@bounded-sh/server 0.0.17 → 0.0.19

package/dist/index.js

@@ -1,11 +1,11 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var buffer = require('buffer');
 var web3_js = require('@solana/web3.js');
+var bs58 = require('bs58');
+var buffer = require('buffer');
 var anchor = require('@coral-xyz/anchor');
 var nacl = require('tweetnacl');
-var bs58 = require('bs58');
 var crypto = require('crypto');
 
 function _interopNamespaceDefault(e) {
@@ -28,40 +28,70 @@ function _interopNamespaceDefault(e) {
 var anchor__namespace = /*#__PURE__*/_interopNamespaceDefault(anchor);
 var crypto__namespace = /*#__PURE__*/_interopNamespaceDefault(crypto);
 
-/* ------------------------------------------------------------- *
- * KEYPAIR ENV-VAR (only consulted when no explicit keypair is given)
- *
- * Most code should pass a keypair explicitly — `createWalletClient({ keypair })`
- * does. The env var is the fallback for the global `set/get` path. `BOUNDED_*`
- * is the canonical name (it matches the CLI's `BOUNDED_PRIVATE_KEY`).
- * ------------------------------------------------------------- */
-const ENV_VARS = ['BOUNDED_PRIVATE_KEY']; // base-58 or JSON array
-function loadKeypairFromEnv() {
-    var _a;
-    let secret;
-    let found;
-    for (const name of ENV_VARS) {
-        const v = (_a = process === null || process === void 0 ? void 0 : process.env) === null || _a === void 0 ? void 0 : _a[name];
-        if (v) {
-            secret = v;
-            found = name;
-            break;
-        }
-    }
-    if (!secret) {
-        throw new Error(`No server keypair: set ${ENV_VARS[0]} to a base58 secret key (or JSON array), ` +
-            `or pass one explicitly via createWalletClient({ keypair }).`);
-    }
-    try {
-        const secretKey = secret.trim().startsWith('[')
-            ? Uint8Array.from(JSON.parse(secret))
-            : bs58.decode(secret.trim());
-        return web3_js.Keypair.fromSecretKey(secretKey);
-    }
-    catch (err) {
-        throw new Error(`Unable to parse ${found}. Ensure it is valid base58 or a JSON array.`);
-    }
+async function init(newConfig) {
+    await core.init(Object.assign(Object.assign({}, newConfig), { authProvider: null, isServer: true, skipBackendInit: true }));
+}
+
+async function getAuthProvider() {
+    throw new Error('Server auth providers are not process-global. Use createWalletClient({ keypair }) and call that client\'s methods.');
 }
+
+function explicitClientOnly(name) {
+    throw new Error(`${name} is not available as a tarobase-server top-level auth operation. ` +
+        'Use createWalletClient({ keypair }) and call the returned client method.');
+}
+async function get(..._args) { explicitClientOnly('get'); }
+async function getMany(..._args) { explicitClientOnly('getMany'); }
+async function set(..._args) { explicitClientOnly('set'); }
+async function setMany(..._args) { explicitClientOnly('setMany'); }
+async function setFile(..._args) { explicitClientOnly('setFile'); }
+async function getFiles(..._args) { explicitClientOnly('getFiles'); }
+async function search(..._args) { explicitClientOnly('search'); }
+async function queryAggregate(..._args) { explicitClientOnly('queryAggregate'); }
+async function runQuery(..._args) { explicitClientOnly('runQuery'); }
+async function runQueryMany(..._args) { explicitClientOnly('runQueryMany'); }
+async function runExpression(..._args) { explicitClientOnly('runExpression'); }
+async function runExpressionMany(..._args) { explicitClientOnly('runExpressionMany'); }
+async function signMessage(..._args) { explicitClientOnly('signMessage'); }
+async function signTransaction(..._args) { explicitClientOnly('signTransaction'); }
+async function signAndSubmitTransaction(..._args) { explicitClientOnly('signAndSubmitTransaction'); }
+async function count(..._args) { explicitClientOnly('count'); }
+async function aggregate(..._args) { explicitClientOnly('aggregate'); }
+async function subscribe(..._args) { explicitClientOnly('subscribe'); }
+async function invokeFunction(..._args) { explicitClientOnly('invokeFunction'); }
+async function liveIntent(..._args) { explicitClientOnly('liveIntent'); }
