@bounded-sh/core 0.0.118-openapps.0 → 0.0.119

package/dist/{index-DQ0FXeI8.js → index-D7-5ecyu.js}

@@ -4307,7 +4307,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-F1e5wPKF.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-CPotom18.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -7679,7 +7679,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-CURbZ68v.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-C2Jz8YM0.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8898,7 +8898,7 @@ function buildRequestedDocuments(documents) {
 /** Best-effort readback, including a failure to load its lazy implementation. */
 async function attemptMirrorSync(paths, options, transactionSignature) {
     try {
-        const mirror = await Promise.resolve().then(function () { return require('./mirror-sync-ChzMq7bH.js'); });
+        const mirror = await Promise.resolve().then(function () { return require('./mirror-sync-DzbDh6G_.js'); });
         return await mirror.attemptMirrorSync(paths, options, transactionSignature);
     }
     catch (error) {
@@ -8996,237 +8996,280 @@ async function set(path, document, options) {
  * state appears only under `observation`/`mirrorSync` once actually observed.
  */
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
-    // Returns the data that was set, or undefined if the document was already set.
-    try {
-        // A server WalletClient threads its immutable config snapshot; the default
-        // path reads the mutable process-global init() config. This keeps the app-id
-        // bound into an on-chain 202 write (Solana/offchain) on the wallet
-        // client's original app after a later global init() (CTA-05).
-        const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();
-        const authProvider = (_d = (_c = options === null || options === void 0 ? void 0 : options._overrides) === null || _c === void 0 ? void 0 : _c.authProvider) !== null && _d !== void 0 ? _d : config.authProvider;
-        if (!authProvider) {
-            throw new Error('Auth provider not initialized');
-        }
-        let documents = [];
-        const pathsToInvalidate = new Set();
-        for (const { path, document: documentWithReservedFields } of many) {
-            // for setting, we should remove any pieces of the document that start with '_' as they are internal and shouldn't be updated. The API would block it if it is one of the reserved ones
-            let document = documentWithReservedFields;
-            if (documentWithReservedFields) {
-                document = Object.fromEntries(Object.entries(documentWithReservedFields).filter(([key]) => !key.startsWith('_')));
-            }
-            const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
-            pathsToInvalidate.add(normalizedPath);
-            const pathIsDocument = normalizedPath.split("/").length % 2 === 0;
-            let curItemId = "";
-            if (pathIsDocument) {
-                curItemId = normalizedPath.split("/").pop() ? normalizedPath.split("/").pop() : "";
-            }
-            else {
-                curItemId = Math.random().toString(36).slice(2).substring(0, 12);
-            }
-            // if the path is a document, we need to append the document id to the path
-            const collectionPath = pathIsDocument ? normalizedPath.split("/").slice(0, -1).join("/") : normalizedPath;
-            pathsToInvalidate.add(collectionPath);
-            let destinationPath = collectionPath;
-            if (curItemId && curItemId.length > 0) {
-                destinationPath = `${destinationPath}/${curItemId}`;
-            }
-            documents.push({ destinationPath, document });
-        }
-        let setResponse;
+    var _a, _b, _c, _d, _e, _f;
+    // A server WalletClient threads its immutable config snapshot; the default
+    // path reads the mutable process-global init() config. This keeps the app-id
+    // bound into an on-chain 202 write (Solana/offchain) on the wallet
+    // client's original app after a later global init() (CTA-05).
+    const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();
+    const authProvider = (_d = (_c = options === null || options === void 0 ? void 0 : options._overrides) === null || _c === void 0 ? void 0 : _c.authProvider) !== null && _d !== void 0 ? _d : config.authProvider;
+    if (!authProvider) {
+        throw new Error('Auth provider not initialized');
+    }
+    const { documents, pathsToInvalidate } = normalizeWriteBatch(many);
+    // A grant lane's credential is single-use, so its write is built exactly once, and its signer
+    // is prepared the way it always was: inside the approval.
+    const grantLane = (_e = options === null || options === void 0 ? void 0 : options._overrides) === null || _e === void 0 ? void 0 : _e._grantLane;
+    if ((options === null || options === void 0 ? void 0 : options.onchain) && !grantLane) {
+        // The caller knows the wallet will sign: the signer is prepared before the first build, so a
+        // first-time emailed code never runs inside a transaction's lifetime and no build is wasted.
         try {
-            // SIMD-0385: tell the worker which Solana transaction formats this client
-            // can sign, so it builds v1 only for a client that can complete it.
