@nevermined-io/core-kit 1.5.0 → 1.7.0

package/dist/nevermined/utils/BlockchainViemUtils.d.ts

@@ -1,6 +1,7 @@
 import { signerToEcdsaValidator } from '@zerodev/ecdsa-validator';
 import { KernelAccountClient } from '@zerodev/sdk';
-import { Address, type Abi, type AbiEvent, type AbiFunction, type Account, type PublicClient, type TransactionReceipt } from 'viem';
+import { KERNEL_V3_1, KERNEL_V3_3 } from '@zerodev/sdk/constants';
+import { Address, type Abi, type AbiEvent, type AbiFunction, type Account, type PublicClient, type SignAuthorizationReturnType, type TransactionReceipt } from 'viem';
 import { SmartAccount } from 'viem/account-abstraction';
 import { Instantiable, InstantiableConfig, Web3Clients } from '../../Instantiable.abstract.js';
 import { Signer } from '@zerodev/sdk/types';
@@ -34,15 +35,15 @@ export declare function getTransactionReceipt({ txHash, publicClient, }: {
  */
 export declare function getContractInstance(contractAddress: string, abi: Abi, client: Web3Clients): Promise<{
     read: {
-        [x: string]: (...parameters: [options?: import("viem").Prettify<import("viem").UnionOmit<import("viem").ReadContractParameters<Abi, string, readonly unknown[]>, "address" | "abi" | "args" | "functionName">> | undefined] | [args: readonly unknown[], options?: import("viem").Prettify<import("viem").UnionOmit<import("viem").ReadContractParameters<Abi, string, readonly unknown[]>, "address" | "abi" | "args" | "functionName">> | undefined]) => Promise<import("viem").ReadContractReturnType>;
+        [x: string]: (...parameters: [options?: import("viem").Prettify<import("viem").UnionOmit<import("viem").ReadContractParameters<Abi, string, readonly unknown[]>, "address" | "abi" | "functionName" | "args">> | undefined] | [args: readonly unknown[], options?: import("viem").Prettify<import("viem").UnionOmit<import("viem").ReadContractParameters<Abi, string, readonly unknown[]>, "address" | "abi" | "functionName" | "args">> | undefined]) => Promise<import("viem").ReadContractReturnType>;
     };
     estimateGas: {
-        [x: string]: (...parameters: [options: import("viem").Prettify<import("viem").UnionOmit<import("viem").EstimateContractGasParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined>, "address" | "abi" | "args" | "functionName">>] | [args: readonly unknown[], options: import("viem").Prettify<import("viem").UnionOmit<import("viem").EstimateContractGasParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined>, "address" | "abi" | "args" | "functionName">>]) => Promise<import("viem").EstimateContractGasReturnType>;
+        [x: string]: (...parameters: [options: import("viem").Prettify<import("viem").UnionOmit<import("viem").EstimateContractGasParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined>, "address" | "abi" | "functionName" | "args">>] | [args: readonly unknown[], options: import("viem").Prettify<import("viem").UnionOmit<import("viem").EstimateContractGasParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined>, "address" | "abi" | "functionName" | "args">>]) => Promise<import("viem").EstimateContractGasReturnType>;
     } & {
-        [x: string]: (...parameters: [options: import("viem").Prettify<import("viem").UnionOmit<import("viem").EstimateContractGasParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined>, "address" | "abi" | "args" | "functionName">>] | [args: readonly unknown[], options: import("viem").Prettify<import("viem").UnionOmit<import("viem").EstimateContractGasParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined>, "address" | "abi" | "args" | "functionName">>]) => Promise<import("viem").EstimateContractGasReturnType>;
+        [x: string]: (...parameters: [options: import("viem").Prettify<import("viem").UnionOmit<import("viem").EstimateContractGasParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined>, "address" | "abi" | "functionName" | "args">>] | [args: readonly unknown[], options: import("viem").Prettify<import("viem").UnionOmit<import("viem").EstimateContractGasParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined>, "address" | "abi" | "functionName" | "args">>]) => Promise<import("viem").EstimateContractGasReturnType>;
     };
     simulate: {
-        [x: string]: <chainOverride extends import("viem").Chain | undefined = undefined, accountOverride extends Account | Address | undefined = undefined>(...parameters: [options?: Omit<import("viem").SimulateContractParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined, chainOverride, accountOverride>, "address" | "abi" | "args" | "functionName"> | undefined] | [args: readonly unknown[], options?: Omit<import("viem").SimulateContractParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined, chainOverride, accountOverride>, "address" | "abi" | "args" | "functionName"> | undefined]) => Promise<import("viem").SimulateContractReturnType>;
