@bounded-sh/core 0.0.63 → 0.0.65

package/dist/solana-message-VZBGvV0S.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"solana-message-VZBGvV0S.mjs","sources":["../.rollup-tmp/utils/sol/solana-message.js"],"sourcesContent":["import { getConfig } from \"../../client/config\";\n// NOTE: this message text must stay BYTE-IDENTICAL to what the wallet-auth\n// verifier reconstructs — any drift breaks every SIWS login.\nexport async function genSolanaMessage(address, nonce, appIdOverride) {\n    var _a, _b;\n    /*  Domain / origin aren't available server-side – fall back to envs\n        or simple placeholders.  */\n    const domain = (typeof process !== 'undefined' && ((_a = process.env) === null || _a === void 0 ? void 0 : _a.SESSION_DOMAIN)) || \"server\";\n    const origin = (typeof process !== 'undefined' && ((_b = process.env) === null || _b === void 0 ? void 0 : _b.SESSION_ORIGIN)) || \"server\";\n    // SECURITY (audit-4 CRITICAL-1): bind the signed prompt to the target app.\n    // A server wallet client passes its snapshotted appId (appIdOverride) so the\n    // signed \"App ID\" stays bound to the app the wallet client was created against\n    // even after a later global init() (CTA-05); the default path reads the SAME\n    // global config that genAuthNonce + /session use, so the signed \"App ID\" is\n    // guaranteed to equal the app the session is minted for; the server verifier\n    // rejects any mismatch.\n    const appId = appIdOverride !== null && appIdOverride !== void 0 ? appIdOverride : (await getConfig()).appId;\n    const statement = \"Sign this message to authenticate with our application.\";\n    const currentDate = new Date();\n    const issuedAt = currentDate.toISOString();\n    const expirationTime = new Date(currentDate.getTime() + 5 * 60 * 1000).toISOString();\n    return `${statement}\\n\\n` +\n        `Wallet address:\\n${address}\\n\\n` +\n        `App ID: ${appId}\\n` +\n        `Domain: ${domain}\\n` +\n        `Origin: ${origin}\\n` +\n        `Nonce: ${nonce}\\n` +\n        `Issued At: ${issuedAt}\\n` +\n        `Expiration Time: ${expirationTime}`;\n}\n"],"names":[],"mappings":";;;;;AACA;AACA;AACO,eAAe,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE;AACtE,IAAI,IAAI,EAAE,EAAE,EAAE;AACd;AACA;AACA,IAAI,MAAM,MAAM,GAAG,CAAC,OAAO,OAAO,KAAK,WAAW,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ;AAC9I,IAAI,MAAM,MAAM,GAAG,CAAC,OAAO,OAAO,KAAK,WAAW,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ;AAC9I;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,KAAK,GAAG,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,MAAM,GAAG,aAAa,GAAG,CAAC,MAAM,SAAS,EAAE,EAAE,KAAK;AAChH,IAAI,MAAM,SAAS,GAAG,yDAAyD;AAC/E,IAAI,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE;AAClC,IAAI,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE;AAC9C,IAAI,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;AACxF,IAAI,OAAO,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC;AAC7B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC;AACzC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;AAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AAC3B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;AAClC,QAAQ,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAC5C;;;;"}

package/dist/{solana-operations-B2Oy9T7D.mjs → solana-operations-BlCYbdiN.mjs}

@@ -1,8 +1,7 @@
-import { g as getConfig, b as bufferExports } from './index-BQ6e4MeP.mjs';
+import { g as getConfig, b as bufferExports } from './index-BNOU00XY.mjs';
 import 'axios';
 import 'tweetnacl';
 import 'reconnecting-websocket';
-import 'bn.js';
 
 const BOUNDED_PROGRAM_MAINNET = ['open', 'Tv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F'].join('');
 const BOUNDED_PROGRAM_DEVNET = ['open', 'Tv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F'].join('');
@@ -152,80 +151,17 @@ function deserializeAndValidateServerTransaction(serializedTransaction, Versione
     assertSamePathSet(label, expectedWritePaths, actualWritePaths);
     return transaction;
 }
-function isHexString(value) {
-    if (typeof value !== 'string')
-        return false;
-    const testValue = value.startsWith('-') ? value.slice(1) : value;
-    return /^(0x)?[0-9a-fA-F]+$/.test(testValue);
-}
-async function handleSolanaTransaction(tx, authProvider, options, expectedWritePaths) {
-    var _a, _b, _c, _d, _e;
-    const chainSdk = await import('@solana/web3.js');
-    const { PublicKey, SystemProgram, TransactionInstruction, VersionedTransaction } = chainSdk;
-    const solTransactionData = {
-        remainingAccounts: tx.remainingAccounts,
-        setDocumentData: tx.transactionArgs.setDocumentData,
-        deletePaths: tx.transactionArgs.deletePaths,
-        idl: tx.idl,
-        txData: (_b = (_a = tx.txData) === null || _a === void 0 ? void 0 : _a.map((txData) => ({
-            pluginFunctionKey: txData.pluginFunctionKey,
-            txData: bufferExports.Buffer.from(txData.txData),
-            raIndices: (() => {
-                const raw = txData.raIndices;
-                if (raw == null)
-                    return bufferExports.Buffer.alloc(0);
-                if (bufferExports.Buffer.isBuffer(raw))
-                    return raw;
-                if (raw instanceof Uint8Array)
-                    return bufferExports.Buffer.from(raw);
-                const arrayLike = Array.isArray(raw) ? raw :
-                    raw && typeof raw === 'object' && Array.isArray(raw.data) ? raw.data :
-                        (() => { throw new Error(`raIndices has unexpected shape: ${typeof raw}`); })();
-                return bufferExports.Buffer.from(arrayLike.map((raIndex) => {
-                    const value = isHexString(raIndex) ? parseInt(raIndex, 16) : Number(raIndex);
-                    if (!Number.isInteger(value) || value < 0 || value > 255) {
-                        throw new Error(`raIndex ${raIndex} is not a valid u8 (must be integer in 0..255)`);
-                    }
-                    return value;
-                }));
-            })(),
-        }))) !== null && _b !== void 0 ? _b : [],
-    };
-    const config = await getConfig();
-    if (tx.signedTransaction) {
-        deserializeAndValidateServerTransaction(tx.signedTransaction, VersionedTransaction, {
-            label: 'Server signedTransaction', expectedAppId: config.appId, expectedWritePaths,
-        });
-    }
-    const solTransaction = {
-        appId: config.appId,
-        txArgs: [solTransactionData],
-        lutKey: (_c = tx.lutAddress) !== null && _c !== void 0 ? _c : null,
-        additionalLutAddresses: tx.additionalLutAddresses,
-        network: tx.network,
-        preInstructions: (_e = (_d = tx.preInstructions) === null || _d === void 0 ? void 0 : _d.map((ix, index) => {
-            var _a;
-            const keys = (_a = ix.keys) === null || _a === void 0 ? void 0 : _a.map((key) => ({ pubkey: new PublicKey(key.pubkey), isSigner: key.isSigner, isWritable: key.isWritable }));
-            const programId = ix.programId === SYSTEM_PROGRAM_ID ? SystemProgram.programId : new PublicKey(ix.programId);
-            const instruction = new TransactionInstruction({ keys, programId, data: bufferExports.Buffer.from(ix.data) });
-            if (instruction.programId.equals(SystemProgram.programId)) {
-                throw new Error(`Server preInstruction[${index}] contains unauthorized System Program preInstruction`);
-            }
-            return instruction;
-        })) !== null && _e !== void 0 ? _e : [],
-        signedTransaction: tx.signedTransaction,
-    };
-    return authProvider.runTransaction(undefined, solTransaction, options);
-}
 async function handlePreBuiltTransaction(tx, authProvider, options, expectedWritePaths) {
-    var _a, _b, _c, _d, _e;
+    var _a, _b, _c, _d, _e, _f, _g;
     const { Connection, VersionedTransaction } = await import('@solana/web3.js');
-    const config = await getConfig();
+    // Honor a wallet client's immutable config snapshot for the expected app-id
+    // binding and RPC endpoint (CTA-05); otherwise read the global init() config.
+    const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();
     const transaction = deserializeAndValidateServerTransaction(tx.serializedTransaction, VersionedTransaction, {
         label: 'Pre-built transaction', expectedAppId: config.appId, expectedWritePaths,
     });
     const shouldSubmit = (options === null || options === void 0 ? void 0 : options.shouldSubmitTx) !== false;
-    const rpcUrl = (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+    const rpcUrl = (_c = config.rpcUrl) === null || _c === void 0 ? void 0 : _c.trim();
     if (shouldSubmit && !rpcUrl)
         throw new Error(`Pre-built Solana transaction submission requires init({ rpcUrl }) for ${tx.network}`);
     const signedTx = await authProvider.signTransaction(transaction);
@@ -241,22 +177,22 @@ async function handlePreBuiltTransaction(tx, authProvider, options, expectedWrit
     // #310: "confirmed" only means the network recorded the transaction, not that it
     // succeeded - a landed-but-failed transaction carries an err. Report it as a failure
     // (with on-chain logs) instead of a fake success, mirroring the server keypair provider.
-    if ((_b = confirmation.value) === null || _b === void 0 ? void 0 : _b.err) {
+    if ((_d = confirmation.value) === null || _d === void 0 ? void 0 : _d.err) {
         const txInfo = await connection.getTransaction(signature, {
             maxSupportedTransactionVersion: 0,
             commitment: 'confirmed',
         });
-        const logMessages = (_c = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _c === void 0 ? void 0 : _c.logMessages;
+        const logMessages = (_e = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _e === void 0 ? void 0 : _e.logMessages;
         const errorMessage = logMessages ? JSON.stringify(logMessages) : JSON.stringify(confirmation.value.err);
         throw new Error(`Transaction failed: ${errorMessage}`);
     }
     return {
         transactionSignature: signature,
         signedTransaction: bufferExports.Buffer.from(rawTx).toString('base64'),
-        blockNumber: (_e = (_d = confirmation.context) === null || _d === void 0 ? void 0 : _d.slot) !== null && _e !== void 0 ? _e : 0,
+        blockNumber: (_g = (_f = confirmation.context) === null || _f === void 0 ? void 0 : _f.slot) !== null && _g !== void 0 ? _g : 0,
         gasUsed: '0',
     };
 }
 
