@bounded-sh/server 0.0.16 → 0.0.18

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { convertRemainingAccounts, buildSetDocumentsTransaction, getConfig, init
 export * from '@bounded-sh/core';
 export { FunctionInvokeError, InsufficientBalanceError, LiveIntentError, aggregate, count, functions, get, getConfig, getFiles, getMany, invokeFunction, live, liveIntent, liveStatus, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
 import { Buffer as Buffer$1 } from 'buffer';
-import { Connection, VersionedTransaction, ComputeBudgetProgram, Keypair } from '@solana/web3.js';
+import { Connection, VersionedTransaction, ComputeBudgetProgram, Keypair, SystemProgram } from '@solana/web3.js';
 import * as anchor from '@coral-xyz/anchor';
 import nacl from 'tweetnacl';
 import bs58 from 'bs58';
@@ -16,6 +16,25 @@ import * as crypto from 'crypto';
  * is the canonical name (it matches the CLI's `BOUNDED_PRIVATE_KEY`).
  * ------------------------------------------------------------- */
 const ENV_VARS = ['BOUNDED_PRIVATE_KEY']; // base-58 or JSON array
+const PRESIGNED_BLOCKHASH_ERROR = 'Server signedTransaction blockhash is stale or expired';
+const BOUNDED_PROGRAM_MAINNET = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
+const BOUNDED_PROGRAM_DEVNET = 'taro6CvKqwrYrDc16ufYgzQ2NZcyyVKStffbtudrhRu';
+const COMPUTE_BUDGET_PROGRAM = 'ComputeBudget111111111111111111111111111111';
+const SYSTEM_PROGRAM_ID = '11111111111111111111111111111111';
+const SUPPORTED_SOLANA_NETWORKS = ['solana_devnet', 'solana_mainnet', 'surfnet'];
+const SUPPORTED_SOLANA_NETWORK_SET = new Set(SUPPORTED_SOLANA_NETWORKS);
+const ALLOWED_SERVER_TX_PROGRAMS = new Set([
+    BOUNDED_PROGRAM_MAINNET,
+    BOUNDED_PROGRAM_DEVNET,
+    COMPUTE_BUDGET_PROGRAM,
+    SYSTEM_PROGRAM_ID,
+]);
+const SET_DOCUMENTS_DISCRIMINATOR = '79,46,72,73,24,79,66,245';
+const SET_DOCUMENTS_V2_DISCRIMINATOR = '22,236,242,185,145,61,26,39';
+const ALLOWED_BOUNDED_SET_DISCRIMINATORS = new Set([
+    SET_DOCUMENTS_DISCRIMINATOR,
+    SET_DOCUMENTS_V2_DISCRIMINATOR,
+]);
 function loadKeypairFromEnv() {
     var _a;
     let secret;
@@ -64,23 +83,214 @@ async function fetchPriorityFee(rpcEndpoint, rawUnsignedTxBuffer) {
         });
         const data = await res.json();
         const fee = (_b = (_a = data === null || data === void 0 ? void 0 : data.result) === null || _a === void 0 ? void 0 : _a.priorityFeeEstimate) !== null && _b !== void 0 ? _b : null;
-        console.log("Got fee from Helius", fee);
         if (fee != null && fee > 0) {
             return Math.ceil(Number(fee) * 1.2);
         }
-        else {
-            console.log("No fee from Helius, using default 10000");
-            return Math.ceil(10000 * 1.2);
-        }
+        console.warn("Priority-fee estimate returned no positive fee; skipping priority fee instruction");
+        return null;
     }
     catch (err) {
-        console.warn("Priority‑fee estimate failed:", err);
-        return Math.ceil(10000 * 1.2);
+        console.warn("Priority-fee estimate failed; skipping priority fee instruction:", err);
+        return null;
+    }
+}
+function isPresignedBlockhashError(error) {
+    return typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' && error.message.includes(PRESIGNED_BLOCKHASH_ERROR);
+}
+function isPermanentPresignedTransactionError(error) {
+    return isPresignedBlockhashError(error) ||
+        (typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' && (error.message.startsWith('Server signedTransaction') ||
+            error.message.startsWith('Server preInstruction')));
+}
+class BorshCursor {
+    constructor(data, offset) {
+        this.data = data;
+        this.offset = offset;
+    }
+    requireBytes(length, field) {
+        if (this.offset + length > this.data.length) {
+            throw new Error(`Server signedTransaction has malformed Bounded instruction data while reading ${field}`);
+        }
+    }
+    readU8(field) {
+        this.requireBytes(1, field);
+        return this.data[this.offset++];
+    }
+    readU32(field) {
+        this.requireBytes(4, field);
