@artblocks/abx-cli 0.1.0-alpha.9 → 0.2.0

package/dist/creator-agent.js

@@ -0,0 +1,363 @@
+import { Chacha20Poly1305 } from '@hpke/chacha20poly1305';
+import { CipherSuite, DhkemP256HkdfSha256, HkdfSha256 } from '@hpke/core';
+import { generateAuthorizationSignature } from '@privy-io/node';
+const OAUTH = 'https://auth.privy.io/api/oauth/v2';
+const WALLET_API = 'https://api.privy.io/v1/wallets';
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const PROVIDER_ERRORS = new Set([
+    'access_denied',
+    'authorization_pending',
+    'device_auth_not_enabled',
+    'expired_token',
+    'invalid_grant',
+    'slow_down',
+]);
+export class CreatorAuthorizationError extends Error {
+    code;
+    constructor(code) {
+        super(`Creator wallet authorization: ${code}`);
+        this.code = code;
+        this.name = 'CreatorAuthorizationError';
+    }
+}
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new CreatorAuthorizationError('invalid_response');
+    return value;
+}
+function string(value) {
+    if (typeof value !== 'string' || !value || value.length > 16_384)
+        throw new CreatorAuthorizationError('invalid_response');
+    return value;
+}
+function verificationUrl(value) {
+    const raw = string(value);
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new CreatorAuthorizationError('invalid_verification_url');
+    }
+    const local = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '[::1]';
+    if (parsed.username || parsed.password || (parsed.protocol !== 'https:' && !(local && parsed.protocol === 'http:'))) {
+        throw new CreatorAuthorizationError('invalid_verification_url');
+    }
+    return parsed.toString();
+}
+function seconds(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0 || value > 86_400) {
+        throw new CreatorAuthorizationError('invalid_response');
+    }
+    return value * 1_000;
+}
+function base64(value) {
+    const encoded = string(value);
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded))
+        throw new CreatorAuthorizationError('invalid_response');
+    return new Uint8Array(Buffer.from(encoded, 'base64'));
+}
+/** Privy device grant client. Refresh credentials may be retained in a native OS credential store;
+ * decrypted request-signing keys remain memory-only and die with this instance. */
+export class CreatorAgentAuthorization {
+    #appId;
+    #fetch;
+    #now;
+    #store;
+    #onPersistenceError;
+    #device;
+    #tokens;
+    #authorizationKey;
+    #keyExpiresAt = 0;
+    #wallets = [];
+    #persist = false;
+    #refreshing;
+    #authenticating;
+    constructor(options) {
+        if (!/^[A-Za-z0-9_-]{1,200}$/.test(options.appId))
+            throw new CreatorAuthorizationError('invalid_app_id');
+        this.#appId = options.appId;
+        this.#fetch = options.fetchImpl ?? fetch;
+        this.#now = options.now ?? Date.now;
+        this.#store = options.store;
+        this.#onPersistenceError = options.onPersistenceError;
+    }
+    async #request(path, body, token) {
+        try {
+            const response = await this.#fetch(`${OAUTH}/${path}`, {
+                method: 'POST',
+                redirect: 'error',
+                signal: AbortSignal.timeout(15_000),
+                headers: {
+                    'content-type': 'application/json',
+                    'privy-app-id': this.#appId,
+                    ...(token ? { authorization: `Bearer ${token}`, 'privy-grant-type': 'device_code' } : {}),
+                },
+                body: JSON.stringify(body),
+            });
+            const text = await response.text();
+            if (text.length > 65_536)
+                throw new CreatorAuthorizationError('invalid_response');
+            return { response, data: object(JSON.parse(text)) };
+        }
+        catch (error) {
+            if (error instanceof CreatorAuthorizationError)
+                throw error;
+            throw new CreatorAuthorizationError('request_failed');
+        }
+    }
+    #providerError(response, data) {
+        if (data.error === 'Device authorization is not enabled for this app') {
+            return new CreatorAuthorizationError('device_auth_not_enabled');
+        }
+        const code = typeof data.error === 'string' && PROVIDER_ERRORS.has(data.error) ? data.error : 'provider_error';
+        return new CreatorAuthorizationError(code);
+    }
+    #parseTokens(data, startedAt) {
+        if (data.token_type !== 'Bearer')
+            throw new CreatorAuthorizationError('invalid_response');
+        return {
+            accessToken: string(data.access_token),
+            refreshToken: string(data.refresh_token),
+            expiresAt: startedAt + seconds(data.expires_in),
+        };
+    }
+    async start() {
+        if (this.#device)
+            throw new CreatorAuthorizationError('already_started');
+        const { response, data } = await this.#request('device_authorization', {});
+        if (!response.ok)
