@bounded-sh/server 0.0.68 → 0.0.70
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -38
- package/dist/auth/providers/offchain-auth-provider.d.ts +0 -1
- package/dist/auth/providers/solana-keypair-provider.d.ts +1 -2
- package/dist/index.d.ts +1 -3
- package/dist/index.js +16 -361
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +18 -362
- package/dist/index.mjs.map +1 -1
- package/dist/wallet-client.d.ts +3 -27
- package/package.json +4 -5
- package/dist/auth/providers/evm-keypair-provider.d.ts +0 -45
package/dist/index.mjs
CHANGED
|
@@ -1,11 +1,9 @@
|
|
|
1
|
-
import { init as init$1,
|
|
1
|
+
import { init as init$1, live as live$1, set as set$1, setMany as setMany$1, setFile as setFile$1, reconcileSetResult, waitForSetResult, get as get$1, getMany as getMany$1, getFiles as getFiles$1, search as search$1, runQuery as runQuery$1, runQueryMany as runQueryMany$1, runExpression as runExpression$1, runExpressionMany as runExpressionMany$1, count as count$1, aggregate as aggregate$1, queryAggregate as queryAggregate$1, subscribe as subscribe$1, functions as functions$1, getConfig, ServerSessionManager, getWebhookKeysUrl, getConfiguredAppId } from '@bounded-sh/core';
|
|
2
2
|
export { BoundedDeclineError, DECLINE_EVENT_NAME, FunctionInvokeError, InsufficientBalanceError, LiveIntentError, deriveDecline, getConfig, getWebhookKeysUrl, reconcileSetResult, waitForSetResult } from '@bounded-sh/core';
|
|
3
3
|
import { Connection, Keypair } from '@solana/web3.js';
|
|
4
4
|
import bs58 from 'bs58';
|
|
5
5
|
import { Buffer as Buffer$1 } from 'buffer';
|
|
6
6
|
import nacl from 'tweetnacl';
|
|
7
|
-
import { http, createWalletClient as createWalletClient$1, createPublicClient, keccak256, defineChain } from 'viem';
|
|
8
|
-
import { privateKeyToAccount } from 'viem/accounts';
|
|
9
7
|
|
|
10
8
|
async function init(newConfig) {
|
|
11
9
|
await init$1(Object.assign(Object.assign({}, newConfig), { authProvider: null, isServer: true, skipBackendInit: true }));
|
|
@@ -52,6 +50,9 @@ async function getIdToken() {
|
|
|
52
50
|
throw new Error('getIdToken is not available as a tarobase-server top-level auth operation. Use createWalletClient({ keypair }) and call the returned client methods.');
|
|
53
51
|
}
|
|
54
52
|
|
|
53
|
+
// Gas-sponsorship top-up cap (0.05 SOL); the fee payer (sponsor) can only move
|
|
54
|
+
// its OWN lamports up to this bound, and only to a co-signing account.
|
|
55
|
+
BigInt(50000000);
|
|
55
56
|
/**
|
|
56
57
|
* DS3-0414: does the transaction already carry a REAL signer signature? A Solana
|
|
57
58
|
* signature is computed over the compiled message, which INCLUDES recentBlockhash, so
|
|
@@ -211,16 +212,6 @@ class SolanaKeypairProvider {
|
|
|
211
212
|
}
|
|
212
213
|
throw new Error('Solana RPC URL is required for server keypair transaction submission; pass an explicit rpcUrl when creating SolanaKeypairProvider.');
|
|
213
214
|
}
|
|
214
|
-
/* ----------------------------------------------------------- *
|
|
215
|
-
* Transaction runner
|
|
216
|
-
* ----------------------------------------------------------- */
|
|
217
|
-
async runTransaction(_evmTransactionData, _solTransactionData, _options) {
|
|
218
|
-
// Client-side Solana transaction building is retired: the realtime worker
|
|
219
|
-
// returns a fully-built (and, when sponsored, partially-signed) transaction
|
|
220
|
-
// on its 202, which the SDK validates and signs via signTransaction /
|
|
221
|
-
// signAndSubmitTransaction. This provider serves no EVM payload either.