+        const value = this.data[this.offset] |
+            (this.data[this.offset + 1] << 8) |
+            (this.data[this.offset + 2] << 16) |
+            (this.data[this.offset + 3] << 24);
+        this.offset += 4;
+        return value >>> 0;
+    }
+    skip(length, field) {
+        this.requireBytes(length, field);
+        this.offset += length;
+    }
+    readString(field) {
+        const length = this.readU32(`${field} length`);
+        this.requireBytes(length, field);
+        const raw = this.data.slice(this.offset, this.offset + length);
+        this.offset += length;
+        return Buffer$1.from(raw).toString('utf8');
+    }
+    skipBytes(field) {
+        const length = this.readU32(`${field} length`);
+        this.skip(length, field);
+    }
+    isAtEnd() {
+        return this.offset === this.data.length;
+    }
+}
+function normalizeOnchainPath(path) {
+    let normalized = path.startsWith('/') ? path.slice(1) : path;
+    if (normalized.endsWith('*') && normalized.length > 1) {
+        normalized = normalized.slice(0, -1);
+    }
+    if (normalized.endsWith('/')) {
+        normalized = normalized.slice(0, -1);
+    }
+    return normalized;
+}
+function skipBoundedFieldValue(cursor) {
+    const option = cursor.readU8('operation value option');
+    if (option === 0)
+        return;
+    if (option !== 1) {
+        throw new Error('Server signedTransaction has malformed Bounded field value option');
+    }
+    const variant = cursor.readU8('operation value variant');
+    switch (variant) {
+        case 0:
+        case 1:
+            cursor.skip(8, 'operation numeric value');
+            return;
+        case 2:
+            cursor.skip(1, 'operation bool value');
+            return;
+        case 3:
+            cursor.readString('operation string value');
+            return;
+        case 4:
+            cursor.skip(32, 'operation address value');
+            return;
+        default:
+            throw new Error(`Server signedTransaction has unsupported Bounded field value variant: ${variant}`);
+    }
+}
+function skipBoundedFieldOperation(cursor) {
+    cursor.readString('operation key');
+    skipBoundedFieldValue(cursor);
+    cursor.skip(1, 'operation kind');
+}
+function skipBoundedTxData(cursor, isV2) {
+    cursor.readString('txData plugin function key');
+    cursor.skipBytes('txData bytes');
+    if (isV2) {
+        cursor.skipBytes('txData raIndices');
+        return;
+    }
+    const raIndexCount = cursor.readU32('txData raIndices length');
+    cursor.skip(raIndexCount * 8, 'txData raIndices');
+}
+function parseBoundedSetDocumentsInstruction(data) {
+    if (data.length < 8) {
+        throw new Error('Server signedTransaction has malformed Bounded instruction data');
+    }
+    const discriminator = Array.from(data.slice(0, 8)).join(',');
+    if (!ALLOWED_BOUNDED_SET_DISCRIMINATORS.has(discriminator)) {
+        throw new Error('Server signedTransaction contains unsupported Bounded instruction');
+    }
+    const isV2 = discriminator === SET_DOCUMENTS_V2_DISCRIMINATOR;
+    const cursor = new BorshCursor(data, 8);
+    const appId = cursor.readString('appId');
+    const documentPaths = [];
+    const documentCount = cursor.readU32('documents length');
+    for (let i = 0; i < documentCount; i++) {
+        documentPaths.push(normalizeOnchainPath(cursor.readString('document path')));
+        const operationCount = cursor.readU32('operations length');
+        for (let j = 0; j < operationCount; j++) {
+            skipBoundedFieldOperation(cursor);
+        }
+    }
+    const deletePaths = [];
+    const deleteCount = cursor.readU32('delete paths length');
+    for (let i = 0; i < deleteCount; i++) {
+        deletePaths.push(normalizeOnchainPath(cursor.readString('delete path')));
+    }
+    const txDataCount = cursor.readU32('txData length');
+    for (let i = 0; i < txDataCount; i++) {
+        skipBoundedTxData(cursor, isV2);
+    }
+    const simulate = cursor.readU8('simulate');
+    if (simulate !== 0 && simulate !== 1) {
