@pepu-chain/sdk 0.0.0-stage → 0.2.0

package/dist/chunk-NVOPDXTA.cjs

@@ -0,0 +1,95 @@
+'use strict';
+
+var chunk7MNJF2OB_cjs = require('./chunk-7MNJF2OB.cjs');
+var chunkAJS4UFQX_cjs = require('./chunk-AJS4UFQX.cjs');
+var chunkWANILJZQ_cjs = require('./chunk-WANILJZQ.cjs');
+var chunk4GINFJO6_cjs = require('./chunk-4GINFJO6.cjs');
+var chunkVF3D6KLQ_cjs = require('./chunk-VF3D6KLQ.cjs');
+var chunkDPCZJLB3_cjs = require('./chunk-DPCZJLB3.cjs');
+var ecdsaValidator = require('@zerodev/ecdsa-validator');
+var sdk = require('@zerodev/sdk');
+var viem = require('viem');
+
+var KERNEL_VERSION = sdk.constants.KERNEL_V3_1;
+function zd(client) {
+  return client;
+}
+function defaultPublicClient() {
+  return viem.createPublicClient({ chain: chunkDPCZJLB3_cjs.pepuMainnet, transport: viem.http(chunkVF3D6KLQ_cjs.resolvePepuEndpoints().rpcUrl) });
+}
+async function toPepuKernelAccount(p) {
+  const sudo = await ecdsaValidator.signerToEcdsaValidator(zd(p.publicClient), {
+    signer: p.owner,
+    entryPoint: chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
+    kernelVersion: KERNEL_VERSION
+  });
+  return sdk.createKernelAccount(zd(p.publicClient), {
+    entryPoint: chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
+    kernelVersion: KERNEL_VERSION,
+    plugins: { sudo, ...p.plugins?.regular ? { regular: p.plugins.regular } : {} },
+    ...p.index !== void 0 ? { index: p.index } : {}
+  });
+}
+function toEmptyAccount(address) {
+  const refuse = async () => {
+    throw new Error("read-only account cannot sign");
+  };
+  return {
+    address,
+    type: "local",
+    source: "custom",
+    publicKey: "0x",
+    signMessage: refuse,
+    signTransaction: refuse,
+    signTypedData: refuse
+  };
+}
+async function getKernelAddress(publicClient, owner) {
+  const account = await toPepuKernelAccount({ publicClient, owner: toEmptyAccount(owner) });
+  return account.address;
+}
+function createPepuSponsoredClient(p) {
+  const publicClient = p.publicClient ?? defaultPublicClient();
+  const paymaster = chunk7MNJF2OB_cjs.createPepuPaymasterClient({
+    ...p.paymasterUrl !== void 0 ? { paymasterUrl: p.paymasterUrl } : {},
+    ...p.paymasterToken !== void 0 ? { paymasterToken: p.paymasterToken } : {},
+    ...p.paymasterContext ? { context: p.paymasterContext } : {}
+  });
+  return sdk.createKernelAccountClient({
+    account: p.account,
+    chain: chunkDPCZJLB3_cjs.pepuMainnet,
+    client: zd(publicClient),
+    bundlerTransport: viem.http(chunk7MNJF2OB_cjs.requireBundlerUrl(p.bundlerUrl)),
+    paymaster,
+    userOperation: { estimateFeesPerGas: async () => chunk7MNJF2OB_cjs.estimatePepuUserOpFees(publicClient) }
+  });
+}
+async function sendSponsored(p) {
+  const calls = chunkAJS4UFQX_cjs.normalizeCalls(p.calls);
+  try {
+    const account = p.client.account;
+    if (!account) throw new Error("The Kernel client has no account.");
+    const callData = await account.encodeCalls(calls);
+    const userOpHash = await p.client.sendUserOperation({ callData });
+    const receipt = await p.client.waitForUserOperationReceipt({ hash: userOpHash, timeout: p.timeoutMs ?? 9e4 });
+    const transactionHash = receipt.receipt.transactionHash;
+    return {
+      userOpHash,
+      transactionHash,
+      success: receipt.success,
+      paymaster: receipt.paymaster ?? null,
+      actualGasCostWei: receipt.actualGasCost,
+      explorerUrl: chunk4GINFJO6_cjs.txUrl(chunkDPCZJLB3_cjs.pepuMainnet, transactionHash)
+    };
+  } catch (e) {
+    throw chunkWANILJZQ_cjs.describeUserOpFailure(e);
+  }
+}
+
+exports.KERNEL_VERSION = KERNEL_VERSION;
+exports.createPepuSponsoredClient = createPepuSponsoredClient;
+exports.getKernelAddress = getKernelAddress;
+exports.sendSponsored = sendSponsored;
+exports.toPepuKernelAccount = toPepuKernelAccount;
+//# sourceMappingURL=chunk-NVOPDXTA.cjs.map
+//# sourceMappingURL=chunk-NVOPDXTA.cjs.map

package/dist/chunk-NVOPDXTA.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/aa/kernel.ts"],"names":["constants","createPublicClient","pepuMainnet","http","resolvePepuEndpoints","signerToEcdsaValidator","ENTRY_POINT_V07","createKernelAccount","createPepuPaymasterClient","createKernelAccountClient","requireBundlerUrl","estimatePepuUserOpFees","normalizeCalls","txUrl","describeUserOpFailure"],"mappings":";;;;;;;;;;;;AAiCO,IAAM,iBAAiBA,aAAA,CAAU;AAUxC,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,mBAAA,GAAoC;AAC3C,EAAA,OAAOC,uBAAA,CAAmB,EAAE,KAAA,EAAOC,6BAAA,EAAa,SAAA,EAAWC,UAAKC,sCAAA,EAAqB,CAAE,MAAM,CAAA,EAAG,CAAA;AAClG;AAWA,eAAsB,oBAAoB,CAAA,EAUV;AAC9B,EAAA,MAAM,OAAO,MAAMC,qCAAA,CAAuB,EAAA,CAAG,CAAA,CAAE,YAAY,CAAA,EAAG;AAAA,IAC5D,QAAQ,CAAA,CAAE,KAAA;AAAA,IACV,UAAA,EAAYC,iCAAA;AAAA,IACZ,aAAA,EAAe;AAAA,GAChB,CAAA;AACD,EAAA,OAAOC,uBAAA,CAAoB,EAAA,CAAG,CAAA,CAAE,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAYD,iCAAA;AAAA,IACZ,aAAA,EAAe,cAAA;AAAA,IACf,OAAA,EAAS,EAAE,IAAA,EAAM,GAAI,EAAE,OAAA,EAAS,OAAA,GAAU,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,OAAA,EAAQ,GAAI,EAAC,EAAG;AAAA,IAC/E,GAAI,EAAE,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI;AAAC,GAC5B,CAAA;AAC1B;AAEA,SAAS,eAAe,OAAA,EAAgC;AACtD,EAAA,MAAM,SAAS,YAA4B;AACzC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,IAAA,EAAM,OAAA;AAAA,IACN,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,WAAA,EAAa,MAAA;AAAA,IACb,eAAA,EAAiB,MAAA;AAAA,IACjB,aAAA,EAAe;AAAA,GACjB;AACF;AASA,eAAsB,gBAAA,CAAiB,cAA4B,KAAA,EAAkC;AACnG,EAAA,MAAM,OAAA,GAAU,MAAM,mBAAA,CAAoB,EAAE,cAAc,KAAA,EAAO,cAAA,CAAe,KAAK,CAAA,EAAG,CAAA;AACxF,EAAA,OAAO,OAAA,CAAQ,OAAA;AACjB;AASO,SAAS,0BAA0B,CAAA,EAQlB;AACtB,EAAA,MAAM,YAAA,GAAe,CAAA,CAAE,YAAA,IAAgB,mBAAA,EAAoB;AAC3D,EAAA,MAAM,YAAYE,2CAAA,CAA0B;AAAA,IAC1C,GAAI,EAAE,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,CAAA,CAAE,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,EAAE,cAAA,KAAmB,MAAA,GAAY,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI,EAAC;AAAA,IAC7E,GAAI,EAAE,gBAAA,GAAmB,EAAE,SAAS,CAAA,CAAE,gBAAA,KAAqB;AAAC,GAC7D,CAAA;AACD,EAAA,OAAOC,6BAAA,CAA0B;AAAA,IAC/B,SAAS,CAAA,CAAE,OAAA;AAAA,IACX,KAAA,EAAOP,6BAAA;AAAA,IACP,MAAA,EAAQ,GAAG,YAAY,CAAA;AAAA,IACvB,gBAAA,EAAkBC,SAAA,CAAKO,mCAAA,CAAkB,CAAA,CAAE,UAAU,CAAC,CAAA;AAAA,IACtD,SAAA;AAAA,IACA,eAAe,EAAE,kBAAA,EAAoB,YAAYC,wCAAA,CAAuB,YAAY,CAAA;AAAE,GACzB,CAAA;AACjE;AAsBA,eAAsB,cAAc,CAAA,EAIH;AAC/B,EAAA,MAAM,KAAA,GAAQC,gCAAA,CAAe,CAAA,CAAE,KAAK,CAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,EAAE,MAAA,CAAO,OAAA;AACzB,IAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,WAAA,CAAY,KAAK,CAAA;AAChD,IAAA,MAAM,aAAa,MAAM,CAAA,CAAE,OAAO,iBAAA,CAAkB,EAAE,UAAU,CAAA;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,CAAA,CAAE,MAAA,CAAO,2BAAA,CAA4B,EAAE,IAAA,EAAM,UAAA,EAAY,OAAA,EAAS,CAAA,CAAE,SAAA,IAAa,GAAA,EAAQ,CAAA;AAC/G,IAAA,MAAM,eAAA,GAAkB,QAAQ,OAAA,CAAQ,eAAA;AACxC,IAAA,OAAO;AAAA,MACL,UAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,SAAA,EAAW,QAAQ,SAAA,IAAa,IAAA;AAAA,MAChC,kBAAkB,OAAA,CAAQ,aAAA;AAAA,MAC1B,WAAA,EAAaC,uBAAA,CAAMX,6BAAA,EAAa,eAAe;AAAA,KACjD;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAMY,wCAAsB,CAAC,CAAA;AAAA,EAC/B;AACF","file":"chunk-NVOPDXTA.cjs","sourcesContent":["/**\n * @pepu-chain/sdk/aa/kernel: Kernel v3.1 smart account plus sponsored-send\n * helpers for the \"direct\" transport (your own bundler and paymaster URLs).