|
|
222
|
-
throw new Error('runTransaction is not supported by this provider; Bounded returns pre-built Solana transactions that are signed with signTransaction/signAndSubmitTransaction.');
|
|
223
|
-
}
|
|
224
215
|
async getNativeMethods() {
|
|
225
216
|
return { keypair: this.keypair };
|
|
226
217
|
}
|
|
@@ -259,314 +250,6 @@ class OffchainAuthProvider {
|
|
|
259
250
|
async signAndSubmitTransaction(_transaction, _feePayer) {
|
|
260
251
|
throw new Error('Poofnet does not support real Solana transactions. Deploy your project to mainnet to use this feature.');
|
|
261
252
|
}
|
|
262
|
-
async runTransaction(evmTransactionData, solTransactionData, options) {
|
|
263
|
-
return this.wrappedProvider.runTransaction(evmTransactionData, solTransactionData, options);
|
|
264
|
-
}
|
|
265
|
-
}
|
|
266
|
-
|
|
267
|
-
function evmErrorText(error) {
|
|
268
|
-
const message = error === null || error === void 0 ? void 0 : error.message;
|
|
269
|
-
return typeof message === 'string' && message.length > 0 ? message : String(error);
|
|
270
|
-
}
|
|
271
|
-
/**
|
|
272
|
-
* Whether a broadcast failure PROVES the transaction never entered the network.
|
|
273
|
-
* A node-level validation rejection is definitive and keeps throwing; a
|
|
274
|
-
* transport failure (timeout, socket reset, aborted request) is ambiguous — the
|
|
275
|
-
* node may hold the bytes — and must resolve as `submitted`.
|
|
276
|
-
*
|
|
277
|
-
* "already known"/"already imported" is deliberately NOT definitive: it means
|
|
278
|
-
* the node already has these exact bytes, which is success, not failure.
|
|
279
|
-
*/
|
|
280
|
-
const DEFINITIVE_EVM_SEND_MARKERS = [
|
|
281
|
-
'nonce too low',
|
|
282
|
-
'insufficient funds',
|
|
283
|
-
'intrinsic gas too low',
|
|
284
|
-
'gas required exceeds',
|
|
285
|
-
'exceeds block gas limit',
|
|
286
|
-
'invalid sender',
|
|
287
|
-
'invalid signature',
|
|
288
|
-
'execution reverted',
|
|
289
|
-
'transaction underpriced',
|
|
290
|
-
'oversized data',
|
|
291
|
-
];
|
|
292
|
-
function isDefinitiveEvmSendFailure(error) {
|
|
293
|
-
var _a, _b;
|
|
294
|
-
const message = String((_b = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : error) !== null && _b !== void 0 ? _b : '').toLowerCase();
|
|
295
|
-
if (!message)
|
|
296
|
-
return false;
|
|
297
|
-
if (message.includes('already known') || message.includes('already imported'))
|
|
298
|
-
return false;
|
|
299
|
-
return DEFINITIVE_EVM_SEND_MARKERS.some(marker => message.includes(marker));
|
|
300
|
-
}
|
|
301
|
-
/** viem raises a dedicated not-found error when a receipt simply is not mined yet. */
|
|
302
|
-
function isReceiptNotFound(error) {
|
|
303
|
-
var _a, _b;
|
|
304
|
-
const name = String((_a = error === null || error === void 0 ? void 0 : error.name) !== null && _a !== void 0 ? _a : '');
|
|
305
|
-
if (name === 'TransactionReceiptNotFoundError')
|
|
306
|
-
return true;
|
|
307
|
-
return String((_b = error === null || error === void 0 ? void 0 : error.message) !== null && _b !== void 0 ? _b : '').toLowerCase().includes('could not be found');
|
|
308
|
-
}
|
|
309
|
-
const NO_SOLANA = 'An EVM keypair client cannot sign Solana transactions.';
