }
+        documents.push({ path, document: document });
+    }
+    if (unobserved.length > 0) {
+        return {
+            observed: false,
+            reason: `no readable document was returned for ${unobserved.join(', ')} ` +
+                '(absent, deleted, lagging, read-denied, or a passthrough write)',
+        };
+    }
+    return { observed: true, documents };
+}
+/**
+ * Best-effort mirror read. A confirmed transaction must NEVER be lost to a
+ * synchronization failure, so this reports its outcome in `mirrorSync` and
+ * never rejects. It reads the CONCRETE destination paths, so a collection
+ * insert with a generated id syncs the path that actually exists.
+ */
+async function attemptMirrorSync(paths, options, settleMs = MIRROR_SYNC_SETTLE_MS) {
+    try {
+        if (settleMs > 0)
+            await new Promise(resolve => setTimeout(resolve, settleMs));
+        const synced = await syncItems(paths, options);
+        // The sync endpoint answers `{ data: <path-keyed map>, status }`; a document
+        // path always contains a `/`, so a top-level `data` key is never one.
+        const map = (synced && typeof synced === 'object' && !Array.isArray(synced) && 'data' in synced)
+            ? synced.data
+            : synced;
+        return validatePathKeyedDocuments(paths, map);
+    }
+    catch (error) {
+        const message = typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' ? error.message : String(error);
+        return { observed: false, reason: `mirror synchronization failed: ${message}` };
+    }
+}
+function normalizePathKey(path) {
+    return path.startsWith('/') ? path.slice(1) : path;
+}
+/**
+ * Post-hook observation for a DIRECT commit, taken from the worker's own batch
+ * receipt. The worker is the only party that can read every concrete path back
+ * AFTER hooks have run, so when it reports nothing we say so rather than
+ * echoing the request as if it were server state.
+ *
+ * Unlike the mirror read, a `null` document here IS authoritative: the worker
+ * read its own store, so a deleted path genuinely is absent. The worker's
+ * `observed` verdict is still re-validated against the requested paths — a
+ * receipt that skips one of them cannot be treated as complete.
+ */
+function observationFromDirectCommit(paths, observation) {
+    var _a;
+    if (!observation || typeof observation !== 'object' || Array.isArray(observation)) {
+        return { observed: false, reason: 'the write receipt carried no post-hook observation' };
+    }
+    const entries = Array.isArray(observation.documents) ? observation.documents : null;
+    if (!entries) {
+        return { observed: false, reason: 'the write receipt carried no path-keyed post-hook documents' };
+    }
+    const byPath = new Map();
+    for (const entry of entries) {
+        if (!entry || typeof entry.path !== 'string')
+            continue;
+        const document = entry.document;
+        byPath.set(normalizePathKey(entry.path), (document && typeof document === 'object' && !Array.isArray(document))
+            ? document
+            : null);
+    }
+    const documents = [];
+    const missing = [];
+    for (const path of paths) {
+        const key = normalizePathKey(path);
+        if (!byPath.has(key)) {
+            missing.push(path);
+            documents.push({ path, document: null });
+            continue;
+        }
+        documents.push({ path, document: (_a = byPath.get(key)) !== null && _a !== void 0 ? _a : null });
+    }
+    if (observation.observed !== true || missing.length > 0) {
+        const unobserved = Array.isArray(observation.unobserved) ? observation.unobserved : [];
+        const reasons = [
+            ...unobserved
+                .filter((entry) => entry && typeof entry.path === 'string')
+                .map((entry) => { var _a; return `${entry.path}: ${(_a = entry.reason) !== null && _a !== void 0 ? _a : 'not observable'}`; }),
+            ...missing.map(path => `${path}: no entry in the receipt observation`),
+        ];
+        return {
+            observed: false,
+            reason: reasons.length > 0
+                ? reasons.join('; ')
+                : 'the worker could not read every requested path back after hooks',
+        };
+    }
+    return { observed: true, documents };
+}
 /**
  * Write a document at `path`. Sugar for a one-element {@link setMany}.
  *
  * **Delete:** pass `null` as the document to delete it — `set(path, null)` is
  * the delete (there is no separate `del`/`remove`). It is routed through the
- * collection's policy `delete` rule and broadcasts a delete to subscribers.
+ * collection's policy `delete` rule and broadcasts a delete to subscribers, and
+ * the deleted entry surfaces as a `null` document under its path.
+ *
+ * Resolves to a discriminated {@link SetResult}; discriminate on `status`.
  */
 async function set(path, document, options) {
     // setMany already invalidates the read cache for the affected document and
     // collection paths — no second sweep needed here.
     return setMany([{ path, document }], options);
 }
+/**
+ * Atomically write (or delete, with a `null` document) a batch of documents.
+ *
+ * Resolves to a discriminated {@link SetResult}:
+ * - `committed` — the worker applied the batch directly.
+ * - `confirmed` — a client-signed chain transaction landed successfully.
+ * - `submitted` — broadcast happened but the outcome is unknown. NEVER
+ *   resubmit; call `reconcileSetResult`/`waitForSetResult` on the receipt.
+ * - `expired_not_landed` — Solana only, and the one retry-safe terminal state.