\n * Needs the optional peers `@zerodev/sdk` and `@zerodev/ecdsa-validator`.\n *\n * This is the only module in the SDK (with `session/kernel` and `combo`) that\n * imports ZeroDev. Ported from `templates/sponsored-session-app/lib/kernel.ts`\n * (Kernel v3.1 build, 20% fee headroom because Alto lacks\n * `zd_getUserOperationGasPrice`).\n *\n * Session keys: `toPepuKernelAccount` takes an optional `plugins.regular`\n * validator, which is the plug point WP-B6 (`/session/kernel`, `/combo`) uses\n * to add a permission validator on top of the ECDSA root.\n */\nimport { signerToEcdsaValidator } from \"@zerodev/ecdsa-validator\";\nimport { constants, createKernelAccount, createKernelAccountClient } from \"@zerodev/sdk\";\nimport type { Signer } from \"@zerodev/sdk/types\";\nimport { createPublicClient, http } from \"viem\";\nimport type { Address, Hex, LocalAccount, PublicClient, WalletClient } from \"viem\";\n\nimport { pepuMainnet } from \"../chains.js\";\nimport { resolvePepuEndpoints } from \"../endpoints.js\";\nimport { txUrl } from \"../explorer.js\";\nimport type { PaymasterContext } from \"../erc7677.js\";\nimport { normalizeCalls } from \"./calls.js\";\nimport { ENTRY_POINT_V07, createPepuPaymasterClient, estimatePepuUserOpFees, requireBundlerUrl } from \"./clients.js\";\nimport { describeUserOpFailure } from \"./describe.js\";\nimport type { Call } from \"./types.js\";\n\nexport type { Call } from \"./types.js\";\nexport { encodeKernelExecute } from \"./calls.js\";\n\n/** Kernel v3.1, the version deployed on PEPU mainnet (factory in the contract registry). */\nexport const KERNEL_VERSION = constants.KERNEL_V3_1;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\ntype KernelAccountParams = Parameters<typeof createKernelAccount>[1];\n\n/**\n * The ZeroDev packages resolve their own copy of viem as a peer. In a monorepo\n * with several viem installs two identical `PublicClient` types are nominally\n * different; this is a type-level bridge only (same object at runtime).\n */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/** The Kernel account type this module builds. */\nexport type KernelSmartAccount = Awaited<ReturnType<typeof createKernelAccount>>;\n/** The sponsored client type {@link createPepuSponsoredClient} returns. */\nexport type KernelAccountClient = ReturnType<typeof createKernelAccountClient>;\n\n/** Anything that can sign for the Kernel owner. */\nexport type KernelOwner = LocalAccount | Signer | WalletClient;\n\nfunction defaultPublicClient(): PublicClient {\n  return createPublicClient({ chain: pepuMainnet, transport: http(resolvePepuEndpoints().rpcUrl) }) as PublicClient;\n}\n\n/**\n * Build a Kernel v3.1 smart account owned by `owner` (ECDSA root validator).\n * The address depends only on the owner and `index`, never on a session.\n * Pass `plugins.regular` to add a permission (session-key) validator on top\n * of the root; that is how `@pepu-chain/sdk/session/kernel` builds on this.\n *\n * @example\n * const account = await toPepuKernelAccount({ publicClient, owner: privateKeyToAccount(key) });\n */\nexport async function toPepuKernelAccount(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  index?: bigint;\n  /**\n   * `regular` is a ZeroDev validator plugin, for example the permission\n   * validator from `@zerodev/permissions` (see `@pepu-chain/sdk/session/kernel`).\n   * Typed as `object` so this entry does not need `@zerodev/permissions` types.\n   */\n  plugins?: { regular?: object };\n}): Promise<KernelSmartAccount> {\n  const sudo = await signerToEcdsaValidator(zd(p.publicClient), {\n    signer: p.owner as Signer,\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n  });\n  return createKernelAccount(zd(p.publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    plugins: { sudo, ...(p.plugins?.regular ? { regular: p.plugins.regular } : {}) },\n    ...(p.index !== undefined ? { index: p.index } : {}),\n  } as KernelAccountParams);\n}\n\nfunction toEmptyAccount(address: Address): LocalAccount {\n  const refuse = async (): Promise<never> => {\n    throw new Error(\"read-only account cannot sign\");\n  };\n  return {\n    address,\n    type: \"local\",\n    source: \"custom\",\n    publicKey: \"0x\" as Hex,\n    signMessage: refuse,\n    signTransaction: refuse,\n    signTypedData: refuse,\n  } as unknown as LocalAccount;\n}\n\n/**\n * The counterfactual Kernel address for an owner, with no signature needed.\n * Lifted from `templates/sponsored-session-app/lib/kernel.ts`.\n *\n * @example\n * const smartAccount = await getKernelAddress(publicClient, ownerAddress);\n */\nexport async function getKernelAddress(publicClient: PublicClient, owner: Address): Promise<Address> {\n  const account = await toPepuKernelAccount({ publicClient, owner: toEmptyAccount(owner) });\n  return account.address;\n}\n\n/**\n * A Kernel client that sends through YOUR bundler and has gas paid by YOUR\n * paymaster (ERC-7677). Fees come from the chain with 20% headroom.\n *\n * @example\n * const client = createPepuSponsoredClient({ account, paymasterContext: { privyAccessToken } });\n */\nexport function createPepuSponsoredClient(p: {\n  account: KernelSmartAccount;\n  bundlerUrl?: string;\n  paymasterUrl?: string;\n  /** Project client token; builds the ERC-7677 URL against the paymaster base when no URL is configured. */\n  paymasterToken?: string;\n  paymasterContext?: PaymasterContext;\n  publicClient?: PublicClient;\n}): KernelAccountClient {\n  const publicClient = p.publicClient ?? defaultPublicClient();\n  const paymaster = createPepuPaymasterClient({\n    ...(p.paymasterUrl !== undefined ? { paymasterUrl: p.paymasterUrl } : {}),\n    ...(p.paymasterToken !== undefined ? { paymasterToken: p.paymasterToken } : {}),\n    ...(p.paymasterContext ? { context: p.paymasterContext } : {}),\n  });\n  return createKernelAccountClient({\n    account: p.account,\n    chain: pepuMainnet,\n    client: zd(publicClient),\n    bundlerTransport: http(requireBundlerUrl(p.bundlerUrl)),\n    paymaster,\n    userOperation: { estimateFeesPerGas: async () => estimatePepuUserOpFees(publicClient) },\n  } as unknown as Parameters<typeof createKernelAccountClient>[0]);\n}\n\n/** Result of {@link sendSponsored}. */\nexport interface SendSponsoredResult {\n  userOpHash: Hex;\n  transactionHash: Hex;\n  success: boolean;\n  paymaster: Address | null;\n  actualGasCostWei: bigint;\n  explorerUrl: string;\n}\n\n/**\n * Encode `calls`, send one UserOperation, wait for its receipt, and report\n * who paid. Failures are mapped through `describeUserOpFailure` (AAxx and\n * paymaster reasons become typed PepuErrors). Flow ported from\n * `sendSessionTap` in the sponsored-session-app template.\n *\n * @example\n * const r = await sendSponsored({ client, calls: [{ to, abi, functionName: \"tap\" }] });\n * console.log(r.paymaster, r.explorerUrl);\n */\nexport async function sendSponsored(p: {\n  client: KernelAccountClient;\n  calls: Call[];\n  timeoutMs?: number;\n}): Promise<SendSponsoredResult> {\n  const calls = normalizeCalls(p.calls);\n  try {\n    const account = p.client.account;\n    if (!account) throw new Error(\"The Kernel client has no account.\");\n    const callData = await account.encodeCalls(calls);\n    const userOpHash = await p.client.sendUserOperation({ callData });\n    const receipt = await p.client.waitForUserOperationReceipt({ hash: userOpHash, timeout: p.timeoutMs ?? 90_000 });\n    const transactionHash = receipt.receipt.transactionHash;\n    return {\n      userOpHash,\n      transactionHash,\n      success: receipt.success,\n      paymaster: receipt.paymaster ?? null,\n      actualGasCostWei: receipt.actualGasCost,\n      explorerUrl: txUrl(pepuMainnet, transactionHash),\n    };\n  } catch (e) {\n    throw describeUserOpFailure(e);\n  }\n}\n"]}

