@bounded-sh/core 0.0.107 → 0.0.108

package/dist/{index-CLst0IiM.mjs → index-No5Vz0YM.mjs}

@@ -4188,7 +4188,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-Deru1tF1.mjs');
+        const { genSolanaMessage } = await import('./solana-message-BBKdydqt.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -7467,7 +7467,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-C9AgPg7U.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-iXGbzhjG.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -7695,6 +7695,37 @@ async function wsIntentReliable(appId, roomRoutePath, intent, isServer) {
     });
 }
 
+const PHASES = new Set(['before_broadcast', 'broadcast_rejected', 'failed_onchain']);
+/** Tag `error` as definitively not applied. An already-tagged error keeps its (earlier, more precise) phase. */
+function markWriteNotApplied(error, phase) {
+    var _a;
+    if (writeNotAppliedPhase(error) !== null)
+        return error;
+    const target = error !== null && typeof error === 'object'
+        ? error
+        : new Error(String(error));
+    try {
+        Object.assign(target, { writeOutcome: 'not_applied', writePhase: phase });
+    }
+    catch (_b) {
+        // A frozen throwable cannot carry the tag; wrap it so the verdict is not lost.
+        const wrapped = new Error(String((_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : error));
+        return Object.assign(wrapped, { cause: error, writeOutcome: 'not_applied', writePhase: phase });
+    }
+    return target;
+}
+/** The phase a write stopped at when it was definitively not applied, else `null` (ambiguous or not a write error). */
+function writeNotAppliedPhase(error) {
+    if (error === null || typeof error !== 'object')
+        return null;
+    const outcome = error.writeOutcome;
+    const phase = error.writePhase;
+    return outcome === 'not_applied' && typeof phase === 'string' && PHASES.has(phase) ? phase : null;
+}
+function isWriteNotApplied(error) {
+    return writeNotAppliedPhase(error) !== null;
+}
+
 /**
  * Thrown when a user's wallet doesn't have enough SOL to cover the transaction.
  * Apps can catch this to trigger an onramp/funding flow.
@@ -8860,7 +8891,13 @@ async function setMany(many, options) {
             if ((error === null || error === void 0 ? void 0 : error.statusCode) === 402 && (error === null || error === void 0 ? void 0 : error.error) === 'INSUFFICIENT_BALANCE') {
                 const deficitLamports = Number((_e = error.deficitLamports) !== null && _e !== void 0 ? _e : 0);
                 const deficitSol = Number((_f = error.deficitSol) !== null && _f !== void 0 ? _f : deficitLamports / 1000000000);
-                throw new InsufficientBalanceError(String((_g = error.address) !== null && _g !== void 0 ? _g : ''), Number((_h = error.balanceLamports) !== null && _h !== void 0 ? _h : 0), Number((_j = error.estimatedCostLamports) !== null && _j !== void 0 ? _j : 0), deficitLamports, deficitSol);
+                throw markWriteNotApplied(new InsufficientBalanceError(String((_g = error.address) !== null && _g !== void 0 ? _g : ''), Number((_h = error.balanceLamports) !== null && _h !== void 0 ? _h : 0), Number((_j = error.estimatedCostLamports) !== null && _j !== void 0 ? _j : 0), deficitLamports, deficitSol), 'before_broadcast');
+            }
+            // The server answered and refused the write (a rule or invariant denial, a bad request, no
+            // session, a rate limit): nothing was built, signed or committed. A network failure, a 5xx,
+            // a 408 or a 499 may follow a commit the response never reported, so those stay untagged.
+            if (DEFINITIVE_WRITE_REFUSAL_STATUSES.has(Number(error === null || error === void 0 ? void 0 : error.statusCode))) {
+                throw markWriteNotApplied(error, 'before_broadcast');
             }
             throw error;
         }
@@ -8871,118 +8908,142 @@ async function setMany(many, options) {
         if (setResponse.status === 202) {
             // This means that the document needs to be set on-chain (or signed for offchain),
             // the API did nothing and gave us the required info to run this transaction.
