@absol-labs/agent 0.5.0 → 0.7.0

package/dist/wallet/privy-session-broker.d.ts

@@ -0,0 +1,109 @@
+import { type Address, type Hex } from "viem";
+import { type SignedSpendMandate } from "../mandates/mandate.js";
+export declare const PRIVY_BROKER_CHAIN_ID = 84532;
+export declare const PRIVY_BROKER_CAIP2: "eip155:84532";
+export declare const PRIVY_BROKER_ESCROW: "0x0f09f36Ccc05A7c9882F438721C08De314dFd46C";
+export declare const PRIVY_BROKER_USDC: "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
+export declare const PRIVY_POLICY_MAX_TOTAL_USDC = 1000000n;
+export declare const PRIVY_POLICY_MAX_RATE_USDC = 1000n;
+export declare const PRIVY_POLICY_MAX_DURATION_SECONDS = 3600;
+export declare const PRIVY_MAX_SESSION_SECONDS = 86400;
+export interface PrivyLinkedWallet {
+    readonly id: string | null;
+    readonly address: string;
+    readonly chain_type: string;
+    readonly connector_type?: string;
+    readonly wallet_client_type?: string;
+}
+export interface PrivyBrokerProvider {
+    verifyAccessToken(token: string): Promise<{
+        readonly userId: string;
+    }>;
+    getUserWallets(userId: string): Promise<readonly PrivyLinkedWallet[]>;
+    sendTransaction(input: {
+        readonly walletId: string;
+        readonly transaction: Record<string, unknown>;
+        readonly authorizationPrivateKey: string;
+        readonly sponsor: boolean;
+    }): Promise<Hex>;
+    signTypedData(input: {
+        readonly walletId: string;
+        readonly typedData: Record<string, unknown>;
+        readonly authorizationPrivateKey: string;
+    }): Promise<Hex>;
+}
+export interface BrokerStreamReader {
+    getStream(streamId: Hex): Promise<{
+        readonly buyer: Address;
+        readonly serviceRef: Hex;
+        readonly status: "active" | "closed";
+    }>;
+}
+export interface PrivyBrokerSession {
+    readonly id: string;
+    readonly tokenHash: string;
+    readonly userId: string;
+    readonly walletId: string;
+    readonly address: Address;
+    readonly signedMandate: SignedSpendMandate;
+    readonly expiresAt: number;
+    readonly createdAt: number;
+    readonly revokedAt?: number;
+    readonly spentSoFarUsdc: bigint;
+    /** True after the broker has requested gas sponsorship for one write. */
+    readonly sponsorshipUsed?: boolean;
+}
+export interface PrivyBrokerSessionStore {
+    findByTokenHash(tokenHash: string): Promise<PrivyBrokerSession | null>;
+    get(id: string): Promise<PrivyBrokerSession | null>;
+    put(session: PrivyBrokerSession): Promise<void>;
+}
+export interface CreatePrivyBrokerSessionInput {
+    readonly accessToken: string;
+    readonly walletId: string;
+    readonly address: Address;
+    readonly signedMandate: unknown;
+}
+export interface PrivyBrokerRpcInput {
+    readonly token: string;
+    readonly method: "eth_sendTransaction" | "eth_signTypedData_v4";
+    readonly params: readonly unknown[];
+}
+export declare class PrivySessionBrokerError extends Error {
+    readonly code: "unauthorized" | "invalid-request" | "expired" | "revoked" | "policy-denied" | "provider-error";
+    constructor(code: "unauthorized" | "invalid-request" | "expired" | "revoked" | "policy-denied" | "provider-error", message: string, options?: {
+        readonly cause?: unknown;
+    });
+}
+export declare class PrivySessionBroker {
+    private readonly dependencies;
+    private readonly locks;
+    constructor(dependencies: {
+        readonly provider: PrivyBrokerProvider;
+        readonly store: PrivyBrokerSessionStore;
+        readonly streamReader: BrokerStreamReader;
+        readonly authorizationPrivateKey: string;
+        readonly nowSeconds?: () => number;
+    });
+    createSession(input: CreatePrivyBrokerSessionInput): Promise<{
+        readonly sessionId: string;
+        readonly token: string;
+        readonly address: Address;
+        readonly expiresAt: number;
+    }>;
+    revokeSession(accessToken: string, sessionId: string): Promise<void>;
+    rpc(input: PrivyBrokerRpcInput): Promise<Hex>;
+    private sendTransaction;
+    private signTypedData;
+    private providerSend;
+    private requireSession;
+    private withSessionLock;
+    private now;
+}
+export declare class InMemoryPrivyBrokerSessionStore implements PrivyBrokerSessionStore {
+    private readonly sessions;
+    findByTokenHash(tokenHash: string): Promise<PrivyBrokerSession | null>;
+    get(id: string): Promise<PrivyBrokerSession | null>;
+    put(session: PrivyBrokerSession): Promise<void>;
+}
+//# sourceMappingURL=privy-session-broker.d.ts.map

