@bounded-sh/core 0.0.118-openapps.0 → 0.0.119

package/dist/{index-C6ZW5Gt2.mjs → index-D93TEYGf.mjs}

@@ -4305,7 +4305,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-CEjXjnaG.mjs');
+        const { genSolanaMessage } = await import('./solana-message-DqKp-y53.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -7677,7 +7677,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-FUjGL_Z8.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-FObAdw-J.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8896,7 +8896,7 @@ function buildRequestedDocuments(documents) {
 /** Best-effort readback, including a failure to load its lazy implementation. */
 async function attemptMirrorSync(paths, options, transactionSignature) {
     try {
-        const mirror = await import('./mirror-sync-kt9PzQen.mjs');
+        const mirror = await import('./mirror-sync-DPMtQC3A.mjs');
         return await mirror.attemptMirrorSync(paths, options, transactionSignature);
     }
     catch (error) {
@@ -8994,237 +8994,280 @@ async function set(path, document, options) {
  * state appears only under `observation`/`mirrorSync` once actually observed.
  */
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
-    // Returns the data that was set, or undefined if the document was already set.
-    try {
-        // A server WalletClient threads its immutable config snapshot; the default
-        // path reads the mutable process-global init() config. This keeps the app-id
-        // bound into an on-chain 202 write (Solana/offchain) on the wallet
-        // client's original app after a later global init() (CTA-05).
-        const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();
-        const authProvider = (_d = (_c = options === null || options === void 0 ? void 0 : options._overrides) === null || _c === void 0 ? void 0 : _c.authProvider) !== null && _d !== void 0 ? _d : config.authProvider;
-        if (!authProvider) {
-            throw new Error('Auth provider not initialized');
-        }
-        let documents = [];
-        const pathsToInvalidate = new Set();
-        for (const { path, document: documentWithReservedFields } of many) {
-            // for setting, we should remove any pieces of the document that start with '_' as they are internal and shouldn't be updated. The API would block it if it is one of the reserved ones
-            let document = documentWithReservedFields;
-            if (documentWithReservedFields) {
-                document = Object.fromEntries(Object.entries(documentWithReservedFields).filter(([key]) => !key.startsWith('_')));
-            }
-            const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
-            pathsToInvalidate.add(normalizedPath);
-            const pathIsDocument = normalizedPath.split("/").length % 2 === 0;
-            let curItemId = "";
-            if (pathIsDocument) {
-                curItemId = normalizedPath.split("/").pop() ? normalizedPath.split("/").pop() : "";
-            }
-            else {
-                curItemId = Math.random().toString(36).slice(2).substring(0, 12);
-            }
-            // if the path is a document, we need to append the document id to the path
-            const collectionPath = pathIsDocument ? normalizedPath.split("/").slice(0, -1).join("/") : normalizedPath;
-            pathsToInvalidate.add(collectionPath);
-            let destinationPath = collectionPath;
-            if (curItemId && curItemId.length > 0) {
-                destinationPath = `${destinationPath}/${curItemId}`;
-            }
-            documents.push({ destinationPath, document });
-        }
-        let setResponse;
+    var _a, _b, _c, _d, _e, _f;
+    // A server WalletClient threads its immutable config snapshot; the default
+    // path reads the mutable process-global init() config. This keeps the app-id
+    // bound into an on-chain 202 write (Solana/offchain) on the wallet
+    // client's original app after a later global init() (CTA-05).
+    const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();
+    const authProvider = (_d = (_c = options === null || options === void 0 ? void 0 : options._overrides) === null || _c === void 0 ? void 0 : _c.authProvider) !== null && _d !== void 0 ? _d : config.authProvider;
+    if (!authProvider) {
+        throw new Error('Auth provider not initialized');
+    }
+    const { documents, pathsToInvalidate } = normalizeWriteBatch(many);
+    // A grant lane's credential is single-use, so its write is built exactly once, and its signer
+    // is prepared the way it always was: inside the approval.
+    const grantLane = (_e = options === null || options === void 0 ? void 0 : options._overrides) === null || _e === void 0 ? void 0 : _e._grantLane;
+    if ((options === null || options === void 0 ? void 0 : options.onchain) && !grantLane) {
+        // The caller knows the wallet will sign: the signer is prepared before the first build, so a
+        // first-time emailed code never runs inside a transaction's lifetime and no build is wasted.
         try {
-            // SIMD-0385: tell the worker which Solana transaction formats this client
-            // can sign, so it builds v1 only for a client that can complete it.
-            const clientTransactionVersions = await resolveClientTransactionVersions(authProvider);
-            setResponse = await makeApiRequest('PUT', `items`, { documents, clientTransactionVersions }, options === null || options === void 0 ? void 0 : options._overrides);
+            await ((_f = authProvider.prepareToSign) === null || _f === void 0 ? void 0 : _f.call(authProvider));
         }
         catch (error) {
-            if ((error === null || error === void 0 ? void 0 : error.statusCode) === 402 && (error === null || error === void 0 ? void 0 : error.error) === 'INSUFFICIENT_BALANCE') {
-                const deficitLamports = Number((_e = error.deficitLamports) !== null && _e !== void 0 ? _e : 0);
-                const deficitSol = Number((_f = error.deficitSol) !== null && _f !== void 0 ? _f : deficitLamports / 1000000000);
-                throw markWriteNotApplied(new InsufficientBalanceError(String((_g = error.address) !== null && _g !== void 0 ? _g : ''), Number((_h = error.balanceLamports) !== null && _h !== void 0 ? _h : 0), Number((_j = error.estimatedCostLamports) !== null && _j !== void 0 ? _j : 0), deficitLamports, deficitSol), 'before_broadcast');
-            }
-            // The server answered and refused the write (a rule or invariant denial, a bad request, no
-            // session, a rate limit): nothing was built, signed or committed. A network failure, a 5xx,
-            // a 408 or a 499 may follow a commit the response never reported, so those stay untagged.