+        [x: string]: <chainOverride extends import("viem").Chain | undefined = undefined, accountOverride extends Account | Address | undefined = undefined>(...parameters: [options?: Omit<import("viem").SimulateContractParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined, chainOverride, accountOverride>, "address" | "abi" | "functionName" | "args"> | undefined] | [args: readonly unknown[], options?: Omit<import("viem").SimulateContractParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined, chainOverride, accountOverride>, "address" | "abi" | "functionName" | "args"> | undefined]) => Promise<import("viem").SimulateContractReturnType>;
     };
     createEventFilter: {
         [x: string]: <strict extends boolean | undefined = undefined>(...parameters: [options?: ({
@@ -68,10 +69,10 @@ export declare function getContractInstance(contractAddress: string, abi: Abi, c
     };
     getEvents: {
         [x: string]: (...parameters: [options?: {
+            blockHash?: `0x${string}` | undefined;
             strict?: boolean | undefined;
             fromBlock?: bigint | import("viem").BlockTag | undefined;
             toBlock?: bigint | import("viem").BlockTag | undefined;
-            blockHash?: `0x${string}` | undefined;
         } | undefined] | [args?: readonly unknown[] | {
             [x: string]: unknown;
             address?: undefined;
@@ -86,10 +87,10 @@ export declare function getContractInstance(contractAddress: string, abi: Abi, c
             batch?: undefined;
             pollingInterval?: undefined;
         } | undefined, options?: {
+            blockHash?: `0x${string}` | undefined;
             strict?: boolean | undefined;
             fromBlock?: bigint | import("viem").BlockTag | undefined;
             toBlock?: bigint | import("viem").BlockTag | undefined;
-            blockHash?: `0x${string}` | undefined;
         } | undefined]) => Promise<import("viem").GetContractEventsReturnType<Abi, string>>;
     };
     watchEvent: {
@@ -125,7 +126,7 @@ export declare function getContractInstance(contractAddress: string, abi: Abi, c
         } | undefined]) => import("viem").WatchContractEventReturnType;
     };
     write: {
-        [x: string]: <chainOverride extends import("viem").Chain | undefined, options extends import("viem").UnionOmit<import("viem").WriteContractParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined, Account | undefined, chainOverride>, "address" | "abi" | "args" | "functionName"> extends infer T ? { [K in keyof T]: T[K]; } : never, Rest extends unknown[] = [options: options]>(...parameters: Rest | [args: readonly unknown[], ...parameters: Rest]) => Promise<import("viem").WriteContractReturnType>;
+        [x: string]: <chainOverride extends import("viem").Chain | undefined, options extends import("viem").UnionOmit<import("viem").WriteContractParameters<Abi, string, readonly unknown[], import("viem").Chain | undefined, Account | undefined, chainOverride>, "address" | "abi" | "functionName" | "args"> extends infer T ? { [K in keyof T]: T[K]; } : never, Rest extends unknown[] = [options: options]>(...parameters: Rest | [args: readonly unknown[], ...parameters: Rest]) => Promise<import("viem").WriteContractReturnType>;
     };
     address: `0x${string}`;
     abi: Abi;
@@ -285,6 +286,17 @@ export declare function estimateUserOperationFees(bundlerClient: any, _publicCli
     maxFeePerGas: bigint;
     maxPriorityFeePerGas: bigint;
 }>;
+/**
+ * Floors `verificationGasLimit` on Tempo networks before the UserOp is handed to
+ * the ZeroDev paymaster, so `zd_sponsorUserOperation` has headroom and does not
+ * revert AA26. No-op on every other network. Shared by both paymaster sponsor
+ * call sites. Generic so the caller's UserOp type is preserved; typing
+ * `verificationGasLimit?: bigint` also turns a plain-number literal (a `bigint`
+ * missing its `n`) into a compile error instead of a silent floor-to-30M.
+ */
+export declare function applyTempoVerificationGasFloor<T extends {
+    verificationGasLimit?: bigint;
+}>(userOperation: T, chainId: number): T;
 /**
  * It creates a ZeroDev Kernel client.
  * @param signer the signer account
@@ -304,6 +316,13 @@ export type EcdsaValidator = Awaited<ReturnType<typeof signerToEcdsaValidator>>;
  * (e.g. the webapp's localStorage) should stamp this and invalidate on change.
