crypto-aio 0.0.2 → 0.1.0

package/dist/adapters/solana/proofs.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Proofs and block scanning. Each fact is attested at its own height with a monotone
+ * predicate, never at a height one endpoint proposes. "My finalized height is past H" is
+ * a quorum read of `getBlockHeight({ commitment: 'finalized' })` keyed on `height > H`;
+ * the block at a height is a quorum read of `getBlock(slot, { commitment: 'finalized' })`
+ * keyed on its consensus fields, so an endpoint that has not finalized it answers nothing
+ * and decides nothing.
+ *
+ * The expiry height itself is never taken on trust: the build read it from one endpoint,
+ * and a height reported too low would prove an Attempt expired while it can still land,
+ * so `rebuild` would pay twice. A verdict rests on the height the quorum attests for the
+ * transaction's blockhash: when the finalized block at the slot the build recorded
+ * carries it, that block's height plus `BLOCKHASH_VALIDITY` is the last valid height,
+ * whatever was recorded; otherwise the finalized block at the recorded height minus
+ * `BLOCKHASH_VALIDITY` must carry it, which confirms the recorded height without the
+ * slot. Neither decides nothing.
+ *
+ * A transaction is proven absent only by reading every block of its window
+ * under finality: each block certifies its own height and its parent's hash, from the
+ * blockhash's own block to the window's last, so a lagging, pruned, snapshot-jumped or
+ * long-term-storage-gapped backend behind a load-balanced URL can only answer "not
+ * available" (decides nothing), never a short window.
+ *
+ * Only a definitive negative proof answers "no". Every other RPC error
+ * on these paths decides nothing (`undecided`: a retryable `PROVIDER_UNAVAILABLE`).
+ *
+ * Tags: every read a verdict rests on carries the contract table's proof tags (`ChainDriver`
+ * in the core's `driver/types.ts`: purpose `proof`, quorum `'proof'`), with two deliberate
+ * exceptions, both single-endpoint `monitor` reads of hints the quorum then re-attests: the
+ * finalized height behind `finalizedHead` (the one unanchored head), and the
+ * height-to-slot lookups of `HeightIndex` (`attestedBlock`). A wrong hint names a block the
+ * quorum does not attest at that height, so it only ever decides nothing.
+ */
+import type { BlockSource, ProofSource } from '../../core/driver/types';
+import { type SolanaContext } from './reader';
+/**
+ * A blockhash is valid for this many blocks after its own: agave's `MAX_PROCESSING_AGE`
+ * (v4.3.0: `runtime/src/bank.rs` sets every bank's `max_processing_age` to it, and
+ * `get_blockhash_last_valid_block_height` answers `block_height + max_processing_age −
+ * age`, so the newest blockhash's last valid height is its block's height plus 150).
+ */
+export declare const BLOCKHASH_VALIDITY = 150n;
+/**
+ * The heights that can hold a transaction whose blockhash gives `lastValidBlockHeight`:
+ * from the block after the blockhash's own, through `lastValidBlockHeight + 1`. agave checks
+ * a blockhash's age against the including block's PARENT, so the block after
+ * `lastValidBlockHeight` still accepts it.
+ */
+export declare function windowOf(lastValidHeight: bigint): {
+    readonly first: bigint;
+    readonly end: bigint;
+};
+/** Library policy: an unanchored head trails one endpoint's view by this peer skew. */
+export declare const PEER_SKEW = 2n;
+export declare function createSolanaProofs(ctx: SolanaContext): ProofSource;
+export declare function createSolanaBlocks(ctx: SolanaContext): BlockSource;

package/dist/adapters/solana/proofs.js

@@ -0,0 +1,540 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PEER_SKEW = exports.BLOCKHASH_VALIDITY = void 0;
+exports.windowOf = windowOf;
+exports.createSolanaProofs = createSolanaProofs;
+exports.createSolanaBlocks = createSolanaBlocks;
+const error_1 = require("../../core/errors/error");
+const decode_1 = require("./decode");
+const keys_1 = require("./keys");
+const reader_1 = require("./reader");
+const rpc_1 = require("./rpc");
+/**
+ * A blockhash is valid for this many blocks after its own: agave's `MAX_PROCESSING_AGE`
+ * (v4.3.0: `runtime/src/bank.rs` sets every bank's `max_processing_age` to it, and
+ * `get_blockhash_last_valid_block_height` answers `block_height + max_processing_age −
+ * age`, so the newest blockhash's last valid height is its block's height plus 150).
