@bounded-sh/server 0.0.62 → 0.0.65

package/dist/index.mjs

@@ -1,9 +1,8 @@
-import { init as init$1, convertRemainingAccounts, buildSetDocumentsTransaction, normalizeEvmAddress, genAuthNonce, getConfig, genSiweMessage, createSessionWithSignature, assertCanonicalBoundedRuntimeWriteCalldata, live as live$1, set as set$1, setMany as setMany$1, setFile as setFile$1, get as get$1, getMany as getMany$1, getFiles as getFiles$1, search as search$1, runQuery as runQuery$1, runQueryMany as runQueryMany$1, runExpression as runExpression$1, runExpressionMany as runExpressionMany$1, count as count$1, aggregate as aggregate$1, queryAggregate as queryAggregate$1, subscribe as subscribe$1, functions as functions$1, ServerSessionManager, getWebhookKeysUrl, getConfiguredAppId } from '@bounded-sh/core';
+import { init as init$1, normalizeEvmAddress, genAuthNonce, getConfig, genSiweMessage, createSessionWithSignature, assertCanonicalBoundedRuntimeWriteCalldata, live as live$1, set as set$1, setMany as setMany$1, setFile as setFile$1, get as get$1, getMany as getMany$1, getFiles as getFiles$1, search as search$1, runQuery as runQuery$1, runQueryMany as runQueryMany$1, runExpression as runExpression$1, runExpressionMany as runExpressionMany$1, count as count$1, aggregate as aggregate$1, queryAggregate as queryAggregate$1, subscribe as subscribe$1, functions as functions$1, ServerSessionManager, getWebhookKeysUrl, getConfiguredAppId } from '@bounded-sh/core';
 export { BoundedDeclineError, DECLINE_EVENT_NAME, FunctionInvokeError, InsufficientBalanceError, LiveIntentError, deriveDecline, getConfig, getWebhookKeysUrl } from '@bounded-sh/core';
-import { Connection, VersionedTransaction, ComputeBudgetProgram, SystemProgram, Keypair } from '@solana/web3.js';
+import { Connection, Keypair } from '@solana/web3.js';
 import bs58 from 'bs58';
 import { Buffer as Buffer$1 } from 'buffer';
-import * as anchor from '@coral-xyz/anchor';
 import nacl from 'tweetnacl';
 import { http, createWalletClient as createWalletClient$1, createPublicClient, defineChain } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
@@ -53,245 +52,6 @@ async function getIdToken() {
     throw new Error('getIdToken is not available as a tarobase-server top-level auth operation. Use createWalletClient({ keypair }) and call the returned client methods.');
 }
 
-const PRESIGNED_BLOCKHASH_ERROR = 'Server signedTransaction blockhash is stale or expired';
-const BOUNDED_PROGRAM_MAINNET = 'openTv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F';
-const BOUNDED_PROGRAM_DEVNET = 'openTv7fbpYSseNHYmCZFZ1CZgj4r8D9fKNgEz1qo6F';
-const COMPUTE_BUDGET_PROGRAM = 'ComputeBudget111111111111111111111111111111';
-const SYSTEM_PROGRAM_ID = '11111111111111111111111111111111';
-const SUPPORTED_SOLANA_NETWORKS = ['solana_devnet', 'solana_mainnet'];
-const SUPPORTED_SOLANA_NETWORK_SET = new Set(SUPPORTED_SOLANA_NETWORKS);
-const ALLOWED_SERVER_TX_PROGRAMS = new Set([
-    BOUNDED_PROGRAM_MAINNET,
-    BOUNDED_PROGRAM_DEVNET,
-    COMPUTE_BUDGET_PROGRAM,
-    SYSTEM_PROGRAM_ID,
-]);
-// Canonical set_documents discriminator (single wire format: ra_indices Vec<u8>).