-            const clientTransactionVersions = await resolveClientTransactionVersions(authProvider);
-            setResponse = await makeApiRequest('PUT', `items`, { documents, clientTransactionVersions }, options === null || options === void 0 ? void 0 : options._overrides);
+            await ((_f = authProvider.prepareToSign) === null || _f === void 0 ? void 0 : _f.call(authProvider));
         }
         catch (error) {
-            if ((error === null || error === void 0 ? void 0 : error.statusCode) === 402 && (error === null || error === void 0 ? void 0 : error.error) === 'INSUFFICIENT_BALANCE') {
-                const deficitLamports = Number((_e = error.deficitLamports) !== null && _e !== void 0 ? _e : 0);
-                const deficitSol = Number((_f = error.deficitSol) !== null && _f !== void 0 ? _f : deficitLamports / 1000000000);
-                throw markWriteNotApplied(new InsufficientBalanceError(String((_g = error.address) !== null && _g !== void 0 ? _g : ''), Number((_h = error.balanceLamports) !== null && _h !== void 0 ? _h : 0), Number((_j = error.estimatedCostLamports) !== null && _j !== void 0 ? _j : 0), deficitLamports, deficitSol), 'before_broadcast');
-            }
-            // The server answered and refused the write (a rule or invariant denial, a bad request, no
-            // session, a rate limit): nothing was built, signed or committed. A network failure, a 5xx,
-            // a 408 or a 499 may follow a commit the response never reported, so those stay untagged.
-            if (DEFINITIVE_WRITE_REFUSAL_STATUSES.has(Number(error === null || error === void 0 ? void 0 : error.statusCode))) {
-                throw markWriteNotApplied(error, 'before_broadcast');
-            }
-            throw error;
+            throw markWriteNotApplied(error, 'before_broadcast');
         }
+    }
+    // Each reason to build again is spent once: the wallet's own ceremony (the build it ran beside is
+    // dying), and a send refused because the blockhash expired (a long pause on the approve card).
+    const rebuilds = { ceremony: !grantLane, expiry: !grantLane };
+    for (;;) {
+        const setResponse = await requestWrite(documents, authProvider, options);
         // Invalidate caches and pending requests for affected paths
         pathsToInvalidate.forEach(path => {
             clearCacheByPrefix(path);
         });
-        if (setResponse.status === 202) {
-            // This means that the document needs to be set on-chain (or signed for offchain),
-            // the API did nothing and gave us the required info to run this transaction.
-            // Until something is sent, every failure below is definitively not applied.
-            let sending = false;
+        if (setResponse.status === 200)
+            return directCommitResult(setResponse, documents);
+        if (setResponse.status !== 202)
+            throw new Error(`Failed to set document: ${setResponse}`);
+        const outcome = await completePreparedWrite(setResponse, documents, config, authProvider, options, rebuilds);
+        if (!isRebuild(outcome))
+            return outcome;
+        rebuilds[outcome.rebuild] = false;
+    }
+}
+/** The caller's batch as the worker takes it, plus every read-cache prefix the write touches. */
+function normalizeWriteBatch(many) {
+    const documents = [];
+    const pathsToInvalidate = new Set();
+    for (const { path, document: documentWithReservedFields } of many) {
+        // for setting, we should remove any pieces of the document that start with '_' as they are internal and shouldn't be updated. The API would block it if it is one of the reserved ones
+        let document = documentWithReservedFields;
+        if (documentWithReservedFields) {
+            document = Object.fromEntries(Object.entries(documentWithReservedFields).filter(([key]) => !key.startsWith('_')));
+        }
+        const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
+        pathsToInvalidate.add(normalizedPath);
+        const pathIsDocument = normalizedPath.split("/").length % 2 === 0;
+        let curItemId = "";
+        if (pathIsDocument) {
+            curItemId = normalizedPath.split("/").pop() ? normalizedPath.split("/").pop() : "";
+        }
+        else {
+            curItemId = Math.random().toString(36).slice(2).substring(0, 12);
+        }
+        // if the path is a document, we need to append the document id to the path
+        const collectionPath = pathIsDocument ? normalizedPath.split("/").slice(0, -1).join("/") : normalizedPath;
+        pathsToInvalidate.add(collectionPath);
+        let destinationPath = collectionPath;
+        if (curItemId && curItemId.length > 0) {
+            destinationPath = `${destinationPath}/${curItemId}`;
+        }
+        documents.push({ destinationPath, document });
+    }
+    return { documents, pathsToInvalidate };
+}
+/** The write PUT: a direct commit (200), a transaction to sign (202), or a definitive refusal. */
+async function requestWrite(documents, authProvider, options) {
+    var _a, _b, _c, _d, _e;
+    try {
+        // SIMD-0385: tell the worker which Solana transaction formats this client
+        // can sign, so it builds v1 only for a client that can complete it.