+            throw this.#providerError(response, data);
+        const expiresAt = this.#now() + seconds(data.expires_in);
+        this.#device = {
+            code: string(data.device_code),
+            expiresAt,
+            interval: data.interval === undefined ? 5_000 : seconds(data.interval),
+        };
+        return {
+            userCode: string(data.user_code),
+            verificationUri: verificationUrl(data.verification_uri),
+            ...(data.verification_uri_complete ? { verificationUriComplete: verificationUrl(data.verification_uri_complete) } : {}),
+        };
+    }
+    async wait() {
+        const device = this.#device;
+        if (!device)
+            throw new CreatorAuthorizationError('not_started');
+        for (;;) {
+            const remaining = device.expiresAt - this.#now();
+            if (remaining <= 0)
+                throw new CreatorAuthorizationError('expired_token');
+            await new Promise((resolve) => setTimeout(resolve, Math.min(device.interval, remaining)));
+            const startedAt = this.#now();
+            const { response, data } = await this.#request('token', { grant_type: DEVICE_GRANT, device_code: device.code });
+            if (response.ok) {
+                this.#tokens = this.#parseTokens(data, startedAt);
+                await this.#authenticate();
+                this.#device = undefined;
+                return this.#wallets.map((wallet) => ({ ...wallet }));
+            }
+            const error = this.#providerError(response, data);
+            if (response.status === 400 && (error.code === 'authorization_pending' || error.code === 'slow_down')) {
+                if (error.code === 'slow_down')
+                    device.interval += 5_000;
+                continue;
+            }
+            throw error;
+        }
+    }
+    /** Resume a prior Privy grant. Returns null when no usable credential remains. */
+    async restore() {
+        if (!this.#store)
+            return null;
+        const stored = await this.#store.load();
+        if (!stored)
+            return null;
+        this.#tokens = stored;
+        this.#persist = true;
+        try {
+            await this.#authenticate();
+            return this.#wallets.map((wallet) => ({ ...wallet }));
+        }
+        catch (error) {
+            if (error instanceof CreatorAuthorizationError &&
+                ['access_denied', 'expired_token', 'invalid_grant', 'login_required'].includes(error.code)) {
+                await this.#clearStored();
+                return null;
+            }
+            throw error;
+        }
+    }
+    /** Persist a newly approved grant after the caller verifies that Privy returned the expected wallet. */
+    async remember() {
+        if (!this.#store || !this.#tokens)
+            return;
+        await this.#store.save(this.#tokens);
+        this.#persist = true;
+    }
+    async #saveRotatedTokens() {
+        if (!this.#persist || !this.#store || !this.#tokens)
+            return;
+        try {
+            await this.#store.save(this.#tokens);
+        }
+        catch {
+            this.#persist = false;
+            this.#onPersistenceError?.();
+        }
+    }
+    async #clearStored() {
+        this.#tokens = undefined;
+        this.#authorizationKey = undefined;
+        this.#keyExpiresAt = 0;
+        this.#wallets = [];
+        this.#persist = false;
+        if (!this.#store)
+            return;
+        try {
+            await this.#store.clear();
+        }
+        catch {
+            this.#onPersistenceError?.();
+        }
+    }
+    async #refresh() {
+        if (this.#refreshing)
+            return this.#refreshing;
+        if (!this.#tokens)
+            throw new CreatorAuthorizationError('login_required');
+        const previous = this.#tokens;
+        const refreshToken = this.#tokens.refreshToken;
+        this.#refreshing = (async () => {
+            this.#tokens = undefined;
+            this.#authorizationKey = undefined;
+            this.#keyExpiresAt = 0;
+            this.#wallets = [];
+            const startedAt = this.#now();
+            try {
+                const { response, data } = await this.#request('token', { grant_type: 'refresh_token', refresh_token: refreshToken });
+                if (!response.ok)
+                    throw this.#providerError(response, data);
+                this.#tokens = this.#parseTokens(data, startedAt);
+                await this.#saveRotatedTokens();
+            }
+            catch (error) {
+                if (error instanceof CreatorAuthorizationError &&
+                    ['access_denied', 'expired_token', 'invalid_grant'].includes(error.code)) {
+                    await this.#clearStored();
+                }
+                else {
+                    // Preserve the last durable grant after a transient failure. If Privy accepted an
+                    // ambiguous refresh, the next attempt will return a definitive invalid-grant response.