|
|
310
|
-
function normalizeChainConfig(input) {
|
|
311
|
-
var _a;
|
|
312
|
-
if (!Number.isSafeInteger(input.chainId) || input.chainId <= 0)
|
|
313
|
-
throw new Error('EVM chainId must be a positive safe integer');
|
|
314
|
-
let rpc;
|
|
315
|
-
try {
|
|
316
|
-
rpc = new URL(input.rpcUrl);
|
|
317
|
-
}
|
|
318
|
-
catch (_b) {
|
|
319
|
-
throw new Error(`EVM RPC URL is invalid for chain ${input.chainId}`);
|
|
320
|
-
}
|
|
321
|
-
if (rpc.protocol !== 'https:' && !(rpc.protocol === 'http:' && (rpc.hostname === 'localhost' || rpc.hostname === '127.0.0.1' || rpc.hostname === '[::1]'))) {
|
|
322
|
-
throw new Error(`EVM RPC URL must use HTTPS for chain ${input.chainId}`);
|
|
323
|
-
}
|
|
324
|
-
const runtimeAddress = normalizeEvmAddress(input.runtimeAddress);
|
|
325
|
-
if (!runtimeAddress)
|
|
326
|
-
throw new Error(`BoundedRuntime address is invalid for chain ${input.chainId}`);
|
|
327
|
-
return { chainId: input.chainId, rpcUrl: rpc.toString(), runtimeAddress, name: ((_a = input.name) === null || _a === void 0 ? void 0 : _a.trim()) || `EVM ${input.chainId}` };
|
|
328
|
-
}
|
|
329
|
-
function asViemChain(config) {
|
|
330
|
-
return defineChain({
|
|
331
|
-
id: config.chainId,
|
|
332
|
-
name: config.name,
|
|
333
|
-
nativeCurrency: { name: 'Native token', symbol: 'NATIVE', decimals: 18 },
|
|
334
|
-
rpcUrls: { default: { http: [config.rpcUrl] } },
|
|
335
|
-
});
|
|
336
|
-
}
|
|
337
|
-
class EvmKeypairProvider {
|
|
338
|
-
constructor(privateKey, defaultChainId, chainConfigs) {
|
|
339
|
-
this.chains = new Map();
|
|
340
|
-
if (!/^0x[0-9a-fA-F]{64}$/.test(privateKey))
|
|
341
|
-
throw new Error('Invalid EVM private key: expected 0x followed by 64 hex characters.');
|
|
342
|
-
this.account = privateKeyToAccount(privateKey);
|
|
343
|
-
const address = normalizeEvmAddress(this.account.address);
|
|
344
|
-
if (!address)
|
|
345
|
-
throw new Error('Could not derive a valid EVM address from the private key');
|
|
346
|
-
this.address = address;
|
|
347
|
-
for (const raw of chainConfigs) {
|
|
348
|
-
const chain = normalizeChainConfig(raw);
|
|
349
|
-
if (this.chains.has(chain.chainId))
|
|
350
|
-
throw new Error(`Duplicate EVM chain configuration: ${chain.chainId}`);
|
|
351
|
-
this.chains.set(chain.chainId, chain);
|
|
352
|
-
}
|
|
353
|
-
if (!this.chains.has(defaultChainId))
|
|
354
|
-
throw new Error(`Default EVM chain ${defaultChainId} is not configured`);
|
|
355
|
-
this.defaultChainId = defaultChainId;
|
|
356
|
-
}
|
|
357
|
-
user() {
|
|
358
|
-
// @user.address (the Solana wallet) is null for an EVM keypair login: this
|
|
359
|
-
// principal has only an EVM address. User.address is typed `string | null`.
|
|
360
|
-
return { id: this.address, address: null, evmAddress: this.address, provider: this };
|
|
361
|
-
}
|
|
362
|
-
async createBoundedSession(sessionConfig) {
|
|
363
|
-
var _a, _b, _c, _d;
|
|
364
|
-
// Bind the SIWE nonce/message/session to the snapshotted app+issuer when a
|
|
365
|
-
// wallet client supplies one, so a later global init() cannot retarget this
|
|
366
|
-
// session mint (CTA-05); otherwise read the mutable global init() config.