+        const clientTransactionVersions = await resolveClientTransactionVersions(authProvider);
+        return await makeApiRequest('PUT', `items`, { documents, clientTransactionVersions }, options === null || options === void 0 ? void 0 : options._overrides);
+    }
+    catch (error) {
+        if ((error === null || error === void 0 ? void 0 : error.statusCode) === 402 && (error === null || error === void 0 ? void 0 : error.error) === 'INSUFFICIENT_BALANCE') {
+            const deficitLamports = Number((_a = error.deficitLamports) !== null && _a !== void 0 ? _a : 0);
+            const deficitSol = Number((_b = error.deficitSol) !== null && _b !== void 0 ? _b : deficitLamports / 1000000000);
+            throw markWriteNotApplied(new InsufficientBalanceError(String((_c = error.address) !== null && _c !== void 0 ? _c : ''), Number((_d = error.balanceLamports) !== null && _d !== void 0 ? _d : 0), Number((_e = error.estimatedCostLamports) !== null && _e !== void 0 ? _e : 0), deficitLamports, deficitSol), 'before_broadcast');
+        }
+        // The server answered and refused the write (a rule or invariant denial, a bad request, no
+        // session, a rate limit): nothing was built, signed or committed. A network failure, a 5xx,
+        // a 408 or a 499 may follow a commit the response never reported, so those stay untagged.
+        if (DEFINITIVE_WRITE_REFUSAL_STATUSES.has(Number(error === null || error === void 0 ? void 0 : error.statusCode))) {
+            throw markWriteNotApplied(error, 'before_broadcast');
+        }
+        throw error;
+    }
+}
+function isRebuild(outcome) {
+    return 'rebuild' in outcome;
+}
+/**
+ * Finish a 202: the worker built the transaction (or the poofnet approval) and did nothing
+ * else; the wallet signs it here and, on a real chain, it is broadcast. Until something is
+ * sent, every failure is definitively not applied. `rebuilds` says which reasons to build
+ * again are still open.
+ */
+async function completePreparedWrite(setResponse, documents, config, authProvider, options, rebuilds) {
+    var _a, _b, _c;
+    let sending = false;
+    try {
+        const { transactions, offchainTransaction } = setResponse.data;
+        // Handle offchain transaction flow (for 'offchain' protocol apps)
+        if (offchainTransaction && Array.isArray(transactions) && transactions.length > 0) {
+            throw new Error('Ambiguous write response mixes offchain and onchain transaction targets');
+        }
+        if (offchainTransaction) {
+            // Offchain signing is retired: no server mints this envelope any more
+            // (the realtime worker commits poofnet writes directly). Fail loudly
+            // rather than silently ignoring a payload the caller was asked to sign.
+            throw new Error('Unsupported 202 transaction shape: offchain signing is retired');
+        }
+        // Handle Solana on-chain transaction flow
+        if (!Array.isArray(transactions) || transactions.length !== 1) {
+            throw new Error(`Expected exactly one on-chain transaction, received ${Array.isArray(transactions) ? transactions.length : 0}`);
+        }
+        const curTx = transactions[0];
+        // The EVM onchain data plane is retired: no worker mints an EVM 202 any
+        // more. A payload that still carries one is an unexpected response and
+        // fails loudly BEFORE anything is signed - never silently ignored.
+        if ((curTx === null || curTx === void 0 ? void 0 : curTx.evmTransaction) != null) {
+            throw new Error('Unsupported 202 transaction shape: the write response carried an evmTransaction, ' +
+                'but EVM onchain writes are no longer supported. Nothing was signed or submitted.');
+        }
+        const hasSerializedSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.serializedTransaction) != null;
+        const hasBuiltSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.transactionArgs) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.remainingAccounts) != null ||
+            (curTx === null || curTx === void 0 ? void 0 : curTx.idl) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.txData) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.preInstructions) != null;
+        if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
+            throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
+        }
+        // All requested paths (writes AND deletes), in request order. Used for the
+        // post-confirm mirror read-back, which correlates every requested path.
+        // The pre-sign validation derives its own full expected intent from
+        // `documents` (see below) and needs nothing from this list.
+        const requestedPaths = documents.map(d => d.destinationPath);
+        const requestedDocuments = buildRequestedDocuments(documents);
+        const appId = config.appId;
+        // The lane comes verbatim from the worker, and is read BEFORE anything is
+        // signed or submitted: a missing tag fails closed while nothing has been
+        // broadcast, instead of stranding a landed transaction with no receipt.
+        const workerChain = readWorkerChainTag((_a = setResponse.data) === null || _a === void 0 ? void 0 : _a.receipt, setResponse.data, curTx);
+        if (!workerChain) {
+            throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
+                'Nothing was signed or submitted.');
+        }
+        const grantLane = (_b = options === null || options === void 0 ? void 0 : options._overrides) === null || _b === void 0 ? void 0 : _b._grantLane;
+        grantLane === null || grantLane === void 0 ? void 0 : grantLane.assertLane(workerChain);
+        // The wallet's own ceremony runs now, before it sees a transaction: a hosted embedded
+        // wallet whose 24-hour signing session has lapsed collects its emailed code here, and that
+        // outlives the blockhash the worker just minted. A ceremony that ran means this build is
+        // already dying, so the write is built again and the wallet signs the fresh one in one click.