+                    this.#tokens = previous;
+                }
+                throw error;
+            }
+        })().finally(() => {
+            this.#refreshing = undefined;
+        });
+        return this.#refreshing;
+    }
+    async #accessToken() {
+        if (this.#refreshing)
+            await this.#refreshing;
+        if (!this.#tokens)
+            throw new CreatorAuthorizationError('login_required');
+        if (this.#tokens.expiresAt <= this.#now() + 30_000)
+            await this.#refresh();
+        if (!this.#tokens || this.#tokens.expiresAt <= this.#now())
+            throw new CreatorAuthorizationError('login_required');
+        return this.#tokens.accessToken;
+    }
+    async #authenticate() {
+        if (this.#authenticating)
+            return this.#authenticating;
+        if (this.#authorizationKey && this.#keyExpiresAt > this.#now() + 5_000)
+            return;
+        this.#authenticating = this.#exchangeKey().finally(() => {
+            this.#authenticating = undefined;
+        });
+        return this.#authenticating;
+    }
+    async #exchangeKey() {
+        try {
+            const suite = new CipherSuite({ kem: new DhkemP256HkdfSha256(), kdf: new HkdfSha256(), aead: new Chacha20Poly1305() });
+            const pair = await suite.kem.generateKeyPair();
+            const publicKey = await globalThis.crypto.subtle.exportKey('spki', pair.publicKey);
+            const body = { encryption_type: 'HPKE', recipient_public_key: Buffer.from(publicKey).toString('base64') };
+            let result = await this.#request('wallets/authenticate', body, await this.#accessToken());
+            if (result.response.status === 401) {
+                await this.#refresh();
+                result = await this.#request('wallets/authenticate', body, await this.#accessToken());
+            }
+            if (!result.response.ok)
+                throw this.#providerError(result.response, result.data);
+            const encrypted = object(result.data.encrypted_authorization_key);
+            const expiresAt = typeof result.data.expires_at === 'number' ? result.data.expires_at : Date.parse(string(result.data.expires_at));
+            if (!Number.isFinite(expiresAt) || expiresAt <= this.#now() + 5_000) {
+                throw new CreatorAuthorizationError('expired_signing_key');
+            }
+            if (!Array.isArray(result.data.wallets))
+                throw new CreatorAuthorizationError('invalid_response');
+            const wallets = result.data.wallets.map((value) => {
+                const wallet = object(value);
+                return { id: string(wallet.id), address: string(wallet.address), chainType: string(wallet.chain_type) };
+            });
+            const recipient = await suite.createRecipientContext({ recipientKey: pair.privateKey, enc: base64(encrypted.encapsulated_key) });
+            const bytes = new Uint8Array(await recipient.open(base64(encrypted.ciphertext)));
+            try {
+                this.#authorizationKey = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+                this.#keyExpiresAt = expiresAt;
+                this.#wallets = wallets;
+            }
+            finally {
+                bytes.fill(0);
+            }
+        }
+        catch (error) {
+            this.#authorizationKey = undefined;
+            this.#keyExpiresAt = 0;
+            this.#wallets = [];
+            if (error instanceof CreatorAuthorizationError)
+                throw error;
+            throw new CreatorAuthorizationError('key_exchange_failed');
+        }
+    }
+    async sign(input) {
+        if (!/^[A-Za-z0-9_-]{1,200}$/.test(input.walletId) || !/^[A-Za-z0-9_-]{1,200}$/.test(input.idempotencyKey)) {
+            throw new CreatorAuthorizationError('invalid_request');
+        }
+        if (input.body.method !== 'eth_sendTransaction')
+            throw new CreatorAuthorizationError('unsupported_method');
+        await this.#authenticate();
+        if (!this.#authorizationKey || this.#keyExpiresAt <= this.#now()) {
+            throw new CreatorAuthorizationError('authorization_expired');
+        }
+        if (!this.#wallets.some((wallet) => wallet.id === input.walletId && wallet.chainType === 'ethereum')) {
+            throw new CreatorAuthorizationError('wallet_not_authorized');
+        }
+        const expiry = Number(input.requestExpiry);
+        if (!Number.isSafeInteger(expiry) || expiry <= this.#now() || expiry > this.#now() + 60_000 || expiry > this.#keyExpiresAt) {
+            throw new CreatorAuthorizationError('invalid_request_expiry');
+        }
+        const url = `${WALLET_API}/${encodeURIComponent(input.walletId)}/rpc`;
+        const headers = {
+            'privy-app-id': this.#appId,
+            'privy-idempotency-key': input.idempotencyKey,
+            'privy-request-expiry': input.requestExpiry,
+        };
+        const signature = generateAuthorizationSignature({
+            authorizationPrivateKey: this.#authorizationKey,
+            input: { version: 1, method: 'POST', url, body: input.body, headers },