package/dist/chunk-OH3QMAIB.js

@@ -0,0 +1,11 @@
+import { http, createPublicClient } from 'viem';
+
+// src/client.ts
+function getPublicClient(chain, options) {
+  const transport = options?.transport ?? http();
+  return createPublicClient({ chain, transport });
+}
+
+export { getPublicClient };
+//# sourceMappingURL=chunk-OH3QMAIB.js.map
+//# sourceMappingURL=chunk-OH3QMAIB.js.map

package/dist/chunk-OH3QMAIB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts"],"names":[],"mappings":";;;AAWO,SAAS,eAAA,CACd,OACA,OAAA,EACoC;AAIpC,EAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,IAAA,EAAK;AAC7C,EAAA,OAAO,kBAAA,CAAmB,EAAE,KAAA,EAAO,SAAA,EAAW,CAAA;AAChD","file":"chunk-OH3QMAIB.js","sourcesContent":["import { type PublicClient, type Transport, createPublicClient, http } from \"viem\";\n\nimport type { PepuChain } from \"./chains.js\";\n\n/**\n * Create a viem `PublicClient` for a Pepe Unchained V2 chain, defaulting\n * its transport to the chain's first `rpcUrls.default.http` entry.\n *\n * Pass `transport` to use a different RPC endpoint (e.g. an authenticated\n * provider URL) while keeping the rest of the chain definition.\n */\nexport function getPublicClient(\n  chain: PepuChain,\n  options?: { transport?: Transport },\n): PublicClient<Transport, PepuChain> {\n  // `http()` with no URL falls back to `chain.rpcUrls.default.http[0]`\n  // internally (see viem's `http` transport), so the chain definition\n  // stays the single source of truth for the default RPC endpoint.\n  const transport = options?.transport ?? http();\n  return createPublicClient({ chain, transport });\n}\n"]}

package/dist/chunk-PHM3ZORG.cjs

@@ -0,0 +1,110 @@
+'use strict';
+
+var chunkNVOPDXTA_cjs = require('./chunk-NVOPDXTA.cjs');
+var chunk7MNJF2OB_cjs = require('./chunk-7MNJF2OB.cjs');
+var chunkJ3O2ZGG3_cjs = require('./chunk-J3O2ZGG3.cjs');
+var permissions = require('@zerodev/permissions');
+var policies = require('@zerodev/permissions/policies');
+var signers = require('@zerodev/permissions/signers');
+var accounts = require('viem/accounts');
+
+// src/session/store.ts
+function createMemoryStore() {
+  const records = /* @__PURE__ */ new Map();
+  const locks = /* @__PURE__ */ new Set();
+  return {
+    get: (userId) => records.get(userId),
+    set: (record) => {
+      records.set(record.userId, record);
+    },
+    delete: (userId) => {
+      records.delete(userId);
+    },
+    tryLock: (userId) => {
+      if (locks.has(userId)) return false;
+      locks.add(userId);
+      return true;
+    },
+    unlock: (userId) => {
+      locks.delete(userId);
+    }
+  };
+}
+function isLive(record, nowSeconds) {
+  return record.approval !== null && nowSeconds < record.validUntil;
+}
+
+// src/session/kernel.ts
+var CALL_POLICY_V0_0_4_ADDRESS = "0x9a52283276A0ec8740DF50bF01B28A80D880eaf2";
+var TIMESTAMP_POLICY_ADDRESS = "0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F";
+var SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 };
+function zd(client) {
+  return client;
+}
+function buildKernelSessionPolicies(p) {
+  chunkJ3O2ZGG3_cjs.assertCalls(p.calls);
+  return [
+    policies.toCallPolicy({
+      policyVersion: policies.CallPolicyVersion.V0_0_4,
+      permissions: p.calls.map((c) => ({
+        target: c.target,
+        valueLimit: c.valueLimit ?? 0n,
+        abi: [chunkJ3O2ZGG3_cjs.findFunction(c)],
+        functionName: c.functionName
+      }))
+    }),
+    policies.toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil })
+  ];
+}
+function generateSessionKey() {
+  const privateKey = accounts.generatePrivateKey();
+  return { privateKey, address: accounts.privateKeyToAccount(privateKey).address };
+}
+function permissionFor(publicClient, sessionKeyAddress, policies) {
+  return permissions.toPermissionValidator(zd(publicClient), {
+    entryPoint: chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
+    kernelVersion: chunkNVOPDXTA_cjs.KERNEL_VERSION,
+    signer: signers.toEmptyECDSASigner(sessionKeyAddress),
+    policies
+  });
+}
+async function expectedPermissionId(p) {
+  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);
+  const { permissionId } = permission.getPluginSerializationParams();
+  if (!permissionId) throw new Error("Could not derive the permission id.");
+  return permissionId;
+}
+async function approveKernelSession(p) {
+  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);
+  const account = await chunkNVOPDXTA_cjs.toPepuKernelAccount({
+    publicClient: p.publicClient,
+    owner: p.owner,
+    plugins: { regular }
+  });
+  const approval = await permissions.serializePermissionAccount(account);
+  return { approval, kernelAddress: account.address };
+}
+async function loadKernelSessionAccount(p) {
+  const sessionSigner = await signers.toECDSASigner({ signer: accounts.privateKeyToAccount(p.sessionPrivateKey) });
+  const account = await permissions.deserializePermissionAccount(
+    zd(p.publicClient),
+    chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
+    chunkNVOPDXTA_cjs.KERNEL_VERSION,
+    p.approval,
+    sessionSigner
+  );
+  return account;
+}
+
+exports.CALL_POLICY_V0_0_4_ADDRESS = CALL_POLICY_V0_0_4_ADDRESS;
+exports.SESSION_GAS_RESERVATION_PEPU = SESSION_GAS_RESERVATION_PEPU;
+exports.TIMESTAMP_POLICY_ADDRESS = TIMESTAMP_POLICY_ADDRESS;
+exports.approveKernelSession = approveKernelSession;
+exports.buildKernelSessionPolicies = buildKernelSessionPolicies;
+exports.createMemoryStore = createMemoryStore;
+exports.expectedPermissionId = expectedPermissionId;
+exports.generateSessionKey = generateSessionKey;
+exports.isLive = isLive;
+exports.loadKernelSessionAccount = loadKernelSessionAccount;
+//# sourceMappingURL=chunk-PHM3ZORG.cjs.map
+//# sourceMappingURL=chunk-PHM3ZORG.cjs.map

