One Wallet Approval Can Create an Expiring NiceChunk Pass—but It Does Not Sandbox the Key

    <script type="module" src="./main.js"></script>

This repository source tag declares the intended production /play/ source route through /play/main.js and play/*. It is not the retained live served byte route: the 2026-07-19 Nginx snapshot returned a versioned bundle from /play/index.html.

1. Line 1

   Load main.js as an ES module relative to /play/index.html.

import { createPlayChainPlayerSync } from "./play-chain-player.js";
import { loadPlayChainModule, mineShouldSavePlayerPosition } from "./play-chain-adapter.js";
import { createPlayChainSession, WALLET_SESSION_CHANGED_EVENT } from "./play-chain-session.js";

The repository working-tree entry imports PlayerProfile synchronization, the chain-module loader and mining position-save predicate, and the wallet-session controller; the older /src/main.js is outside this route. This is source evidence, not the retained live served module: direct /play/main.js returned index HTML in the snapshot.

1. Line 1

   Import the PlayerProfile synchronization module declared by this repository source-tree route, not retained live served bytes.

2. Lines 2–3

   Import the repository chain-module loader, mining position-save predicate, and wallet-session lifecycle; the retained live served bytes came from a versioned bundle instead.

pub const PLAYER_SESSION_MAGIC: [u8; 8] = *b"NCKSES01";
pub const PLAYER_SESSION_VERSION: u16 = 1;
pub const PLAYER_SESSION_SEED: &[u8] = b"session";

These constants identify the 184-byte public record family and the literal first seed used by the canonical PDA.

1. Lines 1–2

   Name the account family and current packed version written during setup.

2. Line 3

   Fix the UTF-8 seed word used before owner and session authority.

        writer.bytes(&PLAYER_SESSION_MAGIC)?;
        writer.u16(PLAYER_SESSION_VERSION)?;
        writer.u8(args.bump)?;
        writer.u8(1)?;
        writer.pubkey(args.owner)?;
        writer.pubkey(args.session_authority)?;
        writer.pubkey(args.player_profile)?;
        writer.pubkey(args.global_config)?;
        writer.u16(args.world_id)?;
        writer.u16(args.allowed_actions)?;
        writer.i64(args.expires_at)?;
        writer.u64(args.created_slot)?;
        writer.u64(args.created_slot)?;
        writer.i64(args.created_at)?;
        writer.u32(args.max_actions)?;
        writer.u32(0)?;

The sequential writers produce the offset table shown above. updatedSlot begins as createdSlot, and actionCount begins as zero.

1. Lines 1–4

   Write magic, version, bump, and the initialized or active byte.

2. Lines 5–8

   Write the four public keys for owner, authority, Profile, and GlobalConfig.

3. Lines 9–16

   Write world, mask, expiry, slots, creation time, maximum, and zero action count.

        dst[Self::UPDATED_SLOT_OFFSET..Self::UPDATED_SLOT_OFFSET + 8]
            .copy_from_slice(&updated_slot.to_le_bytes());
        dst[Self::MAX_ACTIONS_OFFSET..Self::MAX_ACTIONS_OFFSET + 4]
            .copy_from_slice(&max_actions.to_le_bytes());
        dst[Self::ACTION_COUNT_OFFSET..Self::ACTION_COUNT_OFFSET + 4]
            .copy_from_slice(&0_u32.to_le_bytes());
        Ok(())

A refresh updates the slot and stored maximum and writes actionCount back to zero. No close, revoke, or deactivate behavior appears in this method.

1. Lines 1–4

   Replace updatedSlot and maxActions on the same validated account.

2. Lines 5–7

   Reset actionCount to zero and finish without closing the account.

    if !owner.is_signer || !owner.is_writable {
        return Err(NicechunkPlayerError::InvalidPayer.into());
    }
    if !session_authority.is_signer {
        return Err(NicechunkPlayerError::InvalidSessionAuthority.into());
    }
    if !player_session.is_writable {
        return Err(NicechunkPlayerError::InvalidWritableAccount.into());
    }

Distinct owner and session keys both have to sign the setup transaction. If their public keys match, the same transaction signature satisfies both signer metas.

1. Lines 1–3

   Require the owner to sign and remain writable as setup payer.

2. Lines 4–6

   Require possession of the session-authority secret through its signature.

3. Lines 7–9

   Allow create or refresh to write the canonical Session account.

    let expires_at = read_i64(payload, 0);
    let allowed_actions = read_u16(payload, 8);
    let max_actions = read_u32(payload, 10);
    let allowed_mask = SESSION_ACTION_BREAK_BLOCK | SESSION_ACTION_PLACE_BLOCK;
    if allowed_actions == 0 || allowed_actions & !allowed_mask != 0 || max_actions == 0 {
        return Err(NicechunkPlayerError::InvalidInstruction.into());
    }

    let clock = Clock::get()?;
    if expires_at <= clock.unix_timestamp {
        return Err(NicechunkPlayerError::InvalidInstruction.into());
    }

    let (expected_player_profile, profile_bump) =
        Pubkey::find_program_address(&[PLAYER_PROFILE_SEED, owner.key.as_ref()], program_id);
    require_key_eq(
        player_profile.key,
        &expected_player_profile,
        NicechunkPlayerError::InvalidPlayerProfilePda,
    )?;
    let (expected_player_session, bump) = Pubkey::find_program_address(
        &[
            PLAYER_SESSION_SEED,
            owner.key.as_ref(),
            session_authority.key.as_ref(),
        ],
        program_id,
    );

The payload must use only declared bits, a nonzero maximum, and future expiry. PDA derivation then binds the literal seed, owner, and session authority under Player Program.

1. Lines 1–7

   Decode the fourteen-byte payload and reject zero or unknown permission values.

2. Lines 9–12

   Compare expiresAt with the chain Clock rather than the browser clock.

3. Lines 14–28

   Derive the canonical Profile and Session addresses from their ordered public seeds.

  return PublicKey.findProgramAddressSync(
    [Buffer.from(PLAYER_SESSION_SEED), owner.toBuffer(), sessionAuthority.toBuffer()],
    programId,
  );

Independent clients can reproduce the Player Program's address because the SDK keeps the identical seed order.

1. Lines 1–4

   Derive one PDA from the session literal, owner bytes, authority bytes, and Player Program ID.

  const data = Buffer.alloc(15);
  data.writeUInt8(4, 0);
  data.writeBigInt64LE(BigInt(expiresAt), 1);
  data.writeUInt16LE(allowedActions, 9);
  data.writeUInt32LE(maxActions, 11);

This mirrors the production builder: one selector byte precedes the fourteen bytes parsed by the Rust handler.

1. Lines 1–2

   Allocate fifteen bytes and write instruction tag four first.