package/dist/wallet/privy-session-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privy-session-broker.d.ts","sourceRoot":"","sources":["../../src/wallet/privy-session-broker.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,GAAG,EACT,MAAM,MAAM,CAAC;AAGd,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAOhC,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAC3C,eAAO,MAAM,kBAAkB,EAAG,cAAuB,CAAC;AAC1D,eAAO,MAAM,mBAAmB,EAC9B,4CAAqD,CAAC;AACxD,eAAO,MAAM,iBAAiB,EAC5B,4CAAqD,CAAC;AACxD,eAAO,MAAM,2BAA2B,WAAa,CAAC;AACtD,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,iCAAiC,OAAQ,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAS,CAAC;AA0BhD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;IACtE,eAAe,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;QACzC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,aAAa,CAAC,KAAK,EAAE;QACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;KAC1C,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;KACtC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACvE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,GAAG,sBAAsB,CAAC;IAChE,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;CACrC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,QAAQ,CAAC,IAAI,EACT,cAAc,GACd,iBAAiB,GACjB,SAAS,GACT,SAAS,GACT,eAAe,GACf,gBAAgB;gBANX,IAAI,EACT,cAAc,GACd,iBAAiB,GACjB,SAAS,GACT,SAAS,GACT,eAAe,GACf,gBAAgB,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKzC;AAED,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAH/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;gBAGvC,YAAY,EAAE;QAC7B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;QACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;QACxC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;QAC1C,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;QACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;KACpC;IAGG,aAAa,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC;QACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IAuEI,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBpE,GAAG,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC;YAWrC,eAAe;YAiFf,aAAa;YA0Fb,YAAY;YA8BZ,cAAc;YA4Bd,eAAe;IAoB7B,OAAO,CAAC,GAAG;CAGZ;AAED,qBAAa,+BAAgC,YAAW,uBAAuB;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyC;IAE5D,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAQtE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAInD,GAAG,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtD"}

package/dist/wallet/privy-session-broker.js

@@ -0,0 +1,372 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { streamEscrowV2Abi } from "@absol-labs/shared";
+import { decodeFunctionData, getAddress, isAddress, } from "viem";
+import { z } from "zod";
+import { checkMandate, signedSpendMandateSchema, verifyMandateOwnerSignature, verifySignedMandate, } from "../mandates/mandate.js";
+import { invocationCapabilityDomainName, invocationCapabilityDomainVersion, invocationCapabilitySchema, } from "../capability/invocation-capability.js";
+export const PRIVY_BROKER_CHAIN_ID = 84532;
+export const PRIVY_BROKER_CAIP2 = "eip155:84532";
+export const PRIVY_BROKER_ESCROW = "0x0f09f36Ccc05A7c9882F438721C08De314dFd46C";
+export const PRIVY_BROKER_USDC = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
+export const PRIVY_POLICY_MAX_TOTAL_USDC = 1000000n;
+export const PRIVY_POLICY_MAX_RATE_USDC = 1000n;
+export const PRIVY_POLICY_MAX_DURATION_SECONDS = 3_600;
+export const PRIVY_MAX_SESSION_SECONDS = 86_400;
+const wireMandateSchema = z.object({
+    mandateId: z.string(),
+    owner: z.string(),
+    chainId: z.number().int(),
+    issuedAt: z.number().int(),
+    mandate: z.object({
+        maxPerStreamUsdc: z.coerce.bigint(),
+        maxTotalUsdc: z.coerce.bigint(),
+        maxRatePerSecondUsdc: z.coerce.bigint(),
+        maxDurationSeconds: z.number().int(),
+        allowedOperators: z.array(z.string()).optional(),
+        expiresAt: z.number().int(),
+    }),
+    signature: z.string(),
+});
+const transactionSchema = z.object({
+    from: z.string().refine(isAddress),
+    to: z.string().refine(isAddress),
+    data: z.string().regex(/^0x[0-9a-fA-F]*$/),
+    value: z.union([z.string(), z.number(), z.bigint()]).optional(),
+    chainId: z.union([z.string(), z.number()]).optional(),
+});
+export class PrivySessionBrokerError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+        this.name = "PrivySessionBrokerError";
+    }
+}
+export class PrivySessionBroker {
+    dependencies;
+    locks = new Map();
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    async createSession(input) {
+        const now = this.now();
+        const auth = await this.dependencies.provider
+            .verifyAccessToken(input.accessToken)
+            .catch((error) => {
+            throw new PrivySessionBrokerError("unauthorized", "Privy access token is invalid", { cause: error });
+        });
+        const address = requireAddress(input.address);
+        const wallets = await this.dependencies.provider.getUserWallets(auth.userId);
+        const wallet = wallets.find((candidate) => candidate.id === input.walletId &&
+            candidate.address.toLowerCase() === address.toLowerCase() &&
+            candidate.chain_type === "ethereum" &&
+            candidate.connector_type === "embedded" &&
+            candidate.wallet_client_type === "privy");
