@bounded-sh/server 0.0.1

package/dist/index.js

@@ -0,0 +1,1058 @@
+'use strict';
+
+var core = require('@bounded-sh/core');
+var buffer = require('buffer');
+var web3_js = require('@solana/web3.js');
+var anchor = require('@coral-xyz/anchor');
+var nacl = require('tweetnacl');
+var bs58 = require('bs58');
+var crypto = require('crypto');
+
+function _interopNamespaceDefault(e) {
+    var n = Object.create(null);
+    if (e) {
+        Object.keys(e).forEach(function (k) {
+            if (k !== 'default') {
+                var d = Object.getOwnPropertyDescriptor(e, k);
+                Object.defineProperty(n, k, d.get ? d : {
+                    enumerable: true,
+                    get: function () { return e[k]; }
+                });
+            }
+        });
+    }
+    n.default = e;
+    return Object.freeze(n);
+}
+
+var anchor__namespace = /*#__PURE__*/_interopNamespaceDefault(anchor);
+var crypto__namespace = /*#__PURE__*/_interopNamespaceDefault(crypto);
+
+/* ------------------------------------------------------------- *
+ * KEYPAIR ENV-VAR (only consulted when no explicit keypair is given)
+ *
+ * Most code should pass a keypair explicitly — `createWalletClient({ keypair })`
+ * does. The env var is the fallback for the global `set/get` path. `BOUNDED_*`
+ * is the canonical name (it matches the CLI's `BOUNDED_PRIVATE_KEY`); the legacy
+ * `TAROBASE_SOLANA_KEYPAIR` is still honored so existing setups keep working.
+ * ------------------------------------------------------------- */
+const ENV_VARS = ['BOUNDED_PRIVATE_KEY', 'TAROBASE_SOLANA_KEYPAIR']; // base-58 or JSON array
+function loadKeypairFromEnv() {
+    var _a;
+    let secret;
+    let found;
+    for (const name of ENV_VARS) {
+        const v = (_a = process === null || process === void 0 ? void 0 : process.env) === null || _a === void 0 ? void 0 : _a[name];
+        if (v) {
+            secret = v;
+            found = name;
+            break;
+        }
+    }
+    if (!secret) {
+        throw new Error(`No server keypair: set ${ENV_VARS[0]} to a base58 secret key (or JSON array), ` +
+            `or pass one explicitly via createWalletClient({ keypair }).`);
+    }
+    try {
+        const secretKey = secret.trim().startsWith('[')
+            ? Uint8Array.from(JSON.parse(secret))
+            : bs58.decode(secret.trim());
+        return web3_js.Keypair.fromSecretKey(secretKey);
+    }
+    catch (err) {
+        throw new Error(`Unable to parse ${found}. Ensure it is valid base58 or a JSON array.`);
+    }
+}
+/* ──────────────────────────────────────────────────────────
+ * Helper – fetch getPriorityFeeEstimate
+ * ──────────────────────────────────────────────────────── */
+async function fetchPriorityFee(rpcEndpoint, rawUnsignedTxBuffer) {
+    var _a, _b;
+    try {
+        const res = await fetch(rpcEndpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: "1",
+                method: "getPriorityFeeEstimate",
+                params: [{
+                        transaction: bs58.encode(rawUnsignedTxBuffer), options: {
+                            recommended: true
+                        }
+                    }]
+            })
+        });
+        const data = await res.json();
+        const fee = (_b = (_a = data === null || data === void 0 ? void 0 : data.result) === null || _a === void 0 ? void 0 : _a.priorityFeeEstimate) !== null && _b !== void 0 ? _b : null;
+        console.log("Got fee from Helius", fee);
+        if (fee != null && fee > 0) {
+            return Math.ceil(Number(fee) * 1.2);
+        }
+        else {
+            console.log("No fee from Helius, using default 10000");
+            return Math.ceil(10000 * 1.2);
+        }
+    }
+    catch (err) {
+        console.warn("Priority‑fee estimate failed:", err);
+        return Math.ceil(10000 * 1.2);
+    }
+}
+class SolanaKeypairProvider {
+    constructor(networkUrl = null, keypair) {
+        this.networkUrl = networkUrl;
+        this.explicitKeypair = keypair;
+    }
+    get keypair() {
+        var _a, _b;
+        return ((_a = this.cachedKeypair) !== null && _a !== void 0 ? _a : (this.cachedKeypair = (_b = this.explicitKeypair) !== null && _b !== void 0 ? _b : loadKeypairFromEnv()));
+    }
+    /* ----------------------------------------------------------- *
+     * (Auth stubs – fill in later if needed)
+     * ----------------------------------------------------------- */
+    async login() { throw new Error('Not implemented'); }
+    async restoreSession() { throw new Error('Not implemented'); }
+    async logout() { throw new Error('Not implemented'); }
+    /* ----------------------------------------------------------- *
+     * Sign arbitrary message
+     * ----------------------------------------------------------- */
+    async signMessage(message) {
+        const sig = nacl.sign.detached(new TextEncoder().encode(message), this.keypair.secretKey);
+        return buffer.Buffer.from(sig).toString('base64');
+    }
+    /* ----------------------------------------------------------- *
+     * Sign transaction
+     * ----------------------------------------------------------- */
+    async signTransaction(transaction) {
+        // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
+        const isLegacyTransaction = 'recentBlockhash' in transaction && !('message' in transaction && 'staticAccountKeys' in transaction.message);
+        if (isLegacyTransaction) {
+            transaction.partialSign(this.keypair);
+        }
+        else {
+            transaction.sign([this.keypair]);
+        }
+        return transaction;
+    }
+    /**
+     * Signs and submits a Solana transaction to the network.
+     *
+     * This method handles blockhash and transaction confirmation automatically - you do NOT need to
+     * set recentBlockhash or lastValidBlockHeight on the transaction before calling this method.