+async function liveStatus(..._args) { explicitClientOnly('liveStatus'); }
+const functions = {
+    invoke: async (..._args) => explicitClientOnly('functions.invoke'),
+};
+const live = {
+    intent: async (..._args) => explicitClientOnly('live.intent'),
+    status: async (..._args) => explicitClientOnly('live.status'),
+};
+
+async function getIdToken() {
+    throw new Error('getIdToken is not available as a tarobase-server top-level auth operation. Use createWalletClient({ keypair }) and call the returned client methods.');
+}
+
+const PRESIGNED_BLOCKHASH_ERROR = 'Server signedTransaction blockhash is stale or expired';
+const BOUNDED_PROGRAM_MAINNET = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
+const BOUNDED_PROGRAM_DEVNET = 'taro6CvKqwrYrDc16ufYgzQ2NZcyyVKStffbtudrhRu';
+const COMPUTE_BUDGET_PROGRAM = 'ComputeBudget111111111111111111111111111111';
+const SYSTEM_PROGRAM_ID = '11111111111111111111111111111111';
+const SUPPORTED_SOLANA_NETWORKS = ['solana_devnet', 'solana_mainnet', 'surfnet'];
+const SUPPORTED_SOLANA_NETWORK_SET = new Set(SUPPORTED_SOLANA_NETWORKS);
+const ALLOWED_SERVER_TX_PROGRAMS = new Set([
+    BOUNDED_PROGRAM_MAINNET,
+    BOUNDED_PROGRAM_DEVNET,
+    COMPUTE_BUDGET_PROGRAM,
+    SYSTEM_PROGRAM_ID,
+]);
+const SET_DOCUMENTS_DISCRIMINATOR = '79,46,72,73,24,79,66,245';
+const SET_DOCUMENTS_V2_DISCRIMINATOR = '22,236,242,185,145,61,26,39';
+const ALLOWED_BOUNDED_SET_DISCRIMINATORS = new Set([
+    SET_DOCUMENTS_DISCRIMINATOR,
+    SET_DOCUMENTS_V2_DISCRIMINATOR,
+]);
 /* ──────────────────────────────────────────────────────────
  * Helper – fetch getPriorityFeeEstimate
  * ──────────────────────────────────────────────────────── */
@@ -84,28 +114,221 @@ async function fetchPriorityFee(rpcEndpoint, rawUnsignedTxBuffer) {
         });
         const data = await res.json();
         const fee = (_b = (_a = data === null || data === void 0 ? void 0 : data.result) === null || _a === void 0 ? void 0 : _a.priorityFeeEstimate) !== null && _b !== void 0 ? _b : null;
-        console.log("Got fee from Helius", fee);
         if (fee != null && fee > 0) {
             return Math.ceil(Number(fee) * 1.2);
         }
-        else {
-            console.log("No fee from Helius, using default 10000");
-            return Math.ceil(10000 * 1.2);
-        }
+        console.warn("Priority-fee estimate returned no positive fee; skipping priority fee instruction");
+        return null;
     }
     catch (err) {
-        console.warn("Priority‑fee estimate failed:", err);
-        return Math.ceil(10000 * 1.2);
+        console.warn("Priority-fee estimate failed; skipping priority fee instruction:", err);
+        return null;
+    }
+}
+function isPresignedBlockhashError(error) {
+    return typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' && error.message.includes(PRESIGNED_BLOCKHASH_ERROR);
+}
+function isPermanentPresignedTransactionError(error) {
+    return isPresignedBlockhashError(error) ||
+        (typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' && (error.message.startsWith('Server signedTransaction') ||
+            error.message.startsWith('Server preInstruction')));
+}
+class BorshCursor {
+    constructor(data, offset) {
+        this.data = data;
+        this.offset = offset;
+    }
+    requireBytes(length, field) {
+        if (this.offset + length > this.data.length) {
+            throw new Error(`Server signedTransaction has malformed Bounded instruction data while reading ${field}`);
+        }
+    }
+    readU8(field) {
+        this.requireBytes(1, field);
+        return this.data[this.offset++];
+    }
+    readU32(field) {
+        this.requireBytes(4, field);
+        const value = this.data[this.offset] |
+            (this.data[this.offset + 1] << 8) |
+            (this.data[this.offset + 2] << 16) |
+            (this.data[this.offset + 3] << 24);
+        this.offset += 4;
+        return value >>> 0;
+    }
+    skip(length, field) {
+        this.requireBytes(length, field);
+        this.offset += length;
+    }
+    readString(field) {
+        const length = this.readU32(`${field} length`);