+        if (!wallet?.id) {
+            throw new PrivySessionBrokerError("unauthorized", "wallet is not a user-owned Privy embedded Ethereum wallet");
+        }
+        const signedMandate = parseWireMandate(input.signedMandate);
+        if (signedMandate.owner.toLowerCase() !== address.toLowerCase() ||
+            signedMandate.chainId !== PRIVY_BROKER_CHAIN_ID) {
+            throw new PrivySessionBrokerError("policy-denied", "mandate owner or chain does not match the embedded wallet");
+        }
+        const verified = await verifySignedMandate(signedMandate, {
+            nowSeconds: now,
+        });
+        if (!verified.allowed) {
+            throw new PrivySessionBrokerError("policy-denied", `mandate denied: ${verified.reason}`);
+        }
+        assertMandateWithinPrivyPolicy(signedMandate);
+        const expiresAt = Math.min(signedMandate.mandate.expiresAt, now + PRIVY_MAX_SESSION_SECONDS);
+        const token = randomBytes(32).toString("base64url");
+        const session = {
+            id: randomBytes(16).toString("hex"),
+            tokenHash: hashToken(token),
+            userId: auth.userId,
+            walletId: wallet.id,
+            address,
+            signedMandate,
+            expiresAt,
+            createdAt: now,
+            spentSoFarUsdc: 0n,
+        };
+        await this.dependencies.store.put(session);
+        return { sessionId: session.id, token, address, expiresAt };
+    }
+    async revokeSession(accessToken, sessionId) {
+        const auth = await this.dependencies.provider
+            .verifyAccessToken(accessToken)
+            .catch(() => {
+            throw new PrivySessionBrokerError("unauthorized", "Privy access token is invalid");
+        });
+        const session = await this.dependencies.store.get(sessionId);
+        if (session === null || session.userId !== auth.userId) {
+            throw new PrivySessionBrokerError("unauthorized", "session not found");
+        }
+        await this.dependencies.store.put({
+            ...session,
+            revokedAt: this.now(),
+        });
+    }
+    async rpc(input) {
+        const session = await this.requireSession(input.token);
+        return this.withSessionLock(session.id, async () => {
+            const current = await this.requireSession(input.token);
+            if (input.method === "eth_sendTransaction") {
+                return this.sendTransaction(current, input.params);
+            }
+            return this.signTypedData(current, input.params);
+        });
+    }
+    async sendTransaction(session, params) {
+        const transaction = transactionSchema.parse(params[0]);
+        if (transaction.from.toLowerCase() !== session.address.toLowerCase()) {
+            throw new PrivySessionBrokerError("policy-denied", "transaction sender does not match session wallet");
+        }
+        assertChainId(transaction.chainId);
+        assertZeroValue(transaction.value);
+        const to = getAddress(transaction.to);
+        const data = transaction.data;
+        if (to.toLowerCase() === PRIVY_BROKER_USDC.toLowerCase()) {
+            assertBoundedApproval(data, session.signedMandate);
+        }
+        else if (to.toLowerCase() === PRIVY_BROKER_ESCROW.toLowerCase()) {
+            const decoded = decodeFunctionData({ abi: streamEscrowV2Abi, data });
+            if (decoded.functionName === "openStream") {
+                const [operator, , deposit, rate, duration] = decoded.args;
+                const decision = await checkMandate(session.signedMandate, {
+                    operator,
+                    budgetUsdc: deposit,
+                    ratePerSecondUsdc: rate,
+                    maxDurationSeconds: Number(duration),
+                }, session.spentSoFarUsdc, { nowSeconds: this.now() });
+                if (!decision.allowed) {
+                    throw new PrivySessionBrokerError("policy-denied", `mandate denied: ${decision.reason}`);
+                }
+                const hash = await this.providerSend(session, transaction);
+                await this.dependencies.store.put({
+                    ...session,
+                    sponsorshipUsed: true,
+                    spentSoFarUsdc: session.spentSoFarUsdc + deposit,
+                });
+                return hash;
+            }
+            if (decoded.functionName !== "close" &&
+                decoded.functionName !== "reclaim" &&
+                decoded.functionName !== "reclaimUnverified") {
+                throw new PrivySessionBrokerError("policy-denied", "escrow method is not allowed for an agent session");
+            }
+            const owner = await verifyMandateOwnerSignature(session.signedMandate);
+            if (!owner.allowed) {
+                throw new PrivySessionBrokerError("policy-denied", "mandate owner signature is invalid");
+            }
+            const streamId = decoded.args[0];