2. Lines 3–5

   Write expiry, action mask, and maximum in little-endian form.

  const decoded: DecodedPlayerSession = {
    magic: bytes(8).toString("utf8"),
    version: u16(),
    bump: u8(),
    active: u8() === 1,
    owner: pubkey(),
    sessionAuthority: pubkey(),
    playerProfile: pubkey(),
    globalConfig: pubkey(),
    worldId: u16(),
    allowedActions: u16(),
    expiresAt: i64(),
    createdSlot: u64(),
    updatedSlot: u64(),
    createdAt: i64(),
    maxActions: u32(),
    actionCount: u32(),
  };

The decoder consumes the same sixteen fields as Rust pack. The derived audit checks that both orders and byte widths still agree.

1. Lines 1–9

   Decode the header and four public keys before reaching world state.

2. Lines 10–18

   Decode mask, time, slots, creation time, maximum, and action count.

        if read_i64(data, PLAYER_SESSION_EXPIRES_AT_OFFSET) <= now {
            return Err(NicechunkChunkError::PlayerSessionExpired);
        }
        let allowed_actions = read_u16(data, PLAYER_SESSION_ALLOWED_ACTIONS_OFFSET);
        if action >= 16 || allowed_actions & (1_u16 << action) == 0 {
            return Err(NicechunkChunkError::SessionActionNotAllowed);
        }

After identity comparisons, Chunk rejects expiry at or before chain time and a missing requested bit. This range contains no maxActions or actionCount read.

1. Lines 1–3

   Reject a Session whose stored expiry is no longer in the future.

2. Lines 4–7

   Read allowedActions and require the consumer's bit to be present.

    match tag {
        5 => mine_block(program_id, accounts, payload),
        6 => initialize_chunk_broken(program_id, accounts, payload),
        7 => initialize_resource_drop_table(program_id, accounts, payload),
        8 => mine_block_with_rewards(program_id, accounts, payload),
        9 => fell_tree_with_rewards(program_id, accounts, payload),
        10 => apply_civilization_resource_drop_receipt(program_id, accounts, payload),
        11 => initialize_surface_decoration_table(program_id, accounts, payload),
        12 => verify_surface_decoration(program_id, accounts, payload),
        13 => apply_civilization_surface_decoration_receipt(program_id, accounts, payload),
        15 => register_build_site_chunk(program_id, accounts, payload),
        20 => batch_mine_with_rewards(program_id, accounts, payload),
        21 => range_mine_with_rewards(program_id, accounts, payload),
        _ => Err(NicechunkChunkError::InvalidInstruction.into()),
    }

The audit traces Session metas from production builders to five handlers in this dispatch: tags 5, 8, 9, 20, and 21.

1. Lines 1–13

   Map Chunk instruction tags to handlers, including the five Session-aware mining and tree paths.

2. Line 14

   Reject any tag outside this explicit dispatch table.

        if read_i64(data, PLAYER_SESSION_EXPIRES_AT_OFFSET) <= now {
            return Err(NicechunkBuildingError::PlayerSessionExpired);
        }
        let allowed_actions = read_u16(data, PLAYER_SESSION_ALLOWED_ACTIONS_OFFSET);
        if action >= 16 || allowed_actions & (1_u16 << action) == 0 {
            return Err(NicechunkBuildingError::SessionActionNotAllowed);
        }

Building uses the same fixed offsets for expiry and allowedActions. Its current shared helper passes action index 1 for tags 0–5 and 7.

1. Lines 1–3

   Reject when the public record has reached its chain-time expiry.

2. Lines 4–7

   Require the Building helper's requested bit in allowedActions.

    match tag {
        0 => create_build_site(program_id, accounts, payload),
        1 => register_build_site_chunks(program_id, accounts, payload),
        2 => begin_building_upload(program_id, accounts, payload),
        3 => write_building_shard(program_id, accounts, payload),
        4 => finalize_building(program_id, accounts, payload),
        5 => cancel_building_upload(program_id, accounts, payload),
        7 => begin_build_site_resize(program_id, accounts, payload),
        8 => publish_guardian_blueprint(program_id, accounts, payload),
        _ => Err(NicechunkBuildingError::InvalidInstruction.into()),
    }

The audited matrix finds PlayerSession on all seven handlers at tags 0–5 and 7. Tag 6 is invalid, while tag 8 is a separate fixed-publisher Guardian CPI and does not use PlayerSession.

1. Lines 1–9

   Dispatch the seven construction lifecycle handlers that share action index one.

2. Lines 10–12

   Keep Guardian blueprint publishing and invalid tags outside that Session consumer set.

    pub fn remove_resource_at(
        data: &mut [u8],
        owner: &Pubkey,
        index: u8,
        updated_slot: u64,
    ) -> ProgramResult {
        Self::validate_owner(data, owner)?;
        let item_count = data[Self::ITEM_COUNT_OFFSET];
        if index >= item_count {
            return Err(NicechunkBackpackError::InvalidResourceIndex.into());
        }

        let start = Self::RECORDS_OFFSET + index as usize * BACKPACK_SLOT_RECORD_LEN;
        let removed = BackpackSlotRecord::unpack(&data[start..start + BACKPACK_SLOT_RECORD_LEN])?;
        Self::subtract_total_mass(data, removed.mass_grams()?)?;
        let end = Self::RECORDS_OFFSET + item_count as usize * BACKPACK_SLOT_RECORD_LEN;
        if start + BACKPACK_SLOT_RECORD_LEN < end {
            data.copy_within(start + BACKPACK_SLOT_RECORD_LEN..end, start);
        }
        let last_start =
            Self::RECORDS_OFFSET + (item_count - 1) as usize * BACKPACK_SLOT_RECORD_LEN;
        data[last_start..last_start + BACKPACK_SLOT_RECORD_LEN].fill(0);
        data[Self::ITEM_COUNT_OFFSET] = item_count.saturating_sub(1);

The method validates owner and index, shifts every later fixed-size record left, clears the old last slot, and reduces count. It never reads a slot kind or category.

1. Lines 1–11

   Validate Backpack ownership and ensure the dense index exists.

2. Lines 13–17

   Copy later packed records left over the selected record.

3. Lines 18–21

   Clear the final duplicate and reduce the packed item count.

    let player_session_data = player_session.try_borrow_data()?;
    let session = PlayerSessionView::validate(
        &player_session_data,
        session_authority.key,
        player_profile.key,
        SESSION_ACTION_BREAK_BLOCK,
        clock.unix_timestamp,
    )?;
    drop(player_session_data);

    let player_profile_data = player_profile.try_borrow_data()?;
    PlayerProfileView::validate_owner(&player_profile_data, &session.owner)?;
    drop(player_profile_data);
    validate_existing_backpack_pda(program_id, backpack, &session.owner)?;

    let mut backpack_data = backpack.try_borrow_mut_data()?;
    BackpackAccount::remove_resource_at(&mut backpack_data, &session.owner, index, clock.slot)

The single-removal session path borrows PlayerSession read-only, requests BREAK_BLOCK, resolves its owner, and mutates the owner-backed Backpack rather than Session.

1. Lines 1–9

   Read and validate PlayerSession using the BREAK_BLOCK permission constant.

2. Lines 11–14

   Bind the resolved owner to PlayerProfile and the canonical Backpack.