-            const { transactions, offchainTransaction } = setResponse.data;
-            // Handle offchain transaction flow (for 'offchain' protocol apps)
-            if (offchainTransaction && Array.isArray(transactions) && transactions.length > 0) {
-                throw new Error('Ambiguous write response mixes offchain and onchain transaction targets');
-            }
-            if (offchainTransaction) {
-                // Offchain signing is retired: no server mints this envelope any more
-                // (the realtime worker commits poofnet writes directly). Fail loudly
-                // rather than silently ignoring a payload the caller was asked to sign.
-                throw new Error('Unsupported 202 transaction shape: offchain signing is retired');
-            }
-            // Handle Solana on-chain transaction flow
-            if (!Array.isArray(transactions) || transactions.length !== 1) {
-                throw new Error(`Expected exactly one on-chain transaction, received ${Array.isArray(transactions) ? transactions.length : 0}`);
-            }
-            const curTx = transactions[0];
-            // The EVM onchain data plane is retired: no worker mints an EVM 202 any
-            // more. A payload that still carries one is an unexpected response and
-            // fails loudly BEFORE anything is signed - never silently ignored.
-            if ((curTx === null || curTx === void 0 ? void 0 : curTx.evmTransaction) != null) {
-                throw new Error('Unsupported 202 transaction shape: the write response carried an evmTransaction, ' +
-                    'but EVM onchain writes are no longer supported. Nothing was signed or submitted.');
-            }
-            const hasSerializedSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.serializedTransaction) != null;
-            const hasBuiltSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.transactionArgs) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.remainingAccounts) != null ||
-                (curTx === null || curTx === void 0 ? void 0 : curTx.idl) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.txData) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.preInstructions) != null;
-            if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
-                throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
-            }
-            // All requested paths (writes AND deletes), in request order. Used for the
-            // post-confirm mirror read-back, which correlates every requested path.
-            // The pre-sign validation derives its own full expected intent from
-            // `documents` (see below) and needs nothing from this list.
-            const requestedPaths = documents.map(d => d.destinationPath);
-            const requestedDocuments = buildRequestedDocuments(documents);
-            const appId = config.appId;
-            // The lane comes verbatim from the worker, and is read BEFORE anything is
-            // signed or submitted: a missing tag fails closed while nothing has been
-            // broadcast, instead of stranding a landed transaction with no receipt.
-            const workerChain = readWorkerChainTag((_k = setResponse.data) === null || _k === void 0 ? void 0 : _k.receipt, setResponse.data, curTx);
-            if (!workerChain) {
-                throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
-                    'Nothing was signed or submitted.');
-            }
-            if (workerChain === 'realtime_offchain') {
-                // Poofnet: the wallet signs the worker's unsendable approval message and
-                // the worker verifies and commits it. Nothing is submitted to any chain.
-                if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
-                    throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
+            // Until something is sent, every failure below is definitively not applied.
+            let sending = false;
+            try {
+                const { transactions, offchainTransaction } = setResponse.data;
+                // Handle offchain transaction flow (for 'offchain' protocol apps)
+                if (offchainTransaction && Array.isArray(transactions) && transactions.length > 0) {
+                    throw new Error('Ambiguous write response mixes offchain and onchain transaction targets');
                 }
-                const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-Cm19J14R.mjs');
-                const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
-                // Signing-only, exactly as on a real chain: signed and NOT committed.
-                if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
-                    return {
-                        status: 'signed', appId, requestedDocuments: buildRequestedDocuments(documents),
-                        chain: 'realtime_offchain', transactionId: null, signedTransaction,
-                        poofnetIntentId: curTx.poofnetIntentId,
-                    };
+                if (offchainTransaction) {
+                    // Offchain signing is retired: no server mints this envelope any more
+                    // (the realtime worker commits poofnet writes directly). Fail loudly
+                    // rather than silently ignoring a payload the caller was asked to sign.