-export { handlePreBuiltTransaction, handleSolanaTransaction };
-//# sourceMappingURL=solana-operations-B2Oy9T7D.mjs.map
+export { handlePreBuiltTransaction };
+//# sourceMappingURL=solana-operations-BlCYbdiN.mjs.map

package/dist/solana-operations-BlCYbdiN.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"solana-operations-BlCYbdiN.mjs","sources":["../.rollup-tmp/client/solana-operations.js"],"sourcesContent":["import { Buffer } from 'buffer';\nimport { getConfig } from './config';\nconst BOUNDED_PROGRAM_MAINNET = ['open', 'Tv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F'].join('');\nconst BOUNDED_PROGRAM_DEVNET = ['open', 'Tv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F'].join('');\nconst COMPUTE_BUDGET_PROGRAM = 'ComputeBudget111111111111111111111111111111';\nconst SYSTEM_PROGRAM_ID = '11111111111111111111111111111111';\nconst ALLOWED_SERVER_TX_PROGRAMS = new Set([\n    BOUNDED_PROGRAM_MAINNET,\n    BOUNDED_PROGRAM_DEVNET,\n    COMPUTE_BUDGET_PROGRAM,\n    SYSTEM_PROGRAM_ID,\n]);\n// Canonical set_documents discriminator (single wire format: ra_indices Vec<u8>).\nconst SET_DOCUMENTS_DISCRIMINATOR = '79,46,72,73,24,79,66,245';\nconst ALLOWED_BOUNDED_SET_DISCRIMINATORS = new Set([\n    SET_DOCUMENTS_DISCRIMINATOR,\n]);\nclass BorshCursor {\n    constructor(data, offset, label) {\n        this.data = data;\n        this.offset = offset;\n        this.label = label;\n    }\n    requireBytes(length, field) {\n        if (this.offset + length > this.data.length) {\n            throw new Error(`${this.label} has malformed Bounded instruction data while reading ${field}`);\n        }\n    }\n    readU8(field) { this.requireBytes(1, field); return this.data[this.offset++]; }\n    readU32(field) {\n        this.requireBytes(4, field);\n        const value = this.data[this.offset] | (this.data[this.offset + 1] << 8) |\n            (this.data[this.offset + 2] << 16) | (this.data[this.offset + 3] << 24);\n        this.offset += 4;\n        return value >>> 0;\n    }\n    skip(length, field) { this.requireBytes(length, field); this.offset += length; }\n    readString(field) {\n        const length = this.readU32(`${field} length`);\n        this.requireBytes(length, field);\n        const raw = this.data.slice(this.offset, this.offset + length);\n        this.offset += length;\n        return Buffer.from(raw).toString('utf8');\n    }\n    skipBytes(field) { this.skip(this.readU32(`${field} length`), field); }\n    isAtEnd() { return this.offset === this.data.length; }\n}\nfunction skipBoundedFieldValue(cursor) {\n    const option = cursor.readU8('operation value option');\n    if (option === 0)\n        return;\n    if (option !== 1)\n        throw new Error('Server transaction has malformed Bounded field value option');\n    const variant = cursor.readU8('operation value variant');\n    if (variant === 0 || variant === 1)\n        cursor.skip(8, 'operation numeric value');\n    else if (variant === 2)\n        cursor.skip(1, 'operation bool value');\n    else if (variant === 3)\n        cursor.readString('operation string value');\n    else if (variant === 4)\n        cursor.skip(32, 'operation address value');\n    else\n        throw new Error(`Server transaction has unsupported Bounded field value variant: ${variant}`);\n}\nfunction normalizeOnchainPath(path) {\n    let normalized = path.startsWith('/') ? path.slice(1) : path;\n    if (normalized.endsWith('*') && normalized.length > 1)\n        normalized = normalized.slice(0, -1);\n    if (normalized.endsWith('/'))\n        normalized = normalized.slice(0, -1);\n    return normalized;\n}\nfunction parseBoundedSetDocumentsInstruction(data, label) {\n    if (data.length < 8)\n        throw new Error(`${label} has malformed Bounded instruction data`);\n    const discriminator = Array.from(data.slice(0, 8)).join(',');\n    if (!ALLOWED_BOUNDED_SET_DISCRIMINATORS.has(discriminator)) {\n        throw new Error(`${label} contains unsupported Bounded instruction`);\n    }\n    const cursor = new BorshCursor(data, 8, label);\n    const appId = cursor.readString('appId');\n    const documentPaths = [];\n    const documentCount = cursor.readU32('documents length');\n    for (let i = 0; i < documentCount; i++) {\n        documentPaths.push(normalizeOnchainPath(cursor.readString('document path')));\n        const operationCount = cursor.readU32('operations length');\n        for (let j = 0; j < operationCount; j++) {\n            cursor.readString('operation key');\n            skipBoundedFieldValue(cursor);\n            cursor.skip(1, 'operation kind');\n        }\n    }\n    const deletePaths = [];\n    const deleteCount = cursor.readU32('delete paths length');\n    for (let i = 0; i < deleteCount; i++)\n        deletePaths.push(normalizeOnchainPath(cursor.readString('delete path')));\n    const txDataCount = cursor.readU32('txData length');\n    for (let i = 0; i < txDataCount; i++) {\n        cursor.readString('txData plugin function key');\n        cursor.skipBytes('txData bytes');\n        cursor.skipBytes('txData raIndices');\n    }\n    const simulate = cursor.readU8('simulate');\n    if (simulate !== 0 && simulate !== 1)\n        throw new Error(`${label} has malformed Bounded simulate flag`);\n    if (!cursor.isAtEnd())\n        throw new Error(`${label} has trailing Bounded instruction data`);\n    return { appId, documentPaths, deletePaths };\n}\nfunction assertSamePathSet(label, expectedPaths, actualPaths) {\n    const expected = new Set(expectedPaths.map(normalizeOnchainPath).filter(Boolean));\n    const actual = new Set(actualPaths.map(normalizeOnchainPath).filter(Boolean));\n    const missing = [...expected].filter(path => !actual.has(path));\n    const extra = [...actual].filter(path => !expected.has(path));\n    if (missing.length || extra.length) {\n        const details = [missing.length ? `missing paths: ${missing.join(', ')}` : '', extra.length ? `unexpected paths: ${extra.join(', ')}` : '']\n            .filter(Boolean).join('; ');\n        throw new Error(`${label} Bounded instruction paths do not match requested write paths (${details})`);\n    }\n}\nfunction deserializeAndValidateServerTransaction(serializedTransaction, VersionedTransactionClass, options) {\n    var _a;\n    const transaction = VersionedTransactionClass.deserialize(Buffer.from(serializedTransaction, 'base64'));\n    const { label, expectedAppId, expectedWritePaths } = options;\n    const accountKeys = transaction.message.staticAccountKeys;\n    let boundedInstructionCount = 0;\n    const actualWritePaths = [];\n    for (const ix of transaction.message.compiledInstructions) {\n        if (ix.programIdIndex >= accountKeys.length)\n            throw new Error(`${label} has program ID in lookup table (not allowed)`);\n        const programId = accountKeys[ix.programIdIndex].toBase58();\n        if (!ALLOWED_SERVER_TX_PROGRAMS.has(programId))\n            throw new Error(`${label} contains unauthorized program: ${programId}`);\n        const data = ix.data instanceof Uint8Array ? ix.data : Buffer.from((_a = ix.data) !== null && _a !== void 0 ? _a : []);\n        if (programId === SYSTEM_PROGRAM_ID)\n            throw new Error(`${label} contains unauthorized System Program instruction`);\n        if (programId === BOUNDED_PROGRAM_MAINNET || programId === BOUNDED_PROGRAM_DEVNET) {\n            boundedInstructionCount++;\n            const parsed = parseBoundedSetDocumentsInstruction(data, label);\n            if (parsed.appId !== expectedAppId)\n                throw new Error(`${label} Bounded instruction appId does not match configured appId`);\n            actualWritePaths.push(...parsed.documentPaths, ...parsed.deletePaths);\n        }\n    }\n    if (boundedInstructionCount !== 1)\n        throw new Error(`${label} must contain exactly one Bounded set-documents instruction`);\n    assertSamePathSet(label, expectedWritePaths, actualWritePaths);\n    return transaction;\n}\nexport async function handlePreBuiltTransaction(tx, authProvider, options, expectedWritePaths) {\n    var _a, _b, _c, _d, _e, _f, _g;\n    const { Connection, VersionedTransaction } = await import(\"@solana/web3.js\");\n    // Honor a wallet client's immutable config snapshot for the expected app-id\n    // binding and RPC endpoint (CTA-05); otherwise read the global init() config.\n    const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();\n    const transaction = deserializeAndValidateServerTransaction(tx.serializedTransaction, VersionedTransaction, {\n        label: 'Pre-built transaction', expectedAppId: config.appId, expectedWritePaths,\n    });\n    const shouldSubmit = (options === null || options === void 0 ? void 0 : options.shouldSubmitTx) !== false;\n    const rpcUrl = (_c = config.rpcUrl) === null || _c === void 0 ? void 0 : _c.trim();\n    if (shouldSubmit && !rpcUrl)\n        throw new Error(`Pre-built Solana transaction submission requires init({ rpcUrl }) for ${tx.network}`);\n    const signedTx = await authProvider.signTransaction(transaction);\n    const rawTx = signedTx.serialize();\n    if (!shouldSubmit) {\n        return { transactionSignature: '', signedTransaction: Buffer.from(rawTx).toString('base64'), blockNumber: 0, gasUsed: '0' };\n    }\n    const connection = new Connection(rpcUrl, 'confirmed');\n    const signature = await connection.sendRawTransaction(rawTx, { skipPreflight: false, maxRetries: 3 });\n    const confirmation = await connection.confirmTransaction({\n        signature, blockhash: tx.blockhash, lastValidBlockHeight: tx.lastValidBlockHeight,\n    }, 'confirmed');\n    // #310: \"confirmed\" only means the network recorded the transaction, not that it\n    // succeeded - a landed-but-failed transaction carries an err. Report it as a failure\n    // (with on-chain logs) instead of a fake success, mirroring the server keypair provider.