  */
 export declare const SCA_DERIVATION_VERSION: string;
+export declare const ACCOUNT_CACHE_MAX_ENTRIES = 5000;
+/** Current entry count of the Kernel account-resolution memo (#2206). */
+export declare function getAccountResolutionCacheStats(): {
+    size: number;
+};
+/** Clear the account-resolution memo (test isolation / kernel-upgrade invalidation). */
+export declare function clearAccountResolutionCache(): void;
 /**
  * Build the ECDSA sudo validator for a signer. Both `createKernelSmartAccount`
  * and `createSessionKey` need this validator and each derives it via a ZeroDev
@@ -319,8 +338,48 @@ export declare function createEcdsaValidator(signer: Signer, publicClient: Publi
 export declare function createKernelSmartAccount(signer: Signer, publicClient: PublicClient, ecdsaValidator?: EcdsaValidator): Promise<SmartAccount>;
 export declare function getApproval(signer: Signer, publicClient: any, policies: any[]): Promise<string>;
 export declare function useSessionKey(approval: string, signer: Signer, publicClient: any): Promise<import("@zerodev/sdk").CreateKernelAccountReturnType<"0.7">>;
-export declare function createSessionKey(signer: Signer, publicClient: any, policies: any[], ecdsaValidator?: EcdsaValidator): Promise<string>;
-export declare function getSessionKey(serializedSessionKey: string, publicClient: any): Promise<import("@zerodev/sdk").CreateKernelAccountReturnType<"0.7">>;
+export declare function createSessionKey(signer: Signer, publicClient: any, policies: any[], ecdsaValidator?: EcdsaValidator, sessionPrivateKey?: `0x${string}`): Promise<string>;
+/**
+ * Multi-network session keys (#1929). Generates ONE session private key and
+ * serializes the permission account once per network — each serialization
+ * carries that network's chain-bound enable signature. The SAME session key
+ * works on every supported chain (the smart-account address + init code are
+ * identical via CREATE2 parity); only the enable signature differs per chain.
+ *
+ * Use the returned map (chainId → serialized session key) to build a single
+ * multi-network API key: the backend selects the entry for the operation's
+ * network. Avoids the `EnableNotApproved` revert when an API key minted on one
+ * chain is used on another.
+ *
+ * @param signer the smart-account owner (e.g. the Privy EOA) — signs each
+ *   network's enable signature
+ * @param publicClientByChainId map of chainId → a PublicClient for that chain
+ * @param policies the permission policies (same on every chain)
+ */
+export declare function createSessionKeysForNetworks(signer: Signer, publicClientByChainId: Record<number, any>, policies: any[], requiredChainId?: number): Promise<Record<number, string>>;
+/**
+ * The canonical, CREATE2-deterministic Kernel v3.3 implementation that an EOA
+ * delegates to under EIP-7702 (same address on Base mainnet + Base Sepolia).
+ * This is the `contract`/`address` passed to Privy `sign7702Authorization` and
+ * carried in the type-4 authorization. See #2148.
+ */
+export declare const KERNEL_7702_IMPL_ADDRESS = "0xd6CEDDe84be40893d153Be9d467CD6aD37875b28";
+export { KERNEL_V3_1, KERNEL_V3_3 };
+export type KernelVersion = typeof KERNEL_V3_1 | typeof KERNEL_V3_3;
+/**
+ * Resolves a user's EIP-7702 account: the Privy EOA delegated to Kernel v3.3.
+ * The resulting account's address **equals the EOA** (no counterfactual SCA),
+ * so it both signs EIP-3009 as a plain EOA (Router) and acts as a 4337 smart
+ * account (credits/session-keys). `eip7702Auth` is the signed type-4
+ * authorization (from Privy `sign7702Authorization`); omit it once the account
+ * is already delegated on-chain.
+ *
+ * ponytail: on-chain correctness (delegation designator, UserOp submission)
+ * is validated on Base Sepolia in Phase 0 (#2153); this wrapper only pins the
+ * SDK call shape.
+ */
+export declare function createKernel7702Account(signer: Signer, publicClient: PublicClient, eip7702Auth?: SignAuthorizationReturnType): Promise<SmartAccount>;
+export declare function getSessionKey(serializedSessionKey: string, publicClient: any, kernelVersion?: KernelVersion): Promise<import("@zerodev/sdk").CreateKernelAccountReturnType<"0.7">>;
 /**
  * Creates a delegated session key for an existing kernel account.