-const SET_DOCUMENTS_DISCRIMINATOR = '79,46,72,73,24,79,66,245';
-const ALLOWED_BOUNDED_SET_DISCRIMINATORS = new Set([
-    SET_DOCUMENTS_DISCRIMINATOR,
-]);
-/* ──────────────────────────────────────────────────────────
- * Helper – fetch getPriorityFeeEstimate
- * ──────────────────────────────────────────────────────── */
-async function fetchPriorityFee(rpcEndpoint, rawUnsignedTxBuffer) {
-    var _a, _b;
-    try {
-        const res = await fetch(rpcEndpoint, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-                jsonrpc: "2.0",
-                id: "1",
-                method: "getPriorityFeeEstimate",
-                params: [{
-                        transaction: bs58.encode(rawUnsignedTxBuffer), options: {
-                            recommended: true
-                        }
-                    }]
-            })
-        });
-        const data = await res.json();
-        const fee = (_b = (_a = data === null || data === void 0 ? void 0 : data.result) === null || _a === void 0 ? void 0 : _a.priorityFeeEstimate) !== null && _b !== void 0 ? _b : null;
-        if (fee != null && fee > 0) {
-            return Math.ceil(Number(fee) * 1.2);
-        }
-        console.warn("Priority-fee estimate returned no positive fee; skipping priority fee instruction");
-        return null;
-    }
-    catch (err) {
-        console.warn("Priority-fee estimate failed; skipping priority fee instruction:", err);
-        return null;
-    }
-}
-function isPresignedBlockhashError(error) {
-    return typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' && error.message.includes(PRESIGNED_BLOCKHASH_ERROR);
-}
-function isPermanentPresignedTransactionError(error) {
-    return isPresignedBlockhashError(error) ||
-        (typeof (error === null || error === void 0 ? void 0 : error.message) === 'string' && (error.message.startsWith('Server signedTransaction') ||
-            error.message.startsWith('Server preInstruction')));
-}
-class BorshCursor {
-    constructor(data, offset) {
-        this.data = data;
-        this.offset = offset;
-    }
-    requireBytes(length, field) {
-        if (this.offset + length > this.data.length) {
-            throw new Error(`Server signedTransaction has malformed Bounded instruction data while reading ${field}`);
-        }
-    }
-    readU8(field) {
-        this.requireBytes(1, field);
-        return this.data[this.offset++];
-    }
-    readU32(field) {
-        this.requireBytes(4, field);
-        const value = this.data[this.offset] |
-            (this.data[this.offset + 1] << 8) |
-            (this.data[this.offset + 2] << 16) |
-            (this.data[this.offset + 3] << 24);
-        this.offset += 4;
-        return value >>> 0;
-    }
-    skip(length, field) {
-        this.requireBytes(length, field);
-        this.offset += length;
-    }
-    readString(field) {
-        const length = this.readU32(`${field} length`);
-        this.requireBytes(length, field);
-        const raw = this.data.slice(this.offset, this.offset + length);
-        this.offset += length;
-        return Buffer$1.from(raw).toString('utf8');
-    }
-    skipBytes(field) {
-        const length = this.readU32(`${field} length`);
-        this.skip(length, field);
-    }
-    isAtEnd() {
-        return this.offset === this.data.length;
-    }
-}
-function normalizeOnchainPath(path) {
-    let normalized = path.startsWith('/') ? path.slice(1) : path;
-    if (normalized.endsWith('*') && normalized.length > 1) {
-        normalized = normalized.slice(0, -1);
-    }
-    if (normalized.endsWith('/')) {
-        normalized = normalized.slice(0, -1);
-    }
-    return normalized;
-}
-function skipBoundedFieldValue(cursor) {
-    const option = cursor.readU8('operation value option');
-    if (option === 0)
-        return;
-    if (option !== 1) {
-        throw new Error('Server signedTransaction has malformed Bounded field value option');
-    }
-    const variant = cursor.readU8('operation value variant');
-    switch (variant) {
-        case 0:
-        case 1:
-            cursor.skip(8, 'operation numeric value');
-            return;
-        case 2:
-            cursor.skip(1, 'operation bool value');
-            return;
-        case 3:
-            cursor.readString('operation string value');
-            return;
-        case 4:
-            cursor.skip(32, 'operation address value');
-            return;
-        default:
-            throw new Error(`Server signedTransaction has unsupported Bounded field value variant: ${variant}`);
-    }
-}
-function skipBoundedFieldOperation(cursor) {
-    cursor.readString('operation key');
-    skipBoundedFieldValue(cursor);
-    cursor.skip(1, 'operation kind');
-}
-function skipBoundedTxData(cursor) {
-    cursor.readString('txData plugin function key');
