@bounded-sh/server 0.0.41 → 0.0.44

package/dist/index.mjs

@@ -1,10 +1,12 @@
-import { init as init$1, convertRemainingAccounts, buildSetDocumentsTransaction, live as live$1, set as set$1, setMany as setMany$1, setFile as setFile$1, get as get$1, getMany as getMany$1, getFiles as getFiles$1, search as search$1, runQuery as runQuery$1, runQueryMany as runQueryMany$1, runExpression as runExpression$1, runExpressionMany as runExpressionMany$1, count as count$1, aggregate as aggregate$1, queryAggregate as queryAggregate$1, subscribe as subscribe$1, functions as functions$1, getConfig, ServerSessionManager, getWebhookKeysUrl } from '@bounded-sh/core';
+import { init as init$1, convertRemainingAccounts, buildSetDocumentsTransaction, normalizeEvmAddress, genAuthNonce, getConfig, genSiweMessage, createSessionWithSignature, assertCanonicalBoundedRuntimeWriteCalldata, live as live$1, set as set$1, setMany as setMany$1, setFile as setFile$1, get as get$1, getMany as getMany$1, getFiles as getFiles$1, search as search$1, runQuery as runQuery$1, runQueryMany as runQueryMany$1, runExpression as runExpression$1, runExpressionMany as runExpressionMany$1, count as count$1, aggregate as aggregate$1, queryAggregate as queryAggregate$1, subscribe as subscribe$1, functions as functions$1, ServerSessionManager, getWebhookKeysUrl } from '@bounded-sh/core';
 export { BoundedDeclineError, DECLINE_EVENT_NAME, FunctionInvokeError, InsufficientBalanceError, LiveIntentError, deriveDecline, getConfig, getWebhookKeysUrl } from '@bounded-sh/core';
 import { Connection, VersionedTransaction, ComputeBudgetProgram, SystemProgram, Keypair } from '@solana/web3.js';
 import bs58 from 'bs58';
 import { Buffer as Buffer$1 } from 'buffer';
 import * as anchor from '@coral-xyz/anchor';
 import nacl from 'tweetnacl';
+import { http, createWalletClient as createWalletClient$1, createPublicClient, defineChain } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
 
 async function init(newConfig) {
     await init$1(Object.assign(Object.assign({}, newConfig), { authProvider: null, isServer: true, skipBackendInit: true }));
@@ -657,6 +659,144 @@ class OffchainAuthProvider {
     }
 }
 
+const NO_SOLANA = 'An EVM keypair client cannot sign Solana transactions.';
+function normalizeChainConfig(input) {
+    var _a;
+    if (!Number.isSafeInteger(input.chainId) || input.chainId <= 0)
+        throw new Error('EVM chainId must be a positive safe integer');
+    let rpc;
+    try {
+        rpc = new URL(input.rpcUrl);
+    }
+    catch (_b) {
+        throw new Error(`EVM RPC URL is invalid for chain ${input.chainId}`);
+    }
+    if (rpc.protocol !== 'https:' && !(rpc.protocol === 'http:' && (rpc.hostname === 'localhost' || rpc.hostname === '127.0.0.1' || rpc.hostname === '[::1]'))) {
+        throw new Error(`EVM RPC URL must use HTTPS for chain ${input.chainId}`);
+    }
+    const runtimeAddress = normalizeEvmAddress(input.runtimeAddress);
+    if (!runtimeAddress)
+        throw new Error(`BoundedRuntime address is invalid for chain ${input.chainId}`);
+    return { chainId: input.chainId, rpcUrl: rpc.toString(), runtimeAddress, name: ((_a = input.name) === null || _a === void 0 ? void 0 : _a.trim()) || `EVM ${input.chainId}` };
+}
+function asViemChain(config) {
+    return defineChain({
+        id: config.chainId,
+        name: config.name,
+        nativeCurrency: { name: 'Native token', symbol: 'NATIVE', decimals: 18 },
+        rpcUrls: { default: { http: [config.rpcUrl] } },
+    });
+}
+class EvmKeypairProvider {
+    constructor(privateKey, defaultChainId, chainConfigs) {
+        this.chains = new Map();
+        if (!/^0x[0-9a-fA-F]{64}$/.test(privateKey))
+            throw new Error('Invalid EVM private key: expected 0x followed by 64 hex characters.');
+        this.account = privateKeyToAccount(privateKey);