+ */
+exports.BLOCKHASH_VALIDITY = 150n;
+/**
+ * The heights that can hold a transaction whose blockhash gives `lastValidBlockHeight`:
+ * from the block after the blockhash's own, through `lastValidBlockHeight + 1`. agave checks
+ * a blockhash's age against the including block's PARENT, so the block after
+ * `lastValidBlockHeight` still accepts it.
+ */
+function windowOf(lastValidHeight) {
+    const first = lastValidHeight >= exports.BLOCKHASH_VALIDITY - 1n
+        ? lastValidHeight - exports.BLOCKHASH_VALIDITY + 1n
+        : 0n;
+    return { first, end: lastValidHeight + 1n };
+}
+/** Signatures proven absent from their finalized windows, kept per driver. */
+const ABSENT_MEMO = 1_024;
+/**
+ * Window proofs in progress, kept per driver with the same bound: each window's
+ * attested frame, and how far each signature's read of it got.
+ */
+const WINDOW_MEMO = 1_024;
+/** Attested last valid heights by blockhash (immutable chain data), kept per driver. */
+const ANCHOR_MEMO = 1_024;
+/** Library policy: an unanchored head trails one endpoint's view by this peer skew. */
+exports.PEER_SKEW = 2n;
+/** Drops a bounded memo's oldest entry once it holds more than `size`. */
+function trim(memo, size) {
+    if (memo.size > size)
+        memo.delete(memo.keys().next().value);
+}
+async function finalizedHeight(ctx) {
+    return (0, rpc_1.u64)(await (0, rpc_1.call)(ctx.transport, 'getBlockHeight', [{ commitment: 'finalized' }], rpc_1.MONITOR), 'getBlockHeight');
+}
+/**
+ * Whether every quorum endpoint has finalized a block above `height`: the monotone
+ * predicate "my finalized height > height". Endpoints that disagree throw a
+ * retryable `PROVIDER_INCONSISTENT` (decides nothing); all saying no is `false`.
+ */
+async function finalizedPast(ctx, height) {
+    const past = (result) => {
+        if (typeof result === 'bigint')
+            return result > height;
+        if (typeof result === 'number' && Number.isSafeInteger(result))
+            return BigInt(result) > height;
+        throw (0, rpc_1.malformed)('getBlockHeight');
+    };
+    const result = await (0, rpc_1.call)(ctx.transport, 'getBlockHeight', [{ commitment: 'finalized' }], { ...rpc_1.PROOF, quorumKey: past });
+    return past(result);
+}
+/** Our own expiry ordering's recorded height, or `undefined` for any other ordering. */
+const lastValidOf = (ordering) => ordering.kind === 'expiry' ? ordering.lastValidHeight : undefined;
+/** The blockhash an expiry ordering names, if any (the key of the attested heights). */
+const blockhashOf = (ordering) => {
+    const { blockhash } = ordering;
+    return typeof blockhash === 'string' ? blockhash : undefined;
+};
+/**
+ * The blockhash and slot a build recorded with the height (`SolanaExpiryOrdering`). An
+ * ordering without a blockhash can never be attested: it decides nothing. A missing or
+ * ill-typed slot only leaves the slot-free check.
+ */
+function recordedOf(ordering, lastValidHeight) {
+    const { blockhash, blockhashSlot: slot } = ordering;
+    if ((0, keys_1.decodeBase58)(blockhash, 32) === null) {
+        throw new error_1.ProviderError('PROVIDER_UNAVAILABLE', 'the expiry ordering does not name the blockhash its height belongs to');
+    }
+    const exact = typeof slot === 'bigint' && slot >= 0n && slot <= BigInt(Number.MAX_SAFE_INTEGER);
+    return { lastValidHeight, blockhash: blockhash, ...(exact ? { slot } : {}) };
+}
+const BLOCKHASH_BLOCK = "the block of the transaction's blockhash";
+const LIE = 'the recorded expiry height disagrees with its blockhash; using the attested one';
+/**
+ * The height of the finalized block at `slot` when it carries `blockhash`, or
+ * `null` when the slot does not anchor it (another block there, a skipped or pruned slot,
+ * no finalized block yet). The quorum key is the block's height and whether its hash
+ * matches, so the height adopted is every endpoint's, never the first answer's. Only a
+ * hash match yields a height; a disagreement or any other error decides nothing.
