@openzeppelin/miden-multisig-client 0.18.0-rc.1 → 0.18.0-rc.3

package/dist/multisig.js

@@ -7,7 +7,7 @@
 import { GuardianHttpClient } from '@openzeppelin/guardian-client';
 import { ProposalSaltMalformedError } from './multisig/authArgErrors.js';
 import { Account, AccountId, AdviceMap, FeltArray, Note, NoteExportFormat, NoteFile, Signature, TransactionRequest, TransactionSummary, Word, } from '@miden-sdk/miden-sdk';
-import { chainAnchorFromBase64, chainAnchorToBase64, executeForSummary, executeForSummaryAt, summaryApprovalExpirationBlockNum, summarySalt, buildUpdateSignersTransactionRequest, buildUpdateProcedureThresholdTransactionRequest, buildUpdateGuardianTransactionRequest, buildConsumeNotesTransactionRequest, buildP2idNoteFromMetadata, buildP2idTransactionRequest, parseP2idNoteType, p2idNoteTypeToMetadata, } from './transaction.js';
+import { chainAnchorFromBase64, chainAnchorToBase64, executeForSummary, executeForSummaryAtTip, isStaleChainError, prepareTipExecution, syncToBoundBlock, summaryApprovalExpirationBlockNum, summarySalt, buildUpdateSignersTransactionRequest, buildUpdateProcedureThresholdTransactionRequest, buildUpdateGuardianTransactionRequest, buildConsumeNotesTransactionRequest, buildP2idNoteFromMetadata, buildP2idTransactionRequest, parseP2idNoteType, p2idNoteTypeToMetadata, } from './transaction.js';
 import { buildConsumeNotesTransactionRequestFromNotes } from './transaction/consumeNotes.js';
 import { validateMultisigConfig } from './account/builder.js';
 import { ensureNotesAuthenticated } from './transaction/noteAuthentication.js';
@@ -27,7 +27,7 @@ import { importNotesFromProposals as importNotesFromProposalsStandalone, throwIf
 import { backfillPublicNotesByTag as backfillPublicNotesByTagStandalone, } from './recovery/publicNoteBackfill.js';
 import { drainPrivateNoteBacklog } from './recovery/transportDrain.js';
 import { GUARDIAN_SWITCH_RECOVERY_OPTIONS, runNoteRecovery, } from './recovery/recoverNotes.js';
-import { getRawMidenClient, getTransactionProver, requireMidenRpcEndpoint, } from './raw-client.js';
+import { requireMidenRpcEndpoint } from './config.js';
 import { resolveProverConfig, } from './prover/config.js';
 import { ProverWorkflow } from './prover/workflow.js';
 import { resolveRpcConfig, } from './rpc/config.js';
@@ -141,7 +141,6 @@ export class Multisig {
     guardian;
     signer;
     midenClient;
-    rawClientPromise;
     proverWorkflow;
     rpcConfig;
     _accountId;
@@ -177,16 +176,12 @@ export class Multisig {
         this.midenClient = midenClient;
         this._accountId = accountId ?? (account ? accountIdToHex(account) : '');
         this.midenRpcEndpoint = requireMidenRpcEndpoint(midenRpcEndpoint);
-        this.rawClientPromise = getRawMidenClient(midenClient, this.midenRpcEndpoint);
-        this.proverWorkflow = new ProverWorkflow(this.midenClient, proverConfig ?? resolveProverConfig(undefined, getTransactionProver(midenClient)));
+        this.proverWorkflow = new ProverWorkflow(this.midenClient, proverConfig ?? resolveProverConfig(undefined, midenClient.defaultProver));
         this.rpcConfig = rpcConfig ?? resolveRpcConfig(undefined);
     }
     getMidenRpcEndpoint() {
         return this.midenRpcEndpoint;
     }
-    async getRawClient() {
-        return this.rawClientPromise;
-    }
     proposalFactory() {
         return new ProposalFactory({
             accountId: this._accountId,
@@ -215,7 +210,7 @@ export class Multisig {
         return this.signer.commitment;
     }
     /**
-     * Resolve the account from the web client's store, falling back to the
+     * Resolve the account from the Miden client's store, falling back to the
      * `account` snapshot when the store has no record.
      *
      * Transaction execution reads the store, and other flows (e.g. consume-notes
@@ -223,9 +218,10 @@ export class Multisig {
      * source from the store to see the same state execution will.
      */
     async getStoreAccount() {
-        const webClient = await this.getRawClient();
-        const stored = await retryRpcRead(() => webClient.getAccount(AccountId.fromHex(this._accountId)), this.rpcConfig);
-        return stored ?? this.account;
+        return (await this.readStoreAccount()) ?? this.account;
+    }
+    readStoreAccount() {
+        return retryRpcRead(() => this.midenClient.accounts.get(this._accountId), this.rpcConfig);
     }
     /**
      * Read the current ordered signer public-key commitments from account
@@ -375,9 +371,16 @@ export class Multisig {
     /**
      * Sync account state from GUARDIAN into the local Miden client store.
      *
-     * If the GUARDIAN commitment differs from the local commitment (or the account
-     * is missing locally) and the GUARDIAN state is safe to import, the local store
-     * is overwritten with the GUARDIAN state. When the GUARDIAN is merely *behind*
+     * Starts with the canonical-nonce pre-check (OpenZeppelin/guardian#191):
+     * GUARDIAN reports the nonce and commitment of its canonical state, and
+     * when that nonce is not above the local account's — at a matching
+     * commitment when equal — nothing newer exists to pull, so the state
+     * fetch is skipped and the local account stands (`source: 'local'`).