+        const address = normalizeEvmAddress(this.account.address);
+        if (!address)
+            throw new Error('Could not derive a valid EVM address from the private key');
+        this.address = address;
+        for (const raw of chainConfigs) {
+            const chain = normalizeChainConfig(raw);
+            if (this.chains.has(chain.chainId))
+                throw new Error(`Duplicate EVM chain configuration: ${chain.chainId}`);
+            this.chains.set(chain.chainId, chain);
+        }
+        if (!this.chains.has(defaultChainId))
+            throw new Error(`Default EVM chain ${defaultChainId} is not configured`);
+        this.defaultChainId = defaultChainId;
+    }
+    user() {
+        return { id: this.address, address: null, evmAddress: this.address, provider: this };
+    }
+    async createBoundedSession() {
+        var _a, _b, _c;
+        const nonce = await genAuthNonce();
+        const { appId } = await getConfig();
+        const message = genSiweMessage(this.address, nonce, appId, 'server', 'https://server/login', { chainId: this.defaultChainId });
+        const signature = await this.account.signMessage({ message });
+        const session = await createSessionWithSignature(this.address, message, signature, 'siwe');
+        return {
+            address: this.address,
+            accessToken: String((_a = session.accessToken) !== null && _a !== void 0 ? _a : ''),
+            idToken: String((_b = session.idToken) !== null && _b !== void 0 ? _b : ''),
+            refreshToken: String((_c = session.refreshToken) !== null && _c !== void 0 ? _c : ''),
+        };
+    }
+    async login() { return this.user(); }
+    async restoreSession() { return this.user(); }
+    async logout() { }
+    async signMessage(message) {
+        return this.account.signMessage({ message });
+    }
+    async signTransaction(_transaction) {
+        throw new Error(NO_SOLANA);
+    }
+    async signAndSubmitTransaction(_transaction, _feePayer) {
+        throw new Error(NO_SOLANA);
+    }
+    async runTransaction(evm, sol, options) {
+        var _a;
+        if (evm && sol)
+            throw new Error('A transaction cannot target EVM and Solana at the same time.');
+        if (!evm || !evm.chainId || !evm.to || !evm.data)
+            throw new Error('A complete EVM transaction is required');
+        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)
+            throw new Error('EVM keypair writes submit atomically; shouldSubmitTx:false is unsupported.');
+        const config = this.chains.get(evm.chainId);
+        if (!config)
+            throw new Error(`EVM chain ${evm.chainId} is not configured for this wallet client`);
+        if (normalizeEvmAddress(evm.to) !== config.runtimeAddress)
+            throw new Error('EVM transaction target is not the configured BoundedRuntime');
+        if (evm.nonce !== undefined)
+            throw new Error('Server-supplied EVM nonces are not accepted');
+        try {
+            if (BigInt((_a = evm.value) !== null && _a !== void 0 ? _a : '0') !== BigInt(0))
+                throw new Error('BoundedRuntime.setDocuments cannot transfer native value');
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('cannot transfer'))
+                throw error;
+            throw new Error('Invalid EVM transaction value');
+        }
+        // The shared decoder accepts only canonical ordinary/attested document
+        // writes and rejects selector-prefix smuggling, aliases and trailing bytes.
+        assertCanonicalBoundedRuntimeWriteCalldata(evm.data);
+        // A server key can safely switch between explicitly configured chains: each
+        // tx selects its own immutable viem client/RPC/runtime tuple. No untrusted
+        // server response may introduce a new chain or RPC endpoint.