+     * The network/RPC URL is derived from the provider's configuration (set during initialization).
+     *
+     * @param transaction - The transaction to sign and submit (Transaction or VersionedTransaction)
+     * @param feePayer - Optional fee payer public key. If not provided and the transaction doesn't
+     *                   already have a feePayer set, the keypair's public key will be used.
+     *                   Useful for co-signing scenarios where a different account pays the fees.
+     * @returns The transaction signature
+     */
+    async signAndSubmitTransaction(transaction, feePayer) {
+        // 1. Get RPC URL and create connection
+        const rpcUrl = this.getRpcUrl();
+        const connection = new web3_js.Connection(rpcUrl, 'confirmed');
+        // 2. Get fresh blockhash and set it on the transaction before signing
+        const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
+        // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
+        const isLegacyTransaction = 'recentBlockhash' in transaction && !('message' in transaction && 'staticAccountKeys' in transaction.message);
+        if (isLegacyTransaction) {
+            const legacyTx = transaction;
+            legacyTx.recentBlockhash = blockhash;
+            legacyTx.lastValidBlockHeight = lastValidBlockHeight;
+            // Set feePayer if not already set
+            if (!legacyTx.feePayer) {
+                legacyTx.feePayer = feePayer !== null && feePayer !== void 0 ? feePayer : this.keypair.publicKey;
+            }
+        }
+        else {
+            // VersionedTransaction
+            const versionedTx = transaction;
+            versionedTx.message.recentBlockhash = blockhash;
+            // Note: VersionedTransaction feePayer is set in the message at creation time
+            // and cannot be modified after creation
+        }
+        // 3. Sign the transaction
+        const signedTx = await this.signTransaction(transaction);
+        // 4. Submit and confirm using shared helper
+        const { signature } = await this.submitAndConfirmTransaction(signedTx, connection);
+        return signature;
+    }
+    /* ----------------------------------------------------------- *
+     * Private Helpers
+     * ----------------------------------------------------------- */
+    /**
+     * Submits a signed transaction and waits for confirmation using polling.
+     * Shared by both signAndSubmitTransaction and runTransactionInner.
+     */
+    async submitAndConfirmTransaction(signedTx, connection, options) {
+        var _a, _b, _c, _d;
+        const sig = await connection.sendRawTransaction(signedTx.serialize(), {
+            preflightCommitment: 'confirmed'
+        });
+        // Wait for confirmation using polling
+        const startTime = Date.now();
+        const timeoutMs = 10 * 1000; // 10 seconds
+        while (true) {
+            const st = await connection.getSignatureStatus(sig);
+            if ((_a = st === null || st === void 0 ? void 0 : st.value) === null || _a === void 0 ? void 0 : _a.err) {
+                // Transaction confirmed but failed on-chain — fetch logs for a readable error
+                const txInfo = await connection.getTransaction(sig, {
+                    maxSupportedTransactionVersion: 0,
+                    commitment: 'confirmed'
+                });
+                const logMessages = (_b = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _b === void 0 ? void 0 : _b.logMessages;
+                const errorMessage = logMessages ? JSON.stringify(logMessages) : JSON.stringify((_c = st === null || st === void 0 ? void 0 : st.value) === null || _c === void 0 ? void 0 : _c.err);
+                throw new Error(`Transaction failed: ${errorMessage}`);
+            }
+            if (((_d = st === null || st === void 0 ? void 0 : st.value) === null || _d === void 0 ? void 0 : _d.confirmationStatus) === 'confirmed') {
+                break;
+            }
+            // Check if we've exceeded the timeout
+            if (Date.now() - startTime > timeoutMs) {
+                throw new Error(`Transaction confirmation timeout after ${timeoutMs / 1000} seconds`);
+            }
+            await new Promise(resolve => setTimeout(resolve, 500));
+        }
+        // Optionally fetch transaction info
+        let txInfo = null;
+        if (options === null || options === void 0 ? void 0 : options.fetchTxInfo) {
+            txInfo = await connection.getTransaction(sig, {
+                maxSupportedTransactionVersion: 0,
+                commitment: 'confirmed'
+            });
+        }
+        return { signature: sig, txInfo };
+    }
+    getRpcUrl(network) {
+        if (this.networkUrl) {
+            return this.networkUrl;
+        }
+        if (network === 'solana_devnet') {
+            return SOLANA_DEVNET_RPC_URL;
+        }
+        else if (network === 'solana_mainnet') {
+            return SOLANA_MAINNET_RPC_URL;
+        }
+        else if (network === 'surfnet') {
+            return SURFNET_RPC_URL;
+        }
+        return SOLANA_MAINNET_RPC_URL; // default to mainnet
+    }
+    /* ----------------------------------------------------------- *
+     * Transaction runner
+     * ----------------------------------------------------------- */
+    async runTransaction(_evm, sol, opts) {
+        if (!sol)
+            throw new Error('Solana transaction data required');
+        const kp = this.keypair;
+        // Helper for duck typing - checks if transaction is legacy Transaction vs VersionedTransaction
+        const isLegacyTx = (tx) => {
+            return 'recentBlockhash' in tx && !('message' in tx && 'staticAccountKeys' in tx.message);
+        };
+        const wallet = {
+            publicKey: kp.publicKey,
+            signTransaction: async (tx) => {
+                // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
+                if (isLegacyTx(tx)) {
+                    tx.partialSign(kp);
+                }
+                else {
+                    tx.sign([kp]);
+                }
+                return tx;
+            },
+            signAllTransactions: async (txs) => txs.map((t) => {
+                // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
+                if (isLegacyTx(t)) {
+                    t.partialSign(kp);
+                }
+                else {
+                    t.sign([kp]);
+                }
+                return t;
+            }),
+        };