+        throw new Error('Server signedTransaction has malformed Bounded simulate flag');
+    }
+    if (!cursor.isAtEnd()) {
+        throw new Error('Server signedTransaction has trailing Bounded instruction data');
+    }
+    return { appId, documentPaths, deletePaths };
+}
+function assertSamePathSet(expectedPaths, actualPaths) {
+    const expected = new Set(expectedPaths.map(normalizeOnchainPath).filter(Boolean));
+    const actual = new Set(actualPaths.map(normalizeOnchainPath).filter(Boolean));
+    const missing = [...expected].filter(path => !actual.has(path));
+    const extra = [...actual].filter(path => !expected.has(path));
+    if (missing.length > 0 || extra.length > 0) {
+        const details = [
+            missing.length ? `missing paths: ${missing.join(', ')}` : '',
+            extra.length ? `unexpected paths: ${extra.join(', ')}` : '',
+        ].filter(Boolean).join('; ');
+        throw new Error(`Server signedTransaction Bounded instruction paths do not match requested write paths (${details})`);
+    }
+}
+function validatePresignedSignedTransaction(transaction, sol) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const accountKeys = transaction.message.staticAccountKeys;
+    let boundedInstructionCount = 0;
+    const actualWritePaths = [];
+    for (const ix of transaction.message.compiledInstructions) {
+        if (ix.programIdIndex >= accountKeys.length) {
+            throw new Error('Server signedTransaction has program ID in lookup table (not allowed)');
+        }
+        const programId = accountKeys[ix.programIdIndex].toBase58();
+        if (!ALLOWED_SERVER_TX_PROGRAMS.has(programId)) {
+            throw new Error(`Server signedTransaction contains unauthorized program: ${programId}`);
+        }
+        const data = ix.data instanceof Uint8Array ? ix.data : Buffer$1.from((_a = ix.data) !== null && _a !== void 0 ? _a : []);
+        if (programId === SYSTEM_PROGRAM_ID) {
+            throw new Error('Server signedTransaction contains unauthorized System Program instruction');
+        }
+        if (programId === BOUNDED_PROGRAM_MAINNET || programId === BOUNDED_PROGRAM_DEVNET) {
+            boundedInstructionCount += 1;
+            const parsed = parseBoundedSetDocumentsInstruction(data);
+            if (parsed.appId !== sol.appId) {
+                throw new Error('Server signedTransaction Bounded instruction appId does not match configured appId');
+            }
+            actualWritePaths.push(...parsed.documentPaths, ...parsed.deletePaths);
+        }
+    }
+    if (boundedInstructionCount !== 1) {
+        throw new Error('Server signedTransaction must contain exactly one Bounded set-documents instruction');
+    }
+    const expectedWritePaths = [
+        ...(((_d = (_c = (_b = sol.txArgs) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.setDocumentData) !== null && _d !== void 0 ? _d : []).map((doc) => doc.path)),
+        ...((_g = (_f = (_e = sol.txArgs) === null || _e === void 0 ? void 0 : _e[0]) === null || _f === void 0 ? void 0 : _f.deletePaths) !== null && _g !== void 0 ? _g : []),
+    ];
+    assertSamePathSet(expectedWritePaths, actualWritePaths);
+}
+function assertAllowedServerPreInstructions(preInstructions) {
+    for (const [index, ix] of (preInstructions !== null && preInstructions !== void 0 ? preInstructions : []).entries()) {
+        if (ix.programId.equals(SystemProgram.programId)) {
+            throw new Error(`Server preInstruction[${index}] contains unauthorized System Program instruction`);
+        }
     }
 }
 class SolanaKeypairProvider {
-    constructor(networkUrl = null, keypair) {
-        this.networkUrl = networkUrl;
+    constructor(rpcUrl = null, keypair) {
+        this.rpcUrl = rpcUrl;
         this.explicitKeypair = keypair;
     }
     get keypair() {
@@ -119,7 +329,8 @@ class SolanaKeypairProvider {
      *
      * This method handles blockhash and transaction confirmation automatically - you do NOT need to
      * set recentBlockhash or lastValidBlockHeight on the transaction before calling this method.