+ */
+async function heightAtSlot(ctx, blockhash, slot) {
+    const key = (result) => {
+        if (result === null)
+            return null;
+        const header = (0, rpc_1.blockHeader)(result);
+        return {
+            height: header.blockHeight.toString(),
+            matches: header.blockhash === blockhash,
+        };
+    };
+    let result;
+    try {
+        result = await (0, rpc_1.call)(ctx.transport, 'getBlock', [Number(slot), (0, rpc_1.headerOptions)('finalized')], { ...rpc_1.PROOF, quorumKey: key });
+    }
+    catch (error) {
+        if ((0, rpc_1.isNotAvailable)(error))
+            return null;
+        throw (0, rpc_1.undecided)(error, BLOCKHASH_BLOCK);
+    }
+    if (result === null)
+        return null;
+    const header = (0, rpc_1.blockHeader)(result);
+    return header.blockhash === blockhash ? header.blockHeight : null;
+}
+/**
+ * The last valid height the quorum attests for a recorded expiry. agave answers
+ * `getLatestBlockhash` from one bank (its slot, its last blockhash, and that blockhash's
+ * last valid height: `block_height + MAX_PROCESSING_AGE`), so an honest record anchors at
+ * its slot. When it does, the attested block's height plus `BLOCKHASH_VALIDITY` is the
+ * answer, and a recorded height that disagrees is a build-time lie: logged (fixed text) and
+ * ignored. When the slot does not anchor the blockhash, the block at the recorded height
+ * minus `BLOCKHASH_VALIDITY` must carry it, which confirms the recorded height. Only a
+ * lie in both the slot and the height is never attested: it decides nothing, for good, so
+ * such an Operation stays unresolved but is never paid twice.
+ */
+async function attestLastValid(ctx, recorded) {
+    const at = recorded.slot === undefined
+        ? null
+        : await heightAtSlot(ctx, recorded.blockhash, recorded.slot);
+    if (at !== null) {
+        const last = at + exports.BLOCKHASH_VALIDITY;
+        if (last !== recorded.lastValidHeight)
+            ctx.log.warn(LIE);
+        return last;
+    }
+    const height = recorded.lastValidHeight - exports.BLOCKHASH_VALIDITY;
+    const block = height < 0n ? null : await attestedBlock(ctx, height, 'finalized');
+    if (!block)
+        throw (0, rpc_1.notYet)(BLOCKHASH_BLOCK);
+    if (block.header.blockhash !== recorded.blockhash) {
+        throw (0, rpc_1.inconsistent)('neither the recorded slot nor the recorded height holds the blockhash');
+    }
+    return recorded.lastValidHeight;
+}
+/**
+ * The block at `height` as the quorum serves it at `commitment`, or `null` when an endpoint
+ * cannot show it there yet. The slot of a height comes from one endpoint's block list; the
+ * quorum then attests the block itself and its height, so a wrong slot only ever decides
+ * nothing. Callers use it only for heights the quorum already holds as final (deep window
+ * starts, heights at or below an attested finalized height) or for `'latest'` checks where
+ * `null` decides nothing.
+ */
+async function attestedBlock(ctx, height, commitment) {
+    const slot = await ctx.heights.slotAt(height, commitment, rpc_1.MONITOR);
+    if (slot === null)
+        return null;
+    let result;
+    try {
+        result = await (0, rpc_1.call)(ctx.transport, 'getBlock', [Number(slot), (0, rpc_1.headerOptions)(commitment)], rpc_1.PROOF);
+    }
+    catch (error) {
+        if ((0, rpc_1.isSkipped)(error)) {
+            // The slot came from a list that named a slot with no block.