+                    throw new Error('Unsupported 202 transaction shape: offchain signing is retired');
                 }
-                const commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, options === null || options === void 0 ? void 0 : options._overrides);
-                if (commitResponse.status !== 200) {
-                    throw new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`);
+                // Handle Solana on-chain transaction flow
+                if (!Array.isArray(transactions) || transactions.length !== 1) {
+                    throw new Error(`Expected exactly one on-chain transaction, received ${Array.isArray(transactions) ? transactions.length : 0}`);
                 }
-                return directCommitResult(commitResponse, documents);
-            }
-            if (curTx.serializedTransaction) {
-                if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
-                    throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
+                const curTx = transactions[0];
+                // The EVM onchain data plane is retired: no worker mints an EVM 202 any
+                // more. A payload that still carries one is an unexpected response and
+                // fails loudly BEFORE anything is signed - never silently ignored.
+                if ((curTx === null || curTx === void 0 ? void 0 : curTx.evmTransaction) != null) {
+                    throw new Error('Unsupported 202 transaction shape: the write response carried an evmTransaction, ' +
+                        'but EVM onchain writes are no longer supported. Nothing was signed or submitted.');
+                }
+                const hasSerializedSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.serializedTransaction) != null;
+                const hasBuiltSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.transactionArgs) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.remainingAccounts) != null ||
+                    (curTx === null || curTx === void 0 ? void 0 : curTx.idl) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.txData) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.preInstructions) != null;
+                if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
+                    throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
+                }
+                // All requested paths (writes AND deletes), in request order. Used for the
+                // post-confirm mirror read-back, which correlates every requested path.
+                // The pre-sign validation derives its own full expected intent from
+                // `documents` (see below) and needs nothing from this list.
+                const requestedPaths = documents.map(d => d.destinationPath);
+                const requestedDocuments = buildRequestedDocuments(documents);
+                const appId = config.appId;
+                // The lane comes verbatim from the worker, and is read BEFORE anything is
+                // signed or submitted: a missing tag fails closed while nothing has been
+                // broadcast, instead of stranding a landed transaction with no receipt.
+                const workerChain = readWorkerChainTag((_k = setResponse.data) === null || _k === void 0 ? void 0 : _k.receipt, setResponse.data, curTx);
+                if (!workerChain) {
+                    throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
                         'Nothing was signed or submitted.');
                 }
-                const solanaChain = workerChain;
-                const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-Cm19J14R.mjs');
-                // OA-0001: derive the expected intent from OUR OWN request (the one
-                // ground truth a tampered builder response cannot change) so the
-                // validator can reject any transaction whose operation semantics
-                // diverge from it BEFORE the wallet is asked to sign.
-                const expectedIntent = buildExpectedWriteIntent(documents);
-                const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent);
-                // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
-                // and there is nothing to mirror, so no synchronization is attempted.
-                if (solanaOutcome.outcome === 'signed') {
-                    return {
-                        status: 'signed', appId, requestedDocuments, chain: solanaChain,
-                        transactionId: null,
-                        signedTransaction: solanaOutcome.signedTransaction,
-                        fence: solanaOutcome.fence,
-                    };
+                if (workerChain === 'realtime_offchain') {
+                    // Poofnet: the wallet signs the worker's unsendable approval message and
+                    // the worker verifies and commits it. Nothing is submitted to any chain.
+                    if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
+                        throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
+                    }
+                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-Dtow91W5.mjs');
+                    const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
+                    // Signing-only, exactly as on a real chain: signed and NOT committed.
+                    if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+                        return {
+                            status: 'signed', appId, requestedDocuments: buildRequestedDocuments(documents),
+                            chain: 'realtime_offchain', transactionId: null, signedTransaction,
+                            poofnetIntentId: curTx.poofnetIntentId,
+                        };
+                    }
+                    // The commit PUT is the one ambiguous step of this lane: a lost response
+                    // may follow a commit, so its failures stay untagged (read the path back).