+        });
+        return { url, headers: { ...headers, 'privy-authorization-signature': signature } };
+    }
+    dispose() {
+        this.#device = undefined;
+        this.#tokens = undefined;
+        this.#authorizationKey = undefined;
+        this.#keyExpiresAt = 0;
+        this.#wallets = [];
+    }
+}
+//# sourceMappingURL=creator-agent.js.map

package/dist/creator-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"creator-agent.js","sourceRoot":"","sources":["../src/creator-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAC,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAC,MAAM,YAAY,CAAC;AACxE,OAAO,EAAC,8BAA8B,EAAC,MAAM,gBAAgB,CAAC;AAG9D,MAAM,KAAK,GAAG,oCAAoC,CAAC;AACnD,MAAM,UAAU,GAAG,iCAAiC,CAAC;AACrD,MAAM,YAAY,GAAG,8CAA8C,CAAC;AACpE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,eAAe;IACf,uBAAuB;IACvB,yBAAyB;IACzB,eAAe;IACf,eAAe;IACf,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B;IAArB,YAAqB,IAAY;QAC/B,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAD5B,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAcD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;IACzH,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;IAC1H,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,yBAAyB,CAAC,0BAA0B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;IAChH,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,yBAAyB,CAAC,0BAA0B,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;IACrG,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;mFACmF;AACnF,MAAM,OAAO,yBAAyB;IAC3B,MAAM,CAAS;IACf,MAAM,CAAe;IACrB,IAAI,CAAe;IACnB,MAAM,CAA6B;IACnC,mBAAmB,CAAc;IAC1C,OAAO,CAAuD;IAC9D,OAAO,CAA8B;IACrC,iBAAiB,CAAU;IAC3B,aAAa,GAAG,CAAC,CAAC;IAClB,QAAQ,GAA8B,EAAE,CAAC;IACzC,QAAQ,GAAG,KAAK,CAAC;IACjB,WAAW,CAAiB;IAC5B,eAAe,CAAiB;IAEhC,YAAY,OAMX;QACC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,KAAc;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,EAAE;gBACrD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnC,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,cAAc,EAAE,IAAI,CAAC,MAAM;oBAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,kBAAkB,EAAE,aAAa,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxF;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM;gBAAE,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;YAClF,OAAO,EAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB;gBAAE,MAAM,KAAK,CAAC;YAC5D,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,cAAc,CAAC,QAAkB,EAAE,IAA6B;QAC9D,IAAI,IAAI,CAAC,KAAK,KAAK,kDAAkD,EAAE,CAAC;YACtE,OAAO,IAAI,yBAAyB,CAAC,yBAAyB,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC/G,OAAO,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,IAA6B,EAAE,SAAiB;QAC3D,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ;YAAE,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;QAC1F,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;YACtC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;YACxC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;SAChD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;QACzE,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG;YACb,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9B,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;SACvE,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAC,uBAAuB,EAAE,eAAe,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,yBAAyB,CAAC,aAAa,CAAC,CAAC;QAChE,SAAS,CAAC;YACR,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM,IAAI,yBAAyB,CAAC,eAAe,CAAC,CAAC;YACzE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;YAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAC,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAC,CAAC,CAAC;YAC5G,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAC,GAAG,MAAM,EAAC,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;gBACtG,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;oBAAE,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAC,GAAG,MAAM,EAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,yBAAyB;gBAC1C,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAC1F,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACzB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;YACnC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAC,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAC,CAAC,CAAC;gBAClH,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,KAAK,YAAY,yBAAyB;oBAC1C,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EACxE,CAAC;oBACD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN,kFAAkF;oBAClF,uFAAuF;oBACvF,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;gBAC1B,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,CAAC,WAAW,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM;YAAE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAClH,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QACtD,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK;YAAE,OAAO;QAC/E,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACtD,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAC,GAAG,EAAE,IAAI,mBAAmB,EAAE,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,gBAAgB,EAAE,EAAC,CAAC,CAAC;YACrH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,EAAC,eAAe,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAC,CAAC;YACxG,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACjF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAClE,MAAM,SAAS,GACb,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACnH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;gBACpE,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO,EAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAC,CAAC;YACxG,CAAC,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,EAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAC,CAAC,CAAC;YAC/H,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC;gBACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YAC1B,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;YACnC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnB,IAAI,KAAK,YAAY,yBAAyB;gBAAE,MAAM,KAAK,CAAC;YAC5D,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAuG;QAChH,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB;YAAE,MAAM,IAAI,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC3G,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjE,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3H,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtE,MAAM,OAAO,GAAG;YACd,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,uBAAuB,EAAE,KAAK,CAAC,cAAc;YAC7C,sBAAsB,EAAE,KAAK,CAAC,aAAa;SAC5C,CAAC;QACF,MAAM,SAAS,GAAG,8BAA8B,CAAC;YAC/C,uBAAuB,EAAE,IAAI,CAAC,iBAAiB;YAC/C,KAAK,EAAE,EAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAC;SACpE,CAAC,CAAC;QACH,OAAO,EAAC,GAAG,EAAE,OAAO,EAAE,EAAC,GAAG,OAAO,EAAE,+BAA+B,EAAE,SAAS,EAAC,EAAC,CAAC;IAClF,CAAC;IAED,OAAO;QACL,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/creator-keyring.d.ts

@@ -0,0 +1,26 @@
+export interface StoredCreatorAuthorization {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+}
+export interface CreatorAuthorizationStore {
+    load(): Promise<StoredCreatorAuthorization | null>;
+    save(tokens: StoredCreatorAuthorization): Promise<void>;
+    clear(): Promise<void>;
+}
+interface KeyringEntry {
+    getPassword(signal?: AbortSignal): Promise<string | undefined>;
+    setPassword(value: string, signal?: AbortSignal): Promise<void>;
+    deleteCredential(signal?: AbortSignal): Promise<boolean>;
+}
+/** Native per-user credential storage: Keychain on macOS, Credential Manager on Windows, and
+ * Secret Service/keyutils on Linux. The refresh credential is never written to project files. */
+export declare class CreatorKeyringStore implements CreatorAuthorizationStore {
+    #private;
+    constructor(appId: string, walletAddress: string, entry?: KeyringEntry);
+    load(): Promise<StoredCreatorAuthorization | null>;
+    save(tokens: StoredCreatorAuthorization): Promise<void>;
+    clear(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=creator-keyring.d.ts.map

package/dist/creator-keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"creator-keyring.d.ts","sourceRoot":"","sources":["../src/creator-keyring.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,IAAI,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,UAAU,YAAY;IACpB,WAAW,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,gBAAgB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AA6BD;iGACiG;AACjG,qBAAa,mBAAoB,YAAW,yBAAyB;;gBAGvD,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,YAAY;IAKhE,IAAI,IAAI,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAWlD,IAAI,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/creator-keyring.js

@@ -0,0 +1,57 @@
+import { createHash } from 'node:crypto';
+import { AsyncEntry } from '@napi-rs/keyring';
+const SERVICE = 'io.abx.cli.creator-wallet';
+const timeout = () => AbortSignal.timeout(15_000);
+function secret(value) {
+    if (typeof value !== 'string' || !value || value.length > 16_384)
+        throw new Error('invalid_creator_authorization');
+    return value;
+}
+function decode(raw) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('invalid_creator_authorization');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('invalid_creator_authorization');
+    const row = value;
+    if (row.version !== 1 || !Number.isSafeInteger(row.expiresAt) || Number(row.expiresAt) <= 0) {
+        throw new Error('invalid_creator_authorization');
+    }
+    return {
+        accessToken: secret(row.accessToken),
+        refreshToken: secret(row.refreshToken),
+        expiresAt: Number(row.expiresAt),
+    };
+}
+/** Native per-user credential storage: Keychain on macOS, Credential Manager on Windows, and
+ * Secret Service/keyutils on Linux. The refresh credential is never written to project files. */
+export class CreatorKeyringStore {
+    #entry;
+    constructor(appId, walletAddress, entry) {
+        const identity = createHash('sha256').update(`${appId}:${walletAddress.toLowerCase()}`).digest('hex');
+        this.#entry = entry ?? new AsyncEntry(SERVICE, identity);
+    }
+    async load() {
+        const raw = await this.#entry.getPassword(timeout());
+        if (raw === undefined)
+            return null;