|
|
367
|
-
const nonce = await genAuthNonce(sessionConfig);
|
|
368
|
-
const appId = (_a = sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId) !== null && _a !== void 0 ? _a : (await getConfig()).appId;
|
|
369
|
-
const message = genSiweMessage(this.address, nonce, appId, 'server', 'https://server/login', { chainId: this.defaultChainId });
|
|
370
|
-
const signature = await this.account.signMessage({ message });
|
|
371
|
-
const session = await createSessionWithSignature(this.address, message, signature, 'siwe', sessionConfig);
|
|
372
|
-
return {
|
|
373
|
-
address: this.address,
|
|
374
|
-
accessToken: String((_b = session.accessToken) !== null && _b !== void 0 ? _b : ''),
|
|
375
|
-
idToken: String((_c = session.idToken) !== null && _c !== void 0 ? _c : ''),
|
|
376
|
-
refreshToken: String((_d = session.refreshToken) !== null && _d !== void 0 ? _d : ''),
|
|
377
|
-
};
|
|
378
|
-
}
|
|
379
|
-
async login() { return this.user(); }
|
|
380
|
-
async restoreSession() { return this.user(); }
|
|
381
|
-
async logout() { }
|
|
382
|
-
async signMessage(message) {
|
|
383
|
-
return this.account.signMessage({ message });
|
|
384
|
-
}
|
|
385
|
-
async signTransaction(_transaction) {
|
|
386
|
-
throw new Error(NO_SOLANA);
|
|
387
|
-
}
|
|
388
|
-
async signAndSubmitTransaction(_transaction, _feePayer) {
|
|
389
|
-
throw new Error(NO_SOLANA);
|
|
390
|
-
}
|
|
391
|
-
async runTransaction(evm, sol, options) {
|
|
392
|
-
var _a;
|
|
393
|
-
if (evm && sol)
|
|
394
|
-
throw new Error('A transaction cannot target EVM and Solana at the same time.');
|
|
395
|
-
if (!evm || !evm.chainId || !evm.to || !evm.data)
|
|
396
|
-
throw new Error('A complete EVM transaction is required');
|
|
397
|
-
if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)
|
|
398
|
-
throw new Error('EVM keypair writes submit atomically; shouldSubmitTx:false is unsupported.');
|
|
399
|
-
const config = this.chains.get(evm.chainId);
|
|
400
|
-
if (!config)
|
|
401
|
-
throw new Error(`EVM chain ${evm.chainId} is not configured for this wallet client`);
|
|
402
|
-
if (normalizeEvmAddress(evm.to) !== config.runtimeAddress)
|
|
403
|
-
throw new Error('EVM transaction target is not the configured BoundedRuntime');
|
|
404
|
-
if (evm.nonce !== undefined)
|
|
405
|
-
throw new Error('Server-supplied EVM nonces are not accepted');
|
|
406
|
-
try {
|
|
407
|
-
if (BigInt((_a = evm.value) !== null && _a !== void 0 ? _a : '0') !== BigInt(0))
|
|
408
|
-
throw new Error('BoundedRuntime.setDocuments cannot transfer native value');
|
|
409
|
-
}
|
|
410
|
-
catch (error) {
|
|
411
|
-
if (error instanceof Error && error.message.includes('cannot transfer'))
|
|
412
|
-
throw error;
|
|
413
|
-
throw new Error('Invalid EVM transaction value');
|
|
414
|
-
}
|
|
415
|
-
// The shared decoder accepts only canonical ordinary/attested document
|
|
416
|
-
// writes and rejects selector-prefix smuggling, aliases and trailing bytes.
|
|
417
|
-
assertCanonicalBoundedRuntimeWriteCalldata(evm.data);
|
|
418
|
-
// A server key can safely switch between explicitly configured chains: each
|
|
419
|
-
// tx selects its own immutable viem client/RPC/runtime tuple. No untrusted
|
|
420
|
-
// server response may introduce a new chain or RPC endpoint.
|
|
421
|
-
const chain = asViemChain(config);
|
|
422
|
-
const transport = http(config.rpcUrl);
|
|
423
|
-
const wallet = createWalletClient$1({ account: this.account, chain, transport });
|
|
424
|
-
const publicClient = createPublicClient({ chain, transport });
|
|
425
|
-
// Unlike a browser wallet this provider OWNS the private key, so it prepares
|
|
426
|
-
// and signs locally with an EXPLICIT nonce and derives the hash before the
|
|
427
|
-
// transaction is ever broadcast. Learning the hash only from
|
|
428
|
-
// `sendTransaction()` discards an identifier we could have known, so an
|
|
429
|
-
// accepted-but-lost response would strand a landed write.