3. Lines 16–17

   Borrow only Backpack mutably and perform dense-index removal.

const sessionDurationSeconds = 8 * 60 * 60;
const sessionRefreshSkewSeconds = 15 * 60;
const lamportsPerSol = 1_000_000_000;
const minimumSessionFundingLamports = 100_000_000;

These repository source constants define duration, skew, conversion, and minimum funding. They are not by themselves the retained live served bytes; the separate production snapshot hashes the live candidate and confirms equivalent literals.

1. Lines 1–2

   Set the requested duration and early-refresh window in seconds.

2. Lines 3–4

   Define SOL conversion and the browser minimum funding threshold.

  if (stored && stored.expiresAt > nowSeconds + sessionRefreshSkewSeconds) {
    const [playerSession] = derivePlayerSessionPda(owner, stored.keypair.publicKey);
    const [playerProfile] = derivePlayerProfilePda(owner);
    const [account, sessionAccount, profileAccount] = await conn.getMultipleAccountsInfo(
      [playerSession, stored.keypair.publicKey, playerProfile],
      "confirmed",
    );
    const sessionBalance = accountLamports(sessionAccount);
    if (account?.data?.length && isCurrentPlayerProfileAccount(profileAccount, owner)) {
      await fundGameplaySessionIfNeeded(provider, stored.keypair.publicKey, sessionBalance, conn);

This repository source branch uses copied time, nonempty Session data, selected Profile checks, and funding; it is not the retained live served excerpt. It does not fully decode the Session, and low balance can prompt an owner top-up before consumer validation.

1. Lines 1–3

   Require the local expiry window and derive addresses from the stored authority.

2. Lines 4–7

   Read Session, session-address balance, and Profile together at confirmed commitment.

3. Lines 8–10

   Accept nonempty Session data plus the selected Profile gate and top up the stored authority if needed.

  tx.add(createOrRefreshPlayerSessionInstruction({
    owner,
    sessionAuthority: owner,
    playerProfile,
    playerSession,
    expiresAt,
  }));

  await signAndSendKeypairTransaction(keypair, tx, conn);

In repository source, the same owner key occupies both Session roles and signs the direct transaction. This excerpt is not the retained live served asset, and successful execution—not usesGameplaySession:false—would establish the PDA.

1. Lines 1–7

   Build tag four with the owner public key in both account roles.

2. Line 9

   Sign and submit with the one persistent Local Game Wallet Keypair.

export async function recordBlockPlacementOnChain(_target, _renderType, _toolSlot = 0) {
  return { submitted: false, reason: "chain-placement-disabled" };
}

This repository source method returns chain-placement-disabled without submission; it is not the retained live served excerpt. The separately hashed live chain candidate contains the same literal behavior at capture time.

1. Lines 1–3

   Return the literal disabled reason without constructing or sending a chain placement transaction.

function storeGameplaySession(owner, session) {
  if (!hasLocalStorage()) return;
  localStorage.setItem(sessionStorageKey(owner), JSON.stringify({
    publicKey: session.keypair.publicKey.toBase58(),
    secretKey: bytesToBase64(session.keypair.secretKey),
    expiresAt: session.expiresAt,
    savedAt: Date.now(),
  }));
}

This repository source stores Base64 rather than encrypted private bytes under an owner suffix. It is not the retained live served byte evidence, and localStorage access remains a browser trust boundary.

1. Lines 1–3

   Require browser storage and select the owner-scoped Session record.

2. Lines 4–8

   Save public key, Base64 secret bytes, copied expiry, and save time.

3. Line 9

   Complete the local-only storage helper without any chain call.

async function signAndSendKeypairTransaction(signer, transaction, conn = getNicechunkConnection()) {
  transaction.feePayer = signer.publicKey;
  const { blockhash, lastValidBlockHeight } = await conn.getLatestBlockhash("confirmed");
  transaction.recentBlockhash = blockhash;
  transaction.lastValidBlockHeight = lastValidBlockHeight;
  transaction.sign(signer);

This repository source helper makes an ordinary Keypair fee payer and signer without a Session wrapper. It is not the retained live served excerpt; the offline audit separately verifies the cryptographic System-transfer shape.

1. Lines 1–2

   Use the supplied Keypair's public key as transaction fee payer.

2. Lines 3–5

   Fetch a recent confirmed blockhash and its validity boundary.

3. Line 6

   Apply the ordinary Keypair signature to the constructed transaction.

  async function submitPlace(pending) {
    if (!pending) return skipped("missing-pending");
    if (!isEnabled()) return skipped("chain-sync-disabled");
    if (!getWalletAddress()) return skipped("wallet-unavailable");
    const module = await loadPlayChainModule();
    if (typeof module.recordBlockPlacementOnChain !== "function") return skipped("record-placement-unavailable");
    const renderType = module.renderTypeForBlockId?.(pending.blockId) ?? null;
    const result = await module.recordBlockPlacementOnChain(blockFromPending(pending), renderType, pending.hotbarSlotIndex ?? 0);
    return normalizeChainResult(result);
  }

This repository adapter source resolves a module and then calls recordBlockPlacementOnChain only if that loaded module exports it. It is not the retained live served adapter bytes; direct /play/play-chain-adapter.js returned HTML, and actual behavior depends on the resolved asset or trusted override.

1. Lines 1–4

   Require a pending placement, enabled adapter, and connected wallet.

2. Lines 5–8

   Load the runtime-resolved module and call its ordinary placement method; this repository source tree is not retained live served bytes.

3. Lines 9–10

   Normalize the non-submitted disabled result for the Play controller.

export function clearWalletSession(storage = globalThis.localStorage) {
  for (const key of Object.values(walletSessionKeys)) remove(storage, key);
  const keys = [];
  try {
    for (let index = 0; index < storage.length; index += 1) {
      const key = storage.key(index);
      if (key) keys.push(key);
    }
  } catch {
    return;
  }
  for (const key of keys) {
    if (runtimeCachePrefixes.some((prefix) => key.startsWith(prefix))) remove(storage, key);
  }
}

The function does not filter runtime caches to the connected owner. It attempts every matching removal, but enumeration or per-key errors can prevent deletion, so this is best-effort cleanup rather than a success guarantee.

1. Lines 1–2

   Attempt removal of the four wallet-identity fields from this browser origin.

2. Lines 3–11

   Try to enumerate localStorage keys; an exception returns before the runtime-prefix pass.

3. Lines 12–15

   Attempt each matching prefix removal regardless of owner suffix; this range does not verify success.

  function disconnectWallet() {
    const provider = detectWalletProvider();
    try {
      if (provider?.disconnect) {
        Promise.resolve(provider.disconnect()).catch(() => {
          // The local session is already cleared; plugin disconnect is best effort.
        });
      }
    } catch {
      // Some wallet plugins throw when already disconnected.
    }
    clearWalletSession();
    state.walletAddress = "";
    state.sessionLamports = getStoredSessionLamports("");
    resetWalletBalance();
    dispatchWalletChanged("");

This handler attempts provider disconnect and browser cleanup on a best-effort basis, then resets in-memory presentation. It contains no System transfer, PlayerSession close, revoke, or refund transaction and does not verify storage deletion.