+                    sending = true;
+                    const commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, options === null || options === void 0 ? void 0 : options._overrides);
+                    if (commitResponse.status !== 200) {
+                        throw new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`);
+                    }
+                    return directCommitResult(commitResponse, documents);
                 }
-                if (solanaOutcome.outcome === 'submitted') {
+                if (curTx.serializedTransaction) {
+                    if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
+                        throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
+                            'Nothing was signed or submitted.');
+                    }
+                    const solanaChain = workerChain;
+                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-Dtow91W5.mjs');
+                    // OA-0001: derive the expected intent from OUR OWN request (the one
+                    // ground truth a tampered builder response cannot change) so the
+                    // validator can reject any transaction whose operation semantics
+                    // diverge from it BEFORE the wallet is asked to sign.
+                    const expectedIntent = buildExpectedWriteIntent(documents);
+                    const onBroadcast = options === null || options === void 0 ? void 0 : options.onBroadcast;
+                    const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent, onBroadcast && (async (signed) => {
+                        await onBroadcast({
+                            status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                            transactionId: signed.transactionSignature,
+                            signedTransaction: signed.signedTransaction,
+                            fence: signed.fence,
+                            confirmation: { state: 'unknown', reason: 'about to broadcast' },
+                        });
+                    }));
+                    // Past this point the bytes may be on the network: nothing is tagged here.
+                    sending = true;
+                    // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
+                    // and there is nothing to mirror, so no synchronization is attempted.
+                    if (solanaOutcome.outcome === 'signed') {
+                        return {
+                            status: 'signed', appId, requestedDocuments, chain: solanaChain,
+                            transactionId: null,
+                            signedTransaction: solanaOutcome.signedTransaction,
+                            fence: solanaOutcome.fence,
+                        };
+                    }
+                    if (solanaOutcome.outcome === 'submitted') {
+                        return {
+                            status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                            transactionId: solanaOutcome.transactionSignature,
+                            signedTransaction: solanaOutcome.signedTransaction,
+                            fence: solanaOutcome.fence,
+                            confirmation: { state: 'unknown', reason: solanaOutcome.reason },
+                        };
+                    }
+                    // Confirmed: the receipt is already complete, so the mirror read is a
+                    // best-effort enrichment reported in `mirrorSync`, never a rejection.
+                    const mirrorSync = await attemptMirrorSync(requestedPaths, options);
                     return {
-                        status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                        status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
                         transactionId: solanaOutcome.transactionSignature,
                         signedTransaction: solanaOutcome.signedTransaction,
                         fence: solanaOutcome.fence,
-                        confirmation: { state: 'unknown', reason: solanaOutcome.reason },
+                        confirmationContextSlot: solanaOutcome.confirmationContextSlot,
+                        mirrorSync,
                     };
                 }
-                // Confirmed: the receipt is already complete, so the mirror read is a
-                // best-effort enrichment reported in `mirrorSync`, never a rejection.
-                const mirrorSync = await attemptMirrorSync(requestedPaths, options);
-                return {
-                    status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
-                    transactionId: solanaOutcome.transactionSignature,
-                    signedTransaction: solanaOutcome.signedTransaction,
-                    fence: solanaOutcome.fence,
-                    confirmationContextSlot: solanaOutcome.confirmationContextSlot,
-                    mirrorSync,
-                };
+                else {
+                    throw new Error('Unsupported 202 transaction shape: expected serializedTransaction');
+                }
             }
-            else {
-                throw new Error('Unsupported 202 transaction shape: expected serializedTransaction');
+            catch (error) {
+                // The Solana lane tags its own broadcast and on-chain failures; anything
+                // untagged from it, and every poofnet step before the commit PUT, failed
+                // before a single byte was sent.
+                throw sending ? error : markWriteNotApplied(error, 'before_broadcast');
             }
         }
         else if (setResponse.status === 200) {
@@ -9003,6 +9064,8 @@ async function setMany(many, options) {
  * of a result document (a delete returns the PREVIOUS document, so its stale
  * `_transaction_hash` would misreport the delete).
