@usearete/adapter-kit 0.16.0 → 0.17.0

package/dist/index.cjs

@@ -3,6 +3,111 @@
 var kit = require('@solana/kit');
 var sdk = require('@usearete/sdk');
 
+/**
+ * Wallet Standard → kit signer bridge.
+ *
+ * The handoff is byte-oriented on purpose: the app picks the transaction
+ * format, the wallet decodes the version out of the bytes it is given, and
+ * Arete forwards whatever came back without converting versions. Nothing
+ * here routes a transaction through a web3.js 1.x wrapper, which cannot
+ * represent V1 at all.
+ *
+ * The capability check is a local fact about the wallet, not proof the
+ * cluster has activated a version: the account must advertise
+ * `solana:signTransaction`, and *that* feature must advertise the version
+ * being signed. Sign-and-send support is never read as sign-only support —
+ * a wallet that can only sign-and-send cannot hand bytes back for Arete to
+ * relay.
+ *
+ * As of Kit 8, the upstream Wallet Standard `signTransaction` feature still
+ * types `supportedTransactionVersions` as `legacy | 0`. The interfaces below
+ * are therefore declared structurally rather than imported, so a wallet that
+ * does advertise `1` is usable without a cast and one that does not is
+ * refused before it is ever prompted.
+ */
+/** The feature name a sign-only handoff requires. */
+const SOLANA_SIGN_TRANSACTION = 'solana:signTransaction';
+/** The feature name that is explicitly *not* evidence of sign-only support. */
+const SOLANA_SIGN_AND_SEND_TRANSACTION = 'solana:signAndSendTransaction';
+/** Typed refusal from the Wallet Standard bridge. */
+class WalletStandardSignerError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'WalletStandardSignerError';
+        this.code = code;
+    }
+}
+function readSignTransactionFeature(config) {
+    if (!config.account.features.includes(SOLANA_SIGN_TRANSACTION)) {
+        const signAndSendOnly = config.account.features.includes(SOLANA_SIGN_AND_SEND_TRANSACTION);
+        throw new WalletStandardSignerError('sign_transaction_unsupported', `Account ${config.account.address} does not support '${SOLANA_SIGN_TRANSACTION}'`
+            + (signAndSendOnly
+                ? `; it advertises only '${SOLANA_SIGN_AND_SEND_TRANSACTION}', which cannot return `
+                    + 'signed bytes for Arete to relay'
+                : ''));
+    }
+    const feature = config.wallet.features[SOLANA_SIGN_TRANSACTION];
+    if (!feature || typeof feature.signTransaction !== 'function') {
+        throw new WalletStandardSignerError('sign_transaction_unsupported', `Wallet does not implement the '${SOLANA_SIGN_TRANSACTION}' feature`);
+    }
+    return feature;
+}
+/**
+ * A kit {@link TransactionSigner} backed by a Wallet Standard account.
+ *
+ * The feature is resolved once, at creation, so a wallet that cannot sign at
+ * all fails before any transaction is built. The per-version check happens
+ * per transaction, against the version decoded from the bytes about to be
+ * handed over — so a v0-only wallet refuses a V1 transaction without ever
+ * showing the user a prompt.
+ */
+function createWalletStandardSigner(config) {
+    const feature = readSignTransactionFeature(config);
+    const address = config.account.address;
+    return {
+        address,
+        async signTransactions(transactions) {
+            if (transactions.length === 0)
+                return [];
+            const inputs = transactions.map((transaction) => {
+                const version = kit.getTransactionVersionDecoder().decode(transaction.messageBytes);
+                if (!feature.supportedTransactionVersions.includes(version)) {
+                    throw new WalletStandardSignerError('transaction_version_unsupported', `Wallet does not support signing transaction version ${JSON.stringify(version)} `
+                        + `(supported: ${feature.supportedTransactionVersions
+                            .map((supported) => JSON.stringify(supported))
+                            .join(', ')})`);
+                }
+                return {
+                    account: config.account,
+                    chain: config.chain,
+                    transaction: kit.getTransactionEncoder().encode(transaction),
+                };
+            });
+            const outputs = await feature.signTransaction(...inputs);
+            if (outputs.length !== transactions.length) {
+                throw new WalletStandardSignerError('wallet_returned_invalid_transaction', `Wallet returned ${outputs.length} signed transactions for ${transactions.length} `
+                    + 'inputs');
+            }
+            return outputs.map((output, index) => {
+                const returned = kit.getTransactionDecoder().decode(output.signedTransaction);
+                // A wallet may add signatures; it may not rewrite the message the
+                // app compiled. Anything else and the bytes Arete would relay are
+                // not the bytes the caller approved.
+                const original = transactions[index].messageBytes;
+                if (returned.messageBytes.length !== original.length
+                    || returned.messageBytes.some((byte, offset) => byte !== original[offset])) {
+                    throw new WalletStandardSignerError('wallet_returned_invalid_transaction', 'Wallet returned a transaction whose message differs from the one it was given');
+                }
+                const signature = returned.signatures[address];
+                if (!signature) {
+                    throw new WalletStandardSignerError('wallet_returned_invalid_transaction', `Wallet returned no signature for ${address}`);
+                }
+                return { [address]: signature };
+            });
+        },
+    };
+}
+
 /**
  * @usearete/adapter-kit
  *
@@ -14,13 +119,58 @@ var sdk = require('@usearete/sdk');
  * sending, and confirmation.