  * The resulting serialized session key can be deserialized into a SmartAccount
@@ -331,7 +390,7 @@ export declare function getSessionKey(serializedSessionKey: string, publicClient
  * @param policies Array of policies to enforce for this session key
  * @returns Serialized session key string
  */
-export declare function createDelegatedSessionKeyFromKernel(kernelAccount: SmartAccount, publicClient: PublicClient, policies: any[]): Promise<string>;
+export declare function createDelegatedSessionKeyFromKernel(kernelAccount: SmartAccount, publicClient: PublicClient, policies: any[], kernelVersion?: KernelVersion): Promise<string>;
 export declare const WalletUtils: {
     makeWallet: typeof makeWallet;
     makeWallets: typeof makeWallets;

package/dist/nevermined/utils/BlockchainViemUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BlockchainViemUtils.d.ts","sourceRoot":"","sources":["../../../src/nevermined/utils/BlockchainViemUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAOjE,OAAO,EAML,mBAAmB,EAEpB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,OAAO,EAYP,KAAK,GAAG,EACR,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,MAAM,CAAA;AACb,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAQvD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAG9F,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAI3C;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;gBACvC,MAAM,EAAE,kBAAkB;CAIvC;AAaD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,MAAM,EACN,YAAY,GACb,EAAE;IACD,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,YAAY,EAAE,YAAY,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAa9B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM/F;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,GAAG,EAAO,GAAG,WAAW,CAM3F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CASpE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,GAAG,EAAO,GAAG,WAAW,CAEhG;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,GAAG,EAAO,0CAE/E;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,GAAG,EAAO;;;IAOxF;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,iBAElD;AAGD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,SAAI,GAAG,OAAO,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,SAAK,aAM/D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,SAAK,GAAG,OAAO,EAAE,CAG7D;AAID;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAGvE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAEnE;AAID;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,EACf,aAAa,UAAQ,GACpB,MAAM,CAQR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,GAAG,EAClB,aAAa,EAAE,GAAG,GACjB,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC,CAKjE;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,YAAY,EAC3B,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,GAAG,EACjB,aAAa,UAAQ,GACpB,OAAO,CAAC,mBAAmB,CAAC,CA4B9B;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAA0C,CAAA;AAE7E;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,mBAyBnF;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,wEAatF;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,GAAG,EACjB,QAAQ,EAAE,GAAG,EAAE,EACf,cAAc,CAAC,EAAE,cAAc,mBA0BhC;AAED,wBAAsB,aAAa,CAAC,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,wEASlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,mCAAmC,CACvD,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,GAAG,EAAE,GACd,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,eAAO,MAAM,WAAW;;;;;CAKvB,CAAA"}
+{"version":3,"file":"BlockchainViemUtils.d.ts","sourceRoot":"","sources":["../../../src/nevermined/utils/BlockchainViemUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAOjE,OAAO,EAML,mBAAmB,EAEpB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,WAAW,EACX,WAAW,EAGZ,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,OAAO,EAYP,KAAK,GAAG,EACR,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACxB,MAAM,MAAM,CAAA;AACb,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAQvD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAG9F,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAI3C;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;gBACvC,MAAM,EAAE,kBAAkB;CAIvC;AAaD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,MAAM,EACN,YAAY,GACb,EAAE;IACD,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;IACrB,YAAY,EAAE,YAAY,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAa9B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM/F;AAID;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,GAAG,EAAO,GAAG,WAAW,CAM3F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CASpE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,GAAG,EAAO,GAAG,WAAW,CAEhG;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,GAAG,EAAO,0CAE/E;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,GAAG,EAAO;;;IAOxF;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,iBAElD;AAGD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,SAAI,GAAG,OAAO,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,SAAK,aAM/D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,SAAK,GAAG,OAAO,EAAE,CAG7D;AAID;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAGvE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAEnE;AAID;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,EACf,aAAa,UAAQ,GACpB,MAAM,CAaR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,GAAG,EAClB,aAAa,EAAE,GAAG,GACjB,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC,CAKjE;AAaD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,SAAS;IAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxF,aAAa,EAAE,CAAC,EAChB,OAAO,EAAE,MAAM,GACd,CAAC,CAMH;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,YAAY,EAC3B,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,GAAG,EACjB,aAAa,UAAQ,GACpB,OAAO,CAAC,mBAAmB,CAAC,CA8B9B;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAA0C,CAAA;AAkB7E,eAAO,MAAM,yBAAyB,OAAQ,CAAA;AAgC9C,yEAAyE;AACzE,wBAAgB,8BAA8B;;EAE7C;AAED,wFAAwF;AACxF,wBAAgB,2BAA2B,SAE1C;AAcD;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,YAAY,CAAC,CAmBvB;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,mBAyBnF;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,wEAatF;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,GAAG,EACjB,QAAQ,EAAE,GAAG,EAAE,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,iBAAiB,GAAE,KAAK,MAAM,EAAyB,mBA4BxD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,EACd,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1C,QAAQ,EAAE,GAAG,EAAE,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAkCjC;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,+CAAiC,CAAA;AAKtE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAA;AACnC,MAAM,MAAM,aAAa,GAAG,OAAO,WAAW,GAAG,OAAO,WAAW,CAAA;AAEnE;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,WAAW,CAAC,EAAE,2BAA2B,GACxC,OAAO,CAAC,YAAY,CAAC,CAWvB;AAED,wBAAsB,aAAa,CACjC,oBAAoB,EAAE,MAAM,EAC5B,YAAY,EAAE,GAAG,EACjB,aAAa,GAAE,aAA2B,wEAY3C;AAED;;;;;;;;;GASG;AACH,wBAAsB,mCAAmC,CACvD,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,GAAG,EAAE,EACf,aAAa,GAAE,aAA2B,GACzC,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED,eAAO,MAAM,WAAW;;;;;CAKvB,CAAA"}

package/dist/nevermined/utils/BlockchainViemUtils.js

@@ -2,12 +2,12 @@ import { signerToEcdsaValidator } from '@zerodev/ecdsa-validator';
 import { deserializePermissionAccount, serializePermissionAccount, toPermissionValidator } from '@zerodev/permissions';
 import { toECDSASigner } from '@zerodev/permissions/signers';
 import { addressToEmptyAccount, createKernelAccount, createKernelAccountClient, createZeroDevPaymasterClient, getUserOperationGasPrice } from '@zerodev/sdk';
-import { KERNEL_V3_1, getEntryPoint } from '@zerodev/sdk/constants';
+import { KERNEL_V3_1, KERNEL_V3_3, KERNEL_7702_DELEGATION_ADDRESS, getEntryPoint } from '@zerodev/sdk/constants';
 import { encodeAbiParameters, getAbiItem, getAddress, getContract, http, isAddress, pad, stringToBytes, stringToHex, toBytes, keccak256 as viemKeccak256 } from 'viem';
 import { english, generateMnemonic, generatePrivateKey, mnemonicToAccount, privateKeyToAccount } from 'viem/accounts';
 import { Instantiable } from '../../Instantiable.abstract.js';
 import { ContractsError } from '../../errors/NeverminedErrors.js';
-import { getChain } from '../../utils/Network.js';
+import { getChain, isTempoNetwork } from '../../utils/Network.js';
 const ENTRY_POINT_VERSION = '0.7';
 /**
  * Utility class with methods that allow the interaction with the blockchain.