+        // (A caller that passed `onchain` prepared the signer before the build, so this normally
+        // answers 'ready' at once. It runs the ceremony here only when that preparation could not
+        // reach the signer; the build it then replaces is left to expire unsigned.)
+        if (rebuilds.ceremony && await ((_c = authProvider.prepareToSign) === null || _c === void 0 ? void 0 : _c.call(authProvider)) === 'established')
+            return { rebuild: 'ceremony' };
+        if (workerChain === 'realtime_offchain') {
+            // Poofnet: the wallet signs the worker's unsendable approval message and
+            // the worker verifies and commits it. Nothing is submitted to any chain.
+            if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
+                throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
+            }
+            const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-DsT1303T.js'); });
+            const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
+            // Signing-only, exactly as on a real chain: signed and NOT committed.
+            if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+                return {
+                    status: 'signed', appId, requestedDocuments: buildRequestedDocuments(documents),
+                    chain: 'realtime_offchain', transactionId: null, signedTransaction,
+                    poofnetIntentId: curTx.poofnetIntentId,
+                };
+            }
+            // A grant lane's first credential is spent by the PUT that built this approval, so the
+            // commit's is minted now, before `sending`: failing to mint sends nothing.
+            const commitHeaders = await (grantLane === null || grantLane === void 0 ? void 0 : grantLane.commitHeaders());
+            // The commit PUT is the one ambiguous step of this lane: a lost response may follow a
+            // commit, so a transport failure or a 5xx stays untagged (read the path back). A 4xx is
+            // realtime stating it committed nothing (the intent expired or was taken, the signer did
+            // not match, a rule refused it), as for the first PUT. 408 and 499 are a proxy's words,
+            // not realtime's, and may follow a commit, so they stay ambiguous too.
+            sending = true;
+            let commitResponse;
             try {
-                const { transactions, offchainTransaction } = setResponse.data;
-                // Handle offchain transaction flow (for 'offchain' protocol apps)
-                if (offchainTransaction && Array.isArray(transactions) && transactions.length > 0) {
-                    throw new Error('Ambiguous write response mixes offchain and onchain transaction targets');
-                }
-                if (offchainTransaction) {
-                    // Offchain signing is retired: no server mints this envelope any more
-                    // (the realtime worker commits poofnet writes directly). Fail loudly
-                    // rather than silently ignoring a payload the caller was asked to sign.
-                    throw new Error('Unsupported 202 transaction shape: offchain signing is retired');
-                }
-                // Handle Solana on-chain transaction flow
-                if (!Array.isArray(transactions) || transactions.length !== 1) {
-                    throw new Error(`Expected exactly one on-chain transaction, received ${Array.isArray(transactions) ? transactions.length : 0}`);
-                }
-                const curTx = transactions[0];
-                // The EVM onchain data plane is retired: no worker mints an EVM 202 any
-                // more. A payload that still carries one is an unexpected response and
-                // fails loudly BEFORE anything is signed - never silently ignored.
-                if ((curTx === null || curTx === void 0 ? void 0 : curTx.evmTransaction) != null) {
-                    throw new Error('Unsupported 202 transaction shape: the write response carried an evmTransaction, ' +
-                        'but EVM onchain writes are no longer supported. Nothing was signed or submitted.');
-                }
-                const hasSerializedSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.serializedTransaction) != null;
-                const hasBuiltSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.transactionArgs) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.remainingAccounts) != null ||
-                    (curTx === null || curTx === void 0 ? void 0 : curTx.idl) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.txData) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.preInstructions) != null;
-                if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
-                    throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
-                }
-                // All requested paths (writes AND deletes), in request order. Used for the
-                // post-confirm mirror read-back, which correlates every requested path.
-                // The pre-sign validation derives its own full expected intent from
-                // `documents` (see below) and needs nothing from this list.
-                const requestedPaths = documents.map(d => d.destinationPath);
-                const requestedDocuments = buildRequestedDocuments(documents);
-                const appId = config.appId;
-                // The lane comes verbatim from the worker, and is read BEFORE anything is
-                // signed or submitted: a missing tag fails closed while nothing has been
-                // broadcast, instead of stranding a landed transaction with no receipt.
-                const workerChain = readWorkerChainTag((_k = setResponse.data) === null || _k === void 0 ? void 0 : _k.receipt, setResponse.data, curTx);
-                if (!workerChain) {
-                    throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
-                        'Nothing was signed or submitted.');
-                }
-                const grantLane = (_l = options === null || options === void 0 ? void 0 : options._overrides) === null || _l === void 0 ? void 0 : _l._grantLane;
-                grantLane === null || grantLane === void 0 ? void 0 : grantLane.assertLane(workerChain);
-                if (workerChain === 'realtime_offchain') {
-                    // Poofnet: the wallet signs the worker's unsendable approval message and
-                    // the worker verifies and commits it. Nothing is submitted to any chain.