|
|
430
|
-
let request;
|
|
431
|
-
let signedTransaction;
|
|
432
|
-
let hash;
|
|
433
|
-
let nonce;
|
|
434
|
-
try {
|
|
435
|
-
request = await wallet.prepareTransactionRequest({
|
|
436
|
-
account: this.account,
|
|
437
|
-
chain,
|
|
438
|
-
to: config.runtimeAddress,
|
|
439
|
-
data: evm.data,
|
|
440
|
-
value: BigInt(0),
|
|
441
|
-
});
|
|
442
|
-
nonce = Number(request.nonce);
|
|
443
|
-
if (!Number.isSafeInteger(nonce) || nonce < 0)
|
|
444
|
-
throw new Error('the prepared transaction carries no usable nonce');
|
|
445
|
-
signedTransaction = await wallet.signTransaction(request);
|
|
446
|
-
hash = keccak256(signedTransaction);
|
|
447
|
-
}
|
|
448
|
-
catch (error) {
|
|
449
|
-
// Preparation and local signing happen entirely before broadcast, so any
|
|
450
|
-
// failure here is definitive.
|
|
451
|
-
throw error;
|
|
452
|
-
}
|
|
453
|
-
const fence = {
|
|
454
|
-
chainId: config.chainId,
|
|
455
|
-
sender: this.address,
|
|
456
|
-
nonce,
|
|
457
|
-
signedTransaction,
|
|
458
|
-
};
|
|
459
|
-
try {
|
|
460
|
-
await publicClient.sendRawTransaction({ serializedTransaction: signedTransaction });
|
|
461
|
-
}
|
|
462
|
-
catch (error) {
|
|
463
|
-
if (isDefinitiveEvmSendFailure(error))
|
|
464
|
-
throw error;
|
|
465
|
-
// Ambiguous transport outcome: the node may already hold these exact
|
|
466
|
-
// bytes. Report the pre-derived hash and the fence so reconciliation can
|
|
467
|
-
// poll it, or rebroadcast the byte-identical bytes while the nonce is
|
|
468
|
-
// unused — which cannot produce a second execution.
|
|
469
|
-
return {
|
|
470
|
-
outcome: 'submitted',
|
|
471
|
-
lane: 'evm',
|
|
472
|
-
transactionSignature: hash,
|
|
473
|
-
fence,
|
|
474
|
-
reason: `Broadcast response was lost or inconclusive: ${evmErrorText(error)}`,
|
|
475
|
-
};
|
|
476
|
-
}
|
|
477
|
-
let receipt;
|
|
478
|
-
try {
|
|
479
|
-
receipt = await publicClient.waitForTransactionReceipt({ hash });
|
|
480
|
-
}
|
|
481
|
-
catch (error) {
|
|
482
|
-
// The bytes were accepted; only the confirmation outcome is unknown.
|
|
483
|
-
return {
|
|
484
|
-
outcome: 'submitted',
|
|
485
|
-
lane: 'evm',
|
|
486
|
-
transactionSignature: hash,
|
|
487
|
-
fence,
|
|
488
|
-
reason: `Confirmation outcome unknown: ${evmErrorText(error)}`,
|
|
489
|
-
};
|
|
490
|
-
}
|
|
491
|
-
if (receipt.status !== 'success')
|
|
492
|
-
throw new Error(`EVM transaction ${hash} reverted on-chain`);
|
|
493
|
-
if (receipt.blockNumber > BigInt(Number.MAX_SAFE_INTEGER))
|
|
494
|
-
throw new Error('EVM receipt block number exceeds the SDK safe-integer range');
|
|
495
|
-
return {
|
|
496
|
-
outcome: 'confirmed',
|
|
497
|
-
lane: 'evm',
|
|
498
|
-
transactionSignature: hash,
|
|
499
|
-
blockNumber: Number(receipt.blockNumber),
|
|
500
|
-
gasUsed: receipt.gasUsed.toString(),
|
|
501
|
-
data: receipt,
|
|
502
|
-
};
|
|
503
|
-
}
|
|
504
|
-
/**
|
|
505
|
-
* Poll the SAME hash, and — only while the fenced nonce is still unused — put
|
|
506
|
-
* the byte-identical signed transaction back on the wire. Same nonce, same
|
|
507
|
-
* signature, so a rebroadcast can never produce a second execution.
