@bounded-sh/server 0.0.67 → 0.0.69

package/dist/index.mjs

@@ -1,11 +1,9 @@
-import { init as init$1, normalizeEvmAddress, genAuthNonce, getConfig, genSiweMessage, createSessionWithSignature, assertCanonicalBoundedRuntimeWriteCalldata, live as live$1, set as set$1, setMany as setMany$1, setFile as setFile$1, reconcileSetResult, waitForSetResult, get as get$1, getMany as getMany$1, getFiles as getFiles$1, search as search$1, runQuery as runQuery$1, runQueryMany as runQueryMany$1, runExpression as runExpression$1, runExpressionMany as runExpressionMany$1, count as count$1, aggregate as aggregate$1, queryAggregate as queryAggregate$1, subscribe as subscribe$1, functions as functions$1, ServerSessionManager, getWebhookKeysUrl, getConfiguredAppId } from '@bounded-sh/core';
+import { init as init$1, live as live$1, set as set$1, setMany as setMany$1, setFile as setFile$1, reconcileSetResult, waitForSetResult, get as get$1, getMany as getMany$1, getFiles as getFiles$1, search as search$1, runQuery as runQuery$1, runQueryMany as runQueryMany$1, runExpression as runExpression$1, runExpressionMany as runExpressionMany$1, count as count$1, aggregate as aggregate$1, queryAggregate as queryAggregate$1, subscribe as subscribe$1, functions as functions$1, getConfig, ServerSessionManager, getWebhookKeysUrl, getConfiguredAppId } from '@bounded-sh/core';
 export { BoundedDeclineError, DECLINE_EVENT_NAME, FunctionInvokeError, InsufficientBalanceError, LiveIntentError, deriveDecline, getConfig, getWebhookKeysUrl, reconcileSetResult, waitForSetResult } from '@bounded-sh/core';
 import { Connection, Keypair } from '@solana/web3.js';
 import bs58 from 'bs58';
 import { Buffer as Buffer$1 } from 'buffer';
 import nacl from 'tweetnacl';
-import { http, createWalletClient as createWalletClient$1, createPublicClient, keccak256, defineChain } from 'viem';
-import { privateKeyToAccount } from 'viem/accounts';
 
 async function init(newConfig) {
     await init$1(Object.assign(Object.assign({}, newConfig), { authProvider: null, isServer: true, skipBackendInit: true }));
@@ -52,6 +50,20 @@ async function getIdToken() {
     throw new Error('getIdToken is not available as a tarobase-server top-level auth operation. Use createWalletClient({ keypair }) and call the returned client methods.');
 }
 
+/**
+ * DS3-0414: does the transaction already carry a REAL signer signature? A Solana
+ * signature is computed over the compiled message, which INCLUDES recentBlockhash, so
+ * the blockhash must not be rewritten once any signer (sponsor / multisig / co-signer)
+ * has signed - a rewrite silently invalidates their signature. Legacy signatures are
+ * `{ signature: Buffer | null }` entries; versioned signatures are 64-byte arrays that
+ * stay all-zero placeholders until a signer fills them. Mirrors turnkey-signer-bridge.ts.
+ */
+function transactionHasSignature(transaction) {
+    if ('serializeMessage' in transaction) {
+        return transaction.signatures.some((s) => s.signature != null);
+    }
+    return transaction.signatures.some((sig) => sig.some((b) => b !== 0));
+}
 class SolanaKeypairProvider {
     constructor(rpcUrl, serverKeypair) {
         this.rpcUrl = rpcUrl;
@@ -108,25 +120,34 @@ class SolanaKeypairProvider {
         // 1. Get RPC URL and create connection
         const rpcUrl = this.getRpcUrl();
         const connection = new Connection(rpcUrl, 'confirmed');
-        // 2. Get fresh blockhash and set it on the transaction before signing
-        const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
-        // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
-        const isLegacyTransaction = 'recentBlockhash' in transaction && !('message' in transaction && 'staticAccountKeys' in transaction.message);
-        if (isLegacyTransaction) {
-            const legacyTx = transaction;
-            legacyTx.recentBlockhash = blockhash;
-            legacyTx.lastValidBlockHeight = lastValidBlockHeight;
-            // Set feePayer if not already set
-            if (!legacyTx.feePayer) {
-                legacyTx.feePayer = feePayer !== null && feePayer !== void 0 ? feePayer : this.keypair.publicKey;
+        // 2. Get fresh blockhash and set it on the transaction before signing.