+        this.requireBytes(length, field);
+        const raw = this.data.slice(this.offset, this.offset + length);
+        this.offset += length;
+        return buffer.Buffer.from(raw).toString('utf8');
+    }
+    skipBytes(field) {
+        const length = this.readU32(`${field} length`);
+        this.skip(length, field);
+    }
+    isAtEnd() {
+        return this.offset === this.data.length;
+    }
+}
+function normalizeOnchainPath(path) {
+    let normalized = path.startsWith('/') ? path.slice(1) : path;
+    if (normalized.endsWith('*') && normalized.length > 1) {
+        normalized = normalized.slice(0, -1);
+    }
+    if (normalized.endsWith('/')) {
+        normalized = normalized.slice(0, -1);
+    }
+    return normalized;
+}
+function skipBoundedFieldValue(cursor) {
+    const option = cursor.readU8('operation value option');
+    if (option === 0)
+        return;
+    if (option !== 1) {
+        throw new Error('Server signedTransaction has malformed Bounded field value option');
+    }
+    const variant = cursor.readU8('operation value variant');
+    switch (variant) {
+        case 0:
+        case 1:
+            cursor.skip(8, 'operation numeric value');
+            return;
+        case 2:
+            cursor.skip(1, 'operation bool value');
+            return;
+        case 3:
+            cursor.readString('operation string value');
+            return;
+        case 4:
+            cursor.skip(32, 'operation address value');
+            return;
+        default:
+            throw new Error(`Server signedTransaction has unsupported Bounded field value variant: ${variant}`);
+    }
+}
+function skipBoundedFieldOperation(cursor) {
+    cursor.readString('operation key');
+    skipBoundedFieldValue(cursor);
+    cursor.skip(1, 'operation kind');
+}
+function skipBoundedTxData(cursor, isV2) {
+    cursor.readString('txData plugin function key');
+    cursor.skipBytes('txData bytes');
+    if (isV2) {
+        cursor.skipBytes('txData raIndices');
+        return;
+    }
+    const raIndexCount = cursor.readU32('txData raIndices length');
+    cursor.skip(raIndexCount * 8, 'txData raIndices');
+}
+function parseBoundedSetDocumentsInstruction(data) {
+    if (data.length < 8) {
+        throw new Error('Server signedTransaction has malformed Bounded instruction data');
+    }
+    const discriminator = Array.from(data.slice(0, 8)).join(',');
+    if (!ALLOWED_BOUNDED_SET_DISCRIMINATORS.has(discriminator)) {
+        throw new Error('Server signedTransaction contains unsupported Bounded instruction');
+    }
+    const isV2 = discriminator === SET_DOCUMENTS_V2_DISCRIMINATOR;
+    const cursor = new BorshCursor(data, 8);
+    const appId = cursor.readString('appId');
+    const documentPaths = [];
+    const documentCount = cursor.readU32('documents length');
+    for (let i = 0; i < documentCount; i++) {
+        documentPaths.push(normalizeOnchainPath(cursor.readString('document path')));
+        const operationCount = cursor.readU32('operations length');
+        for (let j = 0; j < operationCount; j++) {
+            skipBoundedFieldOperation(cursor);
+        }
+    }
+    const deletePaths = [];
+    const deleteCount = cursor.readU32('delete paths length');
+    for (let i = 0; i < deleteCount; i++) {
+        deletePaths.push(normalizeOnchainPath(cursor.readString('delete path')));
+    }
+    const txDataCount = cursor.readU32('txData length');
+    for (let i = 0; i < txDataCount; i++) {
+        skipBoundedTxData(cursor, isV2);
+    }
+    const simulate = cursor.readU8('simulate');
+    if (simulate !== 0 && simulate !== 1) {
+        throw new Error('Server signedTransaction has malformed Bounded simulate flag');
+    }
+    if (!cursor.isAtEnd()) {
+        throw new Error('Server signedTransaction has trailing Bounded instruction data');
+    }
+    return { appId, documentPaths, deletePaths };
+}
+function assertSamePathSet(expectedPaths, actualPaths) {
+    const expected = new Set(expectedPaths.map(normalizeOnchainPath).filter(Boolean));
+    const actual = new Set(actualPaths.map(normalizeOnchainPath).filter(Boolean));