-            if (DEFINITIVE_WRITE_REFUSAL_STATUSES.has(Number(error === null || error === void 0 ? void 0 : error.statusCode))) {
-                throw markWriteNotApplied(error, 'before_broadcast');
-            }
-            throw error;
+            throw markWriteNotApplied(error, 'before_broadcast');
         }
+    }
+    // Each reason to build again is spent once: the wallet's own ceremony (the build it ran beside is
+    // dying), and a send refused because the blockhash expired (a long pause on the approve card).
+    const rebuilds = { ceremony: !grantLane, expiry: !grantLane };
+    for (;;) {
+        const setResponse = await requestWrite(documents, authProvider, options);
         // Invalidate caches and pending requests for affected paths
         pathsToInvalidate.forEach(path => {
             clearCacheByPrefix(path);
         });
-        if (setResponse.status === 202) {
-            // This means that the document needs to be set on-chain (or signed for offchain),
-            // the API did nothing and gave us the required info to run this transaction.
-            // Until something is sent, every failure below is definitively not applied.
-            let sending = false;
+        if (setResponse.status === 200)
+            return directCommitResult(setResponse, documents);
+        if (setResponse.status !== 202)
+            throw new Error(`Failed to set document: ${setResponse}`);
+        const outcome = await completePreparedWrite(setResponse, documents, config, authProvider, options, rebuilds);
+        if (!isRebuild(outcome))
+            return outcome;
+        rebuilds[outcome.rebuild] = false;
+    }
+}
+/** The caller's batch as the worker takes it, plus every read-cache prefix the write touches. */
+function normalizeWriteBatch(many) {
+    const documents = [];
+    const pathsToInvalidate = new Set();
+    for (const { path, document: documentWithReservedFields } of many) {
+        // for setting, we should remove any pieces of the document that start with '_' as they are internal and shouldn't be updated. The API would block it if it is one of the reserved ones
+        let document = documentWithReservedFields;
+        if (documentWithReservedFields) {
+            document = Object.fromEntries(Object.entries(documentWithReservedFields).filter(([key]) => !key.startsWith('_')));
+        }
+        const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
+        pathsToInvalidate.add(normalizedPath);
+        const pathIsDocument = normalizedPath.split("/").length % 2 === 0;
+        let curItemId = "";
+        if (pathIsDocument) {
+            curItemId = normalizedPath.split("/").pop() ? normalizedPath.split("/").pop() : "";
+        }
+        else {
+            curItemId = Math.random().toString(36).slice(2).substring(0, 12);
+        }
+        // if the path is a document, we need to append the document id to the path
+        const collectionPath = pathIsDocument ? normalizedPath.split("/").slice(0, -1).join("/") : normalizedPath;
+        pathsToInvalidate.add(collectionPath);
+        let destinationPath = collectionPath;
+        if (curItemId && curItemId.length > 0) {
+            destinationPath = `${destinationPath}/${curItemId}`;
+        }
+        documents.push({ destinationPath, document });
+    }
+    return { documents, pathsToInvalidate };
+}
+/** The write PUT: a direct commit (200), a transaction to sign (202), or a definitive refusal. */
+async function requestWrite(documents, authProvider, options) {
+    var _a, _b, _c, _d, _e;
+    try {
+        // SIMD-0385: tell the worker which Solana transaction formats this client
+        // can sign, so it builds v1 only for a client that can complete it.
+        const clientTransactionVersions = await resolveClientTransactionVersions(authProvider);
+        return await makeApiRequest('PUT', `items`, { documents, clientTransactionVersions }, options === null || options === void 0 ? void 0 : options._overrides);
+    }
+    catch (error) {
+        if ((error === null || error === void 0 ? void 0 : error.statusCode) === 402 && (error === null || error === void 0 ? void 0 : error.error) === 'INSUFFICIENT_BALANCE') {
+            const deficitLamports = Number((_a = error.deficitLamports) !== null && _a !== void 0 ? _a : 0);
+            const deficitSol = Number((_b = error.deficitSol) !== null && _b !== void 0 ? _b : deficitLamports / 1000000000);
+            throw markWriteNotApplied(new InsufficientBalanceError(String((_c = error.address) !== null && _c !== void 0 ? _c : ''), Number((_d = error.balanceLamports) !== null && _d !== void 0 ? _d : 0), Number((_e = error.estimatedCostLamports) !== null && _e !== void 0 ? _e : 0), deficitLamports, deficitSol), 'before_broadcast');
+        }
+        // The server answered and refused the write (a rule or invariant denial, a bad request, no
+        // session, a rate limit): nothing was built, signed or committed. A network failure, a 5xx,
+        // a 408 or a 499 may follow a commit the response never reported, so those stay untagged.