+        // DS3-0414: a Solana signature covers the compiled message (recentBlockhash included),
+        // so refreshing the blockhash after a sponsor / co-signer has already signed silently
+        // invalidates their signature - and this is the sponsored/fee-payer submit path, where a
+        // co-signed transaction is exactly what arrives. signTransaction only ADDS this keypair's
+        // signature (partialSign), it never re-signs the others. So only refresh the blockhash
+        // while the transaction is still unsigned; once a real signature is present, sign and
+        // submit the caller's message verbatim.
+        if (!transactionHasSignature(transaction)) {
+            const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
+            // Use duck typing instead of instanceof to handle multiple @solana/web3.js versions
+            const isLegacyTransaction = 'recentBlockhash' in transaction && !('message' in transaction && 'staticAccountKeys' in transaction.message);
+            if (isLegacyTransaction) {
+                const legacyTx = transaction;
+                legacyTx.recentBlockhash = blockhash;
+                legacyTx.lastValidBlockHeight = lastValidBlockHeight;
+                // Set feePayer if not already set
+                if (!legacyTx.feePayer) {
+                    legacyTx.feePayer = feePayer !== null && feePayer !== void 0 ? feePayer : this.keypair.publicKey;
+                }
+            }
+            else {
+                // VersionedTransaction
+                const versionedTx = transaction;
+                versionedTx.message.recentBlockhash = blockhash;
+                // Note: VersionedTransaction feePayer is set in the message at creation time
+                // and cannot be modified after creation
             }
-        }
-        else {
-            // VersionedTransaction
-            const versionedTx = transaction;
-            versionedTx.message.recentBlockhash = blockhash;
-            // Note: VersionedTransaction feePayer is set in the message at creation time
-            // and cannot be modified after creation
         }
         // 3. Sign the transaction
         const signedTx = await this.signTransaction(transaction);
@@ -188,16 +209,6 @@ class SolanaKeypairProvider {
         }
         throw new Error('Solana RPC URL is required for server keypair transaction submission; pass an explicit rpcUrl when creating SolanaKeypairProvider.');
     }
-    /* ----------------------------------------------------------- *
-     * Transaction runner
-     * ----------------------------------------------------------- */
-    async runTransaction(_evmTransactionData, _solTransactionData, _options) {
-        // Client-side Solana transaction building is retired: the realtime worker
-        // returns a fully-built (and, when sponsored, partially-signed) transaction
-        // on its 202, which the SDK validates and signs via signTransaction /
-        // signAndSubmitTransaction. This provider serves no EVM payload either.
-        throw new Error('runTransaction is not supported by this provider; Bounded returns pre-built Solana transactions that are signed with signTransaction/signAndSubmitTransaction.');
-    }
     async getNativeMethods() {
         return { keypair: this.keypair };
     }
@@ -236,312 +247,6 @@ class OffchainAuthProvider {
     async signAndSubmitTransaction(_transaction, _feePayer) {
         throw new Error('Poofnet does not support real Solana transactions. Deploy your project to mainnet to use this feature.');
     }
-    async runTransaction(evmTransactionData, solTransactionData, options) {
-        return this.wrappedProvider.runTransaction(evmTransactionData, solTransactionData, options);
-    }
-}
-
-function evmErrorText(error) {
-    const message = error === null || error === void 0 ? void 0 : error.message;
-    return typeof message === 'string' && message.length > 0 ? message : String(error);
-}
-/**
- * Whether a broadcast failure PROVES the transaction never entered the network.
- * A node-level validation rejection is definitive and keeps throwing; a
- * transport failure (timeout, socket reset, aborted request) is ambiguous — the
- * node may hold the bytes — and must resolve as `submitted`.