+    const missing = [...expected].filter(path => !actual.has(path));
+    const extra = [...actual].filter(path => !expected.has(path));
+    if (missing.length > 0 || extra.length > 0) {
+        const details = [
+            missing.length ? `missing paths: ${missing.join(', ')}` : '',
+            extra.length ? `unexpected paths: ${extra.join(', ')}` : '',
+        ].filter(Boolean).join('; ');
+        throw new Error(`Server signedTransaction Bounded instruction paths do not match requested write paths (${details})`);
+    }
+}
+function validatePresignedSignedTransaction(transaction, sol) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const accountKeys = transaction.message.staticAccountKeys;
+    let boundedInstructionCount = 0;
+    const actualWritePaths = [];
+    for (const ix of transaction.message.compiledInstructions) {
+        if (ix.programIdIndex >= accountKeys.length) {
+            throw new Error('Server signedTransaction has program ID in lookup table (not allowed)');
+        }
+        const programId = accountKeys[ix.programIdIndex].toBase58();
+        if (!ALLOWED_SERVER_TX_PROGRAMS.has(programId)) {
+            throw new Error(`Server signedTransaction contains unauthorized program: ${programId}`);
+        }
+        const data = ix.data instanceof Uint8Array ? ix.data : buffer.Buffer.from((_a = ix.data) !== null && _a !== void 0 ? _a : []);
+        if (programId === SYSTEM_PROGRAM_ID) {
+            throw new Error('Server signedTransaction contains unauthorized System Program instruction');
+        }
+        if (programId === BOUNDED_PROGRAM_MAINNET || programId === BOUNDED_PROGRAM_DEVNET) {
+            boundedInstructionCount += 1;
+            const parsed = parseBoundedSetDocumentsInstruction(data);
+            if (parsed.appId !== sol.appId) {
+                throw new Error('Server signedTransaction Bounded instruction appId does not match configured appId');
+            }
+            actualWritePaths.push(...parsed.documentPaths, ...parsed.deletePaths);
+        }
+    }
+    if (boundedInstructionCount !== 1) {
+        throw new Error('Server signedTransaction must contain exactly one Bounded set-documents instruction');
+    }
+    const expectedWritePaths = [
+        ...(((_d = (_c = (_b = sol.txArgs) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.setDocumentData) !== null && _d !== void 0 ? _d : []).map((doc) => doc.path)),
+        ...((_g = (_f = (_e = sol.txArgs) === null || _e === void 0 ? void 0 : _e[0]) === null || _f === void 0 ? void 0 : _f.deletePaths) !== null && _g !== void 0 ? _g : []),
+    ];
+    assertSamePathSet(expectedWritePaths, actualWritePaths);
+}
+function assertAllowedServerPreInstructions(preInstructions) {
+    for (const [index, ix] of (preInstructions !== null && preInstructions !== void 0 ? preInstructions : []).entries()) {
+        if (ix.programId.equals(web3_js.SystemProgram.programId)) {
+            throw new Error(`Server preInstruction[${index}] contains unauthorized System Program instruction`);
+        }
     }
 }
 class SolanaKeypairProvider {
-    constructor(networkUrl = null, keypair) {
-        this.networkUrl = networkUrl;
-        this.explicitKeypair = keypair;
+    constructor(rpcUrl, serverKeypair) {
+        this.rpcUrl = rpcUrl;
+        this.serverKeypair = serverKeypair;
     }
     get keypair() {
-        var _a, _b;
-        return ((_a = this.cachedKeypair) !== null && _a !== void 0 ? _a : (this.cachedKeypair = (_b = this.explicitKeypair) !== null && _b !== void 0 ? _b : loadKeypairFromEnv()));
+        if (!this.serverKeypair) {
+            throw new Error('Server keypair is required; use createWalletClient({ keypair }) or pass a Keypair to SolanaKeypairProvider.');
+        }
+        return this.serverKeypair;
     }
     /* ----------------------------------------------------------- *
      * (Auth stubs – fill in later if needed)
@@ -139,7 +362,8 @@ class SolanaKeypairProvider {
      *
      * This method handles blockhash and transaction confirmation automatically - you do NOT need to
      * set recentBlockhash or lastValidBlockHeight on the transaction before calling this method.