  */
+/** HTTP statuses on the write request that prove the server refused it before anything happened. */
+const DEFINITIVE_WRITE_REFUSAL_STATUSES = new Set([400, 401, 402, 403, 404, 409, 422, 429]);
 function directCommitResult(response, documents) {
     var _a;
     const body = (response.data && typeof response.data === 'object' && !Array.isArray(response.data))
@@ -9271,48 +9334,6 @@ var operations = /*#__PURE__*/Object.freeze({
     syncItems: syncItems
 });
 
-/** The highest Solana transaction version this SDK reads back (SIMD-0385 v1). */
-const SOLANA_MAX_SUPPORTED_TRANSACTION_VERSION = 1;
-/**
- * getTransaction that survives a SIMD-0385 v1 response. @solana/web3.js 1.98.x
- * validates `version` against `0 | 'legacy'` and THROWS on 1 even when the request
- * raised the ceiling, so a real `Connection` (which exposes `rpcEndpoint`) is read
- * as raw JSON-RPC instead. An injected double without an endpoint goes through its
- * own `getTransaction` with the ceiling raised. Returns the RPC `result` (null when
- * the signature is unknown); RPC and transport failures throw so callers keep
- * treating a failed lookup as inconclusive rather than as absence.
- */
-async function getTransactionJson(rpc, signature, commitment = 'confirmed') {
-    var _a;
-    const endpoint = typeof (rpc === null || rpc === void 0 ? void 0 : rpc.rpcEndpoint) === 'string' ? rpc.rpcEndpoint.trim() : '';
-    if (!endpoint) {
-        return rpc.getTransaction(signature, {
-            maxSupportedTransactionVersion: SOLANA_MAX_SUPPORTED_TRANSACTION_VERSION,
-            commitment,
-        });
-    }
-    const response = await fetch(endpoint, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'getTransaction',
-            params: [signature, {
-                    commitment,
-                    encoding: 'json',
-                    maxSupportedTransactionVersion: SOLANA_MAX_SUPPORTED_TRANSACTION_VERSION,
-                }],
-        }),
-    });
-    if (!response.ok)
-        throw new Error(`getTransaction http ${response.status}`);
-    const body = await response.json();
-    if (body === null || body === void 0 ? void 0 : body.error)
-        throw new Error(`getTransaction rpc error ${body.error.code}: ${body.error.message}`);
-    return (_a = body === null || body === void 0 ? void 0 : body.result) !== null && _a !== void 0 ? _a : null;
-}
-
 const DEFAULT_TIMEOUT_MS = 60000;
 const DEFAULT_MAX_ATTEMPTS$1 = 20;
 const DEFAULT_POLL_INTERVAL_MS = 3000;
@@ -9386,20 +9407,50 @@ async function resolveSolanaRpc(config, options) {
     return new Connection(rpcUrl, 'confirmed');
 }
 /**
- * Solana reconciliation NEVER broadcasts. It reaches `expired_not_landed` only
- * after the fence is observed expired AND history successfully proves the
- * signature is absent; a failed or inconclusive lookup stays `submitted`.
+ * Whether a signature status is final enough to decide on. `processed` can still belong to a fork
+ * that is dropped, so only `confirmed` or `finalized` settle a write; an RPC that omits
+ * `confirmationStatus` reports a rooted transaction as `confirmations: null`.
+ */
+function settledStatus(status) {
+    if (!status)
+        return false;
+    if (status.confirmationStatus === 'confirmed' || status.confirmationStatus === 'finalized')
+        return true;
+    return status.confirmationStatus == null && status.confirmations === null;
+}
+/**
+ * Solana reconciliation NEVER broadcasts. It settles on a `confirmed` or `finalized` status only,
+ * and reaches `expired_not_landed` only from the chain's own blockhash expiry: the FINALIZED block
+ * height is past the fence, so the network can never accept these bytes again, and a
+ * history-searching status lookup from a node that has seen that finalized slot finds no record.
+ * Anything short of that - a `processed` status, a lookup that fails, a node behind the expiry
+ * point - stays `submitted`.