+        /* de-dupe remaining accounts */
+        const deduped = (() => {
+            const fin = [];
+            for (const acc of core.convertRemainingAccounts(sol.txArgs[0].remainingAccounts)) {
+                const ex = fin.find((x) => x.pubkey.equals(acc.pubkey));
+                if (ex) {
+                    ex.isSigner || (ex.isSigner = acc.isSigner);
+                    ex.isWritable || (ex.isWritable = acc.isWritable);
+                }
+                else
+                    fin.push(acc);
+            }
+            return fin;
+        })();
+        let retries = 0;
+        let didPass = false;
+        let delay = 1000;
+        let toReturn = null;
+        let errorMessage = "";
+        while (retries < 5) {
+            try {
+                toReturn = await this.runTransactionInner(sol, opts, wallet, kp, deduped);
+                didPass = true;
+                break;
+            }
+            catch (error) {
+                console.log("Error building and sending transaction on retry:", retries, error);
+                await new Promise(resolve => setTimeout(resolve, delay));
+                // Exponential backoff
+                delay *= 1.5;
+                retries++;
+                errorMessage = error.message || JSON.stringify(error, null, 2);
+            }
+        }
+        if (!didPass) {
+            throw new Error(`Failed to send transaction after 5 retries: ${errorMessage}`);
+        }
+        return toReturn;
+    }
+    async runTransactionInner(sol, opts, wallet, kp, deduped) {
+        var _a, _b, _c;
+        let rpcUrl = this.getRpcUrl(sol.network);
+        const connection = new web3_js.Connection(rpcUrl, 'confirmed');
+        const anchorProvider = new anchor__namespace.AnchorProvider(connection, wallet, anchor__namespace.AnchorProvider.defaultOptions());
+        const app_id = sol.appId;
+        if (!app_id)
+            throw new Error('app_id missing');
+        // When the server has co-signed a transaction (CPI attestation),
+        // deserialize it and just add the wallet signature instead of
+        // building from components.
+        let tx;
+        let blockhash;
+        let lastValidBlockHeight;
+        if (sol.signedTransaction) {
+            tx = web3_js.VersionedTransaction.deserialize(buffer.Buffer.from(sol.signedTransaction, 'base64'));
+            const latestBlockhash = await connection.getLatestBlockhash('confirmed');
+            blockhash = latestBlockhash.blockhash;
+            lastValidBlockHeight = latestBlockhash.lastValidBlockHeight;
+        }
+        else {
+            const result = await core.buildSetDocumentsTransaction(connection, sol.txArgs[0].idl, anchorProvider, kp.publicKey, {
+                app_id,
+                documents: sol.txArgs[0].setDocumentData,
+                delete_paths: sol.txArgs[0].deletePaths,
+                txData: sol.txArgs[0].txData
+            }, deduped, sol.lutKey, sol.preInstructions, false, sol.additionalLutAddresses);
+            tx = result.tx;
+            blockhash = result.blockhash;
+            lastValidBlockHeight = result.lastValidBlockHeight;
+        }
+        // Helper for duck typing - checks if transaction is legacy Transaction vs VersionedTransaction
+        const isLegacyTx = (t) => {
+            return 'recentBlockhash' in t && !('message' in t && 'staticAccountKeys' in t.message);
+        };
+        // Refresh blockhash and lastValidBlockHeight
+        // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
+        if (isLegacyTx(tx)) {
+            tx.partialSign(kp);
+            tx.recentBlockhash = blockhash;
+            tx.lastValidBlockHeight = lastValidBlockHeight;
+            tx.feePayer = kp.publicKey;
+        }
+        else {
+            tx.sign([kp]);
+            tx.message.recentBlockhash = blockhash;
+        }
+        // 3️⃣  Optional priority‑fee instruction
+        const rawUnsigned = tx.serialize({ requireAllSignatures: false });
+        const microLamports = await fetchPriorityFee(connection.rpcEndpoint, rawUnsigned);
+        if (microLamports != null) {
+            // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
+            if (isLegacyTx(tx)) {
+                tx.instructions.unshift(web3_js.ComputeBudgetProgram.setComputeUnitPrice({ microLamports }));
+                tx.partialSign(kp);
+            }
+            else {
+                // For pre-signed (attestation) transactions, we can't rebuild — skip priority fee
+                if (!sol.signedTransaction) {
+                    // Rebuild the transaction with the new priority fee
+                    const roundTwo = await core.buildSetDocumentsTransaction(connection, sol.txArgs[0].idl, anchorProvider, kp.publicKey, {
+                        app_id,
+                        documents: sol.txArgs[0].setDocumentData,
+                        delete_paths: sol.txArgs[0].deletePaths,
+                        txData: sol.txArgs[0].txData
+                    }, deduped, sol.lutKey, [web3_js.ComputeBudgetProgram.setComputeUnitPrice({ microLamports }), ...sol.preInstructions], false, sol.additionalLutAddresses);
+                    tx = roundTwo.tx;
+                    blockhash = roundTwo.blockhash;
+                    lastValidBlockHeight = roundTwo.lastValidBlockHeight;
+                    tx.sign([kp]);
+                    tx.message.recentBlockhash = blockhash;
+                }
+            }
+        }
+        if ((opts === null || opts === void 0 ? void 0 : opts.shouldSubmitTx) === false) {
+            return { signedTransaction: tx, blockNumber: 0, gasUsed: '0', data: '' };
+        }
+        // Submit and confirm using shared helper
+        const { signature, txInfo } = await this.submitAndConfirmTransaction(tx, connection, { fetchTxInfo: true });
+        return {
+            transactionSignature: signature,
+            blockNumber: (_a = txInfo === null || txInfo === void 0 ? void 0 : txInfo.slot) !== null && _a !== void 0 ? _a : 0,
+            gasUsed: (_c = (_b = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _b === void 0 ? void 0 : _b.fee.toString()) !== null && _c !== void 0 ? _c : '0',
+            data: txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta,
+        };
+    }
+    /* ----------------------------------------------------------- */
+    async getNativeMethods() {
+        return { keypair: this.keypair };
+    }
+}
+
+/**
+ * Server-side OffchainAuthProvider wrapper for the poofnet environment.