+        if (DEFINITIVE_WRITE_REFUSAL_STATUSES.has(Number(error === null || error === void 0 ? void 0 : error.statusCode))) {
+            throw markWriteNotApplied(error, 'before_broadcast');
+        }
+        throw error;
+    }
+}
+function isRebuild(outcome) {
+    return 'rebuild' in outcome;
+}
+/**
+ * Finish a 202: the worker built the transaction (or the poofnet approval) and did nothing
+ * else; the wallet signs it here and, on a real chain, it is broadcast. Until something is
+ * sent, every failure is definitively not applied. `rebuilds` says which reasons to build
+ * again are still open.
+ */
+async function completePreparedWrite(setResponse, documents, config, authProvider, options, rebuilds) {
+    var _a, _b, _c;
+    let sending = false;
+    try {
+        const { transactions, offchainTransaction } = setResponse.data;
+        // Handle offchain transaction flow (for 'offchain' protocol apps)
+        if (offchainTransaction && Array.isArray(transactions) && transactions.length > 0) {
+            throw new Error('Ambiguous write response mixes offchain and onchain transaction targets');
+        }
+        if (offchainTransaction) {
+            // Offchain signing is retired: no server mints this envelope any more
+            // (the realtime worker commits poofnet writes directly). Fail loudly
+            // rather than silently ignoring a payload the caller was asked to sign.
+            throw new Error('Unsupported 202 transaction shape: offchain signing is retired');
+        }
+        // Handle Solana on-chain transaction flow
+        if (!Array.isArray(transactions) || transactions.length !== 1) {
+            throw new Error(`Expected exactly one on-chain transaction, received ${Array.isArray(transactions) ? transactions.length : 0}`);
+        }
+        const curTx = transactions[0];
+        // The EVM onchain data plane is retired: no worker mints an EVM 202 any
+        // more. A payload that still carries one is an unexpected response and
+        // fails loudly BEFORE anything is signed - never silently ignored.
+        if ((curTx === null || curTx === void 0 ? void 0 : curTx.evmTransaction) != null) {
+            throw new Error('Unsupported 202 transaction shape: the write response carried an evmTransaction, ' +
+                'but EVM onchain writes are no longer supported. Nothing was signed or submitted.');
+        }
+        const hasSerializedSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.serializedTransaction) != null;
+        const hasBuiltSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.transactionArgs) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.remainingAccounts) != null ||
+            (curTx === null || curTx === void 0 ? void 0 : curTx.idl) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.txData) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.preInstructions) != null;
+        if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
+            throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
+        }
+        // All requested paths (writes AND deletes), in request order. Used for the
+        // post-confirm mirror read-back, which correlates every requested path.
+        // The pre-sign validation derives its own full expected intent from
+        // `documents` (see below) and needs nothing from this list.
+        const requestedPaths = documents.map(d => d.destinationPath);
+        const requestedDocuments = buildRequestedDocuments(documents);
+        const appId = config.appId;
+        // The lane comes verbatim from the worker, and is read BEFORE anything is
+        // signed or submitted: a missing tag fails closed while nothing has been
+        // broadcast, instead of stranding a landed transaction with no receipt.
+        const workerChain = readWorkerChainTag((_a = setResponse.data) === null || _a === void 0 ? void 0 : _a.receipt, setResponse.data, curTx);
+        if (!workerChain) {
+            throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
+                'Nothing was signed or submitted.');
+        }
+        const grantLane = (_b = options === null || options === void 0 ? void 0 : options._overrides) === null || _b === void 0 ? void 0 : _b._grantLane;
+        grantLane === null || grantLane === void 0 ? void 0 : grantLane.assertLane(workerChain);
+        // The wallet's own ceremony runs now, before it sees a transaction: a hosted embedded
+        // wallet whose 24-hour signing session has lapsed collects its emailed code here, and that
+        // outlives the blockhash the worker just minted. A ceremony that ran means this build is
+        // already dying, so the write is built again and the wallet signs the fresh one in one click.
+        // (A caller that passed `onchain` prepared the signer before the build, so this normally
+        // answers 'ready' at once. It runs the ceremony here only when that preparation could not
+        // reach the signer; the build it then replaces is left to expire unsigned.)
+        if (rebuilds.ceremony && await ((_c = authProvider.prepareToSign) === null || _c === void 0 ? void 0 : _c.call(authProvider)) === 'established')
+            return { rebuild: 'ceremony' };
+        if (workerChain === 'realtime_offchain') {
+            // Poofnet: the wallet signs the worker's unsendable approval message and
+            // the worker verifies and commits it. Nothing is submitted to any chain.
+            if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
+                throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
+            }
+            const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-cwcuTNyk.mjs');
+            const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
+            // Signing-only, exactly as on a real chain: signed and NOT committed.
+            if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+                return {
+                    status: 'signed', appId, requestedDocuments: buildRequestedDocuments(documents),
+                    chain: 'realtime_offchain', transactionId: null, signedTransaction,
+                    poofnetIntentId: curTx.poofnetIntentId,
+                };
+            }
+            // A grant lane's first credential is spent by the PUT that built this approval, so the
+            // commit's is minted now, before `sending`: failing to mint sends nothing.
+            const commitHeaders = await (grantLane === null || grantLane === void 0 ? void 0 : grantLane.commitHeaders());
+            // The commit PUT is the one ambiguous step of this lane: a lost response may follow a
+            // commit, so a transport failure or a 5xx stays untagged (read the path back). A 4xx is
+            // realtime stating it committed nothing (the intent expired or was taken, the signer did
+            // not match, a rule refused it), as for the first PUT. 408 and 499 are a proxy's words,
+            // not realtime's, and may follow a commit, so they stay ambiguous too.