+ * - `signed` — `shouldSubmitTx: false`; signed and deliberately not sent.
+ *
+ * `requestedDocuments` is always the caller's own echo; authoritative server
+ * state appears only under `observation`/`mirrorSync` once actually observed.
+ */
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p;
     // Returns the data that was set, or undefined if the document was already set.
     try {
         // A server WalletClient threads its immutable config snapshot; the default
@@ -8425,8 +8646,17 @@ async function setMany(many, options) {
                 (hasSerializedSolanaTarget && hasBuiltSolanaTarget)) {
                 throw new Error('Ambiguous on-chain write response mixes EVM and/or Solana transaction target formats');
             }
-            let transactionResult;
             const expectedWritePaths = documents.map(d => d.destinationPath);
+            const requestedDocuments = buildRequestedDocuments(documents);
+            const appId = config.appId;
+            // The lane comes verbatim from the worker, and is read BEFORE anything is
+            // signed or submitted: a missing tag fails closed while nothing has been
+            // broadcast, instead of stranding a landed transaction with no receipt.
+            const workerChain = readWorkerChainTag((_k = setResponse.data) === null || _k === void 0 ? void 0 : _k.receipt, setResponse.data, curTx);
+            if (!workerChain) {
+                throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
+                    'Nothing was signed or submitted.');
+            }
             // EVM onchain write: the worker returns a PRE-BUILT EIP-1559 tx on
             // `transactions[0].evmTransaction` (the EVM twin of Solana's pre-built
             // `serializedTransaction`). WORKER 202 CONTRACT (field name + shape the
@@ -8441,41 +8671,110 @@ async function setMany(many, options) {
                 assertEvmTransactionMatchesWrite(curTx.evmTransaction, {
                     appId: config.appId,
                     documents,
-                    policy: (_m = (_l = (_k = options === null || options === void 0 ? void 0 : options._overrides) === null || _k === void 0 ? void 0 : _k._evmTransactionPolicy) !== null && _l !== void 0 ? _l : config.evmWalletConfig) !== null && _m !== void 0 ? _m : null,
+                    policy: (_o = (_m = (_l = options === null || options === void 0 ? void 0 : options._overrides) === null || _l === void 0 ? void 0 : _l._evmTransactionPolicy) !== null && _m !== void 0 ? _m : config.evmWalletConfig) !== null && _o !== void 0 ? _o : null,
                 });
-                transactionResult = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
+                const evmChain = workerChain;
+                const evmOutcome = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
+                // CAPTURE THE RECEIPT FIRST. Mirror synchronization comes after, and its
+                // failure can never turn a landed transaction into a thrown error that
+                // invites the caller to submit the same write twice.
+                if (evmOutcome.outcome === 'confirmed') {
+                    const mirrorSync = await attemptMirrorSync(expectedWritePaths, options);
+                    return {
+                        status: 'confirmed', appId, requestedDocuments, chain: evmChain,
+                        transactionId: evmOutcome.transactionSignature,
+                        blockNumber: evmOutcome.blockNumber,
+                        mirrorSync,
+                    };
+                }
+                // An unknown confirmation outcome is NOT a mirror question: nothing is
+                // known to have landed, so no synchronization is attempted.
+                if (evmOutcome.transactionSignature === null) {
+                    return {
+                        status: 'submitted', appId, requestedDocuments, chain: evmChain,
+                        transactionId: null,
+                        confirmation: { state: 'unknown', reason: evmOutcome.reason, reconcilable: false },
+                    };
+                }
+                if ('fence' in evmOutcome && evmOutcome.fence) {
+                    return {
+                        status: 'submitted', appId, requestedDocuments, chain: evmChain,
+                        transactionId: evmOutcome.transactionSignature,
+                        fence: evmOutcome.fence,
+                        confirmation: { state: 'unknown', reason: evmOutcome.reason },
+                    };
+                }
+                return {
+                    status: 'submitted', appId, requestedDocuments, chain: evmChain,
+                    transactionId: evmOutcome.transactionSignature,
+                    rebroadcastable: false,
+                    confirmation: { state: 'unknown', reason: evmOutcome.reason },
+                };
             }
             else if (curTx.serializedTransaction) {
-                const { handlePreBuiltTransaction } = await import('./solana-operations-BlCYbdiN.mjs');
-                transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
+                if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
+                    throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
+                        'Nothing was signed or submitted.');
+                }
+                const solanaChain = workerChain;
+                const { handlePreBuiltTransaction } = await import('./solana-operations-ChHG25O0.mjs');
+                const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
+                // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
+                // and there is nothing to mirror, so no synchronization is attempted.
+                if (solanaOutcome.outcome === 'signed') {
+                    return {
+                        status: 'signed', appId, requestedDocuments, chain: solanaChain,
+                        transactionId: null,
+                        signedTransaction: solanaOutcome.signedTransaction,
+                        fence: solanaOutcome.fence,
+                    };
+                }
+                if (solanaOutcome.outcome === 'submitted') {
+                    return {
+                        status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                        transactionId: solanaOutcome.transactionSignature,
+                        signedTransaction: solanaOutcome.signedTransaction,
+                        fence: solanaOutcome.fence,
+                        confirmation: { state: 'unknown', reason: solanaOutcome.reason },
+                    };
+                }
+                // Confirmed: the receipt is already complete, so the mirror read is a
+                // best-effort enrichment reported in `mirrorSync`, never a rejection.
