@bounded-sh/core 0.0.65 → 0.0.66

package/dist/{index-C8ocsC_W.js → index-DNZifL5j.js}

@@ -553,22 +553,25 @@ async function createSessionWithSignature(address, message, signature, authMetho
 // Deduplicate concurrent refreshSession calls to prevent multiple code paths
 // (WebSocket reconnection, periodic refresh, API 401 retry) from all hitting
 // /session/refresh simultaneously.
-// Note: module-level state is shared across requests in SSR/Node — acceptable
-// since there is only one active session per server instance (same pattern as
-// refreshInFlight in api.ts).
-let refreshInFlight = null;
-let refreshInFlightToken = null;
+//
+// Keyed PER (issuer, token) in a Map, not one global slot (DS2-0373): the rotating
+// refresh token is single-use, so two concurrent refreshes of the SAME token must
+// share one in-flight request. A single global slot could hold only one token at a
+// time, so an interleaved refresh of a DIFFERENT session's token evicted the first
+// token's in-flight promise; a later second refresh of the first token then missed
+// its own in-flight request and re-POSTed the already-spent token - the issuer sees
+// reuse and revokes the whole family. Keying by token lets unrelated sessions
+// coalesce independently.
+// Note: module-level state is shared across requests in SSR/Node - acceptable since
+// each key is bound to a specific session's token (same pattern as api.ts).
+const refreshInFlightByToken = new Map();
 async function refreshSession(refreshToken, issuer) {
-    // Dedupe per (issuer, token): the rotating token is single-use, so two
-    // concurrent refreshes of the SAME token must share one in-flight request or
-    // the second would look like reuse and revoke the family.
     const dedupeKey = `${issuer || ''}::${refreshToken}`;
-    if (refreshInFlight && refreshInFlightToken === dedupeKey) {
-        return refreshInFlight;
-    }
-    refreshInFlightToken = dedupeKey;
+    const existing = refreshInFlightByToken.get(dedupeKey);
+    if (existing)
+        return existing;
     let currentFlight;
-    currentFlight = refreshInFlight = (async () => {
+    currentFlight = (async () => {
         try {
             const config = await getConfig();
             const appId = config.appId;
@@ -583,15 +586,16 @@ async function refreshSession(refreshToken, issuer) {
             return response.data;
         }
         finally {
-            // Only clear if we're still the active in-flight request.
-            // A second call with a different token may have replaced us.
-            if (refreshInFlight === currentFlight) {
-                refreshInFlight = null;
-                refreshInFlightToken = null;
+            // Only remove our own entry, and only if it is still the active flight
+            // for this token (a later refresh of the same token cannot have replaced
+            // it while we were in flight, but this stays correct if that ever changes).
+            if (refreshInFlightByToken.get(dedupeKey) === currentFlight) {
+                refreshInFlightByToken.delete(dedupeKey);
             }
         }
     })();
-    return refreshInFlight;
+    refreshInFlightByToken.set(dedupeKey, currentFlight);
+    return currentFlight;
 }
 class SessionRevokeError extends Error {
     constructor(message, cause) {
@@ -1005,7 +1009,12 @@ class WebSessionManager {
             // hosted login. The idToken carries the canonical identity (@user.id) + exp.
             const { idToken } = sessionObj;
             const { exp } = JSON.parse(this.decodeBase64Url(idToken.split(".")[1]));
-            if (Date.now() > exp * 1000) {
+            // Treat a MISSING or non-numeric expiry as EXPIRED (fail closed). A bare
+            // `Date.now() > exp * 1000` is NaN -> false when exp is absent/non-numeric,
+            // so a forged or malformed token with no usable expiry would otherwise be
+            // accepted as valid forever.
+            const expired = typeof exp !== "number" || !Number.isFinite(exp) || Date.now() > exp * 1000;
+            if (expired) {
                 const { refreshToken } = sessionObj;
                 // Expired token with no way to refresh — clear the stale session
                 // (mirrors the refresh-failed branch below) so isAuthenticated()
@@ -1111,25 +1120,46 @@ class WebSessionManager {
     /* ------------------------------------------------------------------ */
     /* TOKEN HELPERS                                                      */
     /* ------------------------------------------------------------------ */
+    // These reads are DEFENSIVE (try/catch -> treat a corrupt blob as absent).
+    // logout() reads the refresh token + issuer BEFORE the session is cleared; if a
+    // corrupt (non-JSON) blob threw out of the read, logout would abort with the
+    // credential still in storage while isAuthenticated() kept reporting true, so
+    // sign-out could never complete. A corrupt blob is unusable either way, so
+    // reporting "no token" lets the clear path proceed and finish the sign-out.
     static getIdToken() {
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        return session ? JSON.parse(session).idToken : null;
+        try {
+            const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return session ? JSON.parse(session).idToken : null;
+        }
+        catch (_a) {
+            return null;
+        }
     }
     static getRefreshToken() {
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        return session ? JSON.parse(session).refreshToken : null;
+        try {
+            const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return session ? JSON.parse(session).refreshToken : null;
+        }
+        catch (_a) {
+            return null;
+        }
     }
     /** The issuer base that minted this session (for routing silent refresh). */
     static getIssuer() {
         var _a;
         if (typeof window === "undefined")
             return null;
-        const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
-        return session ? ((_a = JSON.parse(session).issuer) !== null && _a !== void 0 ? _a : null) : null;
+        try {
+            const session = localStorage.getItem(this.BOUNDED_SESSION_STORAGE_KEY);
+            return session ? ((_a = JSON.parse(session).issuer) !== null && _a !== void 0 ? _a : null) : null;
+        }
+        catch (_b) {
+            return null;
+        }
     }
     /* ------------------------------------------------------------------ */
     /* UPDATE TOKENS                                                      */
@@ -1387,7 +1417,12 @@ class ReactNativeSessionManager {
             // logins is opaque, so decoding it threw → the catch wiped a valid session.
             const { idToken } = sessionObj;
             const { exp } = JSON.parse(this.decodeBase64Url(idToken.split(".")[1]));
-            if (Date.now() > exp * 1000) {
+            // Treat a MISSING or non-numeric expiry as EXPIRED (fail closed). A bare
+            // `Date.now() > exp * 1000` is NaN -> false when exp is absent/non-numeric,
+            // so a forged or malformed token with no usable expiry would otherwise be
+            // accepted as valid forever.