+            ctx.heights.forget();
+            throw (0, rpc_1.inconsistent)(`slot ${slot} holds no block`);
+        }
+        if ((0, rpc_1.isNotAvailable)(error))
+            return null;
+        throw (0, rpc_1.undecided)(error, `the block at height ${height}`);
+    }
+    if (result === null)
+        return null;
+    const header = (0, rpc_1.blockHeader)(result);
+    if (header.blockHeight !== height) {
+        ctx.heights.forget();
+        throw (0, rpc_1.inconsistent)(`the block at slot ${slot} is not at height ${height}`);
+    }
+    return { slot, header };
+}
+/** The frame of `anchor`'s window, attested once and then kept. */
+async function windowFrame(ctx, anchor, memo, key) {
+    const kept = memo.frames.get(key);
+    if (kept)
+        return kept;
+    const { first, end } = windowOf(anchor.lastValidHeight);
+    const top = await attestedBlock(ctx, end, 'finalized');
+    const bottom = await attestedBlock(ctx, first, 'finalized');
+    if (!top || !bottom)
+        throw (0, rpc_1.notYet)('the transaction window');
+    const listKey = (result) => {
+        if (!Array.isArray(result))
+            throw (0, rpc_1.malformed)('getBlocks');
+        return result.map(String);
+    };
+    let listed;
+    try {
+        listed = await (0, rpc_1.call)(ctx.transport, 'getBlocks', [
+            Number(bottom.slot),
+            Number(top.slot),
+            { commitment: 'finalized', minContextSlot: Number(top.slot) },
+        ], { ...rpc_1.PROOF, quorumKey: listKey });
+    }
+    catch (error) {
+        if ((0, rpc_1.isNotAvailable)(error))
+            throw (0, rpc_1.notYet)('every block of the window');
+        throw (0, rpc_1.undecided)(error, 'every block of the window');
+    }
+    if (!Array.isArray(listed) || BigInt(listed.length) !== end - first + 1n) {
+        throw (0, rpc_1.notYet)('every block of the window');
+    }
+    const frame = {
+        slots: listed.map((value) => (0, rpc_1.u64)(value, 'getBlocks slot')),
+        lastHash: top.header.blockhash,
+    };
+    memo.frames.set(key, frame);
+    trim(memo.frames, WINDOW_MEMO);
+    return frame;
+}
+/**
+ * Whether `signature` is in none of the finalized blocks of its window.
+ * The window's first and last blocks are attested by height; `getBlocks` must list exactly
+ * one slot per height between them; every block is read whole (its signatures) under the
+ * proof quorum and must sit at the next height with the previous block as its parent, the
+ * first one on the attested blockhash's own block. A gap, a pruned block or a lagging
+ * backend answers "not available" and decides nothing. `false` means a block holds the
+ * transaction. Progress is kept between passes (`WindowMemo`): a resumed pass reads on from
+ * the last verified block, chained to its hash; a chain that does not hold drops what was
+ * kept for the window, so the next pass starts over.
+ */
+async function absentFromWindow(ctx, signature, anchor, memo) {
+    const { first } = windowOf(anchor.lastValidHeight);
+    const window = `${anchor.lastValidHeight}:${anchor.blockhash}`;
+    const frame = await windowFrame(ctx, anchor, memo, window);
+    const key = `${signature}:${window}`;
+    const holds = (result) => {
+        const list = result?.signatures;
+        return Array.isArray(list) ? list.includes(signature) : null;
+    };
+    const blockKey = (result) => ({
+        ...(0, rpc_1.pick)(result, rpc_1.BLOCK_FIELDS),
+        holds: holds(result),
+    });
+    const brokenChain = (reason) => {
+        memo.frames.delete(window);
+        memo.cursors.delete(key);
+        return (0, rpc_1.inconsistent)(reason);
+    };
+    // The window hangs off the blockhash's own block, which the anchor attested.