+ *
+ * For signMessage, this generates a mock signature using SHA-256 hashing.
+ * This is used for offchain transaction signing.
+ */
+class OffchainAuthProvider {
+    constructor(wrappedProvider) {
+        this.wrappedProvider = wrappedProvider;
+    }
+    async login() {
+        return this.wrappedProvider.login();
+    }
+    async logout() {
+        return this.wrappedProvider.logout();
+    }
+    async restoreSession() {
+        return this.wrappedProvider.restoreSession();
+    }
+    async getNativeMethods() {
+        return this.wrappedProvider.getNativeMethods();
+    }
+    async signMessage(message) {
+        // Delegate to wrapped provider for real signing
+        return this.wrappedProvider.signMessage(message);
+    }
+    async signMessageMock(message) {
+        // Generate mock signature (SHA-256 hash of message, base64 encoded)
+        // This is used for offchain transaction signing
+        const hash = crypto__namespace.createHash('sha256').update(message).digest('base64');
+        return hash;
+    }
+    async signTransaction(transaction) {
+        throw new Error('Poofnet does not support real Solana transactions. Deploy your project to mainnet to use this feature.');
+    }
+    /**
+     * Sign and submit transaction - not supported in poofnet environment.
+     * See the real providers (PhantomWalletProvider, PrivyWalletProvider, SolanaKeypairProvider)
+     * for the full implementation with blockhash handling and feePayer support.
+     */
+    async signAndSubmitTransaction(_transaction, _feePayer) {
+        throw new Error('Poofnet does not support real Solana transactions. Deploy your project to mainnet to use this feature.');
+    }
+    async runTransaction(evmTransactionData, solTransactionData, options) {
+        return this.wrappedProvider.runTransaction(evmTransactionData, solTransactionData, options);
+    }
+}
+
+let currentAuthProvider = null;
+const SOLANA_DEVNET_RPC_URL = "https://idelle-8nxsep-fast-devnet.helius-rpc.com";
+const SOLANA_MAINNET_RPC_URL = "https://celestia-cegncv-fast-mainnet.helius-rpc.com";
+const SURFNET_RPC_URL = "https://surfpool.fly.dev";
+async function getAuthProvider() {
+    var _a;
+    const config = await core.getConfig();
+    if (currentAuthProvider) {
+        // If provider exists but chain is "offchain" and it's not already wrapped, rewrap it
+        if (config.chain === "offchain" && !(currentAuthProvider instanceof OffchainAuthProvider)) {
+            currentAuthProvider = new OffchainAuthProvider(currentAuthProvider);
+        }
+        return currentAuthProvider;
+    }
+    currentAuthProvider = await matchAuthProvider((_a = config.rpcUrl) !== null && _a !== void 0 ? _a : null);
+    // Wrap with OffchainAuthProvider for offchain chain
+    if (config.chain === "offchain") {
+        currentAuthProvider = new OffchainAuthProvider(currentAuthProvider);
+    }
+    return currentAuthProvider;
+}
+async function matchAuthProvider(rpcUrl) {
+    return new SolanaKeypairProvider(rpcUrl);
+}
+
+let authProviderInstance = null;
+async function init(newConfig) {
+    // Initialize config first so getAuthProvider can access it
+    // Server-side skips backend init since it already has all needed config
+    await core.init(Object.assign(Object.assign({}, newConfig), { isServer: true, skipBackendInit: true }));
+    // Get the auth provider (which will wrap it if chain is "offchain")
+    authProviderInstance = await getAuthProvider();
+    // Update config with the wrapped provider
+    await core.init(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance, isServer: true, skipBackendInit: true }));
+}
+
+// Wrapper for getIdToken - passes isServer=true for server-side usage
+async function getIdToken() {
+    return core.getIdToken(true);
+}
+
+var __rest = (undefined && undefined.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+/* ------------------------------------------------------------------ */
+/*  Keypair parsing                                                    */
+/* ------------------------------------------------------------------ */
+function parseKeypair(secret) {
+    const trimmed = secret.trim();
+    try {
+        const secretKey = trimmed.startsWith('[')
+            ? Uint8Array.from(JSON.parse(trimmed))
+            : bs58.decode(trimmed);
+        return web3_js.Keypair.fromSecretKey(secretKey);
+    }
+    catch (_a) {
+        throw new Error('Invalid keypair: must be base58 or JSON array.');
+    }
+}
+/**
+ * Whether a JWT is expired or within 60s of expiry (or unparseable). Used to
+ * decide if the wallet should re-sign for a fresh token. Server-only (Node
+ * Buffer); a keypair-backed session can always re-sign, so this is safe to be
+ * conservative about.
+ */
+function jwtExpiringSoon(token) {
+    if (!token)
+        return true;
+    try {
+        const part = token.split('.')[1];
+        const json = Buffer.from(part.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8');
+        const exp = JSON.parse(json).exp;
+        if (!exp)
+            return false;
+        return Date.now() > exp * 1000 - 60000;
+    }
+    catch (_a) {
+        return true;
+    }
+}
+/* ------------------------------------------------------------------ */
+/*  WalletClient                                                       */
+/* ------------------------------------------------------------------ */
+class WalletClient {
+    constructor(provider, sessionManager, address) {
+        this.provider = provider;
+        this.sessionManager = sessionManager;
+        this.address = address;
+    }
+    /* ---- Auth override helpers ---- */
+    buildOverrides() {
+        return {
+            authProvider: this.provider,
+            _getAuthHeaders: async () => {
+                let s = await this.sessionManager.getSession();
+                // Keypair-backed session: if the cached token is expired/near-expiry,
+                // re-sign for a fresh one (we always hold the key). Keeps long-lived WS
+                // subscriptions authenticated across reconnects, and stops one-shot reads
+                // from sending a stale token.