+            const expired = typeof exp !== "number" || !Number.isFinite(exp) || Date.now() > exp * 1000;
+            if (expired) {
                 const { refreshToken } = sessionObj;
                 // Expired token with no way to refresh — clear the stale session
                 // (mirrors the refresh-failed branch below) so isAuthenticated()
@@ -4010,7 +4045,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-D_CN0H6r.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-Bycv-L5n.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -4102,18 +4137,31 @@ ServerSessionManager.instance = new ServerSessionManager();
  *
  * These are used instead of bare `atob()`/`btoa()` so the core package
  * works in React Native without requiring the consumer to polyfill globals.
+ *
+ * Both directions are UTF-8-safe: bare btoa / Buffer('binary') are LATIN-1 and
+ * throw (surrogate-pair emoji) or silently mangle (accents, CJK) any code point
+ * > 0xFF, corrupting user text - e.g. an AI-query `prompt` - before it is sent.
+ * safeBtoa base64s the UTF-8 bytes; safeAtob is its exact inverse, and the
+ * realtime worker decodes the same bytes as UTF-8 (src/utf8-base64.ts). ASCII is
+ * byte-identical either way, so JWT (decodeBase64Url) decoding is unaffected.
  */
 function safeAtob(input) {
     if (typeof globalThis.atob === 'function') {
-        return globalThis.atob(input);
+        const binary = globalThis.atob(input);
+        const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+        return new TextDecoder().decode(bytes);
     }
-    return bufferExports.Buffer.from(input, 'base64').toString('binary');
+    return bufferExports.Buffer.from(input, 'base64').toString('utf-8');
 }
 function safeBtoa(input) {
+    const bytes = new TextEncoder().encode(input);
     if (typeof globalThis.btoa === 'function') {
-        return globalThis.btoa(input);
+        let binary = '';
+        for (let i = 0; i < bytes.length; i++)
+            binary += String.fromCharCode(bytes[i]);
+        return globalThis.btoa(binary);
     }
-    return bufferExports.Buffer.from(input, 'binary').toString('base64');
+    return bufferExports.Buffer.from(bytes).toString('base64');
 }
 /**
  * Decode a base64url-encoded string (used by JWT payloads).
@@ -6729,7 +6777,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-I_bcryPz.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-CINyAkPw.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -7403,17 +7451,6 @@ function assertEvmTransactionMatchesWrite(transaction, context) {
     }
 }
 
-var __rest$1 = (undefined && undefined.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
 /**
  * Thrown when a user's wallet doesn't have enough SOL to cover the transaction.
  * Apps can catch this to trigger an onramp/funding flow.
@@ -7991,7 +8028,11 @@ async function get(path, opts = {}) {
                 }
                 else {
                     const path = encodeURIComponent(normalizedPath);
-                    const promptQueryParam = (opts === null || opts === void 0 ? void 0 : opts.prompt) ? `&prompt=${safeBtoa(opts.prompt)}` : "";
+                    // encodeURIComponent the base64: safeBtoa emits standard base64 (with '+' '/' '='),
+                    // and a raw '+' in a query string decodes to a space on the server
+                    // (url.searchParams.get), corrupting the exact non-ASCII prompts DS2-0463 fixed. The
+                    // server percent-decodes back to the original base64 before decodeUtf8Base64. (DS2-0463)
+                    const promptQueryParam = (opts === null || opts === void 0 ? void 0 : opts.prompt) ? `&prompt=${encodeURIComponent(safeBtoa(opts.prompt))}` : "";
                     const apiPath = `items?path=${path}${promptQueryParam}${filterParam}${sortParam}${includeSubPathsParam}${shapeParam}${limitParam}${cursorParam}`;
                     response = await makeApiRequest('GET', apiPath, null, opts._overrides);
                 }
@@ -8332,20 +8373,200 @@ async function runExpressionMany(many) {
         throw error;
     }
 }
+/* ===================== WRITE RECEIPT HELPERS (W4) ======================== */
+/**
+ * Settle delay before the best-effort mirror read on an on-chain write. It is
+ * an optimization, not a correctness guarantee: the receipt is captured first
+ * and returned regardless of what the mirror read reports.
+ */
+const MIRROR_SYNC_SETTLE_MS = 1500;
+const SOLANA_CHAIN_TAGS = new Set(['solana_devnet', 'solana_mainnet']);
+/**
+ * Read the execution-lane tag the WORKER reported. The SDK never infers it: a
+ * batch touching only unflagged collections in a `realtime_devnet` app commits
+ * offchain, so the app's protocol is not the lane. Several field names are
+ * accepted (batch-level receipt first, then the per-transaction Solana
+ * `network` tag that predates it), but no value is ever manufactured.
+ */
+function readWorkerChainTag(...sources) {
+    for (const source of sources) {
+        if (!source || typeof source !== 'object')
+            continue;
+        for (const key of ['chain', 'executionChain', 'network']) {
+            const value = source[key];
+            if (typeof value === 'string' && value.trim().length > 0)
+                return value.trim();
+        }
+    }
+    return null;
+}
+/** Path-keyed echo of what the caller asked for. NEVER authoritative state. */
+function buildRequestedDocuments(documents) {
+    return documents.map(entry => {
+        var _a;
+        return ({
+            path: entry.destinationPath,
+            document: ((_a = entry.document) !== null && _a !== void 0 ? _a : null),
+        });
+    });
+}
+/** Look a concrete path up in a path-keyed map, tolerating a leading slash. */
+function pickPathDocument(source, path) {
+    if (Object.prototype.hasOwnProperty.call(source, path))
+        return source[path];
+    const withSlash = path.startsWith('/') ? path : `/${path}`;
+    if (Object.prototype.hasOwnProperty.call(source, withSlash))
+        return source[withSlash];
+    const withoutSlash = path.startsWith('/') ? path.slice(1) : path;
+    if (Object.prototype.hasOwnProperty.call(source, withoutSlash))
+        return source[withoutSlash];
+    return undefined;
+}
+/**
+ * `observed: true` only when EVERY requested concrete path was read back as a
+ * real document. The sync endpoint answers `null` for a document that is
+ * absent, lagging, or read-denied, and a deleted path reads back as `null` too
+ * — none of those are evidence of synchronization.