- *
- * "already known"/"already imported" is deliberately NOT definitive: it means
- * the node already has these exact bytes, which is success, not failure.
- */
-const DEFINITIVE_EVM_SEND_MARKERS = [
-    'nonce too low',
-    'insufficient funds',
-    'intrinsic gas too low',
-    'gas required exceeds',
-    'exceeds block gas limit',
-    'invalid sender',
-    'invalid signature',
-    'execution reverted',
-    'transaction underpriced',
-    'oversized data',
-];
-function isDefinitiveEvmSendFailure(error) {
-    var _a, _b;
-    const message = String((_b = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : error) !== null && _b !== void 0 ? _b : '').toLowerCase();
-    if (!message)
-        return false;
-    if (message.includes('already known') || message.includes('already imported'))
-        return false;
-    return DEFINITIVE_EVM_SEND_MARKERS.some(marker => message.includes(marker));
-}
-/** viem raises a dedicated not-found error when a receipt simply is not mined yet. */
-function isReceiptNotFound(error) {
-    var _a, _b;
-    const name = String((_a = error === null || error === void 0 ? void 0 : error.name) !== null && _a !== void 0 ? _a : '');
-    if (name === 'TransactionReceiptNotFoundError')
-        return true;
-    return String((_b = error === null || error === void 0 ? void 0 : error.message) !== null && _b !== void 0 ? _b : '').toLowerCase().includes('could not be found');
-}
-const NO_SOLANA = 'An EVM keypair client cannot sign Solana transactions.';
-function normalizeChainConfig(input) {
-    var _a;
-    if (!Number.isSafeInteger(input.chainId) || input.chainId <= 0)
-        throw new Error('EVM chainId must be a positive safe integer');
-    let rpc;
-    try {
-        rpc = new URL(input.rpcUrl);
-    }
-    catch (_b) {
-        throw new Error(`EVM RPC URL is invalid for chain ${input.chainId}`);
-    }
-    if (rpc.protocol !== 'https:' && !(rpc.protocol === 'http:' && (rpc.hostname === 'localhost' || rpc.hostname === '127.0.0.1' || rpc.hostname === '[::1]'))) {
-        throw new Error(`EVM RPC URL must use HTTPS for chain ${input.chainId}`);
-    }
-    const runtimeAddress = normalizeEvmAddress(input.runtimeAddress);
-    if (!runtimeAddress)
-        throw new Error(`BoundedRuntime address is invalid for chain ${input.chainId}`);
-    return { chainId: input.chainId, rpcUrl: rpc.toString(), runtimeAddress, name: ((_a = input.name) === null || _a === void 0 ? void 0 : _a.trim()) || `EVM ${input.chainId}` };
-}
-function asViemChain(config) {
-    return defineChain({
-        id: config.chainId,
-        name: config.name,
-        nativeCurrency: { name: 'Native token', symbol: 'NATIVE', decimals: 18 },
-        rpcUrls: { default: { http: [config.rpcUrl] } },
-    });
-}
-class EvmKeypairProvider {
-    constructor(privateKey, defaultChainId, chainConfigs) {
-        this.chains = new Map();
-        if (!/^0x[0-9a-fA-F]{64}$/.test(privateKey))
-            throw new Error('Invalid EVM private key: expected 0x followed by 64 hex characters.');
-        this.account = privateKeyToAccount(privateKey);
-        const address = normalizeEvmAddress(this.account.address);
-        if (!address)
-            throw new Error('Could not derive a valid EVM address from the private key');
-        this.address = address;
-        for (const raw of chainConfigs) {
-            const chain = normalizeChainConfig(raw);
-            if (this.chains.has(chain.chainId))
-                throw new Error(`Duplicate EVM chain configuration: ${chain.chainId}`);
-            this.chains.set(chain.chainId, chain);
-        }
-        if (!this.chains.has(defaultChainId))
-            throw new Error(`Default EVM chain ${defaultChainId} is not configured`);
-        this.defaultChainId = defaultChainId;
-    }
-    user() {
-        return { id: this.address, address: null, evmAddress: this.address, provider: this };
-    }
-    async createBoundedSession(sessionConfig) {
-        var _a, _b, _c, _d;
-        // Bind the SIWE nonce/message/session to the snapshotted app+issuer when a
-        // wallet client supplies one, so a later global init() cannot retarget this
-        // session mint (CTA-05); otherwise read the mutable global init() config.