+                const mirrorSync = await attemptMirrorSync(expectedWritePaths, options);
+                return {
+                    status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: solanaOutcome.transactionSignature,
+                    signedTransaction: solanaOutcome.signedTransaction,
+                    fence: solanaOutcome.fence,
+                    confirmationContextSlot: solanaOutcome.confirmationContextSlot,
+                    mirrorSync,
+                };
             }
             else {
                 throw new Error('Unsupported 202 transaction shape: expected serializedTransaction or evmTransaction');
             }
-            // Sync items after all transactions are confirmed
-            // Wait for 1.5 seconds to ensure all transactions are confirmed
-            await new Promise(resolve => setTimeout(resolve, 1500));
-            await syncItems(many.map(m => m.path), options);
-            // TODO: Should we wait here or do the optimistic subscription updates like below?
-            return Object.assign(Object.assign({}, documents.map(d => d.document)), { transactionId: transactionResult.transactionSignature, signedTransaction: transactionResult.signedTransaction });
         }
         else if (setResponse.status === 200) {
-            // This means that the document was set successfully.
-            // TODO: If we're able to be smarter about it, we can return the document here, and get it back from the server
-            // rather than just using what we set.
-            // TODO: We can also trigger subscriptions here maybe? Can even recall all relevant subscriptions here.
-            if (setResponse.data === true) {
-                return Object.assign(Object.assign({}, documents.map(d => d.document)), { transactionId: null });
-            }
-            else if (setResponse.data &&
-                typeof setResponse.data === 'object' &&
-                setResponse.data.success === true) {
-                const _o = setResponse.data, { success: _success } = _o, rest = __rest$1(_o, ["success"]);
-                return Object.assign(Object.assign(Object.assign({}, documents.map(d => d.document)), rest), { transactionId: null });
-            }
-            else {
-                return Object.assign(Object.assign({}, setResponse.data), { transactionId: null });
-            }
+            // Direct commit: the worker applied the batch itself. The receipt is
+            // batch-level — `transactionId` comes from the worker's own receipt and is
+            // NEVER lifted out of a result document (a delete returns the PREVIOUS
+            // document, so its stale `_transaction_hash` would misreport the delete).
+            const body = (setResponse.data && typeof setResponse.data === 'object' && !Array.isArray(setResponse.data))
+                ? setResponse.data
+                : null;
+            const receipt = ((body === null || body === void 0 ? void 0 : body.receipt) && typeof body.receipt === 'object' && !Array.isArray(body.receipt))
+                ? body.receipt
+                : null;
+            const rawTransactionId = receipt === null || receipt === void 0 ? void 0 : receipt.transactionId;
+            return {
+                status: 'committed',
+                requestedDocuments: buildRequestedDocuments(documents),
+                observation: observationFromDirectCommit(documents.map(d => d.destinationPath), receipt === null || receipt === void 0 ? void 0 : receipt.observation),
+                // A worker predating the batch receipt reports no lane. Say so rather
+                // than inventing one — and never discard a committed write's receipt.
+                chain: ((_p = readWorkerChainTag(receipt)) !== null && _p !== void 0 ? _p : 'unknown'),
+                transactionId: typeof rawTransactionId === 'string' && rawTransactionId.length > 0 ? rawTransactionId : null,
+            };
         }
         else {
             throw new Error(`Failed to set document: ${setResponse}`);
@@ -8490,7 +8789,11 @@ async function setMany(many, options) {
     // slot of runTransaction (Solana slot undefined). shouldSubmitTx is honored by
     // the provider itself.
     async function handleEvmTransaction(evmTransaction, authProvider, options) {
-        return authProvider.runTransaction(evmTransaction, undefined, options);
+        const result = await authProvider.runTransaction(evmTransaction, undefined, options);
+        if ((result === null || result === void 0 ? void 0 : result.lane) !== 'evm') {
+            throw new Error('The EVM auth provider returned a non-EVM transaction outcome');
+        }
+        return result;
     }
 }
 /**
@@ -8570,8 +8873,27 @@ async function getFiles(path, options) {
         throw error;
     }
 }
+/** Pull the worker's concrete object path (`token.pathId`) out of a response body. */
+function readWorkerFilePath(source) {
+    if (!source || typeof source !== 'object')
+        return null;
+    for (const key of ['pathId', 'path', 'destinationPath']) {
+        const value = source[key];
+        if (typeof value === 'string' && value.trim().length > 0)
+            return value.trim();
+    }
+    return null;
+}
+function readFileVisibility(source) {
+    const value = (source && typeof source === 'object') ? source.visibility : undefined;
+    if (value === 'public' || value === 'private' || value === 'unknown')
+        return value;
+    // The worker did not state it, so neither do we. `unknown` never means the
+    // object is private — it means the read-rule evaluation was not reported.