+            sending = true;
+            let commitResponse;
             try {
-                const { transactions, offchainTransaction } = setResponse.data;
-                // Handle offchain transaction flow (for 'offchain' protocol apps)
-                if (offchainTransaction && Array.isArray(transactions) && transactions.length > 0) {
-                    throw new Error('Ambiguous write response mixes offchain and onchain transaction targets');
-                }
-                if (offchainTransaction) {
-                    // Offchain signing is retired: no server mints this envelope any more
-                    // (the realtime worker commits poofnet writes directly). Fail loudly
-                    // rather than silently ignoring a payload the caller was asked to sign.
-                    throw new Error('Unsupported 202 transaction shape: offchain signing is retired');
-                }
-                // Handle Solana on-chain transaction flow
-                if (!Array.isArray(transactions) || transactions.length !== 1) {
-                    throw new Error(`Expected exactly one on-chain transaction, received ${Array.isArray(transactions) ? transactions.length : 0}`);
-                }
-                const curTx = transactions[0];
-                // The EVM onchain data plane is retired: no worker mints an EVM 202 any
-                // more. A payload that still carries one is an unexpected response and
-                // fails loudly BEFORE anything is signed - never silently ignored.
-                if ((curTx === null || curTx === void 0 ? void 0 : curTx.evmTransaction) != null) {
-                    throw new Error('Unsupported 202 transaction shape: the write response carried an evmTransaction, ' +
-                        'but EVM onchain writes are no longer supported. Nothing was signed or submitted.');
-                }
-                const hasSerializedSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.serializedTransaction) != null;
-                const hasBuiltSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.transactionArgs) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.remainingAccounts) != null ||
-                    (curTx === null || curTx === void 0 ? void 0 : curTx.idl) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.txData) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.preInstructions) != null;
-                if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
-                    throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
-                }
-                // All requested paths (writes AND deletes), in request order. Used for the
-                // post-confirm mirror read-back, which correlates every requested path.
-                // The pre-sign validation derives its own full expected intent from
-                // `documents` (see below) and needs nothing from this list.
-                const requestedPaths = documents.map(d => d.destinationPath);
-                const requestedDocuments = buildRequestedDocuments(documents);
-                const appId = config.appId;
-                // The lane comes verbatim from the worker, and is read BEFORE anything is
-                // signed or submitted: a missing tag fails closed while nothing has been
-                // broadcast, instead of stranding a landed transaction with no receipt.
-                const workerChain = readWorkerChainTag((_k = setResponse.data) === null || _k === void 0 ? void 0 : _k.receipt, setResponse.data, curTx);
-                if (!workerChain) {
-                    throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
-                        'Nothing was signed or submitted.');
-                }
-                const grantLane = (_l = options === null || options === void 0 ? void 0 : options._overrides) === null || _l === void 0 ? void 0 : _l._grantLane;
-                grantLane === null || grantLane === void 0 ? void 0 : grantLane.assertLane(workerChain);
-                if (workerChain === 'realtime_offchain') {
-                    // Poofnet: the wallet signs the worker's unsendable approval message and
-                    // the worker verifies and commits it. Nothing is submitted to any chain.
-                    if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
-                        throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
-                    }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-5WjFwhnt.mjs');
-                    const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
-                    // Signing-only, exactly as on a real chain: signed and NOT committed.
-                    if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
-                        return {
-                            status: 'signed', appId, requestedDocuments: buildRequestedDocuments(documents),
-                            chain: 'realtime_offchain', transactionId: null, signedTransaction,
-                            poofnetIntentId: curTx.poofnetIntentId,
-                        };
-                    }
-                    // A grant lane's first credential is spent by the PUT that built this approval, so the
-                    // commit's is minted now, before `sending`: failing to mint sends nothing.
-                    const commitHeaders = await (grantLane === null || grantLane === void 0 ? void 0 : grantLane.commitHeaders());
-                    // The commit PUT is the one ambiguous step of this lane: a lost response may follow a
-                    // commit, so a transport failure or a 5xx stays untagged (read the path back). A 4xx is
-                    // realtime stating it committed nothing (the intent expired or was taken, the signer did
-                    // not match, a rule refused it), as for the first PUT. 408 and 499 are a proxy's words,
-                    // not realtime's, and may follow a commit, so they stay ambiguous too.
-                    sending = true;
-                    let commitResponse;
-                    try {
-                        commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, commitHeaders ? Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _getAuthHeaders: async () => commitHeaders }) : options === null || options === void 0 ? void 0 : options._overrides);
-                        if (commitResponse.status !== 200) {
-                            throw Object.assign(new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`), { statusCode: commitResponse.status });
-                        }
-                    }
-                    catch (error) {
-                        const status = Number(error === null || error === void 0 ? void 0 : error.statusCode);
-                        throw status >= 400 && status < 500 && status !== 408 && status !== 499 ? markWriteNotApplied(error, 'broadcast_rejected') : error;
-                    }
-                    return directCommitResult(commitResponse, documents);
-                }
-                if (curTx.serializedTransaction) {
-                    if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
-                        throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
-                            'Nothing was signed or submitted.');
-                    }
-                    const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-5WjFwhnt.mjs');
-                    // OA-0001: derive the expected intent from OUR OWN request (the one
-                    // ground truth a tampered builder response cannot change) so the
-                    // validator can reject any transaction whose operation semantics
-                    // diverge from it BEFORE the wallet is asked to sign.
