@bounded-sh/core 0.0.118 → 0.0.119

package/dist/{index-BXfRRAUZ.mjs → index-D93TEYGf.mjs}

@@ -4305,7 +4305,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await import('./solana-message-CjI0h27k.mjs');
+        const { genSolanaMessage } = await import('./solana-message-DqKp-y53.mjs');
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -7677,7 +7677,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-BreUReSo.mjs');
+        const { reconnectRealtimeStoreWithNewAuth } = await import('./realtime-store-FObAdw-J.mjs');
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8896,7 +8896,7 @@ function buildRequestedDocuments(documents) {
 /** Best-effort readback, including a failure to load its lazy implementation. */
 async function attemptMirrorSync(paths, options, transactionSignature) {
     try {
-        const mirror = await import('./mirror-sync-DoH9ewTo.mjs');
+        const mirror = await import('./mirror-sync-DPMtQC3A.mjs');
         return await mirror.attemptMirrorSync(paths, options, transactionSignature);
     }
     catch (error) {
@@ -8994,237 +8994,280 @@ async function set(path, document, options) {
  * state appears only under `observation`/`mirrorSync` once actually observed.
  */
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
-    // Returns the data that was set, or undefined if the document was already set.
-    try {
-        // A server WalletClient threads its immutable config snapshot; the default
-        // path reads the mutable process-global init() config. This keeps the app-id
-        // bound into an on-chain 202 write (Solana/offchain) on the wallet
-        // client's original app after a later global init() (CTA-05).
-        const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();
-        const authProvider = (_d = (_c = options === null || options === void 0 ? void 0 : options._overrides) === null || _c === void 0 ? void 0 : _c.authProvider) !== null && _d !== void 0 ? _d : config.authProvider;
-        if (!authProvider) {
-            throw new Error('Auth provider not initialized');
-        }
-        let documents = [];
-        const pathsToInvalidate = new Set();
-        for (const { path, document: documentWithReservedFields } of many) {
-            // for setting, we should remove any pieces of the document that start with '_' as they are internal and shouldn't be updated. The API would block it if it is one of the reserved ones
-            let document = documentWithReservedFields;
-            if (documentWithReservedFields) {
-                document = Object.fromEntries(Object.entries(documentWithReservedFields).filter(([key]) => !key.startsWith('_')));
-            }
-            const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
-            pathsToInvalidate.add(normalizedPath);
-            const pathIsDocument = normalizedPath.split("/").length % 2 === 0;
-            let curItemId = "";
-            if (pathIsDocument) {
-                curItemId = normalizedPath.split("/").pop() ? normalizedPath.split("/").pop() : "";
-            }
-            else {
-                curItemId = Math.random().toString(36).slice(2).substring(0, 12);
-            }
-            // if the path is a document, we need to append the document id to the path
-            const collectionPath = pathIsDocument ? normalizedPath.split("/").slice(0, -1).join("/") : normalizedPath;
-            pathsToInvalidate.add(collectionPath);
-            let destinationPath = collectionPath;
-            if (curItemId && curItemId.length > 0) {
-                destinationPath = `${destinationPath}/${curItemId}`;
-            }
-            documents.push({ destinationPath, document });
-        }
-        let setResponse;
+    var _a, _b, _c, _d, _e, _f;
+    // A server WalletClient threads its immutable config snapshot; the default
+    // path reads the mutable process-global init() config. This keeps the app-id
+    // bound into an on-chain 202 write (Solana/offchain) on the wallet
+    // client's original app after a later global init() (CTA-05).
+    const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();
+    const authProvider = (_d = (_c = options === null || options === void 0 ? void 0 : options._overrides) === null || _c === void 0 ? void 0 : _c.authProvider) !== null && _d !== void 0 ? _d : config.authProvider;
+    if (!authProvider) {
+        throw new Error('Auth provider not initialized');
+    }
+    const { documents, pathsToInvalidate } = normalizeWriteBatch(many);
+    // A grant lane's credential is single-use, so its write is built exactly once, and its signer
+    // is prepared the way it always was: inside the approval.
+    const grantLane = (_e = options === null || options === void 0 ? void 0 : options._overrides) === null || _e === void 0 ? void 0 : _e._grantLane;
+    if ((options === null || options === void 0 ? void 0 : options.onchain) && !grantLane) {
+        // The caller knows the wallet will sign: the signer is prepared before the first build, so a
+        // first-time emailed code never runs inside a transaction's lifetime and no build is wasted.
         try {
-            // SIMD-0385: tell the worker which Solana transaction formats this client
-            // can sign, so it builds v1 only for a client that can complete it.