+    return 'unknown';
+}
 async function setFile(path, file, options) {
-    var _a;
+    var _a, _b, _c, _d;
     // 1) Get the presigned URL from your backend
     const requestBody = {
         destinationPath: path,
@@ -8588,10 +8910,18 @@ async function setFile(path, file, options) {
         }
     }
     const response = await makeApiRequest('POST', 'storage/url', requestBody, options === null || options === void 0 ? void 0 : options._overrides);
+    const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
     if (file == null) {
-        return true;
+        // A deletion is acknowledged only by a non-404 response. `makeApiRequest`
+        // normalizes 404 into `{ data: null, status: 404 }` rather than throwing, so
+        // the status has to be inspected.
+        const deletePath = (_a = readWorkerFilePath(response === null || response === void 0 ? void 0 : response.data)) !== null && _a !== void 0 ? _a : normalizedPath;
+        if ((response === null || response === void 0 ? void 0 : response.status) === 404) {
+            return { path: deletePath, deleted: false, alreadyAbsent: true };
+        }
+        return { path: deletePath, deleted: true };
     }
-    if (!((_a = response === null || response === void 0 ? void 0 : response.data) === null || _a === void 0 ? void 0 : _a.s3Url)) {
+    if (!((_b = response === null || response === void 0 ? void 0 : response.data) === null || _b === void 0 ? void 0 : _b.s3Url)) {
         throw new Error("No s3Url in response");
     }
     // Client-side size guard using the limit returned by the server
@@ -8600,20 +8930,62 @@ async function setFile(path, file, options) {
         throw new Error(`File size ${(file.size / (1024 * 1024)).toFixed(2)} MB exceeds the maximum upload size of ${(maxFileSize / (1024 * 1024)).toFixed(0)} MB.`);
     }
     const presignedUrl = response.data.s3Url;
-    // 2) Upload the file directly to S3 with a PUT request
-    const uploadResponse = await fetch(presignedUrl, {
-        method: 'PUT',
-        headers: {
-            'Content-Type': file.type,
-        },
-        body: file
-    });
-    // 3) Check if the upload was successful
+    // Retain the CONCRETE path BEFORE the PUT. Storage generates a collection
+    // upload's id server-side, so `setFile("metadata", file)` creates
+    // `metadata/<generated-id>`; if the commit succeeds and only its response is
+    // lost, this is the only identifier the object has.
+    const retainedPath = (_c = readWorkerFilePath(response.data)) !== null && _c !== void 0 ? _c : normalizedPath;
+    // 2) Upload the file directly to storage with a PUT request
+    let uploadResponse;
+    try {
+        uploadResponse = await fetch(presignedUrl, {
+            method: 'PUT',
+            headers: {
+                'Content-Type': file.type,
+            },
+            body: file
+        });
+    }
+    catch (error) {
+        // The transport itself failed, so we do not know whether the object
+        // committed. This is NOT a definite failure and NOT retry-safe.
+        const message = typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' ? error.message : String(error);
+        return {
+            status: 'unknown',
+            path: retainedPath,
+            reason: `the upload response was lost before it could be read: ${message}`,
+            retrySafe: false,
+        };
+    }
+    // 3) A non-2xx answer is a definite, unambiguous failure — keep throwing.
     if (!uploadResponse.ok) {
-        await uploadResponse.text();
+        await uploadResponse.text().catch(() => '');
         throw new Error(`Upload failed with status: ${uploadResponse.status}`);
     }
-    return true;
+    // 4) The PUT response IS the finalize response: it carries the durable URL
+    //    and the anonymous-read verdict, inside the worker's `{ data, status }`
+    //    envelope.
+    let finalizeBody = null;
+    try {
+        const parsed = await uploadResponse.json();
+        finalizeBody = (parsed && typeof parsed === 'object' && parsed.data && typeof parsed.data === 'object')
+            ? parsed.data
+            : parsed;
+    }
+    catch (_e) {
+        // A worker predating the URL-carrying finalize response answers with
+        // something we cannot parse. The object still committed.
+        finalizeBody = null;
+    }
+    const url = (finalizeBody && typeof finalizeBody.url === 'string' && finalizeBody.url.length > 0)
+        ? finalizeBody.url
+        : null;
+    return {
+        status: 'uploaded',
+        path: (_d = readWorkerFilePath(finalizeBody)) !== null && _d !== void 0 ? _d : retainedPath,
+        url,
+        visibility: readFileVisibility(finalizeBody),
+    };
 }
 async function signMessage(message) {
     const config = await getConfig();
@@ -8650,6 +9022,7 @@ var operations = /*#__PURE__*/Object.freeze({
     __proto__: null,
     InsufficientBalanceError: InsufficientBalanceError,
     aggregate: aggregate,
+    attemptMirrorSync: attemptMirrorSync,
     clearReadCacheForAuthChange: clearReadCacheForAuthChange,
     count: count,
     docId: docId,
@@ -8672,6 +9045,341 @@ var operations = /*#__PURE__*/Object.freeze({
     syncItems: syncItems
 });
 
+const DEFAULT_TIMEOUT_MS = 60000;
+const DEFAULT_MAX_ATTEMPTS = 20;
+const DEFAULT_POLL_INTERVAL_MS = 3000;
+const DEFAULT_MIN_REBROADCAST_INTERVAL_MS = 15000;
+/** Mirror read after a late confirmation. No settle delay: the tx already landed. */
+const RECONCILE_MIRROR_SETTLE_MS = 0;
+function errorText(error) {
+    const message = error === null || error === void 0 ? void 0 : error.message;
+    return typeof message === 'string' && message.length > 0 ? message : String(error);
+}
+function isSolanaSubmitted(receipt) {
+    return receipt.status === 'submitted' && 'signedTransaction' in receipt;
+}
+function isEvmFencedSubmitted(receipt) {
+    return receipt.status === 'submitted' && 'fence' in receipt && !('signedTransaction' in receipt);
+}
+function isEvmHashKnownSubmitted(receipt) {
+    return receipt.status === 'submitted' && receipt.rebroadcastable === false;
+}
+/**
+ * The Solana execution lane a client config REQUIRES, or `null` when the config
+ * carries no constraint. Only a positive contradiction rejects a receipt — an
+ * unmapped or unset `chain` is not evidence of a mismatch.