-        const nonce = await genAuthNonce(sessionConfig);
-        const appId = (_a = sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId) !== null && _a !== void 0 ? _a : (await getConfig()).appId;
-        const message = genSiweMessage(this.address, nonce, appId, 'server', 'https://server/login', { chainId: this.defaultChainId });
-        const signature = await this.account.signMessage({ message });
-        const session = await createSessionWithSignature(this.address, message, signature, 'siwe', sessionConfig);
-        return {
-            address: this.address,
-            accessToken: String((_b = session.accessToken) !== null && _b !== void 0 ? _b : ''),
-            idToken: String((_c = session.idToken) !== null && _c !== void 0 ? _c : ''),
-            refreshToken: String((_d = session.refreshToken) !== null && _d !== void 0 ? _d : ''),
-        };
-    }
-    async login() { return this.user(); }
-    async restoreSession() { return this.user(); }
-    async logout() { }
-    async signMessage(message) {
-        return this.account.signMessage({ message });
-    }
-    async signTransaction(_transaction) {
-        throw new Error(NO_SOLANA);
-    }
-    async signAndSubmitTransaction(_transaction, _feePayer) {
-        throw new Error(NO_SOLANA);
-    }
-    async runTransaction(evm, sol, options) {
-        var _a;
-        if (evm && sol)
-            throw new Error('A transaction cannot target EVM and Solana at the same time.');
-        if (!evm || !evm.chainId || !evm.to || !evm.data)
-            throw new Error('A complete EVM transaction is required');
-        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)
-            throw new Error('EVM keypair writes submit atomically; shouldSubmitTx:false is unsupported.');
-        const config = this.chains.get(evm.chainId);
-        if (!config)
-            throw new Error(`EVM chain ${evm.chainId} is not configured for this wallet client`);
-        if (normalizeEvmAddress(evm.to) !== config.runtimeAddress)
-            throw new Error('EVM transaction target is not the configured BoundedRuntime');
-        if (evm.nonce !== undefined)
-            throw new Error('Server-supplied EVM nonces are not accepted');
-        try {
-            if (BigInt((_a = evm.value) !== null && _a !== void 0 ? _a : '0') !== BigInt(0))
-                throw new Error('BoundedRuntime.setDocuments cannot transfer native value');
-        }
-        catch (error) {
-            if (error instanceof Error && error.message.includes('cannot transfer'))
-                throw error;
-            throw new Error('Invalid EVM transaction value');
-        }
-        // The shared decoder accepts only canonical ordinary/attested document
-        // writes and rejects selector-prefix smuggling, aliases and trailing bytes.
-        assertCanonicalBoundedRuntimeWriteCalldata(evm.data);
-        // A server key can safely switch between explicitly configured chains: each
-        // tx selects its own immutable viem client/RPC/runtime tuple. No untrusted
-        // server response may introduce a new chain or RPC endpoint.
-        const chain = asViemChain(config);
-        const transport = http(config.rpcUrl);
-        const wallet = createWalletClient$1({ account: this.account, chain, transport });
-        const publicClient = createPublicClient({ chain, transport });
-        // Unlike a browser wallet this provider OWNS the private key, so it prepares
-        // and signs locally with an EXPLICIT nonce and derives the hash before the
-        // transaction is ever broadcast. Learning the hash only from
-        // `sendTransaction()` discards an identifier we could have known, so an
-        // accepted-but-lost response would strand a landed write.
-        let request;
-        let signedTransaction;
-        let hash;
-        let nonce;
-        try {
-            request = await wallet.prepareTransactionRequest({
-                account: this.account,
-                chain,
-                to: config.runtimeAddress,
-                data: evm.data,
-                value: BigInt(0),
-            });
-            nonce = Number(request.nonce);
-            if (!Number.isSafeInteger(nonce) || nonce < 0)
-                throw new Error('the prepared transaction carries no usable nonce');
-            signedTransaction = await wallet.signTransaction(request);
-            hash = keccak256(signedTransaction);
-        }
-        catch (error) {
-            // Preparation and local signing happen entirely before broadcast, so any
-            // failure here is definitive.