  */
 /**
- * Kit builds v0 messages only, and applies no compute-budget instructions of
- * its own: transaction V1 and the resource budget options land with A4-253.
+ * Kit 8 is the first release that constructs transaction V1 messages and
+ * carries the resource budget as a typed message config, so this adapter
+ * builds every version the contract defines and honours every typed
+ * resource option.
  */
 const CAPABILITY = {
-    supportedTransactionVersions: [0],
-    supportedResourceOptions: [],
+    supportedTransactionVersions: ['legacy', 0, 1],
+    supportedResourceOptions: [
+        'computeUnitLimit',
+        'loadedAccountsDataSizeLimit',
+        'heapSize',
+        'priorityFeeLamports',
+        'computeUnitPriceMicroLamports',
+    ],
 };
+/** Wire ceiling for legacy and v0 transactions, in bytes (one UDP packet). */
+const LEGACY_TRANSACTION_SIZE_LIMIT = 1232;
+/** Wire ceiling for V1 transactions, in bytes (SIMD-0385). */
+const V1_TRANSACTION_SIZE_LIMIT = 4096;
+/** Structural V1 caps enforced before a signer is reached (SIMD-0385). */
+const V1_MAX_SIGNATURES = 12;
+const V1_MAX_ACCOUNTS = 64;
+const V1_MAX_INSTRUCTIONS = 64;
+/**
+ * Per-transaction compute-unit maximum. Also the limit a *provisional* V1
+ * message declares for a budget the caller omitted: SIMD-0385 makes an unset
+ * V1 config field request the **minimum**, not a default, so a provisional
+ * message carrying nothing could never produce an ordinary successful
+ * execution estimate.
+ */
+const MAX_COMPUTE_UNIT_LIMIT = 1400000;
+/** Loaded-account-data maximum (64 MiB), used the same way. */
+const MAX_LOADED_ACCOUNTS_DATA_SIZE = 64 * 1024 * 1024;
+/**
+ * Headroom added to measured compute consumption, in percent: a simulation
+ * is one slot's view of the chain and the transaction that lands may take a
+ * slightly different branch.
+ */
+const ESTIMATED_COMPUTE_UNIT_HEADROOM_PERCENT = 20n;
+/**
+ * The runtime accounts for loaded data in pages of this size, so an
+ * estimated data budget is rounded up to a whole page plus one page of
+ * headroom for account growth between simulation and execution.
+ */
+const LOADED_ACCOUNTS_DATA_PAGE_BYTES = 32 * 1024;
+const COMPUTE_BUDGET_PROGRAM_ADDRESS = 'ComputeBudget111111111111111111111111111111';
+/** Option keys that would carry address lookup tables. */
+const LOOKUP_TABLE_OPTION_KEYS = [
+    'addressLookupTables',
+    'addressLookupTableAccounts',
+    'lookupTables',
+];
 /** Structured adapter error consumed by the Arete transaction outcome APIs. */
 class KitTransactionExecutionError extends Error {
     constructor(outcome) {
@@ -93,14 +243,72 @@ function resolveTransport(selection, rpc, rpcSubscriptions, context) {
         return { kind: 'direct', rpc, rpcSubscriptions };
     throw new Error('No transaction transport is available; connect through Arete or configure direct RPC');
 }
-async function pollAreteStatus(transport, signature, commitment, lastValidBlockHeight, options) {
-    const deadline = Date.now() + (options?.confirmationTimeoutMs ?? 60000);
+/**
+ * Report, never adopt, a relay signature that is not the one signed here.
+ *
+ * The adapter signs the final bytes and derives the signature from them, so
+ * the local one is authoritative. Reconciling an echoed signature would
+ * poll a transaction this adapter never submitted: it can report another
+ * transaction's status as this one's, or never confirm the one that went
+ * out.
+ */
+function reportSignatureMismatch(local, echoed) {
+    if (echoed && echoed !== local) {
+        // eslint-disable-next-line no-console -- the adapter has no logger, and
+        // this runs after the transaction may already be on the wire, so it
+        // must not interrupt the signature-bearing outcome.
+        console.warn(`Arete relay reported signature ${echoed} for a transaction signed as ${local}; `
+            + 'the locally derived signature is authoritative and is the one being reconciled');
+    }
+}
+/** Thrown by {@link withDeadline} when the shared deadline passes first. */
+class DeadlineExpiredError extends Error {
+    constructor() {
+        super('The configured confirmation deadline expired');
+        this.name = 'DeadlineExpiredError';
+    }
+}
+const DEADLINE_EXPIRED = Symbol('deadline-expired');
+/**
+ * Await `work`, or give up at `deadline`.