-    cursor.skipBytes('txData bytes');
-    cursor.skipBytes('txData raIndices');
-}
-function parseBoundedSetDocumentsInstruction(data) {
-    if (data.length < 8) {
-        throw new Error('Server signedTransaction has malformed Bounded instruction data');
-    }
-    const discriminator = Array.from(data.slice(0, 8)).join(',');
-    if (!ALLOWED_BOUNDED_SET_DISCRIMINATORS.has(discriminator)) {
-        throw new Error('Server signedTransaction contains unsupported Bounded instruction');
-    }
-    const cursor = new BorshCursor(data, 8);
-    const appId = cursor.readString('appId');
-    const documentPaths = [];
-    const documentCount = cursor.readU32('documents length');
-    for (let i = 0; i < documentCount; i++) {
-        documentPaths.push(normalizeOnchainPath(cursor.readString('document path')));
-        const operationCount = cursor.readU32('operations length');
-        for (let j = 0; j < operationCount; j++) {
-            skipBoundedFieldOperation(cursor);
-        }
-    }
-    const deletePaths = [];
-    const deleteCount = cursor.readU32('delete paths length');
-    for (let i = 0; i < deleteCount; i++) {
-        deletePaths.push(normalizeOnchainPath(cursor.readString('delete path')));
-    }
-    const txDataCount = cursor.readU32('txData length');
-    for (let i = 0; i < txDataCount; i++) {
-        skipBoundedTxData(cursor);
-    }
-    const simulate = cursor.readU8('simulate');
-    if (simulate !== 0 && simulate !== 1) {
-        throw new Error('Server signedTransaction has malformed Bounded simulate flag');
-    }
-    if (!cursor.isAtEnd()) {
-        throw new Error('Server signedTransaction has trailing Bounded instruction data');
-    }
-    return { appId, documentPaths, deletePaths };
-}
-function assertSamePathSet(expectedPaths, actualPaths) {
-    const expected = new Set(expectedPaths.map(normalizeOnchainPath).filter(Boolean));
-    const actual = new Set(actualPaths.map(normalizeOnchainPath).filter(Boolean));
-    const missing = [...expected].filter(path => !actual.has(path));
-    const extra = [...actual].filter(path => !expected.has(path));
-    if (missing.length > 0 || extra.length > 0) {
-        const details = [
-            missing.length ? `missing paths: ${missing.join(', ')}` : '',
-            extra.length ? `unexpected paths: ${extra.join(', ')}` : '',
-        ].filter(Boolean).join('; ');
-        throw new Error(`Server signedTransaction Bounded instruction paths do not match requested write paths (${details})`);
-    }
-}
-function validatePresignedSignedTransaction(transaction, sol) {
-    var _a, _b, _c, _d, _e, _f, _g;
-    const accountKeys = transaction.message.staticAccountKeys;
-    let boundedInstructionCount = 0;
-    const actualWritePaths = [];
-    for (const ix of transaction.message.compiledInstructions) {
-        if (ix.programIdIndex >= accountKeys.length) {
-            throw new Error('Server signedTransaction has program ID in lookup table (not allowed)');
-        }
-        const programId = accountKeys[ix.programIdIndex].toBase58();
-        if (!ALLOWED_SERVER_TX_PROGRAMS.has(programId)) {
-            throw new Error(`Server signedTransaction contains unauthorized program: ${programId}`);
-        }
-        const data = ix.data instanceof Uint8Array ? ix.data : Buffer$1.from((_a = ix.data) !== null && _a !== void 0 ? _a : []);
-        if (programId === SYSTEM_PROGRAM_ID) {
-            throw new Error('Server signedTransaction contains unauthorized System Program instruction');
-        }
-        if (programId === BOUNDED_PROGRAM_MAINNET || programId === BOUNDED_PROGRAM_DEVNET) {
-            boundedInstructionCount += 1;
-            const parsed = parseBoundedSetDocumentsInstruction(data);
-            if (parsed.appId !== sol.appId) {
-                throw new Error('Server signedTransaction Bounded instruction appId does not match configured appId');
-            }
-            actualWritePaths.push(...parsed.documentPaths, ...parsed.deletePaths);
-        }
-    }
-    if (boundedInstructionCount !== 1) {
-        throw new Error('Server signedTransaction must contain exactly one Bounded set-documents instruction');
-    }
-    const expectedWritePaths = [
-        ...(((_d = (_c = (_b = sol.txArgs) === null || _b === void 0 ? void 0 : _b[0]) === null || _c === void 0 ? void 0 : _c.setDocumentData) !== null && _d !== void 0 ? _d : []).map((doc) => doc.path)),
-        ...((_g = (_f = (_e = sol.txArgs) === null || _e === void 0 ? void 0 : _e[0]) === null || _f === void 0 ? void 0 : _f.deletePaths) !== null && _g !== void 0 ? _g : []),
-    ];
-    assertSamePathSet(expectedWritePaths, actualWritePaths);
-}
-function assertAllowedServerPreInstructions(preInstructions) {
-    for (const [index, ix] of (preInstructions !== null && preInstructions !== void 0 ? preInstructions : []).entries()) {