-                    const expectedIntent = buildExpectedWriteIntent(documents);
-                    const onBroadcast = options === null || options === void 0 ? void 0 : options.onBroadcast;
-                    const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent, onBroadcast && (async (signed) => {
-                        await onBroadcast({
-                            status: 'submitted', appId, requestedDocuments, chain: solanaChain,
-                            transactionId: signed.transactionSignature,
-                            signedTransaction: signed.signedTransaction,
-                            fence: signed.fence,
-                            confirmation: { state: 'unknown', reason: 'about to broadcast' },
-                        });
-                    }));
-                    // Past this point the bytes may be on the network: nothing is tagged here.
-                    sending = true;
-                    // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
-                    // and there is nothing to mirror, so no synchronization is attempted.
-                    if (solanaOutcome.outcome === 'signed') {
-                        return {
-                            status: 'signed', appId, requestedDocuments, chain: solanaChain,
-                            transactionId: null,
-                            signedTransaction: solanaOutcome.signedTransaction,
-                            fence: solanaOutcome.fence,
-                        };
-                    }
-                    if (solanaOutcome.outcome === 'submitted') {
-                        return {
-                            status: 'submitted', appId, requestedDocuments, chain: solanaChain,
-                            transactionId: solanaOutcome.transactionSignature,
-                            signedTransaction: solanaOutcome.signedTransaction,
-                            fence: solanaOutcome.fence,
-                            confirmation: { state: 'unknown', reason: solanaOutcome.reason },
-                        };
-                    }
-                    // Confirmed: the receipt is already complete, so the mirror read is a
-                    // best-effort enrichment reported in `mirrorSync`, never a rejection.
-                    const mirrorSync = grantLane
-                        ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
-                        : await attemptMirrorSync(requestedPaths, Object.assign(Object.assign({}, options), { _overrides: Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _config: config }) }), solanaOutcome.transactionSignature);
-                    return {
-                        status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
-                        transactionId: solanaOutcome.transactionSignature,
-                        signedTransaction: solanaOutcome.signedTransaction,
-                        fence: solanaOutcome.fence,
-                        confirmationContextSlot: solanaOutcome.confirmationContextSlot,
-                        mirrorSync,
-                    };
-                }
-                else {
-                    throw new Error('Unsupported 202 transaction shape: expected serializedTransaction');
+                commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, commitHeaders ? Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _getAuthHeaders: async () => commitHeaders }) : options === null || options === void 0 ? void 0 : options._overrides);
+                if (commitResponse.status !== 200) {
+                    throw Object.assign(new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`), { statusCode: commitResponse.status });
                 }
             }
             catch (error) {
-                // The Solana lane tags its own broadcast and on-chain failures; anything
-                // untagged from it, and every poofnet step before the commit PUT, failed
-                // before a single byte was sent.
-                throw sending ? error : markWriteNotApplied(error, 'before_broadcast');
+                const status = Number(error === null || error === void 0 ? void 0 : error.statusCode);
+                throw status >= 400 && status < 500 && status !== 408 && status !== 499 ? markWriteNotApplied(error, 'broadcast_rejected') : error;
             }
+            return directCommitResult(commitResponse, documents);
         }
-        else if (setResponse.status === 200) {
-            return directCommitResult(setResponse, documents);
+        if (curTx.serializedTransaction) {
+            if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
+                throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
+                    'Nothing was signed or submitted.');
+            }
+            const solanaChain = workerChain;
+            const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-cwcuTNyk.mjs');
+            // OA-0001: derive the expected intent from OUR OWN request (the one
+            // ground truth a tampered builder response cannot change) so the
+            // validator can reject any transaction whose operation semantics
+            // diverge from it BEFORE the wallet is asked to sign.
+            const expectedIntent = buildExpectedWriteIntent(documents);
+            const onBroadcast = options === null || options === void 0 ? void 0 : options.onBroadcast;
+            const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent, onBroadcast && (async (signed) => {
+                await onBroadcast({
+                    status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: signed.transactionSignature,
+                    signedTransaction: signed.signedTransaction,
+                    fence: signed.fence,
+                    confirmation: { state: 'unknown', reason: 'about to broadcast' },
+                });
+            }));
+            // Past this point the bytes may be on the network: nothing is tagged here.
+            sending = true;
+            // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
+            // and there is nothing to mirror, so no synchronization is attempted.
+            if (solanaOutcome.outcome === 'signed') {
+                return {
+                    status: 'signed', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: null,
+                    signedTransaction: solanaOutcome.signedTransaction,
+                    fence: solanaOutcome.fence,
+                };
+            }
+            if (solanaOutcome.outcome === 'submitted') {
+                return {
+                    status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: solanaOutcome.transactionSignature,
+                    signedTransaction: solanaOutcome.signedTransaction,
+                    fence: solanaOutcome.fence,
+                    confirmation: { state: 'unknown', reason: solanaOutcome.reason },
+                };
+            }
+            // Confirmed: the receipt is already complete, so the mirror read is a
+            // best-effort enrichment reported in `mirrorSync`, never a rejection.
+            const mirrorSync = grantLane
+                ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
+                : await attemptMirrorSync(requestedPaths, Object.assign(Object.assign({}, options), { _overrides: Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _config: config }) }), solanaOutcome.transactionSignature);
+            return {
+                status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
+                transactionId: solanaOutcome.transactionSignature,
+                signedTransaction: solanaOutcome.signedTransaction,
+                fence: solanaOutcome.fence,
+                confirmationContextSlot: solanaOutcome.confirmationContextSlot,
+                mirrorSync,
+            };
         }
         else {
-            throw new Error(`Failed to set document: ${setResponse}`);
+            throw new Error('Unsupported 202 transaction shape: expected serializedTransaction');
         }
     }
     catch (error) {
-        throw error;
+        // The blockhash died before the send: the RPC refused the bytes in preflight, so nothing
+        // entered the network. The worker builds a fresh one and the wallet signs it again.