-                    if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
-                        throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
-                    }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-CI0sREvl.js'); });
-                    const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
-                    // Signing-only, exactly as on a real chain: signed and NOT committed.
-                    if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
-                        return {
-                            status: 'signed', appId, requestedDocuments: buildRequestedDocuments(documents),
-                            chain: 'realtime_offchain', transactionId: null, signedTransaction,
-                            poofnetIntentId: curTx.poofnetIntentId,
-                        };
-                    }
-                    // A grant lane's first credential is spent by the PUT that built this approval, so the
-                    // commit's is minted now, before `sending`: failing to mint sends nothing.
-                    const commitHeaders = await (grantLane === null || grantLane === void 0 ? void 0 : grantLane.commitHeaders());
-                    // The commit PUT is the one ambiguous step of this lane: a lost response may follow a
-                    // commit, so a transport failure or a 5xx stays untagged (read the path back). A 4xx is
-                    // realtime stating it committed nothing (the intent expired or was taken, the signer did
-                    // not match, a rule refused it), as for the first PUT. 408 and 499 are a proxy's words,
-                    // not realtime's, and may follow a commit, so they stay ambiguous too.
-                    sending = true;
-                    let commitResponse;
-                    try {
-                        commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, commitHeaders ? Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _getAuthHeaders: async () => commitHeaders }) : options === null || options === void 0 ? void 0 : options._overrides);
-                        if (commitResponse.status !== 200) {
-                            throw Object.assign(new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`), { statusCode: commitResponse.status });
-                        }
-                    }
-                    catch (error) {
-                        const status = Number(error === null || error === void 0 ? void 0 : error.statusCode);
-                        throw status >= 400 && status < 500 && status !== 408 && status !== 499 ? markWriteNotApplied(error, 'broadcast_rejected') : error;
-                    }
-                    return directCommitResult(commitResponse, documents);
-                }
-                if (curTx.serializedTransaction) {
-                    if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
-                        throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
-                            'Nothing was signed or submitted.');
-                    }
-                    const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-CI0sREvl.js'); });
-                    // OA-0001: derive the expected intent from OUR OWN request (the one
-                    // ground truth a tampered builder response cannot change) so the
-                    // validator can reject any transaction whose operation semantics
-                    // diverge from it BEFORE the wallet is asked to sign.
-                    const expectedIntent = buildExpectedWriteIntent(documents);
-                    const onBroadcast = options === null || options === void 0 ? void 0 : options.onBroadcast;
-                    const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent, onBroadcast && (async (signed) => {
-                        await onBroadcast({
-                            status: 'submitted', appId, requestedDocuments, chain: solanaChain,
-                            transactionId: signed.transactionSignature,
-                            signedTransaction: signed.signedTransaction,
-                            fence: signed.fence,
-                            confirmation: { state: 'unknown', reason: 'about to broadcast' },
-                        });
-                    }));
-                    // Past this point the bytes may be on the network: nothing is tagged here.
-                    sending = true;
-                    // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
-                    // and there is nothing to mirror, so no synchronization is attempted.
-                    if (solanaOutcome.outcome === 'signed') {
-                        return {
-                            status: 'signed', appId, requestedDocuments, chain: solanaChain,
-                            transactionId: null,
-                            signedTransaction: solanaOutcome.signedTransaction,
-                            fence: solanaOutcome.fence,
-                        };
-                    }
-                    if (solanaOutcome.outcome === 'submitted') {
-                        return {
-                            status: 'submitted', appId, requestedDocuments, chain: solanaChain,
-                            transactionId: solanaOutcome.transactionSignature,
-                            signedTransaction: solanaOutcome.signedTransaction,
-                            fence: solanaOutcome.fence,
-                            confirmation: { state: 'unknown', reason: solanaOutcome.reason },
-                        };
-                    }
-                    // Confirmed: the receipt is already complete, so the mirror read is a
-                    // best-effort enrichment reported in `mirrorSync`, never a rejection.
-                    const mirrorSync = grantLane
-                        ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
-                        : await attemptMirrorSync(requestedPaths, Object.assign(Object.assign({}, options), { _overrides: Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _config: config }) }), solanaOutcome.transactionSignature);
-                    return {
-                        status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
-                        transactionId: solanaOutcome.transactionSignature,
-                        signedTransaction: solanaOutcome.signedTransaction,
-                        fence: solanaOutcome.fence,
-                        confirmationContextSlot: solanaOutcome.confirmationContextSlot,
-                        mirrorSync,
-                    };
-                }
-                else {
-                    throw new Error('Unsupported 202 transaction shape: expected serializedTransaction');
+                commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, commitHeaders ? Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _getAuthHeaders: async () => commitHeaders }) : options === null || options === void 0 ? void 0 : options._overrides);
+                if (commitResponse.status !== 200) {
+                    throw Object.assign(new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`), { statusCode: commitResponse.status });
                 }
             }
             catch (error) {
-                // The Solana lane tags its own broadcast and on-chain failures; anything
-                // untagged from it, and every poofnet step before the commit PUT, failed
-                // before a single byte was sent.