-        if (ix.programId.equals(SystemProgram.programId)) {
-            throw new Error(`Server preInstruction[${index}] contains unauthorized System Program instruction`);
-        }
-    }
-}
 class SolanaKeypairProvider {
     constructor(rpcUrl, serverKeypair) {
         this.rpcUrl = rpcUrl;
@@ -420,16 +180,6 @@ class SolanaKeypairProvider {
         }
         return { signature: sig, txInfo };
     }
-    requireSupportedNetwork(network) {
-        const networkName = network === null || network === void 0 ? void 0 : network.trim();
-        if (!networkName) {
-            throw new Error(`Supported sol.network is required for Solana transaction submission; expected one of: ${SUPPORTED_SOLANA_NETWORKS.join(', ')}.`);
-        }
-        if (!SUPPORTED_SOLANA_NETWORK_SET.has(networkName)) {
-            throw new Error(`Unsupported Solana network "${networkName}". Supported networks: ${SUPPORTED_SOLANA_NETWORKS.join(', ')}.`);
-        }
-        return networkName;
-    }
     getRpcUrl() {
         var _a;
         const explicitRpcUrl = (_a = this.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
@@ -441,174 +191,13 @@ class SolanaKeypairProvider {
     /* ----------------------------------------------------------- *
      * Transaction runner
      * ----------------------------------------------------------- */
-    async runTransaction(_evm, sol, opts) {
-        if (!sol)
-            throw new Error('Solana transaction data required');
-        const kp = this.keypair;
-        this.requireSupportedNetwork(sol.network);
-        const rpcUrl = this.getRpcUrl();
-        // Helper for duck typing - checks if transaction is legacy Transaction vs VersionedTransaction
-        const isLegacyTx = (tx) => {
-            return 'recentBlockhash' in tx && !('message' in tx && 'staticAccountKeys' in tx.message);
-        };
-        const wallet = {
-            publicKey: kp.publicKey,
-            signTransaction: async (tx) => {
-                // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
-                if (isLegacyTx(tx)) {
-                    tx.partialSign(kp);
-                }
-                else {
-                    tx.sign([kp]);
-                }
-                return tx;
-            },
-            signAllTransactions: async (txs) => txs.map((t) => {
-                // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
-                if (isLegacyTx(t)) {
-                    t.partialSign(kp);
-                }
-                else {
-                    t.sign([kp]);
-                }
-                return t;
-            }),
-        };
-        /* de-dupe remaining accounts */
-        const deduped = (() => {
-            const fin = [];
-            for (const acc of convertRemainingAccounts(sol.txArgs[0].remainingAccounts)) {
-                const ex = fin.find((x) => x.pubkey.equals(acc.pubkey));
-                if (ex) {
-                    ex.isSigner || (ex.isSigner = acc.isSigner);
-                    ex.isWritable || (ex.isWritable = acc.isWritable);
-                }
-                else
-                    fin.push(acc);
-            }
-            return fin;
-        })();
-        let retries = 0;
-        let didPass = false;
-        let delay = 1000;
-        let toReturn = null;
-        let errorMessage = "";
-        while (retries < 5) {
-            try {
-                toReturn = await this.runTransactionInner(sol, opts, wallet, kp, deduped, rpcUrl);
-                didPass = true;
-                break;
-            }
-            catch (error) {
-                if (isPermanentPresignedTransactionError(error)) {
-                    throw error;
-                }
-                console.log("Error building and sending transaction on retry:", retries, error);
-                await new Promise(resolve => setTimeout(resolve, delay));
-                // Exponential backoff
-                delay *= 1.5;
-                retries++;
-                errorMessage = error.message || JSON.stringify(error, null, 2);
-            }
-        }
-        if (!didPass) {
-            throw new Error(`Failed to send transaction after 5 retries: ${errorMessage}`);
-        }
-        return toReturn;
-    }
-    async runTransactionInner(sol, opts, wallet, kp, deduped, rpcUrl) {
-        var _a, _b, _c;
-        const connection = new Connection(rpcUrl, 'confirmed');
-        const anchorProvider = new anchor.AnchorProvider(connection, wallet, anchor.AnchorProvider.defaultOptions());
-        const app_id = sol.appId;
-        if (!app_id)
-            throw new Error('app_id missing');
-        // When the server has co-signed a transaction (CPI attestation),
-        // deserialize it and just add the wallet signature instead of
-        // building from components.