+ */
+function validatePathKeyedDocuments(paths, source) {
+    if (!source || typeof source !== 'object' || Array.isArray(source)) {
+        return { observed: false, reason: 'the synchronization response was not a path-keyed document map' };
+    }
+    const map = source;
+    const documents = [];
+    const unobserved = [];
+    for (const path of paths) {
+        const document = pickPathDocument(map, path);
+        if (document == null || typeof document !== 'object' || Array.isArray(document)) {
+            unobserved.push(path);
+            documents.push({ path, document: null });
+            continue;
+        }
+        documents.push({ path, document: document });
+    }
+    if (unobserved.length > 0) {
+        return {
+            observed: false,
+            reason: `no readable document was returned for ${unobserved.join(', ')} ` +
+                '(absent, deleted, lagging, read-denied, or a passthrough write)',
+        };
+    }
+    return { observed: true, documents };
+}
+/**
+ * Best-effort mirror read. A confirmed transaction must NEVER be lost to a
+ * synchronization failure, so this reports its outcome in `mirrorSync` and
+ * never rejects. It reads the CONCRETE destination paths, so a collection
+ * insert with a generated id syncs the path that actually exists.
+ */
+async function attemptMirrorSync(paths, options, settleMs = MIRROR_SYNC_SETTLE_MS) {
+    try {
+        if (settleMs > 0)
+            await new Promise(resolve => setTimeout(resolve, settleMs));
+        const synced = await syncItems(paths, options);
+        // The sync endpoint answers `{ data: <path-keyed map>, status }`; a document
+        // path always contains a `/`, so a top-level `data` key is never one.
+        const map = (synced && typeof synced === 'object' && !Array.isArray(synced) && 'data' in synced)
+            ? synced.data
+            : synced;
+        return validatePathKeyedDocuments(paths, map);
+    }
+    catch (error) {
+        const message = typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' ? error.message : String(error);
+        return { observed: false, reason: `mirror synchronization failed: ${message}` };
+    }
+}
+function normalizePathKey(path) {
+    return path.startsWith('/') ? path.slice(1) : path;
+}
+/**
+ * Post-hook observation for a DIRECT commit, taken from the worker's own batch
+ * receipt. The worker is the only party that can read every concrete path back
+ * AFTER hooks have run, so when it reports nothing we say so rather than
+ * echoing the request as if it were server state.
+ *
+ * Unlike the mirror read, a `null` document here IS authoritative: the worker
+ * read its own store, so a deleted path genuinely is absent. The worker's
+ * `observed` verdict is still re-validated against the requested paths — a
+ * receipt that skips one of them cannot be treated as complete.
+ */
+function observationFromDirectCommit(paths, observation) {
+    var _a;
+    if (!observation || typeof observation !== 'object' || Array.isArray(observation)) {
+        return { observed: false, reason: 'the write receipt carried no post-hook observation' };
+    }
+    const entries = Array.isArray(observation.documents) ? observation.documents : null;
+    if (!entries) {
+        return { observed: false, reason: 'the write receipt carried no path-keyed post-hook documents' };
+    }
+    const byPath = new Map();
+    for (const entry of entries) {
+        if (!entry || typeof entry.path !== 'string')
+            continue;
+        const document = entry.document;
+        byPath.set(normalizePathKey(entry.path), (document && typeof document === 'object' && !Array.isArray(document))
+            ? document
+            : null);
+    }
+    const documents = [];
+    const missing = [];
+    for (const path of paths) {
+        const key = normalizePathKey(path);
+        if (!byPath.has(key)) {
+            missing.push(path);
+            documents.push({ path, document: null });
+            continue;
+        }
+        documents.push({ path, document: (_a = byPath.get(key)) !== null && _a !== void 0 ? _a : null });
+    }
+    if (observation.observed !== true || missing.length > 0) {
+        const unobserved = Array.isArray(observation.unobserved) ? observation.unobserved : [];
+        const reasons = [
+            ...unobserved
+                .filter((entry) => entry && typeof entry.path === 'string')
+                .map((entry) => { var _a; return `${entry.path}: ${(_a = entry.reason) !== null && _a !== void 0 ? _a : 'not observable'}`; }),
+            ...missing.map(path => `${path}: no entry in the receipt observation`),
+        ];
+        return {
+            observed: false,
+            reason: reasons.length > 0
+                ? reasons.join('; ')
+                : 'the worker could not read every requested path back after hooks',
+        };
+    }
+    return { observed: true, documents };
+}
 /**
  * Write a document at `path`. Sugar for a one-element {@link setMany}.
  *
  * **Delete:** pass `null` as the document to delete it — `set(path, null)` is
  * the delete (there is no separate `del`/`remove`). It is routed through the
- * collection's policy `delete` rule and broadcasts a delete to subscribers.
+ * collection's policy `delete` rule and broadcasts a delete to subscribers, and
+ * the deleted entry surfaces as a `null` document under its path.
+ *
+ * Resolves to a discriminated {@link SetResult}; discriminate on `status`.
  */
 async function set(path, document, options) {
     // setMany already invalidates the read cache for the affected document and
     // collection paths — no second sweep needed here.
     return setMany([{ path, document }], options);
 }
+/**
+ * Atomically write (or delete, with a `null` document) a batch of documents.
+ *
+ * Resolves to a discriminated {@link SetResult}:
+ * - `committed` — the worker applied the batch directly.
+ * - `confirmed` — a client-signed chain transaction landed successfully.
+ * - `submitted` — broadcast happened but the outcome is unknown. NEVER
+ *   resubmit; call `reconcileSetResult`/`waitForSetResult` on the receipt.
+ * - `expired_not_landed` — Solana only, and the one retry-safe terminal state.
+ * - `signed` — `shouldSubmitTx: false`; signed and deliberately not sent.
+ *
+ * `requestedDocuments` is always the caller's own echo; authoritative server
+ * state appears only under `observation`/`mirrorSync` once actually observed.
+ */
 async function setMany(many, options) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p;
     // Returns the data that was set, or undefined if the document was already set.
     try {
         // A server WalletClient threads its immutable config snapshot; the default
@@ -8427,8 +8648,17 @@ async function setMany(many, options) {
                 (hasSerializedSolanaTarget && hasBuiltSolanaTarget)) {
                 throw new Error('Ambiguous on-chain write response mixes EVM and/or Solana transaction target formats');
             }
-            let transactionResult;
             const expectedWritePaths = documents.map(d => d.destinationPath);
+            const requestedDocuments = buildRequestedDocuments(documents);
+            const appId = config.appId;
+            // The lane comes verbatim from the worker, and is read BEFORE anything is
+            // signed or submitted: a missing tag fails closed while nothing has been
+            // broadcast, instead of stranding a landed transaction with no receipt.
