@ar.io/sdk 4.0.0-solana.33 → 4.0.0-solana.34

package/lib/esm/solana/io-writeable.js

@@ -881,7 +881,16 @@ export class SolanaARIOWriteable extends SolanaARIOReadable {
                 params: buyNameParams,
             }, { programAddress: this.arnsProgram });
         }
-        else if (params.fundFrom === 'plan' || params.fundFrom === 'any') {
+        else if (params.fundFrom === 'plan' ||
+            params.fundFrom === 'any' ||
+            params.fundFrom === 'stakes' ||
+            params.fundFrom === 'withdrawal') {
+            // 'stakes'/'withdrawal' WITHOUT an explicit gatewayAddress/withdrawalId
+            // land here (the single-source branches above handle the explicit case).
+            // Route through the funding planner, which constrains sources to the
+            // chosen mode — it never silently spends liquid balance and auto-splits
+            // across the caller's delegations/vaults. (Previously these fell through
+            // to the balance path below, silently draining liquid ARIO.)
             ix = await this._buildBuyNameFromFundingPlanIx({
                 params,
                 antPubkey,
@@ -892,8 +901,10 @@ export class SolanaARIOWriteable extends SolanaARIOReadable {
                 arnsConfig,
             });
         }
-        else {
-            // 'balance' or undefined falls through to the original direct-buy path.
+        else if (!params.fundFrom ||
+            params.fundFrom === 'balance' ||
+            params.fundFrom === 'turbo') {
+            // Direct balance-funded buy.
             ix = await getBuyNameInstructionAsync(await this.withArnsDefaults({
                 arnsRecord,
                 buyerTokenAccount: buyerATA,
@@ -904,6 +915,9 @@ export class SolanaARIOWriteable extends SolanaARIOReadable {
                 params: buyNameParams,
             }), { programAddress: this.arnsProgram });
         }
+        else {
+            throw new Error(`unsupported fundFrom mode '${params.fundFrom}' for buyRecord`);
+        }
         // Sprint 4 / ADR-016: bundle `ant.sync_attributes` IFF the buyer
         // owns the ANT (preserves BD-096 — non-holder buys defer the trait
         // sync to a later `syncAttributes()` call by the actual owner).
@@ -1428,7 +1442,14 @@ export class SolanaARIOWriteable extends SolanaARIOReadable {
                 return getExtendLeaseFromWithdrawalInstructionAsync({ ...wBase, years: args.years }, { programAddress: this.arnsProgram });
             return getIncreaseUndernameLimitFromWithdrawalInstructionAsync({ ...wBase, quantity: args.quantity }, { programAddress: this.arnsProgram });
         }
-        if (args.params.fundFrom === 'plan' || args.params.fundFrom === 'any') {
+        if (args.params.fundFrom === 'plan' ||
+            args.params.fundFrom === 'any' ||
+            args.params.fundFrom === 'stakes' ||
+            args.params.fundFrom === 'withdrawal') {
+            // 'stakes'/'withdrawal' without an explicit gatewayAddress/withdrawalId
+            // route here (the single-source branches above handle the explicit
+            // case). The planner constrains sources to the chosen mode and never
+            // spends liquid balance.
             // Cost estimation for manage variants: each operation has its own
             // pricing path. Keep it pragmatic — let the planner build the plan
             // around the user's desired total (caller can pass explicit sources
@@ -1987,10 +2008,54 @@ export class SolanaARIOWriteable extends SolanaARIOReadable {
             years: params.years ?? 1,
             ant: antPubkey,
         };
+        // Returned-name price is a per-slot-decaying Dutch auction, so the
+        // multi-source funding plan (which pre-commits exact source amounts) can't
+        // match the execution-time cost → FundingPlanAmountMismatch (#6066). Prefer
+        // a single-source stake path: it carries no amount, so the program computes
+        // and draws the live cost itself. When the caller asked to fund from
+        // stakes/withdrawal/any without naming a specific gateway/vault,
+        // auto-resolve a single source with enough stake to cover the
+        // (premium-inclusive) cost.
+        let resolvedGateway = params.gatewayAddress;
+        let resolvedFundAsOperator = params.fundAsOperator ?? false;