1. Lines 1–10

   Ask the wallet provider to disconnect but tolerate rejection or an already-disconnected state.

2. Lines 11–15

   Call best-effort local cleanup, then reset in-memory wallet and balance presentation.

3. Line 16

   Notify Play that the visible wallet address is now empty.

function storeLocalGameWalletKeypair(keypair, source = "created") {
  const address = keypair.publicKey.toBase58();
  const secretKey = bs58.encode(keypair.secretKey);
  const createdAt = String(Date.now());
  if (!hasLocalStorage()) throw new Error("Browser local storage is unavailable.");
  localStorage.setItem(localGameWalletKeys.address, address);
  localStorage.setItem(localGameWalletKeys.secretKey, secretKey);

The persistent owner's private bytes are turned into a plain Base58 string and stored under Local Game Wallet keys, separate from plugin-session cleanup.

1. Lines 1–4

   Prepare the public address, Base58 secret text, and creation time.

2. Lines 5–7

   Require localStorage and save both public address and unencrypted secret string.

  encodeHello(position) {
    const chunk = this.worldToChunk(position?.x ?? 0, position?.z ?? 0);
    const bytes = new Uint8Array(HELLO_SIZE);
    const view = new DataView(bytes.buffer);
    view.setUint8(0, MSG_HELLO);
    view.setUint8(1, PROTOCOL_VERSION);
    view.setUint16(2, 0, true);
    this.writeWalletHint(bytes, 4);
    view.setInt32(36, chunk.x, true);
    view.setInt32(40, chunk.z, true);
    const nonce = randomNonceWords();
    view.setUint32(44, nonce.low, true);
    view.setUint32(48, nonce.high, true);
    return bytes.buffer;
  }

The realtime greeting writes a public wallet hint, chunk coordinates, and nonce. It does not insert PlayerSession, session authority, private bytes, or wallet signature.

1. Lines 1–7

   Allocate the HELLO frame and write its message and protocol header.

2. Lines 8–10

   Write the wallet public-key hint and current chunk coordinates.

3. Lines 11–15

   Add random nonce words and return the unsigned message bytes.

  function createGuardianClient(wallet) {
    return createNiceChunkGuardianClient({
      walletAddress: wallet,
      url: state.guardianUrl,
      playerName: String(getPlayerName?.() || "Local Miner"),
      chunkSize: chunks?.chunkSize || 16,
      onReady: (info) => {
        state.connected = true;

The runtime constructs its separate realtime client from the wallet public address and world presentation data, not from a PlayerSession input.

1. Lines 1–3

   Create the Guardian client using the current wallet address as an identity hint.

2. Lines 4–8

   Provide endpoint and presentation context, then register an independent onReady callback.

    match tag {
        0 => initialize_registry(program_id, accounts),
        1 => register_genesis_guardian(program_id, accounts, payload),
        2 => register_guardian(program_id, accounts, payload),
        5 => update_guardian_endpoint(program_id, accounts, payload),
        6 => update_guardian_blueprint(program_id, accounts, payload),
        8 => update_guardian_operator(program_id, accounts, payload),
        _ => Err(NicechunkGuardianError::InvalidInstruction.into()),
    }

The current Guardian dispatch manages registry, enrollment, endpoint, blueprint, and operator state. The full audited contract contains no PlayerSession reference or session lifecycle handler.

1. Lines 1–7

   Map Guardian tags only to Guardian registry and region-management handlers.

2. Lines 8–9

   Reject unsupported tags rather than accepting a Session revoke operation.

  const instruction = SystemProgram.transfer({
    fromPubkey: sessionAuthority.publicKey,
    toPubkey: recipient,
    lamports: 1,
  });
  const transaction = new Transaction({
    feePayer: sessionAuthority.publicKey,
    recentBlockhash: Keypair.generate().publicKey.toBase58(),
  }).add(instruction);
  transaction.sign(sessionAuthority);
  const playerSessionReferenced = instruction.keys.some(({ pubkey }) => pubkey.equals(playerSession));
  const playerProgramInvoked = instruction.programId.equals(new PublicKey(playerProgramId));
  const source = instruction.keys[0];
  const signaturePresent = transaction.signatures.length === 1 && transaction.signatures[0].signature !== null;
  const signatureValid = transaction.verifySignatures();
  assert(instruction.programId.equals(SystemProgram.programId), "Offline transfer did not target System Program.");
  assert(source.pubkey.equals(sessionAuthority.publicKey), "Offline transfer source differs from the session authority.");
  assert(source.isSigner && source.isWritable, "Offline transfer source is not a writable signer.");
  assert(instruction.keys.length === 2, "System transfer account list drifted from two keys.");
  assert(!playerSessionReferenced, "Offline System transfer unexpectedly references PlayerSession.");
  assert(!playerProgramInvoked, "Offline System transfer unexpectedly invokes Player Program.");
  assert(signaturePresent && signatureValid, "Temporary session Keypair could not sign an ordinary System transfer offline.");

Fresh test keys sign one unbroadcast lamport transfer entirely offline. Assertions confirm System Program, a writable signer, no Session account, no Player Program, and a valid signature.

1. Lines 1–10

   Construct a one-lamport System transfer and sign it with a generated session-authority Keypair.

2. Lines 11–15

   Measure Session references, invoked program, signer meta, and signature validity.

3. Lines 16–22

   Fail the audit if the ordinary transfer starts depending on PlayerSession or cannot verify.

  "systemTransferProbe": {
    "networkRequests": 0,
    "broadcasts": 0,
    "lamports": 1,
    "instructionProgramId": "11111111111111111111111111111111",
    "instructionAccountCount": 2,
    "sourceIsSigner": true,
    "sourceIsWritable": true,
    "playerSessionAccountReferenced": false,
    "playerProgramInvoked": false,
    "signaturePresent": true,
    "signatureValid": true,
    "privateKeyOutput": false
  },

The saved output exposes the verifiable result without retaining private key bytes and without claiming a broadcast or real fund movement.

1. Lines 1–6

   Record zero network activity and the native System Program instruction shape.

2. Lines 7–10

   Record signer requirements and absence of PlayerSession and Player Program.

3. Lines 11–13

   Record signature presence, successful verification, and no private-key output.

  assert(report.privacyBoundary.sessionSigningSecretBytesRetained === false, "Privacy boundary drifted.");
  assert(report.privacyBoundary.walletFilesRead === false, "Wallet-file boundary drifted.");
  assert(report.privacyBoundary.browserStorageRead === false, "Browser-storage boundary drifted.");
  assert(report.reproduction.checkModeUsesNetwork === false, "Local check unexpectedly claims network use.");
  assertNoSecretFields(report);

Offline report checking explicitly rejects retained session secrets, wallet-file reads, browser-storage reads, network use, or secret-shaped report fields.

1. Lines 1–3

   Require that no session secret, wallet file, or browser storage entered the capture.

2. Lines 4–5

   Keep check mode offline and scan the retained report for forbidden secret fields.