+            const stream = await this.dependencies.streamReader.getStream(streamId);
+            if (stream.buyer.toLowerCase() !== session.address.toLowerCase()) {
+                throw new PrivySessionBrokerError("policy-denied", "session wallet is not the stream buyer");
+            }
+        }
+        else {
+            throw new PrivySessionBrokerError("policy-denied", "transaction target is not allowlisted");
+        }
+        return this.providerSend(session, transaction);
+    }
+    async signTypedData(session, params) {
+        const raw = params[1];
+        const typedData = typeof raw === "string"
+            ? JSON.parse(raw)
+            : raw;
+        if (typedData === null || typeof typedData !== "object") {
+            throw new PrivySessionBrokerError("invalid-request", "typed data must be an object");
+        }
+        const typedDataRecord = typedData;
+        if (typeof params[0] !== "string" ||
+            params[0].toLowerCase() !== session.address.toLowerCase()) {
+            throw new PrivySessionBrokerError("policy-denied", "typed-data signer does not match the session wallet");
+        }
+        const domain = typedDataRecord.domain;
+        if (domain?.name !== invocationCapabilityDomainName ||
+            domain.version !== invocationCapabilityDomainVersion ||
+            Number(domain.chainId) !== PRIVY_BROKER_CHAIN_ID ||
+            typeof domain.verifyingContract !== "string" ||
+            domain.verifyingContract.toLowerCase() !==
+                PRIVY_BROKER_ESCROW.toLowerCase() ||
+            typedDataRecord.primaryType !== "InvocationCapability") {
+            throw new PrivySessionBrokerError("policy-denied", "only Metrik invocation capabilities may be signed");
+        }
+        const rawMessage = typedDataRecord.message;
+        const capability = invocationCapabilitySchema.parse({
+            ...rawMessage,
+            expiry: typeof rawMessage?.expiry === "string"
+                ? Number(rawMessage.expiry)
+                : rawMessage?.expiry,
+        });
+        if (capability.buyer.toLowerCase() !== session.address.toLowerCase() ||
+            capability.expiry <= this.now() ||
+            capability.expiry > Math.min(session.expiresAt, this.now() + 120)) {
+            throw new PrivySessionBrokerError("policy-denied", "capability buyer or expiry is outside the session");
+        }
+        const stream = await this.dependencies.streamReader.getStream(capability.streamId);
+        if (stream.status !== "active" ||
+            stream.buyer.toLowerCase() !== session.address.toLowerCase() ||
+            stream.serviceRef.toLowerCase() !== capability.serviceRef.toLowerCase()) {
+            throw new PrivySessionBrokerError("policy-denied", "capability does not match an active buyer stream");
+        }
+        try {
+            return await this.dependencies.provider.signTypedData({
+                walletId: session.walletId,
+                typedData: typedDataRecord,
+                authorizationPrivateKey: this.dependencies.authorizationPrivateKey,
+            });
+        }
+        catch (error) {
+            throw new PrivySessionBrokerError("provider-error", "Privy rejected the typed-data signature request", { cause: error });
+        }
+    }
+    async providerSend(session, transaction) {
+        const { chainId: _chainId, ...privyTransaction } = transaction;
+        const sponsor = session.sponsorshipUsed !== true;
+        let hash;
+        try {
+            hash = await this.dependencies.provider.sendTransaction({
+                walletId: session.walletId,
+                transaction: privyTransaction,
+                authorizationPrivateKey: this.dependencies.authorizationPrivateKey,
+                sponsor,
+            });
+        }
+        catch (error) {
+            throw new PrivySessionBrokerError("provider-error", "Privy rejected the transaction request", { cause: error });
+        }
+        if (sponsor) {
+            await this.dependencies.store.put({
+                ...session,
+                sponsorshipUsed: true,
+            });
+        }
+        return hash;
+    }
+    async requireSession(token) {
+        if (token.length < 32) {
+            throw new PrivySessionBrokerError("unauthorized", "invalid session token");
+        }
+        const session = await this.dependencies.store.findByTokenHash(hashToken(token));
+        if (session === null ||
+            !safeTokenHashEqual(session.tokenHash, hashToken(token))) {
+            throw new PrivySessionBrokerError("unauthorized", "invalid session token");
+        }
+        if (session.revokedAt !== undefined) {
+            throw new PrivySessionBrokerError("revoked", "session is revoked");
+        }
+        if (this.now() >= session.expiresAt) {
+            throw new PrivySessionBrokerError("expired", "session is expired");
+        }
+        return session;
+    }