+        let resolvedWithdrawalId = params.withdrawalId;
+        const wantsStake = params.fundFrom === 'stakes' ||
+            params.fundFrom === 'withdrawal' ||
+            params.fundFrom === 'any';
+        if (wantsStake &&
+            resolvedGateway === undefined &&
+            resolvedWithdrawalId === undefined &&
+            !params.sources?.length) {
+            const picked = await this._autoPickReturnedNameStakeSource(params);
+            if (picked?.kind === 'delegation') {
+                resolvedGateway = picked.gateway;
+                resolvedFundAsOperator = false;
+            }
+            else if (picked?.kind === 'operatorStake') {
+                resolvedGateway = picked.gateway;
+                resolvedFundAsOperator = true;
+            }
+            else if (picked?.kind === 'withdrawal') {
+                resolvedWithdrawalId = picked.withdrawalId;
+            }
+            else if (params.fundFrom !== 'any') {
+                // 'stakes'/'withdrawal' explicitly requested but nothing covers it.
+                throw new Error(`buyReturnedName: no ${params.fundFrom === 'withdrawal'
+                    ? 'matured withdrawal vault'
+                    : 'delegation/operator stake'} large enough to fund '${params.name}' was found for ` +
+                    `${this.signer.address}. Fund from balance, or add stake first.`);
+            }
+            // 'any' with nothing found → falls through to the balance path.
+        }
         let ix;
-        if (!params.fundFrom ||
+        const useBalance = !params.fundFrom ||
             params.fundFrom === 'balance' ||
-            params.fundFrom === 'turbo') {
+            params.fundFrom === 'turbo' ||
+            (params.fundFrom === 'any' &&
+                resolvedGateway === undefined &&
+                resolvedWithdrawalId === undefined &&
+                !params.sources?.length);
+        if (useBalance) {
             ix = await getBuyReturnedNameInstructionAsync(await this.withArnsDefaults({
                 arnsRecord,
                 returnedName: returnedNamePda,
@@ -2019,10 +2084,10 @@ export class SolanaARIOWriteable extends SolanaARIOReadable {
                 garProgram: this.garProgram,
                 params: buyParams,
             };
-            if (params.fundFrom === 'stakes' && params.gatewayAddress) {
-                const gatewayAddr = address(params.gatewayAddress);
+            if (resolvedGateway !== undefined) {
+                const gatewayAddr = address(resolvedGateway);
                 const [gatewayPda] = await getGatewayPDA(gatewayAddr, this.garProgram);
-                if (params.fundAsOperator) {
+                if (resolvedFundAsOperator) {
                     ix = await getBuyReturnedNameFromOperatorStakeInstructionAsync({ ...sharedReturnedBase, gateway: gatewayPda }, { programAddress: this.arnsProgram });
                 }
                 else {
@@ -2034,17 +2099,16 @@ export class SolanaARIOWriteable extends SolanaARIOReadable {
                     }, { programAddress: this.arnsProgram });
                 }
             }
-            else if (params.fundFrom === 'withdrawal' &&
-                params.withdrawalId !== undefined) {
-                const [withdrawalPda] = await getWithdrawalPDA(this.signer.address, params.withdrawalId, this.garProgram);
+            else if (resolvedWithdrawalId !== undefined) {
+                const [withdrawalPda] = await getWithdrawalPDA(this.signer.address, resolvedWithdrawalId, this.garProgram);
                 ix = await getBuyReturnedNameFromWithdrawalInstructionAsync({ ...sharedReturnedBase, withdrawal: withdrawalPda }, { programAddress: this.arnsProgram });
             }
-            else if (params.fundFrom === 'plan' || params.fundFrom === 'any') {
-                // Returned-name pricing is dynamic (Dutch auction premium); we trust
-                // explicit caller-supplied sources here and skip auto-discovery if
-                // sources is provided. For 'any' without sources, we fall back to a
-                // best-effort estimate using the plain registration fee — caller can
-                // always retry with explicit sources on FundingPlanAmountMismatch.
+            else if (params.fundFrom === 'plan' && params.sources?.length) {