+ *
+ * A racing timer rather than an abort signal: `TransactionTransport` takes
+ * none, and no HTTP client under it imposes a request timeout, so a backend
+ * that stops answering would otherwise hold the caller forever. The
+ * abandoned request is left with a no-op rejection handler — it may still be
+ * in flight, which is exactly why the outcome is *unknown* rather than
+ * failed.
+ */
+async function withDeadline(deadline, work) {
+    work.catch(() => { });
+    let timer;
+    // Executor form, not `Promise.withResolvers`: that landed in Node 22 and
+    // this package's floor is the Node 20.18 that Kit 8 requires.
+    const expiry = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(DEADLINE_EXPIRED), Math.max(deadline - Date.now(), 0));
+    });
+    try {
+        const result = await Promise.race([work, expiry]);
+        if (result === DEADLINE_EXPIRED)
+            throw new DeadlineExpiredError();
+        return result;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Poll until the signature reaches `commitment`, its lifetime expires, or
+ * `deadline` passes — including while a request is in flight. Never
+ * resubmits, and only ever polls the signature the caller signed.
+ */
+async function pollAreteStatus(transport, signature, commitment, lastValidBlockHeight, deadline, options) {
     const interval = options?.statusPollIntervalMs ?? 500;
     let emptyStatusPolls = 0;
     while (Date.now() <= deadline) {
-        const status = await transport.getSignatureStatus(signature, {
+        const status = await withDeadline(deadline, transport.getSignatureStatus(signature, {
             commitment, searchTransactionHistory: true,
-        });
+        }));
         if (status?.err) {
             throw new KitTransactionExecutionError({
                 status: 'chain-failed', phase: 'confirmation', signature,
@@ -110,7 +318,8 @@ async function pollAreteStatus(transport, signature, commitment, lastValidBlockH
         if (status && hasReachedCommitment(status.confirmationStatus, commitment)) {
             return { signature, slot: status.slot === null ? undefined : Number(status.slot) };
         }
-        if (await transport.getBlockHeight({ commitment }) > lastValidBlockHeight) {
+        if (await withDeadline(deadline, transport.getBlockHeight({ commitment }))
+            > lastValidBlockHeight) {
             throw new KitTransactionExecutionError({
                 status: 'submitted-unknown', phase: 'confirmation', signature,
                 slot: status?.slot === null ? undefined : Number(status?.slot),
@@ -118,7 +327,8 @@ async function pollAreteStatus(transport, signature, commitment, lastValidBlockH
             });
         }
         emptyStatusPolls = status ? 0 : emptyStatusPolls + 1;
-        const delayMs = Math.min(interval * (2 ** Math.min(emptyStatusPolls, 3)), 4000);
+        const backoffMs = Math.min(interval * (2 ** Math.min(emptyStatusPolls, 3)), 4000);
+        const delayMs = Math.min(backoffMs, Math.max(deadline - Date.now(), 0));
         await new Promise((resolve) => setTimeout(resolve, delayMs));
     }
     throw new KitTransactionExecutionError({
@@ -176,7 +386,7 @@ function fromAccountRole(role) {
             return { isSigner: false, isWritable: false };
     }
 }
-/** Convert an Arete BuiltInstruction to a kit IInstruction. */
+/** Convert an Arete BuiltInstruction to a kit Instruction. */
 function toKitInstruction(ix) {
     const accounts = ix.keys.map((k) => ({
         address: kit.address(k.pubkey),
@@ -188,7 +398,7 @@ function toKitInstruction(ix) {
         data: ix.data,
     };
 }
-/** Convert a kit IInstruction to an Arete BuiltInstruction. */
+/** Convert a kit Instruction to an Arete BuiltInstruction. */
 function fromKitInstruction(ix) {
     return {
         programId: ix.programAddress,
@@ -199,6 +409,232 @@ function fromKitInstruction(ix) {
         data: ix.data ? new Uint8Array(ix.data) : new Uint8Array(0),
     };
 }
+// ---------------------------------------------------------------------------
+// One version/configuration planner, shared by send and unsigned inspection
+// ---------------------------------------------------------------------------
+/**
+ * Refuse the inputs the typed configuration owns.
+ *
+ * A hand-built `ComputeBudget` instruction is not an effective V1
+ * configuration — the runtime reads V1 budgets from the message config — and
+ * silently accepting one would apply a budget on legacy/v0 and none on V1
+ * from the same caller code. Address lookup tables have no V1 encoding at
+ * all, and this adapter compiles none for any version.
+ */
+function assertBuildableInputs(instructions, options, version) {
+    if (instructions.length === 0) {
+        throw new Error('A transaction requires at least one instruction');
+    }
+    if (instructions.some((ix) => ix.programId === COMPUTE_BUDGET_PROGRAM_ADDRESS)) {
+        throw new Error('Caller-supplied ComputeBudget instructions are rejected: request compute units, heap '
+            + 'size, loaded-accounts size and fees through the typed `resources` options so one '
+            + 'contract covers every transaction version');
+    }
+    const lookupTableKey = LOOKUP_TABLE_OPTION_KEYS.find((key) => options?.[key] !== undefined);
+    if (lookupTableKey) {
+        throw new Error(`Address lookup tables are not supported by this adapter (rejected option `
+            + `'${lookupTableKey}')`
+            + (version === 1 ? '; transaction version 1 has no lookup tables at all (SIMD-0385)' : ''));
+    }
+}
+function toUnits(value) {
+    return value === undefined ? undefined : Number(value);
+}
+/**
+ * A V1 message: the resource budget is the message's typed config, and the
+ * runtime reads it from there — which is why a caller-supplied
+ * `ComputeBudget` instruction is rejected rather than merged.