-            const clientTransactionVersions = await resolveClientTransactionVersions(authProvider);
-            setResponse = await makeApiRequest('PUT', `items`, { documents, clientTransactionVersions }, options === null || options === void 0 ? void 0 : options._overrides);
+            await ((_f = authProvider.prepareToSign) === null || _f === void 0 ? void 0 : _f.call(authProvider));
         }
         catch (error) {
-            if ((error === null || error === void 0 ? void 0 : error.statusCode) === 402 && (error === null || error === void 0 ? void 0 : error.error) === 'INSUFFICIENT_BALANCE') {
-                const deficitLamports = Number((_e = error.deficitLamports) !== null && _e !== void 0 ? _e : 0);
-                const deficitSol = Number((_f = error.deficitSol) !== null && _f !== void 0 ? _f : deficitLamports / 1000000000);
-                throw markWriteNotApplied(new InsufficientBalanceError(String((_g = error.address) !== null && _g !== void 0 ? _g : ''), Number((_h = error.balanceLamports) !== null && _h !== void 0 ? _h : 0), Number((_j = error.estimatedCostLamports) !== null && _j !== void 0 ? _j : 0), deficitLamports, deficitSol), 'before_broadcast');
-            }
-            // The server answered and refused the write (a rule or invariant denial, a bad request, no
-            // session, a rate limit): nothing was built, signed or committed. A network failure, a 5xx,
-            // a 408 or a 499 may follow a commit the response never reported, so those stay untagged.
-            if (DEFINITIVE_WRITE_REFUSAL_STATUSES.has(Number(error === null || error === void 0 ? void 0 : error.statusCode))) {
-                throw markWriteNotApplied(error, 'before_broadcast');
-            }
-            throw error;
+            throw markWriteNotApplied(error, 'before_broadcast');
         }
+    }
+    // Each reason to build again is spent once: the wallet's own ceremony (the build it ran beside is
+    // dying), and a send refused because the blockhash expired (a long pause on the approve card).
+    const rebuilds = { ceremony: !grantLane, expiry: !grantLane };
+    for (;;) {
+        const setResponse = await requestWrite(documents, authProvider, options);
         // Invalidate caches and pending requests for affected paths
         pathsToInvalidate.forEach(path => {
             clearCacheByPrefix(path);
         });
-        if (setResponse.status === 202) {
-            // This means that the document needs to be set on-chain (or signed for offchain),
-            // the API did nothing and gave us the required info to run this transaction.
-            // Until something is sent, every failure below is definitively not applied.
-            let sending = false;
+        if (setResponse.status === 200)
+            return directCommitResult(setResponse, documents);
+        if (setResponse.status !== 202)
+            throw new Error(`Failed to set document: ${setResponse}`);
+        const outcome = await completePreparedWrite(setResponse, documents, config, authProvider, options, rebuilds);
+        if (!isRebuild(outcome))
+            return outcome;
+        rebuilds[outcome.rebuild] = false;
+    }
+}
+/** The caller's batch as the worker takes it, plus every read-cache prefix the write touches. */
+function normalizeWriteBatch(many) {
+    const documents = [];
+    const pathsToInvalidate = new Set();
+    for (const { path, document: documentWithReservedFields } of many) {
+        // for setting, we should remove any pieces of the document that start with '_' as they are internal and shouldn't be updated. The API would block it if it is one of the reserved ones
+        let document = documentWithReservedFields;
+        if (documentWithReservedFields) {
+            document = Object.fromEntries(Object.entries(documentWithReservedFields).filter(([key]) => !key.startsWith('_')));
+        }
+        const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
+        pathsToInvalidate.add(normalizedPath);
+        const pathIsDocument = normalizedPath.split("/").length % 2 === 0;
+        let curItemId = "";
+        if (pathIsDocument) {
+            curItemId = normalizedPath.split("/").pop() ? normalizedPath.split("/").pop() : "";
+        }
+        else {
+            curItemId = Math.random().toString(36).slice(2).substring(0, 12);
+        }
+        // if the path is a document, we need to append the document id to the path
+        const collectionPath = pathIsDocument ? normalizedPath.split("/").slice(0, -1).join("/") : normalizedPath;
+        pathsToInvalidate.add(collectionPath);
+        let destinationPath = collectionPath;
+        if (curItemId && curItemId.length > 0) {
+            destinationPath = `${destinationPath}/${curItemId}`;
+        }
+        documents.push({ destinationPath, document });
+    }
+    return { documents, pathsToInvalidate };
+}
+/** The write PUT: a direct commit (200), a transaction to sign (202), or a definitive refusal. */
+async function requestWrite(documents, authProvider, options) {
+    var _a, _b, _c, _d, _e;
+    try {
+        // SIMD-0385: tell the worker which Solana transaction formats this client
+        // can sign, so it builds v1 only for a client that can complete it.