+            const workerChain = readWorkerChainTag((_k = setResponse.data) === null || _k === void 0 ? void 0 : _k.receipt, setResponse.data, curTx);
+            if (!workerChain) {
+                throw new Error('The write response carried no execution-chain tag, so this receipt could not state where the write ran. ' +
+                    'Nothing was signed or submitted.');
+            }
             // EVM onchain write: the worker returns a PRE-BUILT EIP-1559 tx on
             // `transactions[0].evmTransaction` (the EVM twin of Solana's pre-built
             // `serializedTransaction`). WORKER 202 CONTRACT (field name + shape the
@@ -8443,41 +8673,110 @@ async function setMany(many, options) {
                 assertEvmTransactionMatchesWrite(curTx.evmTransaction, {
                     appId: config.appId,
                     documents,
-                    policy: (_m = (_l = (_k = options === null || options === void 0 ? void 0 : options._overrides) === null || _k === void 0 ? void 0 : _k._evmTransactionPolicy) !== null && _l !== void 0 ? _l : config.evmWalletConfig) !== null && _m !== void 0 ? _m : null,
+                    policy: (_o = (_m = (_l = options === null || options === void 0 ? void 0 : options._overrides) === null || _l === void 0 ? void 0 : _l._evmTransactionPolicy) !== null && _m !== void 0 ? _m : config.evmWalletConfig) !== null && _o !== void 0 ? _o : null,
                 });
-                transactionResult = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
+                const evmChain = workerChain;
+                const evmOutcome = await handleEvmTransaction(curTx.evmTransaction, authProvider, options);
+                // CAPTURE THE RECEIPT FIRST. Mirror synchronization comes after, and its
+                // failure can never turn a landed transaction into a thrown error that
+                // invites the caller to submit the same write twice.
+                if (evmOutcome.outcome === 'confirmed') {
+                    const mirrorSync = await attemptMirrorSync(expectedWritePaths, options);
+                    return {
+                        status: 'confirmed', appId, requestedDocuments, chain: evmChain,
+                        transactionId: evmOutcome.transactionSignature,
+                        blockNumber: evmOutcome.blockNumber,
+                        mirrorSync,
+                    };
+                }
+                // An unknown confirmation outcome is NOT a mirror question: nothing is
+                // known to have landed, so no synchronization is attempted.
+                if (evmOutcome.transactionSignature === null) {
+                    return {
+                        status: 'submitted', appId, requestedDocuments, chain: evmChain,
+                        transactionId: null,
+                        confirmation: { state: 'unknown', reason: evmOutcome.reason, reconcilable: false },
+                    };
+                }
+                if ('fence' in evmOutcome && evmOutcome.fence) {
+                    return {
+                        status: 'submitted', appId, requestedDocuments, chain: evmChain,
+                        transactionId: evmOutcome.transactionSignature,
+                        fence: evmOutcome.fence,
+                        confirmation: { state: 'unknown', reason: evmOutcome.reason },
+                    };
+                }
+                return {
+                    status: 'submitted', appId, requestedDocuments, chain: evmChain,
+                    transactionId: evmOutcome.transactionSignature,
+                    rebroadcastable: false,
+                    confirmation: { state: 'unknown', reason: evmOutcome.reason },
+                };
             }
             else if (curTx.serializedTransaction) {
-                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-CYpu6EU8.js'); });
-                transactionResult = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
+                if (!SOLANA_CHAIN_TAGS.has(workerChain)) {
+                    throw new Error(`The write response reported execution chain "${workerChain}" for a Solana transaction. ` +
+                        'Nothing was signed or submitted.');
+                }
+                const solanaChain = workerChain;
+                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-Dm_4VnlB.js'); });
+                const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
+                // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
+                // and there is nothing to mirror, so no synchronization is attempted.
+                if (solanaOutcome.outcome === 'signed') {
+                    return {
+                        status: 'signed', appId, requestedDocuments, chain: solanaChain,
+                        transactionId: null,
+                        signedTransaction: solanaOutcome.signedTransaction,
+                        fence: solanaOutcome.fence,
+                    };
+                }
+                if (solanaOutcome.outcome === 'submitted') {
+                    return {
+                        status: 'submitted', appId, requestedDocuments, chain: solanaChain,
+                        transactionId: solanaOutcome.transactionSignature,
+                        signedTransaction: solanaOutcome.signedTransaction,
+                        fence: solanaOutcome.fence,
+                        confirmation: { state: 'unknown', reason: solanaOutcome.reason },
+                    };
+                }
+                // Confirmed: the receipt is already complete, so the mirror read is a
+                // best-effort enrichment reported in `mirrorSync`, never a rejection.
+                const mirrorSync = await attemptMirrorSync(expectedWritePaths, options);
+                return {
+                    status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
+                    transactionId: solanaOutcome.transactionSignature,
+                    signedTransaction: solanaOutcome.signedTransaction,
+                    fence: solanaOutcome.fence,
+                    confirmationContextSlot: solanaOutcome.confirmationContextSlot,
+                    mirrorSync,
+                };
             }
             else {
                 throw new Error('Unsupported 202 transaction shape: expected serializedTransaction or evmTransaction');
             }
-            // Sync items after all transactions are confirmed
-            // Wait for 1.5 seconds to ensure all transactions are confirmed
-            await new Promise(resolve => setTimeout(resolve, 1500));
-            await syncItems(many.map(m => m.path), options);
-            // TODO: Should we wait here or do the optimistic subscription updates like below?
-            return Object.assign(Object.assign({}, documents.map(d => d.document)), { transactionId: transactionResult.transactionSignature, signedTransaction: transactionResult.signedTransaction });
         }
         else if (setResponse.status === 200) {
-            // This means that the document was set successfully.
-            // TODO: If we're able to be smarter about it, we can return the document here, and get it back from the server
-            // rather than just using what we set.
-            // TODO: We can also trigger subscriptions here maybe? Can even recall all relevant subscriptions here.