+        const chain = asViemChain(config);
+        const transport = http(config.rpcUrl);
+        const wallet = createWalletClient$1({ account: this.account, chain, transport });
+        const publicClient = createPublicClient({ chain, transport });
+        const hash = await wallet.sendTransaction({
+            account: this.account,
+            chain,
+            to: config.runtimeAddress,
+            data: evm.data,
+            value: BigInt(0),
+        });
+        const receipt = await publicClient.waitForTransactionReceipt({ hash });
+        if (receipt.status !== 'success')
+            throw new Error(`EVM transaction ${hash} reverted on-chain`);
+        if (receipt.blockNumber > BigInt(Number.MAX_SAFE_INTEGER))
+            throw new Error('EVM receipt block number exceeds the SDK safe-integer range');
+        return {
+            transactionSignature: hash,
+            blockNumber: Number(receipt.blockNumber),
+            gasUsed: receipt.gasUsed.toString(),
+            data: receipt,
+        };
+    }
+    async getNativeMethods() { return this.account; }
+    transactionPolicy() {
+        return {
+            runtimeAddresses: Object.fromEntries([...this.chains].map(([id, config]) => [String(id), config.runtimeAddress])),
+        };
+    }
+}
+
 var __rest = (undefined && undefined.__rest) || function (s, e) {
     var t = {};
     for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
@@ -708,10 +848,11 @@ function jwtExpiringSoon(token) {
 /*  WalletClient                                                       */
 /* ------------------------------------------------------------------ */
 class WalletClient {
-    constructor(provider, sessionManager, address) {
+    constructor(provider, sessionManager, address, evmTransactionPolicy) {
         this.provider = provider;
         this.sessionManager = sessionManager;
         this.address = address;
+        this.evmTransactionPolicy = evmTransactionPolicy;
         this.live = {
             intent: (roomPath, intent, opts = {}) => live$1.intent(roomPath, intent, this.mergeLiveIntentOptions(opts)),
             status: (roomPath, opts = {}) => live$1.status(roomPath, Object.assign(Object.assign({}, opts), { headers: this.sanitizeHeaders(opts.headers) })),
@@ -739,9 +880,7 @@ class WalletClient {
     }
     /* ---- Auth override helpers ---- */
     buildOverrides() {
-        return {
-            authProvider: this.provider,
-            _getAuthHeaders: async () => {
+        return Object.assign({ authProvider: this.provider, _getAuthHeaders: async () => {
                 let s = await this.sessionManager.getSession();
                 // Keypair-backed session: if the cached token is expired/near-expiry,
                 // re-sign for a fresh one (we always hold the key). Keeps long-lived WS
@@ -752,12 +891,9 @@ class WalletClient {
                     s = await this.sessionManager.getSession();
                 }
                 return { Authorization: `Bearer ${s.idToken}` };
-            },
-            _clearAuth: async () => {
+            }, _clearAuth: async () => {
                 this.sessionManager.clearSession();
-            },
-            _walletAddress: this.address,
-        };
+            }, _walletAddress: this.address }, (this.evmTransactionPolicy ? { _evmTransactionPolicy: this.evmTransactionPolicy } : {}));
     }
     /** Strip Authorization from caller headers to prevent overriding wallet token */
     sanitizeHeaders(headers) {
@@ -769,7 +905,7 @@ class WalletClient {
     mergeSetOverrides(opts) {
         var _a;
         const ovr = this.buildOverrides();
-        return Object.assign(Object.assign({}, opts), { _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), authProvider: ovr.authProvider, _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth }) });
+        return Object.assign(Object.assign({}, opts), { _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), authProvider: ovr.authProvider, _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _evmTransactionPolicy: ovr._evmTransactionPolicy }) });
     }
     mergeReadOverrides(existing) {
         const ovr = this.buildOverrides();
@@ -863,19 +999,53 @@ class WalletClient {
     }
 }
 /**
- * Create a self-contained wallet client bound to a specific keypair.