+        const clientTransactionVersions = await resolveClientTransactionVersions(authProvider);
+        return await makeApiRequest('PUT', `items`, { documents, clientTransactionVersions }, options === null || options === void 0 ? void 0 : options._overrides);
+    }
+    catch (error) {
+        if ((error === null || error === void 0 ? void 0 : error.statusCode) === 402 && (error === null || error === void 0 ? void 0 : error.error) === 'INSUFFICIENT_BALANCE') {
+            const deficitLamports = Number((_a = error.deficitLamports) !== null && _a !== void 0 ? _a : 0);
+            const deficitSol = Number((_b = error.deficitSol) !== null && _b !== void 0 ? _b : deficitLamports / 1000000000);
+            throw markWriteNotApplied(new InsufficientBalanceError(String((_c = error.address) !== null && _c !== void 0 ? _c : ''), Number((_d = error.balanceLamports) !== null && _d !== void 0 ? _d : 0), Number((_e = error.estimatedCostLamports) !== null && _e !== void 0 ? _e : 0), deficitLamports, deficitSol), 'before_broadcast');
+        }
+        // The server answered and refused the write (a rule or invariant denial, a bad request, no
+        // session, a rate limit): nothing was built, signed or committed. A network failure, a 5xx,
+        // a 408 or a 499 may follow a commit the response never reported, so those stay untagged.
+        if (DEFINITIVE_WRITE_REFUSAL_STATUSES.has(Number(error === null || error === void 0 ? void 0 : error.statusCode))) {
+            throw markWriteNotApplied(error, 'before_broadcast');
+        }
+        throw error;
+    }
+}
+function isRebuild(outcome) {
+    return 'rebuild' in outcome;
+}
+/**
+ * Finish a 202: the worker built the transaction (or the poofnet approval) and did nothing
+ * else; the wallet signs it here and, on a real chain, it is broadcast. Until something is
+ * sent, every failure is definitively not applied. `rebuilds` says which reasons to build
+ * again are still open.
+ */
+async function completePreparedWrite(setResponse, documents, config, authProvider, options, rebuilds) {
+    var _a, _b, _c;
+    let sending = false;
+    try {
+        const { transactions, offchainTransaction } = setResponse.data;
+        // Handle offchain transaction flow (for 'offchain' protocol apps)
+        if (offchainTransaction && Array.isArray(transactions) && transactions.length > 0) {
+            throw new Error('Ambiguous write response mixes offchain and onchain transaction targets');
+        }
+        if (offchainTransaction) {
+            // Offchain signing is retired: no server mints this envelope any more
+            // (the realtime worker commits poofnet writes directly). Fail loudly
+            // rather than silently ignoring a payload the caller was asked to sign.
+            throw new Error('Unsupported 202 transaction shape: offchain signing is retired');
+        }
+        // Handle Solana on-chain transaction flow
+        if (!Array.isArray(transactions) || transactions.length !== 1) {
+            throw new Error(`Expected exactly one on-chain transaction, received ${Array.isArray(transactions) ? transactions.length : 0}`);
+        }
+        const curTx = transactions[0];
+        // The EVM onchain data plane is retired: no worker mints an EVM 202 any
+        // more. A payload that still carries one is an unexpected response and
+        // fails loudly BEFORE anything is signed - never silently ignored.
+        if ((curTx === null || curTx === void 0 ? void 0 : curTx.evmTransaction) != null) {
+            throw new Error('Unsupported 202 transaction shape: the write response carried an evmTransaction, ' +
+                'but EVM onchain writes are no longer supported. Nothing was signed or submitted.');
+        }
+        const hasSerializedSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.serializedTransaction) != null;
+        const hasBuiltSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.transactionArgs) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.remainingAccounts) != null ||
+            (curTx === null || curTx === void 0 ? void 0 : curTx.idl) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.txData) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.preInstructions) != null;
+        if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
+            throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
+        }
+        // All requested paths (writes AND deletes), in request order. Used for the
+        // post-confirm mirror read-back, which correlates every requested path.
+        // The pre-sign validation derives its own full expected intent from
+        // `documents` (see below) and needs nothing from this list.
+        const requestedPaths = documents.map(d => d.destinationPath);
+        const requestedDocuments = buildRequestedDocuments(documents);
+        const appId = config.appId;
+        // The lane comes verbatim from the worker, and is read BEFORE anything is
+        // signed or submitted: a missing tag fails closed while nothing has been
+        // broadcast, instead of stranding a landed transaction with no receipt.