-            if (setResponse.data === true) {
-                return Object.assign(Object.assign({}, documents.map(d => d.document)), { transactionId: null });
-            }
-            else if (setResponse.data &&
-                typeof setResponse.data === 'object' &&
-                setResponse.data.success === true) {
-                const _o = setResponse.data, { success: _success } = _o, rest = __rest$1(_o, ["success"]);
-                return Object.assign(Object.assign(Object.assign({}, documents.map(d => d.document)), rest), { transactionId: null });
-            }
-            else {
-                return Object.assign(Object.assign({}, setResponse.data), { transactionId: null });
-            }
+            // Direct commit: the worker applied the batch itself. The receipt is
+            // batch-level — `transactionId` comes from the worker's own receipt and is
+            // NEVER lifted out of a result document (a delete returns the PREVIOUS
+            // document, so its stale `_transaction_hash` would misreport the delete).
+            const body = (setResponse.data && typeof setResponse.data === 'object' && !Array.isArray(setResponse.data))
+                ? setResponse.data
+                : null;
+            const receipt = ((body === null || body === void 0 ? void 0 : body.receipt) && typeof body.receipt === 'object' && !Array.isArray(body.receipt))
+                ? body.receipt
+                : null;
+            const rawTransactionId = receipt === null || receipt === void 0 ? void 0 : receipt.transactionId;
+            return {
+                status: 'committed',
+                requestedDocuments: buildRequestedDocuments(documents),
+                observation: observationFromDirectCommit(documents.map(d => d.destinationPath), receipt === null || receipt === void 0 ? void 0 : receipt.observation),
+                // A worker predating the batch receipt reports no lane. Say so rather
+                // than inventing one — and never discard a committed write's receipt.
+                chain: ((_p = readWorkerChainTag(receipt)) !== null && _p !== void 0 ? _p : 'unknown'),
+                transactionId: typeof rawTransactionId === 'string' && rawTransactionId.length > 0 ? rawTransactionId : null,
+            };
         }
         else {
             throw new Error(`Failed to set document: ${setResponse}`);
@@ -8492,7 +8791,11 @@ async function setMany(many, options) {
     // slot of runTransaction (Solana slot undefined). shouldSubmitTx is honored by
     // the provider itself.
     async function handleEvmTransaction(evmTransaction, authProvider, options) {
-        return authProvider.runTransaction(evmTransaction, undefined, options);
+        const result = await authProvider.runTransaction(evmTransaction, undefined, options);
+        if ((result === null || result === void 0 ? void 0 : result.lane) !== 'evm') {
+            throw new Error('The EVM auth provider returned a non-EVM transaction outcome');
+        }
+        return result;
     }
 }
 /**
@@ -8572,8 +8875,27 @@ async function getFiles(path, options) {
         throw error;
     }
 }
+/** Pull the worker's concrete object path (`token.pathId`) out of a response body. */
+function readWorkerFilePath(source) {
+    if (!source || typeof source !== 'object')
+        return null;
+    for (const key of ['pathId', 'path', 'destinationPath']) {
+        const value = source[key];
+        if (typeof value === 'string' && value.trim().length > 0)
+            return value.trim();
+    }
+    return null;
+}
+function readFileVisibility(source) {
+    const value = (source && typeof source === 'object') ? source.visibility : undefined;
+    if (value === 'public' || value === 'private' || value === 'unknown')
+        return value;
+    // The worker did not state it, so neither do we. `unknown` never means the
+    // object is private — it means the read-rule evaluation was not reported.
+    return 'unknown';
+}
 async function setFile(path, file, options) {
-    var _a;
+    var _a, _b, _c, _d;
     // 1) Get the presigned URL from your backend
     const requestBody = {
         destinationPath: path,
@@ -8590,10 +8912,18 @@ async function setFile(path, file, options) {
         }
     }
     const response = await makeApiRequest('POST', 'storage/url', requestBody, options === null || options === void 0 ? void 0 : options._overrides);
+    const normalizedPath = path.startsWith('/') ? path.slice(1) : path;
     if (file == null) {
-        return true;
+        // A deletion is acknowledged only by a non-404 response. `makeApiRequest`
+        // normalizes 404 into `{ data: null, status: 404 }` rather than throwing, so
+        // the status has to be inspected.
+        const deletePath = (_a = readWorkerFilePath(response === null || response === void 0 ? void 0 : response.data)) !== null && _a !== void 0 ? _a : normalizedPath;
+        if ((response === null || response === void 0 ? void 0 : response.status) === 404) {
+            return { path: deletePath, deleted: false, alreadyAbsent: true };
+        }
+        return { path: deletePath, deleted: true };
     }
-    if (!((_a = response === null || response === void 0 ? void 0 : response.data) === null || _a === void 0 ? void 0 : _a.s3Url)) {
+    if (!((_b = response === null || response === void 0 ? void 0 : response.data) === null || _b === void 0 ? void 0 : _b.s3Url)) {
         throw new Error("No s3Url in response");
     }
     // Client-side size guard using the limit returned by the server
@@ -8602,20 +8932,62 @@ async function setFile(path, file, options) {
         throw new Error(`File size ${(file.size / (1024 * 1024)).toFixed(2)} MB exceeds the maximum upload size of ${(maxFileSize / (1024 * 1024)).toFixed(0)} MB.`);
     }
     const presignedUrl = response.data.s3Url;
-    // 2) Upload the file directly to S3 with a PUT request
-    const uploadResponse = await fetch(presignedUrl, {
-        method: 'PUT',
-        headers: {
-            'Content-Type': file.type,
-        },
-        body: file
-    });
-    // 3) Check if the upload was successful
+    // Retain the CONCRETE path BEFORE the PUT. Storage generates a collection
+    // upload's id server-side, so `setFile("metadata", file)` creates
+    // `metadata/<generated-id>`; if the commit succeeds and only its response is
+    // lost, this is the only identifier the object has.
+    const retainedPath = (_c = readWorkerFilePath(response.data)) !== null && _c !== void 0 ? _c : normalizedPath;
+    // 2) Upload the file directly to storage with a PUT request
+    let uploadResponse;
+    try {
+        uploadResponse = await fetch(presignedUrl, {
+            method: 'PUT',
+            headers: {
+                'Content-Type': file.type,
+            },
+            body: file
+        });
+    }
+    catch (error) {
+        // The transport itself failed, so we do not know whether the object
+        // committed. This is NOT a definite failure and NOT retry-safe.