+                if (jwtExpiringSoon(s.idToken)) {
+                    this.sessionManager.clearSession();
+                    s = await this.sessionManager.getSession();
+                }
+                return { Authorization: `Bearer ${s.idToken}` };
+            },
+            _clearAuth: async () => {
+                this.sessionManager.clearSession();
+            },
+            _walletAddress: this.address,
+        };
+    }
+    /** Strip Authorization from caller headers to prevent overriding wallet token */
+    sanitizeHeaders(headers) {
+        if (!headers)
+            return undefined;
+        const _a = headers, { Authorization, authorization } = _a, rest = __rest(_a, ["Authorization", "authorization"]);
+        return Object.keys(rest).length > 0 ? rest : undefined;
+    }
+    mergeSetOverrides(opts) {
+        var _a;
+        const ovr = this.buildOverrides();
+        return Object.assign(Object.assign({}, opts), { _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), authProvider: ovr.authProvider, _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth }) });
+    }
+    mergeReadOverrides(existing) {
+        const ovr = this.buildOverrides();
+        return Object.assign(Object.assign({}, existing), { headers: this.sanitizeHeaders(existing === null || existing === void 0 ? void 0 : existing.headers), _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _walletAddress: ovr._walletAddress });
+    }
+    /* ---- Data operations ---- */
+    async set(path, document, options) {
+        return core.set(path, document, this.mergeSetOverrides(options));
+    }
+    async setMany(many, options) {
+        return core.setMany(many, this.mergeSetOverrides(options));
+    }
+    async setFile(path, file, options) {
+        return core.setFile(path, file, { _overrides: this.mergeReadOverrides(options === null || options === void 0 ? void 0 : options._overrides) });
+    }
+    async get(path, opts) {
+        return core.get(path, Object.assign(Object.assign({}, opts), { _overrides: this.mergeReadOverrides(opts === null || opts === void 0 ? void 0 : opts._overrides) }));
+    }
+    async getMany(paths, opts) {
+        return core.getMany(paths, Object.assign(Object.assign({}, opts), { _overrides: this.mergeReadOverrides() }));
+    }
+    async getFiles(path, options) {
+        return core.getFiles(path, { _overrides: this.mergeReadOverrides(options === null || options === void 0 ? void 0 : options._overrides) });
+    }
+    async search(path, query, opts = {}) {
+        return core.search(path, query, Object.assign(Object.assign({}, opts), { _overrides: this.mergeReadOverrides(opts === null || opts === void 0 ? void 0 : opts._overrides) }));
+    }
+    async runQuery(absolutePath, queryName, queryArgs, opts) {
+        return core.runQuery(absolutePath, queryName, queryArgs, Object.assign(Object.assign({}, opts), { _overrides: this.mergeReadOverrides(opts === null || opts === void 0 ? void 0 : opts._overrides) }));
+    }
+    async runQueryMany(many, opts) {
+        return core.runQueryMany(many, Object.assign(Object.assign({}, opts), { _overrides: this.mergeReadOverrides(opts === null || opts === void 0 ? void 0 : opts._overrides) }));
+    }
+    async runExpression(expression, queryArgs, options) {
+        return core.runExpression(expression, queryArgs, Object.assign(Object.assign({}, options), { _overrides: this.mergeReadOverrides(options === null || options === void 0 ? void 0 : options._overrides) }));
+    }
+    async runExpressionMany(many) {
+        const ovr = this.mergeReadOverrides();
+        return core.runExpressionMany(many.map(m => (Object.assign(Object.assign({}, m), { _overrides: ovr }))));
+    }
+    async count(path, opts = {}) {
+        return core.count(path, Object.assign(Object.assign({}, opts), { _overrides: this.mergeReadOverrides(opts === null || opts === void 0 ? void 0 : opts._overrides) }));
+    }
+    async aggregate(path, operation, opts = {}) {
+        return core.aggregate(path, operation, Object.assign(Object.assign({}, opts), { _overrides: this.mergeReadOverrides(opts === null || opts === void 0 ? void 0 : opts._overrides) }));
+    }
+    async queryAggregate(path, spec, opts = {}) {
+        return core.queryAggregate(path, spec, Object.assign(Object.assign({}, opts), { _overrides: this.mergeReadOverrides(opts === null || opts === void 0 ? void 0 : opts._overrides) }));
+    }
+    /**
+     * Subscribe to real-time updates as THIS wallet's identity. Unlike the global
+     * `subscribe`, this needs no `BOUNDED_PRIVATE_KEY` env var — the WS connection
+     * authenticates with the wallet's own session (so read rules see the right
+     * principal), and is scoped to its own connection so it never crosses another
+     * identity. Accepts a bare callback or `{ onData, onError, filter, ... }`.
+     * Returns an async unsubscribe.
+     */
+    async subscribe(path, options) {
+        const opts = typeof options === 'function' ? { onData: options } : Object.assign({}, options);
+        const ovr = this.buildOverrides();
+        return core.subscribe(path, Object.assign(Object.assign({}, opts), { _overrides: {
+                _getAuthHeaders: ovr._getAuthHeaders,
+                _clearAuth: ovr._clearAuth,
+                _walletAddress: ovr._walletAddress,
+            } }));
+    }
+    /**
+     * Invoke a deployed Bounded Function AS this wallet's identity. Unlike the
+     * top-level `functions.invoke`, this needs no `BOUNDED_PRIVATE_KEY` env var —
+     * the dispatcher sees the wallet's verified session, so the function's `auth`
+     * rule + `ctx.user` reflect this client. Returns the function's JSON; throws
+     * `FunctionInvokeError` on 401/403/404/503.