+                // Explicit caller-supplied plan only: the caller owns the source
+                // amounts and accepts the decay risk (the price moves per slot, so a
+                // stale plan trips FundingPlanAmountMismatch). We do NOT auto-discover
+                // a multi-source plan for returned names — see the single-source note
+                // above.
                 const cost = await this._simulateTokenCost({
                     intent: CostIntent.BuyName,
                     name: params.name,
@@ -2068,14 +2132,63 @@ export class SolanaARIOWriteable extends SolanaARIOReadable {
                 throw new Error(`unsupported fundFrom mode '${params.fundFrom}' for buyReturnedName`);
             }
         }
+        // The on-chain `buy_returned_name*` handlers take `initiator_token_account`
+        // and `buyer_token_account` as `Account<TokenAccount>` (NOT `init`), so
+        // Anchor requires both ATAs to already exist or fails with
+        // AccountNotInitialized (#3012). The original initiator may never have held
+        // ARIO, and the premium always settles from the buyer's liquid ATA — bundle
+        // idempotent ATA creates so the buy succeeds without a separate setup step
+        // (mirrors the vault-ATA handling above). Idempotent: ~1500 CU each, no-op
+        // when the account already exists.
+        const createInitiatorAtaIx = buildCreateAtaIdempotentIx(this.signer.address, initiatorATA, initiator, arnsConfig.mint);
+        const createBuyerAtaIx = buildCreateAtaIdempotentIx(this.signer.address, buyerATA, this.signer.address, arnsConfig.mint);
         // Sprint 4 / ADR-016: bundle ant.sync_attributes after the buy so the
         // Attributes plugin reflects the new record holder. assetOverride =
         // antPubkey because the ArnsRecord PDA is created by buy_returned_name
         // and doesn't exist on-chain at SDK build time.
         const syncIx = await this._buildSyncAttributesIxIfOwner(params.name, antPubkey);
-        const sig = await this.sendTransaction(syncIx ? [ix, syncIx] : [ix]);
+        const sig = await this.sendTransaction([
+            createBuyerAtaIx,
+            createInitiatorAtaIx,
+            ix,
+            ...(syncIx ? [syncIx] : []),
+        ]);
         return { id: sig };
     }
+    /**
+     * Pick a single stake-derived funding source that can cover a returned-name
+     * purchase, for the single-source `buy_returned_name_from_*` paths.
+     *
+     * Returned-name prices decay per slot, so the multi-source funding plan
+     * (which pre-commits exact amounts) can't match the execution-time cost. The
+     * single-source paths carry no amount — the program draws the live cost — so
+     * we only need to pick ONE source with enough stake. We size the pick against
+     * the premium-inclusive estimate (an upper bound, since the price only falls
+     * from now) and choose the largest matching source. Returns `null` when no
+     * single source covers the estimate.
+     */
+    async _autoPickReturnedNameStakeSource(params) {
+        const estimate = BigInt(Math.ceil(await this.getTokenCost({
+            intent: 'Buy-Name',
+            name: params.name,
+            type: params.type,
+            years: params.years ?? 1,
+        })));
+        const arnsConfig = await this.getArnsConfig();
+        const { discoverFundingSources } = await import('./funding-plan.js');
+        const sources = await discoverFundingSources(this.rpc, this.signer.address, { arioMint: arnsConfig.mint, garProgram: this.garProgram });
+        // 'withdrawal' mode → matured withdrawal vaults only; otherwise prefer
+        // operator stake when the caller asked, else a delegation.
+        const wantKind = params.fundFrom === 'withdrawal'
+            ? 'withdrawal'
+            : params.fundAsOperator === true
+                ? 'operatorStake'
+                : 'delegation';
+        const candidates = sources
+            .filter((s) => s.kind === wantKind && s.available >= estimate)
+            .sort((a, b) => b.available > a.available ? 1 : b.available < a.available ? -1 : 0);
+        return candidates[0] ?? null;
+    }
     // =========================================
     // Name management (ario-arns)
     // =========================================