+        const message = typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' ? error.message : String(error);
+        return {
+            status: 'unknown',
+            path: retainedPath,
+            reason: `the upload response was lost before it could be read: ${message}`,
+            retrySafe: false,
+        };
+    }
+    // 3) A non-2xx answer is a definite, unambiguous failure — keep throwing.
     if (!uploadResponse.ok) {
-        await uploadResponse.text();
+        await uploadResponse.text().catch(() => '');
         throw new Error(`Upload failed with status: ${uploadResponse.status}`);
     }
-    return true;
+    // 4) The PUT response IS the finalize response: it carries the durable URL
+    //    and the anonymous-read verdict, inside the worker's `{ data, status }`
+    //    envelope.
+    let finalizeBody = null;
+    try {
+        const parsed = await uploadResponse.json();
+        finalizeBody = (parsed && typeof parsed === 'object' && parsed.data && typeof parsed.data === 'object')
+            ? parsed.data
+            : parsed;
+    }
+    catch (_e) {
+        // A worker predating the URL-carrying finalize response answers with
+        // something we cannot parse. The object still committed.
+        finalizeBody = null;
+    }
+    const url = (finalizeBody && typeof finalizeBody.url === 'string' && finalizeBody.url.length > 0)
+        ? finalizeBody.url
+        : null;
+    return {
+        status: 'uploaded',
+        path: (_d = readWorkerFilePath(finalizeBody)) !== null && _d !== void 0 ? _d : retainedPath,
+        url,
+        visibility: readFileVisibility(finalizeBody),
+    };
 }
 async function signMessage(message) {
     const config = await getConfig();
@@ -8652,6 +9024,7 @@ var operations = /*#__PURE__*/Object.freeze({
     __proto__: null,
     InsufficientBalanceError: InsufficientBalanceError,
     aggregate: aggregate,
+    attemptMirrorSync: attemptMirrorSync,
     clearReadCacheForAuthChange: clearReadCacheForAuthChange,
     count: count,
     docId: docId,
@@ -8674,6 +9047,341 @@ var operations = /*#__PURE__*/Object.freeze({
     syncItems: syncItems
 });
 
+const DEFAULT_TIMEOUT_MS = 60000;
+const DEFAULT_MAX_ATTEMPTS = 20;
+const DEFAULT_POLL_INTERVAL_MS = 3000;
+const DEFAULT_MIN_REBROADCAST_INTERVAL_MS = 15000;
+/** Mirror read after a late confirmation. No settle delay: the tx already landed. */
+const RECONCILE_MIRROR_SETTLE_MS = 0;
+function errorText(error) {
+    const message = error === null || error === void 0 ? void 0 : error.message;
+    return typeof message === 'string' && message.length > 0 ? message : String(error);
+}
+function isSolanaSubmitted(receipt) {
+    return receipt.status === 'submitted' && 'signedTransaction' in receipt;
+}
+function isEvmFencedSubmitted(receipt) {
+    return receipt.status === 'submitted' && 'fence' in receipt && !('signedTransaction' in receipt);
+}
+function isEvmHashKnownSubmitted(receipt) {
+    return receipt.status === 'submitted' && receipt.rebroadcastable === false;
+}
+/**
+ * The Solana execution lane a client config REQUIRES, or `null` when the config
+ * carries no constraint. Only a positive contradiction rejects a receipt — an
+ * unmapped or unset `chain` is not evidence of a mismatch.
+ */
+function requiredSolanaChain(config) {
+    switch (config.chain) {
+        case 'realtime_devnet':
+        case 'solana_devnet':
+            return 'solana_devnet';
+        case 'realtime_mainnet':
+        case 'realtime_mainnet_preview':
+        case 'solana_mainnet':
+            return 'solana_mainnet';
+        default:
+            return null;
+    }
+}
+/**
+ * Bind the receipt to the app + chain it was issued for BEFORE any RPC or
+ * mirror request. Writes bind to an immutable config, so a bare reconcile after
+ * a global re-`init()` could otherwise poll the wrong app's endpoints entirely.
+ */
+function assertReceiptMatchesContext(receipt, config) {
+    var _a;
+    if (!receipt.appId || typeof receipt.appId !== 'string') {
+        throw new Error('This write receipt carries no appId and cannot be reconciled.');
+    }
+    if (receipt.appId !== config.appId) {
+        throw new Error(`This write receipt was issued for app "${receipt.appId}" but the bound client targets "${config.appId}". ` +
+            'Reconcile it through the client it came from.');
+    }
+    if (isSolanaSubmitted(receipt)) {
+        const required = requiredSolanaChain(config);
+        if (required && required !== receipt.chain) {
+            throw new Error(`This write receipt ran on "${receipt.chain}" but the bound client targets "${required}".`);
+        }
+        return;
+    }
+    const fence = receipt.fence;
+    if (fence && typeof fence.chainId === 'number') {
+        const evm = config.evmWalletConfig;
+        const configured = new Set();
+        if (evm && typeof evm.chainId === 'number')
+            configured.add(evm.chainId);
+        for (const id of Object.keys((_a = evm === null || evm === void 0 ? void 0 : evm.runtimeAddresses) !== null && _a !== void 0 ? _a : {})) {
+            const parsed = Number(id);
+            if (Number.isSafeInteger(parsed))
+                configured.add(parsed);
+        }
+        if (configured.size > 0 && !configured.has(fence.chainId)) {
+            throw new Error(`This write receipt ran on EVM chain ${fence.chainId}, which the bound client does not configure.`);
+        }
+    }
+}
+function stillSubmitted(receipt, reason) {
+    return Object.assign(Object.assign({}, receipt), { confirmation: Object.assign(Object.assign({}, receipt.confirmation), { reason }) });
+}
+async function mirrorFor(receipt, options) {
+    const paths = receipt.requestedDocuments.map(entry => entry.path);
+    if (paths.length === 0)
+        return { observed: false, reason: 'the receipt carried no requested paths' };
+    const setOptions = (options === null || options === void 0 ? void 0 : options._overrides) ? { _overrides: options._overrides } : undefined;
+    return attemptMirrorSync(paths, setOptions, RECONCILE_MIRROR_SETTLE_MS);
+}
+async function resolveSolanaRpc(config, options) {
+    var _a, _b;
+    const injected = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._solanaRpc;
+    if (injected)
+        return injected;
+    const rpcUrl = (_b = config.rpcUrl) === null || _b === void 0 ? void 0 : _b.trim();
+    if (!rpcUrl) {
+        throw new Error('Reconciling a Solana write receipt requires init({ rpcUrl }).');
+    }
+    const { Connection } = await import('@solana/web3.js');
+    return new Connection(rpcUrl, 'confirmed');
+}
+/**
+ * Solana reconciliation NEVER broadcasts. It reaches `expired_not_landed` only
+ * after the fence is observed expired AND history successfully proves the
+ * signature is absent; a failed or inconclusive lookup stays `submitted`.