+        const workerChain = readWorkerChainTag((_a = setResponse.data) === null || _a === void 0 ? void 0 : _a.receipt, setResponse.data, curTx);
+        if (!workerChain) {
+            throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
+                'Nothing was signed or submitted.');
+        }
+        const grantLane = (_b = options === null || options === void 0 ? void 0 : options._overrides) === null || _b === void 0 ? void 0 : _b._grantLane;
+        grantLane === null || grantLane === void 0 ? void 0 : grantLane.assertLane(workerChain);
+        // The wallet's own ceremony runs now, before it sees a transaction: a hosted embedded
+        // wallet whose 24-hour signing session has lapsed collects its emailed code here, and that
+        // outlives the blockhash the worker just minted. A ceremony that ran means this build is
+        // already dying, so the write is built again and the wallet signs the fresh one in one click.
+        // (A caller that passed `onchain` prepared the signer before the build, so this normally
+        // answers 'ready' at once. It runs the ceremony here only when that preparation could not
+        // reach the signer; the build it then replaces is left to expire unsigned.)
+        if (rebuilds.ceremony && await ((_c = authProvider.prepareToSign) === null || _c === void 0 ? void 0 : _c.call(authProvider)) === 'established')
+            return { rebuild: 'ceremony' };
+        if (workerChain === 'realtime_offchain') {
+            // Poofnet: the wallet signs the worker's unsendable approval message and
+            // the worker verifies and commits it. Nothing is submitted to any chain.
+            if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
+                throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
+            }
+            const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-cwcuTNyk.mjs');
+            const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
+            // Signing-only, exactly as on a real chain: signed and NOT committed.
+            if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+                return {
+                    status: 'signed', appId, requestedDocuments: buildRequestedDocuments(documents),
+                    chain: 'realtime_offchain', transactionId: null, signedTransaction,
+                    poofnetIntentId: curTx.poofnetIntentId,
+                };
+            }
+            // A grant lane's first credential is spent by the PUT that built this approval, so the
+            // commit's is minted now, before `sending`: failing to mint sends nothing.
+            const commitHeaders = await (grantLane === null || grantLane === void 0 ? void 0 : grantLane.commitHeaders());
+            // The commit PUT is the one ambiguous step of this lane: a lost response may follow a
+            // commit, so a transport failure or a 5xx stays untagged (read the path back). A 4xx is
+            // realtime stating it committed nothing (the intent expired or was taken, the signer did
+            // not match, a rule refused it), as for the first PUT. 408 and 499 are a proxy's words,
+            // not realtime's, and may follow a commit, so they stay ambiguous too.
+            sending = true;
+            let commitResponse;
             try {
-                const { transactions, offchainTransaction } = setResponse.data;
-                // Handle offchain transaction flow (for 'offchain' protocol apps)
-                if (offchainTransaction && Array.isArray(transactions) && transactions.length > 0) {
-                    throw new Error('Ambiguous write response mixes offchain and onchain transaction targets');
-                }
-                if (offchainTransaction) {
-                    // Offchain signing is retired: no server mints this envelope any more
-                    // (the realtime worker commits poofnet writes directly). Fail loudly
-                    // rather than silently ignoring a payload the caller was asked to sign.
-                    throw new Error('Unsupported 202 transaction shape: offchain signing is retired');
-                }
-                // Handle Solana on-chain transaction flow
-                if (!Array.isArray(transactions) || transactions.length !== 1) {
-                    throw new Error(`Expected exactly one on-chain transaction, received ${Array.isArray(transactions) ? transactions.length : 0}`);
-                }
-                const curTx = transactions[0];
-                // The EVM onchain data plane is retired: no worker mints an EVM 202 any
-                // more. A payload that still carries one is an unexpected response and
-                // fails loudly BEFORE anything is signed - never silently ignored.
-                if ((curTx === null || curTx === void 0 ? void 0 : curTx.evmTransaction) != null) {
-                    throw new Error('Unsupported 202 transaction shape: the write response carried an evmTransaction, ' +
-                        'but EVM onchain writes are no longer supported. Nothing was signed or submitted.');
-                }
-                const hasSerializedSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.serializedTransaction) != null;
-                const hasBuiltSolanaTarget = (curTx === null || curTx === void 0 ? void 0 : curTx.transactionArgs) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.remainingAccounts) != null ||
-                    (curTx === null || curTx === void 0 ? void 0 : curTx.idl) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.txData) != null || (curTx === null || curTx === void 0 ? void 0 : curTx.preInstructions) != null;
-                if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
-                    throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
-                }
-                // All requested paths (writes AND deletes), in request order. Used for the
-                // post-confirm mirror read-back, which correlates every requested path.