-                throw sending ? error : markWriteNotApplied(error, 'before_broadcast');
+                const status = Number(error === null || error === void 0 ? void 0 : error.statusCode);
+                throw status >= 400 && status < 500 && status !== 408 && status !== 499 ? markWriteNotApplied(error, 'broadcast_rejected') : error;
             }
+            return directCommitResult(commitResponse, documents);
         }
-        else if (setResponse.status === 200) {
-            return directCommitResult(setResponse, documents);
+        if (curTx.serializedTransaction) {
+            if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
+                throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
+                    'Nothing was signed or submitted.');
+            }
+            const solanaChain = workerChain;
+            const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-DsT1303T.js'); });
+            // OA-0001: derive the expected intent from OUR OWN request (the one
+            // ground truth a tampered builder response cannot change) so the
+            // validator can reject any transaction whose operation semantics
+            // diverge from it BEFORE the wallet is asked to sign.
+            const expectedIntent = buildExpectedWriteIntent(documents);
+            const onBroadcast = options === null || options === void 0 ? void 0 : options.onBroadcast;
+            const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent, onBroadcast && (async (signed) => {
+                await onBroadcast({
+                    status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: signed.transactionSignature,
+                    signedTransaction: signed.signedTransaction,
+                    fence: signed.fence,
+                    confirmation: { state: 'unknown', reason: 'about to broadcast' },
+                });
+            }));
+            // Past this point the bytes may be on the network: nothing is tagged here.
+            sending = true;
+            // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
+            // and there is nothing to mirror, so no synchronization is attempted.
+            if (solanaOutcome.outcome === 'signed') {
+                return {
+                    status: 'signed', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: null,
+                    signedTransaction: solanaOutcome.signedTransaction,
+                    fence: solanaOutcome.fence,
+                };
+            }
+            if (solanaOutcome.outcome === 'submitted') {
+                return {
+                    status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: solanaOutcome.transactionSignature,
+                    signedTransaction: solanaOutcome.signedTransaction,
+                    fence: solanaOutcome.fence,
+                    confirmation: { state: 'unknown', reason: solanaOutcome.reason },
+                };
+            }
+            // Confirmed: the receipt is already complete, so the mirror read is a
+            // best-effort enrichment reported in `mirrorSync`, never a rejection.
+            const mirrorSync = grantLane
+                ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
+                : await attemptMirrorSync(requestedPaths, Object.assign(Object.assign({}, options), { _overrides: Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _config: config }) }), solanaOutcome.transactionSignature);
+            return {
+                status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
+                transactionId: solanaOutcome.transactionSignature,
+                signedTransaction: solanaOutcome.signedTransaction,
+                fence: solanaOutcome.fence,
+                confirmationContextSlot: solanaOutcome.confirmationContextSlot,
+                mirrorSync,
+            };
         }
         else {
-            throw new Error(`Failed to set document: ${setResponse}`);
+            throw new Error('Unsupported 202 transaction shape: expected serializedTransaction');
         }
     }
     catch (error) {
-        throw error;
+        // The blockhash died before the send: the RPC refused the bytes in preflight, so nothing
+        // entered the network. The worker builds a fresh one and the wallet signs it again.
+        if (rebuilds.expiry && (await Promise.resolve().then(function () { return require('./solana-operations-DsT1303T.js'); })).isExpiredBlockhashRejection(error))
+            return { rebuild: 'expiry' };
+        // The Solana lane tags its own broadcast and on-chain failures; anything
+        // untagged from it, and every poofnet step before the commit PUT, failed
+        // before a single byte was sent.
+        throw sending ? error : markWriteNotApplied(error, 'before_broadcast');
     }
 }
 /**
@@ -9462,6 +9505,23 @@ async function signTransaction(transaction) {
     }
     return config.authProvider.signTransaction(transaction);
 }
+/**
+ * Make the signed-in wallet ready to sign without delay, BEFORE the transaction it will sign
+ * exists. A hosted embedded wallet whose 24-hour signing session has lapsed collects its emailed
+ * code here; a transaction built before that code is dead by the time it is signed, because a
+ * blockhash lives about 33 seconds on mainnet (late 2026) and the code takes longer. `set` and
+ * `setMany` do this themselves before a wallet signature; call it directly before a flow that
+ * builds and signs outside them, such as a permit approval. Resolves `'established'` when a
+ * ceremony ran, else `'ready'`; a wallet that holds its own key always answers `'ready'`.