+ */
+function requiredSolanaChain(config) {
+    switch (config.chain) {
+        case 'realtime_devnet':
+        case 'solana_devnet':
+            return 'solana_devnet';
+        case 'realtime_mainnet':
+        case 'realtime_mainnet_preview':
+        case 'solana_mainnet':
+            return 'solana_mainnet';
+        default:
+            return null;
+    }
+}
+/**
+ * Bind the receipt to the app + chain it was issued for BEFORE any RPC or
+ * mirror request. Writes bind to an immutable config, so a bare reconcile after
+ * a global re-`init()` could otherwise poll the wrong app's endpoints entirely.
+ */
+function assertReceiptMatchesContext(receipt, config) {
+    var _a;
+    if (!receipt.appId || typeof receipt.appId !== 'string') {
+        throw new Error('This write receipt carries no appId and cannot be reconciled.');
+    }
+    if (receipt.appId !== config.appId) {
+        throw new Error(`This write receipt was issued for app "${receipt.appId}" but the bound client targets "${config.appId}". ` +
+            'Reconcile it through the client it came from.');
+    }
+    if (isSolanaSubmitted(receipt)) {
+        const required = requiredSolanaChain(config);
+        if (required && required !== receipt.chain) {
+            throw new Error(`This write receipt ran on "${receipt.chain}" but the bound client targets "${required}".`);
+        }
+        return;
+    }
+    const fence = receipt.fence;
+    if (fence && typeof fence.chainId === 'number') {
+        const evm = config.evmWalletConfig;
+        const configured = new Set();
+        if (evm && typeof evm.chainId === 'number')
+            configured.add(evm.chainId);
+        for (const id of Object.keys((_a = evm === null || evm === void 0 ? void 0 : evm.runtimeAddresses) !== null && _a !== void 0 ? _a : {})) {
+            const parsed = Number(id);
+            if (Number.isSafeInteger(parsed))
+                configured.add(parsed);
+        }
+        if (configured.size > 0 && !configured.has(fence.chainId)) {
+            throw new Error(`This write receipt ran on EVM chain ${fence.chainId}, which the bound client does not configure.`);
+        }
+    }
+}
+function stillSubmitted(receipt, reason) {
+    return Object.assign(Object.assign({}, receipt), { confirmation: Object.assign(Object.assign({}, receipt.confirmation), { reason }) });
+}
+async function mirrorFor(receipt, options) {
+    const paths = receipt.requestedDocuments.map(entry => entry.path);
+    if (paths.length === 0)
+        return { observed: false, reason: 'the receipt carried no requested paths' };
+    const setOptions = (options === null || options === void 0 ? void 0 : options._overrides) ? { _overrides: options._overrides } : undefined;
+    return attemptMirrorSync(paths, setOptions, RECONCILE_MIRROR_SETTLE_MS);
+}
+async function resolveSolanaRpc(config, options) {
+    var _a, _b;
+    const injected = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._solanaRpc;
+    if (injected)
+        return injected;
+    const rpcUrl = (_b = config.rpcUrl) === null || _b === void 0 ? void 0 : _b.trim();
+    if (!rpcUrl) {
+        throw new Error('Reconciling a Solana write receipt requires init({ rpcUrl }).');
+    }
+    const { Connection } = await import('@solana/web3.js');
+    return new Connection(rpcUrl, 'confirmed');
+}
+/**
+ * Solana reconciliation NEVER broadcasts. It reaches `expired_not_landed` only
+ * after the fence is observed expired AND history successfully proves the
+ * signature is absent; a failed or inconclusive lookup stays `submitted`.
+ */
+async function reconcileSolana(receipt, config, options) {
+    var _a, _b, _c, _d;
+    const rpc = await resolveSolanaRpc(config, options);
+    let statusValue = null;
+    let contextSlot;
+    try {
+        if (typeof rpc.getSignatureStatuses !== 'function') {
+            return stillSubmitted(receipt, 'the configured Solana RPC cannot report signature statuses');
+        }
+        const statuses = await rpc.getSignatureStatuses([receipt.transactionId]);
+        statusValue = (_b = (_a = statuses === null || statuses === void 0 ? void 0 : statuses.value) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : null;
+        contextSlot = (_c = statuses === null || statuses === void 0 ? void 0 : statuses.context) === null || _c === void 0 ? void 0 : _c.slot;
+    }
+    catch (error) {
+        return stillSubmitted(receipt, `signature status lookup failed: ${errorText(error)}`);
+    }
+    if (statusValue) {
+        // Landed. A landed-but-failed transaction is a genuine failure, not `submitted`.