+    async withSessionLock(id, operation) {
+        const previous = this.locks.get(id) ?? Promise.resolve();
+        let release;
+        const next = new Promise((resolve) => {
+            release = resolve;
+        });
+        const queued = previous.then(() => next);
+        this.locks.set(id, queued);
+        await previous;
+        try {
+            return await operation();
+        }
+        finally {
+            release();
+            if (this.locks.get(id) === queued)
+                this.locks.delete(id);
+        }
+    }
+    now() {
+        return this.dependencies.nowSeconds?.() ?? Math.floor(Date.now() / 1_000);
+    }
+}
+export class InMemoryPrivyBrokerSessionStore {
+    sessions = new Map();
+    async findByTokenHash(tokenHash) {
+        return ([...this.sessions.values()].find((session) => safeTokenHashEqual(session.tokenHash, tokenHash)) ?? null);
+    }
+    async get(id) {
+        return this.sessions.get(id) ?? null;
+    }
+    async put(session) {
+        this.sessions.set(session.id, session);
+    }
+}
+function parseWireMandate(value) {
+    return signedSpendMandateSchema.parse(wireMandateSchema.parse(value));
+}
+function requireAddress(value) {
+    if (!isAddress(value)) {
+        throw new PrivySessionBrokerError("invalid-request", "invalid wallet address");
+    }
+    return getAddress(value);
+}
+function assertMandateWithinPrivyPolicy(signed) {
+    const mandate = signed.mandate;
+    if (mandate.maxPerStreamUsdc > PRIVY_POLICY_MAX_TOTAL_USDC ||
+        mandate.maxTotalUsdc > PRIVY_POLICY_MAX_TOTAL_USDC ||
+        mandate.maxRatePerSecondUsdc > PRIVY_POLICY_MAX_RATE_USDC ||
+        mandate.maxDurationSeconds > PRIVY_POLICY_MAX_DURATION_SECONDS) {
+        throw new PrivySessionBrokerError("policy-denied", "mandate exceeds the installed Privy signer policy");
+    }
+}
+function assertBoundedApproval(data, signed) {
+    const decoded = decodeFunctionData({
+        abi: [
+            {
+                type: "function",
+                name: "approve",
+                stateMutability: "nonpayable",
+                inputs: [
+                    { name: "spender", type: "address" },
+                    { name: "amount", type: "uint256" },
+                ],
+                outputs: [{ name: "", type: "bool" }],
+            },
+        ],
+        data,
+    });
+    const [spender, amount] = decoded.args;
+    if (spender.toLowerCase() !== PRIVY_BROKER_ESCROW.toLowerCase() ||
+        amount > signed.mandate.maxPerStreamUsdc) {
+        throw new PrivySessionBrokerError("policy-denied", "USDC approval exceeds the mandate or targets another spender");
+    }
+}
+function assertChainId(value) {
+    if (value === undefined)
+        return;
+    const parsed = typeof value === "number"
+        ? value
+        : value.startsWith("0x")
+            ? Number.parseInt(value.slice(2), 16)
+            : Number(value);
+    if (parsed !== PRIVY_BROKER_CHAIN_ID) {
+        throw new PrivySessionBrokerError("policy-denied", "transaction is not for Base Sepolia");
+    }
+}
+function assertZeroValue(value) {
+    if (value === undefined)
+        return;
+    const parsed = typeof value === "bigint"
+        ? value
+        : typeof value === "number"
+            ? BigInt(value)
+            : BigInt(value);
+    if (parsed !== 0n) {
+        throw new PrivySessionBrokerError("policy-denied", "native-token transfers are not allowed");
+    }
+}
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+function safeTokenHashEqual(left, right) {
+    const a = Buffer.from(left, "hex");
+    const b = Buffer.from(right, "hex");
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+//# sourceMappingURL=privy-session-broker.js.map

package/dist/wallet/privy-session-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privy-session-broker.js","sourceRoot":"","sources":["../../src/wallet/privy-session-broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,SAAS,GAGV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,2BAA2B,EAC3B,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AAEhD,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAuB,CAAC;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAC9B,4CAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAC5B,4CAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAU,CAAC;AACtD,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAM,CAAC;AACjD,MAAM,CAAC,MAAM,iCAAiC,GAAG,KAAK,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE;QACnC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE;QAC/B,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE;QACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACpC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;KAC5B,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAoEH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAErC;IADX,YACW,IAMW,EACpB,OAAe,EACf,OAAsC;QAEtC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAVf,SAAI,GAAJ,IAAI,CAMO;QAKpB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IAIV;IAHF,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE1D,YACmB,YAMhB;QANgB,iBAAY,GAAZ,YAAY,CAM5B;IACA,CAAC;IAEJ,KAAK,CAAC,aAAa,CAAC,KAAoC;QAMtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ;aAC1C,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC;aACpC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,+BAA+B,EAC/B,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAC7D,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ;YAC/B,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE;YACzD,SAAS,CAAC,UAAU,KAAK,UAAU;YACnC,SAAS,CAAC,cAAc,KAAK,UAAU;YACvC,SAAS,CAAC,kBAAkB,KAAK,OAAO,CAC3C,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5D,IACE,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE;YAC3D,aAAa,CAAC,OAAO,KAAK,qBAAqB,EAC/C,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE;YACxD,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mBAAmB,QAAQ,CAAC,MAAM,EAAE,CACrC,CAAC;QACJ,CAAC;QACD,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAE9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,aAAa,CAAC,OAAO,CAAC,SAAS,EAC/B,GAAG,GAAG,yBAAyB,CAChC,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAuB;YAClC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACnC,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,OAAO;YACP,aAAa;YACb,SAAS;YACT,SAAS,EAAE,GAAG;YACd,cAAc,EAAE,EAAE;SACnB,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,SAAiB;QACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ;aAC1C,iBAAiB,CAAC,WAAW,CAAC;aAC9B,KAAK,CAAC,GAAG,EAAE;YACV,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,+BAA+B,CAChC,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;YAChC,GAAG,OAAO;YACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAA0B;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,OAA2B,EAC3B,MAA0B;QAE1B,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,eAAe,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAW,CAAC;QAErC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;YACzD,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,mBAAmB,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBAC1C,MAAM,CAAC,QAAQ,EAAE,AAAD,EAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;gBAC3D,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,OAAO,CAAC,aAAa,EACrB;oBACE,QAAQ;oBACR,UAAU,EAAE,OAAO;oBACnB,iBAAiB,EAAE,IAAI;oBACvB,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC;iBACrC,EACD,OAAO,CAAC,cAAc,EACtB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAC3B,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mBAAmB,QAAQ,CAAC,MAAM,EAAE,CACrC,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;oBAChC,GAAG,OAAO;oBACV,eAAe,EAAE,IAAI;oBACrB,cAAc,EAAE,OAAO,CAAC,cAAc,GAAG,OAAO;iBACjD,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,OAAO,CAAC,YAAY,KAAK,OAAO;gBAChC,OAAO,CAAC,YAAY,KAAK,SAAS;gBAClC,OAAO,CAAC,YAAY,KAAK,mBAAmB,EAC5C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mDAAmD,CACpD,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,oCAAoC,CACrC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACxE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;gBACjE,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,wCAAwC,CACzC,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,uCAAuC,CACxC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,OAA2B,EAC3B,MAA0B;QAE1B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,SAAS,GACb,OAAO,GAAG,KAAK,QAAQ;YACrB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B;YAC9C,CAAC,CAAC,GAAG,CAAC;QACV,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,SAAoC,CAAC;QAC7D,IACE,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ;YAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EACzD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAElB,CAAC;QACd,IACE,MAAM,EAAE,IAAI,KAAK,8BAA8B;YAC/C,MAAM,CAAC,OAAO,KAAK,iCAAiC;YACpD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,qBAAqB;YAChD,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;YAC5C,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE;gBACpC,mBAAmB,CAAC,WAAW,EAAE;YACnC,eAAe,CAAC,WAAW,KAAK,sBAAsB,EACtD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,OAEtB,CAAC;QACd,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC;YAClD,GAAG,UAAU;YACb,MAAM,EACJ,OAAO,UAAU,EAAE,MAAM,KAAK,QAAQ;gBACpC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,UAAU,EAAE,MAAM;SACzB,CAAC,CAAC;QACH,IACE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE;YAChE,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE;YAC/B,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EACjE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,CAC3D,UAAU,CAAC,QAAe,CAC3B,CAAC;QACF,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE;YAC5D,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,EACvE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,SAAS,EAAE,eAAe;gBAC1B,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB;aACnE