+        if (rebuilds.expiry && (await import('./solana-operations-cwcuTNyk.mjs')).isExpiredBlockhashRejection(error))
+            return { rebuild: 'expiry' };
+        // The Solana lane tags its own broadcast and on-chain failures; anything
+        // untagged from it, and every poofnet step before the commit PUT, failed
+        // before a single byte was sent.
+        throw sending ? error : markWriteNotApplied(error, 'before_broadcast');
     }
 }
 /**
@@ -9460,6 +9503,23 @@ async function signTransaction(transaction) {
     }
     return config.authProvider.signTransaction(transaction);
 }
+/**
+ * Make the signed-in wallet ready to sign without delay, BEFORE the transaction it will sign
+ * exists. A hosted embedded wallet whose 24-hour signing session has lapsed collects its emailed
+ * code here; a transaction built before that code is dead by the time it is signed, because a
+ * blockhash lives about 33 seconds on mainnet (late 2026) and the code takes longer. `set` and
+ * `setMany` do this themselves before a wallet signature; call it directly before a flow that
+ * builds and signs outside them, such as a permit approval. Resolves `'established'` when a
+ * ceremony ran, else `'ready'`; a wallet that holds its own key always answers `'ready'`.
+ */
+async function prepareToSign() {
+    var _a, _b, _c;
+    const config = await getConfig();
+    if (!config.authProvider) {
+        throw new Error('Auth provider not initialized. Please call init() first.');
+    }
+    return (_c = (await ((_b = (_a = config.authProvider).prepareToSign) === null || _b === void 0 ? void 0 : _b.call(_a)))) !== null && _c !== void 0 ? _c : 'ready';
+}
 async function signAndSubmitTransaction(transaction, feePayer) {
     const config = await getConfig();
     if (!config.authProvider) {
@@ -9480,6 +9540,7 @@ var operations = /*#__PURE__*/Object.freeze({
     getFiles: getFiles,
     getMany: getMany,
     onReadCacheAuthChange: onReadCacheAuthChange,
+    prepareToSign: prepareToSign,
     queryAggregate: queryAggregate,
     runExpression: runExpression,
     runExpressionMany: runExpressionMany,
@@ -9494,9 +9555,81 @@ var operations = /*#__PURE__*/Object.freeze({
     signTransaction: signTransaction
 });
 
+const DEFAULT_POLL_INTERVAL_MS$1 = 1000;
+const DEFAULT_MAX_WAIT_MS = 120000;
+/**
+ * Whether a status is final enough to decide on. `processed` can still belong to a fork
+ * that is dropped, so only `confirmed` or `finalized` settle a write; an RPC that omits
+ * `confirmationStatus` reports a rooted transaction as `confirmations: null`.
+ */
+function settledSignatureStatus(status) {
+    if (!status)
+        return false;
+    if (status.confirmationStatus === 'confirmed' || status.confirmationStatus === 'finalized')
+        return true;
+    return status.confirmationStatus == null && status.confirmations === null;
+}
+/**
+ * Poll the SAME signature until it is seen at `confirmed` or the blockhash fence closes.
+ * Never broadcasts. A `processed` status, even one carrying an error, is not a verdict and
+ * keeps the loop going. Once the confirmed block height passes `lastValidBlockHeight`, one
+ * history-searching read decides whether the transaction landed anyway; if not, the answer
+ * is "not seen" or "seen only below confirmed", never "never landed": only a finalized
+ * expiry proves that, which is `reconcileSetResult`'s job. Transient RPC failures retry the
+ * same signature.
+ */
+async function confirmSignature(rpc, fence, options = {}) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    if (typeof rpc.getSignatureStatuses !== 'function' || typeof rpc.getBlockHeight !== 'function') {
+        // An injected RPC that cannot answer is reported at once, not retried for two minutes.
+        return { landed: false, reason: 'the configured Solana RPC cannot report signature statuses and block height' };
+    }
+    const pollIntervalMs = (_a = options.pollIntervalMs) !== null && _a !== void 0 ? _a : DEFAULT_POLL_INTERVAL_MS$1;
+    const maxWaitMs = (_b = options.maxWaitMs) !== null && _b !== void 0 ? _b : DEFAULT_MAX_WAIT_MS;
+    const startedAt = Date.now();
+    let lastFailure = null;
+    for (;;) {
+        try {
+            // Status first: a settled status decides on its own, and the height is read only
+            // while the transaction is still unseen, so a failing height read never discards
+            // a confirmation this tick already has.