+    let { next, parent } = memo.cursors.get(key) ?? { next: 0, parent: anchor.blockhash };
+    for (; next < frame.slots.length; next++) {
+        let block;
+        try {
+            block = await (0, rpc_1.call)(ctx.transport, 'getBlock', [
+                Number(frame.slots[next]),
+                { ...(0, rpc_1.headerOptions)('finalized'), transactionDetails: 'signatures' },
+            ], { ...rpc_1.PROOF, quorumKey: blockKey });
+        }
+        catch (error) {
+            if ((0, rpc_1.isNotAvailable)(error))
+                throw (0, rpc_1.notYet)('a block of the window');
+            throw (0, rpc_1.undecided)(error, 'a block of the window');
+        }
+        const found = holds(block);
+        if (found === null)
+            throw (0, rpc_1.notYet)('a block of the window');
+        const header = (0, rpc_1.blockHeader)(block);
+        if (header.blockHeight !== first + BigInt(next) ||
+            header.previousBlockhash !== parent) {
+            throw brokenChain('the window is not one chain of blocks');
+        }
+        if (found) {
+            memo.cursors.delete(key);
+            return false;
+        }
+        parent = header.blockhash;
+        memo.cursors.set(key, { next: next + 1, parent });
+        trim(memo.cursors, WINDOW_MEMO);
+    }
+    if (parent !== frame.lastHash) {
+        throw brokenChain('the window does not end at its attested block');
+    }
+    memo.cursors.delete(key);
+    return true;
+}
+/** The quorum's finalized transaction (`null`: every endpoint agrees it has none). */
+async function finalTransaction(ctx, signature) {
+    try {
+        return await (0, rpc_1.call)(ctx.transport, 'getTransaction', [signature, (0, rpc_1.parsedOptions)('finalized')], rpc_1.PROOF);
+    }
+    catch (error) {
+        if ((0, rpc_1.isNotAvailable)(error))
+            throw (0, rpc_1.notYet)('the transaction history');
+        throw (0, rpc_1.undecided)(error, 'the transaction history');
+    }
+}
+/** Whatever a proof method meets, no RPC error is ever a verdict. */
+function guarded(method) {
+    return async (...args) => {
+        try {
+            return await method(...args);
+        }
+        catch (error) {
+            throw (0, rpc_1.undecided)(error, 'the proof');
+        }
+    };
+}
+function createSolanaProofs(ctx) {
+    const absent = new Set();
+    const windows = { frames: new Map(), cursors: new Map() };
+    /** Attested last valid heights by blockhash: a blockhash names one block, for good. */
+    const anchors = new Map();
+    const known = (ordering) => {
+        const blockhash = blockhashOf(ordering);
+        return blockhash === undefined ? undefined : anchors.get(blockhash);
+    };
+    /** The attested last valid height of `ordering`, remembered once attested. */
+    const attested = async (ordering, recorded) => {
+        const record = recordedOf(ordering, recorded);
+        let last = anchors.get(record.blockhash);
+        if (last === undefined) {
+            last = await attestLastValid(ctx, record);
+            anchors.set(record.blockhash, last);
+            trim(anchors, ANCHOR_MEMO);
+        }
+        return { lastValidHeight: last, blockhash: record.blockhash };
+    };
+    /**
+     * While the recorded height has not passed, the last valid height the recorded
+     * slot alone attests (no height fallback), remembered as `attested` remembers it. A build
+     * that raised the recorded height would otherwise wait for that height, possibly for
+     * ever, although the real window has passed. `undefined` (not yet) when no slot was
+     * recorded, the slot does not hold the blockhash, or it cannot be read.
+     */
+    const attestedAtSlot = async (ordering, recorded) => {
+        let record;
+        let at;
+        try {
+            record = recordedOf(ordering, recorded);
+            if (record.slot === undefined)
+                return undefined;
+            at = await heightAtSlot(ctx, record.blockhash, record.slot);
+        }
+        catch {
+            return undefined;
+        }
+        if (at === null)
+            return undefined;
+        const last = at + exports.BLOCKHASH_VALIDITY;
+        if (last !== recorded)
+            ctx.log.warn(LIE);
+        anchors.set(record.blockhash, last);
+        trim(anchors, ANCHOR_MEMO);
+        return last;
+    };
+    /**
+     * A finalized `getTransaction` answer, read under that method's quorum key, is the only
+     * verdict input (never a block's entry): the transaction asked for, in the finalized
+     * block at its slot, with the landing guard applied.