-                // The pre-sign validation derives its own full expected intent from
-                // `documents` (see below) and needs nothing from this list.
-                const requestedPaths = documents.map(d => d.destinationPath);
-                const requestedDocuments = buildRequestedDocuments(documents);
-                const appId = config.appId;
-                // The lane comes verbatim from the worker, and is read BEFORE anything is
-                // signed or submitted: a missing tag fails closed while nothing has been
-                // broadcast, instead of stranding a landed transaction with no receipt.
-                const workerChain = readWorkerChainTag((_k = setResponse.data) === null || _k === void 0 ? void 0 : _k.receipt, setResponse.data, curTx);
-                if (!workerChain) {
-                    throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
-                        'Nothing was signed or submitted.');
-                }
-                const grantLane = (_l = options === null || options === void 0 ? void 0 : options._overrides) === null || _l === void 0 ? void 0 : _l._grantLane;
-                grantLane === null || grantLane === void 0 ? void 0 : grantLane.assertLane(workerChain);
-                if (workerChain === 'realtime_offchain') {
-                    // Poofnet: the wallet signs the worker's unsendable approval message and
-                    // the worker verifies and commits it. Nothing is submitted to any chain.
-                    if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
-                        throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
-                    }
-                    const { signPoofnetTransaction, buildExpectedWriteIntent } = await import('./solana-operations-CD6pks4-.mjs');
-                    const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
-                    // Signing-only, exactly as on a real chain: signed and NOT committed.
-                    if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
-                        return {
-                            status: 'signed', appId, requestedDocuments: buildRequestedDocuments(documents),
-                            chain: 'realtime_offchain', transactionId: null, signedTransaction,
-                            poofnetIntentId: curTx.poofnetIntentId,
-                        };
-                    }
-                    // A grant lane's first credential is spent by the PUT that built this approval, so the
-                    // commit's is minted now, before `sending`: failing to mint sends nothing.
-                    const commitHeaders = await (grantLane === null || grantLane === void 0 ? void 0 : grantLane.commitHeaders());
-                    // The commit PUT is the one ambiguous step of this lane: a lost response may follow a
-                    // commit, so a transport failure or a 5xx stays untagged (read the path back). A 4xx is
-                    // realtime stating it committed nothing (the intent expired or was taken, the signer did
-                    // not match, a rule refused it), as for the first PUT. 408 and 499 are a proxy's words,
-                    // not realtime's, and may follow a commit, so they stay ambiguous too.
-                    sending = true;
-                    let commitResponse;
-                    try {
-                        commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, commitHeaders ? Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _getAuthHeaders: async () => commitHeaders }) : options === null || options === void 0 ? void 0 : options._overrides);
-                        if (commitResponse.status !== 200) {
-                            throw Object.assign(new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`), { statusCode: commitResponse.status });
-                        }
-                    }
-                    catch (error) {
-                        const status = Number(error === null || error === void 0 ? void 0 : error.statusCode);
-                        throw status >= 400 && status < 500 && status !== 408 && status !== 499 ? markWriteNotApplied(error, 'broadcast_rejected') : error;
-                    }
-                    return directCommitResult(commitResponse, documents);
-                }
-                if (curTx.serializedTransaction) {
-                    if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
-                        throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
-                            'Nothing was signed or submitted.');
-                    }
-                    const solanaChain = workerChain;
-                    const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-CD6pks4-.mjs');
-                    // OA-0001: derive the expected intent from OUR OWN request (the one
-                    // ground truth a tampered builder response cannot change) so the
-                    // validator can reject any transaction whose operation semantics
-                    // diverge from it BEFORE the wallet is asked to sign.
-                    const expectedIntent = buildExpectedWriteIntent(documents);
-                    const onBroadcast = options === null || options === void 0 ? void 0 : options.onBroadcast;
-                    const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent, onBroadcast && (async (signed) => {
-                        await onBroadcast({
-                            status: 'submitted', appId, requestedDocuments, chain: solanaChain,
-                            transactionId: signed.transactionSignature,
-                            signedTransaction: signed.signedTransaction,
-                            fence: signed.fence,
-                            confirmation: { state: 'unknown', reason: 'about to broadcast' },
-                        });
-                    }));
-                    // Past this point the bytes may be on the network: nothing is tagged here.
-                    sending = true;
-                    // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
-                    // and there is nothing to mirror, so no synchronization is attempted.