package/dist/chunk-PHM3ZORG.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session/store.ts","../src/session/kernel.ts"],"names":["assertCalls","toCallPolicy","CallPolicyVersion","findFunction","toTimestampPolicy","generatePrivateKey","privateKeyToAccount","toPermissionValidator","ENTRY_POINT_V07","KERNEL_VERSION","toEmptyECDSASigner","toPepuKernelAccount","serializePermissionAccount","toECDSASigner","deserializePermissionAccount"],"mappings":";;;;;;;;;;;AAyDO,SAAS,iBAAA,GAAkC;AAChD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA2B;AAC/C,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,MAAA,KAAW,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,IACnC,GAAA,EAAK,CAAC,MAAA,KAAW;AACf,MAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACvB,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,MAAA,KAAW;AACnB,MAAA,IAAI,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA,EAAG,OAAO,KAAA;AAC9B,MAAA,KAAA,CAAM,IAAI,MAAM,CAAA;AAChB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAQO,SAAS,MAAA,CAAO,QAAuB,UAAA,EAA6B;AACzE,EAAA,OAAO,MAAA,CAAO,QAAA,KAAa,IAAA,IAAQ,UAAA,GAAa,MAAA,CAAO,UAAA;AACzD;;;ACvCO,IAAM,0BAAA,GAAsC;AAE5C,IAAM,wBAAA,GAAoC;AAW1C,IAAM,4BAAA,GAA+B,EAAE,cAAA,EAAgB,IAAA,EAAM,gBAAgB,GAAA;AAKpF,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,2BAA2B,CAAA,EAI9B;AACX,EAAAA,6BAAA,CAAY,EAAE,KAAK,CAAA;AACnB,EAAA,OAAO;AAAA,IACLC,qBAAA,CAAa;AAAA,MACX,eAAeC,0BAAA,CAAkB,MAAA;AAAA,MACjC,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAC/B,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAA,EAAY,EAAE,UAAA,IAAc,EAAA;AAAA,QAC5B,GAAA,EAAK,CAACC,8BAAA,CAAa,CAAC,CAAC,CAAA;AAAA,QACrB,cAAc,CAAA,CAAE;AAAA,OAClB,CAAE;AAAA,KACmC,CAAA;AAAA,IACvCC,0BAAA,CAAkB,EAAE,UAAA,EAAY,CAAA,CAAE,cAAc,CAAA,EAAG,UAAA,EAAY,CAAA,CAAE,UAAA,EAAY;AAAA,GAC/E;AACF;AASO,SAAS,kBAAA,GAA4D;AAC1E,EAAA,MAAM,aAAaC,2BAAA,EAAmB;AACtC,EAAA,OAAO,EAAE,UAAA,EAAY,OAAA,EAASC,4BAAA,CAAoB,UAAU,EAAE,OAAA,EAAQ;AACxE;AAEA,SAAS,aAAA,CAAc,YAAA,EAA4B,iBAAA,EAA4B,QAAA,EAAoB;AACjG,EAAA,OAAOC,iCAAA,CAAsB,EAAA,CAAG,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAYC,iCAAA;AAAA,IACZ,aAAA,EAAeC,gCAAA;AAAA,IACf,MAAA,EAAQC,2BAAmB,iBAAiB,CAAA;AAAA,IAC5C;AAAA,GACD,CAAA;AACH;AASA,eAAsB,qBAAqB,CAAA,EAIvB;AAClB,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACtF,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,UAAA,CAAW,4BAAA,EAA6B;AACjE,EAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACxE,EAAA,OAAO,YAAA;AACT;AAeA,eAAsB,qBAAqB,CAAA,EAKe;AACxD,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACnF,EAAA,MAAM,OAAA,GAAU,MAAMC,qCAAA,CAAoB;AAAA,IACxC,cAAc,CAAA,CAAE,YAAA;AAAA,IAChB,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,OAAA,EAAS,EAAE,OAAA;AAAQ,GACpB,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAMC,sCAAA,CAA2B,OAAgB,CAAA;AAClE,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,OAAA,CAAQ,OAAA,EAAQ;AACpD;AAUA,eAAsB,yBAAyB,CAAA,EAIf;AAC9B,EAAA,MAAM,aAAA,GAAgB,MAAMC,qBAAA,CAAc,EAAE,QAAQP,4BAAA,CAAoB,CAAA,CAAE,iBAAiB,CAAA,EAAG,CAAA;AAC9F,EAAA,MAAM,UAAU,MAAMQ,wCAAA;AAAA,IACpB,EAAA,CAAG,EAAE,YAAY,CAAA;AAAA,IACjBN,iCAAA;AAAA,IACAC,gCAAA;AAAA,IACA,CAAA,CAAE,QAAA;AAAA,IACF;AAAA,GACF;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-PHM3ZORG.cjs","sourcesContent":["import type { Address, Hex } from \"viem\";\n\n/**\n * Server-side session records for the Kernel (on-chain) session flow, keyed by\n * Privy user id. Ported from templates/sponsored-session-app/lib/session-store.ts.\n *\n * WHAT IS STORED: the session private key (a hot key whose power is limited\n * ON-CHAIN by the call and timestamp policies until `validUntil`) and the\n * public approval. The owner's key never reaches the server.\n *\n * PRODUCTION: {@link createMemoryStore} is DEV-GRADE. It is lost on every\n * restart (the user simply starts a new session) and is not shared between\n * serverless instances. A production deployment must implement\n * {@link SessionStore} on a persistent database or KV AND keep\n * `sessionPrivateKey` encrypted at rest (KMS or an envelope key). Nothing else\n * in the SDK changes.\n */\nexport interface SessionRecord {\n  userId: string;\n  ownerAddress: Address;\n  kernelAddress: Address;\n  /** The session key's private half. Encrypt it at rest in any persistent store. */\n  sessionPrivateKey: Hex;\n  sessionKeyAddress: Address;\n  permissionId: string;\n  /** Unix seconds. The on-chain permission is invalid at and after this time. */\n  validUntil: number;\n  /** Present once the owner has signed the grant. */\n  approval: string | null;\n  /** Number of successful sponsored actions in this session. */\n  actions: number;\n}\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * Pluggable storage for {@link SessionRecord}s. Every method may be sync or\n * async. `tryLock` must be atomic per user: it returns `false` when an action\n * is already running for that user (a multi-instance deployment needs a\n * distributed lock, for example a Redis `SET NX PX`).\n */\nexport interface SessionStore {\n  get(userId: string): MaybePromise<SessionRecord | undefined>;\n  set(record: SessionRecord): MaybePromise<void>;\n  delete(userId: string): MaybePromise<void>;\n  tryLock(userId: string): MaybePromise<boolean>;\n  unlock(userId: string): MaybePromise<void>;\n}\n\n/**\n * An in-memory {@link SessionStore} for development and tests. DEV-GRADE: not\n * persistent, not shared across instances, and the session key is held in\n * plaintext in process memory. Production needs an encrypted persistent store.\n *\n * @example\n * const store = createMemoryStore();\n */\nexport function createMemoryStore(): SessionStore {\n  const records = new Map<string, SessionRecord>();\n  const locks = new Set<string>();\n  return {\n    get: (userId) => records.get(userId),\n    set: (record) => {\n      records.set(record.userId, record);\n    },\n    delete: (userId) => {\n      records.delete(userId);\n    },\n    tryLock: (userId) => {\n      if (locks.has(userId)) return false;\n      locks.add(userId);\n      return true;\n    },\n    unlock: (userId) => {\n      locks.delete(userId);\n    },\n  };\n}\n\n/**\n * True while the on-chain permission is still valid: approved and before expiry.\n *\n * @example\n * isLive(record, Math.floor(Date.now() / 1000));\n */\nexport function isLive(record: SessionRecord, nowSeconds: number): boolean {\n  return record.approval !== null && nowSeconds < record.validUntil;\n}\n","import { deserializePermissionAccount, serializePermissionAccount, toPermissionValidator } from \"@zerodev/permissions\";\nimport type { Policy } from \"@zerodev/permissions\";\nimport { CallPolicyVersion, toCallPolicy, toTimestampPolicy } from \"@zerodev/permissions/policies\";\nimport { toECDSASigner, toEmptyECDSASigner } from \"@zerodev/permissions/signers\";\nimport type { createKernelAccount } from \"@zerodev/sdk\";\nimport type { Abi, Address, Hex, PublicClient } from \"viem\";\nimport { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";\n\nimport { ENTRY_POINT_V07 } from \"../aa/clients.js\";\nimport { KERNEL_VERSION, toPepuKernelAccount } from \"../aa/kernel.js\";\nimport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nimport { assertCalls, findFunction } from \"./scope.js\";\nimport type { KernelSessionCall } from \"./scope.js\";\n\nexport { KERNEL_VERSION, getKernelAddress } from \"../aa/kernel.js\";\nexport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nexport { createMemoryStore, isLive } from \"./store.js\";\nexport type { SessionRecord, SessionStore } from \"./store.js\";\nexport { checkApproval, describeKernelSessionScope, isCallInScope, parseApproval } from \"./scope.js\";\nexport type { ApprovalCheck, KernelSessionCall, KernelSessionScope, ParsedApproval } from \"./scope.js\";\n\n/**\n * `@pepu-chain/sdk/session/kernel`: on-chain session keys with ZeroDev Kernel\n * permissions. Extracted from templates/sponsored-session-app/lib/{kernel,\n * session-policy,approval}.ts and built on `toPepuKernelAccount`\n * (`plugins.regular`).