+     *
+     * Otherwise the state is fetched (`source: 'guardian'`). If the GUARDIAN
+     * commitment differs from the local commitment (or the account is missing
+     * locally) and the GUARDIAN state is safe to import, the local store is
+     * overwritten with the GUARDIAN state. When the GUARDIAN is merely *behind*
      * local — e.g. the pushed execution delta has not been canonicalized yet
      * (see OpenZeppelin/guardian#316) — the local state is already ahead and
      * on-chain-verifiable, so it is kept as authoritative. Either way, config is
@@ -385,11 +388,18 @@ export class Multisig {
      * (e.g. the UI) observe the current state instead of a stale snapshot.
      */
     async syncState() {
+        const localAccount = await this.readStoreAccount();
+        if (localAccount) {
+            const head = await this.guardian.getCanonicalNonce(this._accountId);
+            const localNonce = localAccount.nonce().asInt();
+            const guardianNonce = BigInt(head.nonce);
+            if (this.guardianIsNotAhead(localAccount, localNonce, head.commitment, guardianNonce)) {
+                this.refreshConfigFromAccount(localAccount);
+                return { source: 'local', localNonce, guardianNonce };
+            }
+        }
         const state = await this.fetchState();
-        const accountId = AccountId.fromHex(this._accountId);
-        const webClient = await this.getRawClient();
-        const localAccount = await retryRpcRead(() => webClient.getAccount(accountId), this.rpcConfig);
-        let accountForConfigRefresh = localAccount ?? null;
+        let accountForConfigRefresh = localAccount;
         const guardianCommitment = normalizeHexWord(state.commitment);
         const localCommitment = localAccount
             ? normalizeHexWord(localAccount.to_commitment().toHex())
@@ -397,18 +407,33 @@ export class Multisig {
         if (!localAccount || localCommitment !== guardianCommitment) {
             const accountBytes = base64ToUint8Array(state.stateDataBase64);
             const incomingAccount = Account.deserialize(accountBytes);
-            if (await this.isSafeToOverwriteLocalState(incomingAccount, localAccount)) {
-                await webClient.newAccount(incomingAccount, true);
+            if (await this.isSafeToOverwriteLocalState(incomingAccount, localAccount ?? undefined)) {
+                await this.midenClient.accounts.insert({ account: incomingAccount, overwrite: true });
                 accountForConfigRefresh = incomingAccount;
             }
         }
         this.refreshConfigFromAccount(accountForConfigRefresh);
-        return state;
+        return { source: 'guardian', state };
+    }
+    /**
+     * The pre-check decision: GUARDIAN has nothing newer when its canonical
+     * nonce is below the local nonce, or equal to it at the same commitment.
+     * An equal nonce with a different commitment is divergence, which the
+     * full fetch reports (see `isSafeToOverwriteLocalState`).
+     */
+    guardianIsNotAhead(localAccount, localNonce, guardianCommitment, guardianNonce) {
+        if (guardianNonce < localNonce) {
+            return true;
+        }
+        if (guardianNonce > localNonce) {
+            return false;
+        }
+        return (normalizeHexWord(guardianCommitment) ===
+            normalizeHexWord(localAccount.to_commitment().toHex()));
     }
     async verifyStateCommitment() {
         const accountId = AccountId.fromHex(this._accountId);
-        const webClient = await this.getRawClient();
-        const localAccount = await retryRpcRead(() => webClient.getAccount(accountId), this.rpcConfig);
+        const localAccount = await this.readStoreAccount();
         if (!localAccount) {
             throw new Error(`Local account state not found for account ${this._accountId}. Sync the account before verifying.`);
         }
@@ -464,11 +489,10 @@ export class Multisig {
      * fail.
      */
     async syncNetworkOnly() {
-        const webClient = await this.getRawClient();
-        await retryRpcRead(() => webClient.syncState(), this.rpcConfig);
-        const account = await retryRpcRead(() => webClient.getAccount(AccountId.fromHex(this._accountId)), this.rpcConfig);
-        this.refreshConfigFromAccount(account ?? null);
-        return account ?? null;
+        await this.syncChain();
+        const account = await this.readStoreAccount();
+        this.refreshConfigFromAccount(account);
+        return account;
     }
     refreshConfigFromAccount(account) {
         if (!account) {
@@ -539,11 +563,12 @@ export class Multisig {
      * Every synced proposal's metadata is checked against its signed summary
      * and the outcome is recorded in {@link Proposal.verification}. One that
      * fails is still cached and returned, so a single stale or corrupt
-     * proposal cannot hide the others (issue #462: once the node prunes a
-     * proposal's anchor block its re-execution fails for everyone). `failed`
-     * with `retryable: true` means a transient node error, worth syncing
-     * again; `retryable: false` means the proposal cannot be reproduced and
-     * must be re-proposed. `signProposal` and `executeProposal` re-verify and
+     * proposal cannot hide the others (issue #462). Verification re-executes
+     * each proposal at the chain tip, so the Miden client is synced once first.
+     * `failed` with `retryable: true` means a transient node error or chain
+     * state this client had not caught up with, worth syncing again;
+     * `retryable: false` means the proposal cannot be reproduced and must be
+     * re-proposed. `signProposal` and `executeProposal` re-verify and
      * refuse a failed proposal. A failed proposal still counts as reported, so
      * it is pruned like any other once GUARDIAN stops listing it.