-     * The network/RPC URL is derived from the provider's configuration (set during initialization).
+     * Requires an explicit RPC URL configured on the provider because this method has no
+     * Solana transaction payload network to resolve.
      *
      * @param transaction - The transaction to sign and submit (Transaction or VersionedTransaction)
      * @param feePayer - Optional fee payer public key. If not provided and the transaction doesn't
@@ -223,20 +447,23 @@ class SolanaKeypairProvider {
         }
         return { signature: sig, txInfo };
     }
-    getRpcUrl(network) {
-        if (this.networkUrl) {
-            return this.networkUrl;
-        }
-        if (network === 'solana_devnet') {
-            return SOLANA_DEVNET_RPC_URL;
+    requireSupportedNetwork(network) {
+        const networkName = network === null || network === void 0 ? void 0 : network.trim();
+        if (!networkName) {
+            throw new Error(`Supported sol.network is required for Solana transaction submission; expected one of: ${SUPPORTED_SOLANA_NETWORKS.join(', ')}.`);
         }
-        else if (network === 'solana_mainnet') {
-            return SOLANA_MAINNET_RPC_URL;
+        if (!SUPPORTED_SOLANA_NETWORK_SET.has(networkName)) {
+            throw new Error(`Unsupported Solana network "${networkName}". Supported networks: ${SUPPORTED_SOLANA_NETWORKS.join(', ')}.`);
         }
-        else if (network === 'surfnet') {
-            return SURFNET_RPC_URL;
+        return networkName;
+    }
+    getRpcUrl() {
+        var _a;
+        const explicitRpcUrl = (_a = this.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+        if (explicitRpcUrl) {
+            return explicitRpcUrl;
         }
-        return SOLANA_MAINNET_RPC_URL; // default to mainnet
+        throw new Error('Solana RPC URL is required for server keypair transaction submission; pass an explicit rpcUrl when creating SolanaKeypairProvider.');
     }
     /* ----------------------------------------------------------- *
      * Transaction runner
@@ -245,6 +472,8 @@ class SolanaKeypairProvider {
         if (!sol)
             throw new Error('Solana transaction data required');
         const kp = this.keypair;
+        this.requireSupportedNetwork(sol.network);
+        const rpcUrl = this.getRpcUrl();
         // Helper for duck typing - checks if transaction is legacy Transaction vs VersionedTransaction
         const isLegacyTx = (tx) => {
             return 'recentBlockhash' in tx && !('message' in tx && 'staticAccountKeys' in tx.message);
@@ -293,11 +522,14 @@ class SolanaKeypairProvider {
         let errorMessage = "";
         while (retries < 5) {
             try {
-                toReturn = await this.runTransactionInner(sol, opts, wallet, kp, deduped);
+                toReturn = await this.runTransactionInner(sol, opts, wallet, kp, deduped, rpcUrl);
                 didPass = true;
                 break;
             }
             catch (error) {
+                if (isPermanentPresignedTransactionError(error)) {
+                    throw error;
+                }
                 console.log("Error building and sending transaction on retry:", retries, error);
                 await new Promise(resolve => setTimeout(resolve, delay));
                 // Exponential backoff
@@ -311,9 +543,8 @@ class SolanaKeypairProvider {
         }
         return toReturn;
     }
-    async runTransactionInner(sol, opts, wallet, kp, deduped) {
+    async runTransactionInner(sol, opts, wallet, kp, deduped, rpcUrl) {
         var _a, _b, _c;
-        let rpcUrl = this.getRpcUrl(sol.network);
         const connection = new web3_js.Connection(rpcUrl, 'confirmed');
         const anchorProvider = new anchor__namespace.AnchorProvider(connection, wallet, anchor__namespace.AnchorProvider.defaultOptions());
         const app_id = sol.appId;
@@ -327,11 +558,16 @@ class SolanaKeypairProvider {
