crypto-aio 0.0.2 → 0.1.0

package/dist/adapters/solana/builder.js

@@ -0,0 +1,545 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSolanaBuilder = createSolanaBuilder;
+exports.createSolanaBroadcaster = createSolanaBroadcaster;
+const error_1 = require("../../core/errors/error");
+const asset_1 = require("../../core/model/asset");
+const fee_1 = require("../../core/model/fee");
+const bytes_1 = require("../../core/util/bytes");
+const errors_1 = require("./errors");
+const fees_1 = require("./fees");
+const keys_1 = require("./keys");
+const programs_1 = require("./programs");
+const reader_1 = require("./reader");
+const rpc_1 = require("./rpc");
+const wire_1 = require("./wire");
+const invalid = (reason) => new error_1.ValidationError('INVALID_INTENT', reason);
+/** A UTF-16 surrogate without its pair: text that has no UTF-8 encoding. */
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+const U64_MAX = 2n ** 64n - 1n;
+const SIGNATURE_BYTES = 64;
+/** The longest text of a packet-sized transaction: 1,644 base64 characters, 2,464 hex. */
+const MAX_BASE64_CHARS = 4 * Math.ceil(programs_1.MAX_TRANSACTION_SIZE / 3);
+const MAX_HEX_CHARS = 2 * programs_1.MAX_TRANSACTION_SIZE;
+const TOO_LARGE = `the transaction exceeds ${programs_1.MAX_TRANSACTION_SIZE} bytes`;
+/** Every node refuses a transaction over the packet limit; it is refused here, unsent. */
+const REFUSED_TOO_LARGE = Object.freeze({
+    kind: 'refused',
+    code: 'TX_REFUSED',
+    reason: 'transaction too large',
+});
+function onlyOutput(intent) {
+    const output = intent.outputs[0];
+    if (!output || intent.outputs.length !== 1) {
+        throw invalid('Solana transfers have exactly one output');
+    }
+    return output;
+}
+const addressOf = (publicKey) => {
+    try {
+        return (0, keys_1.addressFromPublicKey)(publicKey);
+    }
+    catch {
+        return null;
+    }
+};
+/** The wallet's ed25519 key whose address is the sending address. */
+function keyOf(from, keys) {
+    const key = keys.find((k) => k.scheme === 'ed25519' && addressOf(k.publicKey) === from);
+    if (!key) {
+        throw new error_1.SigningError('SIGNER_UNAVAILABLE', 'no ed25519 key for the sending address');
+    }
+    return key;
+}
+/** At most 256 UTF-8 bytes of well-formed text (the intent's policy, not `memo()`'s). */
+function memoOf(text) {
+    if (text === undefined)
+        return undefined;
+    if (LONE_SURROGATE.test(text))
+        throw invalid('the memo is not well-formed Unicode text');
+    if (new TextEncoder().encode(text).length > programs_1.MAX_MEMO_BYTES) {
+        throw invalid(`the memo exceeds ${programs_1.MAX_MEMO_BYTES} UTF-8 bytes`);
+    }
+    return text;
+}
+async function rentExemptMinimum(ctx, bytes, tags) {
+    return (0, rpc_1.u64)(await (0, rpc_1.call)(ctx.transport, 'getMinimumBalanceForRentExemption', [bytes, { commitment: 'confirmed' }], tags), 'getMinimumBalanceForRentExemption');
+}
+/**
+ * The classic token account of `owner` for `mint` at its associated address, or `null`
+ * while that account is not created. An address that only holds lamports is not created
+ * yet: the ATA program keeps those lamports when it creates the account, so nobody can
+ * block a transfer by funding the address first. Anything else there is not the owner's
+ * account for the mint (a reassigned owner included), and is refused.