-                    if (solanaOutcome.outcome === 'signed') {
-                        return {
-                            status: 'signed', appId, requestedDocuments, chain: solanaChain,
-                            transactionId: null,
-                            signedTransaction: solanaOutcome.signedTransaction,
-                            fence: solanaOutcome.fence,
-                        };
-                    }
-                    if (solanaOutcome.outcome === 'submitted') {
-                        return {
-                            status: 'submitted', appId, requestedDocuments, chain: solanaChain,
-                            transactionId: solanaOutcome.transactionSignature,
-                            signedTransaction: solanaOutcome.signedTransaction,
-                            fence: solanaOutcome.fence,
-                            confirmation: { state: 'unknown', reason: solanaOutcome.reason },
-                        };
-                    }
-                    // Confirmed: the receipt is already complete, so the mirror read is a
-                    // best-effort enrichment reported in `mirrorSync`, never a rejection.
-                    const mirrorSync = grantLane
-                        ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
-                        : await attemptMirrorSync(requestedPaths, Object.assign(Object.assign({}, options), { _overrides: Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _config: config }) }), solanaOutcome.transactionSignature);
-                    return {
-                        status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
-                        transactionId: solanaOutcome.transactionSignature,
-                        signedTransaction: solanaOutcome.signedTransaction,
-                        fence: solanaOutcome.fence,
-                        confirmationContextSlot: solanaOutcome.confirmationContextSlot,
-                        mirrorSync,
-                    };
-                }
-                else {
-                    throw new Error('Unsupported 202 transaction shape: expected serializedTransaction');
+                commitResponse = await makeApiRequest('PUT', 'items/signed', { intentId: curTx.poofnetIntentId, signedTransaction }, commitHeaders ? Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _getAuthHeaders: async () => commitHeaders }) : options === null || options === void 0 ? void 0 : options._overrides);
+                if (commitResponse.status !== 200) {
+                    throw Object.assign(new Error(`Poofnet signed write was not committed (status ${commitResponse.status})`), { statusCode: commitResponse.status });
                 }
             }
             catch (error) {
-                // The Solana lane tags its own broadcast and on-chain failures; anything
-                // untagged from it, and every poofnet step before the commit PUT, failed
-                // before a single byte was sent.
-                throw sending ? error : markWriteNotApplied(error, 'before_broadcast');
+                const status = Number(error === null || error === void 0 ? void 0 : error.statusCode);
+                throw status >= 400 && status < 500 && status !== 408 && status !== 499 ? markWriteNotApplied(error, 'broadcast_rejected') : error;
             }
+            return directCommitResult(commitResponse, documents);
         }
-        else if (setResponse.status === 200) {
-            return directCommitResult(setResponse, documents);
+        if (curTx.serializedTransaction) {
+            if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
+                throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
+                    'Nothing was signed or submitted.');
+            }
+            const solanaChain = workerChain;
+            const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await import('./solana-operations-cwcuTNyk.mjs');
+            // OA-0001: derive the expected intent from OUR OWN request (the one
+            // ground truth a tampered builder response cannot change) so the
+            // validator can reject any transaction whose operation semantics
+            // diverge from it BEFORE the wallet is asked to sign.
+            const expectedIntent = buildExpectedWriteIntent(documents);
+            const onBroadcast = options === null || options === void 0 ? void 0 : options.onBroadcast;
+            const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent, onBroadcast && (async (signed) => {
+                await onBroadcast({
+                    status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: signed.transactionSignature,
+                    signedTransaction: signed.signedTransaction,
+                    fence: signed.fence,
+                    confirmation: { state: 'unknown', reason: 'about to broadcast' },
+                });
+            }));
+            // Past this point the bytes may be on the network: nothing is tagged here.
+            sending = true;
+            // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
+            // and there is nothing to mirror, so no synchronization is attempted.
+            if (solanaOutcome.outcome === 'signed') {
+                return {
+                    status: 'signed', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: null,
+                    signedTransaction: solanaOutcome.signedTransaction,
+                    fence: solanaOutcome.fence,
+                };
+            }
+            if (solanaOutcome.outcome === 'submitted') {
+                return {
+                    status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: solanaOutcome.transactionSignature,
+                    signedTransaction: solanaOutcome.signedTransaction,
+                    fence: solanaOutcome.fence,
+                    confirmation: { state: 'unknown', reason: solanaOutcome.reason },
+                };
+            }
+            // Confirmed: the receipt is already complete, so the mirror read is a
+            // best-effort enrichment reported in `mirrorSync`, never a rejection.