|
|
508
|
-
*
|
|
509
|
-
* It NEVER reports a retry-safe terminal state. Nonce advancement is not proof
|
|
510
|
-
* the write did not execute: a replacement can occupy the same sender and
|
|
511
|
-
* nonce carrying identical Bounded calldata under a different hash, and plain
|
|
512
|
-
* JSON-RPC offers no transaction-by-sender-and-nonce lookup to identify it.
|
|
513
|
-
*/
|
|
514
|
-
async reconcileEvmTransaction(request) {
|
|
515
|
-
var _a, _b;
|
|
516
|
-
const chainId = (_b = (_a = request.fence) === null || _a === void 0 ? void 0 : _a.chainId) !== null && _b !== void 0 ? _b : this.defaultChainId;
|
|
517
|
-
const config = this.chains.get(chainId);
|
|
518
|
-
if (!config)
|
|
519
|
-
return { state: 'unknown', reason: `EVM chain ${chainId} is not configured for this wallet client` };
|
|
520
|
-
const chain = asViemChain(config);
|
|
521
|
-
const transport = http(config.rpcUrl);
|
|
522
|
-
const publicClient = createPublicClient({ chain, transport });
|
|
523
|
-
try {
|
|
524
|
-
const receipt = await publicClient.getTransactionReceipt({ hash: request.transactionHash });
|
|
525
|
-
if (receipt) {
|
|
526
|
-
if (receipt.status !== 'success') {
|
|
527
|
-
return { state: 'failed', reason: `EVM transaction ${request.transactionHash} reverted on-chain` };
|
|
528
|
-
}
|
|
529
|
-
if (receipt.blockNumber > BigInt(Number.MAX_SAFE_INTEGER)) {
|
|
530
|
-
return { state: 'unknown', reason: 'EVM receipt block number exceeds the SDK safe-integer range' };
|
|
531
|
-
}
|
|
532
|
-
return { state: 'confirmed', blockNumber: Number(receipt.blockNumber) };
|
|
533
|
-
}
|
|
534
|
-
}
|
|
535
|
-
catch (error) {
|
|
536
|
-
// viem throws `TransactionReceiptNotFoundError` when it is simply not
|
|
537
|
-
// mined yet; that is not an error condition, just "still unknown".
|
|
538
|
-
if (!isReceiptNotFound(error)) {
|
|
539
|
-
return { state: 'unknown', reason: `receipt lookup failed: ${evmErrorText(error)}` };
|
|
540
|
-
}
|
|
541
|
-
}
|
|
542
|
-
const fence = request.fence;
|
|
543
|
-
if (!request.allowRebroadcast || !fence) {
|
|
544
|
-
return { state: 'unknown', reason: 'no receipt yet for this transaction hash' };
|
|
545
|
-
}
|
|
546
|
-
try {
|
|
547
|
-
const nonceNow = await publicClient.getTransactionCount({ address: fence.sender, blockTag: 'latest' });
|
|
548
|
-
if (nonceNow > fence.nonce) {
|
|
549
|
-
// The nonce is spent. It may have been spent by THIS transaction under a
|
|
550
|
-
// different hash (a replacement), so this is emphatically not retry-safe.