\n    if ((_d = confirmation.value) === null || _d === void 0 ? void 0 : _d.err) {\n        const txInfo = await connection.getTransaction(signature, {\n            maxSupportedTransactionVersion: 0,\n            commitment: 'confirmed',\n        });\n        const logMessages = (_e = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _e === void 0 ? void 0 : _e.logMessages;\n        const errorMessage = logMessages ? JSON.stringify(logMessages) : JSON.stringify(confirmation.value.err);\n        throw new Error(`Transaction failed: ${errorMessage}`);\n    }\n    return {\n        transactionSignature: signature,\n        signedTransaction: Buffer.from(rawTx).toString('base64'),\n        blockNumber: (_g = (_f = confirmation.context) === null || _f === void 0 ? void 0 : _f.slot) !== null && _g !== void 0 ? _g : 0,\n        gasUsed: '0',\n    };\n}\n"],"names":["Buffer"],"mappings":";;;;;AAEA,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5F,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3F,MAAM,sBAAsB,GAAG,6CAA6C;AAC5E,MAAM,iBAAiB,GAAG,kCAAkC;AAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;AAC3C,IAAI,uBAAuB;AAC3B,IAAI,sBAAsB;AAC1B,IAAI,sBAAsB;AAC1B,IAAI,iBAAiB;AACrB,CAAC,CAAC;AACF;AACA,MAAM,2BAA2B,GAAG,0BAA0B;AAC9D,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC;AACnD,IAAI,2BAA2B;AAC/B,CAAC,CAAC;AACF,MAAM,WAAW,CAAC;AAClB,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;AACrC,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI;AACxB,QAAQ,IAAI,CAAC,MAAM,GAAG,MAAM;AAC5B,QAAQ,IAAI,CAAC,KAAK,GAAG,KAAK;AAC1B,IAAI;AACJ,IAAI,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE;AAChC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;AACrD,YAAY,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1G,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAClF,IAAI,OAAO,CAAC,KAAK,EAAE;AACnB,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC;AACnC,QAAQ,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AAChF,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACnF,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC;AACxB,QAAQ,OAAO,KAAK,KAAK,CAAC;AAC1B,IAAI;AACJ,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;AACnF,IAAI,UAAU,CAAC,KAAK,EAAE;AACtB,QAAQ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AACtD,QAAQ,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;AACxC,QAAQ,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACtE,QAAQ,IAAI,CAAC,MAAM,IAAI,MAAM;AAC7B,QAAQ,OAAOA,oBAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;AAChD,IAAI;AACJ,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1E,IAAI,OAAO,GAAG,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzD;AACA,SAAS,qBAAqB,CAAC,MAAM,EAAE;AACvC,IAAI,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;AAC1D,IAAI,IAAI,MAAM,KAAK,CAAC;AACpB,QAAQ;AACR,IAAI,IAAI,MAAM,KAAK,CAAC;AACpB,QAAQ,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC;AACtF,IAAI,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC;AAC5D,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC;AACtC,QAAQ,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,yBAAyB,CAAC;AACjD,SAAS,IAAI,OAAO,KAAK,CAAC;AAC1B,QAAQ,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC;AAC9C,SAAS,IAAI,OAAO,KAAK,CAAC;AAC1B,QAAQ,MAAM,CAAC,UAAU,CAAC,wBAAwB,CAAC;AACnD,SAAS,IAAI,OAAO,KAAK,CAAC;AAC1B,QAAQ,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,yBAAyB,CAAC;AAClD;AACA,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,gEAAgE,EAAE,OAAO,CAAC,CAAC,CAAC;AACrG;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,IAAI,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;AAChE,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;AACzD,QAAQ,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5C,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;AAChC,QAAQ,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5C,IAAI,OAAO,UAAU;AACrB;AACA,SAAS,mCAAmC,CAAC,IAAI,EAAE,KAAK,EAAE;AAC1D,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;AACvB,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAC1E,IAAI,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAChE,IAAI,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;AAChE,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC5E,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC;AAClD,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;AAC5C,IAAI,MAAM,aAAa,GAAG,EAAE;AAC5B,IAAI,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;AAC5D,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE;AAC5C,QAAQ,aAAa,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;AACpF,QAAQ,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;AAClE,QAAQ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC,EAAE,EAAE;AACjD,YAAY,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;AAC9C,YAAY,qBAAqB,CAAC,MAAM,CAAC;AACzC,YAAY,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC;AAC5C,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG,EAAE;AAC1B,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;AAC7D,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE;AACxC,QAAQ,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;AAChF,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;AACvD,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE;AAC1C,QAAQ,MAAM,CAAC,UAAU,CAAC,4BAA4B,CAAC;AACvD,QAAQ,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC;AACxC,QAAQ,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;AAC5C,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;AAC9C,IAAI,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;AACxC,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACvE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;AACzB,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,sCAAsC,CAAC,CAAC;AACzE,IAAI,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE;AAChD;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE;AAC9D,IAAI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrF,IAAI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjF,IAAI,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnE,IAAI,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjE,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE;AAClJ,aAAa,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACvC,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,+DAA+D,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7G,IAAI;AACJ;AACA,SAAS,uCAAuC,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,OAAO,EAAE;AAC5G,IAAI,IAAI,EAAE;AACV,IAAI,MAAM,WAAW,GAAG,yBAAyB,CAAC,WAAW,CAACA,oBAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;AAC3G,IAAI,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,OAAO;AAChE,IAAI,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,iBAAiB;AAC7D,IAAI,IAAI,uBAAuB,GAAG,CAAC;AACnC,IAAI,MAAM,gBAAgB,GAAG,EAAE;AAC/B,IAAI,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE;AAC/D,QAAQ,IAAI,EAAE,CAAC,cAAc,IAAI,WAAW,CAAC,MAAM;AACnD,YAAY,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,6CAA6C,CAAC,CAAC;AACpF,QAAQ,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;AACnE,QAAQ,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC;AACtD,YAAY,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,QAAQ,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,YAAY,UAAU,GAAG,EAAE,CAAC,IAAI,GAAGA,oBAAM,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9H,QAAQ,IAAI,SAAS,KAAK,iBAAiB;AAC3C,YAAY,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACxF,QAAQ,IAAI,SAAS,KAAK,uBAAuB,IAAI,SAAS,KAAK,sBAAsB,EAAE;AAC3F,YAAY,uBAAuB,EAAE;AACrC,YAAY,MAAM,MAAM,GAAG,mCAAmC,CAAC,IAAI,EAAE,KAAK,CAAC;AAC3E,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;AAC9C,gBAAgB,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,0DAA0D,CAAC,CAAC;AACrG,YAAY,gBAAgB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;AACjF,QAAQ;AACR,IAAI;AACJ,IAAI,IAAI,uBAAuB,KAAK,CAAC;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC9F,IAAI,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;AAClE,IAAI,OAAO,WAAW;AACtB;AACO,eAAe,yBAAyB,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE;AAC/F,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;AAClC,IAAI,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAChF;AACA;AACA,IAAI,MAAM,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,OAAO,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,MAAM,SAAS,EAAE;AACxM,IAAI,MAAM,WAAW,GAAG,uCAAuC,CAAC,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,EAAE;AAChH,QAAQ,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB;AACvF,KAAK,CAAC;AACN,IAAI,MAAM,YAAY,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAC7G,IAAI,MAAM,MAAM,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE;AACtF,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM;AAC/B,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,sEAAsE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9G,IAAI,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,WAAW,CAAC;AACpE,IAAI,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE;AACtC,IAAI,IAAI,CAAC,YAAY,EAAE;AACvB,QAAQ,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,iBAAiB,EAAEA,oBAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;AACnI,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC;AAC1D,IAAI,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AACzG,IAAI,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC;AAC7D,QAAQ,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,oBAAoB;AACzF,KAAK,EAAE,WAAW,CAAC;AACnB;AACA;AACA;AACA,IAAI,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,EAAE;AAC/E,QAAQ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,SAAS,EAAE;AAClE,YAAY,8BAA8B,EAAE,CAAC;AAC7C,YAAY,UAAU,EAAE,WAAW;AACnC,SAAS,CAAC;AACV,QAAQ,MAAM,WAAW,GAAG,CAAC,EAAE,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,IAAI,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW;AAClJ,QAAQ,MAAM,YAAY,GAAG,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;AAC/G,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC;AAC9D,IAAI;AACJ,IAAI,OAAO;AACX,QAAQ,oBAAoB,EAAE,SAAS;AACvC,QAAQ,iBAAiB,EAAEA,oBAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAChE,QAAQ,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,YAAY,CAAC,OAAO,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,IAAI,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,CAAC;AACvI,QAAQ,OAAO,EAAE,GAAG;AACpB,KAAK;AACL;;;;"}