+     */
+    async invoke(name, args = {}, opts = {}) {
+        const ovr = this.buildOverrides();
+        return core.functions.invoke(name, args, Object.assign(Object.assign({}, opts), { _overrides: { _getAuthHeaders: ovr._getAuthHeaders } }));
+    }
+    /* ---- Signing operations (use provider directly) ---- */
+    async signMessage(message) {
+        return this.provider.signMessage(message);
+    }
+    async signTransaction(transaction) {
+        return this.provider.signTransaction(transaction);
+    }
+    async signAndSubmitTransaction(transaction, feePayer) {
+        return this.provider.signAndSubmitTransaction(transaction, feePayer);
+    }
+}
+/**
+ * Create a self-contained wallet client bound to a specific keypair.
+ * Each client has its own auth session — no global state is mutated.
+ *
+ * @example
+ * ```ts
+ * const vault = await createWalletClient({ keypair: process.env.VAULT_KEY });
+ * await vault.set('markets/123', data);
+ * ```
+ */
+async function createWalletClient(opts) {
+    var _a;
+    const kp = parseKeypair(opts.keypair);
+    const config = await core.getConfig();
+    let provider = new SolanaKeypairProvider((_a = config.rpcUrl) !== null && _a !== void 0 ? _a : null, kp);
+    if (config.chain === 'offchain') {
+        provider = new OffchainAuthProvider(provider);
+    }
+    const sessionManager = core.ServerSessionManager.forKeypair(kp);
+    // Eagerly authenticate so failures surface immediately
+    await sessionManager.getSession();
+    return new WalletClient(provider, sessionManager, kp.publicKey.toBase58());
+}
+
+// ---------------------------------------------------------------------------
+// webhooks.ts -- Verify signed inbound mutation webhooks.
+//
+// The Tarobase realtime worker fires outbound webhooks for declared
+// collections after a mutation commits, signed with a platform Ed25519 private
+// key. This module verifies those signatures on the receiving server.
+//
+// verifyWebhook():
+//   1. Fetches the platform's hosted public keys (well-known endpoint),
+//      cached in-memory with a TTL.
+//   2. Picks the key matching the X-Bounded-Key-Id header.
+//   3. Verifies the Ed25519 signature (X-Bounded-Signature) over the RAW body.
+//   4. Checks the X-Bounded-Timestamp is within an allowed skew.
+//   5. Returns the parsed, typed payload — or throws.
+//
+// Verification uses WebCrypto (globalThis.crypto.subtle), available natively in
+// Node 18+, Bun, Deno, Cloudflare Workers, and modern browsers.
+// ---------------------------------------------------------------------------
+// Default to PRODUCTION keys so an omitted keysUrl is production-safe (audit
+// SDK LOW-7). Staging receivers must pass keysUrl explicitly.
+const DEFAULT_WEBHOOK_KEYS_URL = "https://realtime.bounded.sh/.well-known/bounded-webhook-keys.json";
+const DEFAULT_MAX_SKEW_SECONDS = 300;
+const DEFAULT_CACHE_TTL_MS = 300000;
+class WebhookVerificationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WebhookVerificationError";
+    }
+}
+function getHeader(headers, name) {
+    var _a;
+    if (headers && typeof headers.get === "function") {
+        return headers.get(name);
+    }
+    const lower = name.toLowerCase();
+    const obj = headers;
+    for (const key of Object.keys(obj)) {
+        if (key.toLowerCase() === lower) {
+            const value = obj[key];
+            return Array.isArray(value) ? (_a = value[0]) !== null && _a !== void 0 ? _a : null : value !== null && value !== void 0 ? value : null;
+        }
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Base64
+// ---------------------------------------------------------------------------
+function base64ToBytes(b64) {
+    const binary = typeof Buffer !== "undefined"
+        ? Buffer.from(b64, "base64").toString("binary")
+        : atob(b64);
+    const buffer = new ArrayBuffer(binary.length);
+    const bytes = new Uint8Array(buffer);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+function utf8Bytes(text) {
+    const encoded = new TextEncoder().encode(text);
+    const buffer = new ArrayBuffer(encoded.length);
+    const bytes = new Uint8Array(buffer);
+    bytes.set(encoded);
+    return bytes;
+}
+const keyCache = new Map();
+/** Clear the in-memory key cache (mainly for tests). */
+function clearWebhookKeyCache() {
+    keyCache.clear();
+}
+async function loadKeys(keysUrl, cacheTtlMs, fetchImpl, now) {
+    const cached = keyCache.get(keysUrl);
+    if (cached && cached.expiresAt > now()) {
+        return cached.keys;
+    }
+    let res;
+    try {
+        res = await fetchImpl(keysUrl);
+    }
+    catch (err) {
+        throw new WebhookVerificationError(`Failed to fetch webhook keys from ${keysUrl}: ${err.message}`);
+    }
+    if (!res.ok) {
+        throw new WebhookVerificationError(`Failed to fetch webhook keys from ${keysUrl}: HTTP ${res.status}`);
+    }
+    const body = (await res.json());
+    if (!body || !Array.isArray(body.keys)) {
+        throw new WebhookVerificationError(`Webhook keys endpoint ${keysUrl} returned an invalid payload.`);
+    }
+    keyCache.set(keysUrl, { keys: body.keys, expiresAt: now() + cacheTtlMs });
+    return body.keys;
+}
+// ---------------------------------------------------------------------------
+// In-memory replay store (single-process receivers)
+// ---------------------------------------------------------------------------
+/**
+ * A simple in-memory {@link WebhookReplayStore}. Records seen event ids until
+ * their skew-window expiry and lazily evicts expired entries. Suitable for a
+ * single-process receiver; use a shared store (Redis, KV, a DB unique
+ * constraint) for multi-instance deployments.