-        let tx;
-        let blockhash;
-        let lastValidBlockHeight;
-        if (sol.signedTransaction) {
-            tx = VersionedTransaction.deserialize(Buffer$1.from(sol.signedTransaction, 'base64'));
-            validatePresignedSignedTransaction(tx, sol);
-            blockhash = tx.message.recentBlockhash;
-            const isValid = await connection.isBlockhashValid(blockhash, { commitment: 'confirmed' });
-            if (!isValid.value) {
-                throw new Error(`${PRESIGNED_BLOCKHASH_ERROR}; request a fresh server-built transaction.`);
-            }
-            lastValidBlockHeight = 0;
-        }
-        else {
-            assertAllowedServerPreInstructions(sol.preInstructions);
-            const result = await buildSetDocumentsTransaction(connection, sol.txArgs[0].idl, anchorProvider, kp.publicKey, {
-                app_id,
-                documents: sol.txArgs[0].setDocumentData,
-                delete_paths: sol.txArgs[0].deletePaths,
-                txData: sol.txArgs[0].txData
-            }, deduped, sol.lutKey, sol.preInstructions, false, sol.additionalLutAddresses);
-            tx = result.tx;
-            blockhash = result.blockhash;
-            lastValidBlockHeight = result.lastValidBlockHeight;
-        }
-        // Helper for duck typing - checks if transaction is legacy Transaction vs VersionedTransaction
-        const isLegacyTx = (t) => {
-            return 'recentBlockhash' in t && !('message' in t && 'staticAccountKeys' in t.message);
-        };
-        // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
-        if (isLegacyTx(tx)) {
-            if (!sol.signedTransaction) {
-                tx.recentBlockhash = blockhash;
-                tx.lastValidBlockHeight = lastValidBlockHeight;
-                tx.feePayer = kp.publicKey;
-            }
-            tx.partialSign(kp);
-        }
-        else {
-            if (!sol.signedTransaction) {
-                tx.message.recentBlockhash = blockhash;
-            }
-            tx.sign([kp]);
-        }
-        // 3️⃣  Optional priority-fee instruction. Pre-signed transactions are
-        // immutable at this point; preserve their exact message and skip estimation.
-        if (!sol.signedTransaction) {
-            const rawUnsigned = tx.serialize({ requireAllSignatures: false });
-            const microLamports = await fetchPriorityFee(connection.rpcEndpoint, rawUnsigned);
-            if (microLamports != null) {
-                // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
-                if (isLegacyTx(tx)) {
-                    tx.instructions.unshift(ComputeBudgetProgram.setComputeUnitPrice({ microLamports }));
-                    tx.partialSign(kp);
-                }
-                else {
-                    const roundTwo = await buildSetDocumentsTransaction(connection, sol.txArgs[0].idl, anchorProvider, kp.publicKey, {
-                        app_id,
-                        documents: sol.txArgs[0].setDocumentData,
-                        delete_paths: sol.txArgs[0].deletePaths,
-                        txData: sol.txArgs[0].txData
-                    }, deduped, sol.lutKey, [ComputeBudgetProgram.setComputeUnitPrice({ microLamports }), ...sol.preInstructions], false, sol.additionalLutAddresses);
-                    tx = roundTwo.tx;
-                    blockhash = roundTwo.blockhash;
-                    lastValidBlockHeight = roundTwo.lastValidBlockHeight;
-                    tx.message.recentBlockhash = blockhash;
-                    tx.sign([kp]);
-                }
-            }
-        }
-        if ((opts === null || opts === void 0 ? void 0 : opts.shouldSubmitTx) === false) {
-            return { signedTransaction: tx, blockNumber: 0, gasUsed: '0', data: '' };
-        }
-        // Submit and confirm using shared helper
-        const { signature, txInfo } = await this.submitAndConfirmTransaction(tx, connection, { fetchTxInfo: true });
-        return {
-            transactionSignature: signature,
-            blockNumber: (_a = txInfo === null || txInfo === void 0 ? void 0 : txInfo.slot) !== null && _a !== void 0 ? _a : 0,
-            gasUsed: (_c = (_b = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _b === void 0 ? void 0 : _b.fee.toString()) !== null && _c !== void 0 ? _c : '0',
-            data: txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta,
-        };
+    async runTransaction(_evmTransactionData, _solTransactionData, _options) {
+        // Client-side Solana transaction building is retired: the realtime worker
+        // returns a fully-built (and, when sponsored, partially-signed) transaction
+        // on its 202, which the SDK validates and signs via signTransaction /
+        // signAndSubmitTransaction. This provider serves no EVM payload either.