package/lib/esm/solana/rpc-circuit-breaker.js

@@ -47,6 +47,121 @@ const logger = new Logger({ level: 'error' });
 const DEFAULT_MAINNET_RPC = 'https://api.mainnet-beta.solana.com';
 const DEFAULT_DEVNET_RPC = 'https://api.devnet.solana.com';
 // ---------------------------------------------------------------------------
+// Adaptive rate gate (token bucket + cooldown)
+// ---------------------------------------------------------------------------
+/** Default ceiling when `maxRequestsPerSecond` is not provided. */
+const DEFAULT_MAX_RPS = 10;
+/** Multiply the current rate by this on a 429 with no usable header. */
+const AIMD_DECREASE = 0.5;
+/** Never throttle below this many requests/second. */
+const MIN_RATE = 1;
+/** Consecutive successes before nudging the rate up by 1 (additive recovery). */
+const RECOVERY_SUCCESSES = 20;
+/** Fraction of a provider-advertised limit to actually use (safety margin). */
+const RATE_SAFETY_FACTOR = 0.9;
+/** Cooldown applied on a 429 that carries no `Retry-After`. */
+const DEFAULT_COOLDOWN_MS = 1_000;
+/**
+ * Token-bucket throttle whose rate can be retuned at runtime and which can be
+ * paused on demand. Tokens refill continuously at the current rate, capped at
+ * one second's worth (the burst allowance); waiters are released FIFO.
+ */
+function createRateGate(initialRate) {
+    let rate = Math.max(MIN_RATE, initialRate);
+    let capacity = Math.max(1, rate);
+    let tokens = capacity;
+    let lastRefill = Date.now();
+    let pausedUntil = 0;
+    const queue = [];
+    let timer = null;
+    const schedule = (ms) => {
+        if (timer !== null)
+            return;
+        timer = setTimeout(() => {
+            timer = null;
+            pump();
+        }, Math.max(ms, 1));
+    };
+    const refill = () => {
+        const now = Date.now();
+        const elapsed = (now - lastRefill) / 1000;
+        if (elapsed > 0) {
+            tokens = Math.min(capacity, tokens + elapsed * rate);
+            lastRefill = now;
+        }
+    };
+    const pump = () => {
+        const now = Date.now();
+        if (pausedUntil > now) {
+            schedule(pausedUntil - now);
+            return;
+        }
+        refill();
+        while (tokens >= 1) {
+            const release = queue.shift();
+            if (!release)
+                break;
+            tokens -= 1;
+            release();
+        }
+        if (queue.length > 0) {
+            // Wake when the next whole token will have accrued.
+            schedule(Math.ceil(((1 - tokens) / rate) * 1000));
+        }
+    };
+    return {
+        acquire: () => new Promise((resolve) => {
+            queue.push(resolve);
+            pump();
+        }),
+        setRate: (ratePerSecond) => {
+            rate = Math.max(MIN_RATE, ratePerSecond);
+            capacity = Math.max(1, rate);
+            tokens = Math.min(tokens, capacity);
+            lastRefill = Date.now();
+            pump();
+        },
+        pauseFor: (ms) => {
+            const until = Date.now() + Math.max(0, ms);
+            if (until > pausedUntil)
+                pausedUntil = until;
+            schedule(ms);
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// 429 / rate-limit header parsing
+// ---------------------------------------------------------------------------
+/**
+ * If `err` is a transport HTTP 429, return its response `Headers`; else null.
+ * Duck-typed against the `@solana/errors` HTTP-error context
+ * (`{ statusCode, headers }`) so we avoid a hard dependency on the error code.
+ */
+function http429Headers(err) {
+    const ctx = err
+        ?.context;
+    if (ctx?.statusCode === 429 && ctx.headers instanceof Headers) {
+        return ctx.headers;
+    }
+    return null;
+}
+/** Parse `Retry-After` (delta-seconds or HTTP-date) into ms, or null. */
+function parseRetryAfterMs(headers) {
+    const v = headers.get('retry-after');
+    if (v === null || v === '')
+        return null;
+    const secs = Number(v);
+    if (Number.isFinite(secs))
+        return Math.max(0, secs * 1000);
+    const when = Date.parse(v);
+    return Number.isNaN(when) ? null : Math.max(0, when - Date.now());
+}