package/dist/{solana-operations-ngqIkN9W.js → solana-operations-CYpu6EU8.js}

@@ -1,10 +1,9 @@
 'use strict';
 
-var index = require('./index-BIdD2yUB.js');
+var index = require('./index-C8ocsC_W.js');
 require('axios');
 require('tweetnacl');
 require('reconnecting-websocket');
-require('bn.js');
 
 const BOUNDED_PROGRAM_MAINNET = ['open', 'Tv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F'].join('');
 const BOUNDED_PROGRAM_DEVNET = ['open', 'Tv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F'].join('');
@@ -154,80 +153,17 @@ function deserializeAndValidateServerTransaction(serializedTransaction, Versione
     assertSamePathSet(label, expectedWritePaths, actualWritePaths);
     return transaction;
 }
-function isHexString(value) {
-    if (typeof value !== 'string')
-        return false;
-    const testValue = value.startsWith('-') ? value.slice(1) : value;
-    return /^(0x)?[0-9a-fA-F]+$/.test(testValue);
-}
-async function handleSolanaTransaction(tx, authProvider, options, expectedWritePaths) {
-    var _a, _b, _c, _d, _e;
-    const chainSdk = await import('@solana/web3.js');
-    const { PublicKey, SystemProgram, TransactionInstruction, VersionedTransaction } = chainSdk;
-    const solTransactionData = {
-        remainingAccounts: tx.remainingAccounts,
-        setDocumentData: tx.transactionArgs.setDocumentData,
-        deletePaths: tx.transactionArgs.deletePaths,
-        idl: tx.idl,
-        txData: (_b = (_a = tx.txData) === null || _a === void 0 ? void 0 : _a.map((txData) => ({
-            pluginFunctionKey: txData.pluginFunctionKey,
-            txData: index.bufferExports.Buffer.from(txData.txData),
-            raIndices: (() => {
-                const raw = txData.raIndices;
-                if (raw == null)
-                    return index.bufferExports.Buffer.alloc(0);
-                if (index.bufferExports.Buffer.isBuffer(raw))
-                    return raw;
-                if (raw instanceof Uint8Array)
-                    return index.bufferExports.Buffer.from(raw);
-                const arrayLike = Array.isArray(raw) ? raw :
-                    raw && typeof raw === 'object' && Array.isArray(raw.data) ? raw.data :
-                        (() => { throw new Error(`raIndices has unexpected shape: ${typeof raw}`); })();
-                return index.bufferExports.Buffer.from(arrayLike.map((raIndex) => {
-                    const value = isHexString(raIndex) ? parseInt(raIndex, 16) : Number(raIndex);
-                    if (!Number.isInteger(value) || value < 0 || value > 255) {
-                        throw new Error(`raIndex ${raIndex} is not a valid u8 (must be integer in 0..255)`);
-                    }
-                    return value;
-                }));
-            })(),
-        }))) !== null && _b !== void 0 ? _b : [],
-    };
-    const config = await index.getConfig();
-    if (tx.signedTransaction) {
-        deserializeAndValidateServerTransaction(tx.signedTransaction, VersionedTransaction, {
-            label: 'Server signedTransaction', expectedAppId: config.appId, expectedWritePaths,
-        });
-    }
-    const solTransaction = {
-        appId: config.appId,
-        txArgs: [solTransactionData],
-        lutKey: (_c = tx.lutAddress) !== null && _c !== void 0 ? _c : null,
-        additionalLutAddresses: tx.additionalLutAddresses,
-        network: tx.network,
-        preInstructions: (_e = (_d = tx.preInstructions) === null || _d === void 0 ? void 0 : _d.map((ix, index$1) => {
-            var _a;
-            const keys = (_a = ix.keys) === null || _a === void 0 ? void 0 : _a.map((key) => ({ pubkey: new PublicKey(key.pubkey), isSigner: key.isSigner, isWritable: key.isWritable }));
-            const programId = ix.programId === SYSTEM_PROGRAM_ID ? SystemProgram.programId : new PublicKey(ix.programId);
-            const instruction = new TransactionInstruction({ keys, programId, data: index.bufferExports.Buffer.from(ix.data) });
-            if (instruction.programId.equals(SystemProgram.programId)) {
-                throw new Error(`Server preInstruction[${index$1}] contains unauthorized System Program preInstruction`);
-            }
-            return instruction;
-        })) !== null && _e !== void 0 ? _e : [],
-        signedTransaction: tx.signedTransaction,
-    };
-    return authProvider.runTransaction(undefined, solTransaction, options);
-}
 async function handlePreBuiltTransaction(tx, authProvider, options, expectedWritePaths) {
-    var _a, _b, _c, _d, _e;
+    var _a, _b, _c, _d, _e, _f, _g;
     const { Connection, VersionedTransaction } = await import('@solana/web3.js');
-    const config = await index.getConfig();
+    // Honor a wallet client's immutable config snapshot for the expected app-id
+    // binding and RPC endpoint (CTA-05); otherwise read the global init() config.
+    const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await index.getConfig();
     const transaction = deserializeAndValidateServerTransaction(tx.serializedTransaction, VersionedTransaction, {
         label: 'Pre-built transaction', expectedAppId: config.appId, expectedWritePaths,
     });
     const shouldSubmit = (options === null || options === void 0 ? void 0 : options.shouldSubmitTx) !== false;
-    const rpcUrl = (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+    const rpcUrl = (_c = config.rpcUrl) === null || _c === void 0 ? void 0 : _c.trim();
     if (shouldSubmit && !rpcUrl)
         throw new Error(`Pre-built Solana transaction submission requires init({ rpcUrl }) for ${tx.network}`);
     const signedTx = await authProvider.signTransaction(transaction);
@@ -243,23 +179,22 @@ async function handlePreBuiltTransaction(tx, authProvider, options, expectedWrit
     // #310: "confirmed" only means the network recorded the transaction, not that it
     // succeeded - a landed-but-failed transaction carries an err. Report it as a failure
     // (with on-chain logs) instead of a fake success, mirroring the server keypair provider.
-    if ((_b = confirmation.value) === null || _b === void 0 ? void 0 : _b.err) {
+    if ((_d = confirmation.value) === null || _d === void 0 ? void 0 : _d.err) {
         const txInfo = await connection.getTransaction(signature, {
             maxSupportedTransactionVersion: 0,
             commitment: 'confirmed',
         });
-        const logMessages = (_c = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _c === void 0 ? void 0 : _c.logMessages;
+        const logMessages = (_e = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _e === void 0 ? void 0 : _e.logMessages;
         const errorMessage = logMessages ? JSON.stringify(logMessages) : JSON.stringify(confirmation.value.err);
         throw new Error(`Transaction failed: ${errorMessage}`);
     }
     return {
         transactionSignature: signature,
         signedTransaction: index.bufferExports.Buffer.from(rawTx).toString('base64'),
-        blockNumber: (_e = (_d = confirmation.context) === null || _d === void 0 ? void 0 : _d.slot) !== null && _e !== void 0 ? _e : 0,
+        blockNumber: (_g = (_f = confirmation.context) === null || _f === void 0 ? void 0 : _f.slot) !== null && _g !== void 0 ? _g : 0,
         gasUsed: '0',
     };
 }
 