\n *\n * The scope is enforced ON-CHAIN by ZeroDev's policy contracts, which the\n * user's Kernel account calls during UserOperation validation:\n *\n * - Call policy v0.0.4: only the listed targets and function selectors, with a\n *   native value no larger than `valueLimit` (default 0).\n * - Timestamp policy: the permission is invalid outside `validAfter`..`validUntil`.\n *\n * A UserOperation outside this scope is rejected by the EntryPoint itself, no\n * matter who relays it or what the app backend does.\n *\n * Deployed on PEPU mainnet (eth_getCode verified 2026-10-02): Kernel v3.1\n * factory 0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419, ECDSA validator\n * 0x845ADb2C711129d4f3966735eD98a9F09fC4cE57, ECDSA signer module\n * 0x6A6F069E2a08c2468e7724Ab3250CdBFBA14D4FF, call policy v0.0.4 and the\n * timestamp policy below. Call policy v0.0.5 is NOT deployed on PEPU, so the\n * version is pinned.\n *\n * Optional peers: `@zerodev/sdk`, `@zerodev/permissions`, `@zerodev/ecdsa-validator`.\n */\n\n/** Call policy v0.0.4. Pinned: v0.0.5 is not deployed on PEPU mainnet. */\nexport const CALL_POLICY_V0_0_4_ADDRESS: Address = \"0x9a52283276A0ec8740DF50bF01B28A80D880eaf2\";\n/** ZeroDev timestamp policy on PEPU mainnet. */\nexport const TIMESTAMP_POLICY_ADDRESS: Address = \"0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F\";\n\n/**\n * Worst-case gas the paymaster policy service RESERVES per sponsored operation,\n * measured on PEPU mainnet with the sponsored-session-app template: the first\n * operation of a session (account deploy plus enabling the permission) about\n * 20.5 PEPU, later operations about 6.9 PEPU. The real first-session cost was\n * about 12.8 PEPU for two operations. Size per-user hourly and daily spend\n * caps above these, or users hit `trailing-hour spend ... would exceed cap`\n * after their first action.\n */\nexport const SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 } as const;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\n\n/** Type-level bridge for ZeroDev's own viem copy (same object at runtime). */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/**\n * The on-chain policies for one session: call policy v0.0.4 plus the timestamp\n * policy. Pure and deterministic given its input. Only the named function\n * fragments go into the policy, which keeps the grant small.\n *\n * @example\n * const policies = buildKernelSessionPolicies({\n *   calls: [{ target: tapScore, abi: tapScoreAbi, functionName: \"tap\" }],\n *   validUntil: Math.floor(Date.now() / 1000) + 900,\n * });\n */\nexport function buildKernelSessionPolicies(p: {\n  calls: readonly KernelSessionCall[];\n  validUntil: number;\n  validAfter?: number;\n}): Policy[] {\n  assertCalls(p.calls);\n  return [\n    toCallPolicy({\n      policyVersion: CallPolicyVersion.V0_0_4,\n      permissions: p.calls.map((c) => ({\n        target: c.target,\n        valueLimit: c.valueLimit ?? 0n,\n        abi: [findFunction(c)] as Abi,\n        functionName: c.functionName,\n      })),\n    } as Parameters<typeof toCallPolicy>[0]),\n    toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil }),\n  ];\n}\n\n/**\n * A fresh random session key. SERVER ONLY: the private key must never reach\n * the browser. Only the address is sent to the owner for approval.\n *\n * @example\n * const { privateKey, address } = generateSessionKey();\n */\nexport function generateSessionKey(): { privateKey: Hex; address: Address } {\n  const privateKey = generatePrivateKey();\n  return { privateKey, address: privateKeyToAccount(privateKey).address };\n}\n\nfunction permissionFor(publicClient: PublicClient, sessionKeyAddress: Address, policies: Policy[]) {\n  return toPermissionValidator(zd(publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    signer: toEmptyECDSASigner(sessionKeyAddress),\n    policies,\n  });\n}\n\n/**\n * The permission id the chain derives for this session key plus these\n * policies. The server compares it with a browser-supplied approval.\n *\n * @example\n * const permissionId = await expectedPermissionId({ publicClient, sessionKeyAddress, policies });\n */\nexport async function expectedPermissionId(p: {\n  publicClient: PublicClient;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<string> {\n  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const { permissionId } = permission.getPluginSerializationParams();\n  if (!permissionId) throw new Error(\"Could not derive the permission id.\");\n  return permissionId;\n}\n\n/**\n * In the user's browser: the owner (the Privy embedded wallet, the only thing\n * that can authorize a session) signs ONE EIP-712 message that enables a\n * permission validator on their Kernel account. That signature is the whole\n * grant. It names the session key's public address (never its private key)\n * and the policies. The returned `approval` holds no secret: it is the enable\n * signature plus the policy parameters, useless without the session key.\n *\n * @example\n * const { approval, kernelAddress } = await approveKernelSession({\n *   publicClient, owner: walletClient, sessionKeyAddress, policies,\n * });\n */\nexport async function approveKernelSession(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<{ approval: string; kernelAddress: Address }> {\n  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const account = await toPepuKernelAccount({\n    publicClient: p.publicClient,\n    owner: p.owner,\n    plugins: { regular },\n  });\n  const approval = await serializePermissionAccount(account as never);\n  return { approval, kernelAddress: account.address };\n}\n\n/**\n * On the server: rebuild the session's Kernel account from the approval and\n * the server-held session key (an ECDSA signer for that key). No owner\n * signature is involved. Pass the result to `createPepuSponsoredClient`.\n *\n * @example\n * const account = await loadKernelSessionAccount({ publicClient, approval, sessionPrivateKey });\n */\nexport async function loadKernelSessionAccount(p: {\n  publicClient: PublicClient;\n  approval: string;\n  sessionPrivateKey: Hex;\n}): Promise<KernelSmartAccount> {\n  const sessionSigner = await toECDSASigner({ signer: privateKeyToAccount(p.sessionPrivateKey) });\n  const account = await deserializePermissionAccount(\n    zd(p.publicClient),\n    ENTRY_POINT_V07,\n    KERNEL_VERSION,\n    p.approval,\n    sessionSigner,\n  );\n  return account as unknown as KernelSmartAccount;\n}\n"]}

package/dist/chunk-R5PXQNO3.cjs

@@ -0,0 +1,209 @@
+'use strict';
+
+var chunkDH6BFNVJ_cjs = require('./chunk-DH6BFNVJ.cjs');
+var chunkYQL7NISX_cjs = require('./chunk-YQL7NISX.cjs');
+var reactAuth = require('@privy-io/react-auth');
+var react = require('react');
+
+var KNOWN_CODES = new Set(chunkYQL7NISX_cjs.PEPU_ERROR_CATALOG.map((e) => e.code));
+async function errorFromResponse(res) {
+  const body = await res.json().catch(() => null);
+  const e = body?.error;
+  const message = typeof e === "string" ? e : e?.message;
+  const rawCode = typeof e === "object" ? e?.code : void 0;
+  const code = res.status === 409 && !rawCode ? "SESSION_NONE" : rawCode && KNOWN_CODES.has(rawCode) ? rawCode : res.status === 401 ? "AUTH_INVALID_TOKEN" : "UNKNOWN";
+  const Cls = code === "SESSION_NONE" ? chunkYQL7NISX_cjs.PepuSessionError : code === "AUTH_INVALID_TOKEN" ? chunkYQL7NISX_cjs.PepuAuthError : chunkYQL7NISX_cjs.PepuError;