      *
@@ -581,6 +606,12 @@ export class Multisig {
         const deltas = await this.guardian.getDeltaProposals(this._accountId);
         const factory = this.proposalFactory();
         const reported = new Map();
+        if (deltas.length > 0) {
+            // Verification re-executes at the store's sync height; bring it to the
+            // tip once for the whole listing. Best effort: a node outage then shows
+            // up on each proposal as a retryable failure instead of failing the sync.
+            await this.syncChain().catch((error) => console.warn('Could not sync the Miden client before verifying proposals', error));
+        }
         for (const delta of deltas) {
             const proposalId = normalizeHexWord(computeCommitmentFromTxSummary(delta.deltaPayload.txSummary.data));
             const existingProposal = this.proposals.get(proposalId);
@@ -729,7 +760,6 @@ export class Multisig {
      */
     async createAddSignerProposal(newCommitment, options = {}, ...legacyArgs) {
         const proposalNonce = resolveProposalNonce('createAddSignerProposal', options, legacyArgs);
-        const webClient = await this.getRawClient();
         const targetThreshold = options.newThreshold ?? this.threshold;
         const targetSignerCommitments = [...this.signerCommitments, newCommitment];
         // What `update_signers_and_threshold` rejects on-chain, and what the auth
@@ -741,8 +771,8 @@ export class Multisig {
             guardianCommitment: this.guardianCommitment,
         });
         this.warnOnOverrideDilution(targetSignerCommitments.length);
-        const { request, salt } = await buildUpdateSignersTransactionRequest(webClient, targetThreshold, targetSignerCommitments, this.proposalRequestOptions(options));
-        const { summary, anchor } = await executeForSummary(webClient, this._accountId, request);
+        const { request, salt } = await buildUpdateSignersTransactionRequest(this.midenClient, targetThreshold, targetSignerCommitments, this.proposalRequestOptions(options));
+        const { summary, anchor } = await executeForSummary(this.midenClient, this._accountId, request);
         const chainAnchor = chainAnchorToBase64(anchor);
         anchor.free();
         const summaryBase64 = uint8ArrayToBase64(summary.serialize());
@@ -766,7 +796,6 @@ export class Multisig {
      */
     async createRemoveSignerProposal(signerToRemove, options = {}, ...legacyArgs) {
         const proposalNonce = resolveProposalNonce('createRemoveSignerProposal', options, legacyArgs);
-        const webClient = await this.getRawClient();
         const normalizedRemove = signerToRemove.toLowerCase();
         const targetSignerCommitments = this.signerCommitments.filter((c) => c.toLowerCase() !== normalizedRemove);
         if (targetSignerCommitments.length === this.signerCommitments.length) {
@@ -779,8 +808,8 @@ export class Multisig {
         if (targetThreshold < 1 || targetThreshold > targetSignerCommitments.length) {
             throw new Error(`Invalid threshold ${targetThreshold}. Must be between 1 and ${targetSignerCommitments.length}`);
         }
-        const { request, salt } = await buildUpdateSignersTransactionRequest(webClient, targetThreshold, targetSignerCommitments, this.proposalRequestOptions(options));
-        const { summary, anchor } = await executeForSummary(webClient, this._accountId, request);
+        const { request, salt } = await buildUpdateSignersTransactionRequest(this.midenClient, targetThreshold, targetSignerCommitments, this.proposalRequestOptions(options));
+        const { summary, anchor } = await executeForSummary(this.midenClient, this._accountId, request);
         const chainAnchor = chainAnchorToBase64(anchor);
         anchor.free();
         const summaryBase64 = uint8ArrayToBase64(summary.serialize());
@@ -803,15 +832,14 @@ export class Multisig {
      */
     async createChangeThresholdProposal(newThreshold, options = {}) {
         const proposalNonce = resolveProposalNonce('createChangeThresholdProposal', options);
-        const webClient = await this.getRawClient();
         if (newThreshold < 1 || newThreshold > this.signerCommitments.length) {
             throw new Error(`Invalid threshold ${newThreshold}. Must be between 1 and ${this.signerCommitments.length}`);
         }
         if (newThreshold === this.threshold) {
             throw new Error('New threshold is the same as current threshold');
         }
-        const { request, salt } = await buildUpdateSignersTransactionRequest(webClient, newThreshold, this.signerCommitments, this.proposalRequestOptions(options));
-        const { summary, anchor } = await executeForSummary(webClient, this._accountId, request);
+        const { request, salt } = await buildUpdateSignersTransactionRequest(this.midenClient, newThreshold, this.signerCommitments, this.proposalRequestOptions(options));
+        const { summary, anchor } = await executeForSummary(this.midenClient, this._accountId, request);
         const chainAnchor = chainAnchorToBase64(anchor);
         anchor.free();
         const summaryBase64 = uint8ArrayToBase64(summary.serialize());
@@ -828,7 +856,6 @@ export class Multisig {
     }
     async createUpdateProcedureThresholdProposal(targetProcedure, targetThreshold, options = {}) {
         const proposalNonce = resolveProposalNonce('createUpdateProcedureThresholdProposal', options);
-        const webClient = await this.getRawClient();
         if (targetThreshold < 0 || targetThreshold > this.signerCommitments.length) {
             throw new Error(`Invalid threshold ${targetThreshold}. Must be between 0 and ${this.signerCommitments.length}`);
         }
@@ -839,8 +866,8 @@ export class Multisig {
         if (currentOverride !== undefined && currentOverride === targetThreshold) {
             throw new Error(`Procedure ${targetProcedure} already has threshold override ${targetThreshold}`);
         }
-        const { request, salt } = await buildUpdateProcedureThresholdTransactionRequest(webClient, targetProcedure, targetThreshold, this.proposalRequestOptions(options));
-        const { summary, anchor } = await executeForSummary(webClient, this._accountId, request);
+        const { request, salt } = await buildUpdateProcedureThresholdTransactionRequest(this.midenClient, targetProcedure, targetThreshold, this.proposalRequestOptions(options));
+        const { summary, anchor } = await executeForSummary(this.midenClient, this._accountId, request);
         const chainAnchor = chainAnchorToBase64(anchor);
         anchor.free();
         const summaryBase64 = uint8ArrayToBase64(summary.serialize());
@@ -880,7 +907,6 @@ export class Multisig {
      * proposals for the same operation can never drift apart.
