@bounded-sh/core 0.0.71 → 0.0.73

package/dist/client/solana-operations.d.ts

@@ -11,9 +11,56 @@ import type { SetOptions } from './operations';
  */
 export declare function deriveTransactionSignature(signedTransaction: VersionedTransaction): string;
 export declare function isDefinitiveSolanaSendFailure(error: unknown): boolean;
+/**
+ * One expected field operation, derived from the caller's request document.
+ * `value`/`delta` are the JSON-round-tripped request values (what the server
+ * actually parsed), NOT the pre-serialization JS objects.
+ */
+export type ExpectedFieldOperation = {
+    key: string;
+    kind: 'write';
+    value: unknown;
+} | {
+    key: string;
+    kind: 'delete';
+} | {
+    key: string;
+    kind: 'timestamp';
+} | {
+    key: string;
+    kind: 'increment';
+    delta: number;
+};
+export interface ExpectedWriteIntent {
+    documents: Array<{
+        path: string;
+        operations: ExpectedFieldOperation[];
+    }>;
+    deletePaths: string[];
+}
+/**
+ * Build the expected write intent from the exact request the client POSTed
+ * (`[{ destinationPath, document }]`, a `null` document being a delete).
+ *
+ * Each document is JSON-round-tripped first: the server parsed the SERIALIZED
+ * body, so the intent must be derived from the same bytes - this drops
+ * `undefined` values, turns `NaN`/`Infinity` into `null`, and normalizes key
+ * order exactly as the server's JSON.parse did.
+ *
+ * Operation order mirrors the worker's transform (normalizeWriteBody ->
+ * resolveOperationFields -> documentToOperations): plain fields in request key
+ * order, then increment fields appended in the order they appeared. The
+ * comparison is therefore ORDERED, not a multiset - the honest builder is
+ * deterministic given the request, and ordering additionally catches
+ * duplicate-path and reordering tampering that the retired set comparison hid.
+ */
+export declare function buildExpectedWriteIntent(documents: Array<{
+    destinationPath: string;
+    document: any;
+}>): ExpectedWriteIntent;
 export declare function handlePreBuiltTransaction(tx: {
     serializedTransaction: string;
     blockhash: string;
     lastValidBlockHeight: number;
     network: string;
-}, authProvider: AuthProvider, options: SetOptions | undefined, expectedWritePaths: string[]): Promise<SolanaTransactionResult>;
+}, authProvider: AuthProvider, options: SetOptions | undefined, expectedIntent: ExpectedWriteIntent): Promise<SolanaTransactionResult>;

package/dist/{index-yT8ZfzrL.js → index-C9ezg0Ef.js}

@@ -4133,7 +4133,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-Dh9ryO-Y.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-Cam1-0wi.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -6901,7 +6901,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-BDpIOFMH.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-JPgBppmw.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8327,7 +8327,11 @@ async function setMany(many, options) {
             if (hasSerializedSolanaTarget && hasBuiltSolanaTarget) {
                 throw new Error('Ambiguous on-chain write response mixes Solana transaction target formats');
             }
-            const expectedWritePaths = documents.map(d => d.destinationPath);
+            // All requested paths (writes AND deletes), in request order. Used for the
+            // post-confirm mirror read-back, which correlates every requested path.
+            // The pre-sign validation derives its own full expected intent from
+            // `documents` (see below) and needs nothing from this list.
+            const requestedPaths = documents.map(d => d.destinationPath);
             const requestedDocuments = buildRequestedDocuments(documents);
             const appId = config.appId;
             // The lane comes verbatim from the worker, and is read BEFORE anything is
@@ -8344,8 +8348,13 @@ async function setMany(many, options) {
                         'Nothing was signed or submitted.');
                 }
                 const solanaChain = workerChain;
-                const { handlePreBuiltTransaction } = await Promise.resolve().then(function () { return require('./solana-operations-DGEGqFd9.js'); });
-                const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedWritePaths);
+                const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-DycSSUls.js'); });
+                // OA-0001: derive the expected intent from OUR OWN request (the one
+                // ground truth a tampered builder response cannot change) so the
+                // validator can reject any transaction whose operation semantics
+                // diverge from it BEFORE the wallet is asked to sign.
+                const expectedIntent = buildExpectedWriteIntent(documents);
+                const solanaOutcome = await handlePreBuiltTransaction(curTx, authProvider, options, expectedIntent);
                 // `shouldSubmitTx: false` signed WITHOUT sending — no signature exists,
                 // and there is nothing to mirror, so no synchronization is attempted.
                 if (solanaOutcome.outcome === 'signed') {
@@ -8367,7 +8376,7 @@ async function setMany(many, options) {
                 }
                 // Confirmed: the receipt is already complete, so the mirror read is a
                 // best-effort enrichment reported in `mirrorSync`, never a rejection.
-                const mirrorSync = await attemptMirrorSync(expectedWritePaths, options);
+                const mirrorSync = await attemptMirrorSync(requestedPaths, options);
                 return {
                     status: 'confirmed', appId, requestedDocuments, chain: solanaChain,
                     transactionId: solanaOutcome.transactionSignature,
@@ -9785,7 +9794,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-Dh9ryO-Y.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-Cam1-0wi.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -10346,4 +10355,4 @@ exports.toMillis = toMillis;
 exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
-//# sourceMappingURL=index-yT8ZfzrL.js.map
+//# sourceMappingURL=index-C9ezg0Ef.js.map