+            const mirrorSync = grantLane
+                ? { observed: false, reason: 'not attempted: a venue grant authorizes only the write' }
+                : await attemptMirrorSync(requestedPaths, Object.assign(Object.assign({}, options), { _overrides: Object.assign(Object.assign({}, options === null || options === void 0 ? void 0 : options._overrides), { _config: config }) }), solanaOutcome.transactionSignature);
+            return {
+                status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
+                transactionId: solanaOutcome.transactionSignature,
+                signedTransaction: solanaOutcome.signedTransaction,
+                fence: solanaOutcome.fence,
+                confirmationContextSlot: solanaOutcome.confirmationContextSlot,
+                mirrorSync,
+            };
         }
         else {
-            throw new Error(`Failed to set document: ${setResponse}`);
+            throw new Error('Unsupported 202 transaction shape: expected serializedTransaction');
         }
     }
     catch (error) {
-        throw error;
+        // The blockhash died before the send: the RPC refused the bytes in preflight, so nothing
+        // entered the network. The worker builds a fresh one and the wallet signs it again.
+        if (rebuilds.expiry && (await import('./solana-operations-cwcuTNyk.mjs')).isExpiredBlockhashRejection(error))
+            return { rebuild: 'expiry' };
+        // The Solana lane tags its own broadcast and on-chain failures; anything
+        // untagged from it, and every poofnet step before the commit PUT, failed
+        // before a single byte was sent.
+        throw sending ? error : markWriteNotApplied(error, 'before_broadcast');
     }
 }
 /**
@@ -9460,6 +9503,23 @@ async function signTransaction(transaction) {
     }
     return config.authProvider.signTransaction(transaction);
 }
+/**
+ * Make the signed-in wallet ready to sign without delay, BEFORE the transaction it will sign
+ * exists. A hosted embedded wallet whose 24-hour signing session has lapsed collects its emailed
+ * code here; a transaction built before that code is dead by the time it is signed, because a
+ * blockhash lives about 33 seconds on mainnet (late 2026) and the code takes longer. `set` and
+ * `setMany` do this themselves before a wallet signature; call it directly before a flow that
+ * builds and signs outside them, such as a permit approval. Resolves `'established'` when a
+ * ceremony ran, else `'ready'`; a wallet that holds its own key always answers `'ready'`.
+ */
+async function prepareToSign() {
+    var _a, _b, _c;
+    const config = await getConfig();
+    if (!config.authProvider) {
+        throw new Error('Auth provider not initialized. Please call init() first.');
+    }
+    return (_c = (await ((_b = (_a = config.authProvider).prepareToSign) === null || _b === void 0 ? void 0 : _b.call(_a)))) !== null && _c !== void 0 ? _c : 'ready';
+}
 async function signAndSubmitTransaction(transaction, feePayer) {
     const config = await getConfig();
     if (!config.authProvider) {
@@ -9480,6 +9540,7 @@ var operations = /*#__PURE__*/Object.freeze({
     getFiles: getFiles,
     getMany: getMany,
     onReadCacheAuthChange: onReadCacheAuthChange,
+    prepareToSign: prepareToSign,
     queryAggregate: queryAggregate,
     runExpression: runExpression,
     runExpressionMany: runExpressionMany,
@@ -11042,7 +11103,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await import('./solana-message-CjI0h27k.mjs');
+    const implementation = await import('./solana-message-DqKp-y53.mjs');
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11591,5 +11652,5 @@ function defineLiveModule(mod) {
     return mod;
 }
 
-export { DECLINE_EVENT_NAME as $, reconcileSetResult as A, waitForSetResult as B, isWriteNotApplied as C, writeNotAppliedPhase as D, subscribe as E, closeAllSubscriptions as F, clearCache as G, getCachedData as H, InsufficientBalanceError as I, reconnectWithNewAuth as J, createClient as K, exchangeAppToken as L, clearAppTokenCache as M, createAppTokenAuthHeaders as N, AppTokenExchangeError as O, setWithVenueGrant as P, resolveVenueRpcUrl as Q, subscribeQuery as R, ScopedClientReadOnlyError as S, closeAllQuerySubscriptions as T, canonicalizeArgs as U, canonicalizeResult as V, DEFAULT_QUERY_POLL_INTERVAL_MS as W, MIN_QUERY_POLL_INTERVAL_MS as X, BoundedDeclineError