-            throw error;
-        }
-        const fence = {
-            chainId: config.chainId,
-            sender: this.address,
-            nonce,
-            signedTransaction,
-        };
-        try {
-            await publicClient.sendRawTransaction({ serializedTransaction: signedTransaction });
-        }
-        catch (error) {
-            if (isDefinitiveEvmSendFailure(error))
-                throw error;
-            // Ambiguous transport outcome: the node may already hold these exact
-            // bytes. Report the pre-derived hash and the fence so reconciliation can
-            // poll it, or rebroadcast the byte-identical bytes while the nonce is
-            // unused — which cannot produce a second execution.
-            return {
-                outcome: 'submitted',
-                lane: 'evm',
-                transactionSignature: hash,
-                fence,
-                reason: `Broadcast response was lost or inconclusive: ${evmErrorText(error)}`,
-            };
-        }
-        let receipt;
-        try {
-            receipt = await publicClient.waitForTransactionReceipt({ hash });
-        }
-        catch (error) {
-            // The bytes were accepted; only the confirmation outcome is unknown.
-            return {
-                outcome: 'submitted',
-                lane: 'evm',
-                transactionSignature: hash,
-                fence,
-                reason: `Confirmation outcome unknown: ${evmErrorText(error)}`,
-            };
-        }
-        if (receipt.status !== 'success')
-            throw new Error(`EVM transaction ${hash} reverted on-chain`);
-        if (receipt.blockNumber > BigInt(Number.MAX_SAFE_INTEGER))
-            throw new Error('EVM receipt block number exceeds the SDK safe-integer range');
-        return {
-            outcome: 'confirmed',
-            lane: 'evm',
-            transactionSignature: hash,
-            blockNumber: Number(receipt.blockNumber),
-            gasUsed: receipt.gasUsed.toString(),
-            data: receipt,
-        };
-    }
-    /**
-     * Poll the SAME hash, and — only while the fenced nonce is still unused — put
-     * the byte-identical signed transaction back on the wire. Same nonce, same
-     * signature, so a rebroadcast can never produce a second execution.
-     *
-     * It NEVER reports a retry-safe terminal state. Nonce advancement is not proof
-     * the write did not execute: a replacement can occupy the same sender and
-     * nonce carrying identical Bounded calldata under a different hash, and plain
-     * JSON-RPC offers no transaction-by-sender-and-nonce lookup to identify it.
-     */
-    async reconcileEvmTransaction(request) {
-        var _a, _b;
-        const chainId = (_b = (_a = request.fence) === null || _a === void 0 ? void 0 : _a.chainId) !== null && _b !== void 0 ? _b : this.defaultChainId;
-        const config = this.chains.get(chainId);
-        if (!config)
-            return { state: 'unknown', reason: `EVM chain ${chainId} is not configured for this wallet client` };
-        const chain = asViemChain(config);
-        const transport = http(config.rpcUrl);
-        const publicClient = createPublicClient({ chain, transport });
-        try {
-            const receipt = await publicClient.getTransactionReceipt({ hash: request.transactionHash });
-            if (receipt) {
-                if (receipt.status !== 'success') {
-                    return { state: 'failed', reason: `EVM transaction ${request.transactionHash} reverted on-chain` };
-                }
-                if (receipt.blockNumber > BigInt(Number.MAX_SAFE_INTEGER)) {
-                    return { state: 'unknown', reason: 'EVM receipt block number exceeds the SDK safe-integer range' };
-                }
-                return { state: 'confirmed', blockNumber: Number(receipt.blockNumber) };
-            }
-        }
-        catch (error) {
-            // viem throws `TransactionReceiptNotFoundError` when it is simply not
-            // mined yet; that is not an error condition, just "still unknown".