+/** Provider-advertised requests/second limit (`x-ratelimit-rps-limit`), or null. */
+function parseRpsLimit(headers) {
+    const v = Number(headers.get('x-ratelimit-rps-limit'));
+    return Number.isFinite(v) && v > 0 ? v : null;
+}
+// ---------------------------------------------------------------------------
 // Implementation
 // ---------------------------------------------------------------------------
 /**
@@ -58,11 +173,51 @@ const DEFAULT_DEVNET_RPC = 'https://api.devnet.solana.com';
 export function createCircuitBreakerRpc({ primaryUrl, fallbackUrl, circuitBreakerOptions: opts = {}, }) {
     const primaryTransport = createDefaultRpcTransport({ url: primaryUrl });
     const fallbackTransport = createDefaultRpcTransport({ url: fallbackUrl });
+    // Throttling is always on. `maxRequestsPerSecond` is the *ceiling*: every
+    // request flows through an adaptive token bucket that backs off on HTTP 429
+    // (honoring `Retry-After` and `x-ratelimit-rps-limit` when present, AIMD
+    // otherwise) and recovers back toward the ceiling on sustained success.
+    const ceilingRate = opts.maxRequestsPerSecond !== undefined && opts.maxRequestsPerSecond > 0
+        ? opts.maxRequestsPerSecond
+        : DEFAULT_MAX_RPS;
+    const gate = createRateGate(ceilingRate);
+    let currentRate = ceilingRate;
+    let successStreak = 0;
+    const onError = (err) => {
+        const headers = http429Headers(err);
+        if (!headers)
+            return; // only adapt to rate-limit (429) failures
+        successStreak = 0;
+        const advertised = parseRpsLimit(headers);
+        const next = advertised !== null
+            ? Math.min(ceilingRate, Math.max(MIN_RATE, advertised * RATE_SAFETY_FACTOR))
+            : Math.max(MIN_RATE, currentRate * AIMD_DECREASE);
+        if (next !== currentRate) {
+            currentRate = next;
+            gate.setRate(currentRate);
+        }
+        const retryAfter = parseRetryAfterMs(headers);
+        gate.pauseFor(retryAfter ?? DEFAULT_COOLDOWN_MS);
+        logger.warn(`[rpc-circuit-breaker] 429 — throttling to ${currentRate.toFixed(1)} req/s` +
+            `, cooling down ${retryAfter ?? DEFAULT_COOLDOWN_MS}ms`);
+    };
+    const onSuccess = () => {
+        if (currentRate >= ceilingRate)
+            return;
+        if (++successStreak >= RECOVERY_SUCCESSES) {
+            successStreak = 0;
+            currentRate = Math.min(ceilingRate, currentRate + 1);
+            gate.setRate(currentRate);
+        }
+    };
     const breaker = new CircuitBreaker((request) => primaryTransport(request), {
         timeout: opts.timeout ?? 10_000,
         errorThresholdPercentage: opts.errorThresholdPercentage ?? 25,
         resetTimeout: opts.resetTimeout ?? 60_000,
         volumeThreshold: opts.volumeThreshold ?? 3,
+        ...(opts.maxConcurrent !== undefined && opts.maxConcurrent > 0
+            ? { capacity: opts.maxConcurrent }
+            : {}),
     });
     breaker.fallback((request) => fallbackTransport(request));
     breaker.on('open', () => {
@@ -74,7 +229,20 @@ export function createCircuitBreakerRpc({ primaryUrl, fallbackUrl, circuitBreake
     breaker.on('close', () => {
         logger.info('[rpc-circuit-breaker] circuit CLOSED — primary RPC recovered');
     });
-    const transport = ((request) => breaker.fire(request));
+    // Adapt the rate to the *primary's* health via opossum's events: `failure`
+    // fires whenever the primary call rejects (a 429 included) even when the
+    // fallback then masks it by resolving `fire()`, and `success` fires on a
+    // healthy primary call. A plain try/catch around `fire()` would miss the
+    // fallback-masked 429s entirely.
+    breaker.on('failure', (err) => onError(err));
+    breaker.on('success', () => onSuccess());
+    const transport = (async (request) => {
+        // Throttle entry to the breaker so we stay under the provider's rate
+        // limit; the queue wait sits outside `fire`, so opossum's per-request
+        // timeout only measures the actual transport call.
+        await gate.acquire();
+        return breaker.fire(request);
+    });
     return createSolanaRpcFromTransport(transport);
 }
 /**