         let lastValidBlockHeight;
         if (sol.signedTransaction) {
             tx = web3_js.VersionedTransaction.deserialize(buffer.Buffer.from(sol.signedTransaction, 'base64'));
-            const latestBlockhash = await connection.getLatestBlockhash('confirmed');
-            blockhash = latestBlockhash.blockhash;
-            lastValidBlockHeight = latestBlockhash.lastValidBlockHeight;
+            validatePresignedSignedTransaction(tx, sol);
+            blockhash = tx.message.recentBlockhash;
+            const isValid = await connection.isBlockhashValid(blockhash, { commitment: 'confirmed' });
+            if (!isValid.value) {
+                throw new Error(`${PRESIGNED_BLOCKHASH_ERROR}; request a fresh server-built transaction.`);
+            }
+            lastValidBlockHeight = 0;
         }
         else {
+            assertAllowedServerPreInstructions(sol.preInstructions);
             const result = await core.buildSetDocumentsTransaction(connection, sol.txArgs[0].idl, anchorProvider, kp.publicKey, {
                 app_id,
                 documents: sol.txArgs[0].setDocumentData,
@@ -346,31 +582,33 @@ class SolanaKeypairProvider {
         const isLegacyTx = (t) => {
             return 'recentBlockhash' in t && !('message' in t && 'staticAccountKeys' in t.message);
         };
-        // Refresh blockhash and lastValidBlockHeight
         // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
         if (isLegacyTx(tx)) {
+            if (!sol.signedTransaction) {
+                tx.recentBlockhash = blockhash;
+                tx.lastValidBlockHeight = lastValidBlockHeight;
+                tx.feePayer = kp.publicKey;
+            }
             tx.partialSign(kp);
-            tx.recentBlockhash = blockhash;
-            tx.lastValidBlockHeight = lastValidBlockHeight;
-            tx.feePayer = kp.publicKey;
         }
         else {
+            if (!sol.signedTransaction) {
+                tx.message.recentBlockhash = blockhash;
+            }
             tx.sign([kp]);
-            tx.message.recentBlockhash = blockhash;
         }
-        // 3️⃣  Optional priority‑fee instruction
-        const rawUnsigned = tx.serialize({ requireAllSignatures: false });
-        const microLamports = await fetchPriorityFee(connection.rpcEndpoint, rawUnsigned);
-        if (microLamports != null) {
-            // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
-            if (isLegacyTx(tx)) {
-                tx.instructions.unshift(web3_js.ComputeBudgetProgram.setComputeUnitPrice({ microLamports }));
-                tx.partialSign(kp);
-            }
-            else {
-                // For pre-signed (attestation) transactions, we can't rebuild — skip priority fee
-                if (!sol.signedTransaction) {
-                    // Rebuild the transaction with the new priority fee
+        // 3️⃣  Optional priority-fee instruction. Pre-signed transactions are
+        // immutable at this point; preserve their exact message and skip estimation.
+        if (!sol.signedTransaction) {
+            const rawUnsigned = tx.serialize({ requireAllSignatures: false });
+            const microLamports = await fetchPriorityFee(connection.rpcEndpoint, rawUnsigned);
+            if (microLamports != null) {
+                // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
+                if (isLegacyTx(tx)) {
+                    tx.instructions.unshift(web3_js.ComputeBudgetProgram.setComputeUnitPrice({ microLamports }));
+                    tx.partialSign(kp);
+                }
+                else {
                     const roundTwo = await core.buildSetDocumentsTransaction(connection, sol.txArgs[0].idl, anchorProvider, kp.publicKey, {
                         app_id,
                         documents: sol.txArgs[0].setDocumentData,
@@ -380,8 +618,8 @@ class SolanaKeypairProvider {