-            if (!isReceiptNotFound(error)) {
-                return { state: 'unknown', reason: `receipt lookup failed: ${evmErrorText(error)}` };
-            }
-        }
-        const fence = request.fence;
-        if (!request.allowRebroadcast || !fence) {
-            return { state: 'unknown', reason: 'no receipt yet for this transaction hash' };
-        }
-        try {
-            const nonceNow = await publicClient.getTransactionCount({ address: fence.sender, blockTag: 'latest' });
-            if (nonceNow > fence.nonce) {
-                // The nonce is spent. It may have been spent by THIS transaction under a
-                // different hash (a replacement), so this is emphatically not retry-safe.
-                return {
-                    state: 'unknown',
-                    reason: `nonce ${fence.nonce} on ${fence.sender} has been consumed but this hash has no receipt; ` +
-                        'the transaction may have been replaced, so the write is not proven absent',
-                };
-            }
-            await publicClient.sendRawTransaction({ serializedTransaction: fence.signedTransaction });
-            return { state: 'unknown', reason: 'rebroadcast the byte-identical fenced transaction; still awaiting a receipt' };
-        }
-        catch (error) {
-            return { state: 'unknown', reason: `rebroadcast attempt was inconclusive: ${evmErrorText(error)}` };
-        }
-    }
-    async getNativeMethods() { return this.account; }
-    transactionPolicy() {
-        return {
-            runtimeAddresses: Object.fromEntries([...this.chains].map(([id, config]) => [String(id), config.runtimeAddress])),
-        };
-    }
 }
 
 // #023: strip caller-supplied auth headers so an operation runs as the isolated wallet, not
@@ -601,12 +306,11 @@ function jwtExpiringSoon(token) {
 /*  WalletClient                                                       */
 /* ------------------------------------------------------------------ */
 class WalletClient {
-    constructor(provider, sessionManager, address, config, evmTransactionPolicy) {
+    constructor(provider, sessionManager, address, config) {
         this.provider = provider;
         this.sessionManager = sessionManager;
         this.address = address;
         this.config = config;
-        this.evmTransactionPolicy = evmTransactionPolicy;
         this.live = {
             intent: (roomPath, intent, opts = {}) => live$1.intent(roomPath, intent, this.mergeLiveIntentOptions(opts)),
             // Route status through the SAME auth merge intent uses so a server-keypair
@@ -639,10 +343,12 @@ class WalletClient {
     }
     /* ---- Auth override helpers ---- */
     buildOverrides() {
-        return Object.assign({ authProvider: this.provider, 
+        return {
+            authProvider: this.provider,
             // Pin every request to this wallet client's snapshotted app + endpoints so
             // a later global init() can never retarget its reads/writes (CTA-05).
-            _config: this.config, _getAuthHeaders: async () => {
+            _config: this.config,
+            _getAuthHeaders: async () => {
                 let s = await this.sessionManager.getSession();
                 // Keypair-backed session: if the cached token is expired/near-expiry,
                 // re-sign for a fresh one (we always hold the key). Keeps long-lived WS
@@ -653,9 +359,12 @@ class WalletClient {
                     s = await this.sessionManager.getSession();
                 }
                 return { Authorization: `Bearer ${s.idToken}` };
-            }, _clearAuth: async () => {
+            },
+            _clearAuth: async () => {
                 this.sessionManager.clearSession();
-            }, _walletAddress: this.address }, (this.evmTransactionPolicy ? { _evmTransactionPolicy: this.evmTransactionPolicy } : {}));
+            },
+            _walletAddress: this.address,
+        };
     }
     /** #023: strip caller Authorization (any casing) so operations run as the isolated wallet. */
     sanitizeHeaders(headers) {
@@ -664,7 +373,7 @@ class WalletClient {
     mergeSetOverrides(opts) {
         var _a;
         const ovr = this.buildOverrides();
-        return Object.assign(Object.assign({}, opts), { _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), authProvider: ovr.authProvider, _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _evmTransactionPolicy: ovr._evmTransactionPolicy, _config: ovr._config }) });
+        return Object.assign(Object.assign({}, opts), { _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), authProvider: ovr.authProvider, _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _config: ovr._config }) });
     }
     mergeReadOverrides(existing) {
         const ovr = this.buildOverrides();
@@ -783,20 +492,13 @@ class WalletClient {
     }
 }
 /**
- * Create a self-contained wallet client bound to one Solana or EVM keypair.