+ */
+function planV1Message(input) {
+    const { resources } = input;
+    const configured = kit.setTransactionMessageConfig({
+        computeUnitLimit: toUnits(resources.computeUnitLimit),
+        heapSize: toUnits(resources.heapSize),
+        loadedAccountsDataSizeLimit: toUnits(resources.loadedAccountsDataSizeLimit),
+        priorityFeeLamports: resources.priorityFeeLamports,
+    }, kit.createTransactionMessage({ version: 1 }));
+    const withFeePayer = kit.setTransactionMessageFeePayerSigner(input.feePayer, configured);
+    const withLifetime = kit.setTransactionMessageLifetimeUsingBlockhash(input.latestBlockhash, withFeePayer);
+    return kit.appendTransactionMessageInstructions(input.instructions.map(toKitInstruction), withLifetime);
+}
+/**
+ * A legacy or v0 message: the same budget, rendered as the canonical
+ * `ComputeBudget` instructions kit prepends.
+ */
+function planLegacyMessage(input) {
+    const { resources } = input;
+    const created = input.version === 0
+        ? kit.createTransactionMessage({ version: 0 })
+        : kit.createTransactionMessage({ version: 'legacy' });
+    const withFeePayer = kit.setTransactionMessageFeePayerSigner(input.feePayer, created);
+    const withLifetime = kit.setTransactionMessageLifetimeUsingBlockhash(input.latestBlockhash, withFeePayer);
+    let message = kit.appendTransactionMessageInstructions(input.instructions.map(toKitInstruction), withLifetime);
+    if (resources.computeUnitLimit !== undefined) {
+        message = kit.setTransactionMessageComputeUnitLimit(Number(resources.computeUnitLimit), message);
+    }
+    if (resources.computeUnitPriceMicroLamports !== undefined) {
+        message = kit.setTransactionMessageComputeUnitPrice(resources.computeUnitPriceMicroLamports, message);
+    }
+    if (resources.heapSize !== undefined) {
+        message = kit.setTransactionMessageHeapSize(Number(resources.heapSize), message);
+    }
+    if (resources.loadedAccountsDataSizeLimit !== undefined) {
+        message = kit.setTransactionMessageLoadedAccountsDataSizeLimit(Number(resources.loadedAccountsDataSizeLimit), message);
+    }
+    return message;
+}
+/**
+ * One version/configuration planner for send and unsigned inspection: the
+ * only difference between the two is whether the fee payer can sign.
+ */
+function planMessage(input) {
+    const message = input.version === 1 ? planV1Message(input) : planLegacyMessage(input);
+    return input.attachedSigners?.length
+        ? kit.addSignersToTransactionMessage([...input.attachedSigners], message)
+        : message;
+}
+/**
+ * The version's wire ceiling, checked on the compiled bytes before a signer
+ * is ever reached.
+ *
+ * The V1 structural caps ({@link V1_MAX_SIGNATURES} signatures,
+ * {@link V1_MAX_ACCOUNTS} accounts, {@link V1_MAX_INSTRUCTIONS} top-level
+ * instructions) are enforced by `compileTransaction` itself, so they fail
+ * here too — one compile earlier than this check, and equally before
+ * signing. Re-implementing them would only risk disagreeing with the codec.
+ */
+function assertWithinSizeLimit(version, size) {
+    const limit = version === 1 ? V1_TRANSACTION_SIZE_LIMIT : LEGACY_TRANSACTION_SIZE_LIMIT;
+    if (size > limit) {
+        throw new Error(`Transaction is ${size} bytes, over the ${limit}-byte limit for version `
+            + `${JSON.stringify(version)}`);
+    }
+}
+/** Measured consumption plus headroom, positive and protocol-bounded. */
+function estimatedComputeUnitLimit(unitsConsumed) {
+    const padded = (unitsConsumed * (100n + ESTIMATED_COMPUTE_UNIT_HEADROOM_PERCENT) + 99n) / 100n;
+    if (padded < 1n)
+        return 1n;
+    return padded > BigInt(MAX_COMPUTE_UNIT_LIMIT) ? BigInt(MAX_COMPUTE_UNIT_LIMIT) : padded;
+}
+/** Measured loaded data rounded up to a whole page plus one page of headroom. */
+function estimatedLoadedAccountsDataSize(loadedBytes) {
+    const page = BigInt(LOADED_ACCOUNTS_DATA_PAGE_BYTES);
+    const padded = ((loadedBytes + page - 1n) / page + 1n) * page;
+    const max = BigInt(MAX_LOADED_ACCOUNTS_DATA_SIZE);
+    return padded > max ? max : padded;
+}
+async function fetchLatestBlockhash(resolved, commitment, minContextSlot) {
+    const value = resolved.kind === 'arete'
+        ? await resolved.transport.getLatestBlockhash({ commitment, minContextSlot })
+        : (await resolved.rpc.getLatestBlockhash({ commitment, minContextSlot }).send()).value;
+    return {
+        blockhash: value.blockhash,
+        lastValidBlockHeight: BigInt(value.lastValidBlockHeight),
+    };
+}
+/**
+ * Simulate a transaction carrying placeholder signatures. Verification is
+ * off on both backends: nothing on this path has touched a signer.