@@ -244,10 +244,13 @@ const TRANSACTION_RECEIPT_POLLING_INTERVAL_MS = 1_500;
  *   `BUNDLER_RPC_URL_OVERRIDE` is set.
  */ export function getBundlerRpcUrl(zeroDevProjectId, chainId, useUltraRelay = false) {
     const base = `https://rpc.zerodev.app/api/v3/${zeroDevProjectId}/chain/${chainId}`;
-    // `||` (not `??`) because Vite replaces missing browser env vars with the
-    // empty string at build time; an empty override is equivalent to "no
-    // override" for our purposes.
-    return process.env.BUNDLER_RPC_URL_OVERRIDE || (useUltraRelay ? `${base}?provider=ULTRA_RELAY` : base);
+    // Per-chain override wins, then the global override, then the canonical URL.
+    // The per-chain form (`BUNDLER_RPC_URL_OVERRIDE_<chainId>`) lets a single
+    // process route UserOps for different networks to different local bundlers —
+    // e.g. a dual-fork dev stack (base-sepolia bundler :4337 + tempo bundler
+    // :4338). `||` (not `??`) because Vite replaces missing browser env vars with
+    // the empty string at build time; an empty override is equivalent to none.
+    return process.env[`BUNDLER_RPC_URL_OVERRIDE_${chainId}`] || process.env.BUNDLER_RPC_URL_OVERRIDE || (useUltraRelay ? `${base}?provider=ULTRA_RELAY` : base);
 }
 /**
  * Returns the paymaster RPC URL (ZeroDev-only; the local fork stack uses
@@ -280,6 +283,32 @@ const TRANSACTION_RECEIPT_POLLING_INTERVAL_MS = 1_500;
     }
     return getUserOperationGasPrice(bundlerClient);
 }
+// Tempo undersizes the ZeroDev bundler's `verificationGasLimit` estimate (cold
+// SCA deploy + session-key enable under TIP-20 gas), so `zd_sponsorUserOperation`
+// re-simulates with that too-low ceiling and reverts `AA26 over
+// verificationGasLimit` (see #1929, staging createPlan on tempo-moderato). We give
+// the sponsor an explicit floor so it stops undersizing. A multiplier is useless
+// here — viem calls getPaymasterData with verificationGasLimit still 0/undefined,
+// so `x * n` is 0. An absolute floor covers both the 0 and the too-low cases.
+// NOTE(#1929): fixed floor — bump if a Tempo op still AA26s (env-tunable if it ever needs per-deploy calibration).
+// needs per-deploy calibration).
+const TEMPO_MIN_VERIFICATION_GAS = 30_000_000n;
+/**
+ * Floors `verificationGasLimit` on Tempo networks before the UserOp is handed to
+ * the ZeroDev paymaster, so `zd_sponsorUserOperation` has headroom and does not
+ * revert AA26. No-op on every other network. Shared by both paymaster sponsor
+ * call sites. Generic so the caller's UserOp type is preserved; typing
+ * `verificationGasLimit?: bigint` also turns a plain-number literal (a `bigint`
+ * missing its `n`) into a compile error instead of a silent floor-to-30M.
+ */ export function applyTempoVerificationGasFloor(userOperation, chainId) {
+    if (!isTempoNetwork(chainId)) return userOperation;
+    const current = typeof userOperation.verificationGasLimit === 'bigint' ? userOperation.verificationGasLimit : 0n;
+    const floored = current > TEMPO_MIN_VERIFICATION_GAS ? current : TEMPO_MIN_VERIFICATION_GAS;
+    return {
+        ...userOperation,
+        verificationGasLimit: floored
+    };
+}
 /**
  * It creates a ZeroDev Kernel client.