  "summary": {
    "retainedPlayerSessions": 10,
    "currentAtContextBlockTime": 0,
    "expiredAtContextBlockTime": 10,
    "uniqueOwners": 8,
    "uniqueSessionAuthorities": 10,
    "ownerEqualsAuthoritySessions": 5,
    "distinctAuthoritySessions": 5,
    "ownersWithMultipleSessions": 1,
    "maximumSessionsForOneOwner": 3,
    "sessionsForOwnersWithMultipleSessions": 3,
    "canonicalSessionPdas": 10,

At confirmed context slot 477236696, all ten retained public Session records were expired, and one owner had three records. Presence is not current authorization.

1. Lines 1–4

   Count ten retained Sessions, zero current records, and ten expired records at context time.

2. Lines 5–8

   Count eight owners and split equal-key versus distinct-authority arrangements.

3. Lines 9–12

   Record multi-Session coexistence and canonical-PDA observations in this one snapshot.

  const [globalConfig] = deriveGlobalConfigPda(coreProgramId);
  const data = Buffer.alloc(15);
  data.writeUInt8(4, 0);
  data.writeBigInt64LE(BigInt(expiresAt), 1);
  data.writeUInt16LE(allowedActions, 9);
  data.writeUInt32LE(maxActions, 11);
  return new TransactionInstruction({
    programId: playerProgramId,
    keys: [
      { pubkey: owner, isSigner: true, isWritable: true },
      { pubkey: sessionAuthority, isSigner: true, isWritable: false },
      { pubkey: playerProfile, isSigner: false, isWritable: false },
      { pubkey: playerSession, isSigner: false, isWritable: true },
      { pubkey: globalConfig, isSigner: false, isWritable: false },
      { pubkey: SystemProgram.programId, isSigner: false, isWritable: false },
    ],
    data,
  });

The independent SDK writes tag 4 and marks PlayerProfile read-only while PlayerSession is writable. The handler accepts an already valid final-layout Profile without mutation and rejects an invalid allocated one; this builder does not grant an in-place migration path.

1. Lines 1–6

   Derive GlobalConfig and serialize the fifteen-byte tag-four instruction data.

2. Lines 7–16

   Declare both signer roles, a read-only PlayerProfile, a writable Session, and the remaining read-only accounts.

3. Lines 17–18

   Attach the serialized data and finish the SDK instruction object.

  const data = Buffer.alloc(15);
  data.writeUInt8(4, 0);
  data.writeBigInt64LE(BigInt(expiresAt), 1);
  data.writeUInt16LE(sessionAllowedActions, 9);
  data.writeUInt32LE(sessionMaxActions, 11);

  return new TransactionInstruction({
    programId: playerProgramId,
    keys: [
      { pubkey: owner, isSigner: true, isWritable: true },
      { pubkey: sessionAuthority, isSigner: true, isWritable: false },
      { pubkey: playerProfile, isSigner: false, isWritable: false },
      { pubkey: playerSession, isSigner: false, isWritable: true },
      { pubkey: deriveGlobalConfigPda(), isSigner: false, isWritable: false },
      { pubkey: SystemProgram.programId, isSigner: false, isWritable: false },
    ],
    data,
  });

This repository source-tree builder repeats the SDK's read-only PlayerProfile and writable PlayerSession metas. It is not retained live served bytes; the production snapshot separately pins the fetched chain candidate.

1. Lines 1–5

   Serialize repository defaults into tag-four data; this source tree is not retained live served bytes.

2. Lines 7–16

   Request owner and authority signers, keep Profile read-only, and make only PlayerSession writable for setup.

3. Lines 17–18

   Finish this repository instruction object without proving what live bytes a browser loaded.

fn ensure_player_profile_current<'a>(
    payer: &AccountInfo<'a>,
    player_profile: &AccountInfo<'a>,
    global_config: &AccountInfo<'a>,
    system_program_account: &AccountInfo<'a>,
    program_id: &Pubkey,
    owner: &Pubkey,
    bump: u8,
    global_config_view: &GlobalConfigView,
    clock: &Clock,
) -> ProgramResult {
    {
        let data = player_profile.try_borrow_data()?;
        if PlayerProfile::validate_owner_and_config(&data, owner, global_config.key).is_ok() {
            return Ok(());
        }
    }

    if player_profile.owner != &system_program::ID || player_profile.data_len() != 0 {
        return Err(NicechunkPlayerError::InvalidSystemAccount.into());
    }
    create_or_allocate_player_profile_pda(
        payer,
        player_profile,
        system_program_account,
        program_id,
        owner,
        bump,
    )?;

    let mut data = player_profile.try_borrow_mut_data()?;
    PlayerProfile::pack_default(
        &mut data,
        bump,
        owner,
        global_config.key,
        global_config_view.world_id,
        "",
        clock.slot,
        clock.unix_timestamp,
    )
}

A valid final-layout Profile returns immediately. Any existing invalid account is rejected. Only an empty System-owned PDA can be allocated, so Session refresh cannot silently resize or migrate old layouts.

1. Lines 1–14

   Borrow the supplied Profile and return only when final-layout validation confirms owner, GlobalConfig, version, initialized state, and slot-count invariants.

2. Lines 16–18

   Reject every invalid account that is already allocated or owned by a program instead of attempting an in-place migration.

3. Lines 19–37

   Allocate only a missing System-owned PDA and pack a new default Profile with the current canonical layout.

const NS_BACKPACK: u8 = 1;
const NS_CHUNK: u8 = 2;
const NS_SMELTING: u8 = 3;
const NS_MARKET: u8 = 4;

pub fn process_instruction(
    program_id: &solana_program::pubkey::Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let (tag, payload) = instruction_data
        .split_first()
        .ok_or(NicechunkGameError::InvalidInstruction)?;

    match *tag {
        NS_BACKPACK => nicechunk_backpack::process_instruction(program_id, accounts, payload),
        NS_CHUNK => nicechunk_chunk::process_instruction(program_id, accounts, payload),
        NS_SMELTING => nicechunk_smelting::process_instruction(program_id, accounts, payload),
        NS_MARKET => nicechunk_market::process_instruction(program_id, accounts, payload),
        _ => Err(NicechunkGameError::InvalidInstruction.into()),
    }
}

The unified Game Program treats the first byte as a namespace. Namespace 1 removes that outer byte and passes the remaining inner tag and payload to the shared Backpack instruction handler.

1. Lines 1–4

   Assign namespace byte one to Backpack and distinct values to the other game families.

2. Lines 6–13

   Split the first byte from the remaining payload and reject empty instruction data.