 exports.handlePreBuiltTransaction = handlePreBuiltTransaction;
-exports.handleSolanaTransaction = handleSolanaTransaction;
-//# sourceMappingURL=solana-operations-ngqIkN9W.js.map
+//# sourceMappingURL=solana-operations-CYpu6EU8.js.map

package/dist/solana-operations-CYpu6EU8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"solana-operations-CYpu6EU8.js","sources":["../.rollup-tmp/client/solana-operations.js"],"sourcesContent":["import { Buffer } from 'buffer';\nimport { getConfig } from './config';\nconst BOUNDED_PROGRAM_MAINNET = ['open', 'Tv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F'].join('');\nconst BOUNDED_PROGRAM_DEVNET = ['open', 'Tv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F'].join('');\nconst COMPUTE_BUDGET_PROGRAM = 'ComputeBudget111111111111111111111111111111';\nconst SYSTEM_PROGRAM_ID = '11111111111111111111111111111111';\nconst ALLOWED_SERVER_TX_PROGRAMS = new Set([\n    BOUNDED_PROGRAM_MAINNET,\n    BOUNDED_PROGRAM_DEVNET,\n    COMPUTE_BUDGET_PROGRAM,\n    SYSTEM_PROGRAM_ID,\n]);\n// Canonical set_documents discriminator (single wire format: ra_indices Vec<u8>).\nconst SET_DOCUMENTS_DISCRIMINATOR = '79,46,72,73,24,79,66,245';\nconst ALLOWED_BOUNDED_SET_DISCRIMINATORS = new Set([\n    SET_DOCUMENTS_DISCRIMINATOR,\n]);\nclass BorshCursor {\n    constructor(data, offset, label) {\n        this.data = data;\n        this.offset = offset;\n        this.label = label;\n    }\n    requireBytes(length, field) {\n        if (this.offset + length > this.data.length) {\n            throw new Error(`${this.label} has malformed Bounded instruction data while reading ${field}`);\n        }\n    }\n    readU8(field) { this.requireBytes(1, field); return this.data[this.offset++]; }\n    readU32(field) {\n        this.requireBytes(4, field);\n        const value = this.data[this.offset] | (this.data[this.offset + 1] << 8) |\n            (this.data[this.offset + 2] << 16) | (this.data[this.offset + 3] << 24);\n        this.offset += 4;\n        return value >>> 0;\n    }\n    skip(length, field) { this.requireBytes(length, field); this.offset += length; }\n    readString(field) {\n        const length = this.readU32(`${field} length`);\n        this.requireBytes(length, field);\n        const raw = this.data.slice(this.offset, this.offset + length);\n        this.offset += length;\n        return Buffer.from(raw).toString('utf8');\n    }\n    skipBytes(field) { this.skip(this.readU32(`${field} length`), field); }\n    isAtEnd() { return this.offset === this.data.length; }\n}\nfunction skipBoundedFieldValue(cursor) {\n    const option = cursor.readU8('operation value option');\n    if (option === 0)\n        return;\n    if (option !== 1)\n        throw new Error('Server transaction has malformed Bounded field value option');\n    const variant = cursor.readU8('operation value variant');\n    if (variant === 0 || variant === 1)\n        cursor.skip(8, 'operation numeric value');\n    else if (variant === 2)\n        cursor.skip(1, 'operation bool value');\n    else if (variant === 3)\n        cursor.readString('operation string value');\n    else if (variant === 4)\n        cursor.skip(32, 'operation address value');\n    else\n        throw new Error(`Server transaction has unsupported Bounded field value variant: ${variant}`);\n}\nfunction normalizeOnchainPath(path) {\n    let normalized = path.startsWith('/') ? path.slice(1) : path;\n    if (normalized.endsWith('*') && normalized.length > 1)\n        normalized = normalized.slice(0, -1);\n    if (normalized.endsWith('/'))\n        normalized = normalized.slice(0, -1);\n    return normalized;\n}\nfunction parseBoundedSetDocumentsInstruction(data, label) {\n    if (data.length < 8)\n        throw new Error(`${label} has malformed Bounded instruction data`);\n    const discriminator = Array.from(data.slice(0, 8)).join(',');\n    if (!ALLOWED_BOUNDED_SET_DISCRIMINATORS.has(discriminator)) {\n        throw new Error(`${label} contains unsupported Bounded instruction`);\n    }\n    const cursor = new BorshCursor(data, 8, label);\n    const appId = cursor.readString('appId');\n    const documentPaths = [];\n    const documentCount = cursor.readU32('documents length');\n    for (let i = 0; i < documentCount; i++) {\n        documentPaths.push(normalizeOnchainPath(cursor.readString('document path')));\n        const operationCount = cursor.readU32('operations length');\n        for (let j = 0; j < operationCount; j++) {\n            cursor.readString('operation key');\n            skipBoundedFieldValue(cursor);\n            cursor.skip(1, 'operation kind');\n        }\n    }\n    const deletePaths = [];\n    const deleteCount = cursor.readU32('delete paths length');\n    for (let i = 0; i < deleteCount; i++)\n        deletePaths.push(normalizeOnchainPath(cursor.readString('delete path')));\n    const txDataCount = cursor.readU32('txData length');\n    for (let i = 0; i < txDataCount; i++) {\n        cursor.readString('txData plugin function key');\n        cursor.skipBytes('txData bytes');\n        cursor.skipBytes('txData raIndices');\n    }\n    const simulate = cursor.readU8('simulate');\n    if (simulate !== 0 && simulate !== 1)\n        throw new Error(`${label} has malformed Bounded simulate flag`);\n    if (!cursor.isAtEnd())\n        throw new Error(`${label} has trailing Bounded instruction data`);\n    return { appId, documentPaths, deletePaths };\n}\nfunction assertSamePathSet(label, expectedPaths, actualPaths) {\n    const expected = new Set(expectedPaths.map(normalizeOnchainPath).filter(Boolean));\n    const actual = new Set(actualPaths.map(normalizeOnchainPath).filter(Boolean));\n    const missing = [...expected].filter(path => !actual.has(path));\n    const extra = [...actual].filter(path => !expected.has(path));\n    if (missing.length || extra.length) {\n        const details = [missing.length ? `missing paths: ${missing.join(', ')}` : '', extra.length ? `unexpected paths: ${extra.join(', ')}` : '']\n            .filter(Boolean).join('; ');\n        throw new Error(`${label} Bounded instruction paths do not match requested write paths (${details})`);\n    }\n}\nfunction deserializeAndValidateServerTransaction(serializedTransaction, VersionedTransactionClass, options) {\n    var _a;\n    const transaction = VersionedTransactionClass.deserialize(Buffer.from(serializedTransaction, 'base64'));\n    const { label, expectedAppId, expectedWritePaths } = options;\n    const accountKeys = transaction.message.staticAccountKeys;\n    let boundedInstructionCount = 0;\n    const actualWritePaths = [];\n    for (const ix of transaction.message.compiledInstructions) {\n        if (ix.programIdIndex >= accountKeys.length)\n            throw new Error(`${label} has program ID in lookup table (not allowed)`);\n        const programId = accountKeys[ix.programIdIndex].toBase58();\n        if (!ALLOWED_SERVER_TX_PROGRAMS.has(programId))\n            throw new Error(`${label} contains unauthorized program: ${programId}`);\n        const data = ix.data instanceof Uint8Array ? ix.data : Buffer.from((_a = ix.data) !== null && _a !== void 0 ? _a : []);\n        if (programId === SYSTEM_PROGRAM_ID)\n            throw new Error(`${label} contains unauthorized System Program instruction`);\n        if (programId === BOUNDED_PROGRAM_MAINNET || programId === BOUNDED_PROGRAM_DEVNET) {\n            boundedInstructionCount++;\n            const parsed = parseBoundedSetDocumentsInstruction(data, label);\n            if (parsed.appId !== expectedAppId)\n                throw new Error(`${label} Bounded instruction appId does not match configured appId`);\n            actualWritePaths.push(...parsed.documentPaths, ...parsed.deletePaths);\n        }\n    }\n    if (boundedInstructionCount !== 1)\n        throw new Error(`${label} must contain exactly one Bounded set-documents instruction`);\n    assertSamePathSet(label, expectedWritePaths, actualWritePaths);\n    return transaction;\n}\nexport async function handlePreBuiltTransaction(tx, authProvider, options, expectedWritePaths) {\n    var _a, _b, _c, _d, _e, _f, _g;\n    const { Connection, VersionedTransaction } = await import(\"@solana/web3.js\");\n    // Honor a wallet client's immutable config snapshot for the expected app-id\n    // binding and RPC endpoint (CTA-05); otherwise read the global init() config.\n    const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();\n    const transaction = deserializeAndValidateServerTransaction(tx.serializedTransaction, VersionedTransaction, {\n        label: 'Pre-built transaction', expectedAppId: config.appId, expectedWritePaths,\n    });\n    const shouldSubmit = (options === null || options === void 0 ? void 0 : options.shouldSubmitTx) !== false;\n    const rpcUrl = (_c = config.rpcUrl) === null || _c === void 0 ? void 0 : _c.trim();\n    if (shouldSubmit && !rpcUrl)\n        throw new Error(`Pre-built Solana transaction submission requires init({ rpcUrl }) for ${tx.network}`);\n    const signedTx = await authProvider.signTransaction(transaction);\n    const rawTx = signedTx.serialize();\n    if (!shouldSubmit) {\n        return { transactionSignature: '', signedTransaction: Buffer.from(rawTx).toString('base64'), blockNumber: 0, gasUsed: '0' };\n    }\n    const connection = new Connection(rpcUrl, 'confirmed');\n    const signature = await connection.sendRawTransaction(rawTx, { skipPreflight: false, maxRetries: 3 });\n    const confirmation = await connection.confirmTransaction({\n        signature, blockhash: tx.blockhash, lastValidBlockHeight: tx.lastValidBlockHeight,\n    }, 'confirmed');\n    // #310: \"confirmed\" only means the network recorded the transaction, not that it\n    // succeeded - a landed-but-failed transaction carries an err. Report it as a failure\n    // (with on-chain logs) instead of a fake success, mirroring the server keypair provider.