  * @param signer the signer account
@@ -305,7 +334,7 @@ const TRANSACTION_RECEIPT_POLLING_INTERVAL_MS = 1_500;
                         transport: http(paymasterRpc)
                     });
                     return zerodevPaymaster.sponsorUserOperation({
-                        userOperation
+                        userOperation: applyTempoVerificationGasFloor(userOperation, chainId)
                     });
                 }
             }
@@ -323,6 +352,71 @@ const TRANSACTION_RECEIPT_POLLING_INTERVAL_MS = 1_500;
  * bump here means the same EOA derives a different SCA. Persisted SCA caches
  * (e.g. the webapp's localStorage) should stamp this and invalidate on change.
  */ export const SCA_DERIVATION_VERSION = `${ENTRY_POINT_VERSION}:${KERNEL_V3_1}`;
+// ponytail: in-process memo for ZeroDev Kernel account resolution. Every
+// deserializePermissionAccount / createKernelAccount reads the EIP-1967 impl
+// slot (eth_getStorageAt) of a deployed account — ~56% of backend Infura RPC
+// volume, and the same session key/owner is re-resolved per request and twice
+// per x402 payment (verify + settle). See #2206. Safe to reuse the resolved
+// account: the Kernel account fetches its nonce fresh at send time, so a cached
+// account never signs against a stale nonce. Keyed by the deterministic inputs
+// (serialized key / owner + kernel version + chainId); short TTL bounds
+// staleness across a kernel upgrade. Single-process only — cross-pod dedup is
+// out of scope (#2206 notes). Upgrade path: swap the Map for a shared store.
+const ACCOUNT_CACHE_TTL_MS = 60_000;
+// Bound the cache: `getSessionKey` runs behind `getAccountAttributes` on every
+// authenticated request, keyed per-API-key, so an entry never re-requested
+// would otherwise sit past its TTL for the life of the (long-lived) apps/api
+// process — a slow leak. Cardinality ≈ distinct API keys ever seen; cap + sweep
+// keep it bounded (matches BlockchainCacheService's MAX_ENTRIES + cleanup()).
+export const ACCOUNT_CACHE_MAX_ENTRIES = 5_000;
+const accountResolutionCache = new Map();
+function memoResolveAccount(key, resolver) {
+    const now = Date.now();
+    const cached = accountResolutionCache.get(key);
+    if (cached && cached.expiresAt > now) {
+        return cached.value;
+    }
+    // Sweep expired entries + bound size so keys never re-requested don't
+    // accumulate for the life of the process (Map keeps insertion order → FIFO).
+    for (const [k, e] of accountResolutionCache){
+        if (e.expiresAt <= now) accountResolutionCache.delete(k);
+    }
+    if (accountResolutionCache.size >= ACCOUNT_CACHE_MAX_ENTRIES) {
+        accountResolutionCache.delete(accountResolutionCache.keys().next().value);
+    }
+    const entry = {
+        value: undefined,
+        expiresAt: now + ACCOUNT_CACHE_TTL_MS
+    };
+    // Coalesce concurrent identical resolutions; evict on rejection so a transient
+    // RPC failure isn't cached — but only if this exact entry is still current, so
+    // a resolver that hangs past its TTL and then rejects can't drop a newer one.
+    entry.value = resolver().catch((err)=>{
+        if (accountResolutionCache.get(key) === entry) accountResolutionCache.delete(key);
+        throw err;
+    });
+    accountResolutionCache.set(key, entry);
+    return entry.value;
+}
+/** Current entry count of the Kernel account-resolution memo (#2206). */ export function getAccountResolutionCacheStats() {
+    return {
+        size: accountResolutionCache.size
+    };
+}
+/** Clear the account-resolution memo (test isolation / kernel-upgrade invalidation). */ export function clearAccountResolutionCache() {
+    accountResolutionCache.clear();
+}
+function chainIdOf(publicClient) {
+    const id = publicClient?.chain?.id;
+    // chainId is the ONLY discriminator in the sca:/7702:/sk: keys, and SCA /
+    // session-key addresses are identical across chains by CREATE2 design — so an
+    // id-less client must fail closed rather than alias two networks under one
+    // bucket and serve a chain-A account to a chain-B request (latent until #1933).