  */
 async function reconcileSolana(receipt, config, options) {
     var _a, _b, _c, _d;
     const rpc = await resolveSolanaRpc(config, options);
+    if (typeof rpc.getSignatureStatuses !== 'function') {
+        return stillSubmitted(receipt, 'the configured Solana RPC cannot report signature statuses');
+    }
+    // Expiry is read BEFORE the status, so an absence observed afterwards is an absence after the
+    // fence closed for good. A finalized height past lastValidBlockHeight is final: the blockhash
+    // can never become valid again.
+    let finalizedHeight;
+    let finalizedSlot;
+    try {
+        if (typeof rpc.getBlockHeight === 'function')
+            finalizedHeight = await rpc.getBlockHeight('finalized');
+        if (typeof rpc.getSlot === 'function')
+            finalizedSlot = await rpc.getSlot('finalized');
+    }
+    catch (error) {
+        return stillSubmitted(receipt, `finalized height lookup failed: ${errorText(error)}`);
+    }
+    const expired = typeof finalizedHeight === 'number' && finalizedHeight > receipt.fence.lastValidBlockHeight;
     let statusValue = null;
     let contextSlot;
     try {
-        if (typeof rpc.getSignatureStatuses !== 'function') {
-            return stillSubmitted(receipt, 'the configured Solana RPC cannot report signature statuses');
-        }
-        const statuses = await rpc.getSignatureStatuses([receipt.transactionId]);
+        const statuses = await rpc.getSignatureStatuses([receipt.transactionId], { searchTransactionHistory: true });
         statusValue = (_b = (_a = statuses === null || statuses === void 0 ? void 0 : statuses.value) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : null;
         contextSlot = (_c = statuses === null || statuses === void 0 ? void 0 : statuses.context) === null || _c === void 0 ? void 0 : _c.slot;
     }
@@ -9407,9 +9458,12 @@ async function reconcileSolana(receipt, config, options) {
         return stillSubmitted(receipt, `signature status lookup failed: ${errorText(error)}`);
     }
     if (statusValue) {
+        if (!settledStatus(statusValue)) {
+            return stillSubmitted(receipt, `seen at ${String((_d = statusValue.confirmationStatus) !== null && _d !== void 0 ? _d : 'an unconfirmed')} commitment; waiting for confirmed`);
+        }
         // Landed. A landed-but-failed transaction is a genuine failure, not `submitted`.
         if (statusValue.err) {
-            throw new Error(`Transaction failed: ${JSON.stringify(statusValue.err)}`);
+            throw markWriteNotApplied(new Error(`Transaction failed: ${JSON.stringify(statusValue.err)}`), 'failed_onchain');
         }
         const confirmed = {
             status: 'confirmed',
@@ -9419,50 +9473,21 @@ async function reconcileSolana(receipt, config, options) {
             transactionId: receipt.transactionId,
             signedTransaction: receipt.signedTransaction,
             fence: receipt.fence,
-            confirmationContextSlot: contextSlot !== null && contextSlot !== void 0 ? contextSlot : 0,
+            confirmationContextSlot: typeof statusValue.slot === 'number' ? statusValue.slot : (contextSlot !== null && contextSlot !== void 0 ? contextSlot : 0),
             mirrorSync: await mirrorFor(receipt, options),
         };
         return confirmed;
     }
-    // Absent from the status window. Expiry has to be OBSERVED before absence can
-    // mean anything: before the fence expires the transaction may still land.
-    let blockHeight;
-    try {
-        blockHeight = typeof rpc.getBlockHeight === 'function' ? await rpc.getBlockHeight('confirmed') : undefined;
+    if (typeof finalizedHeight !== 'number') {
+        return stillSubmitted(receipt, 'expiry could not be observed: the RPC reported no finalized block height');
     }
-    catch (error) {
-        return stillSubmitted(receipt, `block height lookup failed: ${errorText(error)}`);
-    }
-    if (typeof blockHeight !== 'number') {
-        return stillSubmitted(receipt, 'expiry could not be observed: the RPC reported no block height');
-    }
-    if (blockHeight <= receipt.fence.lastValidBlockHeight) {
-        return stillSubmitted(receipt, `not yet expired: block height ${blockHeight} is within the fence (lastValidBlockHeight ${receipt.fence.lastValidBlockHeight})`);
-    }
-    // Expired. Prove absence from history before declaring the write retry-safe.