3. Lines 15–22

   Delegate namespace one to nicechunk_backpack and reject unknown namespaces.

    if payload.len() != 1 || (accounts.len() != 2 && accounts.len() != 4) {
        return Err(NicechunkBackpackError::InvalidInstruction.into());
    }

    let index = payload[0];
    let account_info_iter = &mut accounts.iter();

    if accounts.len() == 2 {
        let owner = next_account_info(account_info_iter)?;
        let backpack = next_account_info(account_info_iter)?;

        if !owner.is_signer || !owner.is_writable {
            return Err(NicechunkBackpackError::InvalidPayer.into());
        }
        if !backpack.is_writable {
            return Err(NicechunkBackpackError::InvalidWritableAccount.into());
        }
        require_key_eq(
            backpack.owner,
            program_id,
            NicechunkBackpackError::InvalidBackpackOwner,
        )?;
        validate_existing_backpack_pda(program_id, backpack, owner.key)?;

        let clock = Clock::get()?;
        let mut backpack_data = backpack.try_borrow_mut_data()?;
        return BackpackAccount::remove_resource_at(
            &mut backpack_data,
            owner.key,
            index,
            clock.slot,
        );
    }

The handler explicitly accepts either two or four accounts. With two, it requires the owner signer and writable Backpack and returns after direct dense-index removal without reading PlayerSession.

1. Lines 1–6

   Accept exactly the single-index payload and either the two-account or four-account shape.

2. Lines 8–23

   In the two-account shape, validate the owner signer and canonical writable Backpack.

3. Lines 25–33

   Mutate the owner's Backpack directly and return before any Session-aware branch.

    let session_authority = next_account_info(account_info_iter)?;
    let player_profile = next_account_info(account_info_iter)?;
    let player_session = next_account_info(account_info_iter)?;
    let backpack = next_account_info(account_info_iter)?;

    if !session_authority.is_signer {
        return Err(NicechunkBackpackError::InvalidSessionAuthority.into());
    }
    if !backpack.is_writable {
        return Err(NicechunkBackpackError::InvalidWritableAccount.into());
    }
    require_key_eq(
        backpack.owner,
        program_id,
        NicechunkBackpackError::InvalidBackpackOwner,
    )?;
    require_key_eq(
        player_profile.owner,
        &NICECHUNK_PLAYER_PROGRAM_ID,
        NicechunkBackpackError::InvalidPlayerProgram,
    )?;
    require_key_eq(
        player_session.owner,
        &NICECHUNK_PLAYER_PROGRAM_ID,
        NicechunkBackpackError::InvalidPlayerProgram,
    )?;

    let clock = Clock::get()?;
    let player_session_data = player_session.try_borrow_data()?;
    let session = PlayerSessionView::validate(
        &player_session_data,
        session_authority.key,
        player_profile.key,
        SESSION_ACTION_BREAK_BLOCK,
        clock.unix_timestamp,
    )?;

After the two-account early return, the remaining four accounts are authority, Profile, Session, and Backpack. This branch checks the authority signature, Player Program ownership, chain time, and BREAK_BLOCK permission before later removal.

1. Lines 1–4

   Consume the four Session-aware account roles in their contract order.

2. Lines 6–26

   Require the authority signature, writable Backpack, and expected owning programs.

3. Lines 28–36

   Read chain time and ask PlayerSessionView for BREAK_BLOCK authorization.

const sessionAllowedActions = (1 << 1) | (1 << 2);
const sessionMaxActions = 10_000;

These adjacent repository source-tree constants combine BREAK_BLOCK and PLACE_BLOCK into mask 6 and request maxActions 10,000. They are not retained live served bytes and do not prove either field is enforced by consumers.

1. Line 1

   Combine bit indexes one and two into repository mask value six.

2. Line 2

   Choose the stored maximum of ten thousand in source, not an enforced live-byte limit.

async function signAndSendWalletTransaction(provider, transaction, conn = getNicechunkConnection(), extraSigners = []) {
  transaction.feePayer = provider.publicKey;

  if (typeof conn.prepareTransaction === "function") {
    await conn.prepareTransaction(transaction, { commitment: "confirmed" });
  } else {
    const { blockhash, lastValidBlockHeight } = await conn.getLatestBlockhash("confirmed");
    transaction.recentBlockhash = blockhash;
    transaction.lastValidBlockHeight = lastValidBlockHeight;
  }

  for (const signer of extraSigners) transaction.partialSign(signer);

  if (typeof provider.signTransaction === "function") {
    const signed = await provider.signTransaction(transaction);
    const signature = await sendRawTransactionWithLogs(conn, signed.serialize(), "wallet");
    await confirmTransactionByHttpPolling(conn, {
      signature,
      blockhash: transaction.recentBlockhash,
      lastValidBlockHeight: transaction.lastValidBlockHeight,
    }, "confirmed");
    return signature;
  }

  if (typeof provider.signAndSendTransaction !== "function") {
    throw new Error("Wallet does not support transaction signing.");
  }
  const result = await provider.signAndSendTransaction(transaction);
  const signature = typeof result === "string" ? result : result?.signature;
  if (!signature) throw new Error("Wallet did not return a transaction signature.");
  await confirmTransactionByHttpPolling(conn, {
    signature,
    blockhash: transaction.recentBlockhash,
    lastValidBlockHeight: transaction.lastValidBlockHeight,
  }, "confirmed");
  return signature;
}

This repository source-tree helper broadcasts through one of two wallet APIs and awaits HTTP polling at confirmed commitment before it returns. It is not retained live served bytes and does not make the following browser storage write part of the chain transaction.

1. Lines 1–12

   Prepare the repository transaction and apply any extra signer signatures; these are not retained live served bytes.

2. Lines 14–23

   With signTransaction, broadcast serialized bytes and wait for confirmed polling before return.

3. Lines 25–37

   With signAndSendTransaction, require a signature and likewise await confirmed polling before return.

  await signAndSendWalletTransaction(provider, tx, conn, [keypair]);
  const session = { keypair, expiresAt };
  storeGameplaySession(owner, session);
  markGameplaySessionReady(owner, keypair.publicKey, targetLamports);

In this repository source tree, setup awaits the broadcasting-and-confirming wallet helper before calling storeGameplaySession. It is not retained live served bytes, and the later localStorage write is a second, non-atomic commit that can still fail.

1. Line 1

   Await the repository wallet helper's confirmed return; this source is not retained live served bytes.

2. Lines 2–3

   Only afterward assemble the local record and ask localStorage to persist the secret.

3. Line 4

   Mark the in-memory ready cache after the separate persistence call completes.

const chunkDeltaCacheTtlMs = 60_000;
const gameplaySessionStatusCacheTtlMs = 60_000;
const gameplaySessionReadyCacheTtlMs = 5 * 60_000;
const resourceDropTableCacheTtlMs = 10 * 60_000;
const chunkDeltaCache = new Map();
const initializedChunkBrokenCache = new Set();
const gameplaySessionStatusCache = new Map();
const gameplaySessionReadyCache = new Map();

The repository source-tree ready-cache TTL is five minutes and has its own Map. It is not retained live served bytes; the duration limits cache age, not Session record expiry or possible synthetic-time overstatement.

1. Lines 1–4

   Declare separate repository cache lifetimes, including five minutes for gameplay readiness.