+ */
+class InMemoryReplayStore {
+    constructor() {
+        this.seen = new Map();
+    }
+    checkAndRecord(id, expiresAtMs) {
+        const now = Date.now();
+        // Opportunistic eviction of expired entries to bound memory.
+        if (this.seen.size > 0) {
+            for (const [key, exp] of this.seen) {
+                if (exp <= now)
+                    this.seen.delete(key);
+            }
+        }
+        const existing = this.seen.get(id);
+        if (existing !== undefined && existing > now) {
+            return true; // replay
+        }
+        this.seen.set(id, expiresAtMs);
+        return false;
+    }
+    /** Clear all recorded ids (mainly for tests). */
+    clear() {
+        this.seen.clear();
+    }
+}
+// ---------------------------------------------------------------------------
+// verifyWebhook
+// ---------------------------------------------------------------------------
+/**
+ * Verify a signed inbound webhook and return its typed payload.
+ *
+ * @param rawBody The exact raw request body string the platform signed. Must be
+ *   the unparsed bytes — re-serializing parsed JSON may not match byte-for-byte.
+ * @param headers The inbound request headers (a Headers instance or a plain
+ *   object; case-insensitive).
+ * @param opts Optional overrides (keys URL, skew, cache TTL, fetch).
+ * @returns The parsed, validated {@link WebhookPayload}.
+ * @throws {WebhookVerificationError} if anything fails verification.
+ */
+async function verifyWebhook(rawBody, headers, opts = {}) {
+    var _a, _b, _c, _d, _e, _f;
+    // Resolution order: explicit opts.keysUrl > the configured Bounded network's
+    // hosted keys (so a staging receiver verifies staging-signed deliveries
+    // without passing keysUrl) > the production default (fail-closed when the
+    // network is unknown — audit SDK LOW-7).
+    const keysUrl = (_b = (_a = opts.keysUrl) !== null && _a !== void 0 ? _a : core.getWebhookKeysUrl()) !== null && _b !== void 0 ? _b : DEFAULT_WEBHOOK_KEYS_URL;
+    const maxSkew = (_c = opts.maxSkewSeconds) !== null && _c !== void 0 ? _c : DEFAULT_MAX_SKEW_SECONDS;
+    const cacheTtlMs = (_d = opts.cacheTtlMs) !== null && _d !== void 0 ? _d : DEFAULT_CACHE_TTL_MS;
+    const fetchImpl = (_e = opts.fetchImpl) !== null && _e !== void 0 ? _e : globalThis.fetch;
+    const now = (_f = opts.now) !== null && _f !== void 0 ? _f : Date.now;
+    if (typeof fetchImpl !== "function") {
+        throw new WebhookVerificationError("No fetch implementation available; pass opts.fetchImpl.");
+    }
+    const signature = getHeader(headers, "X-Bounded-Signature");
+    const keyId = getHeader(headers, "X-Bounded-Key-Id");
+    const timestampHeader = getHeader(headers, "X-Bounded-Timestamp");
+    if (!signature)
+        throw new WebhookVerificationError("Missing X-Bounded-Signature header.");
+    if (!keyId)
+        throw new WebhookVerificationError("Missing X-Bounded-Key-Id header.");
+    if (!timestampHeader)
+        throw new WebhookVerificationError("Missing X-Bounded-Timestamp header.");
+    const headerTimestamp = Number(timestampHeader);
+    if (!Number.isFinite(headerTimestamp)) {
+        throw new WebhookVerificationError("Invalid X-Bounded-Timestamp header.");
+    }
+    // Resolve the signing key by id.
+    const keys = await loadKeys(keysUrl, cacheTtlMs, fetchImpl, now);
+    let key = keys.find((k) => k.id === keyId);
+    // Cache-miss tolerance: a freshly-rotated key may not be cached yet. Force a
+    // single refresh before giving up.
+    if (!key) {
+        keyCache.delete(keysUrl);
+        const refreshed = await loadKeys(keysUrl, cacheTtlMs, fetchImpl, now);
+        key = refreshed.find((k) => k.id === keyId);
+    }
+    if (!key) {
+        throw new WebhookVerificationError(`No public key found for key id "${keyId}".`);
+    }
+    if (key.alg !== "ed25519") {
+        throw new WebhookVerificationError(`Unsupported key algorithm "${key.alg}".`);
+    }
+    // Verify the Ed25519 signature over the raw body.
+    const subtle = (globalThis.crypto && globalThis.crypto.subtle);
+    if (!subtle) {
+        throw new WebhookVerificationError("WebCrypto (crypto.subtle) is not available.");
+    }
+    let cryptoKey;
+    try {
+        cryptoKey = await subtle.importKey("raw", base64ToBytes(key.publicKey), { name: "Ed25519" }, false, ["verify"]);
+    }
+    catch (err) {
+        throw new WebhookVerificationError(`Failed to import Ed25519 public key: ${err.message}`);
+    }
+    const ok = await subtle.verify({ name: "Ed25519" }, cryptoKey, base64ToBytes(signature), utf8Bytes(rawBody));
+    if (!ok) {
+        throw new WebhookVerificationError("Webhook signature verification failed.");
+    }
+    // Parse and shallow-validate the payload.