+    if (id == null) {
+        throw new Error('account-resolution cache: publicClient.chain.id is required for keying');
+    }
+    return id;
+}
 /**
  * Build the ECDSA sudo validator for a signer. Both `createKernelSmartAccount`
  * and `createSessionKey` need this validator and each derives it via a ZeroDev
@@ -341,14 +435,21 @@ const TRANSACTION_RECEIPT_POLLING_INTERVAL_MS = 1_500;
     });
 }
 export async function createKernelSmartAccount(signer, publicClient, ecdsaValidator) {
-    const validator = ecdsaValidator ?? await createEcdsaValidator(signer, publicClient);
-    return await createKernelAccount(publicClient, {
-        plugins: {
-            sudo: validator
-        },
-        entryPoint: getEntryPoint(ENTRY_POINT_VERSION),
-        kernelVersion: KERNEL_V3_1
-    });
+    const build = async ()=>{
+        const validator = ecdsaValidator ?? await createEcdsaValidator(signer, publicClient);
+        return createKernelAccount(publicClient, {
+            plugins: {
+                sudo: validator
+            },
+            entryPoint: getEntryPoint(ENTRY_POINT_VERSION),
+            kernelVersion: KERNEL_V3_1
+        });
+    };
+    // A caller-supplied validator isn't part of the key — bypass the memo (like
+    // createKernel7702Account does for eip7702Auth) rather than let a cache entry
+    // built by a different call silently ignore it (the mismatch createEcdsaValidator warns about).
+    if (ecdsaValidator) return build();
+    return memoResolveAccount(`sca:${chainIdOf(publicClient)}:${SCA_DERIVATION_VERSION}:${signer.address}`, build);
 }
 export async function getApproval(signer, publicClient, policies) {
     const ecdsaValidator = await signerToEcdsaValidator(publicClient, {
@@ -383,9 +484,8 @@ export async function useSessionKey(approval, signer, publicClient) {
     const sessionKeyAccount = await deserializePermissionAccount(publicClient, getEntryPoint(ENTRY_POINT_VERSION), KERNEL_V3_1, approval, sessionKeySigner);
     return sessionKeyAccount;
 }
-export async function createSessionKey(signer, publicClient, policies, ecdsaValidator) {
+export async function createSessionKey(signer, publicClient, policies, ecdsaValidator, sessionPrivateKey = generatePrivateKey()) {
     const validator = ecdsaValidator ?? await createEcdsaValidator(signer, publicClient);
-    const sessionPrivateKey = generatePrivateKey();
     const masterAccount = privateKeyToAccount(sessionPrivateKey);
     const sessionKeySigner = await toECDSASigner({
         signer: masterAccount
@@ -404,11 +504,86 @@ export async function createSessionKey(signer, publicClient, policies, ecdsaVali
         },
         kernelVersion: KERNEL_V3_1
     });
+    // serializePermissionAccount embeds the ENABLE signature for `publicClient`'s
+    // chain (signed by the sudo/owner). That signature is chain-bound, which is
+    // why one serialization only validates on the chain it was made for. #1929
     return serializePermissionAccount(sessionKeyAccount, sessionPrivateKey);
 }
-export async function getSessionKey(serializedSessionKey, publicClient) {
-    const sessionKeyAccount = await deserializePermissionAccount(publicClient, getEntryPoint(ENTRY_POINT_VERSION), KERNEL_V3_1, serializedSessionKey);
-    return sessionKeyAccount;
+/**
+ * Multi-network session keys (#1929). Generates ONE session private key and
+ * serializes the permission account once per network — each serialization
+ * carries that network's chain-bound enable signature. The SAME session key
+ * works on every supported chain (the smart-account address + init code are
+ * identical via CREATE2 parity); only the enable signature differs per chain.
+ *
+ * Use the returned map (chainId → serialized session key) to build a single
+ * multi-network API key: the backend selects the entry for the operation's
+ * network. Avoids the `EnableNotApproved` revert when an API key minted on one
+ * chain is used on another.
+ *
+ * @param signer the smart-account owner (e.g. the Privy EOA) — signs each
+ *   network's enable signature
+ * @param publicClientByChainId map of chainId → a PublicClient for that chain
+ * @param policies the permission policies (same on every chain)
+ */ export async function createSessionKeysForNetworks(signer, publicClientByChainId, policies, requiredChainId) {
+    const sessionPrivateKey = generatePrivateKey();
+    const out = {};
+    for (const [chainIdStr, publicClient] of Object.entries(publicClientByChainId)){
+        const chainId = Number(chainIdStr);
+        try {
+            out[chainId] = await createSessionKey(signer, publicClient, policies, undefined, sessionPrivateKey);
+        } catch (err) {
+            // Best-effort: a secondary network whose RPC is unreachable must not break
+            // key generation (e.g. login). `requiredChainId` (the primary) still throws.
+            if (requiredChainId != null && chainId === Number(requiredChainId)) throw err;
+            console.warn(`[createSessionKeysForNetworks] skipping network ${chainId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // Enforce the `requiredChainId` contract even when it is ABSENT from the input
+    // map (the loop above only throws when it is present AND fails). Without this,
+    // callers read `out[primary]` → undefined → an API key with no primary session
+    // key, which fails opaquely downstream.
+    if (requiredChainId != null && out[requiredChainId] == null) {
+        throw new Error(`createSessionKeysForNetworks: required network ${requiredChainId} was not in the public-client map`);
+    }
+    return out;
+}
+/**
+ * The canonical, CREATE2-deterministic Kernel v3.3 implementation that an EOA
+ * delegates to under EIP-7702 (same address on Base mainnet + Base Sepolia).