+ */
+async function reconcileSolana(receipt, config, options) {
+    var _a, _b, _c, _d;
+    const rpc = await resolveSolanaRpc(config, options);
+    let statusValue = null;
+    let contextSlot;
+    try {
+        if (typeof rpc.getSignatureStatuses !== 'function') {
+            return stillSubmitted(receipt, 'the configured Solana RPC cannot report signature statuses');
+        }
+        const statuses = await rpc.getSignatureStatuses([receipt.transactionId]);
+        statusValue = (_b = (_a = statuses === null || statuses === void 0 ? void 0 : statuses.value) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : null;
+        contextSlot = (_c = statuses === null || statuses === void 0 ? void 0 : statuses.context) === null || _c === void 0 ? void 0 : _c.slot;
+    }
+    catch (error) {
+        return stillSubmitted(receipt, `signature status lookup failed: ${errorText(error)}`);
+    }
+    if (statusValue) {
+        // Landed. A landed-but-failed transaction is a genuine failure, not `submitted`.
+        if (statusValue.err) {
+            throw new Error(`Transaction failed: ${JSON.stringify(statusValue.err)}`);
+        }
+        const confirmed = {
+            status: 'confirmed',
+            appId: receipt.appId,
+            requestedDocuments: receipt.requestedDocuments,
+            chain: receipt.chain,
+            transactionId: receipt.transactionId,
+            signedTransaction: receipt.signedTransaction,
+            fence: receipt.fence,
+            confirmationContextSlot: contextSlot !== null && contextSlot !== void 0 ? contextSlot : 0,
+            mirrorSync: await mirrorFor(receipt, options),
+        };
+        return confirmed;
+    }
+    // Absent from the status window. Expiry has to be OBSERVED before absence can
+    // mean anything: before the fence expires the transaction may still land.
+    let blockHeight;
+    try {
+        blockHeight = typeof rpc.getBlockHeight === 'function' ? await rpc.getBlockHeight('confirmed') : undefined;
+    }
+    catch (error) {
+        return stillSubmitted(receipt, `block height lookup failed: ${errorText(error)}`);
+    }
+    if (typeof blockHeight !== 'number') {
+        return stillSubmitted(receipt, 'expiry could not be observed: the RPC reported no block height');
+    }
+    if (blockHeight <= receipt.fence.lastValidBlockHeight) {
+        return stillSubmitted(receipt, `not yet expired: block height ${blockHeight} is within the fence (lastValidBlockHeight ${receipt.fence.lastValidBlockHeight})`);
+    }
+    // Expired. Prove absence from history before declaring the write retry-safe.
+    let history;
+    try {
+        history = await rpc.getTransaction(receipt.transactionId, {
+            maxSupportedTransactionVersion: 0,
+            commitment: 'confirmed',
+        });
+    }
+    catch (error) {
+        return stillSubmitted(receipt, `history lookup failed after expiry: ${errorText(error)}`);
+    }
+    if (history) {
+        if ((_d = history === null || history === void 0 ? void 0 : history.meta) === null || _d === void 0 ? void 0 : _d.err) {
+            throw new Error(`Transaction failed: ${JSON.stringify(history.meta.err)}`);
+        }
+        const confirmed = {
+            status: 'confirmed',
+            appId: receipt.appId,
+            requestedDocuments: receipt.requestedDocuments,
+            chain: receipt.chain,
+            transactionId: receipt.transactionId,
+            signedTransaction: receipt.signedTransaction,
+            fence: receipt.fence,
+            confirmationContextSlot: typeof history.slot === 'number' ? history.slot : (contextSlot !== null && contextSlot !== void 0 ? contextSlot : 0),
+            mirrorSync: await mirrorFor(receipt, options),
+        };
+        return confirmed;
+    }
+    return {
+        status: 'expired_not_landed',
+        appId: receipt.appId,
+        requestedDocuments: receipt.requestedDocuments,
+        chain: receipt.chain,
+        transactionId: receipt.transactionId,
+        fence: receipt.fence,
+    };
+}
+/**
+ * EVM reconciliation runs through the provider's own transport, so a wallet
+ * client reconciles with its own identity and RPC. There is deliberately NO
+ * EVM retry-safe terminal state: nonce advancement is not proof the write did
+ * not execute, and plain JSON-RPC offers no transaction-by-sender-and-nonce
+ * lookup, so a `submitted` EVM receipt either confirms or stays `submitted`.
+ */
+async function reconcileEvm(receipt, provider, options) {
+    if (!provider || typeof provider.reconcileEvmTransaction !== 'function') {
+        return stillSubmitted(receipt, 'no EVM reconciliation transport is available on the bound auth provider');
+    }
+    const fenced = isEvmFencedSubmitted(receipt) ? receipt.fence : undefined;
+    const allowRebroadcast = Boolean(fenced) && (options === null || options === void 0 ? void 0 : options.allowRebroadcast) !== false;
+    let outcome;
+    try {
+        outcome = await provider.reconcileEvmTransaction({
+            transactionHash: receipt.transactionId,
+            fence: fenced,
+            allowRebroadcast,
+        });
+    }
+    catch (error) {
+        return stillSubmitted(receipt, `EVM reconciliation failed: ${errorText(error)}`);
+    }
+    if (outcome.state === 'failed') {
+        // Landed and reverted: a genuine failure, never `submitted`.
+        throw new Error(outcome.reason);
+    }
+    if (outcome.state === 'confirmed') {
+        if (typeof outcome.blockNumber !== 'number') {
+            return stillSubmitted(receipt, 'the EVM receipt reported success without a block number, so confirmation could not be stated');
+        }
+        const confirmed = {
+            status: 'confirmed',
+            appId: receipt.appId,
+            requestedDocuments: receipt.requestedDocuments,
+            chain: receipt.chain,
+            transactionId: receipt.transactionId,
+            blockNumber: outcome.blockNumber,
+            mirrorSync: await mirrorFor(receipt, options),
+        };
+        return confirmed;
+    }
+    if (outcome.state === 'absent_after_expiry') {
+        // Defensive: no EVM lane may report a retry-safe terminal state.