\n    if ((_d = confirmation.value) === null || _d === void 0 ? void 0 : _d.err) {\n        const txInfo = await connection.getTransaction(signature, {\n            maxSupportedTransactionVersion: 0,\n            commitment: 'confirmed',\n        });\n        const logMessages = (_e = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _e === void 0 ? void 0 : _e.logMessages;\n        const errorMessage = logMessages ? JSON.stringify(logMessages) : JSON.stringify(confirmation.value.err);\n        throw new Error(`Transaction failed: ${errorMessage}`);\n    }\n    return {\n        transactionSignature: signature,\n        signedTransaction: Buffer.from(rawTx).toString('base64'),\n        blockNumber: (_g = (_f = confirmation.context) === null || _f === void 0 ? void 0 : _f.slot) !== null && _g !== void 0 ? _g : 0,\n        gasUsed: '0',\n    };\n}\n"],"names":["Buffer","getConfig"],"mappings":";;;;;;;AAEA,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5F,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3F,MAAM,sBAAsB,GAAG,6CAA6C;AAC5E,MAAM,iBAAiB,GAAG,kCAAkC;AAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;AAC3C,IAAI,uBAAuB;AAC3B,IAAI,sBAAsB;AAC1B,IAAI,sBAAsB;AAC1B,IAAI,iBAAiB;AACrB,CAAC,CAAC;AACF;AACA,MAAM,2BAA2B,GAAG,0BAA0B;AAC9D,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC;AACnD,IAAI,2BAA2B;AAC/B,CAAC,CAAC;AACF,MAAM,WAAW,CAAC;AAClB,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;AACrC,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI;AACxB,QAAQ,IAAI,CAAC,MAAM,GAAG,MAAM;AAC5B,QAAQ,IAAI,CAAC,KAAK,GAAG,KAAK;AAC1B,IAAI;AACJ,IAAI,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE;AAChC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;AACrD,YAAY,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1G,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAClF,IAAI,OAAO,CAAC,KAAK,EAAE;AACnB,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC;AACnC,QAAQ,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AAChF,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACnF,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC;AACxB,QAAQ,OAAO,KAAK,KAAK,CAAC;AAC1B,IAAI;AACJ,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;AACnF,IAAI,UAAU,CAAC,KAAK,EAAE;AACtB,QAAQ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AACtD,QAAQ,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;AACxC,QAAQ,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACtE,QAAQ,IAAI,CAAC,MAAM,IAAI,MAAM;AAC7B,QAAQ,OAAOA,0BAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;AAChD,IAAI;AACJ,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1E,IAAI,OAAO,GAAG,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzD;AACA,SAAS,qBAAqB,CAAC,MAAM,EAAE;AACvC,IAAI,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;AAC1D,IAAI,IAAI,MAAM,KAAK,CAAC;AACpB,QAAQ;AACR,IAAI,IAAI,MAAM,KAAK,CAAC;AACpB,QAAQ,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC;AACtF,IAAI,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC;AAC5D,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC;AACtC,QAAQ,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,yBAAyB,CAAC;AACjD,SAAS,IAAI,OAAO,KAAK,CAAC;AAC1B,QAAQ,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC;AAC9C,SAAS,IAAI,OAAO,KAAK,CAAC;AAC1B,QAAQ,MAAM,CAAC,UAAU,CAAC,wBAAwB,CAAC;AACnD,SAAS,IAAI,OAAO,KAAK,CAAC;AAC1B,QAAQ,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,yBAAyB,CAAC;AAClD;AACA,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,gEAAgE,EAAE,OAAO,CAAC,CAAC,CAAC;AACrG;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,IAAI,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;AAChE,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;AACzD,QAAQ,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5C,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;AAChC,QAAQ,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5C,IAAI,OAAO,UAAU;AACrB;AACA,SAAS,mCAAmC,CAAC,IAAI,EAAE,KAAK,EAAE;AAC1D,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;AACvB,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAC1E,IAAI,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAChE,IAAI,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;AAChE,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC5E,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC;AAClD,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;AAC5C,IAAI,MAAM,aAAa,GAAG,EAAE;AAC5B,IAAI,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;AAC5D,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE;AAC5C,QAAQ,aAAa,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;AACpF,QAAQ,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;AAClE,QAAQ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC,EAAE,EAAE;AACjD,YAAY,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;AAC9C,YAAY,qBAAqB,CAAC,MAAM,CAAC;AACzC,YAAY,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC;AAC5C,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG,EAAE;AAC1B,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;AAC7D,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE;AACxC,QAAQ,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;AAChF,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;AACvD,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE;AAC1C,QAAQ,MAAM,CAAC,UAAU,CAAC,4BAA4B,CAAC;AACvD,QAAQ,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC;AACxC,QAAQ,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;AAC5C,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;AAC9C,IAAI,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;AACxC,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACvE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;AACzB,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,sCAAsC,CAAC,CAAC;AACzE,IAAI,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE;AAChD;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE;AAC9D,IAAI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrF,IAAI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjF,IAAI,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnE,IAAI,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjE,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE;AAClJ,aAAa,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACvC,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,+DAA+D,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7G,IAAI;AACJ;AACA,SAAS,uCAAuC,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,OAAO,EAAE;AAC5G,IAAI,IAAI,EAAE;AACV,IAAI,MAAM,WAAW,GAAG,yBAAyB,CAAC,WAAW,CAACA,0BAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;AAC3G,IAAI,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,OAAO;AAChE,IAAI,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,iBAAiB;AAC7D,IAAI,IAAI,uBAAuB,GAAG,CAAC;AACnC,IAAI,MAAM,gBAAgB,GAAG,EAAE;AAC/B,IAAI,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE;AAC/D,QAAQ,IAAI,EAAE,CAAC,cAAc,IAAI,WAAW,CAAC,MAAM;AACnD,YAAY,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,6CAA6C,CAAC,CAAC;AACpF,QAAQ,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;AACnE,QAAQ,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC;AACtD,YAAY,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,QAAQ,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,YAAY,UAAU,GAAG,EAAE,CAAC,IAAI,GAAGA,0BAAM,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9H,QAAQ,IAAI,SAAS,KAAK,iBAAiB;AAC3C,YAAY,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACxF,QAAQ,IAAI,SAAS,KAAK,uBAAuB,IAAI,SAAS,KAAK,sBAAsB,EAAE;AAC3F,YAAY,uBAAuB,EAAE;AACrC,YAAY,MAAM,MAAM,GAAG,mCAAmC,CAAC,IAAI,EAAE,KAAK,CAAC;AAC3E,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;AAC9C,gBAAgB,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,0DAA0D,CAAC,CAAC;AACrG,YAAY,gBAAgB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;AACjF,QAAQ;AACR,IAAI;AACJ,IAAI,IAAI,uBAAuB,KAAK,CAAC;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC9F,IAAI,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;AAClE,IAAI,OAAO,WAAW;AACtB;AACO,eAAe,yBAAyB,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE;AAC/F,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;AAClC,IAAI,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAChF;AACA;AACA,IAAI,MAAM,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,OAAO,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,MAAMC,eAAS,EAAE;AACxM,IAAI,MAAM,WAAW,GAAG,uCAAuC,CAAC,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,EAAE;AAChH,QAAQ,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB;AACvF,KAAK,CAAC;AACN,IAAI,MAAM,YAAY,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAC7G,IAAI,MAAM,MAAM,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE;AACtF,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM;AAC/B,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,sEAAsE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9G,IAAI,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,WAAW,CAAC;AACpE,IAAI,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE;AACtC,IAAI,IAAI,CAAC,YAAY,EAAE;AACvB,QAAQ,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,iBAAiB,EAAED,0BAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;AACnI,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC;AAC1D,IAAI,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AACzG,IAAI,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC;AAC7D,QAAQ,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,oBAAoB;AACzF,KAAK,EAAE,WAAW,CAAC;AACnB;AACA;AACA;AACA,IAAI,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,EAAE;AAC/E,QAAQ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,SAAS,EAAE;AAClE,YAAY,8BAA8B,EAAE,CAAC;AAC7C,YAAY,UAAU,EAAE,WAAW;AACnC,SAAS,CAAC;AACV,QAAQ,MAAM,WAAW,GAAG,CAAC,EAAE,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,IAAI,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,WAAW;AAClJ,QAAQ,MAAM,YAAY,GAAG,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;AAC/G,QAAQ,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC;AAC9D,IAAI;AACJ,IAAI,OAAO;AACX,QAAQ,oBAAoB,EAAE,SAAS;AACvC,QAAQ,iBAAiB,EAAEA,0BAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAChE,QAAQ,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,YAAY,CAAC,OAAO,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,IAAI,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,CAAC;AACvI,QAAQ,OAAO,EAAE,GAAG;AACpB,KAAK;AACL;;;;"}