+            const statuses = await rpc.getSignatureStatuses([fence.signature]);
+            const status = (_d = (_c = statuses === null || statuses === void 0 ? void 0 : statuses.value) === null || _c === void 0 ? void 0 : _c[0]) !== null && _d !== void 0 ? _d : null;
+            if (settledSignatureStatus(status))
+                return { landed: true, status, contextSlot: (_e = statuses === null || statuses === void 0 ? void 0 : statuses.context) === null || _e === void 0 ? void 0 : _e.slot };
+            const blockHeight = await rpc.getBlockHeight('confirmed');
+            if (blockHeight > fence.lastValidBlockHeight) {
+                const history = await rpc.getSignatureStatuses([fence.signature], { searchTransactionHistory: true });
+                const late = (_g = (_f = history === null || history === void 0 ? void 0 : history.value) === null || _f === void 0 ? void 0 : _f[0]) !== null && _g !== void 0 ? _g : null;
+                if (settledSignatureStatus(late))
+                    return { landed: true, status: late, contextSlot: (_h = history === null || history === void 0 ? void 0 : history.context) === null || _h === void 0 ? void 0 : _h.slot };
+                const seen = late ? `seen only at ${String((_j = late.confirmationStatus) !== null && _j !== void 0 ? _j : 'an unconfirmed')} commitment` : 'not seen at confirmed';
+                return {
+                    landed: false,
+                    reason: `${seen} before the blockhash expired (block height ${blockHeight} is past ${fence.lastValidBlockHeight})`,
+                };
+            }
+            lastFailure = null;
+        }
+        catch (error) {
+            // Transient: keep polling the same signature. The ceiling below bounds a dead RPC.
+            lastFailure = error instanceof Error ? error.message : String(error);
+        }
+        if (Date.now() - startedAt >= maxWaitMs) {
+            return {
+                landed: false,
+                reason: lastFailure
+                    ? `the RPC kept failing while the transaction was awaited: ${lastFailure}`
+                    : `not seen at confirmed within ${Math.round(maxWaitMs / 1000)}s and the block height never passed the blockhash fence`,
+            };
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+}
+
 const DEFAULT_TIMEOUT_MS = 60000;
-const DEFAULT_MAX_ATTEMPTS$1 = 20;
-const DEFAULT_POLL_INTERVAL_MS = 3000;
+const DEFAULT_MAX_ATTEMPTS$1 = 60;
+const DEFAULT_POLL_INTERVAL_MS = 1000;
 function errorText(error) {
     const message = error === null || error === void 0 ? void 0 : error.message;
     return typeof message === 'string' && message.length > 0 ? message : String(error);
@@ -9564,18 +9697,6 @@ async function resolveSolanaRpc(config, options) {
     const { Connection } = await import('@solana/web3.js');
     return new Connection(rpcUrl, 'confirmed');
 }
-/**
- * Whether a signature status is final enough to decide on. `processed` can still belong to a fork
- * that is dropped, so only `confirmed` or `finalized` settle a write; an RPC that omits
- * `confirmationStatus` reports a rooted transaction as `confirmations: null`.
- */
-function settledStatus(status) {
-    if (!status)
-        return false;
-    if (status.confirmationStatus === 'confirmed' || status.confirmationStatus === 'finalized')
-        return true;
-    return status.confirmationStatus == null && status.confirmations === null;
-}
 /**
  * Solana reconciliation NEVER broadcasts. It settles on a `confirmed` or `finalized` status only,
  * and reaches `expired_not_landed` only from the chain's own blockhash expiry: the FINALIZED block
@@ -9587,17 +9708,13 @@ function settledStatus(status) {
 async function reconcileSolana(receipt, config, options) {
     var _a, _b, _c, _d;
     const rpc = await resolveSolanaRpc(config, options);
-    if (typeof rpc.getSignatureStatuses !== 'function') {
-        return stillSubmitted(receipt, 'the configured Solana RPC cannot report signature statuses');
-    }
     // Expiry is read BEFORE the status, so an absence observed afterwards is an absence after the
     // fence closed for good. A finalized height past lastValidBlockHeight is final: the blockhash
     // can never become valid again.
     let finalizedHeight;
     let finalizedSlot;
     try {
-        if (typeof rpc.getBlockHeight === 'function')
-            finalizedHeight = await rpc.getBlockHeight('finalized');
+        finalizedHeight = await rpc.getBlockHeight('finalized');
         if (typeof rpc.getSlot === 'function')
             finalizedSlot = await rpc.getSlot('finalized');
     }
@@ -9616,7 +9733,7 @@ async function reconcileSolana(receipt, config, options) {
         return stillSubmitted(receipt, `signature status lookup failed: ${errorText(error)}`);
     }
     if (statusValue) {
-        if (!settledStatus(statusValue)) {
+        if (!settledSignatureStatus(statusValue)) {
             return stillSubmitted(receipt, `seen at ${String((_d = statusValue.confirmationStatus) !== null && _d !== void 0 ? _d : 'an unconfirmed')} commitment; waiting for confirmed`);
         }
         // Landed. A landed-but-failed transaction is a genuine failure, not `submitted`.