+        return stillSubmitted(receipt, 'the EVM transport reported absence, which is not proof an EVM write did not execute');
+    }
+    return stillSubmitted(receipt, outcome.reason);
+}
+/**
+ * Poll the SAME signature/hash a `submitted` receipt carries and return the
+ * resulting `SetResult`.
+ *
+ * - Terminal receipts (`committed`, `confirmed`, `expired_not_landed`,
+ *   `signed`) are returned unchanged; nothing was left open.
+ * - An irreconcilable injected-wallet receipt (`transactionId: null`) is
+ *   rejected immediately: no identifier exists to poll.
+ * - A transaction that landed and FAILED throws, exactly as it would have on
+ *   the original write.
+ */
+async function reconcileSetResult(receipt, options) {
+    var _a, _b, _c, _d, _e;
+    if (!receipt || typeof receipt !== 'object' || typeof receipt.status !== 'string') {
+        throw new Error('reconcileSetResult requires a write receipt returned by set/setMany.');
+    }
+    if (receipt.status !== 'submitted')
+        return receipt;
+    if (receipt.transactionId === null) {
+        throw new Error('This receipt is explicitly irreconcilable: the wallet send response was lost, so no transaction hash exists to poll. ' +
+            'Resolve it out of band — resubmitting could execute the write twice.');
+    }
+    const config = (_b = (_a = options === null || options === void 0 ? void 0 : options._overrides) === null || _a === void 0 ? void 0 : _a._config) !== null && _b !== void 0 ? _b : await getConfig();
+    // Validation happens BEFORE any RPC or mirror request.
+    assertReceiptMatchesContext(receipt, config);
+    if (isSolanaSubmitted(receipt)) {
+        return reconcileSolana(receipt, config, options);
+    }
+    const provider = (_e = (_d = (_c = options === null || options === void 0 ? void 0 : options._overrides) === null || _c === void 0 ? void 0 : _c.authProvider) !== null && _d !== void 0 ? _d : config.authProvider) !== null && _e !== void 0 ? _e : null;
+    if (isEvmFencedSubmitted(receipt) || isEvmHashKnownSubmitted(receipt)) {
+        return reconcileEvm(receipt, provider, options);
+    }
+    return stillSubmitted(receipt, 'this receipt shape has no reconciliation lane');
+}
+/**
+ * Reconcile repeatedly until the receipt leaves `submitted` or the bound is hit.
+ *
+ * The bound is mandatory, because some states are permanently non-terminal by
+ * design: an unidentified nonce consumer or a permanently underpriced EVM
+ * transaction never resolves. On exhaustion (or abort) this returns the LATEST
+ * `submitted` receipt with its identifier intact rather than hanging or
+ * throwing the identifier away.
+ */
+async function waitForSetResult(receipt, options) {
+    var _a, _b, _c, _d, _e;
+    if (receipt && typeof receipt === 'object' && receipt.status === 'submitted' && receipt.transactionId === null) {
+        // Rejected immediately rather than polled: there is nothing to poll.
+        return reconcileSetResult(receipt, options);
+    }
+    const timeoutMs = (_a = options === null || options === void 0 ? void 0 : options.timeoutMs) !== null && _a !== void 0 ? _a : DEFAULT_TIMEOUT_MS;
+    const maxAttempts = (_b = options === null || options === void 0 ? void 0 : options.maxAttempts) !== null && _b !== void 0 ? _b : DEFAULT_MAX_ATTEMPTS;
+    const pollIntervalMs = (_c = options === null || options === void 0 ? void 0 : options.pollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_POLL_INTERVAL_MS;
+    const minRebroadcastIntervalMs = (_d = options === null || options === void 0 ? void 0 : options.minRebroadcastIntervalMs) !== null && _d !== void 0 ? _d : DEFAULT_MIN_REBROADCAST_INTERVAL_MS;
+    const rebroadcastPermitted = (options === null || options === void 0 ? void 0 : options.allowRebroadcast) !== false;
+    const startedAt = Date.now();
+    let current = receipt;
+    let attempts = 0;
+    let lastRebroadcastAt = -Infinity;
+    while (attempts < maxAttempts && Date.now() - startedAt < timeoutMs) {
+        if ((_e = options === null || options === void 0 ? void 0 : options.signal) === null || _e === void 0 ? void 0 : _e.aborted)
+            return current;
+        const now = Date.now();
+        const allowRebroadcast = rebroadcastPermitted && (now - lastRebroadcastAt >= minRebroadcastIntervalMs);
+        if (allowRebroadcast)
+            lastRebroadcastAt = now;
+        attempts++;
+        current = await reconcileSetResult(current, Object.assign(Object.assign({}, options), { allowRebroadcast }));
+        if (current.status !== 'submitted')
+            return current;
+        if (attempts >= maxAttempts)
+            break;
+        const remaining = timeoutMs - (Date.now() - startedAt);
+        if (remaining <= 0)
+            break;
+        const slept = await sleepUnlessAborted(Math.min(pollIntervalMs, remaining), options === null || options === void 0 ? void 0 : options.signal);
+        if (!slept)
+            return current;
+    }
+    return current;
+}
+/** Resolves `false` when the signal aborted during (or before) the sleep. */
+function sleepUnlessAborted(ms, signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted)
+        return Promise.resolve(false);
+    if (!signal)
+        return new Promise(resolve => setTimeout(() => resolve(true), ms));
+    return new Promise(resolve => {
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(true);
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve(false);
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+
 /**
  * WebSocket Subscription Module
  *
@@ -9515,7 +10223,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-D_CN0H6r.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-Bycv-L5n.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -10044,6 +10752,7 @@ exports.normalizeEvmAddress = normalizeEvmAddress;
 exports.now = now;
 exports.onSessionCleared = onSessionCleared;
 exports.queryAggregate = queryAggregate;
+exports.reconcileSetResult = reconcileSetResult;
 exports.reconnectWithNewAuth = reconnectWithNewAuth;
 exports.refreshSession = refreshSession;
 exports.revokeSession = revokeSession;
@@ -10067,5 +10776,6 @@ exports.subscribeView = subscribeView;
 exports.toLowerEvmAddress = toLowerEvmAddress;
 exports.toMillis = toMillis;
 exports.toSeconds = toSeconds;
+exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
-//# sourceMappingURL=index-C8ocsC_W.js.map
+//# sourceMappingURL=index-DNZifL5j.js.map