                     tx = roundTwo.tx;
                     blockhash = roundTwo.blockhash;
                     lastValidBlockHeight = roundTwo.lastValidBlockHeight;
-                    tx.sign([kp]);
                     tx.message.recentBlockhash = blockhash;
+                    tx.sign([kp]);
                 }
             }
         }
@@ -451,47 +689,6 @@ class OffchainAuthProvider {
     }
 }
 
-let currentAuthProvider = null;
-const SOLANA_DEVNET_RPC_URL = "https://idelle-8nxsep-fast-devnet.helius-rpc.com";
-const SOLANA_MAINNET_RPC_URL = "https://celestia-cegncv-fast-mainnet.helius-rpc.com";
-const SURFNET_RPC_URL = "https://surfpool.fly.dev";
-async function getAuthProvider() {
-    var _a;
-    const config = await core.getConfig();
-    if (currentAuthProvider) {
-        // If provider exists but chain is "offchain" and it's not already wrapped, rewrap it
-        if (config.chain === "offchain" && !(currentAuthProvider instanceof OffchainAuthProvider)) {
-            currentAuthProvider = new OffchainAuthProvider(currentAuthProvider);
-        }
-        return currentAuthProvider;
-    }
-    currentAuthProvider = await matchAuthProvider((_a = config.rpcUrl) !== null && _a !== void 0 ? _a : null);
-    // Wrap with OffchainAuthProvider for offchain chain
-    if (config.chain === "offchain") {
-        currentAuthProvider = new OffchainAuthProvider(currentAuthProvider);
-    }
-    return currentAuthProvider;
-}
-async function matchAuthProvider(rpcUrl) {
-    return new SolanaKeypairProvider(rpcUrl);
-}
-
-let authProviderInstance = null;
-async function init(newConfig) {
-    // Initialize config first so getAuthProvider can access it
-    // Server-side skips backend init since it already has all needed config
-    await core.init(Object.assign(Object.assign({}, newConfig), { isServer: true, skipBackendInit: true }));
-    // Get the auth provider (which will wrap it if chain is "offchain")
-    authProviderInstance = await getAuthProvider();
-    // Update config with the wrapped provider
-    await core.init(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance, isServer: true, skipBackendInit: true }));
-}
-
-// Wrapper for getIdToken - passes isServer=true for server-side usage
-async function getIdToken() {
-    return core.getIdToken(true);
-}
-
 var __rest = (undefined && undefined.__rest) || function (s, e) {
     var t = {};
     for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
@@ -641,8 +838,7 @@ class WalletClient {
         return core.queryAggregate(path, spec, Object.assign(Object.assign({}, opts), { _overrides: this.mergeReadOverrides(opts === null || opts === void 0 ? void 0 : opts._overrides) }));
     }
     /**
-     * Subscribe to real-time updates as THIS wallet's identity. Unlike the global
-     * `subscribe`, this needs no `BOUNDED_PRIVATE_KEY` env var — the WS connection
+     * Subscribe to real-time updates as THIS wallet's identity. The WS connection
      * authenticates with the wallet's own session (so read rules see the right
      * principal), and is scoped to its own connection so it never crosses another
      * identity. Accepts a bare callback or `{ onData, onError, filter, ... }`.
@@ -658,10 +854,9 @@ class WalletClient {
             } }));
     }
     /**
-     * Invoke a deployed Bounded Function AS this wallet's identity. Unlike the
-     * top-level `functions.invoke`, this needs no `BOUNDED_PRIVATE_KEY` env var —
-     * the dispatcher sees the wallet's verified session, so the function's `auth`
-     * rule + `ctx.user` reflect this client. Returns the function's JSON; throws
+     * Invoke a deployed Bounded Function AS this wallet's identity. The dispatcher
+     * sees the wallet's verified session, so the function's `auth` rule +
+     * `ctx.user` reflect this client. Returns the function's JSON; throws
      * `FunctionInvokeError` on 401/403/404/503.