+     */
+    const included = async (result, signature, from) => {
+        const parsed = (0, decode_1.parseTransaction)(result, signature);
+        if (parsed.slot === undefined)
+            throw (0, rpc_1.malformed)('getTransaction');
+        let header;
+        try {
+            const block = await (0, rpc_1.call)(ctx.transport, 'getBlock', [Number(parsed.slot), (0, rpc_1.headerOptions)('finalized')], rpc_1.PROOF);
+            header = block === null ? null : (0, rpc_1.blockHeader)(block);
+        }
+        catch (error) {
+            if (!(0, rpc_1.isNotAvailable)(error))
+                throw (0, rpc_1.undecided)(error, 'the block of the transaction');
+            header = null;
+        }
+        if (!header)
+            throw (0, rpc_1.notYet)('the block of the transaction');
+        // Our own token transfers count only when the balances show them. The reasons are
+        // `observe`'s fixed texts, so the proven failure keeps the observed one.
+        const reason = parsed.err !== null
+            ? 'transaction failed'
+            : (0, decode_1.tokenTransfersLanded)(parsed, from)
+                ? undefined
+                : 'token transfer failed';
+        return {
+            included: true,
+            success: reason === undefined,
+            blockHeight: header.blockHeight,
+            blockHash: header.blockhash,
+            txHash: signature,
+            ...(reason !== undefined ? { reason } : {}),
+        };
+    };
+    const proofs = {
+        async finalizedHead() {
+            // The one unanchored head: one endpoint's view, trailed by a peer skew.
+            const seen = await finalizedHeight(ctx);
+            const height = seen > exports.PEER_SKEW ? seen - exports.PEER_SKEW : 0n;
+            const block = await attestedBlock(ctx, height, 'finalized');
+            if (!block)
+                throw (0, rpc_1.notYet)('the finalized head');
+            return {
+                height,
+                hash: block.header.blockhash,
+                ...(block.header.blockTime !== undefined
+                    ? { timestamp: block.header.blockTime }
+                    : {}),
+            };
+        },
+        async includedFinal(ref, ordering, from) {
+            // A malformed signature can never be on chain.
+            if (!(0, keys_1.isSignature)(ref.id))
+                return { included: false };
+            const found = await finalTransaction(ctx, ref.id);
+            if (found !== null)
+                return included(found, ref.id, from);
+            // An index that shows nothing proves nothing; only the window can. Behind one URL,
+            // `getTransaction` may reach a backend that lags, was pruned or jumped to a
+            // snapshot, and agave ignores its `minContextSlot`.
+            const recorded = lastValidOf(ordering);
+            if (recorded === undefined)
+                throw (0, rpc_1.notYet)('proof that the transaction is absent');
+            const remembered = known(ordering);
+            if (remembered !== undefined && absent.has(`${ref.id}:${remembered}`)) {
+                return { included: false };
+            }
+            // The window's last block (lastValidBlockHeight + 1) is final everywhere, at the
+            // attested height. An early "no" at the recorded one only delays, unless the
+            // recorded slot attests another height: its predicate is asked below.
+            const pastWindow = () => (0, rpc_1.notYet)('finality past the transaction window');
+            if (remembered === undefined && !(await finalizedPast(ctx, recorded))) {
+                const bySlot = await attestedAtSlot(ordering, recorded);
+                if (bySlot === undefined || bySlot === recorded)
+                    throw pastWindow();
+            }
+            const anchor = await attested(ordering, recorded);
+            const last = anchor.lastValidHeight;
+            if (last !== recorded || remembered !== undefined) {
+                if (!(await finalizedPast(ctx, last)))
+                    throw pastWindow();
+            }
+            const key = `${ref.id}:${last}`;
+            if (!absent.has(key)) {
+                if (!(await absentFromWindow(ctx, ref.id, anchor, windows))) {
+                    throw (0, rpc_1.inconsistent)('a block of the window holds a transaction its index does not show');
+                }
+                absent.add(key);
+                trim(absent, ABSENT_MEMO);
+            }
+            return { included: false };
+        },
+        // Expiry ordering has no slot that another transaction could consume.