|
|
551
|
-
return {
|
|
552
|
-
state: 'unknown',
|
|
553
|
-
reason: `nonce ${fence.nonce} on ${fence.sender} has been consumed but this hash has no receipt; ` +
|
|
554
|
-
'the transaction may have been replaced, so the write is not proven absent',
|
|
555
|
-
};
|
|
556
|
-
}
|
|
557
|
-
await publicClient.sendRawTransaction({ serializedTransaction: fence.signedTransaction });
|
|
558
|
-
return { state: 'unknown', reason: 'rebroadcast the byte-identical fenced transaction; still awaiting a receipt' };
|
|
559
|
-
}
|
|
560
|
-
catch (error) {
|
|
561
|
-
return { state: 'unknown', reason: `rebroadcast attempt was inconclusive: ${evmErrorText(error)}` };
|
|
562
|
-
}
|
|
563
|
-
}
|
|
564
|
-
async getNativeMethods() { return this.account; }
|
|
565
|
-
transactionPolicy() {
|
|
566
|
-
return {
|
|
567
|
-
runtimeAddresses: Object.fromEntries([...this.chains].map(([id, config]) => [String(id), config.runtimeAddress])),
|
|
568
|
-
};
|
|
569
|
-
}
|
|
570
253
|
}
|
|
571
254
|
|
|
572
255
|
// #023: strip caller-supplied auth headers so an operation runs as the isolated wallet, not
|
|
@@ -626,12 +309,11 @@ function jwtExpiringSoon(token) {
|
|
|
626
309
|
/* WalletClient */
|
|
627
310
|
/* ------------------------------------------------------------------ */
|
|
628
311
|
class WalletClient {
|
|
629
|
-
constructor(provider, sessionManager, address, config
|
|
312
|
+
constructor(provider, sessionManager, address, config) {
|
|
630
313
|
this.provider = provider;
|
|
631
314
|
this.sessionManager = sessionManager;
|
|
632
315
|
this.address = address;
|
|
633
316
|
this.config = config;
|
|
634
|
-
this.evmTransactionPolicy = evmTransactionPolicy;
|
|
635
317
|
this.live = {
|
|
636
318
|
intent: (roomPath, intent, opts = {}) => live$1.intent(roomPath, intent, this.mergeLiveIntentOptions(opts)),
|
|
637
319
|
// Route status through the SAME auth merge intent uses so a server-keypair
|
|
@@ -664,10 +346,12 @@ class WalletClient {
|
|
|
664
346
|
}
|
|
665
347
|
/* ---- Auth override helpers ---- */
|
|
666
348
|
buildOverrides() {
|
|
667
|
-
return
|
|
349
|
+
return {
|
|
350
|
+
authProvider: this.provider,
|
|
668
351
|
// Pin every request to this wallet client's snapshotted app + endpoints so
|
|
669
352
|
// a later global init() can never retarget its reads/writes (CTA-05).
|
|
670
|
-
_config: this.config,
|
|
353
|
+
_config: this.config,
|
|
354
|
+
_getAuthHeaders: async () => {
|
|
671
355
|
let s = await this.sessionManager.getSession();
|
|
672
356
|
// Keypair-backed session: if the cached token is expired/near-expiry,
|
|
673
357
|
// re-sign for a fresh one (we always hold the key). Keeps long-lived WS
|
|
@@ -678,9 +362,12 @@ class WalletClient {
|
|
|
678
362
|
s = await this.sessionManager.getSession();
|
|
679
363
|
}
|
|
680
364
|
return { Authorization: `Bearer ${s.idToken}` };
|
|
681
|
-
},
|
|
365
|
+
},
|
|
366
|
+
_clearAuth: async () => {
|
|
682
367
|
this.sessionManager.clearSession();
|
|
683
|
-
},
|
|
368
|
+
},
|
|
369
|
+
_walletAddress: this.address,
|
|
370
|
+
};
|
|
684
371
|
}
|
|
685
372
|
/** #023: strip caller Authorization (any casing) so operations run as the isolated wallet. */
|
|
686
373
|
sanitizeHeaders(headers) {
|
|
@@ -689,7 +376,7 @@ class WalletClient {
|
|
|
689
376
|
mergeSetOverrides(opts) {
|
|
690
377
|
var _a;
|
|
691
378
|
const ovr = this.buildOverrides();
|
|
692
|
-
return Object.assign(Object.assign({}, opts), { _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), authProvider: ovr.authProvider, _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth,
|
|
379
|
+
return Object.assign(Object.assign({}, opts), { _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), authProvider: ovr.authProvider, _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _config: ovr._config }) });
|
|
693
380
|
}
|
|
694
381
|
mergeReadOverrides(existing) {
|
|
695
382
|
const ovr = this.buildOverrides();
|
|
@@ -808,20 +495,13 @@ class WalletClient {
|
|
|
808
495
|
}
|
|
809
496
|
}
|
|
810
497
|
/**
|
|
811
|
-
* Create a self-contained wallet client bound to one Solana
|
|
498
|
+
* Create a self-contained wallet client bound to one Solana keypair.
|
|
812
499
|
* Each client has its own auth session — no global state is mutated.