package/dist/utils/auth-api.d.ts

@@ -1,5 +1,18 @@
+import { type ClientConfig } from '../client/config';
+/**
+ * The immutable subset of a resolved {@link ClientConfig} a session mint needs:
+ * the target app and its wallet/SIWS issuer, plus the configured auth method.
+ *
+ * A server `WalletClient` snapshots this at construction and threads it into
+ * every nonce/session/refresh call so the mint is BOUND to the app+issuer the
+ * client was created against. Without it, `genAuthNonce`/`createSessionWithSignature`
+ * read the mutable process-global config, so a later `init(...)` for a different
+ * app or environment would silently retarget the wallet client's session mint
+ * (CTA-05).
+ */
+export type SessionMintConfig = Pick<ClientConfig, 'appId' | 'authApiUrl' | 'authMethod'>;
 export declare function genNonce(): Promise<any>;
-export declare function genAuthNonce(): Promise<any>;
+export declare function genAuthNonce(sessionConfig?: SessionMintConfig): Promise<any>;
 /**
  * Exchange a wallet signature for a Bounded session at the /session issuer.
  *
@@ -9,7 +22,7 @@ export declare function genAuthNonce(): Promise<any>;
  *   Solana wallet/guest method passes through verbatim, and anything else
  *   defaults to the canonical 'phantom' the issuer accepts for a signature.
  */
-export declare function createSessionWithSignature(address: string, message: string, signature: string, authMethodOverride?: string): Promise<any>;
+export declare function createSessionWithSignature(address: string, message: string, signature: string, authMethodOverride?: string, sessionConfig?: SessionMintConfig): Promise<any>;
 export declare function refreshSession(refreshToken: string, issuer?: string): Promise<any>;
 export declare class SessionRevokeError extends Error {
     readonly cause?: unknown;

package/dist/utils/rn-session-manager.d.ts

@@ -13,13 +13,24 @@ import { type CommitResult, type ExpectedSession } from "./session-mutation";
 /**
  * Synchronous storage adapter for React Native session persistence.
  *
- * **Security: tokens (access, identity, refresh) are stored as plaintext JSON.**
- * Use an encrypted storage backend in production — for example:
- *   - MMKV with an encryption key (`new MMKV({ encryptionKey: '...' })`)
- *   - expo-secure-store
- *   - react-native-keychain
+ * The session manager writes the WHOLE credential set - access token, identity
+ * token, and the long-lived (rolling) REFRESH token - through this adapter as a
+ * single JSON string. Whatever `setItem` persists is exactly what an attacker with
+ * device access reads back.
  *
- * Plaintext token storage on a rooted/jailbroken device is a credential theft risk.
+ * **You MUST supply an ENCRYPTED backend.** The manager cannot introspect a
+ * caller-supplied adapter to confirm it encrypts at rest, so this is your
+ * responsibility (`allowUnsafePlaintext` on the config is the explicit escape hatch
+ * for the unencrypted case - see `configure()`). Supported encrypted patterns:
+ *   - MMKV with an encryption key held in the OS keystore:
+ *     `new MMKV({ encryptionKey })` where `encryptionKey` comes from
+ *     react-native-keychain / expo-secure-store (NEVER a hardcoded constant)
+ *   - expo-secure-store directly
+ *   - react-native-keychain directly
+ *
+ * A keyless MMKV instance (constructed with no encryptionKey) or AsyncStorage is
+ * PLAINTEXT: on a rooted/jailbroken device or in a device backup the refresh token
+ * is a portable, replayable credential.
  */
 export interface RNStorageAdapter {
     getItem(key: string): string | null;
@@ -30,18 +41,49 @@ interface RNSessionConfig {
     storage: RNStorageAdapter;
     /** base64 → binary string (replaces browser atob). */
     atob: (input: string) => string;
+    /**
+     * Explicit acknowledgment that `storage` is UNENCRYPTED (plaintext).
+     *
+     * The supported/secure default is an encrypted backend (see `configure()`); the
+     * manager cannot verify a caller's adapter actually encrypts, so it cannot enforce
+     * it for you. If you deliberately supply a plaintext adapter (e.g. bare MMKV or
+     * AsyncStorage during development) you MUST set this to `true` to acknowledge that
+     * the access/identity/refresh tokens are readable from a rooted device or a device
+     * backup. It is a conscious-choice gate that also emits a loud one-time warning at
+     * `configure()`; leave it unset for any encrypted backend.
+     */
+    allowUnsafePlaintext?: boolean;
 }
 export declare class ReactNativeSessionManager {
     private static BOUNDED_SESSION_STORAGE_KEY;
     /**
      * Must be called once before any other method.
      *
+     * SECURITY: the persisted blob includes the long-lived refresh token, so the
+     * `storage` adapter MUST encrypt at rest. The supported pattern is MMKV with an
+     * `encryptionKey` held in the OS keystore (Keychain on iOS / Keystore on Android)
+     * via react-native-keychain - NOT a keyless MMKV instance, and NEVER a hardcoded key.
+     *
      * ```ts
      * import { ReactNativeSessionManager } from '@bounded-sh/core';
      * import { MMKV } from 'react-native-mmkv';
+     * import * as Keychain from 'react-native-keychain';
      * import { decode } from 'base-64';
      *
-     * const mmkv = new MMKV();
+     * // Fetch (or lazily mint) a random 256-bit key stored in the OS keystore.
+     * // The keystore - not the app bundle - is the root of trust for the key.
+     * async function getMmkvEncryptionKey(): Promise<string> {
+     *   const service = 'sh.bounded.session.mmkv';
+     *   const existing = await Keychain.getGenericPassword({ service });
+     *   if (existing) return existing.password;
+     *   const bytes = crypto.getRandomValues(new Uint8Array(32));
+     *   const key = [...bytes].map((b) => b.toString(16).padStart(2, '0')).join('');
+     *   await Keychain.setGenericPassword('bounded', key, { service });
+     *   return key;
+     * }
+     *
+     * const encryptionKey = await getMmkvEncryptionKey();
+     * const mmkv = new MMKV({ id: 'bounded-session', encryptionKey });
      * ReactNativeSessionManager.configure({
      *   storage: {
      *     getItem: (k) => mmkv.getString(k) ?? null,
@@ -51,6 +93,14 @@ export declare class ReactNativeSessionManager {
      *   atob: decode,
      * });
      * ```
+     *
+     * Unencrypted adapters (bare MMKV, AsyncStorage) are a credential-theft risk and
+     * require an explicit opt-in - the manager cannot verify encryption for you:
+     *
+     * ```ts
+     * // Development only: acknowledge that tokens are stored in plaintext.
+     * ReactNativeSessionManager.configure({ storage, atob: decode, allowUnsafePlaintext: true });
+     * ```
      */
     static configure(cfg: RNSessionConfig): void;
     /**