2. Lines 5–8

   Allocate the independent cache collections; these declarations are not retained live served bytes.

  const nowSeconds = Math.floor(Date.now() / 1000);
  const expiresAt = nowSeconds + sessionDurationSeconds;
  if (isGameplaySessionReadyCached(owner, owner)) {
    return { keypair, expiresAt, localGameWallet: true };
  }

  const conn = getNicechunkConnection();
  const [playerProfile] = derivePlayerProfilePda(owner);
  const [playerSession] = derivePlayerSessionPda(owner, owner);

This repository source-tree Local Game Wallet branch computes now plus the eight-hour sessionDurationSeconds and returns it on a ready-cache hit before creating the connection used for RPC reads. It is not retained live served bytes, and this expiresAt is synthetic rather than the confirmed record value.

1. Lines 1–2

   Compute a fresh repository-local now-plus-eight-hours candidate, not an on-chain expiry read.

2. Lines 3–5

   Return that synthetic expiry immediately when the five-minute ready cache still matches.

3. Lines 7–9

   Only a cache miss reaches connection and PDA setup for later RPC checks; this source is not retained live served bytes.

function remove(storage, key) {
  try {
    storage?.removeItem?.(key);
  } catch {
    // Logout still redirects even when browser storage is unavailable.
  }
}

Each identity or prefix deletion uses this helper. A removeItem exception is caught and ignored, so the caller continues without proving that the browser actually deleted that key.

1. Lines 1–3

   Attempt one optional removeItem call for the supplied storage key.

2. Lines 4–7

   Swallow an exception so logout can continue and redirect without a deletion guarantee.

  const [blockTimeUnix, rentMinimumLamports, playerProgram] = await Promise.all([
    connection.getBlockTime(snapshot.contextSlot),
    connection.getMinimumBalanceForRentExemption(lengths.playerSession, commitment),
    inspectUpgradeableProgram(connection, ids.playerProgram, snapshot.contextSlot),
  ]);
  if (blockTimeUnix === null) {
    throw new Error(`No block time is available for confirmed context slot ${snapshot.contextSlot}.`);
  }

The capture requests RPC getBlockTime for the shared confirmed context slot and refuses to classify records without it. This is not a direct read of the Clock sysvar that on-chain consumers use during execution.

1. Lines 1–5

   Read the context-slot block time alongside rent and supplemental Player deployment information.

2. Lines 6–8

   Stop the capture if RPC cannot supply a timestamp for the confirmed context slot.

    capture: {
      endpoint: redactEndpoint(endpoint),
      endpointSource: process.env.NICECHUNK_DEVNET_RPC ? "NICECHUNK_DEVNET_RPC" : "runtime-public-default",
      endpointFingerprintSha256: sha256(Buffer.from(redactEndpoint(endpoint), "utf8")),
      endpointCredentialMaterialRetained: false,
      commitment,
      rpcVersion,
      genesisHash,
      minimumRequestedSlot: snapshot.minimumSlot,
      programAccountsContextSlot: snapshot.contextSlot,
      allProgramAccountQueriesShareOneContext: true,
      contextSlots: snapshot.contexts,
      contextBlockTimeUnix: blockTimeUnix,
      contextBlockTime: new Date(blockTimeUnix * 1_000).toISOString(),
      sharedContextAttempt: snapshot.attempt,
      supplementalAccountContextSlots: {
        playerProgram: playerProgram.contextSlot,
        playerProgramData: playerProgram.programData.contextSlot,
      },
      maximumSupplementalContextSlotDelta: Math.max(
        playerProgram.contextSlot,
        playerProgram.programData.contextSlot,
      ) - snapshot.contextSlot,

The script records the common program-account slot separately from Player Program and ProgramData supplemental slots. In the retained report those latter contexts are +1 and +2, so their hashes are nearby deployment observations rather than the exact shared Session/Profile/Config context.

1. Lines 1–10

   Retain redacted endpoint metadata, commitment, and the shared program-account context slot.

2. Lines 11–15

   Record that program-account queries share one context and attach its RPC block time.

3. Lines 16–23

   Keep Player Program and ProgramData supplemental slots and their maximum delta distinct.

  "schemaVersion": 1,
  "kind": "nicechunk-player-sessions-production-runtime-snapshot",
  "auditDate": "2026-07-18",
  "snapshotDate": "2026-07-19",
  "captureStartedAt": "2026-07-19T00:44:27.337Z",
  "capturedAt": "2026-07-19T00:44:32.257Z",
  "productionOrigin": "https://nicechunk.com",
  "scope": {
    "statement": "A byte-pinned snapshot of the public NiceChunk production entry, runtime bundle, and runtime-resolved chain-module candidates.",
    "productionSnapshotNotPermanentFact": true,
    "repositorySourceUsedAsProductionEvidence": false,
    "rawResponseBodiesRetained": false,
    "retainedInstead": "Full response SHA-256/length/status metadata plus byte offsets and hashed short literal contexts.",
    "dateSemantics": "auditDate names the documentation audit batch and output filename; snapshotDate is the real UTC date of the HTTPS observation."
  },
  "privacyAndNetworkBoundary": {
    "transport": "TLS HTTPS only",
    "requestMethod": "GET",
    "fixedPublicHost": "nicechunk.com",
    "requestsMade": 10,
    "requestBodiesSent": 0,
    "authorizationHeadersSent": false,
    "cookiesSent": false,
    "queryCredentialsSent": false,
    "browserStorageRead": false,
    "walletKeyMaterialRead": false,
    "rpcMethodsCalled": [],
    "transactionsConstructed": 0,
    "transactionsSent": 0,
    "note": "Static JavaScript contains storage-key and secretKey field names; this capture reads code bytes only and never reads any player's stored values."
  },

This retained artifact calls 2026-07-18 the documentation audit batch and 2026-07-19 the actual UTC HTTPS observation date. It describes a fixed public GET byte audit—not a browser HAR—and says no browser storage, wallet keys, RPC accounts, or player overrides were read.

1. Lines 1–15

   Separate auditDate from snapshotDate and state that the point-in-time byte snapshot is not permanent.

2. Lines 16–24

   Record TLS GET transport without bodies, authorization, cookies, or query credentials.

3. Lines 25–31

   Record zero browser-storage, key, RPC, and transaction access; only static code bytes were inspected.

    {
      "id": "playIndex",
      "requestUrl": "https://nicechunk.com/play/index.html",
      "finalUrl": "https://nicechunk.com/play/index.html",
      "redirected": false,
      "status": 200,
      "ok": true,
      "contentType": "text/html",
      "contentEncoding": null,
      "contentLengthHeader": 55636,
      "bodyLength": 55636,
      "contentLengthHeaderMatchesBody": true,
      "sha256": "9caed4fdcbd50702fbae99068771ccf9ce108046f918251996bc2e85363ae48f",
      "etag": "\"6a5ba988-d954\"",
      "lastModified": "Sat, 18 Jul 2026 16:27:52 GMT",
      "cacheControl": "no-store, no-cache, must-revalidate",
      "hashBoundary": "sha256 covers the decoded HTTP entity body bytes in [0, bodyLength); Accept-Encoding was identity."
    },

The retained live served entry tuple is path, 200 HTML status, body length, and SHA-256. The hash covers the decoded HTTP entity body, which makes this static response auditable without claiming browser execution.