+ */
+async function associatedAccount(ctx, address, owner, mint, whose, tags) {
+    const info = await (0, reader_1.accountInfo)(ctx, address, tags);
+    if (!info ||
+        (info.owner === programs_1.SYSTEM_PROGRAM && !info.executable && info.data.length === 0)) {
+        return null;
+    }
+    const account = info.owner === programs_1.TOKEN_PROGRAM ? (0, programs_1.decodeTokenAccount)(info.data) : null;
+    if (!account ||
+        (0, keys_1.encodeBase58)(account.owner) !== owner ||
+        (0, keys_1.encodeBase58)(account.mint) !== mint) {
+        throw invalid(`the ${whose} token account does not match`);
+    }
+    return { amount: account.amount, frozen: account.frozen };
+}
+/**
+ * Where a transfer pays the recipient `to` (the binding the landing guard trusts): SOL to
+ * `to` itself; SPL into `to`'s associated token account for the mint, derived with the
+ * mint's own program, classic Token (`mintDecimals` refuses every other owner).
+ */
+const destinationOf = (ctx, to, mint) => mint === undefined ? to : ctx.codec.associatedTokenAddress(to, mint);
+function tokenPlan(ctx, from, to, mint, decimals) {
+    return {
+        mint,
+        decimals,
+        source: ctx.codec.associatedTokenAddress(from, mint),
+        destination: destinationOf(ctx, to, mint),
+    };
+}
+/** The one output and the recipient's on-chain checks (no key: a fee needs none). */
+async function planTransfer(ctx, intent, tags) {
+    const output = onlyOutput(intent);
+    const { from } = intent;
+    const text = memoOf(intent.memo);
+    const base = {
+        from,
+        to: output.to,
+        amount: output.amount,
+        ...(text !== undefined ? { memo: text } : {}),
+    };
+    const recipient = output.to === from ? null : await (0, reader_1.accountInfo)(ctx, output.to, tags);
+    if (intent.asset === 'native') {
+        if (recipient && (recipient.executable || recipient.owner !== programs_1.SYSTEM_PROGRAM)) {
+            throw invalid('the recipient is a program-owned account');
+        }
+        if (!recipient &&
+            output.to !== from &&
+            output.amount < (await rentExemptMinimum(ctx, 0, tags))) {
+            throw new error_1.ValidationError('INVALID_AMOUNT', 'a new account needs at least the rent-exempt minimum');
+        }
+        return { ...base, createsRecipientAccount: false };
+    }
+    const mint = (0, reader_1.mintOf)(intent.asset);
+    // Token metadata under the proof quorum, with the caller's signal: the decimals are
+    // signed into `transferChecked`, so a lagging endpoint without the mint decides
+    // nothing.
+    const decimals = await (0, reader_1.mintDecimals)(ctx, mint, (0, rpc_1.withSignal)(reader_1.METADATA, tags.signal));
+    // Nobody can sign for a program's associated token account.
+    if (recipient?.executable) {
+        throw invalid('the recipient is a program; send to a wallet or a PDA owner');
+    }
+    if (recipient &&
+        (recipient.owner === programs_1.TOKEN_PROGRAM || recipient.owner === programs_1.TOKEN_2022_PROGRAM)) {
+        throw invalid('the recipient is a token account; send to its owner');
+    }
+    const token = tokenPlan(ctx, from, output.to, mint, decimals);
+    const existing = await associatedAccount(ctx, token.destination, output.to, mint, 'recipient', tags);
+    if (existing?.frozen)
+        throw invalid('the recipient token account is frozen');
+    return { ...base, token, createsRecipientAccount: existing === null };
+}
+/** The transfer's own instructions (no compute budget). */
+function transferInstructions(plan) {
+    const list = [];
+    const { token } = plan;
+    if (token) {
+        if (plan.createsRecipientAccount) {
+            list.push((0, programs_1.createAssociatedTokenAccountIdempotent)(plan.from, token.destination, plan.to, token.mint));
+        }
+        list.push((0, programs_1.transferChecked)(token.source, token.mint, token.destination, plan.from, plan.amount, token.decimals));
+    }
+    else {
+        list.push((0, programs_1.systemTransfer)(plan.from, plan.to, plan.amount));
+    }
+    if (plan.memo !== undefined)
+        list.push((0, programs_1.memo)(plan.memo));
+    return list;
+}
+const withBudget = (limit, price, list) => [
+    (0, programs_1.setComputeUnitLimit)(limit),
+    (0, programs_1.setComputeUnitPrice)(price),
+    ...list,
+];
+/**
+ * The newest blockhash at `confirmed`, its last valid height, and the slot of its block:
+ * agave answers from one bank (`rpc.rs` `get_latest_blockhash`: the bank's last blockhash,
+ * that blockhash's last valid height, and `new_response`'s context slot, the bank's own).