+        if (statusValue.err) {
+            throw new Error(`Transaction failed: ${JSON.stringify(statusValue.err)}`);
+        }
+        const confirmed = {
+            status: 'confirmed',
+            appId: receipt.appId,
+            requestedDocuments: receipt.requestedDocuments,
+            chain: receipt.chain,
+            transactionId: receipt.transactionId,
+            signedTransaction: receipt.signedTransaction,
+            fence: receipt.fence,
+            confirmationContextSlot: contextSlot !== null && contextSlot !== void 0 ? contextSlot : 0,
+            mirrorSync: await mirrorFor(receipt, options),
+        };
+        return confirmed;
+    }
+    // Absent from the status window. Expiry has to be OBSERVED before absence can
+    // mean anything: before the fence expires the transaction may still land.
+    let blockHeight;
+    try {
+        blockHeight = typeof rpc.getBlockHeight === 'function' ? await rpc.getBlockHeight('confirmed') : undefined;
+    }
+    catch (error) {
+        return stillSubmitted(receipt, `block height lookup failed: ${errorText(error)}`);
+    }
+    if (typeof blockHeight !== 'number') {
+        return stillSubmitted(receipt, 'expiry could not be observed: the RPC reported no block height');
+    }
+    if (blockHeight <= receipt.fence.lastValidBlockHeight) {
+        return stillSubmitted(receipt, `not yet expired: block height ${blockHeight} is within the fence (lastValidBlockHeight ${receipt.fence.lastValidBlockHeight})`);
+    }
+    // Expired. Prove absence from history before declaring the write retry-safe.
+    let history;
+    try {
+        history = await rpc.getTransaction(receipt.transactionId, {
+            maxSupportedTransactionVersion: 0,
+            commitment: 'confirmed',
+        });
+    }
+    catch (error) {
+        return stillSubmitted(receipt, `history lookup failed after expiry: ${errorText(error)}`);
+    }
+    if (history) {
+        if ((_d = history === null || history === void 0 ? void 0 : history.meta) === null || _d === void 0 ? void 0 : _d.err) {
+            throw new Error(`Transaction failed: ${JSON.stringify(history.meta.err)}`);
+        }
+        const confirmed = {
+            status: 'confirmed',
+            appId: receipt.appId,
+            requestedDocuments: receipt.requestedDocuments,
+            chain: receipt.chain,
+            transactionId: receipt.transactionId,
+            signedTransaction: receipt.signedTransaction,
+            fence: receipt.fence,
+            confirmationContextSlot: typeof history.slot === 'number' ? history.slot : (contextSlot !== null && contextSlot !== void 0 ? contextSlot : 0),
+            mirrorSync: await mirrorFor(receipt, options),
+        };
+        return confirmed;
+    }
+    return {
+        status: 'expired_not_landed',
+        appId: receipt.appId,
+        requestedDocuments: receipt.requestedDocuments,
+        chain: receipt.chain,
+        transactionId: receipt.transactionId,
+        fence: receipt.fence,
+    };
+}
+/**
+ * EVM reconciliation runs through the provider's own transport, so a wallet
+ * client reconciles with its own identity and RPC. There is deliberately NO
+ * EVM retry-safe terminal state: nonce advancement is not proof the write did
+ * not execute, and plain JSON-RPC offers no transaction-by-sender-and-nonce
+ * lookup, so a `submitted` EVM receipt either confirms or stays `submitted`.
+ */
+async function reconcileEvm(receipt, provider, options) {
+    if (!provider || typeof provider.reconcileEvmTransaction !== 'function') {
+        return stillSubmitted(receipt, 'no EVM reconciliation transport is available on the bound auth provider');
+    }
+    const fenced = isEvmFencedSubmitted(receipt) ? receipt.fence : undefined;
+    const allowRebroadcast = Boolean(fenced) && (options === null || options === void 0 ? void 0 : options.allowRebroadcast) !== false;
+    let outcome;
+    try {
+        outcome = await provider.reconcileEvmTransaction({
+            transactionHash: receipt.transactionId,
+            fence: fenced,
+            allowRebroadcast,
+        });
+    }
+    catch (error) {
+        return stillSubmitted(receipt, `EVM reconciliation failed: ${errorText(error)}`);
+    }
+    if (outcome.state === 'failed') {
+        // Landed and reverted: a genuine failure, never `submitted`.
+        throw new Error(outcome.reason);
+    }
+    if (outcome.state === 'confirmed') {
+        if (typeof outcome.blockNumber !== 'number') {
+            return stillSubmitted(receipt, 'the EVM receipt reported success without a block number, so confirmation could not be stated');
+        }
+        const confirmed = {
+            status: 'confirmed',
+            appId: receipt.appId,
+            requestedDocuments: receipt.requestedDocuments,
+            chain: receipt.chain,
+            transactionId: receipt.transactionId,
+            blockNumber: outcome.blockNumber,
+            mirrorSync: await mirrorFor(receipt, options),
+        };
+        return confirmed;
+    }
+    if (outcome.state === 'absent_after_expiry') {
+        // Defensive: no EVM lane may report a retry-safe terminal state.