|
|
813
500
|
*
|
|
814
501
|
* @example
|
|
815
502
|
* ```ts
|
|
816
503
|
* const vault = await createWalletClient({ keypair: process.env.VAULT_KEY });
|
|
817
504
|
* await vault.set('markets/123', data);
|
|
818
|
-
*
|
|
819
|
-
* const evmVault = await createWalletClient({
|
|
820
|
-
* evmPrivateKey: process.env.EVM_PRIVATE_KEY,
|
|
821
|
-
* chainId: 8453,
|
|
822
|
-
* rpcUrl: process.env.BASE_RPC_URL,
|
|
823
|
-
* runtimeAddress: process.env.BOUNDED_RUNTIME,
|
|
824
|
-
* });
|
|
825
505
|
* ```
|
|
826
506
|
*/
|
|
827
507
|
async function createWalletClient(opts) {
|
|
@@ -837,32 +517,8 @@ async function createWalletClient(opts) {
|
|
|
837
517
|
authApiUrl: config.authApiUrl,
|
|
838
518
|
authMethod: config.authMethod,
|
|
839
519
|
};
|
|
840
|
-
if ('evmPrivateKey' in opts && typeof opts.evmPrivateKey === 'string') {
|
|
841
|
-
const chainConfigs = [];
|
|
842
|
-
if (opts.chains) {
|
|
843
|
-
for (const [rawId, chain] of Object.entries(opts.chains)) {
|
|
844
|
-
const chainId = Number(rawId);
|
|
845
|
-
if (!Number.isSafeInteger(chainId) || chainId <= 0)
|
|
846
|
-
throw new Error(`Invalid EVM chain id in chains map: ${rawId}`);
|
|
847
|
-
chainConfigs.push({ chainId, rpcUrl: chain.rpcUrl, runtimeAddress: chain.runtimeAddress, name: chain.name });
|
|
848
|
-
}
|
|
849
|
-
}
|
|
850
|
-
if (opts.rpcUrl !== undefined || opts.runtimeAddress !== undefined) {
|
|
851
|
-
if (!opts.rpcUrl || !opts.runtimeAddress)
|
|
852
|
-
throw new Error('Single-chain EVM clients require both rpcUrl and runtimeAddress');
|
|
853
|
-
if (chainConfigs.some((chain) => chain.chainId === opts.chainId))
|
|
854
|
-
throw new Error(`EVM chain ${opts.chainId} is configured twice`);
|
|
855
|
-
chainConfigs.push({ chainId: opts.chainId, rpcUrl: opts.rpcUrl, runtimeAddress: opts.runtimeAddress });
|
|
856
|
-
}
|
|
857
|
-
if (chainConfigs.length === 0)
|
|
858
|
-
throw new Error('EVM wallet clients require an explicit RPC URL and BoundedRuntime address');
|
|
859
|
-
const provider = new EvmKeypairProvider(opts.evmPrivateKey, opts.chainId, chainConfigs);
|
|
860
|
-
const sessionManager = ServerSessionManager.forSessionFactory(() => provider.createBoundedSession(sessionConfig));
|
|
861
|
-
await sessionManager.getSession();
|
|
862
|
-
return new WalletClient(provider, sessionManager, provider.address, config, provider.transactionPolicy());
|
|
863
|
-
}
|
|
864
520
|
if (!('keypair' in opts) || typeof opts.keypair !== 'string') {
|
|
865
|
-
throw new Error('createWalletClient requires
|
|
521
|
+
throw new Error('createWalletClient requires a Solana keypair');
|
|
866
522
|
}
|
|
867
523
|
const kp = parseKeypair(opts.keypair);
|
|
868
524
|
let provider = new SolanaKeypairProvider((_a = config.rpcUrl) !== null && _a !== void 0 ? _a : null, kp);
|
|
@@ -1200,5 +856,5 @@ async function verifyWebhook(rawBody, headers, opts = {}) {
|
|
|
1200
856
|
return payload;
|
|
1201
857
|
}
|
|
1202
858
|
|
|
1203
|
-
export { DEFAULT_WEBHOOK_KEYS_URL,
|
|
859
|
+
export { DEFAULT_WEBHOOK_KEYS_URL, InMemoryReplayStore, WalletClient, WebhookVerificationError, aggregate, clearWebhookKeyCache, clearWebhookReplayCache, count, createWalletClient, functions, get, getAuthProvider, getFiles, getIdToken, getMany, init, invokeFunction, live, liveIntent, liveStatus, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe, verifyWebhook };
|
|
1204
860
|
//# sourceMappingURL=index.mjs.map
|