+ * This is the `contract`/`address` passed to Privy `sign7702Authorization` and
+ * carried in the type-4 authorization. See #2148.
+ */ export const KERNEL_7702_IMPL_ADDRESS = KERNEL_7702_DELEGATION_ADDRESS;
+// The two Kernel versions the platform runs: v3.1 for the legacy counterfactual
+// SCA, v3.3 for the EIP-7702-delegated EOA account. Re-exported so the API
+// layer can pick the right version for (de)serializing session keys.
+export { KERNEL_V3_1, KERNEL_V3_3 };
+/**
+ * Resolves a user's EIP-7702 account: the Privy EOA delegated to Kernel v3.3.
+ * The resulting account's address **equals the EOA** (no counterfactual SCA),
+ * so it both signs EIP-3009 as a plain EOA (Router) and acts as a 4337 smart
+ * account (credits/session-keys). `eip7702Auth` is the signed type-4
+ * authorization (from Privy `sign7702Authorization`); omit it once the account
+ * is already delegated on-chain.
+ *
+ * ponytail: on-chain correctness (delegation designator, UserOp submission)
+ * is validated on Base Sepolia in Phase 0 (#2153); this wrapper only pins the
+ * SDK call shape.
+ */ export async function createKernel7702Account(signer, publicClient, eip7702Auth) {
+    const build = ()=>createKernelAccount(publicClient, {
+            eip7702Account: signer,
+            ...eip7702Auth ? {
+                eip7702Auth
+            } : {},
+            entryPoint: getEntryPoint(ENTRY_POINT_VERSION),
+            kernelVersion: KERNEL_V3_3
+        });
+    // The install path (auth attached) is a one-time mutating op — never cache it.
+    if (eip7702Auth) return build();
+    return memoResolveAccount(`7702:${chainIdOf(publicClient)}:${signer.address}`, build);
+}
+export async function getSessionKey(serializedSessionKey, publicClient, kernelVersion = KERNEL_V3_1) {
+    return memoResolveAccount(`sk:${chainIdOf(publicClient)}:${kernelVersion}:${serializedSessionKey}`, ()=>deserializePermissionAccount(publicClient, getEntryPoint(ENTRY_POINT_VERSION), kernelVersion, serializedSessionKey));
 }
 /**
  * Creates a delegated session key for an existing kernel account.
@@ -419,7 +594,7 @@ export async function getSessionKey(serializedSessionKey, publicClient) {
  * @param publicClient Viem PublicClient instance
  * @param policies Array of policies to enforce for this session key
  * @returns Serialized session key string
- */ export async function createDelegatedSessionKeyFromKernel(kernelAccount, publicClient, policies) {
+ */ export async function createDelegatedSessionKeyFromKernel(kernelAccount, publicClient, policies, kernelVersion = KERNEL_V3_1) {
     // 1) Generate ephemeral session private key (used only for the permission plugin)
     const sessionPrivateKey = generatePrivateKey();
     const sessionAccount = privateKeyToAccount(sessionPrivateKey);
@@ -427,12 +602,14 @@ export async function getSessionKey(serializedSessionKey, publicClient) {
     const sessionKeySigner = await toECDSASigner({
         signer: sessionAccount
     });
-    // 3) Create the permission validator plugin
+    // 3) Create the permission validator plugin — MUST match the parent kernel's
+    //    version (v3.3 for a 7702 account, v3.1 for the legacy SCA), otherwise the
+    //    serialized blob deserializes/validates against the wrong kernel.
     const permissionValidator = await toPermissionValidator(publicClient, {
         entryPoint: getEntryPoint(ENTRY_POINT_VERSION),
         signer: sessionKeySigner,
         policies,
-        kernelVersion: KERNEL_V3_1
+        kernelVersion
     });
     // 4) Extract the sudo validator from the existing kernel account
     const kernelAccountTyped = kernelAccount;
@@ -440,14 +617,18 @@ export async function getSessionKey(serializedSessionKey, publicClient) {
     if (!sudoValidator) {
         throw new Error('Kernel account does not have a sudo validator');
     }
-    // 5) Create a new kernel account with both sudo (from original) and permission validator
+    // 5) Create a new kernel account with both sudo (from original) and permission
+    //    validator, at the same address as the parent kernel. For a 7702 account
+    //    that address is the EOA; pinning `address` keeps the session-key account
+    //    on the same account rather than a fresh counterfactual one.
     const sessionKeyAccount = await createKernelAccount(publicClient, {
         entryPoint: getEntryPoint(ENTRY_POINT_VERSION),
+        address: kernelAccountTyped.address,
         plugins: {
             sudo: sudoValidator,
             regular: permissionValidator
         },
-        kernelVersion: KERNEL_V3_1
+        kernelVersion
     });
     // 6) Serialize the session key account with the ephemeral private key
     const serialized = await serializePermissionAccount(sessionKeyAccount, sessionPrivateKey);