+  return new Cls(code, message ?? `Request failed (${res.status}).`, {
+    status: res.status,
+    ...typeof e === "object" && e?.hint ? { hint: e.hint } : {}
+  });
+}
+function deriveSessionState(p) {
+  if (!p.delegated) return { state: "none" };
+  if (p.expiresAt === void 0) return { state: "active" };
+  const secondsLeft = p.expiresAt - p.nowSeconds;
+  return secondsLeft <= 0 ? { state: "expired", secondsLeft: 0 } : { state: "active", secondsLeft };
+}
+var CHANGE_EVENT = "pepu-session-change";
+var storageKey = (address) => `pepu:session:${address.toLowerCase()}`;
+function readStored(address) {
+  if (!address) return void 0;
+  try {
+    const raw = globalThis.localStorage?.getItem(storageKey(address));
+    return raw ? JSON.parse(raw) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function writeStored(address, value) {
+  try {
+    if (value) globalThis.localStorage?.setItem(storageKey(address), JSON.stringify(value));
+    else globalThis.localStorage?.removeItem(storageKey(address));
+  } catch {
+  }
+  globalThis.dispatchEvent?.(new Event(CHANGE_EVENT));
+}
+function useAuthFetch(o) {
+  const { user } = reactAuth.usePrivy();
+  const pepuAuthFetch = chunkDH6BFNVJ_cjs.usePepuAuthFetch();
+  const custom = o.authFetch;
+  const authFetch = react.useCallback(
+    (url, init) => custom ? custom(url, init) : pepuAuthFetch(url, init),
+    [custom, pepuAuthFetch]
+  );
+  return { authFetch, address: o.address ?? user?.wallet?.address };
+}
+function useSessionGrant(o = {}) {
+  const { authFetch, address } = useAuthFetch(o);
+  const { addSigners } = reactAuth.useSigners();
+  const [status, setStatus] = react.useState("idle");
+  const [error, setError] = react.useState();
+  const endpoint = o.grantEndpoint ?? "/api/session/grant";
+  const grant = react.useCallback(async () => {
+    setError(void 0);
+    try {
+      if (!address) throw new chunkYQL7NISX_cjs.PepuAuthError("WALLET_NOT_PROVISIONED", "No embedded wallet address yet.");
+      setStatus("creating-policy");
+      const res = await authFetch(endpoint, { method: "POST" });
+      if (!res.ok) throw await errorFromResponse(res);
+      const body = await res.json();
+      if (!body.alreadyGranted) {
+        setStatus("awaiting-consent");
+        try {
+          await addSigners({ address, signers: [{ signerId: body.signerId, policyIds: [body.policyId] }] });
+        } catch (caught) {
+          const msg = caught instanceof Error ? caught.message : "";
+          if (!/duplicate signer/i.test(msg)) throw caught;
+        }
+        writeStored(address, { expiresAt: body.expiresAt, policyId: body.policyId });
+      } else {
+        globalThis.dispatchEvent?.(new Event(CHANGE_EVENT));
+      }
+      setStatus("granted");
+    } catch (e) {
+      setError(chunkYQL7NISX_cjs.toPepuError(e, { op: "session grant" }));
+      setStatus("error");
+    }
+  }, [address, authFetch, endpoint, addSigners]);
+  return { grant, status, ...error ? { error } : {} };
+}
+function useSessionStatus(o = {}) {
+  const { authFetch, address } = useAuthFetch(o);
+  const endpoint = o.statusEndpoint ?? "/api/session/status";
+  const [delegated, setDelegated] = react.useState(false);
+  const [loading, setLoading] = react.useState(true);
+  const [serverExpiresAt, setServerExpiresAt] = react.useState();
+  const [now, setNow] = react.useState(() => Math.floor(Date.now() / 1e3));
+  const [tick, setTick] = react.useState(0);
+  const refetch = react.useCallback(() => setTick((t) => t + 1), []);
+  react.useEffect(() => {
+    let cancelled = false;
+    void (async () => {
+      try {
+        const res = await authFetch(endpoint);
+        if (!res.ok) return;
+        const body = await res.json();
+        if (cancelled) return;
+        setDelegated(Boolean(body.delegated));
+        setServerExpiresAt(body.expiresAt);
+      } catch {
+      } finally {
+        if (!cancelled) setLoading(false);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [authFetch, endpoint, tick]);
+  react.useEffect(() => {
+    const onChange = () => setTick((t) => t + 1);
+    globalThis.addEventListener?.(CHANGE_EVENT, onChange);
+    return () => globalThis.removeEventListener?.(CHANGE_EVENT, onChange);
+  }, []);
+  react.useEffect(() => {
+    const id = setInterval(() => setNow(Math.floor(Date.now() / 1e3)), 1e3);
+    return () => clearInterval(id);
+  }, []);
+  react.useEffect(() => {
+    if (!o.pollMs) return;
+    const id = setInterval(() => setTick((t) => t + 1), o.pollMs);
+    return () => clearInterval(id);
+  }, [o.pollMs]);
+  const expiresAt = serverExpiresAt ?? readStored(address)?.expiresAt;
+  const derived = deriveSessionState({ delegated, expiresAt, nowSeconds: now });
+  return {
+    state: derived.state,
+    loading,
+    ...expiresAt !== void 0 ? { expiresAt } : {},
+    ...derived.secondsLeft !== void 0 ? { secondsLeft: derived.secondsLeft } : {},
+    refetch
+  };
+}
+function useSessionRevoke(o = {}) {
+  const { authFetch, address } = useAuthFetch(o);
+  const { removeSigners } = reactAuth.useSigners();
+  const [status, setStatus] = react.useState("idle");
+  const [error, setError] = react.useState();
+  const endpoint = o.revokeEndpoint ?? "/api/session/revoke";
+  const revoke = react.useCallback(async () => {
+    setError(void 0);
+    try {
+      if (!address) throw new chunkYQL7NISX_cjs.PepuAuthError("WALLET_NOT_PROVISIONED", "No embedded wallet address yet.");
+      setStatus("revoking");
+      const stored = readStored(address);
+      await removeSigners({ address });
+      try {
+        await authFetch(endpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ policyId: stored?.policyId })
+        });
+      } catch {
+      }
+      writeStored(address, null);
+      setStatus("revoked");
+    } catch (e) {
+      setError(chunkYQL7NISX_cjs.toPepuError(e, { op: "session revoke" }));
+      setStatus("error");
+    }
+  }, [address, authFetch, endpoint, removeSigners]);
+  return { revoke, status, ...error ? { error } : {} };
+}
+function useSessionAct(o) {
+  const { authFetch } = useAuthFetch(o);
+  const [status, setStatus] = react.useState("idle");
+  const [error, setError] = react.useState();
+  const act = react.useCallback(
+    async (input) => {
+      setStatus("pending");
+      setError(void 0);
+      try {
+        const res = await authFetch(o.endpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(input ?? {})
+        });
+        if (!res.ok) throw await errorFromResponse(res);
+        const out = await res.json();
+        setStatus("success");
+        return out;
+      } catch (e) {
+        const err = chunkYQL7NISX_cjs.toPepuError(e, { op: "session action" });
+        setError(err);
+        setStatus("error");
+        throw err;
+      }
+    },
+    [authFetch, o.endpoint]
+  );
+  return { act, status, ...error ? { error } : {} };
+}
+
+exports.deriveSessionState = deriveSessionState;
+exports.errorFromResponse = errorFromResponse;
+exports.useSessionAct = useSessionAct;
+exports.useSessionGrant = useSessionGrant;
+exports.useSessionRevoke = useSessionRevoke;
+exports.useSessionStatus = useSessionStatus;