+        try {
+            return decode(raw);
+        }
+        catch {
+            await this.#entry.deleteCredential(timeout());
+            return null;
+        }
+    }
+    async save(tokens) {
+        await this.#entry.setPassword(JSON.stringify({ version: 1, ...tokens }), timeout());
+    }
+    async clear() {
+        await this.#entry.deleteCredential(timeout());
+    }
+}
+//# sourceMappingURL=creator-keyring.js.map

package/dist/creator-keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"creator-keyring.js","sourceRoot":"","sources":["../src/creator-keyring.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAoB5C,MAAM,OAAO,GAAG,2BAA2B,CAAC;AAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAElD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;iGACiG;AACjG,MAAM,OAAO,mBAAmB;IACrB,MAAM,CAAe;IAE9B,YAAY,KAAa,EAAE,aAAqB,EAAE,KAAoB;QACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAkC;QAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,OAAO,EAAE,CAAC,EAAE,GAAG,MAAM,EAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/creator-signer.d.ts

@@ -0,0 +1,52 @@
+import { type Address, type Hex, type PreparedTx } from '@artblocks/abx-sdk';
+import type { TransactionReceipt } from 'viem';
+/** Preserve the exact RPC estimate across the JSON service boundary. This is a serialization
+ * guard, not a sponsorship-policy ceiling; real EVM transaction limits are many orders of
+ * magnitude below Number.MAX_SAFE_INTEGER. */
+export declare function sponsoredGasLimit(gas: bigint): number;
+/** Synchronous preflight for commands that may upload content before opening the signing lane. */
+export declare function assertSponsorConfigured(chainKey: string): void;
+/**
+ * Resolve the existing account-bound creator wallet for a sponsored preview without provisioning
+ * a wallet or opening an authorization grant. A dry run must use the signer that the real send
+ * will use; silently falling back to a local env key changes the CREATE2 salt, owner, royalty
+ * receiver, and mint recipient shown in the preview.
+ */
+export declare function sponsoredPreviewAddress(chainKey: string, options?: {
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: typeof fetch;
+}): Promise<Address>;
+/** Resolve the account-bound creator wallet for a transaction plan. Real sponsored sends may
+ * provision the stable wallet just as `openSponsoredSession` does; dry runs call the wrapper above
+ * and remain strictly read-only. */
+export declare function sponsoredWalletAddress(chainKey: string, options?: {
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: typeof fetch;
+    provision?: boolean;
+}): Promise<Address>;
+export interface SponsoredReceipt {
+    txHash: Hex;
+    receipt: TransactionReceipt;
+}
+export interface SponsoredSession {
+    address: Address;
+    send(tx: PreparedTx): Promise<SponsoredReceipt>;
+    close(): void;
+}
+/** Pure boundary check shared by every sponsored operation. Privy's sponsored relay requires a
+ * call target, so custom-contract deployments must already be expressed as a call to the keyless
+ * CREATE2 proxy before they reach this boundary. */
+export declare function assertSponsoredPreparedTx(tx: PreparedTx, chainId: number): asserts tx is PreparedTx & {
+    to: Address;
+};
+/** Resolve the first-party wallet API from its public remote catalog. The env override is an
+ * explicit local/staging escape hatch; production callers discover the interface from the
+ * services catalog and do not need to know a deployment hostname. */
+export declare function creatorApiUrl(chainId: number, env?: NodeJS.ProcessEnv): Promise<string>;
+/**
+ * Open a creator authorization session. Privy's rotating grant is retained in the user's native OS
+ * credential store and reused across CLI invocations. The decrypted request-signing key remains
+ * memory-only and every exact transaction is still prepared, signed, and reconciled independently.
+ */
+export declare function openSponsoredSession(chainKey: string): Promise<SponsoredSession>;
+//# sourceMappingURL=creator-signer.d.ts.map

package/dist/creator-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"creator-signer.d.ts","sourceRoot":"","sources":["../src/creator-signer.ts"],"names":[],"mappings":"AAEA,OAAO,EAWL,KAAK,OAAO,EACZ,KAAK,GAAG,EACR,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,MAAM,CAAC;AAS7C;;8CAE8C;AAC9C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED,kGAAkG;AAClG,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9D;AAaD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAM,GAChE,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;oCAEoC;AACpC,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAM,GACrF,OAAO,CAAC,OAAO,CAAC,CA2BlB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,GAAG,CAAC;IACZ,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;oDAEoD;AACpD,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,EAAE,IAAI,UAAU,GAAG;IAAC,EAAE,EAAE,OAAO,CAAA;CAAC,CAY1C;AAmBD;;qEAEqE;AACrE,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW1G;AAmBD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmItF"}