+ */
+async function simulateUnsigned(resolved, wireTransaction, commitment, minContextSlot) {
+    if (resolved.kind === 'arete') {
+        const simulation = await resolved.transport.simulateTransaction(wireTransaction, {
+            commitment,
+            minContextSlot,
+        });
+        return {
+            contextSlot: simulation.contextSlot,
+            err: simulation.err ?? undefined,
+            logs: simulation.logs ?? undefined,
+            unitsConsumed: simulation.unitsConsumed,
+            loadedAccountsDataSize: simulation.loadedAccountsDataSize,
+        };
+    }
+    const simulation = await resolved.rpc.simulateTransaction(wireTransaction, { commitment, encoding: 'base64', minContextSlot, sigVerify: false }).send();
+    // The loaded-accounts budget is optional upstream and comes back as null
+    // when the node did not measure it; `Number(null)` would invent a measured
+    // zero and destroy the distinction estimation depends on.
+    const { loadedAccountsDataSize } = simulation.value;
+    return {
+        contextSlot: simulation.context.slot,
+        err: simulation.value.err ?? undefined,
+        logs: simulation.value.logs ?? undefined,
+        unitsConsumed: simulation.value.unitsConsumed == null
+            ? undefined
+            : BigInt(simulation.value.unitsConsumed),
+        loadedAccountsDataSize: loadedAccountsDataSize == null
+            ? undefined
+            : BigInt(loadedAccountsDataSize),
+    };
+}
+async function estimateFee(resolved, encodedMessage, commitment, minContextSlot) {
+    if (resolved.kind === 'arete') {
+        const fee = await resolved.transport.getFeeForMessage(encodedMessage, {
+            commitment,
+            minContextSlot,
+        });
+        return {
+            feeLamports: fee.feeLamports === null ? undefined : fee.feeLamports,
+            contextSlot: fee.contextSlot,
+        };
+    }
+    const fee = await resolved.rpc
+        .getFeeForMessage(encodedMessage, { commitment, minContextSlot })
+        .send();
+    return {
+        feeLamports: fee.value === null ? undefined : fee.value,
+        contextSlot: fee.context.slot,
+    };
+}
+/**
+ * The V1 message a simulation can actually execute: the caller's own budgets
+ * where they gave them, the protocol maxima where they did not.
+ */
+function provisionalV1Resources(resources) {
+    return {
+        ...resources,
+        computeUnitLimit: resources.computeUnitLimit ?? BigInt(MAX_COMPUTE_UNIT_LIMIT),
+        loadedAccountsDataSizeLimit: resources.loadedAccountsDataSizeLimit ?? BigInt(MAX_LOADED_ACCOUNTS_DATA_SIZE),
+    };
+}
+/**
+ * Resolve the two budgets a signable V1 message must declare.
+ *
+ * An unset V1 budget requests the *minimum* rather than a default
+ * (SIMD-0385), so a final message missing either could only fail on chain.
+ * An explicit caller budget is used verbatim and never raised; a missing one
+ * is measured by simulating the provisional message and derived with
+ * headroom; and a metric the simulation never reported is refused by name.
+ */
+async function resolveV1Budgets(resolved, compileProvisional, resources, commitment, minContextSlot) {
+    if (resources.computeUnitLimit !== undefined
+        && resources.loadedAccountsDataSizeLimit !== undefined) {
+        return resources;
+    }
+    const simulation = await simulateUnsigned(resolved, compileProvisional(provisionalV1Resources(resources)), commitment, minContextSlot);
+    if (simulation.err) {
+        throw new Error(`Budget estimation simulation reported ${JSON.stringify(simulation.err)}; `
+            + 'nothing was submitted');
+    }
+    const unestimable = (option, metric) => new Error(`${option} is required for transaction version 1 and could not be estimated: the `
+        + `simulation reported no ${metric}. Pass an explicit ${option}, or use a backend whose `
+        + `simulation reports ${metric}.`);
+    let { computeUnitLimit, loadedAccountsDataSizeLimit } = resources;
+    if (computeUnitLimit === undefined) {
+        if (simulation.unitsConsumed === undefined) {
+            throw unestimable('computeUnitLimit', 'unitsConsumed');
+        }
+        computeUnitLimit = estimatedComputeUnitLimit(simulation.unitsConsumed);
+    }
+    if (loadedAccountsDataSizeLimit === undefined) {
+        if (simulation.loadedAccountsDataSize === undefined) {
+            throw unestimable('loadedAccountsDataSizeLimit', 'loadedAccountsDataSize');
+        }
+        loadedAccountsDataSizeLimit = estimatedLoadedAccountsDataSize(simulation.loadedAccountsDataSize);
+    }
+    return { ...resources, computeUnitLimit, loadedAccountsDataSizeLimit };
+}
 /**
  * Create a {@link WalletAdapter} from a kit RPC pair and a signer.