+ * One endpoint's word: proofs attest the three together before using the height.
+ */
+async function latestBlockhash(ctx, tags) {
+    const result = await (0, rpc_1.call)(ctx.transport, 'getLatestBlockhash', [{ commitment: 'confirmed' }], tags);
+    const value = (0, rpc_1.contextValue)(result, 'getLatestBlockhash');
+    if (!value || (0, keys_1.decodeBase58)(value.blockhash, 32) === null) {
+        throw (0, rpc_1.malformed)('getLatestBlockhash');
+    }
+    return {
+        blockhash: value.blockhash,
+        lastValidBlockHeight: (0, rpc_1.u64)(value.lastValidBlockHeight, 'lastValidBlockHeight'),
+        slot: (0, rpc_1.u64)((0, rpc_1.record)((0, rpc_1.record)(result)?.context)?.slot, 'getLatestBlockhash context slot'),
+    };
+}
+const base64 = (bytes) => Buffer.from(bytes).toString('base64');
+/** Whether `bytes` (a key read from a message) is the key `address`. */
+function isKey(bytes, address) {
+    const expected = (0, keys_1.decodeBase58)(address, 32);
+    return bytes !== undefined && expected !== null && (0, bytes_1.equalBytes)(bytes, expected);
+}
+/** The transaction with a zero signature for each required signer. */
+const withPlaceholders = (parts, message) => (0, wire_1.signedTransaction)(Array.from({ length: parts.required }, () => new Uint8Array(SIGNATURE_BYTES)), message);
+/**
+ * A compiled message read back from its bytes before it is simulated, quoted or signed: one
+ * legacy message (a `null` from the reader is a refusal, never "no signers needed") whose
+ * only signer is `from`, the fee payer, and whose transaction fits the packet limit.
+ */
+function readBack(message, from) {
+    const parts = (0, wire_1.parseMessage)(message);
+    if (!parts)
+        throw invalid('the compiled message is not one legacy message');
+    if (parts.required !== 1 || !isKey(parts.keys[0], from)) {
+        throw invalid('the compiled message has unexpected signers');
+    }
+    if (withPlaceholders(parts, message).length > programs_1.MAX_TRANSACTION_SIZE) {
+        throw invalid(TOO_LARGE);
+    }
+    return parts;
+}
+const isWritable = (parts, index) => index < parts.required
+    ? index < parts.required - parts.readonlySigned
+    : index < parts.keys.length - parts.readonlyUnsigned;
+/** A little-endian u64 of `data` at `at`, or `null` when the data is too short. */
+const u64At = (data, at) => data.length < at + 8
+    ? null
+    : new DataView(data.buffer, data.byteOffset + at, 8).getBigUint64(0, true);
+/**
+ * The recipient binding the landing guard trusts, read from the bytes and re-derived from
+ * the intent alone: exactly one transfer (System `Transfer`, or Token `TransferChecked`)
+ * moves the intent's amount into `destinationOf` the intent's recipient. The sender is
+ * bound by `readBack`: it is the message's only signer.
+ */
+function checkRecipient(ctx, parts, output, mint) {
+    const program = mint === undefined ? programs_1.SYSTEM_PROGRAM : programs_1.TOKEN_PROGRAM;
+    // The destination's position and the amount's offset: System [from, to], data
+    // [u32 2, u64 lamports]; Token [source, mint, destination, authority], data
+    // [12, u64 amount, u8 decimals].