+        return stillSubmitted(receipt, 'the EVM transport reported absence, which is not proof an EVM write did not execute');
+    }
+    return stillSubmitted(receipt, outcome.reason);
+}
+/**
+ * Poll the SAME signature/hash a `submitted` receipt carries and return the
+ * resulting `SetResult`.
+ *
+ * - Terminal receipts (`committed`, `confirmed`, `expired_not_landed`,
+ *   `signed`) are returned unchanged; nothing was left open.
+ * - An irreconcilable injected-wallet receipt (`transactionId: null`) is
+ *   rejected immediately: no identifier exists to poll.
+ * - A transaction that landed and FAILED throws, exactly as it would have on
+ *   the original write.
+ */
+async function reconcileSetResult(receipt, options) {
+    var _a, _b, _c, _d, _e;
+    if (!receipt || typeof receipt !== 'object' || typeof receipt.status !== 'string') {
+        throw new Error('reconcileSetResult requires a write receipt returned by set/setMany.');
+    }
+    if (receipt.status !== 'submitted')
+        return receipt;
+    if (receipt.transactionId === null) {
+        throw new Error('This receipt is explicitly irreconcilable: the wallet send response was lost, so no transaction hash exists to poll. ' +
+            'Resolve it out of band — resubmitting could execute the write twice.');
+    }
+    const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();
+    // Validation happens BEFORE any RPC or mirror request.
+    assertReceiptMatchesContext(receipt, config);
+    if (isSolanaSubmitted(receipt)) {
+        return reconcileSolana(receipt, config, options);
+    }
+    const provider = (_e = (_d = (_c = options === null || options === void 0 ? void 0 : options._overrides) === null || _c === void 0 ? void 0 : _c.authProvider) !== null && _d !== void 0 ? _d : config.authProvider) !== null && _e !== void 0 ? _e : null;
+    if (isEvmFencedSubmitted(receipt) || isEvmHashKnownSubmitted(receipt)) {
+        return reconcileEvm(receipt, provider, options);
+    }
+    return stillSubmitted(receipt, 'this receipt shape has no reconciliation lane');
+}
+/**
+ * Reconcile repeatedly until the receipt leaves `submitted` or the bound is hit.
+ *
+ * The bound is mandatory, because some states are permanently non-terminal by
+ * design: an unidentified nonce consumer or a permanently underpriced EVM
+ * transaction never resolves. On exhaustion (or abort) this returns the LATEST
+ * `submitted` receipt with its identifier intact rather than hanging or
+ * throwing the identifier away.
+ */
+async function waitForSetResult(receipt, options) {
+    var _a, _b, _c, _d, _e;
+    if (receipt && typeof receipt === 'object' && receipt.status === 'submitted' && receipt.transactionId === null) {
+        // Rejected immediately rather than polled: there is nothing to poll.
+        return reconcileSetResult(receipt, options);
+    }
+    const timeoutMs = (_a = options === null || options === void 0 ? void 0 : options.timeoutMs) !== null && _a !== void 0 ? _a : DEFAULT_TIMEOUT_MS;
+    const maxAttempts = (_b = options === null || options === void 0 ? void 0 : options.maxAttempts) !== null && _b !== void 0 ? _b : DEFAULT_MAX_ATTEMPTS;
+    const pollIntervalMs = (_c = options === null || options === void 0 ? void 0 : options.pollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_POLL_INTERVAL_MS;
+    const minRebroadcastIntervalMs = (_d = options === null || options === void 0 ? void 0 : options.minRebroadcastIntervalMs) !== null && _d !== void 0 ? _d : DEFAULT_MIN_REBROADCAST_INTERVAL_MS;
+    const rebroadcastPermitted = (options === null || options === void 0 ? void 0 : options.allowRebroadcast) !== false;
+    const startedAt = Date.now();
+    let current = receipt;
+    let attempts = 0;
+    let lastRebroadcastAt = -Infinity;
+    while (attempts < maxAttempts && Date.now() - startedAt < timeoutMs) {
+        if ((_e = options === null || options === void 0 ? void 0 : options.signal) === null || _e === void 0 ? void 0 : _e.aborted)
+            return current;
+        const now = Date.now();
+        const allowRebroadcast = rebroadcastPermitted && (now - lastRebroadcastAt >= minRebroadcastIntervalMs);
+        if (allowRebroadcast)
+            lastRebroadcastAt = now;
+        attempts++;
+        current = await reconcileSetResult(current, Object.assign(Object.assign({}, options), { allowRebroadcast }));
+        if (current.status !== 'submitted')
+            return current;
+        if (attempts >= maxAttempts)
+            break;
+        const remaining = timeoutMs - (Date.now() - startedAt);
+        if (remaining <= 0)
+            break;
+        const slept = await sleepUnlessAborted(Math.min(pollIntervalMs, remaining), options === null || options === void 0 ? void 0 : options.signal);
+        if (!slept)
+            return current;
+    }