  */
@@ -212,17 +648,21 @@ function createWalletAdapter(config) {
         signerAddresses: [...new Set(signerAddresses)],
         supportedTransactionVersions: CAPABILITY.supportedTransactionVersions,
         async signAndSend(instructions, options, context) {
-            // Rejects an explicit non-v0 version and any resource option this
-            // adapter cannot apply, before a wallet is ever prompted.
-            sdk.resolveTransactionBuildOptions(options, CAPABILITY);
-            if (instructions.length === 0) {
-                const cause = new Error('signAndSend requires at least one instruction');
+            // Rejects an unsupported explicit version and any version-bound fee
+            // used against the wrong version, before a wallet is ever prompted.
+            let plan;
+            try {
+                plan = sdk.resolveTransactionBuildOptions(options, CAPABILITY);
+                assertBuildableInputs(instructions, options, plan.transactionVersion);
+            }
+            catch (cause) {
                 throw new KitTransactionExecutionError({
                     status: 'not-submitted',
                     phase: 'build',
                     cause,
                 });
             }
+            const version = plan.transactionVersion;
             const sendOptions = options;
             const feePayer = sendOptions?.feePayer ?? signer;
             const commitment = toCommitment(options?.confirmationLevel, fallbackCommitment);
@@ -251,12 +691,30 @@ function createWalletAdapter(config) {
                 const attachedSigners = [...requiredSignerAddresses]
                     .filter((requiredAddress) => requiredAddress !== feePayer.address)
                     .map((requiredAddress) => localSignerMap.get(requiredAddress));
-                const latestBlockhash = resolved.kind === 'arete'
-                    ? await resolved.transport.getLatestBlockhash({ commitment })
-                    : (await resolved.rpc.getLatestBlockhash({ commitment }).send()).value;
-                lastValidBlockHeight = BigInt(latestBlockhash.lastValidBlockHeight);
-                const messageWithFeePayer = kit.pipe(kit.createTransactionMessage({ version: 0 }), (m) => kit.setTransactionMessageFeePayerSigner(feePayer, m), (m) => kit.setTransactionMessageLifetimeUsingBlockhash(latestBlockhash, m), (m) => kit.appendTransactionMessageInstructions(instructions.map(toKitInstruction), m));
-                message = kit.addSignersToTransactionMessage(attachedSigners, messageWithFeePayer);
+                const latestBlockhash = await fetchLatestBlockhash(resolved, commitment);
+                lastValidBlockHeight = latestBlockhash.lastValidBlockHeight;
+                const compile = (resources) => planMessage({
+                    version,
+                    resources,
+                    instructions,
+                    latestBlockhash,
+                    feePayer,
+                    attachedSigners,
+                });
+                // The budgets are resolved before the final message exists, so the
+                // configuration that is compiled, sized, preflighted and signed is
+                // one configuration. The provisional message is sized too: an
+                // oversized payload is a build failure with an exact byte count,
+                // not a backend-specific simulation error.
+                const encodeSized = (compiled) => {
+                    assertWithinSizeLimit(version, kit.getTransactionSize(compiled));
+                    return kit.getBase64EncodedWireTransaction(compiled);
+                };
+                const resources = version === 1
+                    ? await resolveV1Budgets(resolved, (provisional) => encodeSized(kit.compileTransaction(compile(provisional))), plan.resources, commitment)
+                    : plan.resources;
+                message = compile(resources);
+                assertWithinSizeLimit(version, kit.getTransactionSize(kit.compileTransaction(message)));
             }
             catch (cause) {
                 throw new KitTransactionExecutionError({
@@ -269,6 +727,7 @@ function createWalletAdapter(config) {
             let signature;
             try {
                 signedTransaction = await kit.signTransactionMessageWithSigners(message);
+                kit.assertIsTransactionWithBlockhashLifetime(signedTransaction);
                 signature = kit.getSignatureFromTransaction(signedTransaction);
             }
             catch (cause) {
@@ -279,31 +738,45 @@ function createWalletAdapter(config) {
                 });
             }
             if (resolved.kind === 'arete') {
-                let submittedSignature;
+                // One deadline over submission *and* confirmation: a relay that
+                // takes the transaction and then stalls would otherwise hold the
+                // caller forever, because no HTTP client here imposes a request
+                // timeout. Expiry on either side is submitted-unknown under the
+                // signature these bytes carry — never a rebuild, re-sign or resend.