      */
     async buildSwitchGuardianSummary(newGuardianEndpoint, newGuardianPubkey, approvalExpirationDelta) {
-        const webClient = await this.getRawClient();
         // What `auth_tx_guarded_multisig` asserts after a guardian rotation, checked
         // before any signature is collected.
         validateMultisigConfig({
@@ -889,12 +915,12 @@ export class Multisig {
             guardianCommitment: newGuardianPubkey,
         });
         await this.verifyGuardianEndpointCommitment(newGuardianEndpoint, newGuardianPubkey);
-        const { request, salt } = await buildUpdateGuardianTransactionRequest(webClient, newGuardianPubkey, {
+        const { request, salt } = await buildUpdateGuardianTransactionRequest(this.midenClient, newGuardianPubkey, {
             accountId: this._accountId,
             approvalExpirationDelta,
             signatureScheme: this.signer.scheme,
         });
-        const { summary, anchor } = await executeForSummary(webClient, this._accountId, request);
+        const { summary, anchor } = await executeForSummary(this.midenClient, this._accountId, request);
         const chainAnchor = chainAnchorToBase64(anchor);
         anchor.free();
         const summaryBase64 = uint8ArrayToBase64(summary.serialize());
@@ -966,15 +992,13 @@ export class Multisig {
      */
     async createConsumeNotesProposal(noteIds, options = {}) {
         const proposalNonce = resolveProposalNonce('createConsumeNotesProposal', options);
-        const webClient = await this.getRawClient();
         if (noteIds.length === 0) {
             throw new Error('At least one note ID is required');
         }
         // Fetch notes locally (proposer has them per FR-012); embed for v2 verification.
-        const rawClient = await getRawMidenClient(webClient);
         const fetchedNotes = [];
         for (const noteIdHex of noteIds) {
-            const inputNoteRecord = await rawClient.getInputNote(noteIdHex);
+            const inputNoteRecord = await this.midenClient.notes.get(noteIdHex);
             if (!inputNoteRecord) {
                 throw new LegacyConsumeNotesNoteMissingError(noteIdHex);
             }
@@ -985,8 +1009,8 @@ export class Multisig {
         // the notes are authenticated here first, before the anchor is captured.
         await this.ensureNotesAuthenticated(fetchedNotes);
         const embeddedNotes = fetchedNotes.map((n) => noteToBase64(n));
-        const { request, salt } = await buildConsumeNotesTransactionRequestFromNotes(webClient, fetchedNotes, this.proposalRequestOptions(options));
-        const { summary, anchor } = await executeForSummary(webClient, this._accountId, request);
+        const { request, salt } = await buildConsumeNotesTransactionRequestFromNotes(this.midenClient, fetchedNotes, this.proposalRequestOptions(options));
+        const { summary, anchor } = await executeForSummary(this.midenClient, this._accountId, request);
         const chainAnchor = chainAnchorToBase64(anchor);
         anchor.free();
         const summaryBase64 = uint8ArrayToBase64(summary.serialize());
@@ -1023,15 +1047,14 @@ export class Multisig {
      */
     async createP2idProposal(recipientId, faucetId, amount, options = {}, ...legacyArgs) {
         const proposalNonce = resolveProposalNonce('createP2idProposal', options, legacyArgs);
-        const webClient = await this.getRawClient();
         if (amount <= 0n) {
             throw new Error('Amount must be greater than 0');
         }
         // Forward everything but the nonce, so a note option added to
         // CreateP2idProposalOptions can't be silently dropped before the builder.
         const { nonce: _nonce, ...noteOptions } = options;
-        const { request, salt } = await buildP2idTransactionRequest(webClient, this._accountId, recipientId, faucetId, amount, noteOptions);
-        const { summary, anchor } = await executeForSummary(webClient, this._accountId, request);
+        const { request, salt } = await buildP2idTransactionRequest(this.midenClient, this._accountId, recipientId, faucetId, amount, noteOptions);
+        const { summary, anchor } = await executeForSummary(this.midenClient, this._accountId, request);
         const chainAnchor = chainAnchorToBase64(anchor);
         anchor.free();
         const summaryBase64 = uint8ArrayToBase64(summary.serialize());
@@ -1055,41 +1078,24 @@ export class Multisig {
     /**
      * Get notes that can be consumed by this multisig account.
      *
-     * Returns a list of notes that are committed on-chain and can be consumed
-     * immediately by the multisig account.
+     * Returns the notes the Miden client's last sync screened as consumable by
+     * this account right now; block-locked notes are left out.