+    let payload;
+    try {
+        payload = JSON.parse(rawBody);
+    }
+    catch (_g) {
+        throw new WebhookVerificationError("Webhook body is not valid JSON.");
+    }
+    if (!payload ||
+        typeof payload.id !== "string" ||
+        typeof payload.appId !== "string" ||
+        typeof payload.path !== "string" ||
+        (payload.operation !== "create" &&
+            payload.operation !== "update" &&
+            payload.operation !== "delete") ||
+        typeof payload.timestamp !== "number" ||
+        !Number.isFinite(payload.timestamp)) {
+        throw new WebhookVerificationError("Webhook payload is missing required fields.");
+    }
+    // Replay protection: the timestamp used for the skew window MUST be the SIGNED
+    // payload.timestamp, not the unsigned X-Bounded-Timestamp header. An attacker
+    // can swap the header freely without breaking the Ed25519 signature, so the
+    // header alone is no replay bound. We also require the header to equal the
+    // signed value so the (unsigned) header cannot diverge from what was signed.
+    if (headerTimestamp !== payload.timestamp) {
+        throw new WebhookVerificationError("X-Bounded-Timestamp header does not match the signed payload timestamp.");
+    }
+    const nowSeconds = Math.floor(now() / 1000);
+    if (Math.abs(nowSeconds - payload.timestamp) > maxSkew) {
+        throw new WebhookVerificationError(`Webhook timestamp outside allowed skew of ${maxSkew}s (delta ${Math.abs(nowSeconds - payload.timestamp)}s).`);
+    }
+    // Optional nonce/replay cache: reject a previously-seen event id within the
+    // skew window. The signed payload.id uniquely identifies the delivery.
+    if (opts.replayStore) {
+        const expiresAtMs = (payload.timestamp + maxSkew) * 1000;
+        const replayed = await opts.replayStore.checkAndRecord(payload.id, expiresAtMs);
+        if (replayed) {
+            throw new WebhookVerificationError(`Webhook replay detected for event id "${payload.id}".`);
+        }
+    }
+    return payload;
+}
+
+Object.defineProperty(exports, "FunctionInvokeError", {
+    enumerable: true,
+    get: function () { return core.FunctionInvokeError; }
+});
+Object.defineProperty(exports, "InsufficientBalanceError", {
+    enumerable: true,
+    get: function () { return core.InsufficientBalanceError; }
+});
+Object.defineProperty(exports, "LiveIntentError", {
+    enumerable: true,
+    get: function () { return core.LiveIntentError; }
+});
+Object.defineProperty(exports, "aggregate", {
+    enumerable: true,
+    get: function () { return core.aggregate; }
+});
+Object.defineProperty(exports, "count", {
+    enumerable: true,
+    get: function () { return core.count; }
+});
+Object.defineProperty(exports, "functions", {
+    enumerable: true,
+    get: function () { return core.functions; }
+});
+Object.defineProperty(exports, "get", {
+    enumerable: true,
+    get: function () { return core.get; }
+});
+Object.defineProperty(exports, "getConfig", {
+    enumerable: true,
+    get: function () { return core.getConfig; }
+});
+Object.defineProperty(exports, "getFiles", {
+    enumerable: true,
+    get: function () { return core.getFiles; }
+});
+Object.defineProperty(exports, "getMany", {
+    enumerable: true,
+    get: function () { return core.getMany; }
+});
+Object.defineProperty(exports, "invokeFunction", {
+    enumerable: true,
+    get: function () { return core.invokeFunction; }
+});
+Object.defineProperty(exports, "live", {
+    enumerable: true,
+    get: function () { return core.live; }
+});
+Object.defineProperty(exports, "liveIntent", {
+    enumerable: true,
+    get: function () { return core.liveIntent; }
+});
+Object.defineProperty(exports, "queryAggregate", {
+    enumerable: true,
+    get: function () { return core.queryAggregate; }
+});
+Object.defineProperty(exports, "runExpression", {
+    enumerable: true,
+    get: function () { return core.runExpression; }
+});
+Object.defineProperty(exports, "runExpressionMany", {
+    enumerable: true,
+    get: function () { return core.runExpressionMany; }
+});
+Object.defineProperty(exports, "runQuery", {
+    enumerable: true,
+    get: function () { return core.runQuery; }
+});
+Object.defineProperty(exports, "runQueryMany", {
+    enumerable: true,
+    get: function () { return core.runQueryMany; }
+});
+Object.defineProperty(exports, "search", {
+    enumerable: true,
+    get: function () { return core.search; }
+});
+Object.defineProperty(exports, "set", {
+    enumerable: true,
+    get: function () { return core.set; }
+});
+Object.defineProperty(exports, "setFile", {
+    enumerable: true,
+    get: function () { return core.setFile; }
+});
+Object.defineProperty(exports, "setMany", {
+    enumerable: true,
+    get: function () { return core.setMany; }
+});
+Object.defineProperty(exports, "signAndSubmitTransaction", {
+    enumerable: true,
+    get: function () { return core.signAndSubmitTransaction; }
+});
+Object.defineProperty(exports, "signMessage", {
+    enumerable: true,
+    get: function () { return core.signMessage; }
+});
+Object.defineProperty(exports, "signTransaction", {
+    enumerable: true,
+    get: function () { return core.signTransaction; }
+});
+Object.defineProperty(exports, "subscribe", {
+    enumerable: true,
+    get: function () { return core.subscribe; }
+});
+exports.DEFAULT_WEBHOOK_KEYS_URL = DEFAULT_WEBHOOK_KEYS_URL;
+exports.InMemoryReplayStore = InMemoryReplayStore;
+exports.WalletClient = WalletClient;
+exports.WebhookVerificationError = WebhookVerificationError;
+exports.clearWebhookKeyCache = clearWebhookKeyCache;
+exports.createWalletClient = createWalletClient;
+exports.getAuthProvider = getAuthProvider;
+exports.getIdToken = getIdToken;
+exports.init = init;
+exports.verifyWebhook = verifyWebhook;
+Object.keys(core).forEach(function (k) {
+    if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
+        enumerable: true,
+        get: function () { return core[k]; }
+    });
+});
+//# sourceMappingURL=index.js.map