+ * Create a self-contained wallet client bound to one Solana keypair.
  * Each client has its own auth session — no global state is mutated.
  *
  * @example
  * ```ts
  * const vault = await createWalletClient({ keypair: process.env.VAULT_KEY });
  * await vault.set('markets/123', data);
- *
- * const evmVault = await createWalletClient({
- *   evmPrivateKey: process.env.EVM_PRIVATE_KEY,
- *   chainId: 8453,
- *   rpcUrl: process.env.BASE_RPC_URL,
- *   runtimeAddress: process.env.BOUNDED_RUNTIME,
- * });
  * ```
  */
 async function createWalletClient(opts) {
@@ -812,32 +514,8 @@ async function createWalletClient(opts) {
         authApiUrl: config.authApiUrl,
         authMethod: config.authMethod,
     };
-    if ('evmPrivateKey' in opts && typeof opts.evmPrivateKey === 'string') {
-        const chainConfigs = [];
-        if (opts.chains) {
-            for (const [rawId, chain] of Object.entries(opts.chains)) {
-                const chainId = Number(rawId);
-                if (!Number.isSafeInteger(chainId) || chainId <= 0)
-                    throw new Error(`Invalid EVM chain id in chains map: ${rawId}`);
-                chainConfigs.push({ chainId, rpcUrl: chain.rpcUrl, runtimeAddress: chain.runtimeAddress, name: chain.name });
-            }
-        }
-        if (opts.rpcUrl !== undefined || opts.runtimeAddress !== undefined) {
-            if (!opts.rpcUrl || !opts.runtimeAddress)
-                throw new Error('Single-chain EVM clients require both rpcUrl and runtimeAddress');
-            if (chainConfigs.some((chain) => chain.chainId === opts.chainId))
-                throw new Error(`EVM chain ${opts.chainId} is configured twice`);
-            chainConfigs.push({ chainId: opts.chainId, rpcUrl: opts.rpcUrl, runtimeAddress: opts.runtimeAddress });
-        }
-        if (chainConfigs.length === 0)
-            throw new Error('EVM wallet clients require an explicit RPC URL and BoundedRuntime address');
-        const provider = new EvmKeypairProvider(opts.evmPrivateKey, opts.chainId, chainConfigs);
-        const sessionManager = ServerSessionManager.forSessionFactory(() => provider.createBoundedSession(sessionConfig));
-        await sessionManager.getSession();
-        return new WalletClient(provider, sessionManager, provider.address, config, provider.transactionPolicy());
-    }
     if (!('keypair' in opts) || typeof opts.keypair !== 'string') {
-        throw new Error('createWalletClient requires exactly one of keypair or evmPrivateKey');
+        throw new Error('createWalletClient requires a Solana keypair');
     }
     const kp = parseKeypair(opts.keypair);
     let provider = new SolanaKeypairProvider((_a = config.rpcUrl) !== null && _a !== void 0 ? _a : null, kp);
@@ -1175,5 +853,5 @@ async function verifyWebhook(rawBody, headers, opts = {}) {
     return payload;
 }
 
-export { DEFAULT_WEBHOOK_KEYS_URL, EvmKeypairProvider, InMemoryReplayStore, WalletClient, WebhookVerificationError, aggregate, clearWebhookKeyCache, clearWebhookReplayCache, count, createWalletClient, functions, get, getAuthProvider, getFiles, getIdToken, getMany, init, invokeFunction, live, liveIntent, liveStatus, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe, verifyWebhook };
+export { DEFAULT_WEBHOOK_KEYS_URL, InMemoryReplayStore, WalletClient, WebhookVerificationError, aggregate, clearWebhookKeyCache, clearWebhookReplayCache, count, createWalletClient, functions, get, getAuthProvider, getFiles, getIdToken, getMany, init, invokeFunction, live, liveIntent, liveStatus, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe, verifyWebhook };
 //# sourceMappingURL=index.mjs.map