-    let history;
-    try {
-        history = await getTransactionJson(rpc, receipt.transactionId, 'confirmed');
+    if (!expired) {
+        return stillSubmitted(receipt, `not yet expired: finalized block height ${finalizedHeight} is within the fence (lastValidBlockHeight ${receipt.fence.lastValidBlockHeight})`);
     }
-    catch (error) {
-        return stillSubmitted(receipt, `history lookup failed after expiry: ${errorText(error)}`);
-    }
-    if (history) {
-        if ((_d = history === null || history === void 0 ? void 0 : history.meta) === null || _d === void 0 ? void 0 : _d.err) {
-            throw new Error(`Transaction failed: ${JSON.stringify(history.meta.err)}`);
-        }
-        const confirmed = {
-            status: 'confirmed',
-            appId: receipt.appId,
-            requestedDocuments: receipt.requestedDocuments,
-            chain: receipt.chain,
-            transactionId: receipt.transactionId,
-            signedTransaction: receipt.signedTransaction,
-            fence: receipt.fence,
-            confirmationContextSlot: typeof history.slot === 'number' ? history.slot : (contextSlot !== null && contextSlot !== void 0 ? contextSlot : 0),
-            mirrorSync: await mirrorFor(receipt, options),
-        };
-        return confirmed;
+    // A load-balanced RPC may answer the status from a node behind the one that reported the
+    // finalized height. Its absence proves nothing until that node has seen the finalized slot.
+    if (typeof finalizedSlot !== 'number' || typeof contextSlot !== 'number' || contextSlot < finalizedSlot) {
+        return stillSubmitted(receipt, `expired, but the status node (slot ${contextSlot !== null && contextSlot !== void 0 ? contextSlot : 'unknown'}) has not reached the finalized slot ${finalizedSlot !== null && finalizedSlot !== void 0 ? finalizedSlot : 'unknown'}`);
     }
     return {
         status: 'expired_not_landed',
@@ -10725,7 +10750,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-Deru1tF1.mjs');
+    const implementation = await import('./solana-message-BBKdydqt.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11274,5 +11299,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { serverTimestamp as $, subscribe as A, closeAllSubscriptions as B, clearCache as C, getCachedData as D, reconnectWithNewAuth as E, createClient as F, ScopedClientReadOnlyError as G, exchangeAppToken as H, InsufficientBalanceError as I, clearAppTokenCache as J, createAppTokenAuthHeaders as K, AppTokenExchangeError as L, subscribeQuery as M, closeAllQuerySubscriptions as N, canonicalizeArgs as O, canonicalizeResult as P, DEFAULT_QUERY_POLL_INTERVAL_MS as Q, MIN_QUERY_POLL_INTERVAL_MS as R, SOLANA_MAX_SUPPORTED_TRANSACTION_VERSION as S, BoundedDeclineError as T, deriveDecline as U, dispatchDeclineEvent as V, DECLINE_EVENT_NAME as W, dispatchRateLimitEvent as X, RATE_LIMIT_EVENT_NAME as Y, hasActiveConnection as Z, increment as _, getTransactionJson as a, now as a0, toSeconds as a1, toMillis as a2, getIdToken as a3, deriveUserIdentityFromIdToken as a4, getSessionGeneration as a5, WebSessionManager as a6, ReactNativeSessionManager as a7, getActiveSessionManager as a8, onSessionCleared as a9, intent as aA, status as aB, subscribeView as aC, LiveIntentError as aD, withEffects as aE, isEffectResult as aF, defineLiveModule as aG, EFFECT_INTENT_ADDRESS as aH, SessionEnvironmentError as aa, UNSUPPORTED_ENVIRONMENT_CODE as