package/lib/esm/version.js

@@ -14,4 +14,4 @@
  * limitations under the License.
  */
 // AUTOMATICALLY GENERATED FILE - DO NOT TOUCH
-export const version = '4.0.0-solana.33';
+export const version = '4.0.0-solana.34';

package/lib/types/solana/io-writeable.d.ts

@@ -522,6 +522,19 @@ export declare class SolanaARIOWriteable extends SolanaARIOReadable {
         years?: number;
         processId: string;
     } & Partial<ArNSPurchaseParams>, _options?: WriteOptions): Promise<MessageResult>;
+    /**
+     * Pick a single stake-derived funding source that can cover a returned-name
+     * purchase, for the single-source `buy_returned_name_from_*` paths.
+     *
+     * Returned-name prices decay per slot, so the multi-source funding plan
+     * (which pre-commits exact amounts) can't match the execution-time cost. The
+     * single-source paths carry no amount — the program draws the live cost — so
+     * we only need to pick ONE source with enough stake. We size the pick against
+     * the premium-inclusive estimate (an upper bound, since the price only falls
+     * from now) and choose the largest matching source. Returns `null` when no
+     * single source covers the estimate.
+     */
+    private _autoPickReturnedNameStakeSource;
     /** Reassign an ArNS name to a different ANT. */
     reassignName(params: {
         name: string;

package/lib/types/solana/rpc-circuit-breaker.d.ts

@@ -24,6 +24,35 @@ export interface CircuitBreakerRpcOptions {
      * @default 3
      */
     volumeThreshold?: number;
+    /**
+     * Ceiling for requests allowed through per second. Implemented as an
+     * adaptive token bucket *in front of* the breaker: excess requests are
+     * queued (FIFO) until a token frees, smoothing bursts so you stay under a
+     * provider's rate limit (avoids HTTP 429 / Solana error #8100002).
+     *
+     * The bucket auto-tunes on 429s: it honors `Retry-After`, drops to
+     * `x-ratelimit-rps-limit` when the provider advertises one (public Solana
+     * RPC does; QuickNode generally does not), otherwise halves the rate
+     * (AIMD). It recovers back up toward this ceiling on sustained success.
+     *
+     * The queue wait happens *before* `breaker.fire`, so it does NOT count
+     * against {@link CircuitBreakerRpcOptions.timeout}.
+     *
+     * Throttling is always on; omitting this (or passing `<= 0`) uses the
+     * {@link DEFAULT_MAX_RPS} default. To effectively remove the limit, pass a
+     * very large number.
+     * @default 10
+     */
+    maxRequestsPerSecond?: number;
+    /**
+     * Maximum number of concurrent in-flight requests (opossum `capacity`
+     * semaphore). Unlike {@link CircuitBreakerRpcOptions.maxRequestsPerSecond},
+     * excess requests are **rejected immediately** rather than queued — this is
+     * concurrency control, not a rate limit. For avoiding 429s you usually want
+     * `maxRequestsPerSecond` instead.
+     * @default undefined (unlimited)
+     */
+    maxConcurrent?: number;
 }
 export interface CircuitBreakerRpcConfig {
     /** URL for the primary (preferred) RPC endpoint. */

package/lib/types/version.d.ts

@@ -13,4 +13,4 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-export declare const version = "4.0.0-solana.32";
+export declare const version = "4.0.0-solana.33";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ar.io/sdk",
-  "version": "4.0.0-solana.33",
+  "version": "4.0.0-solana.34",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ar-io/ar-io-sdk.git"