+ * Create a self-contained wallet client bound to one Solana or EVM keypair.
  * Each client has its own auth session — no global state is mutated.
  *
  * @example
  * ```ts
  * const vault = await createWalletClient({ keypair: process.env.VAULT_KEY });
  * await vault.set('markets/123', data);
+ *
+ * const evmVault = await createWalletClient({
+ *   evmPrivateKey: process.env.EVM_PRIVATE_KEY,
+ *   chainId: 8453,
+ *   rpcUrl: process.env.BASE_RPC_URL,
+ *   runtimeAddress: process.env.BOUNDED_RUNTIME,
+ * });
  * ```
  */
 async function createWalletClient(opts) {
     var _a;
-    const kp = parseKeypair(opts.keypair);
     const config = await getConfig();
+    if ('evmPrivateKey' in opts && typeof opts.evmPrivateKey === 'string') {
+        const chainConfigs = [];
+        if (opts.chains) {
+            for (const [rawId, chain] of Object.entries(opts.chains)) {
+                const chainId = Number(rawId);
+                if (!Number.isSafeInteger(chainId) || chainId <= 0)
+                    throw new Error(`Invalid EVM chain id in chains map: ${rawId}`);
+                chainConfigs.push({ chainId, rpcUrl: chain.rpcUrl, runtimeAddress: chain.runtimeAddress, name: chain.name });
+            }
+        }
+        if (opts.rpcUrl !== undefined || opts.runtimeAddress !== undefined) {
+            if (!opts.rpcUrl || !opts.runtimeAddress)
+                throw new Error('Single-chain EVM clients require both rpcUrl and runtimeAddress');
+            if (chainConfigs.some((chain) => chain.chainId === opts.chainId))
+                throw new Error(`EVM chain ${opts.chainId} is configured twice`);
+            chainConfigs.push({ chainId: opts.chainId, rpcUrl: opts.rpcUrl, runtimeAddress: opts.runtimeAddress });
+        }
+        if (chainConfigs.length === 0)
+            throw new Error('EVM wallet clients require an explicit RPC URL and BoundedRuntime address');
+        const provider = new EvmKeypairProvider(opts.evmPrivateKey, opts.chainId, chainConfigs);
+        const sessionManager = ServerSessionManager.forSessionFactory(() => provider.createBoundedSession());
+        await sessionManager.getSession();
+        return new WalletClient(provider, sessionManager, provider.address, provider.transactionPolicy());
+    }
+    if (!('keypair' in opts) || typeof opts.keypair !== 'string') {
+        throw new Error('createWalletClient requires exactly one of keypair or evmPrivateKey');
+    }
+    const kp = parseKeypair(opts.keypair);
     let provider = new SolanaKeypairProvider((_a = config.rpcUrl) !== null && _a !== void 0 ? _a : null, kp);
     if (config.chain === 'offchain') {
         provider = new OffchainAuthProvider(provider);
@@ -1140,5 +1310,5 @@ async function verifyWebhook(rawBody, headers, opts = {}) {
     return payload;
 }
 
-export { DEFAULT_WEBHOOK_KEYS_URL, InMemoryReplayStore, WalletClient, WebhookVerificationError, aggregate, clearWebhookKeyCache, clearWebhookReplayCache, count, createWalletClient, functions, get, getAuthProvider, getFiles, getIdToken, getMany, init, invokeFunction, live, liveIntent, liveStatus, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe, verifyWebhook };
+export { DEFAULT_WEBHOOK_KEYS_URL, EvmKeypairProvider, InMemoryReplayStore, WalletClient, WebhookVerificationError, aggregate, clearWebhookKeyCache, clearWebhookReplayCache, count, createWalletClient, functions, get, getAuthProvider, getFiles, getIdToken, getMany, init, invokeFunction, live, liveIntent, liveStatus, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe, verifyWebhook };
 //# sourceMappingURL=index.mjs.map