      */
     async getConsumableNotes() {
-        const accountId = AccountId.fromHex(this._accountId);
-        const webClient = await this.getRawClient();
-        // Get consumable notes for this account
-        const consumableRecords = await webClient.getConsumableNotes(accountId);
-        // Convert to our simplified ConsumableNote type
+        const records = await this.midenClient.notes.listAvailable({ account: this._accountId });
         const notes = [];
-        for (const record of consumableRecords) {
-            const inputNote = record.inputNoteRecord();
-            const consumability = record.noteConsumability();
-            // Only include notes that can be consumed now (consumableAfterBlock is undefined/null)
-            const canConsumeNow = consumability.some((c) => c.accountId().toString().toLowerCase() === this._accountId.toLowerCase() &&
-                c.consumptionStatus().consumableAfterBlock() === undefined);
-            if (canConsumeNow) {
-                // Miden 0.15: InputNoteRecord.id() is `NoteId | undefined`; skip id-less records.
-                const id = inputNote.id();
-                if (id === undefined) {
-                    continue;
-                }
-                const noteId = id.toString();
-                const details = inputNote.details();
-                const fungibleAssets = details.assets().fungibleAssets();
-                // Extract assets
-                const assets = [];
-                for (const asset of fungibleAssets) {
-                    assets.push({
-                        faucetId: asset.faucetId().toString(),
-                        amount: asset.amount(),
-                    });
-                }
-                notes.push({ id: noteId, assets });
+        for (const inputNote of records) {
+            // Miden 0.15: InputNoteRecord.id() is `NoteId | undefined`; skip id-less records.
+            const id = inputNote.id();
+            if (id === undefined) {
+                continue;
             }
+            const assets = inputNote
+                .details()
+                .assets()
+                .fungibleAssets()
+                .map((asset) => ({ faucetId: asset.faucetId().toString(), amount: asset.amount() }));
+            notes.push({ id: id.toString(), assets });
         }
         return notes;
     }
@@ -1111,11 +1117,10 @@ export class Multisig {
      * @returns Serialized note file bytes
      */
     async exportNoteToBytes(noteId) {
-        const webClient = await this.getRawClient();
         const trimmedNoteId = noteId.trim();
         let record;
         try {
-            record = await webClient.getOutputNote(trimmedNoteId);
+            [record] = await this.midenClient.notes.listSent({ ids: [trimmedNoteId] });
         }
         catch (err) {
             const detail = err instanceof Error ? err.message : String(err);
@@ -1127,7 +1132,7 @@ export class Multisig {
         const format = record.inclusionProof()
             ? NoteExportFormat.Full
             : NoteExportFormat.Details;
-        const noteFile = await webClient.exportNoteFile(trimmedNoteId, format);
+        const noteFile = await this.midenClient.notes.export(trimmedNoteId, { format });
         return noteFile.serialize();
     }
     /**
@@ -1171,7 +1176,6 @@ export class Multisig {
      *   commitment for a details-only file
      */
     async importNoteFromBytes(noteBytes) {
-        const webClient = await this.getRawClient();
         let noteFile;
         try {
             noteFile = NoteFile.deserialize(noteBytes);
@@ -1180,7 +1184,7 @@ export class Multisig {
             const detail = err instanceof Error ? err.message : String(err);
             throw new Error(`failed to decode note file: ${detail}`);
         }
-        return webClient.importNoteFile(noteFile);
+        return this.midenClient.notes.import(noteFile);
     }
     /**
      * Import a note file received out-of-band from a browser
@@ -1464,6 +1468,8 @@ export class Multisig {
     }
     async signProposal(proposalId) {
         const normalizedProposalId = normalizeHexWord(proposalId);
+        // Verification re-executes the proposal at the store's sync height.
+        await this.syncChain();
         const existingProposal = await this.getProposalForSigning(proposalId, normalizedProposalId);
         if (!existingProposal) {
             throw new Error(`Proposal not found: ${proposalId}`);
@@ -1492,9 +1498,14 @@ export class Multisig {
         await this.syncProposals();
         return this.proposals.get(proposalId) ?? this.proposals.get(normalizedProposalId);
     }
+    /**
+     * Builds the final, fully signed request for a ready proposal, for a caller
+     * that proves and submits it with its own pipeline. The request declares the
+     * block its summary binds, so execute it at the chain tip, without an
+     * anchor, on a client synced to at least that block.
+     */
     async createTransactionProposalRequest(proposalId) {
-        const { finalRequest, anchor } = await this.prepareProposalExecution(proposalId);
-        anchor.free();
+        const { finalRequest } = await this.prepareProposalExecution(proposalId);
         return finalRequest;
     }
     /**
@@ -1503,22 +1514,16 @@ export class Multisig {
      * @param proposalId - The proposal commitment/ID
      */
     async executeProposal(proposalId) {
-        const { metadata, finalRequest, proposal, anchor } = await this.prepareProposalExecution(proposalId);
-        try {
-            if (metadata.proposalType === 'switch_guardian') {
-                // #417: import notes embedded in pending proposals from the old
-                // GUARDIAN. Must run before the switch executes and repoints;
-                // best-effort and bounded — see preservePreSwitchProposalNotes.
-                await this.preservePreSwitchProposalNotes();
-            }
-            // Execute at the proposal's anchored reference block, so the summary the
-            // cosigners signed reproduces exactly. The anchor was already checked
-            // against the summary's block commitment during binding verification.
-            await this.proverWorkflow.submitAt(AccountId.fromHex(this._accountId), finalRequest, anchor);
-        }
-        finally {
-            anchor.free();
-        }
+        const { metadata, finalRequest, proposal } = await this.prepareProposalExecution(proposalId);
+        if (metadata.proposalType === 'switch_guardian') {
+            // #417: import notes embedded in pending proposals from the old
+            // GUARDIAN. Must run before the switch executes and repoints;
+            // best-effort and bounded — see preservePreSwitchProposalNotes.