@@ -10986,7 +11103,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-CEjXjnaG.mjs');
+    const implementation = await import('./solana-message-DqKp-y53.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11535,5 +11652,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { dispatchRateLimitEvent as $, waitForSetResult as A, isWriteNotApplied as B, writeNotAppliedPhase as C, subscribe as D, closeAllSubscriptions as E, clearCache as F, getCachedData as G, reconnectWithNewAuth as H, InsufficientBalanceError as I, createClient as J, exchangeAppToken as K, clearAppTokenCache as L, createAppTokenAuthHeaders as M, AppTokenExchangeError as N, setWithVenueGrant as O, resolveVenueRpcUrl as P, subscribeQuery as Q, closeAllQuerySubscriptions as R, ScopedClientReadOnlyError as S, canonicalizeArgs as T, canonicalizeResult as U, DEFAULT_QUERY_POLL_INTERVAL_MS as V, MIN_QUERY_POLL_INTERVAL_MS as W, BoundedDeclineError as X, deriveDecline as Y, dispatchDeclineEvent as Z, DECLINE_EVENT_NAME as _, markWriteNotApplied as a, RATE_LIMIT_EVENT_NAME as a0, hasActiveConnection as a1, increment as a2, serverTimestamp as a3, now as a4, toSeconds as a5, toMillis as a6, getIdToken as a7, deriveUserIdentityFromIdToken as a8, getSessionGeneration as a9, genSiweMessage as aA, normalizeEvmAddress as aB, toLowerEvmAddress as aC, functions as aD, invoke as aE, FunctionInvokeError as aF, live as aG, intent as aH, status as aI, subscribeView as aJ, LiveIntentError as aK, withEffects as aL, isEffectResult as aM, defineLiveModule as aN, EFFECT_INTENT_ADDRESS as aO, WebSessionManager as aa, ReactNativeSessionManager as ab, getActiveSessionManager as ac, onSessionCleared as ad, announceSessionChange as ae, onSessionChange as af, SESSION_SIGNAL_CHANNEL as ag, SessionEnvironmentError as ah, UNSUPPORTED_ENVIRONMENT_CODE as ai, AUTH_CHANGED_CODE as aj, AUTH_EXPIRED_CODE as ak, isAuthExpiredError as al, getFreshAuthToken as am, ServerSessionManager as an, createSessionWithSignature as ao, refreshSession as ap, revokeSession as aq, signSessionCreateMessage as ar, genAuthNonce as as, genSolanaMessage as at, createSolanaSignInRequest as au, createSolanaSignInMessageText as av, genSolanaSignInRequest as aw, genSolanaSignInMessage as ax, browserSignInDomain as ay, SOLANA_SIGN_IN_STATEMENT as az, bufferExports as b, getWebhookKeysUrl as c, getConfiguredAppId as d, get as e, getMany as f, getConfig as g, docId as h, init as i, setMany as j, setFile as k, getFiles as l, makeApiRequest as m, search as n, runQueryMany as o, runExpression as p, queryAggregate as q, runQuery as r, set as s, runExpressionMany as t, signMessage as u, signTransaction as v, signAndSubmitTransaction as w, count as x, aggregate as y, reconcileSetResult as z };
-//# sourceMappingURL=index-C6ZW5Gt2.mjs.map
+export { dispatchDeclineEvent as $, aggregate as A, reconcileSetResult as B, waitForSetResult as C, isWriteNotApplied as D, writeNotAppliedPhase as E, subscribe as F, closeAllSubscriptions as G, clearCache as H, InsufficientBalanceError as I, getCachedData as J, reconnectWithNewAuth as K, createClient as L, exchangeAppToken as M, clearAppTokenCache as N, createAppTokenAuthHeaders as O, AppTokenExchangeError as P, setWithVenueGrant as Q, resolveVenueRpcUrl as R, ScopedClientReadOnlyError as S, subscribeQuery as T, closeAllQuerySubscriptions as U, canonicalizeArgs as V, canonicalizeResult as W, DEFAULT_QUERY_POLL_INTERVAL_MS as X, MIN_QUERY_POLL_INTERVAL_MS as Y, BoundedDeclineError as Z, deriveDecline as _, markWriteNotApplied as a, DECLINE_EVENT_NAME as a0, dispatchRateLimitEvent as a1, RATE_LIMIT_EVENT_NAME as a2, hasActiveConnection as a3, increment as a4, serverTimestamp as a5, now as a6, toSeconds as a7, toMillis as a8, getIdToken as a9, browserSignInDomain as aA, SOLANA_SIGN_IN_STATEMENT as aB, genSiweMessage as aC, normalizeEvmAddress as aD, toLowerEvmAddress as aE, functions as aF, invoke as aG, FunctionInvokeError as aH, live as aI, intent as aJ, status as aK, subscribeView as aL, LiveIntentError as aM, withEffects as aN, isEffectResult as aO, defineLiveModule as aP, EFFECT_INTENT_ADDRESS as aQ, deriveUserIdentityFromIdToken as aa, getSessionGeneration as ab, WebSessionManager as ac, ReactNativeSessionManager as ad, getActiveSessionManager as ae, onSessionCleared as af, announceSessionChange as ag, onSessionChange as ah, SESSION_SIGNAL_CHANNEL as ai, SessionEnvironmentError as aj, UNSUPPORTED_ENVIRONMENT_CODE as ak, AUTH_CHANGED_CODE as al, AUTH_EXPIRED_CODE as am, isAuthExpiredError as an, getFreshAuthToken as ao, ServerSessionManager as ap, createSessionWithSignature as aq, refreshSession as ar, revokeSession as as, signSessionCreateMessage as at, genAuthNonce as au, genSolanaMessage as av, createSolanaSignInRequest as aw, createSolanaSignInMessageText as ax, genSolanaSignInRequest as ay, genSolanaSignInMessage as az, bufferExports as b, confirmSignature as c, getWebhookKeysUrl as d, getConfiguredAppId as e, get as f, getConfig as g, getMany as h, init as i, docId as j, setMany as k, setFile as l, makeApiRequest as m, getFiles as n, search as o, runQueryMany as p, queryAggregate as q, runQuery as r, set as s, runExpression as t, runExpressionMany as u, signMessage as v, signTransaction as w, signAndSubmitTransaction as x, prepareToSign as y, count as z };
+//# sourceMappingURL=index-D93TEYGf.mjs.map