+    const [destination, amountAt] = mint === undefined ? [1, 4] : [2, 1];
+    const transfers = parts.instructions.filter((ix) => isKey(parts.keys[ix.program], program));
+    const transfer = transfers[0];
+    if (transfers.length !== 1 ||
+        !transfer ||
+        !isKey(parts.keys[transfer.accounts[destination]], destinationOf(ctx, output.to, mint)) ||
+        u64At(transfer.data, amountAt) !== output.amount) {
+        throw invalid('the transfer does not pay the recipient');
+    }
+}
+/**
+ * The bytes carry exactly `list` on `blockhash`: each instruction's program, accounts and
+ * data, and no other instruction. An account the list writes must be writable (the message
+ * merges flags per key); its signers are `readBack`'s.
+ */
+function checkInstructions(parts, blockhash, list) {
+    const mismatch = () => invalid('the compiled message does not match the transfer');
+    if (!isKey(parts.blockhash, blockhash) || parts.instructions.length !== list.length) {
+        throw mismatch();
+    }
+    list.forEach((expected, i) => {
+        const found = parts.instructions[i];
+        if (!found ||
+            !isKey(parts.keys[found.program], expected.programId) ||
+            found.accounts.length !== expected.accounts.length ||
+            !(0, bytes_1.equalBytes)(found.data, expected.data)) {
+            throw mismatch();
+        }
+        expected.accounts.forEach((account, j) => {
+            const index = found.accounts[j];
+            if (!isKey(parts.keys[index], account.address) ||
+                (account.writable && !isWritable(parts, index))) {
+                throw mismatch();
+            }
+        });
+    });
+}
+/** The simulated compute units of the transfer, or `null` when it cannot be measured. */
+async function simulatedUnits(ctx, from, price, list, blockhash, tags) {
+    const message = ctx.codec.compileMessage(from, blockhash, withBudget(programs_1.MAX_COMPUTE_UNIT_LIMIT, price, list));
+    const unsignedTx = withPlaceholders(readBack(message, from), message);
+    const value = (0, rpc_1.contextValue)(await (0, rpc_1.call)(ctx.transport, 'simulateTransaction', [
+        base64(unsignedTx),
+        {
+            encoding: 'base64',
+            sigVerify: false,
+            replaceRecentBlockhash: true,
+            commitment: 'confirmed',
+        },
+    ], tags), 'simulateTransaction');
+    if (!value)
+        throw (0, rpc_1.malformed)('simulateTransaction');
+    // A failing simulation (e.g. insufficient funds) still lets `checkFunds` explain itself.
+    if (value.err !== null || value.unitsConsumed === undefined)
+        return null;
+    return (0, rpc_1.u64)(value.unitsConsumed, 'unitsConsumed');
+}
+/**
+ * The base64 wire bytes of a signed transaction, or `null` when they exceed the packet
+ * limit. The text is capped before it is decoded, and only a canonical text is
+ * read: `Buffer` skips what it cannot decode, and a truncated transaction is never sent.
+ */
+function wirePayload(raw) {
+    const { encoding, data } = raw;
+    if (encoding === 'json')
+        throw invalid('a Solana transaction is bytes (base64 or hex)');
+    if (typeof data !== 'string')
+        throw invalid('a Solana transaction is a text of bytes');
+    if (data.length > (encoding === 'hex' ? MAX_HEX_CHARS : MAX_BASE64_CHARS))
+        return null;
+    const bytes = Buffer.from(data, encoding);
+    const canonical = encoding === 'hex'
+        ? bytes.toString('hex') === data.toLowerCase()
+        : bytes.toString('base64') === data;
+    if (!canonical)
+        throw invalid(`the transaction is not canonical ${encoding}`);
+    return bytes.length > programs_1.MAX_TRANSACTION_SIZE ? null : bytes.toString('base64');
+}
+function createSolanaBuilder(ctx) {
+    return {
+        async estimateFee(intent, build) {
+            const tags = (0, rpc_1.withSignal)(rpc_1.READ, build.signal);
+            // The handle's bound, which no endpoint can raise. An explicit price above it is
+            // refused before any request; a speed's is clamped below it.