+            await this.preservePreSwitchProposalNotes();
+        }
+        // Execute at the chain tip. The request declares the block the signed
+        // summary binds, so the summary the cosigners signed reproduces there.
+        await this.submitAtTip(finalRequest);
         if (metadata.proposalType === 'switch_guardian') {
             if (!metadata.newGuardianEndpoint || !metadata.newGuardianPubkey) {
                 throw new Error('Switch GUARDIAN proposal metadata is incomplete after execution');
@@ -1564,11 +1569,12 @@ export class Multisig {
      * Submit an integration-built transaction (advice already injected). Mirrors
      * the Rust `submit_transaction`; used by the custom proposal producer flow
      * after `prepareCustomExecution` rebuilds its request with the returned advice.
-     * The transaction is executed at the proposal's anchored reference block,
-     * since the collected signatures only authorize the summary produced there.
+     * The transaction is executed at the chain tip, so the request has to declare
+     * the block its auth args bind (`feeAwareTransactionRequestBuilder` does).
      */
     async submitTransaction(proposalId, request) {
         const normalizedProposalId = normalizeHexWord(proposalId);
+        await this.syncChain();
         const delta = await this.guardian.getDeltaProposal(this._accountId, normalizedProposalId);
         const existing = this.getLocalProposal(proposalId);
         const proposal = this.proposalFactory().fromDelta(delta, normalizedProposalId, existing?.metadata, existing?.signatures ?? []);
@@ -1580,11 +1586,31 @@ export class Multisig {
             if (anchorCommitment !== summaryBlockCommitment) {
                 throw new Error(`Proposal ${proposalId} chain anchor does not match the block commitment bound into its tx_summary`);
             }
-            await this.proverWorkflow.submitAt(AccountId.fromHex(this._accountId), request, anchor);
         }
         finally {
             anchor.free();
         }
+        await this.submitAtTip(request);
+    }
+    /**
+     * Executes `request` at the chain tip, then proves, submits and applies it,
+     * syncing first when this client is still below the block the request binds.
+     */
+    async submitAtTip(request) {
+        await prepareTipExecution(this.midenClient, request, () => this.syncChain());
+        await this.proverWorkflow.submit(AccountId.fromHex(this._accountId), request);
+    }
+    /**
+     * Brings the Miden client to the chain tip before a proposal is re-executed:
+     * an execution loads foreign accounts, the fee faucet among them, at the
+     * store's sync height, which a node prunes about 50 blocks later.
+     */
+    async syncChain() {
+        await retryRpcRead(() => this.midenClient.syncChain(), this.rpcConfig);
+    }
+    /** {@link syncToBoundBlock} with this client's RPC retry policy. */
+    async syncToBoundBlock(boundBlockNum) {
+        await syncToBoundBlock(this.midenClient, boundBlockNum, () => this.syncChain());
     }
     /**
      * Create a proposal from a producer-built transaction the SDK does not model.
@@ -1605,9 +1631,8 @@ export class Multisig {
         if (BUILTIN_PROPOSAL_TYPES.has(label)) {
             throw new Error(`'${label}' is a built-in proposal type; use the typed proposal API instead`);
         }
-        const webClient = await this.getRawClient();
         const request = deserializeTransactionRequest(transactionRequestBytes);
-        const { summary, anchor } = await executeForSummary(webClient, this._accountId, request);
+        const { summary, anchor } = await executeForSummary(this.midenClient, this._accountId, request);
         const chainAnchor = chainAnchorToBase64(anchor);
         anchor.free();
         const summaryBase64 = uint8ArrayToBase64(summary.serialize());
@@ -1632,6 +1657,8 @@ export class Multisig {
      */
     async prepareCustomExecution(proposalId, transactionRequestBytes) {
         const normalizedProposalId = normalizeHexWord(proposalId);
+        // The binding probe re-executes the producer's request at the store's sync height.
+        await this.syncChain();
         const delta = await this.guardian.getDeltaProposal(this._accountId, normalizedProposalId);
         const existing = this.getLocalProposal(proposalId);
         const proposal = this.proposalFactory().fromDelta(delta, normalizedProposalId, existing?.metadata, existing?.signatures ?? []);
@@ -1646,26 +1673,23 @@ export class Multisig {
         const txSummary = TransactionSummary.deserialize(base64ToUint8Array(delta.deltaPayload.txSummary.data));
         const signedCommitmentHex = normalizeHexWord(txSummary.toCommitment().toHex());
         const bindingRequest = deserializeTransactionRequest(transactionRequestBytes);
-        // Probe at the proposal's anchored reference block: the signed summary
-        // binds that block's commitment, so probing at the local sync height would
-        // never reproduce it. The anchor arrives from an untrusted party via
-        // GUARDIAN, so its block commitment is checked against the signed summary
-        // before executing against it.
+        // The anchor arrives from an untrusted party via GUARDIAN, so its block
+        // commitment is checked against the signed summary: it has to name the
+        // block the summary binds. The probe itself runs at the chain tip, where
+        // the request's declared bound block reproduces the signed summary.