+    return current;
+}
+/** Resolves `false` when the signal aborted during (or before) the sleep. */
+function sleepUnlessAborted(ms, signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted)
+        return Promise.resolve(false);
+    if (!signal)
+        return new Promise(resolve => setTimeout(() => resolve(true), ms));
+    return new Promise(resolve => {
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(true);
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve(false);
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+
 /**
  * WebSocket Subscription Module
  *
@@ -9513,7 +10221,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-VZBGvV0S.mjs');
+    const implementation = await import('./solana-message-DXXwC95Z.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -9980,5 +10688,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { getActiveSessionManager as $, getCachedData as A, reconnectWithNewAuth as B, createClient as C, subscribeQuery as D, closeAllQuerySubscriptions as E, canonicalizeArgs as F, canonicalizeResult as G, DEFAULT_QUERY_POLL_INTERVAL_MS as H, InsufficientBalanceError as I, BoundedDeclineError as J, deriveDecline as K, dispatchDeclineEvent as L, MIN_QUERY_POLL_INTERVAL_MS as M, DECLINE_EVENT_NAME as N, dispatchRateLimitEvent as O, hasActiveConnection as P, increment as Q, RATE_LIMIT_EVENT_NAME as R, ScopedClientReadOnlyError as S, serverTimestamp as T, now as U, toSeconds as V, toMillis as W, getIdToken as X, deriveUserIdentityFromIdToken as Y, WebSessionManager as Z, ReactNativeSessionManager as _, getWebhookKeysUrl as a, onSessionCleared as a0, SessionEnvironmentError as a1, UNSUPPORTED_ENVIRONMENT_CODE as a2, AUTH_CHANGED_CODE as a3, AUTH_EXPIRED_CODE as a4, isAuthExpiredError as a5, ServerSessionManager as a6, createSessionWithSignature as a7, refreshSession as a8, revokeSession as a9, signSessionCreateMessage as aa, genAuthNonce as ab, genSolanaMessage as ac, genSiweMessage as ad, normalizeEvmAddress as ae, toLowerEvmAddress as af, assertCanonicalBoundedRuntimeWriteCalldata as ag, assertEvmTransactionMatchesWrite as ah, BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR as ai, BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR as aj, functions as ak, invoke as al, FunctionInvokeError as am, live as an, intent as ao, status as ap, subscribeView as aq, LiveIntentError as ar, withEffects as as, isEffectResult as at, defineLiveModule as au, EFFECT_INTENT_ADDRESS as av, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, runQueryMany as m, runExpression as n, runExpressionMany as o, signMessage as p, queryAggregate as q, runQuery as r, set as s, signTransaction as t, signAndSubmitTransaction as u, count as v, aggregate as w, subscribe as x, closeAllSubscriptions as y, clearCache as z };
-//# sourceMappingURL=index-BNOU00XY.mjs.map
+export { WebSessionManager as $, closeAllSubscriptions as A, clearCache as B, getCachedData as C, reconnectWithNewAuth as D, createClient as E, subscribeQuery as F, closeAllQuerySubscriptions as G, canonicalizeArgs as H, InsufficientBalanceError as I, canonicalizeResult as J, DEFAULT_QUERY_POLL_INTERVAL_MS as K, BoundedDeclineError as L, MIN_QUERY_POLL_INTERVAL_MS as M, deriveDecline as N, dispatchDeclineEvent as O, DECLINE_EVENT_NAME as P, dispatchRateLimitEvent as Q, RATE_LIMIT_EVENT_NAME as R, ScopedClientReadOnlyError as S, hasActiveConnection as T, increment as U, serverTimestamp as V, now as W, toSeconds as X, toMillis as Y, getIdToken as Z, deriveUserIdentityFromIdToken as _, getWebhookKeysUrl as a, ReactNativeSessionManager as a0, getActiveSessionManager as a1, onSessionCleared as a2, SessionEnvironmentError as a3, UNSUPPORTED_ENVIRONMENT_CODE as a4, AUTH_CHANGED_CODE as a5, AUTH_EXPIRED_CODE as a6, isAuthExpiredError as a7, ServerSessionManager as a8, createSessionWithSignature as a9, refreshSession as aa, revokeSession as ab, signSessionCreateMessage as ac, genAuthNonce as ad, genSolanaMessage as ae, genSiweMessage as af, normalizeEvmAddress as ag, toLowerEvmAddress as ah, assertCanonicalBoundedRuntimeWriteCalldata as ai, assertEvmTransactionMatchesWrite as aj, BOUNDED_RUNTIME_SET_DOCUMENTS_SELECTOR as ak, BOUNDED_RUNTIME_SET_DOCUMENTS_ATTESTED_SELECTOR as al, functions as am, invoke as an, FunctionInvokeError as ao, live as ap, intent as aq, status as ar, subscribeView as as, LiveIntentError as at, withEffects as au, isEffectResult as av, defineLiveModule as aw, EFFECT_INTENT_ADDRESS as ax, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, runQueryMany as m, runExpression as n, runExpressionMany as o, signMessage as p, queryAggregate as q, runQuery as r, set as s, signTransaction as t, signAndSubmitTransaction as u, count as v, aggregate as w, reconcileSetResult as x, waitForSetResult as y, subscribe as z };
+//# sourceMappingURL=index-TyXiW4Uf.mjs.map