      */
     async invoke(name, args = {}, opts = {}) {
@@ -969,117 +1164,46 @@ Object.defineProperty(exports, "LiveIntentError", {
     enumerable: true,
     get: function () { return core.LiveIntentError; }
 });
-Object.defineProperty(exports, "aggregate", {
-    enumerable: true,
-    get: function () { return core.aggregate; }
-});
-Object.defineProperty(exports, "count", {
-    enumerable: true,
-    get: function () { return core.count; }
-});
-Object.defineProperty(exports, "functions", {
-    enumerable: true,
-    get: function () { return core.functions; }
-});
-Object.defineProperty(exports, "get", {
-    enumerable: true,
-    get: function () { return core.get; }
-});
 Object.defineProperty(exports, "getConfig", {
     enumerable: true,
     get: function () { return core.getConfig; }
 });
-Object.defineProperty(exports, "getFiles", {
-    enumerable: true,
-    get: function () { return core.getFiles; }
-});
-Object.defineProperty(exports, "getMany", {
+Object.defineProperty(exports, "getWebhookKeysUrl", {
     enumerable: true,
-    get: function () { return core.getMany; }
-});
-Object.defineProperty(exports, "invokeFunction", {
-    enumerable: true,
-    get: function () { return core.invokeFunction; }
-});
-Object.defineProperty(exports, "live", {
-    enumerable: true,
-    get: function () { return core.live; }
-});
-Object.defineProperty(exports, "liveIntent", {
-    enumerable: true,
-    get: function () { return core.liveIntent; }
-});
-Object.defineProperty(exports, "liveStatus", {
-    enumerable: true,
-    get: function () { return core.liveStatus; }
-});
-Object.defineProperty(exports, "queryAggregate", {
-    enumerable: true,
-    get: function () { return core.queryAggregate; }
-});
-Object.defineProperty(exports, "runExpression", {
-    enumerable: true,
-    get: function () { return core.runExpression; }
-});
-Object.defineProperty(exports, "runExpressionMany", {
-    enumerable: true,
-    get: function () { return core.runExpressionMany; }
-});
-Object.defineProperty(exports, "runQuery", {
-    enumerable: true,
-    get: function () { return core.runQuery; }
-});
-Object.defineProperty(exports, "runQueryMany", {
-    enumerable: true,
-    get: function () { return core.runQueryMany; }
-});
-Object.defineProperty(exports, "search", {
-    enumerable: true,
-    get: function () { return core.search; }
-});
-Object.defineProperty(exports, "set", {
-    enumerable: true,
-    get: function () { return core.set; }
-});
-Object.defineProperty(exports, "setFile", {
-    enumerable: true,
-    get: function () { return core.setFile; }
-});
-Object.defineProperty(exports, "setMany", {
-    enumerable: true,
-    get: function () { return core.setMany; }
-});
-Object.defineProperty(exports, "signAndSubmitTransaction", {
-    enumerable: true,
-    get: function () { return core.signAndSubmitTransaction; }
-});
-Object.defineProperty(exports, "signMessage", {
-    enumerable: true,
-    get: function () { return core.signMessage; }
-});
-Object.defineProperty(exports, "signTransaction", {
-    enumerable: true,
-    get: function () { return core.signTransaction; }
-});
-Object.defineProperty(exports, "subscribe", {
-    enumerable: true,
-    get: function () { return core.subscribe; }
+    get: function () { return core.getWebhookKeysUrl; }
 });
 exports.DEFAULT_WEBHOOK_KEYS_URL = DEFAULT_WEBHOOK_KEYS_URL;
 exports.InMemoryReplayStore = InMemoryReplayStore;
 exports.WalletClient = WalletClient;
 exports.WebhookVerificationError = WebhookVerificationError;
+exports.aggregate = aggregate;
 exports.clearWebhookKeyCache = clearWebhookKeyCache;
 exports.clearWebhookReplayCache = clearWebhookReplayCache;
+exports.count = count;
 exports.createWalletClient = createWalletClient;
+exports.functions = functions;
+exports.get = get;
 exports.getAuthProvider = getAuthProvider;
+exports.getFiles = getFiles;
 exports.getIdToken = getIdToken;
+exports.getMany = getMany;
 exports.init = init;
+exports.invokeFunction = invokeFunction;
+exports.live = live;
+exports.liveIntent = liveIntent;
+exports.liveStatus = liveStatus;
+exports.queryAggregate = queryAggregate;
+exports.runExpression = runExpression;
+exports.runExpressionMany = runExpressionMany;
+exports.runQuery = runQuery;
+exports.runQueryMany = runQueryMany;
+exports.search = search;
+exports.set = set;
+exports.setFile = setFile;
+exports.setMany = setMany;
+exports.signAndSubmitTransaction = signAndSubmitTransaction;
+exports.signMessage = signMessage;
+exports.signTransaction = signTransaction;
+exports.subscribe = subscribe;
 exports.verifyWebhook = verifyWebhook;
-Object.keys(core).forEach(function (k) {
-    if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
-        enumerable: true,
-        get: function () { return core[k]; }
-    });
-});
 //# sourceMappingURL=index.js.map