         const anchor = this.requireProposalAnchor(proposalId, proposal.metadata);
-        let derivedCommitmentHex;
         try {
             const anchorCommitment = normalizeHexWord(anchor.commitment().toHex());
             const summaryBlockCommitment = normalizeHexWord(txSummary.blockCommitment().toHex());
             if (anchorCommitment !== summaryBlockCommitment) {
                 throw new Error(`Custom proposal ${proposalId} chain anchor does not match the block commitment bound into its tx_summary`);
             }
-            const webClient = await this.getRawClient();
-            const derived = await executeForSummaryAt(webClient, this._accountId, bindingRequest, anchor);
-            derivedCommitmentHex = normalizeHexWord(derived.toCommitment().toHex());
         }
         finally {
             anchor.free();
         }
+        const derived = await executeForSummaryAtTip(this.midenClient, this._accountId, bindingRequest);
+        const derivedCommitmentHex = normalizeHexWord(derived.toCommitment().toHex());
         if (derivedCommitmentHex !== signedCommitmentHex) {
             throw new Error(`Custom proposal binding mismatch: expected ${signedCommitmentHex}, got ${derivedCommitmentHex}`);
         }
@@ -1753,8 +1777,8 @@ export class Multisig {
         return this.proposals.get(proposalId) ?? this.proposals.get(normalizedProposalId);
     }
     /**
-     * The returned `anchor` is the block the request has to execute at; the
-     * caller owns it and frees it once submitted.
+     * The returned request declares the block the signed summary binds, and
+     * executes at the chain tip.
      */
     async prepareProposalExecution(proposalId) {
         const proposal = this.getLocalProposal(proposalId);
@@ -1762,6 +1786,8 @@ export class Multisig {
             throw new Error(`Proposal not found: ${proposalId}`);
         }
         this.proposalFactory().assertAccountId(proposal.accountId);
+        // Verification and execution run at the store's sync height.
+        await this.syncChain();
         await this.verifyProposalMetadataBinding(proposal);
         const metadata = proposal.metadata;
         // Reject custom proposals before any advice assembly or GUARDIAN ack push:
@@ -1873,14 +1899,18 @@ export class Multisig {
             await this.verifyGuardianEndpointCommitment(metadata.newGuardianEndpoint, metadata.newGuardianPubkey);
         }
         const anchor = this.requireProposalAnchor(proposalId, metadata);
+        let binding;
         try {
-            const finalRequest = await this.buildTransactionRequestFromMetadata(metadata, proposalRequestBinding(txSummary, anchor, saltHex), adviceMap);
-            return { finalRequest, metadata, proposal, anchor };
+            binding = proposalRequestBinding(txSummary, anchor, saltHex);
         }
-        catch (error) {
+        finally {
             anchor.free();
-            throw error;
         }
+        // A switch_guardian proposal is verified without a rebuild, so this may be
+        // the first time this client needs the chain at the bound block.
+        await this.syncToBoundBlock(binding.boundBlockNum);
+        const finalRequest = await this.buildTransactionRequestFromMetadata(metadata, binding, adviceMap);
+        return { finalRequest, metadata, proposal };
     }
     /**
      * Export a proposal for offline signing
@@ -1950,6 +1980,10 @@ export class Multisig {
             throw new Error('Invalid proposal JSON: missing required fields');
         }
         const proposal = this.proposalFactory().fromExported(exported);
+        // Verification re-executes every built-in type at the store's sync height.
+        if (proposal.metadata.proposalType !== 'custom') {
+            await this.syncChain();
+        }
         await this.verifyProposalMetadataBinding(proposal);
         this.proposals.set(proposal.id, proposal);
         return proposal;
@@ -1982,6 +2016,10 @@ export class Multisig {
         if (alreadySigned) {
             throw new Error('You have already signed this proposal');
         }
+        // Verification re-executes every built-in type at the store's sync height.
+        if (proposal.metadata?.proposalType !== 'custom') {
+            await this.syncChain();
+        }
         const commitmentToSign = await this.verifyProposalMetadataBinding(proposal);
         // Sign the commitment
         const signature = await buildGuardianSignatureFromSigner(this.signer, commitmentToSign);
@@ -2033,7 +2071,7 @@ export class Multisig {
         catch (error) {
             proposal.verification = {
                 status: 'failed',
-                retryable: isTransientRpcError(error),
+                retryable: isTransientRpcError(error) || isStaleChainError(error),
                 message: error instanceof Error ? error.message : String(error),
             };
             throw error;
@@ -2042,10 +2080,11 @@ export class Multisig {
     async checkProposalMetadataBinding(proposal) {
         const txSummaryCommitment = this.ensureProposalCommitmentMatchesSummary(proposal);
         const summary = TransactionSummary.deserialize(base64ToUint8Array(proposal.txSummary));
-        // The anchor arrives from an untrusted party via GUARDIAN, so check its
-        // block commitment against the one bound into the signed summary before
-        // anything executes against it. `ChainAnchor.deserialize` already enforced
-        // internal header/chain consistency.
+        // The anchor arrives from an untrusted party via GUARDIAN, so check that it
+        // names the block the signed summary binds: the rebuild below binds the
+        // block it names. Nothing executes against it; the rebuild runs at the
+        // chain tip. `ChainAnchor.deserialize` already enforced internal
+        // header/chain consistency.
         const anchor = this.requireProposalAnchor(proposal.id, proposal.metadata);
         try {
             const anchorCommitment = normalizeHexWord(anchor.commitment().toHex());
@@ -2072,6 +2111,11 @@ export class Multisig {
                 // binding checks for this type.
                 return txSummaryCommitment;
             }
+            // The rebuild reads the chain's fee faucet from the synced protocol
+            // configuration and executes at the tip, so the store has to have synced
+            // to the block the summary binds; a cosigner that has only just loaded
+            // the account has not.