+        throw new Error('runTransaction is not supported by this provider; Bounded returns pre-built Solana transactions that are signed with signTransaction/signAndSubmitTransaction.');
     }
-    /* ----------------------------------------------------------- */
     async getNativeMethods() {
         return { keypair: this.keypair };
     }
@@ -703,18 +292,21 @@ class EvmKeypairProvider {
     user() {
         return { id: this.address, address: null, evmAddress: this.address, provider: this };
     }
-    async createBoundedSession() {
-        var _a, _b, _c;
-        const nonce = await genAuthNonce();
-        const { appId } = await getConfig();
+    async createBoundedSession(sessionConfig) {
+        var _a, _b, _c, _d;
+        // Bind the SIWE nonce/message/session to the snapshotted app+issuer when a
+        // wallet client supplies one, so a later global init() cannot retarget this
+        // session mint (CTA-05); otherwise read the mutable global init() config.
+        const nonce = await genAuthNonce(sessionConfig);
+        const appId = (_a = sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId) !== null && _a !== void 0 ? _a : (await getConfig()).appId;
         const message = genSiweMessage(this.address, nonce, appId, 'server', 'https://server/login', { chainId: this.defaultChainId });
         const signature = await this.account.signMessage({ message });
-        const session = await createSessionWithSignature(this.address, message, signature, 'siwe');
+        const session = await createSessionWithSignature(this.address, message, signature, 'siwe', sessionConfig);
         return {
             address: this.address,
-            accessToken: String((_a = session.accessToken) !== null && _a !== void 0 ? _a : ''),
-            idToken: String((_b = session.idToken) !== null && _b !== void 0 ? _b : ''),
-            refreshToken: String((_c = session.refreshToken) !== null && _c !== void 0 ? _c : ''),
+            accessToken: String((_b = session.accessToken) !== null && _b !== void 0 ? _b : ''),
+            idToken: String((_c = session.idToken) !== null && _c !== void 0 ? _c : ''),
+            refreshToken: String((_d = session.refreshToken) !== null && _d !== void 0 ? _d : ''),
         };
     }
     async login() { return this.user(); }
@@ -847,10 +439,11 @@ function jwtExpiringSoon(token) {
 /*  WalletClient                                                       */
 /* ------------------------------------------------------------------ */
 class WalletClient {
-    constructor(provider, sessionManager, address, evmTransactionPolicy) {
+    constructor(provider, sessionManager, address, config, evmTransactionPolicy) {
         this.provider = provider;
         this.sessionManager = sessionManager;
         this.address = address;
+        this.config = config;
         this.evmTransactionPolicy = evmTransactionPolicy;
         this.live = {
             intent: (roomPath, intent, opts = {}) => live$1.intent(roomPath, intent, this.mergeLiveIntentOptions(opts)),
@@ -876,6 +469,7 @@ class WalletClient {
                         _getAuthHeaders: ovr._getAuthHeaders,
                         _clearAuth: ovr._clearAuth,
                         _walletAddress: ovr._walletAddress,
+                        _config: ovr._config,
                     },
                 });
             },
@@ -883,7 +477,10 @@ class WalletClient {
     }
     /* ---- Auth override helpers ---- */
     buildOverrides() {
-        return Object.assign({ authProvider: this.provider, _getAuthHeaders: async () => {
+        return Object.assign({ authProvider: this.provider, 
+            // Pin every request to this wallet client's snapshotted app + endpoints so
+            // a later global init() can never retarget its reads/writes (CTA-05).