+ */
+async function prepareToSign() {
+    var _a, _b, _c;
+    const config = await getConfig();
+    if (!config.authProvider) {
+        throw new Error('Auth provider not initialized. Please call init() first.');
+    }
+    return (_c = (await ((_b = (_a = config.authProvider).prepareToSign) === null || _b === void 0 ? void 0 : _b.call(_a)))) !== null && _c !== void 0 ? _c : 'ready';
+}
 async function signAndSubmitTransaction(transaction, feePayer) {
     const config = await getConfig();
     if (!config.authProvider) {
@@ -9482,6 +9542,7 @@ var operations = /*#__PURE__*/Object.freeze({
     getFiles: getFiles,
     getMany: getMany,
     onReadCacheAuthChange: onReadCacheAuthChange,
+    prepareToSign: prepareToSign,
     queryAggregate: queryAggregate,
     runExpression: runExpression,
     runExpressionMany: runExpressionMany,
@@ -9496,9 +9557,81 @@ var operations = /*#__PURE__*/Object.freeze({
     signTransaction: signTransaction
 });
 
+const DEFAULT_POLL_INTERVAL_MS$1 = 1000;
+const DEFAULT_MAX_WAIT_MS = 120000;
+/**
+ * Whether a status is final enough to decide on. `processed` can still belong to a fork
+ * that is dropped, so only `confirmed` or `finalized` settle a write; an RPC that omits
+ * `confirmationStatus` reports a rooted transaction as `confirmations: null`.
+ */
+function settledSignatureStatus(status) {
+    if (!status)
+        return false;
+    if (status.confirmationStatus === 'confirmed' || status.confirmationStatus === 'finalized')
+        return true;
+    return status.confirmationStatus == null && status.confirmations === null;
+}
+/**
+ * Poll the SAME signature until it is seen at `confirmed` or the blockhash fence closes.
+ * Never broadcasts. A `processed` status, even one carrying an error, is not a verdict and
+ * keeps the loop going. Once the confirmed block height passes `lastValidBlockHeight`, one
+ * history-searching read decides whether the transaction landed anyway; if not, the answer
+ * is "not seen" or "seen only below confirmed", never "never landed": only a finalized
+ * expiry proves that, which is `reconcileSetResult`'s job. Transient RPC failures retry the
+ * same signature.
+ */
+async function confirmSignature(rpc, fence, options = {}) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    if (typeof rpc.getSignatureStatuses !== 'function' || typeof rpc.getBlockHeight !== 'function') {
+        // An injected RPC that cannot answer is reported at once, not retried for two minutes.
+        return { landed: false, reason: 'the configured Solana RPC cannot report signature statuses and block height' };
+    }
+    const pollIntervalMs = (_a = options.pollIntervalMs) !== null && _a !== void 0 ? _a : DEFAULT_POLL_INTERVAL_MS$1;
+    const maxWaitMs = (_b = options.maxWaitMs) !== null && _b !== void 0 ? _b : DEFAULT_MAX_WAIT_MS;
+    const startedAt = Date.now();
+    let lastFailure = null;
+    for (;;) {
+        try {
+            // Status first: a settled status decides on its own, and the height is read only
+            // while the transaction is still unseen, so a failing height read never discards
+            // a confirmation this tick already has.
+            const statuses = await rpc.getSignatureStatuses([fence.signature]);
+            const status = (_d = (_c = statuses === null || statuses === void 0 ? void 0 : statuses.value) === null || _c === void 0 ? void 0 : _c[0]) !== null && _d !== void 0 ? _d : null;
+            if (settledSignatureStatus(status))
+                return { landed: true, status, contextSlot: (_e = statuses === null || statuses === void 0 ? void 0 : statuses.context) === null || _e === void 0 ? void 0 : _e.slot };
+            const blockHeight = await rpc.getBlockHeight('confirmed');
+            if (blockHeight > fence.lastValidBlockHeight) {
+                const history = await rpc.getSignatureStatuses([fence.signature], { searchTransactionHistory: true });
+                const late = (_g = (_f = history === null || history === void 0 ? void 0 : history.value) === null || _f === void 0 ? void 0 : _f[0]) !== null && _g !== void 0 ? _g : null;
+                if (settledSignatureStatus(late))
+                    return { landed: true, status: late, contextSlot: (_h = history === null || history === void 0 ? void 0 : history.context) === null || _h === void 0 ? void 0 : _h.slot };
+                const seen = late ? `seen only at ${String((_j = late.confirmationStatus) !== null && _j !== void 0 ? _j : 'an unconfirmed')} commitment` : 'not seen at confirmed';
+                return {
+                    landed: false,
+                    reason: `${seen} before the blockhash expired (block height ${blockHeight} is past ${fence.lastValidBlockHeight})`,
+                };
+            }
+            lastFailure = null;
+        }
+        catch (error) {
+            // Transient: keep polling the same signature. The ceiling below bounds a dead RPC.