+            await this.syncToBoundBlock(binding.boundBlockNum);
             // A consume-notes summary commits to *authenticated* consumption (see
             // ensureNotesAuthenticated), which miden-client decides from this store
             // alone. Put the store in that mode before the rebuild, or a cosigner
@@ -2081,8 +2125,7 @@ export class Multisig {
                 await this.ensureNotesAuthenticated(decodeEmbeddedConsumeNotes(proposal.metadata));
             }
             const request = await this.buildTransactionRequestFromMetadata(proposal.metadata, binding);
-            const webClient = await this.getRawClient();
-            const reconstructed = await executeForSummaryAt(webClient, this._accountId, request, anchor);
+            const reconstructed = await executeForSummaryAtTip(this.midenClient, this._accountId, request);
             const reconstructedCommitment = normalizeHexWord(reconstructed.toCommitment().toHex());
             if (reconstructedCommitment !== txSummaryCommitment) {
                 throw new Error(`Invalid proposal: metadata does not match tx_summary for ${proposal.id}`);
@@ -2093,12 +2136,6 @@ export class Multisig {
             anchor.free();
         }
     }
-    /**
-     * Decodes a proposal's chain anchor. Throws when absent: a proposal without
-     * an anchor was created at an unknown reference block, so its signed summary
-     * cannot be reproduced, verified, or executed. The caller owns the returned
-     * anchor and must `free()` it once done.
-     */
     /**
      * Reads a proposal's salt. Throws when absent, because there is nothing to fall
      * back to.
@@ -2140,11 +2177,16 @@ export class Multisig {
         }
         return saltHex;
     }
+    /**
+     * Decodes a proposal's chain anchor, which names the block its signed summary
+     * binds. Throws when absent: every proposal carries one, so a proposal
+     * without it is malformed and is neither verified nor executed. The caller
+     * owns the returned anchor and must `free()` it once done.
+     */
     requireProposalAnchor(proposalId, metadata) {
         if (!metadata.chainAnchor) {
-            throw new Error(`Proposal ${proposalId} has no chain anchor; it was created without ` +
-                'chain-anchored execution and its signed summary cannot be reproduced ' +
-                'at the original reference block');
+            throw new Error(`Proposal ${proposalId} has no chain anchor, which names the block its signed ` +
+                'summary binds; it cannot be verified or executed');
         }
         return chainAnchorFromBase64(metadata.chainAnchor);
     }
@@ -2158,8 +2200,7 @@ export class Multisig {
         if (expirationBlockNum === undefined) {
             return;
         }
-        const webClient = await this.getRawClient();
-        const syncHeight = await webClient.getSyncHeight();
+        const syncHeight = await this.midenClient.getSyncHeight();
         if (syncHeight >= expirationBlockNum) {
             throw new Error(`Proposal ${proposalId} approval expired at block ${expirationBlockNum}; the chain is at ` +
                 `block ${syncHeight}, so the collected signatures no longer authorize it`);
@@ -2188,20 +2229,19 @@ export class Multisig {
         }
     }
     async buildTransactionRequestWithOptions(metadata, requestOptions) {
-        const webClient = await this.getRawClient();
         switch (metadata.proposalType) {
             case 'add_signer':
             case 'remove_signer':
             case 'change_threshold': {
-                const { request } = await buildUpdateSignersTransactionRequest(webClient, metadata.targetThreshold, metadata.targetSignerCommitments, requestOptions);
+                const { request } = await buildUpdateSignersTransactionRequest(this.midenClient, metadata.targetThreshold, metadata.targetSignerCommitments, requestOptions);
                 return request;
             }
             case 'switch_guardian': {
-                const { request } = await buildUpdateGuardianTransactionRequest(webClient, metadata.newGuardianPubkey, requestOptions);
+                const { request } = await buildUpdateGuardianTransactionRequest(this.midenClient, metadata.newGuardianPubkey, requestOptions);
                 return request;
             }
             case 'update_procedure_threshold': {
-                const { request } = await buildUpdateProcedureThresholdTransactionRequest(webClient, metadata.targetProcedure, metadata.targetThreshold, requestOptions);
+                const { request } = await buildUpdateProcedureThresholdTransactionRequest(this.midenClient, metadata.targetProcedure, metadata.targetThreshold, requestOptions);
                 return request;
             }
             case 'consume_notes': {
@@ -2209,7 +2249,7 @@ export class Multisig {
                 const version = metadata.metadataVersion;
                 if (version === CONSUME_NOTES_METADATA_VERSION_V2) {
                     const decoded = decodeEmbeddedConsumeNotes(metadata);
-                    const { request } = await buildConsumeNotesTransactionRequestFromNotes(webClient, decoded, requestOptions);
+                    const { request } = await buildConsumeNotesTransactionRequestFromNotes(this.midenClient, decoded, requestOptions);
                     return request;
                 }
                 if (version === undefined || version === 1) {
@@ -2218,13 +2258,13 @@ export class Multisig {
                         // operator which legacy shape was rejected.
                         throw new UnsupportedMetadataVersionError(version);
                     }
-                    const { request } = await buildConsumeNotesTransactionRequest(webClient, metadata.noteIds, requestOptions);
+                    const { request } = await buildConsumeNotesTransactionRequest(this.midenClient, metadata.noteIds, requestOptions);
                     return request;
                 }
                 throw new UnsupportedMetadataVersionError(version);
             }
             case 'p2id': {
-                const { request } = await buildP2idTransactionRequest(webClient, this._accountId, metadata.recipientId, metadata.faucetId, BigInt(metadata.amount), {
+                const { request } = await buildP2idTransactionRequest(this.midenClient, this._accountId, metadata.recipientId, metadata.faucetId, BigInt(metadata.amount), {
                     ...requestOptions,
                     noteType: parseP2idNoteType(metadata.noteType),
                     reclaimHeight: metadata.reclaimHeight,