+            _config: this.config, _getAuthHeaders: async () => {
                 let s = await this.sessionManager.getSession();
                 // Keypair-backed session: if the cached token is expired/near-expiry,
                 // re-sign for a fresh one (we always hold the key). Keeps long-lived WS
@@ -905,22 +502,22 @@ class WalletClient {
     mergeSetOverrides(opts) {
         var _a;
         const ovr = this.buildOverrides();
-        return Object.assign(Object.assign({}, opts), { _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), authProvider: ovr.authProvider, _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _evmTransactionPolicy: ovr._evmTransactionPolicy }) });
+        return Object.assign(Object.assign({}, opts), { _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), authProvider: ovr.authProvider, _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _evmTransactionPolicy: ovr._evmTransactionPolicy, _config: ovr._config }) });
     }
     mergeReadOverrides(existing) {
         const ovr = this.buildOverrides();
-        return Object.assign(Object.assign({}, existing), { headers: this.sanitizeHeaders(existing === null || existing === void 0 ? void 0 : existing.headers), _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _walletAddress: ovr._walletAddress });
+        return Object.assign(Object.assign({}, existing), { headers: this.sanitizeHeaders(existing === null || existing === void 0 ? void 0 : existing.headers), _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _walletAddress: ovr._walletAddress, _config: ovr._config });
     }
     mergeLiveIntentOptions(opts) {
         var _a;
         const ovr = this.buildOverrides();
-        const merged = Object.assign(Object.assign({}, opts), { headers: this.sanitizeHeaders(opts === null || opts === void 0 ? void 0 : opts.headers), _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _walletAddress: ovr._walletAddress }) });
+        const merged = Object.assign(Object.assign({}, opts), { headers: this.sanitizeHeaders(opts === null || opts === void 0 ? void 0 : opts.headers), _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _walletAddress: ovr._walletAddress, _config: ovr._config }) });
         return merged;
     }
     mergeLiveStatusOptions(opts) {
         var _a;
         const ovr = this.buildOverrides();
-        const merged = Object.assign(Object.assign({}, opts), { headers: this.sanitizeHeaders(opts === null || opts === void 0 ? void 0 : opts.headers), _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _walletAddress: ovr._walletAddress }) });
+        const merged = Object.assign(Object.assign({}, opts), { headers: this.sanitizeHeaders(opts === null || opts === void 0 ? void 0 : opts.headers), _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _walletAddress: ovr._walletAddress, _config: ovr._config }) });
         return merged;
     }
     /* ---- Data operations ---- */
@@ -981,6 +578,7 @@ class WalletClient {
                 _getAuthHeaders: ovr._getAuthHeaders,
                 _clearAuth: ovr._clearAuth,
                 _walletAddress: ovr._walletAddress,
+                _config: ovr._config,
             } }));
     }
     /**
@@ -991,7 +589,7 @@ class WalletClient {
      */
     async invoke(name, args = {}, opts = {}) {
         const ovr = this.buildOverrides();
-        return functions$1.invoke(name, args, Object.assign(Object.assign({}, opts), { _overrides: { _getAuthHeaders: ovr._getAuthHeaders } }));
+        return functions$1.invoke(name, args, Object.assign(Object.assign({}, opts), { _overrides: { _getAuthHeaders: ovr._getAuthHeaders, _config: ovr._config } }));
     }
     /* ---- Signing operations (use provider directly) ---- */
     async signMessage(message) {
@@ -1023,7 +621,17 @@ class WalletClient {
  */
 async function createWalletClient(opts) {
     var _a;
-    const config = await getConfig();
+    // Snapshot an IMMUTABLE copy of the resolved config now. Every request this
+    // client makes is threaded with this snapshot (as `_config`) and its session
+    // manager mints against this app+issuer, so a later global `init(...)` for a
+    // different app/environment can never retarget this client's reads, writes,
+    // function calls, live intents, or session mint (CTA-05).