+            const bound = ctx.config.maxComputeUnitPrice;
+            const override = (0, fee_1.isFeeSpeed)(intent.fee) ? undefined : (0, fees_1.parseOverride)(intent.fee);
+            if (override && override.computeUnitPrice > bound) {
+                throw (0, fees_1.aboveMaxPrice)(override.computeUnitPrice, bound);
+            }
+            const plan = await planTransfer(ctx, intent, tags);
+            const list = transferInstructions(plan);
+            const variant = (0, fees_1.variantOffsets)(ctx.nextVariant());
+            let price;
+            if (override) {
+                price = override.computeUnitPrice;
+            }
+            else {
+                const writable = plan.token
+                    ? [plan.from, plan.token.source, plan.token.destination]
+                    : [plan.from, plan.to];
+                const recent = await (0, rpc_1.call)(ctx.transport, 'getRecentPrioritizationFees', [writable], tags);
+                price = (0, fees_1.speedPrice)((0, fees_1.priceForSpeed)(recent, intent.fee), variant.price, bound);
+            }
+            const { blockhash } = await latestBlockhash(ctx, tags);
+            let base = override?.computeUnitLimit;
+            if (base === undefined) {
+                const units = await simulatedUnits(ctx, plan.from, price, list, blockhash, tags);
+                base =
+                    units === null
+                        ? (0, fees_1.fallbackComputeUnitLimit)(list.length)
+                        : (0, fees_1.computeUnitLimitFor)(units);
+            }
+            // Every build varies the limit, an explicit one included, so identical transfers
+            // sign different bytes (the price of an explicit fee is kept exactly). At the
+            // protocol maximum no variant fits, and only the core's guard against two
+            // Operations sharing one Attempt ref keeps them apart.
+            const limit = base + variant.limit > programs_1.MAX_COMPUTE_UNIT_LIMIT
+                ? programs_1.MAX_COMPUTE_UNIT_LIMIT
+                : base + variant.limit;
+            // A fee is a u64 of lamports. An explicit price without one is the
+            // caller's; a node's recent prices or quote without one decide nothing (retryable).
+            const unpriced = (what) => override
+                ? invalid('Solana fee override: the fee does not fit in u64')
+                : (0, rpc_1.malformed)(what);
+            const priority = (0, fees_1.priorityFee)(price, limit);
+            if (priority > U64_MAX)
+                throw unpriced('getRecentPrioritizationFees');
+            const message = ctx.codec.compileMessage(plan.from, blockhash, withBudget(limit, price, list));
+            readBack(message, plan.from);
+            const quoted = (0, rpc_1.contextValue)(await (0, rpc_1.call)(ctx.transport, 'getFeeForMessage', [base64(message), { commitment: 'confirmed' }], tags), 'getFeeForMessage');
+            // `null`: the endpoint does not know the blockhash yet.
+            if (quoted === null)
+                throw (0, rpc_1.notYet)('the fee of the message');
+            const total = (0, rpc_1.u64)(quoted, 'getFeeForMessage');
+            // agave's fee arithmetic saturates: a quote of u64::MAX is no fee.