-     * The network/RPC URL is derived from the provider's configuration (set during initialization).
+     * Requires an explicit RPC URL configured on the provider because this method has no
+     * Solana transaction payload network to resolve.
      *
      * @param transaction - The transaction to sign and submit (Transaction or VersionedTransaction)
      * @param feePayer - Optional fee payer public key. If not provided and the transaction doesn't
@@ -203,20 +414,23 @@ class SolanaKeypairProvider {
         }
         return { signature: sig, txInfo };
     }
-    getRpcUrl(network) {
-        if (this.networkUrl) {
-            return this.networkUrl;
-        }
-        if (network === 'solana_devnet') {
-            return SOLANA_DEVNET_RPC_URL;
+    requireSupportedNetwork(network) {
+        const networkName = network === null || network === void 0 ? void 0 : network.trim();
+        if (!networkName) {
+            throw new Error(`Supported sol.network is required for Solana transaction submission; expected one of: ${SUPPORTED_SOLANA_NETWORKS.join(', ')}.`);
         }
-        else if (network === 'solana_mainnet') {
-            return SOLANA_MAINNET_RPC_URL;
+        if (!SUPPORTED_SOLANA_NETWORK_SET.has(networkName)) {
+            throw new Error(`Unsupported Solana network "${networkName}". Supported networks: ${SUPPORTED_SOLANA_NETWORKS.join(', ')}.`);
         }
-        else if (network === 'surfnet') {
-            return SURFNET_RPC_URL;
+        return networkName;
+    }
+    getRpcUrl() {
+        var _a;
+        const explicitRpcUrl = (_a = this.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+        if (explicitRpcUrl) {
+            return explicitRpcUrl;
         }
-        return SOLANA_MAINNET_RPC_URL; // default to mainnet
+        throw new Error('Solana RPC URL is required for server keypair transaction submission; pass an explicit rpcUrl when creating SolanaKeypairProvider.');
     }
     /* ----------------------------------------------------------- *
      * Transaction runner
@@ -225,6 +439,8 @@ class SolanaKeypairProvider {
         if (!sol)
             throw new Error('Solana transaction data required');
         const kp = this.keypair;
+        this.requireSupportedNetwork(sol.network);
+        const rpcUrl = this.getRpcUrl();
         // Helper for duck typing - checks if transaction is legacy Transaction vs VersionedTransaction
         const isLegacyTx = (tx) => {
             return 'recentBlockhash' in tx && !('message' in tx && 'staticAccountKeys' in tx.message);
@@ -273,11 +489,14 @@ class SolanaKeypairProvider {
         let errorMessage = "";
         while (retries < 5) {
             try {
-                toReturn = await this.runTransactionInner(sol, opts, wallet, kp, deduped);
+                toReturn = await this.runTransactionInner(sol, opts, wallet, kp, deduped, rpcUrl);
                 didPass = true;
                 break;
             }
             catch (error) {
+                if (isPermanentPresignedTransactionError(error)) {
+                    throw error;
+                }
                 console.log("Error building and sending transaction on retry:", retries, error);
                 await new Promise(resolve => setTimeout(resolve, delay));
                 // Exponential backoff
@@ -291,9 +510,8 @@ class SolanaKeypairProvider {
         }
         return toReturn;
     }
-    async runTransactionInner(sol, opts, wallet, kp, deduped) {
+    async runTransactionInner(sol, opts, wallet, kp, deduped, rpcUrl) {
         var _a, _b, _c;
-        let rpcUrl = this.getRpcUrl(sol.network);
         const connection = new Connection(rpcUrl, 'confirmed');
         const anchorProvider = new anchor.AnchorProvider(connection, wallet, anchor.AnchorProvider.defaultOptions());
         const app_id = sol.appId;
@@ -307,11 +525,16 @@ class SolanaKeypairProvider {
         let lastValidBlockHeight;
         if (sol.signedTransaction) {
             tx = VersionedTransaction.deserialize(Buffer$1.from(sol.signedTransaction, 'base64'));
-            const latestBlockhash = await connection.getLatestBlockhash('confirmed');
-            blockhash = latestBlockhash.blockhash;
-            lastValidBlockHeight = latestBlockhash.lastValidBlockHeight;