+            lastFailure = error instanceof Error ? error.message : String(error);
+        }
+        if (Date.now() - startedAt >= maxWaitMs) {
+            return {
+                landed: false,
+                reason: lastFailure
+                    ? `the RPC kept failing while the transaction was awaited: ${lastFailure}`
+                    : `not seen at confirmed within ${Math.round(maxWaitMs / 1000)}s and the block height never passed the blockhash fence`,
+            };
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+}
+
 const DEFAULT_TIMEOUT_MS = 60000;
-const DEFAULT_MAX_ATTEMPTS$1 = 20;
-const DEFAULT_POLL_INTERVAL_MS = 3000;
+const DEFAULT_MAX_ATTEMPTS$1 = 60;
+const DEFAULT_POLL_INTERVAL_MS = 1000;
 function errorText(error) {
     const message = error === null || error === void 0 ? void 0 : error.message;
     return typeof message === 'string' && message.length > 0 ? message : String(error);
@@ -9566,18 +9699,6 @@ async function resolveSolanaRpc(config, options) {
     const { Connection } = await import('@solana/web3.js');
     return new Connection(rpcUrl, 'confirmed');
 }
-/**
- * Whether a signature status is final enough to decide on. `processed` can still belong to a fork
- * that is dropped, so only `confirmed` or `finalized` settle a write; an RPC that omits
- * `confirmationStatus` reports a rooted transaction as `confirmations: null`.
- */
-function settledStatus(status) {
-    if (!status)
-        return false;
-    if (status.confirmationStatus === 'confirmed' || status.confirmationStatus === 'finalized')
-        return true;
-    return status.confirmationStatus == null && status.confirmations === null;
-}
 /**
  * Solana reconciliation NEVER broadcasts. It settles on a `confirmed` or `finalized` status only,
  * and reaches `expired_not_landed` only from the chain's own blockhash expiry: the FINALIZED block
@@ -9589,17 +9710,13 @@ function settledStatus(status) {
 async function reconcileSolana(receipt, config, options) {
     var _a, _b, _c, _d;
     const rpc = await resolveSolanaRpc(config, options);
-    if (typeof rpc.getSignatureStatuses !== 'function') {
-        return stillSubmitted(receipt, 'the configured Solana RPC cannot report signature statuses');
-    }
     // Expiry is read BEFORE the status, so an absence observed afterwards is an absence after the
     // fence closed for good. A finalized height past lastValidBlockHeight is final: the blockhash
     // can never become valid again.
     let finalizedHeight;
     let finalizedSlot;
     try {
-        if (typeof rpc.getBlockHeight === 'function')
-            finalizedHeight = await rpc.getBlockHeight('finalized');
+        finalizedHeight = await rpc.getBlockHeight('finalized');
         if (typeof rpc.getSlot === 'function')
             finalizedSlot = await rpc.getSlot('finalized');
     }
@@ -9618,7 +9735,7 @@ async function reconcileSolana(receipt, config, options) {
         return stillSubmitted(receipt, `signature status lookup failed: ${errorText(error)}`);
     }
     if (statusValue) {
-        if (!settledStatus(statusValue)) {
+        if (!settledSignatureStatus(statusValue)) {
             return stillSubmitted(receipt, `seen at ${String((_d = statusValue.confirmationStatus) !== null && _d !== void 0 ? _d : 'an unconfirmed')} commitment; waiting for confirmed`);
         }
         // Landed. A landed-but-failed transaction is a genuine failure, not `submitted`.
@@ -10988,7 +11105,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-F1e5wPKF.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-CPotom18.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11567,6 +11684,7 @@ exports.clearAppTokenCache = clearAppTokenCache;
 exports.clearCache = clearCache;
 exports.closeAllQuerySubscriptions = closeAllQuerySubscriptions;
 exports.closeAllSubscriptions = closeAllSubscriptions;
+exports.confirmSignature = confirmSignature;
 exports.count = count;
 exports.createAppTokenAuthHeaders = createAppTokenAuthHeaders;
 exports.createClient = createClient;
@@ -11612,6 +11730,7 @@ exports.normalizeEvmAddress = normalizeEvmAddress;
 exports.now = now;
 exports.onSessionChange = onSessionChange;
 exports.onSessionCleared = onSessionCleared;
+exports.prepareToSign = prepareToSign;
 exports.queryAggregate = queryAggregate;
 exports.reconcileSetResult = reconcileSetResult;
 exports.reconnectWithNewAuth = reconnectWithNewAuth;
@@ -11642,4 +11761,4 @@ exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
 exports.writeNotAppliedPhase = writeNotAppliedPhase;
-//# sourceMappingURL=index-DQ0FXeI8.js.map
+//# sourceMappingURL=index-D7-5ecyu.js.map