+            if (total === U64_MAX)
+                throw unpriced('getFeeForMessage');
+            if (total < priority)
+                throw (0, rpc_1.malformed)('getFeeForMessage');
+            const details = {
+                signatures: 1,
+                baseFee: total - priority,
+                computeUnitLimit: limit,
+                computeUnitPrice: price,
+                priorityFee: priority,
+                rent: plan.createsRecipientAccount
+                    ? await rentExemptMinimum(ctx, programs_1.TOKEN_ACCOUNT_SIZE, tags)
+                    : 0n,
+                createsRecipientAccount: plan.createsRecipientAccount,
+            };
+            return (0, fees_1.feeDraft)(override ? 'custom' : intent.fee, details);
+        },
+        async checkFunds(intent, fee, build) {
+            const output = onlyOutput(intent);
+            const tags = (0, rpc_1.withSignal)(rpc_1.READ, build.signal);
+            const balance = (0, rpc_1.u64)((0, rpc_1.contextValue)(await (0, rpc_1.call)(ctx.transport, 'getBalance', [intent.from, { commitment: 'confirmed' }], tags), 'getBalance'), 'balance');
+            if (intent.asset !== 'native') {
+                const mint = (0, reader_1.mintOf)(intent.asset);
+                const source = await associatedAccount(ctx, ctx.codec.associatedTokenAddress(intent.from, mint), intent.from, mint, 'source', tags);
+                if (source?.frozen)
+                    throw invalid('the source token account is frozen');
+                const available = source?.amount ?? 0n;
+                if (available < output.amount) {
+                    return { ok: false, asset: intent.asset, required: output.amount, available };
+                }
+            }
+            // A system account may end at 0 or at the rent-exempt minimum, nothing in between.
+            const spent = (0, fees_1.lamportsCharged)(fee) + (intent.asset === 'native' ? output.amount : 0n);
+            const minimum = await rentExemptMinimum(ctx, 0, tags);
+            if (balance < spent) {
+                return { ok: false, asset: 'native', required: spent, available: balance };
+            }
+            const left = balance - spent;
+            if (left !== 0n && left < minimum) {
+                return {
+                    ok: false,
+                    asset: 'native',
+                    required: spent + minimum,
+                    available: balance,
+                };
+            }
+            return { ok: true };
+        },
+        async build(intent, fee, build) {
+            const output = onlyOutput(intent);
+            const details = (0, fees_1.signedFee)(fee, ctx.config.maxComputeUnitPrice);
+            const key = keyOf(intent.from, build.keys);
+            const text = memoOf(intent.memo);
+            const tags = (0, rpc_1.withSignal)(rpc_1.READ, build.signal);
+            const mint = intent.asset === 'native' ? undefined : (0, reader_1.mintOf)(intent.asset);
+            const plan = {
+                from: intent.from,
+                to: output.to,
+                amount: output.amount,
+                ...(text !== undefined ? { memo: text } : {}),
+                createsRecipientAccount: details.createsRecipientAccount,
+                ...(mint === undefined
+                    ? {}
+                    : {
+                        token: tokenPlan(ctx, intent.from, output.to, mint, await (0, reader_1.mintDecimals)(ctx, mint, (0, rpc_1.withSignal)(reader_1.METADATA, build.signal))),
+                    }),
+            };
+            const list = withBudget(details.computeUnitLimit, details.computeUnitPrice, transferInstructions(plan));
+            const { blockhash, lastValidBlockHeight, slot } = await latestBlockhash(ctx, tags);
+            // The payload, the signing request and the ordering all come from this one message,
+            // read back before it is offered for signing.
+            const message = ctx.codec.compileMessage(plan.from, blockhash, list);
+            const parts = readBack(message, plan.from);
+            checkRecipient(ctx, parts, output, mint);
+            checkInstructions(parts, blockhash, list);
+            // The height, with the blockhash and slot that let a proof attest it.