as Y, deriveDecline as Z, dispatchDeclineEvent as _, markWriteNotApplied as a, dispatchRateLimitEvent as a0, RATE_LIMIT_EVENT_NAME as a1, hasActiveConnection as a2, increment as a3, serverTimestamp as a4, now as a5, toSeconds as a6, toMillis as a7, getIdToken as a8, deriveUserIdentityFromIdToken as a9, SOLANA_SIGN_IN_STATEMENT as aA, genSiweMessage as aB, normalizeEvmAddress as aC, toLowerEvmAddress as aD, functions as aE, invoke as aF, FunctionInvokeError as aG, live as aH, intent as aI, status as aJ, subscribeView as aK, LiveIntentError as aL, withEffects as aM, isEffectResult as aN, defineLiveModule as aO, EFFECT_INTENT_ADDRESS as aP, getSessionGeneration as aa, WebSessionManager as ab, ReactNativeSessionManager as ac, getActiveSessionManager as ad, onSessionCleared as ae, announceSessionChange as af, onSessionChange as ag, SESSION_SIGNAL_CHANNEL as ah, SessionEnvironmentError as ai, UNSUPPORTED_ENVIRONMENT_CODE as aj, AUTH_CHANGED_CODE as ak, AUTH_EXPIRED_CODE as al, isAuthExpiredError as am, getFreshAuthToken as an, ServerSessionManager as ao, createSessionWithSignature as ap, refreshSession as aq, revokeSession as ar, signSessionCreateMessage as as, genAuthNonce as at, genSolanaMessage as au, createSolanaSignInRequest as av, createSolanaSignInMessageText as aw, genSolanaSignInRequest as ax, genSolanaSignInMessage as ay, browserSignInDomain as az, bufferExports as b, confirmSignature as c, getWebhookKeysUrl as d, getConfiguredAppId as e, get as f, getConfig as g, getMany as h, init as i, docId as j, setMany as k, setFile as l, makeApiRequest as m, getFiles as n, search as o, runQueryMany as p, queryAggregate as q, runQuery as r, set as s, runExpression as t, runExpressionMany as u, signMessage as v, signTransaction as w, signAndSubmitTransaction as x, count as y, aggregate as z };
-//# sourceMappingURL=index-BXfRRAUZ.mjs.map
+export { dispatchDeclineEvent as $, aggregate as A, reconcileSetResult as B, waitForSetResult as C, isWriteNotApplied as D, writeNotAppliedPhase as E, subscribe as F, closeAllSubscriptions as G, clearCache as H, InsufficientBalanceError as I, getCachedData as J, reconnectWithNewAuth as K, createClient as L, exchangeAppToken as M, clearAppTokenCache as N, createAppTokenAuthHeaders as O, AppTokenExchangeError as P, setWithVenueGrant as Q, resolveVenueRpcUrl as R, ScopedClientReadOnlyError as S, subscribeQuery as T, closeAllQuerySubscriptions as U, canonicalizeArgs as V, canonicalizeResult as W, DEFAULT_QUERY_POLL_INTERVAL_MS as X, MIN_QUERY_POLL_INTERVAL_MS as Y, BoundedDeclineError as Z, deriveDecline as _, markWriteNotApplied as a, DECLINE_EVENT_NAME as a0, dispatchRateLimitEvent as a1, RATE_LIMIT_EVENT_NAME as a2, hasActiveConnection as a3, increment as a4, serverTimestamp as a5, now as a6, toSeconds as a7, toMillis as a8, getIdToken as a9, browserSignInDomain as aA, SOLANA_SIGN_IN_STATEMENT as aB, genSiweMessage as aC, normalizeEvmAddress as aD, toLowerEvmAddress as aE, functions as aF, invoke as aG, FunctionInvokeError as aH, live as aI, intent as aJ, status as aK, subscribeView as aL, LiveIntentError as aM, withEffects as aN, isEffectResult as aO, defineLiveModule as aP, EFFECT_INTENT_ADDRESS as aQ, deriveUserIdentityFromIdToken as aa, getSessionGeneration as ab, WebSessionManager as ac, ReactNativeSessionManager as ad, getActiveSessionManager as ae, onSessionCleared as af, announceSessionChange as ag, onSessionChange as ah, SESSION_SIGNAL_CHANNEL as ai, SessionEnvironmentError as aj, UNSUPPORTED_ENVIRONMENT_CODE as ak, AUTH_CHANGED_CODE as al, AUTH_EXPIRED_CODE as am, isAuthExpiredError as an, getFreshAuthToken as ao, ServerSessionManager as ap, createSessionWithSignature as aq, refreshSession as ar, revokeSession as as, signSessionCreateMessage as at, genAuthNonce as au, genSolanaMessage as av, createSolanaSignInRequest as aw, createSolanaSignInMessageText as ax, genSolanaSignInRequest as ay, genSolanaSignInMessage as az, bufferExports as b, confirmSignature as c, getWebhookKeysUrl as d, getConfiguredAppId as e, get as f, getConfig as g, getMany as h, init as i, docId as j, setMany as k, setFile as l, makeApiRequest as m, getFiles as n, search as o, runQueryMany as p, queryAggregate as q, runQuery as r, set as s, runExpression as t, runExpressionMany as u, signMessage as v, signTransaction as w, signAndSubmitTransaction as x, prepareToSign as y, count as z };
+//# sourceMappingURL=index-D93TEYGf.mjs.map