1. Lines 1–8

   Identify the served production index URL, final URL, HTTP status, and content type.

2. Lines 9–18

   Bind its decoded body length and SHA-256 to the explicit identity-encoding hash boundary.

    {
      "id": "versionedRuntime",
      "requestUrl": "https://nicechunk.com/runtime/play-bundle-de6020cca220427a/assets/index-BPPMv-5b.js",
      "finalUrl": "https://nicechunk.com/runtime/play-bundle-de6020cca220427a/assets/index-BPPMv-5b.js",
      "redirected": false,
      "status": 200,
      "ok": true,
      "contentType": "application/javascript",
      "contentEncoding": null,
      "contentLengthHeader": 989679,
      "bodyLength": 989679,
      "contentLengthHeaderMatchesBody": true,
      "sha256": "594a23c33a6bc37a73064f3631cf69bbd8f6a24e7c0168bf829b11bc0a9036c6",
      "etag": "\"6a5ba404-f19ef\"",
      "lastModified": "Sat, 18 Jul 2026 16:04:20 GMT",
      "cacheControl": "max-age=31536000, public, max-age=31536000, immutable",
      "hashBoundary": "sha256 covers the decoded HTTP entity body bytes in [0, bodyLength); Accept-Encoding was identity."
    },
    {
      "id": "versionedChain",
      "requestUrl": "https://nicechunk.com/assets/nicechunkChain.play-bundle-de6020cca220427a.js",
      "finalUrl": "https://nicechunk.com/assets/nicechunkChain.play-bundle-de6020cca220427a.js",
      "redirected": false,
      "status": 200,
      "ok": true,
      "contentType": "application/javascript",
      "contentEncoding": null,
      "contentLengthHeader": 112446,
      "bodyLength": 112446,
      "contentLengthHeaderMatchesBody": true,
      "sha256": "2fd4d2f3a36e67a97db59e8b6c8263fbeb2753e5eff6df3d8814f7a6a42ce9f4",
      "etag": "\"6a5ba455-1b73e\"",
      "lastModified": "Sat, 18 Jul 2026 16:05:41 GMT",
      "cacheControl": "max-age=31536000, public, immutable",
      "hashBoundary": "sha256 covers the decoded HTTP entity body bytes in [0, bodyLength); Accept-Encoding was identity."
    },

The runtime bundle and separately fetched default chain candidate are different served resources with different hashes. Static fetching proves their observed bytes, but not which candidate an individual browser actually imported after override resolution.

1. Lines 1–18

   Bind the live versioned runtime URL, JavaScript response, length, and decoded-body hash.

2. Lines 19–36

   Bind the separate versioned default chain candidate URL, response metadata, and hash boundary.

const expectedBuildVersion = "play-bundle-de6020cca220427a";
const expectedRuntimePath = "/runtime/play-bundle-de6020cca220427a/assets/index-BPPMv-5b.js";
const expectedChainPath = "/assets/nicechunkChain.play-bundle-de6020cca220427a.js";

const expectedResources = Object.freeze({
  playIndex: {
    requestUrl: "https://nicechunk.com/play/index.html",
    status: 200,
    contentType: "text/html",
    bodyLength: 55_636,
    sha256: "9caed4fdcbd50702fbae99068771ccf9ce108046f918251996bc2e85363ae48f",
  },
  playMainFallback: {
    requestUrl: "https://nicechunk.com/play/main.js",
    status: 200,
    contentType: "text/html",
    bodyLength: 55_636,
    sha256: "9caed4fdcbd50702fbae99068771ccf9ce108046f918251996bc2e85363ae48f",
  },
  playAdapterFallback: {
    requestUrl: "https://nicechunk.com/play/play-chain-adapter.js",
    status: 200,
    contentType: "text/html",
    bodyLength: 55_636,
    sha256: "9caed4fdcbd50702fbae99068771ccf9ce108046f918251996bc2e85363ae48f",
  },
  versionedRuntime: {
    requestUrl: `https://nicechunk.com${expectedRuntimePath}`,
    status: 200,
    contentType: "application/javascript",
    bodyLength: 989_679,
    sha256: "594a23c33a6bc37a73064f3631cf69bbd8f6a24e7c0168bf829b11bc0a9036c6",
  },
  versionedChain: {
    requestUrl: `https://nicechunk.com${expectedChainPath}`,
    status: 200,
    contentType: "application/javascript",
    bodyLength: 112_446,
    sha256: "2fd4d2f3a36e67a97db59e8b6c8263fbeb2753e5eff6df3d8814f7a6a42ce9f4",
  },

The capture checker assigns distinct expected resource IDs to the live entry, two HTML fallbacks, versioned runtime, and versioned chain candidate, then pins each path, response shape, length, and SHA-256.

1. Lines 1–5

   Pin the build label and distinct runtime and default chain candidate paths.

2. Lines 6–25

   Pin the served index and two direct repository-module URL HTML fallback responses.

3. Lines 26–40

   Pin the versioned runtime and separately fetched versioned chain candidate bytes.

  const unsignedReport = {
    schemaVersion: 1,
    kind: "nicechunk-player-sessions-production-runtime-snapshot",
    auditDate,
    snapshotDate: captureStartedAt.slice(0, 10),
    captureStartedAt,
    capturedAt: new Date().toISOString(),
    productionOrigin,
    scope: {
      statement: "A byte-pinned snapshot of the public NiceChunk production entry, runtime bundle, and runtime-resolved chain-module candidates.",
      productionSnapshotNotPermanentFact: true,
      repositorySourceUsedAsProductionEvidence: false,
      rawResponseBodiesRetained: false,
      retainedInstead: "Full response SHA-256/length/status metadata plus byte offsets and hashed short literal contexts.",
      dateSemantics: "auditDate names the documentation audit batch and output filename; snapshotDate is the real UTC date of the HTTPS observation.",
    },
    privacyAndNetworkBoundary: {
      transport: "TLS HTTPS only",
      requestMethod: "GET",
      fixedPublicHost: "nicechunk.com",
      requestsMade: resources.length,
      requestBodiesSent: 0,
      authorizationHeadersSent: false,
      cookiesSent: false,
      queryCredentialsSent: false,
      browserStorageRead: false,
      walletKeyMaterialRead: false,
      rpcMethodsCalled: [],
      transactionsConstructed: 0,
      transactionsSent: 0,
      note: "Static JavaScript contains storage-key and secretKey field names; this capture reads code bytes only and never reads any player's stored values.",
    },

The capture script labels repository source as non-production evidence and records fixed-host TLS GETs with no browser storage, wallet key, RPC, or transaction access. This is a static byte snapshot, not a HAR, override read, or execution trace.

1. Lines 1–16

   Record the point-in-time byte scope, date semantics, and repository-versus-served evidence boundary.

2. Lines 17–25

   Record fixed-host TLS GET transport without request bodies, credentials, or cookies.

3. Lines 26–32

   Record no browser values, wallet keys, RPC calls, transaction construction, or sends.