+            validatePresignedSignedTransaction(tx, sol);
+            blockhash = tx.message.recentBlockhash;
+            const isValid = await connection.isBlockhashValid(blockhash, { commitment: 'confirmed' });
+            if (!isValid.value) {
+                throw new Error(`${PRESIGNED_BLOCKHASH_ERROR}; request a fresh server-built transaction.`);
+            }
+            lastValidBlockHeight = 0;
         }
         else {
+            assertAllowedServerPreInstructions(sol.preInstructions);
             const result = await buildSetDocumentsTransaction(connection, sol.txArgs[0].idl, anchorProvider, kp.publicKey, {
                 app_id,
                 documents: sol.txArgs[0].setDocumentData,
@@ -326,31 +549,33 @@ class SolanaKeypairProvider {
         const isLegacyTx = (t) => {
             return 'recentBlockhash' in t && !('message' in t && 'staticAccountKeys' in t.message);
         };
-        // Refresh blockhash and lastValidBlockHeight
         // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
         if (isLegacyTx(tx)) {
+            if (!sol.signedTransaction) {
+                tx.recentBlockhash = blockhash;
+                tx.lastValidBlockHeight = lastValidBlockHeight;
+                tx.feePayer = kp.publicKey;
+            }
             tx.partialSign(kp);
-            tx.recentBlockhash = blockhash;
-            tx.lastValidBlockHeight = lastValidBlockHeight;
-            tx.feePayer = kp.publicKey;
         }
         else {
-            tx.sign([kp]);
-            tx.message.recentBlockhash = blockhash;
-        }
-        // 3️⃣  Optional priority‑fee instruction
-        const rawUnsigned = tx.serialize({ requireAllSignatures: false });
-        const microLamports = await fetchPriorityFee(connection.rpcEndpoint, rawUnsigned);
-        if (microLamports != null) {
-            // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
-            if (isLegacyTx(tx)) {
-                tx.instructions.unshift(ComputeBudgetProgram.setComputeUnitPrice({ microLamports }));
-                tx.partialSign(kp);
+            if (!sol.signedTransaction) {
+                tx.message.recentBlockhash = blockhash;
             }
-            else {
-                // For pre-signed (attestation) transactions, we can't rebuild — skip priority fee
-                if (!sol.signedTransaction) {
-                    // Rebuild the transaction with the new priority fee
+            tx.sign([kp]);
+        }
+        // 3️⃣  Optional priority-fee instruction. Pre-signed transactions are
+        // immutable at this point; preserve their exact message and skip estimation.
+        if (!sol.signedTransaction) {
+            const rawUnsigned = tx.serialize({ requireAllSignatures: false });
+            const microLamports = await fetchPriorityFee(connection.rpcEndpoint, rawUnsigned);
+            if (microLamports != null) {
+                // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
+                if (isLegacyTx(tx)) {
+                    tx.instructions.unshift(ComputeBudgetProgram.setComputeUnitPrice({ microLamports }));
+                    tx.partialSign(kp);
+                }
+                else {
                     const roundTwo = await buildSetDocumentsTransaction(connection, sol.txArgs[0].idl, anchorProvider, kp.publicKey, {
                         app_id,
                         documents: sol.txArgs[0].setDocumentData,
@@ -360,8 +585,8 @@ class SolanaKeypairProvider {
                     tx = roundTwo.tx;
                     blockhash = roundTwo.blockhash;
                     lastValidBlockHeight = roundTwo.lastValidBlockHeight;
-                    tx.sign([kp]);
                     tx.message.recentBlockhash = blockhash;
+                    tx.sign([kp]);
                 }
             }
         }
@@ -432,9 +657,6 @@ class OffchainAuthProvider {
 }
 
 let currentAuthProvider = null;
-const SOLANA_DEVNET_RPC_URL = "https://idelle-8nxsep-fast-devnet.helius-rpc.com";
-const SOLANA_MAINNET_RPC_URL = "https://celestia-cegncv-fast-mainnet.helius-rpc.com";
-const SURFNET_RPC_URL = "https://surfpool.fly.dev";
 async function getAuthProvider() {
     var _a;
     const config = await getConfig();