ab, AUTH_CHANGED_CODE as ac, AUTH_EXPIRED_CODE as ad, isAuthExpiredError as ae, getFreshAuthToken as af, ServerSessionManager as ag, createSessionWithSignature as ah, refreshSession as ai, revokeSession as aj, signSessionCreateMessage as ak, genAuthNonce as al, genSolanaMessage as am, createSolanaSignInRequest as an, createSolanaSignInMessageText as ao, genSolanaSignInRequest as ap, genSolanaSignInMessage as aq, browserSignInDomain as ar, SOLANA_SIGN_IN_STATEMENT as as, genSiweMessage as at, normalizeEvmAddress as au, toLowerEvmAddress as av, functions as aw, invoke as ax, FunctionInvokeError as ay, live as az, bufferExports as b, getWebhookKeysUrl as c, getConfiguredAppId as d, get as e, getMany as f, getConfig as g, docId as h, init as i, setMany as j, setFile as k, getFiles as l, search as m, runQueryMany as n, runExpression as o, runExpressionMany as p, queryAggregate as q, runQuery as r, set as s, signMessage as t, signTransaction as u, signAndSubmitTransaction as v, count as w, aggregate as x, reconcileSetResult as y, waitForSetResult as z };
-//# sourceMappingURL=index-CLst0IiM.mjs.map
+export { increment as $, isWriteNotApplied as A, writeNotAppliedPhase as B, subscribe as C, closeAllSubscriptions as D, clearCache as E, getCachedData as F, reconnectWithNewAuth as G, createClient as H, InsufficientBalanceError as I, exchangeAppToken as J, clearAppTokenCache as K, createAppTokenAuthHeaders as L, AppTokenExchangeError as M, subscribeQuery as N, closeAllQuerySubscriptions as O, canonicalizeArgs as P, canonicalizeResult as Q, DEFAULT_QUERY_POLL_INTERVAL_MS as R, ScopedClientReadOnlyError as S, MIN_QUERY_POLL_INTERVAL_MS as T, BoundedDeclineError as U, deriveDecline as V, dispatchDeclineEvent as W, DECLINE_EVENT_NAME as X, dispatchRateLimitEvent as Y, RATE_LIMIT_EVENT_NAME as Z, hasActiveConnection as _, getWebhookKeysUrl as a, serverTimestamp as a0, now as a1, toSeconds as a2, toMillis as a3, getIdToken as a4, deriveUserIdentityFromIdToken as a5, getSessionGeneration as a6, WebSessionManager as a7, ReactNativeSessionManager as a8, getActiveSessionManager as a9, live as aA, intent as aB, status as aC, subscribeView as aD, LiveIntentError as aE, withEffects as aF, isEffectResult as aG, defineLiveModule as aH, EFFECT_INTENT_ADDRESS as aI, onSessionCleared as aa, SessionEnvironmentError as ab, UNSUPPORTED_ENVIRONMENT_CODE as ac, AUTH_CHANGED_CODE as ad, AUTH_EXPIRED_CODE as ae, isAuthExpiredError as af, getFreshAuthToken as ag, ServerSessionManager as ah, createSessionWithSignature as ai, refreshSession as aj, revokeSession as ak, signSessionCreateMessage as al, genAuthNonce as am, genSolanaMessage as an, createSolanaSignInRequest as ao, createSolanaSignInMessageText as ap, genSolanaSignInRequest as aq, genSolanaSignInMessage as ar, browserSignInDomain as as, SOLANA_SIGN_IN_STATEMENT as at, genSiweMessage as au, normalizeEvmAddress as av, toLowerEvmAddress as aw, functions as ax, invoke as ay, FunctionInvokeError as az, bufferExports as b, getConfiguredAppId as c, get as d, getMany as e, docId as f, getConfig as g, setMany as h, init as i, setFile as j, getFiles as k, search as l, markWriteNotApplied as m, runQueryMany as n, runExpression as o, runExpressionMany as p, queryAggregate as q, runQuery as r, set as s, signMessage as t, signTransaction as u, signAndSubmitTransaction as v, count as w, aggregate as x, reconcileSetResult as y, waitForSetResult as z };
+//# sourceMappingURL=index-No5Vz0YM.mjs.map