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,gBAAgB,EAChB,iDAAiD,EACjD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAA2B,EAC3B,WAA8C;QAE9C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,GAAG,WAAW,CAAC;QAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC;QACjD,IAAI,IAAS,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACtD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,gBAAgB;gBAC7B,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB;gBAClE,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,gBAAgB,EAChB,wCAAwC,EACxC,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;gBAChC,GAAG,OAAO;gBACV,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAa;QACxC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,CAC3D,SAAS,CAAC,KAAK,CAAC,CACjB,CAAC;QACF,IACE,OAAO,KAAK,IAAI;YAChB,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,EAAU,EACV,SAA2B;QAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACzD,IAAI,OAAoB,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACzC,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,QAAQ,CAAC;QACf,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;YACV,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IAC5E,CAAC;CACF;AAED,MAAM,OAAO,+BAA+B;IACzB,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IAElE,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,OAAO,CACL,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3C,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CACjD,IAAI,IAAI,CACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAA2B;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,8BAA8B,CAAC,MAA0B;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IACE,OAAO,CAAC,gBAAgB,GAAG,2BAA2B;QACtD,OAAO,CAAC,YAAY,GAAG,2BAA2B;QAClD,OAAO,CAAC,oBAAoB,GAAG,0BAA0B;QACzD,OAAO,CAAC,kBAAkB,GAAG,iCAAiC,EAC9D,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAS,EAAE,MAA0B;IAClE,MAAM,OAAO,GAAG,kBAAkB,CAAC;QACjC,GAAG,EAAE;YACH;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,SAAS;gBACf,eAAe,EAAE,YAAY;gBAC7B,MAAM,EAAE;oBACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;oBACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;iBACpC;gBACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;aACtC;SACO;QACV,IAAI;KACL,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACvC,IACE,OAAO,CAAC,WAAW,EAAE,KAAK,mBAAmB,CAAC,WAAW,EAAE;QAC3D,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,EACxC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,8DAA8D,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAkC;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACrC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,qCAAqC,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAA2C;IAClE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,wCAAwC,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/wallet/privy-session-provider.d.ts

@@ -0,0 +1,21 @@
+import { type Address } from "viem";
+import type { PrivyEip1193Provider } from "./provider.js";
+export interface PrivySessionProviderConfig {
+    readonly brokerUrl: string;
+    readonly sessionToken: string;
+    readonly address: Address;
+    readonly rpcUrl?: string;
+    readonly fetchImpl?: typeof fetch;
+}
+export declare class PrivySessionProviderError extends Error {
+    constructor(message: string, options?: {
+        readonly cause?: unknown;
+    });
+}
+/**
+ * EIP-1193 provider for a policy-bound Metrik/Privy headless session.
+ * Signing and writes go only to the broker; public read RPCs go directly to
+ * Base Sepolia and never receive the session token.
+ */
+export declare function createPrivySessionProvider(config: PrivySessionProviderConfig): PrivyEip1193Provider;
+//# sourceMappingURL=privy-session-provider.d.ts.map

package/dist/wallet/privy-session-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privy-session-provider.d.ts","sourceRoot":"","sources":["../../src/wallet/privy-session-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,OAAO,EAAY,MAAM,MAAM,CAAC;AAG1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAe1D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAIpE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CA0EtB"}

package/dist/wallet/privy-session-provider.js

@@ -0,0 +1,94 @@
+import { getAddress } from "viem";
+import { z } from "zod";
+const jsonRpcResponseSchema = z.object({
+    jsonrpc: z.literal("2.0"),
+    id: z.union([z.string(), z.number(), z.null()]),
+    result: z.unknown().optional(),
+    error: z
+        .object({
+        code: z.number(),
+        message: z.string(),
+        data: z.unknown().optional(),
+    })
+        .optional(),
+});
+export class PrivySessionProviderError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "PrivySessionProviderError";
+    }
+}
+/**
+ * EIP-1193 provider for a policy-bound Metrik/Privy headless session.
+ * Signing and writes go only to the broker; public read RPCs go directly to
+ * Base Sepolia and never receive the session token.