+            const ordering = {
+                kind: 'expiry',
+                lastValidHeight: lastValidBlockHeight,
+                blockhash,
+                blockhashSlot: slot,
+            };
+            const unsigned = {
+                payload: { encoding: 'base64', data: base64(message) },
+                signingRequests: [
+                    {
+                        id: 's0',
+                        scheme: 'ed25519',
+                        payload: message,
+                        payloadKind: 'message',
+                        publicKey: key.publicKey,
+                        ...(key.keyRef ? { keyRef: key.keyRef } : {}),
+                    },
+                ],
+                ordering,
+                fee,
+                summary: {
+                    asset: (0, asset_1.assetId)(ctx.chain.id, ctx.network.id, intent.asset),
+                    outputs: [{ to: output.to, amount: output.amount.toString() }],
+                    ...(text !== undefined ? { memo: text } : {}),
+                },
+            };
+            return unsigned;
+        },
+        async assemble(unsigned, signatures) {
+            const failed = (reason) => new error_1.SigningError('SIGNING_FAILED', reason);
+            const mismatch = () => failed('the message and its signing requests do not match');
+            const { encoding, data } = unsigned.payload;
+            if (encoding !== 'base64')
+                throw failed('not a Solana message');
+            const message = new Uint8Array(Buffer.from(data, 'base64'));
+            if (base64(message) !== data)
+                throw failed('not a Solana message');
+            // A `null` is a refusal, never "no signers needed": one request per required signer.
+            const parts = (0, wire_1.parseMessage)(message);
+            if (!parts || parts.required !== unsigned.signingRequests.length)
+                throw mismatch();
+            // The core stores this `ordering` as the Attempt's, and the expiry proof reads its
+            // blockhash as the message's. A changed one between build and signing would
+            // misplace the window.
+            const ordering = unsigned.ordering;
+            if (ordering.kind !== 'expiry' ||
+                typeof ordering.blockhash !== 'string' ||
+                !isKey(parts.blockhash, ordering.blockhash) ||
+                typeof ordering.lastValidHeight !== 'bigint' ||
+                typeof ordering.blockhashSlot !== 'bigint') {
+                throw failed("the Attempt's ordering does not match the signed message");
+            }
+            const bytes = unsigned.signingRequests.map((request, i) => {
+                if (request.scheme !== 'ed25519' ||
+                    request.payloadKind !== 'message' ||
+                    !(0, bytes_1.equalBytes)(request.publicKey, parts.keys[i]) ||
+                    !(0, bytes_1.equalBytes)(request.payload, message)) {
+                    throw mismatch();
+                }
+                const signature = signatures.find((s) => s.requestId === request.id);
+                if (!signature || signature.bytes.length !== SIGNATURE_BYTES) {
+                    throw failed(`missing signature for request ${request.id}`);
+                }
+                return signature.bytes;
+            });
+            const raw = (0, wire_1.signedTransaction)(bytes, message);
+            if (raw.length > programs_1.MAX_TRANSACTION_SIZE)
+                throw failed(TOO_LARGE);
+            return {
+                raw: { encoding: 'base64', data: base64(raw) },
+                ref: {
+                    id: (0, keys_1.encodeBase58)(bytes[0]),
+                    idKind: 'signature',
+                    canonical: true,
+                },
+            };
+        },
+    };
+}
+function createSolanaBroadcaster(ctx) {
+    return {
+        async broadcast(signed, options = {}) {
+            const payload = wirePayload(signed.raw);
+            if (payload === null)
+                return REFUSED_TOO_LARGE;
+            try {
+                await (0, rpc_1.call)(ctx.transport, 'sendTransaction', [payload, { encoding: 'base64', preflightCommitment: 'confirmed' }], {
+                    ...(0, rpc_1.withSignal)(rpc_1.BROADCAST, options.signal),
+                    ...(options.fanout !== undefined ? { fanout: options.fanout } : {}),
+                });
+                return { kind: 'accepted' };
+            }
+            catch (error) {
+                // Only a definitive, non-ambiguous node answer is classified: by its code, then
+                // its structured data (a preflight failure's simulation result), then its
+                // anchored text. Anything else may have been sent: rethrown unchanged. A claimed
+                // bad signature stands only when these bytes carry one.
+                const code = (0, rpc_1.rpcCode)(error);
+                if (code === undefined)
+                    throw error;
+                const failure = error;
+                return (0, errors_1.classifyOwnBroadcast)(Buffer.from(payload, 'base64'), code, (0, rpc_1.rpcMessage)(failure), failure.details?.rpcData);
+            }
+        },
+    };
+}
+//# sourceMappingURL=builder.js.map