package/dist/utils/server-session-manager.d.ts

@@ -1,4 +1,5 @@
 import type { Keypair } from "@solana/web3.js";
+import { type SessionMintConfig } from "./auth-api";
 /**
  * Server-side SessionManager
  * --------------------------
@@ -21,12 +22,16 @@ export declare class ServerSessionManager {
     private generation;
     private readonly keypair;
     private readonly sessionFactory;
+    private readonly sessionConfig;
     private constructor();
     /**
      * Create a session manager for a specific keypair.
      * Each instance has its own independent session cache.
+     *
+     * `sessionConfig` (optional) pins the app+issuer the keypair signs/mints
+     * against, so re-signing after expiry never follows a later global init().
      */
-    static forKeypair(keypair: Keypair): ServerSessionManager;
+    static forKeypair(keypair: Keypair, sessionConfig?: SessionMintConfig): ServerSessionManager;
     /**
      * Create an isolated server session manager for a non-Solana signer (currently
      * EVM/SIWE). The factory must perform the signature exchange and return the

package/dist/utils/sol/sol-accessors.d.ts

@@ -1,29 +1,2 @@
-import type { Connection, PublicKey, Transaction, TransactionInstruction, VersionedTransaction } from "@solana/web3.js";
-import type { AnchorProvider } from "@coral-xyz/anchor";
-import type { TxData } from "./sol-utils";
-export type RemainingAccount = {
-    pubkey: PublicKey;
-    isWritable: boolean;
-    isSigner: boolean;
-};
-/** Load the Anchor/Web3 transaction builder only when an onchain write uses it. */
-export declare function buildSetDocumentsTransaction(connection: Connection, idl: any, programProvider: AnchorProvider, payerPublicKey: PublicKey, args: {
-    app_id: string;
-    documents: {
-        path: string;
-        operations: {
-            key: string;
-            value: any;
-            operation: number;
-        }[];
-    }[];
-    delete_paths: string[];
-    txData: TxData[];
-}, remainingAccounts: RemainingAccount[], lutKey: PublicKey | null, preInstructions: TransactionInstruction[], simulate: boolean, additionalLutAddresses?: string[]): Promise<{
-    tx: VersionedTransaction | Transaction;
-    blockhash: string;
-    lastValidBlockHeight: number;
-}>;
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 export declare function genSolanaMessage(address: string, nonce: string): Promise<string>;
-export declare function convertRemainingAccounts(remainingAccounts: any[]): RemainingAccount[];

package/dist/utils/sol/solana-message.d.ts

@@ -1 +1 @@
-export declare function genSolanaMessage(address: string, nonce: string): Promise<string>;
+export declare function genSolanaMessage(address: string, nonce: string, appIdOverride?: string): Promise<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-sh/core",
-  "version": "0.0.63",
+  "version": "0.0.65",
   "description": "Shared client, data-plane, and transport primitives for Bounded, the full-stack app builder and runtime for AI-built apps: policy-enforced operations, files, functions, and realtime.",
   "homepage": "https://bounded.sh/docs/sdk",
   "main": "./dist/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "rm -rf ./dist ./.rollup-tmp && tsc -p tsconfig.build.json --outDir .rollup-tmp --declarationDir .rollup-tmp --emitDeclarationOnly false && rollup -c && tsc -p tsconfig.build.json --emitDeclarationOnly --declarationDir dist && rm -rf ./.rollup-tmp",
     "watch": "rollup -c -w",
-    "test": "node src/client/run-config-network-test.mjs && node src/client/run-read-principal-test.mjs && node src/client/run-principal-collision-test.mjs && node src/client/run-abortable-read-test.mjs && node src/utils/run-api-abort-test.mjs && node src/utils/run-api-transient-get-retry-test.mjs && node src/utils/run-auth-api-issuer-switch-test.mjs && node src/utils/run-session-manager-binding-test.mjs && node src/utils/run-session-protocol-test.mjs && node src/utils/run-auth-token-freshness-test.mjs && node src/utils/run-api-401-recovery-test.mjs && node src/utils/run-server-session-manager-test.mjs && node src/utils/api-refresh-inflight-key.source.test.mjs && node src/client/run-row-shape-test.mjs && node src/client/run-transport-test.mjs && node src/client/run-queries-coalesce-test.mjs && node src/client/run-runexpression-overrides-test.mjs && node src/client/run-subscribe-query-test.mjs && node src/client/subscribe-query-defaults.source.test.mjs && node src/client/run-public-export-surface-test.mjs && node src/client/run-live-auth-test.mjs && node src/client/run-live-view-principal-test.mjs && node src/client/run-subscription-auth-error-test.mjs && node src/client/run-subscription-confirmation-retry-test.mjs && node src/client/subscription-handoff-grace.source.test.mjs && node src/client/run-onchain-validation-test.mjs && node src/client/run-evm-dispatch-test.mjs && node src/utils/evm/run-evm-utils-test.mjs && node src/client/websocket-auth-url.test.mjs && node src/client/run-create-client-http-test.mjs && node src/client/run-create-client-subscribe-test.mjs",
+    "test": "node src/client/run-config-network-test.mjs && node src/client/run-read-principal-test.mjs && node src/client/run-principal-collision-test.mjs && node src/client/run-abortable-read-test.mjs && node src/utils/run-api-abort-test.mjs && node src/utils/run-api-transient-get-retry-test.mjs && node src/utils/run-auth-api-issuer-switch-test.mjs && node src/utils/run-auth-api-server-credential-test.mjs && node src/utils/run-session-manager-binding-test.mjs && node src/utils/rn-session-manager-example.source.test.mjs && node src/utils/run-session-protocol-test.mjs && node src/utils/run-auth-token-freshness-test.mjs && node src/utils/run-api-401-recovery-test.mjs && node src/utils/run-server-session-manager-test.mjs && node src/utils/api-refresh-inflight-key.source.test.mjs && node src/client/run-row-shape-test.mjs && node src/client/run-transport-test.mjs && node src/client/run-queries-coalesce-test.mjs && node src/client/run-runexpression-overrides-test.mjs && node src/client/run-subscribe-query-test.mjs && node src/client/subscribe-query-defaults.source.test.mjs && node src/client/run-public-export-surface-test.mjs && node src/client/run-live-auth-test.mjs && node src/client/run-live-view-principal-test.mjs && node src/client/run-subscription-auth-error-test.mjs && node src/client/run-subscription-confirmation-retry-test.mjs && node src/client/subscription-handoff-grace.source.test.mjs && node src/client/run-onchain-validation-test.mjs && node src/client/run-evm-dispatch-test.mjs && node src/utils/evm/run-evm-utils-test.mjs && node src/client/websocket-auth-url.test.mjs && node src/client/run-create-client-http-test.mjs && node src/client/run-create-client-subscribe-test.mjs && node src/client/run-wallet-config-binding-test.mjs",
     "prepare": "npm run build"
   },
   "files": [