+ */
+export function createPrivySessionProvider(config) {
+    const fetchImpl = config.fetchImpl ?? fetch;
+    const address = getAddress(config.address);
+    const brokerUrl = new URL("/v1/rpc", requireHttpsBase(config.brokerUrl));
+    const rpcUrl = config.rpcUrl ?? "https://base-sepolia-rpc.publicnode.com";
+    let rpcId = 0;
+    return {
+        async request({ method, params = [] }) {
+            if (method === "eth_chainId")
+                return "0x14a34";
+            if (method === "eth_accounts" || method === "eth_requestAccounts") {
+                return [address];
+            }
+            if (method === "eth_sendTransaction" ||
+                method === "eth_signTypedData_v4") {
+                const response = await fetchImpl(brokerUrl, {
+                    method: "POST",
+                    headers: {
+                        authorization: `Bearer ${config.sessionToken}`,
+                        "content-type": "application/json",
+                    },
+                    body: JSON.stringify({ method, params }, bigintJson),
+                }).catch((error) => {
+                    throw new PrivySessionProviderError("session broker is unreachable", {
+                        cause: error,
+                    });
+                });
+                const body = (await response.json().catch(() => null));
+                if (!response.ok || body?.result === undefined) {
+                    throw new PrivySessionProviderError(body?.error ??
+                        `session broker rejected ${method} (${response.status})`);
+                }
+                return body.result;
+            }
+            if (method === "personal_sign" ||
+                method === "eth_sign" ||
+                method === "eth_signTransaction" ||
+                method === "wallet_sendCalls") {
+                throw new PrivySessionProviderError(`${method} is outside the Metrik agent-session policy`);
+            }
+            const id = ++rpcId;
+            const response = await fetchImpl(rpcUrl, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ jsonrpc: "2.0", id, method, params }, bigintJson),
+            }).catch((error) => {
+                throw new PrivySessionProviderError("Base Sepolia RPC is unreachable", {
+                    cause: error,
+                });
+            });
+            const body = jsonRpcResponseSchema.parse(await response.json());
+            if (!response.ok || body.error !== undefined) {
+                throw new PrivySessionProviderError(body.error?.message ?? `Base Sepolia RPC rejected ${method}`);
+            }
+            return body.result;
+        },
+    };
+}
+function requireHttpsBase(value) {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.hostname !== "localhost") {
+        throw new PrivySessionProviderError("session broker URL must use HTTPS (except localhost development)");
+    }
+    return url;
+}
+function bigintJson(_key, value) {
+    return typeof value === "bigint" ? `0x${value.toString(16)}` : value;
+}
+//# sourceMappingURL=privy-session-provider.js.map

package/dist/wallet/privy-session-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privy-session-provider.js","sourceRoot":"","sources":["../../src/wallet/privy-session-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,MAAM,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAUH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,OAAsC;QACjE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,yCAAyC,CAAC;IAC1E,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE;YACnC,IAAI,MAAM,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC;YAC/C,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBAClE,OAAO,CAAC,OAAO,CAAC,CAAC;YACnB,CAAC;YACD,IACE,MAAM,KAAK,qBAAqB;gBAChC,MAAM,KAAK,sBAAsB,EACjC,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;oBAC1C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE;wBAC9C,cAAc,EAAE,kBAAkB;qBACnC;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC;iBACrD,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC1B,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,EAAE;wBACnE,KAAK,EAAE,KAAK;qBACb,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAG7C,CAAC;gBACT,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC/C,MAAM,IAAI,yBAAyB,CACjC,IAAI,EAAE,KAAK;wBACT,2BAA2B,MAAM,KAAK,QAAQ,CAAC,MAAM,GAAG,CAC3D,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,CAAC,MAAM,CAAC;YACrB,CAAC;YACD,IACE,MAAM,KAAK,eAAe;gBAC1B,MAAM,KAAK,UAAU;gBACrB,MAAM,KAAK,qBAAqB;gBAChC,MAAM,KAAK,kBAAkB,EAC7B,CAAC;gBACD,MAAM,IAAI,yBAAyB,CACjC,GAAG,MAAM,6CAA6C,CACvD,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC;YACnB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EACtC,UAAU,CACX;aACF,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC1B,MAAM,IAAI,yBAAyB,CAAC,iCAAiC,EAAE;oBACrE,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7C,MAAM,IAAI,yBAAyB,CACjC,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,6BAA6B,MAAM,EAAE,CAC7D,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9D,MAAM,IAAI,yBAAyB,CACjC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACvE,CAAC"}