+                const deadline = Date.now() + (sendOptions?.confirmationTimeoutMs ?? 60000);
                 try {
-                    const sent = await resolved.transport.sendTransaction(kit.getBase64EncodedWireTransaction(signedTransaction), { skipPreflight: options?.skipPreflight ?? false, preflightCommitment: commitment });
-                    submittedSignature = sent.signature;
+                    const sent = await withDeadline(deadline, resolved.transport.sendTransaction(kit.getBase64EncodedWireTransaction(signedTransaction), { skipPreflight: options?.skipPreflight ?? false, preflightCommitment: commitment }));
+                    reportSignatureMismatch(signature, sent.signature);
                 }
                 catch (cause) {
+                    if (cause instanceof DeadlineExpiredError) {
+                        throw new KitTransactionExecutionError({
+                            status: 'submitted-unknown', phase: 'send', signature,
+                            cause: new Error('The relay did not acknowledge the submission before the confirmation '
+                                + 'deadline; the transaction was dispatched once and may still land'),
+                        });
+                    }
                     if (cause instanceof sdk.TransactionTransportError && cause.submissionState === 'not_submitted') {
                         throw new KitTransactionExecutionError({ status: 'not-submitted', phase: 'send', cause });
                     }
+                    if (cause instanceof sdk.TransactionTransportError) {
+                        reportSignatureMismatch(signature, cause.signature);
+                    }
+                    // The locally derived signature stays authoritative: it is the one
+                    // these bytes carry, so a relay reporting another identifies some
+                    // other transaction and cannot be what the caller reconciles.
                     throw new KitTransactionExecutionError({
-                        status: 'submitted-unknown', phase: 'send',
-                        signature: cause instanceof sdk.TransactionTransportError && cause.signature
-                            ? cause.signature : signature,
-                        cause,
+                        status: 'submitted-unknown', phase: 'send', signature, cause,
                     });
                 }
                 try {
-                    return await pollAreteStatus(resolved.transport, submittedSignature, commitment, lastValidBlockHeight, sendOptions);
+                    return await pollAreteStatus(resolved.transport, signature, commitment, lastValidBlockHeight, deadline, sendOptions);
                 }
                 catch (cause) {
                     if (cause instanceof KitTransactionExecutionError)
                         throw cause;
                     throw new KitTransactionExecutionError({
-                        status: 'submitted-unknown', phase: 'confirmation',
-                        signature: submittedSignature, cause,
+                        status: 'submitted-unknown', phase: 'confirmation', signature, cause,
                     });
                 }
             }
@@ -377,71 +850,75 @@ function createWalletAdapter(config) {
             }
         },
         async inspectTransaction(instructions, options, context) {
-            sdk.resolveTransactionBuildOptions(options, CAPABILITY);
-            if (instructions.length === 0) {
-                throw new Error('inspectTransaction requires at least one instruction');
-            }
+            const plan = sdk.resolveTransactionBuildOptions(options, CAPABILITY);
+            const version = plan.transactionVersion;
+            assertBuildableInputs(instructions, options, version);
             const inspectionOptions = options;
             const commitment = inspectionOptions?.commitment ?? fallbackCommitment;
             const minContextSlot = inspectionOptions?.minContextSlot;
             const resolved = resolveTransport(config.transport, rpc, rpcSubscriptions, context);
-            const latestBlockhash = resolved.kind === 'arete'
-                ? await resolved.transport.getLatestBlockhash({ commitment, minContextSlot })
-                : (await resolved.rpc.getLatestBlockhash({ commitment, minContextSlot }).send()).value;
-            const message = kit.pipe(kit.createTransactionMessage({ version: 0 }), (m) => kit.setTransactionMessageFeePayer(kit.address(inspectionOptions?.feePayer ?? signer.address), m), (m) => kit.setTransactionMessageLifetimeUsingBlockhash(latestBlockhash, m), (m) => kit.appendTransactionMessageInstructions(instructions.map(toKitInstruction), m));
+            const latestBlockhash = await fetchLatestBlockhash(resolved, commitment, minContextSlot);
+            // Inspection is where you discover the budgets to pin, so an omitted
+            // V1 ceiling becomes the protocol maximum rather than the SIMD-0385
+            // minimum: that provisional message is what the reported metrics
+            // describe. Nothing here touches a signer — the fee payer is a bare
+            // address and the compiled transaction carries placeholder signatures.
+            const resources = version === 1 ? provisionalV1Resources(plan.resources) : plan.resources;
+            const message = planMessage({
+                version,
+                resources,
+                instructions,
+                latestBlockhash,
+                feePayer: kit.createNoopSigner(kit.address(inspectionOptions?.feePayer ?? signer.address)),
+            });
             const unsignedTransaction = kit.compileTransaction(message);
+            // The same ceiling the send path enforces: a payload that could only
+            // be rejected on submission is refused here with its byte count,
+            // rather than answered with inspection results or a backend-specific
+            // simulation error.