+        slotConsumed: async () => false,
+        async expired(ordering) {
+            const recorded = lastValidOf(ordering);
+            // "Not expired" is the safe answer: it never declares a transaction dead.
+            if (recorded === undefined)
+                return false;
+            const remembered = known(ordering);
+            if (remembered !== undefined)
+                return finalizedPast(ctx, remembered);
+            // An early "no" at the recorded height only delays, unless the recorded slot attests
+            // another height: then that height's own predicate answers.
+            if (!(await finalizedPast(ctx, recorded))) {
+                const bySlot = await attestedAtSlot(ordering, recorded);
+                return bySlot !== undefined && bySlot !== recorded && finalizedPast(ctx, bySlot);
+            }
+            // "Expired" rests on the attested height, and its own predicate read.
+            const { lastValidHeight } = await attested(ordering, recorded);
+            return lastValidHeight === recorded || finalizedPast(ctx, lastValidHeight);
+        },
+        async blockHash(height, level) {
+            // Null above the finalized height decides nothing; so does any endpoint that has
+            // not finalized `height` yet (the attested read answers nothing there).
+            if (level === 'finalized' && !(await finalizedPast(ctx, height - 1n)))
+                return null;
+            const block = await attestedBlock(ctx, height, level === 'finalized' ? 'finalized' : 'confirmed');
+            return block?.header.blockhash ?? null;
+        },
+    };
+    return {
+        finalizedHead: guarded(proofs.finalizedHead),
+        includedFinal: guarded(proofs.includedFinal),
+        slotConsumed: guarded(proofs.slotConsumed),
+        expired: guarded(proofs.expired),
+        blockHash: guarded(proofs.blockHash),
+    };
+}
+const changed = (height) => (0, rpc_1.inconsistent)(`block ${height} changed while scanning`);
+function createSolanaBlocks(ctx) {
+    return {
+        header: async (height) => (await (0, reader_1.blockAtHeight)(ctx, height, rpc_1.MONITOR))?.block ?? null,
+        async transactions(block, filter) {
+            const slot = await ctx.heights.slotAt(block.height, 'confirmed', rpc_1.MONITOR);
+            if (slot === null)
+                throw changed(block.height);
+            let result;
+            try {
+                result = await (0, rpc_1.call)(ctx.transport, 'getBlock', [
+                    Number(slot),
+                    { ...(0, rpc_1.parsedOptions)('confirmed'), transactionDetails: 'full', rewards: false },
+                ], rpc_1.MONITOR);
+            }
+            catch (error) {
+                if ((0, rpc_1.isGone)(error))
+                    throw (0, rpc_1.gone)(`the block at height ${block.height}`);
+                // A slot the index named holds no block: drop the cache it came from.
+                if ((0, rpc_1.isSkipped)(error))
+                    ctx.heights.forget();
+                if ((0, rpc_1.isNotAvailable)(error))
+                    throw changed(block.height);
+                // Any other node error decides nothing; the scan retries.
+                throw (0, rpc_1.undecided)(error, `the block at height ${block.height}`);
+            }
+            const full = result;
+            if (!full || full.blockhash !== block.hash)
+                throw changed(block.height);
+            if (!Array.isArray(full.transactions))
+                throw (0, rpc_1.malformed)('getBlock');
+            const wanted = filter?.addresses?.length ? new Set(filter.addresses) : undefined;
+            const place = {
+                height: block.height,
+                hash: block.hash,
+                ...(block.timestamp !== undefined ? { blockTime: block.timestamp } : {}),
+            };
+            // All or nothing: a transaction that does not parse makes the whole block retry
+            // (retryable), never a block read short.
+            return full.transactions.flatMap((entry) => {
+                const parsed = (0, decode_1.parseTransaction)(entry);
+                if ((0, decode_1.isVote)(parsed))
+                    return [];
+                const decoded = (0, decode_1.decodeTransaction)(parsed, place);
+                return !wanted || (0, decode_1.touches)(decoded, parsed, wanted) ? [decoded] : [];
+            });
+        },
+    };
+}
+//# sourceMappingURL=proofs.js.map