+    const config = Object.freeze(Object.assign({}, (await getConfig())));
+    const sessionConfig = {
+        appId: config.appId,
+        authApiUrl: config.authApiUrl,
+        authMethod: config.authMethod,
+    };
     if ('evmPrivateKey' in opts && typeof opts.evmPrivateKey === 'string') {
         const chainConfigs = [];
         if (opts.chains) {
@@ -1044,9 +652,9 @@ async function createWalletClient(opts) {
         if (chainConfigs.length === 0)
             throw new Error('EVM wallet clients require an explicit RPC URL and BoundedRuntime address');
         const provider = new EvmKeypairProvider(opts.evmPrivateKey, opts.chainId, chainConfigs);
-        const sessionManager = ServerSessionManager.forSessionFactory(() => provider.createBoundedSession());
+        const sessionManager = ServerSessionManager.forSessionFactory(() => provider.createBoundedSession(sessionConfig));
         await sessionManager.getSession();
-        return new WalletClient(provider, sessionManager, provider.address, provider.transactionPolicy());
+        return new WalletClient(provider, sessionManager, provider.address, config, provider.transactionPolicy());
     }
     if (!('keypair' in opts) || typeof opts.keypair !== 'string') {
         throw new Error('createWalletClient requires exactly one of keypair or evmPrivateKey');
@@ -1056,10 +664,10 @@ async function createWalletClient(opts) {
     if (config.chain === 'offchain') {
         provider = new OffchainAuthProvider(provider);
     }
-    const sessionManager = ServerSessionManager.forKeypair(kp);
+    const sessionManager = ServerSessionManager.forKeypair(kp, sessionConfig);
     // Eagerly authenticate so failures surface immediately
     await sessionManager.getSession();
-    return new WalletClient(provider, sessionManager, kp.publicKey.toBase58());
+    return new WalletClient(provider, sessionManager, kp.publicKey.toBase58(), config);
 }
 
 // ---------------------------------------------------------------------------
@@ -1236,7 +844,7 @@ function clearWebhookReplayCache() {
  * @throws {WebhookVerificationError} if anything fails verification.
  */
 async function verifyWebhook(rawBody, headers, opts = {}) {
-    var _a, _b, _c, _d, _e, _f, _g;
+    var _a, _b, _c, _d, _e, _f, _g, _h;
     // Resolution order: explicit opts.keysUrl > the configured Bounded network's
     // hosted keys (so a staging receiver verifies staging-signed deliveries
     // without passing keysUrl) > the production default (fail-closed when the
@@ -1311,7 +919,7 @@ async function verifyWebhook(rawBody, headers, opts = {}) {
     try {
         payload = JSON.parse(rawBody);
     }
-    catch (_h) {
+    catch (_j) {
         throw new WebhookVerificationError("Webhook body is not valid JSON.");
     }
     if (!payload ||
@@ -1363,15 +971,25 @@ async function verifyWebhook(rawBody, headers, opts = {}) {
     }
     // Replay cache: reject a previously-seen signed delivery within the skew
     // window. The worker's payload.id is the document id/path, so using it alone
-    // would reject legitimate rapid updates to the same document. The signature
-    // is over the exact raw body and changes whenever the signed delivery changes.
+    // would reject legitimate rapid updates to the same document.
+    //
+    // SHW-05: delivery is durable + at-least-once, and a RETRY of one delivery
+    // uses a fresh timestamp (to stay inside the skew window) and therefore a
+    // different signature. Keying replay on the signed, per-delivery `deliveryId`
+    // (stable across retries) is what actually dedupes those retries; the old
+    // `${keyId}:${signature}` key only caught exact byte-identical resends and
+    // would wave every retry of the same delivery straight through. Fall back to
+    // the signature only for a legacy payload with no deliveryId. Pair a shared
+    // store (retained for the retry window) with this for exactly-once handling.
     const replayStore = opts.replayStore === undefined ? defaultReplayStore : opts.replayStore;
     if (replayStore) {
         const expiresAtMs = (payload.timestamp + maxSkew) * 1000;
-        const replayKey = `${keyId}:${signature}`;
+        const replayKey = typeof payload.deliveryId === "string" && payload.deliveryId.length > 0
+            ? `${keyId}:did:${payload.deliveryId}`
+            : `${keyId}:${signature}`;
         const replayed = await replayStore.checkAndRecord(replayKey, expiresAtMs);
         if (replayed) {
-            throw new WebhookVerificationError(`Webhook replay detected for event id "${payload.id}".`);
+            throw new WebhookVerificationError(`Webhook replay detected for event id "${payload.id}" (delivery "${(_h = payload.deliveryId) !== null && _h !== void 0 ? _h : "?"}").`);
         }
     }
     return payload;