+            assertWithinSizeLimit(version, kit.getTransactionSize(unsignedTransaction));
             const wireTransaction = kit.getBase64EncodedWireTransaction(unsignedTransaction);
             const encodedMessage = kit.getBase64Decoder().decode(unsignedTransaction.messageBytes);
-            if (resolved.kind === 'arete') {
-                const [fee, simulation] = await Promise.all([
-                    resolved.transport.getFeeForMessage(encodedMessage, { commitment, minContextSlot }),
-                    resolved.transport.simulateTransaction(wireTransaction, { commitment, minContextSlot }),
-                ]);
-                return {
-                    feeLamports: fee.feeLamports === null ? undefined : toNumber(fee.feeLamports),
-                    logs: simulation.logs ?? undefined,
-                    computeUnitsConsumed: simulation.unitsConsumed === undefined
-                        ? undefined : toNumber(simulation.unitsConsumed),
-                    contextSlot: toNumber(simulation.contextSlot),
-                    error: simulation.err ?? undefined,
-                    loadedAccountsDataSize: simulation.loadedAccountsDataSize === undefined
-                        ? undefined : toNumber(simulation.loadedAccountsDataSize),
-                    feeContextSlot: toNumber(fee.contextSlot),
-                };
-            }
             const [fee, simulation] = await Promise.all([
-                resolved.rpc.getFeeForMessage(encodedMessage, { commitment, minContextSlot }).send(),
-                resolved.rpc.simulateTransaction(wireTransaction, {
-                    commitment,
-                    encoding: 'base64',
-                    minContextSlot,
-                    sigVerify: false,
-                }).send(),
+                estimateFee(resolved, encodedMessage, commitment, minContextSlot),
+                simulateUnsigned(resolved, wireTransaction, commitment, minContextSlot),
             ]);
-            // The RPC reports the loaded-accounts budget that @solana/kit 2.3 does
-            // not yet type. It is optional upstream and comes back as null when the
-            // node did not measure it — `Number(null)` would invent a measured zero
-            // and destroy the missing-versus-zero distinction budget estimation
-            // depends on.
-            const { loadedAccountsDataSize: directLoadedAccountsDataSize } = simulation.value;
             return {
-                feeLamports: fee.value === null ? undefined : toNumber(fee.value),
-                logs: simulation.value.logs ?? undefined,
-                computeUnitsConsumed: simulation.value.unitsConsumed == null
+                feeLamports: fee.feeLamports === undefined ? undefined : toNumber(fee.feeLamports),
+                logs: simulation.logs === undefined ? undefined : [...simulation.logs],
+                computeUnitsConsumed: simulation.unitsConsumed === undefined
+                    ? undefined
+                    : toNumber(simulation.unitsConsumed),
+                contextSlot: toNumber(simulation.contextSlot),
+                error: simulation.err ?? undefined,
+                loadedAccountsDataSize: simulation.loadedAccountsDataSize === undefined
                     ? undefined
-                    : toNumber(simulation.value.unitsConsumed),
-                contextSlot: toNumber(simulation.context.slot),
-                error: simulation.value.err ?? undefined,
-                loadedAccountsDataSize: directLoadedAccountsDataSize == null
-                    ? undefined : Number(directLoadedAccountsDataSize),
-                feeContextSlot: toNumber(fee.context.slot),
+                    : toNumber(simulation.loadedAccountsDataSize),
+                feeContextSlot: toNumber(fee.contextSlot),
+                transactionVersion: version,
+                resources: sdk.toWireResourceOptions(resources),
             };
         },
     };
 }
 
+exports.ESTIMATED_COMPUTE_UNIT_HEADROOM_PERCENT = ESTIMATED_COMPUTE_UNIT_HEADROOM_PERCENT;
 exports.KitTransactionExecutionError = KitTransactionExecutionError;
+exports.LEGACY_TRANSACTION_SIZE_LIMIT = LEGACY_TRANSACTION_SIZE_LIMIT;
+exports.LOADED_ACCOUNTS_DATA_PAGE_BYTES = LOADED_ACCOUNTS_DATA_PAGE_BYTES;
+exports.MAX_COMPUTE_UNIT_LIMIT = MAX_COMPUTE_UNIT_LIMIT;
+exports.MAX_LOADED_ACCOUNTS_DATA_SIZE = MAX_LOADED_ACCOUNTS_DATA_SIZE;
+exports.SOLANA_SIGN_AND_SEND_TRANSACTION = SOLANA_SIGN_AND_SEND_TRANSACTION;
+exports.SOLANA_SIGN_TRANSACTION = SOLANA_SIGN_TRANSACTION;
+exports.V1_MAX_ACCOUNTS = V1_MAX_ACCOUNTS;
+exports.V1_MAX_INSTRUCTIONS = V1_MAX_INSTRUCTIONS;
+exports.V1_MAX_SIGNATURES = V1_MAX_SIGNATURES;
+exports.V1_TRANSACTION_SIZE_LIMIT = V1_TRANSACTION_SIZE_LIMIT;
+exports.WalletStandardSignerError = WalletStandardSignerError;
 exports.createWalletAdapter = createWalletAdapter;
+exports.createWalletStandardSigner = createWalletStandardSigner;
+exports.estimatedComputeUnitLimit = estimatedComputeUnitLimit;
+exports.estimatedLoadedAccountsDataSize = estimatedLoadedAccountsDataSize;
 exports.fromAccountRole = fromAccountRole;
 exports.fromKitInstruction = fromKitInstruction;
 exports.toAccountRole = toAccountRole;