+//# sourceMappingURL=chunk-R5PXQNO3.cjs.map
+//# sourceMappingURL=chunk-R5PXQNO3.cjs.map

package/dist/chunk-R5PXQNO3.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session/react.ts"],"names":["PEPU_ERROR_CATALOG","PepuSessionError","PepuAuthError","PepuError","usePrivy","usePepuAuthFetch","useCallback","useSigners","useState","toPepuError","useEffect"],"mappings":";;;;;;;AAwBA,IAAM,WAAA,GAAc,IAAI,GAAA,CAAYA,oCAAA,CAAmB,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAUzE,eAAsB,kBAAkB,GAAA,EAAmC;AACzE,EAAA,MAAM,OAAQ,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAG/C,EAAA,MAAM,IAAI,IAAA,EAAM,KAAA;AAChB,EAAA,MAAM,OAAA,GAAU,OAAO,CAAA,KAAM,QAAA,GAAW,IAAI,CAAA,EAAG,OAAA;AAC/C,EAAA,MAAM,OAAA,GAAU,OAAO,CAAA,KAAM,QAAA,GAAW,GAAG,IAAA,GAAO,MAAA;AAClD,EAAA,MAAM,OACJ,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,CAAC,UACnB,cAAA,GACA,OAAA,IAAW,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA,GAC/B,OAAA,GACD,GAAA,CAAI,MAAA,KAAW,MACb,oBAAA,GACA,SAAA;AACV,EAAA,MAAM,MAAM,IAAA,KAAS,cAAA,GAAiBC,kCAAA,GAAmB,IAAA,KAAS,uBAAuBC,+BAAA,GAAgBC,2BAAA;AACzG,EAAA,OAAO,IAAI,GAAA,CAAI,IAAA,EAAM,WAAW,CAAA,gBAAA,EAAmB,GAAA,CAAI,MAAM,CAAA,EAAA,CAAA,EAAM;AAAA,IACjE,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,GAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,EAAG,IAAA,GAAO,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAK,GAAI;AAAC,GAC5D,CAAA;AACH;AAaO,SAAS,mBAAmB,CAAA,EAIe;AAChD,EAAA,IAAI,CAAC,CAAA,CAAE,SAAA,EAAW,OAAO,EAAE,OAAO,MAAA,EAAO;AACzC,EAAA,IAAI,EAAE,SAAA,KAAc,MAAA,EAAW,OAAO,EAAE,OAAO,QAAA,EAAS;AACxD,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,SAAA,GAAY,CAAA,CAAE,UAAA;AACpC,EAAA,OAAO,WAAA,IAAe,CAAA,GAAI,EAAE,KAAA,EAAO,SAAA,EAAW,WAAA,EAAa,CAAA,EAAE,GAAI,EAAE,KAAA,EAAO,QAAA,EAAU,WAAA,EAAY;AAClG;AAGA,IAAM,YAAA,GAAe,qBAAA;AACrB,IAAM,aAAa,CAAC,OAAA,KAA4B,CAAA,aAAA,EAAgB,OAAA,CAAQ,aAAa,CAAA,CAAA;AAOrF,SAAS,WAAW,OAAA,EAAwD;AAC1E,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,MAAO,UAAA,CAAiB,YAAA,EAAc,OAAA,CAAQ,UAAA,CAAW,OAAO,CAAC,CAAA;AACvE,IAAA,OAAO,GAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,GAAsB,KAAA,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,CAAY,SAAiB,KAAA,EAAmC;AACvE,EAAA,IAAI;AACF,IAAA,IAAI,KAAA,EAAQ,UAAA,CAAiB,YAAA,EAAc,OAAA,CAAQ,UAAA,CAAW,OAAO,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,SACvF,UAAA,CAAiB,YAAA,EAAc,UAAA,CAAW,UAAA,CAAW,OAAO,CAAC,CAAA;AAAA,EACrE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAC,UAAA,CAAiB,aAAA,GAAgB,IAAI,KAAA,CAAM,YAAY,CAAC,CAAA;AAC3D;AAEA,SAAS,aAAa,CAAA,EAAuE;AAC3F,EAAA,MAAM,EAAE,IAAA,EAAK,GAAIC,kBAAA,EAAS;AAC1B,EAAA,MAAM,gBAAgBC,kCAAA,EAAiB;AACvC,EAAA,MAAM,SAAS,CAAA,CAAE,SAAA;AACjB,EAAA,MAAM,SAAA,GAAYC,iBAAA;AAAA,IAChB,CAAC,GAAA,EAAK,IAAA,KAAU,MAAA,GAAS,MAAA,CAAO,KAAK,IAAI,CAAA,GAAI,aAAA,CAAc,GAAA,EAAK,IAAI,CAAA;AAAA,IACpE,CAAC,QAAQ,aAAa;AAAA,GACxB;AACA,EAAA,OAAO,EAAE,SAAA,EAAW,OAAA,EAAS,EAAE,OAAA,IAAW,IAAA,EAAM,QAAQ,OAAA,EAAQ;AAClE;AAaO,SAAS,eAAA,CAAgB,CAAA,GAA8C,EAAC,EAI7E;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,OAAA,EAAQ,GAAI,aAAa,CAAC,CAAA;AAC7C,EAAA,MAAM,EAAE,UAAA,EAAW,GAAIC,oBAAA,EAAW;AAClC,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAIC,eAA6B,MAAM,CAAA;AAC/D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,cAAA,EAAgC;AAC1D,EAAA,MAAM,QAAA,GAAW,EAAE,aAAA,IAAiB,oBAAA;AAEpC,EAAA,MAAM,KAAA,GAAQF,kBAAY,YAAY;AACpC,IAAA,QAAA,CAAS,MAAS,CAAA;AAClB,IAAA,IAAI;AACF,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAIJ,+BAAA,CAAc,0BAA0B,iCAAiC,CAAA;AACjG,MAAA,SAAA,CAAU,iBAAiB,CAAA;AAC3B,MAAA,MAAM,MAAM,MAAM,SAAA,CAAU,UAAU,EAAE,MAAA,EAAQ,QAAQ,CAAA;AACxD,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,MAAM,kBAAkB,GAAG,CAAA;AAC9C,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAG7B,MAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,QAAA,SAAA,CAAU,kBAAkB,CAAA;AAC5B,QAAA,IAAI;AACF,UAAA,MAAM,WAAW,EAAE,OAAA,EAAS,OAAA,EAAS,CAAC,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,SAAA,EAAW,CAAC,IAAA,CAAK,QAAQ,CAAA,EAAG,GAAG,CAAA;AAAA,QAClG,SAAS,MAAA,EAAQ;AACf,UAAA,MAAM,GAAA,GAAM,MAAA,YAAkB,KAAA,GAAQ,MAAA,CAAO,OAAA,GAAU,EAAA;AACvD,UAAA,IAAI,CAAC,mBAAA,CAAoB,IAAA,CAAK,GAAG,GAAG,MAAM,MAAA;AAAA,QAC5C;AACA,QAAA,WAAA,CAAY,OAAA,EAAS,EAAE,SAAA,EAAW,IAAA,CAAK,WAAW,QAAA,EAAU,IAAA,CAAK,UAAU,CAAA;AAAA,MAC7E,CAAA,MAAO;AACL,QAAC,UAAA,CAAiB,aAAA,GAAgB,IAAI,KAAA,CAAM,YAAY,CAAC,CAAA;AAAA,MAC3D;AACA,MAAA,SAAA,CAAU,SAAS,CAAA;AAAA,IACrB,SAAS,CAAA,EAAG;AACV,MAAA,QAAA,CAASO,8BAAY,CAAA,EAAG,EAAE,EAAA,EAAI,eAAA,EAAiB,CAAC,CAAA;AAChD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,UAAU,CAAC,CAAA;AAE7C,EAAA,OAAO,EAAE,OAAO,MAAA,EAAQ,GAAI,QAAQ,EAAE,KAAA,EAAM,GAAI,EAAC,EAAG;AACtD;AAUO,SAAS,gBAAA,CAAiB,CAAA,GAAgE,EAAC,EAUhG;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,OAAA,EAAQ,GAAI,aAAa,CAAC,CAAA;AAC7C,EAAA,MAAM,QAAA,GAAW,EAAE,cAAA,IAAkB,qBAAA;AACrC,EAAA,MAAM,CAAC,SAAA,EAAW,YAAY,CAAA,GAAID,eAAS,KAAK,CAAA;AAChD,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIA,eAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,eAAA,EAAiB,kBAAkB,CAAA,GAAIA,cAAA,EAA6B;AAC3E,EAAA,MAAM,CAAC,GAAA,EAAK,MAAM,CAAA,GAAIA,cAAA,CAAS,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAC,CAAA;AAClE,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAAS,CAAC,CAAA;AAClC,EAAA,MAAM,OAAA,GAAUF,iBAAA,CAAY,MAAM,OAAA,CAAQ,CAAC,MAAM,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAE3D,EAAAI,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,KAAA,CAAM,YAAY;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,QAAQ,CAAA;AACpC,QAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACb,QAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,QAAA,IAAI,SAAA,EAAW;AACf,QAAA,YAAA,CAAa,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAC,CAAA;AACpC,QAAA,kBAAA,CAAmB,KAAK,SAAS,CAAA;AAAA,MACnC,CAAA,CAAA,MAAQ;AAAA,MAER,CAAA,SAAE;AACA,QAAA,IAAI,CAAC,SAAA,EAAW,UAAA,CAAW,KAAK,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,GAAG;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,SAAA,EAAW,QAAA,EAAU,IAAI,CAAC,CAAA;AAE9B,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,MAAM,WAAW,MAAY,OAAA,CAAQ,CAAC,CAAA,KAAM,IAAI,CAAC,CAAA;AACjD,IAAC,UAAA,CAAiB,gBAAA,GAAmB,YAAA,EAAc,QAAQ,CAAA;AAC3D,IAAA,OAAO,MAAO,UAAA,CAAiB,mBAAA,GAAsB,YAAA,EAAc,QAAQ,CAAA;AAAA,EAC7E,CAAA,EAAG,EAAE,CAAA;AAEL,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,MAAM,EAAA,GAAK,WAAA,CAAY,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAC,CAAA,EAAG,GAAI,CAAA;AACxE,IAAA,OAAO,MAAM,cAAc,EAAE,CAAA;AAAA,EAC/B,CAAA,EAAG,EAAE,CAAA;AAEL,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,EAAE,MAAA,EAAQ;AACf,IAAA,MAAM,EAAA,GAAK,WAAA,CAAY,MAAM,OAAA,CAAQ,CAAC,MAAM,CAAA,GAAI,CAAC,CAAA,EAAG,CAAA,CAAE,MAAM,CAAA;AAC5D,IAAA,OAAO,MAAM,cAAc,EAAE,CAAA;AAAA,EAC/B,CAAA,EAAG,CAAC,CAAA,CAAE,MAAM,CAAC,CAAA;AAEb,EAAA,MAAM,SAAA,GAAY,eAAA,IAAmB,UAAA,CAAW,OAAO,CAAA,EAAG,SAAA;AAC1D,EAAA,MAAM,UAAU,kBAAA,CAAmB,EAAE,WAAW,SAAA,EAAW,UAAA,EAAY,KAAK,CAAA;AAC5E,EAAA,OAAO;AAAA,IACL,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,OAAA;AAAA,IACA,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc,EAAC;AAAA,IAC/C,GAAI,QAAQ,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAY,GAAI,EAAC;AAAA,IAChF;AAAA,GACF;AACF;AAWO,SAAS,gBAAA,CAAiB,CAAA,GAA+C,EAAC,EAI/E;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,OAAA,EAAQ,GAAI,aAAa,CAAC,CAAA;AAC7C,EAAA,MAAM,EAAE,aAAA,EAAc,GAAIH,oBAAA,EAAW;AACrC,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAIC,eAA8B,MAAM,CAAA;AAChE,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,cAAA,EAAgC;AAC1D,EAAA,MAAM,QAAA,GAAW,EAAE,cAAA,IAAkB,qBAAA;AAErC,EAAA,MAAM,MAAA,GAASF,kBAAY,YAAY;AACrC,IAAA,QAAA,CAAS,MAAS,CAAA;AAClB,IAAA,IAAI;AACF,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAIJ,+BAAA,CAAc,0BAA0B,iCAAiC,CAAA;AACjG,MAAA,SAAA,CAAU,UAAU,CAAA;AACpB,MAAA,MAAM,MAAA,GAAS,WAAW,OAAO,CAAA;AACjC,MAAA,MAAM,aAAA,CAAc,EAAE,OAAA,EAAS,CAAA;AAC/B,MAAA,IAAI;AACF,QAAA,MAAM,UAAU,QAAA,EAAU;AAAA,UACxB,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,UAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,MAAA,EAAQ,UAAU;AAAA,SACpD,CAAA;AAAA,MACH,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,WAAA,CAAY,SAAS,IAAI,CAAA;AACzB,MAAA,SAAA,CAAU,SAAS,CAAA;AAAA,IACrB,SAAS,CAAA,EAAG;AACV,MAAA,QAAA,CAASO,8BAAY,CAAA,EAAG,EAAE,EAAA,EAAI,gBAAA,EAAkB,CAAC,CAAA;AACjD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,aAAa,CAAC,CAAA;AAEhD,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,GAAI,QAAQ,EAAE,KAAA,EAAM,GAAI,EAAC,EAAG;AACvD;AAcO,SAAS,cAAoB,CAAA,EAIlC;AACA,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,YAAA,CAAa,CAAC,CAAA;AACpC,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAID,eAA2B,MAAM,CAAA;AAC7D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,cAAA,EAAgC;AAE1D,EAAA,MAAM,GAAA,GAAMF,iBAAA;AAAA,IACV,OAAO,KAAA,KAAyB;AAC9B,MAAA,SAAA,CAAU,SAAS,CAAA;AACnB,MAAA,QAAA,CAAS,MAAS,CAAA;AAClB,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,CAAA,CAAE,QAAA,EAAU;AAAA,UACtC,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,UAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAA,IAAS,EAAE;AAAA,SACjC,CAAA;AACD,QAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,MAAM,kBAAkB,GAAG,CAAA;AAC9C,QAAA,MAAM,GAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,QAAA,SAAA,CAAU,SAAS,CAAA;AACnB,QAAA,OAAO,GAAA;AAAA,MACT,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,MAAMG,6BAAA,CAAY,CAAA,EAAG,EAAE,EAAA,EAAI,kBAAkB,CAAA;AACnD,QAAA,QAAA,CAAS,GAAG,CAAA;AACZ,QAAA,SAAA,CAAU,OAAO,CAAA;AACjB,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IACA,CAAC,SAAA,EAAW,CAAA,CAAE,QAAQ;AAAA,GACxB;AAEA,EAAA,OAAO,EAAE,KAAK,MAAA,EAAQ,GAAI,QAAQ,EAAE,KAAA,EAAM,GAAI,EAAC,EAAG;AACpD","file":"chunk-R5PXQNO3.cjs","sourcesContent":["import { usePrivy, useSigners } from \"@privy-io/react-auth\";\nimport { useCallback, useEffect, useState } from \"react\";\nimport { PEPU_ERROR_CATALOG, PepuAuthError, PepuError, PepuSessionError, toPepuError } from \"../errors.js\";\nimport type { PepuErrorCode } from \"../errors.js\";\nimport { usePepuAuthFetch } from \"../privy/react.js\";\n\n/**\n * Client hooks for the Privy-mode session. Ported from\n * templates/game-app/components/session-consent-screen.tsx and\n * session-status-card.tsx. Auth defaults to `usePepuAuthFetch` from\n * `@pepu-chain/sdk/privy/react` (Privy bearer token); pass `authFetch` to use\n * your own.\n */\n\n/** A fetch that adds the user's Privy bearer token. */\nexport type AuthFetch = (url: string, init?: RequestInit) => Promise<Response>;\n\ninterface BaseOptions {\n  /** Custom authenticated fetch. Default: `usePepuAuthFetch()` (Privy bearer token). */\n  authFetch?: AuthFetch;\n  /** The embedded wallet address. Default: the Privy user's wallet. */\n  address?: string;\n}\n\nconst KNOWN_CODES = new Set<string>(PEPU_ERROR_CATALOG.map((e) => e.code));\n\n/**\n * Turn a non-OK route response into a typed error. Reads the\n * `{ error: { code, message, hint } }` body the SDK route factories return.\n * Only a 409 means \"no session\" (`SESSION_NONE`).\n *\n * @example\n * if (!res.ok) throw await errorFromResponse(res);\n */\nexport async function errorFromResponse(res: Response): Promise<PepuError> {\n  const body = (await res.json().catch(() => null)) as {\n    error?: { code?: string; message?: string; hint?: string } | string;\n  } | null;\n  const e = body?.error;\n  const message = typeof e === \"string\" ? e : e?.message;\n  const rawCode = typeof e === \"object\" ? e?.code : undefined;\n  const code: PepuErrorCode =\n    res.status === 409 && !rawCode\n      ? \"SESSION_NONE\"\n      : rawCode && KNOWN_CODES.has(rawCode)\n        ? (rawCode as PepuErrorCode)\n        : res.status === 401\n          ? \"AUTH_INVALID_TOKEN\"\n          : \"UNKNOWN\";\n  const Cls = code === \"SESSION_NONE\" ? PepuSessionError : code === \"AUTH_INVALID_TOKEN\" ? PepuAuthError : PepuError;\n  return new Cls(code, message ?? `Request failed (${res.status}).`, {\n    status: res.status,\n    ...(typeof e === \"object\" && e?.hint ? { hint: e.hint } : {}),\n  });\n}\n\n/** Session state from the server's `delegated` flag and the locally tracked expiry. */\nexport type SessionState = \"none\" | \"active\" | \"expired\";\n\n/**\n * Derive the session state. A delegated signer with a known expiry in the\n * past is `expired` (Privy denies it, but the signer still exists until\n * revoked). Pure.\n *\n * @example\n * deriveSessionState({ delegated: true, expiresAt: 100, nowSeconds: 200 }); // { state: \"expired\", secondsLeft: 0 }\n */\nexport function deriveSessionState(p: {\n  delegated: boolean;\n  expiresAt?: number | undefined;\n  nowSeconds: number;\n}): { state: SessionState; secondsLeft?: number } {\n  if (!p.delegated) return { state: \"none\" };\n  if (p.expiresAt === undefined) return { state: \"active\" };\n  const secondsLeft = p.expiresAt - p.nowSeconds;\n  return secondsLeft <= 0 ? { state: \"expired\", secondsLeft: 0 } : { state: \"active\", secondsLeft };\n}\n\ntype G = { localStorage?: Storage; dispatchEvent?: (e: Event) => boolean; addEventListener?: (t: string, l: () => void) => void; removeEventListener?: (t: string, l: () => void) => void };\nconst CHANGE_EVENT = \"pepu-session-change\";\nconst storageKey = (address: string): string => `pepu:session:${address.toLowerCase()}`;\n\ninterface StoredSession {\n  expiresAt: number;\n  policyId?: string;\n}\n\nfunction readStored(address: string | undefined): StoredSession | undefined {\n  if (!address) return undefined;\n  try {\n    const raw = (globalThis as G).localStorage?.getItem(storageKey(address));\n    return raw ? (JSON.parse(raw) as StoredSession) : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction writeStored(address: string, value: StoredSession | null): void {\n  try {\n    if (value) (globalThis as G).localStorage?.setItem(storageKey(address), JSON.stringify(value));\n    else (globalThis as G).localStorage?.removeItem(storageKey(address));\n  } catch {\n    // Storage can be blocked; the session still works without a countdown.\n  }\n  (globalThis as G).dispatchEvent?.(new Event(CHANGE_EVENT));\n}\n\nfunction useAuthFetch(o: BaseOptions): { authFetch: AuthFetch; address: string | undefined } {\n  const { user } = usePrivy();\n  const pepuAuthFetch = usePepuAuthFetch();\n  const custom = o.authFetch;\n  const authFetch = useCallback<AuthFetch>(\n    (url, init) => (custom ? custom(url, init) : pepuAuthFetch(url, init)),\n    [custom, pepuAuthFetch],\n  );\n  return { authFetch, address: o.address ?? user?.wallet?.address };\n}\n\nexport type SessionGrantStatus = \"idle\" | \"creating-policy\" | \"awaiting-consent\" | \"granted\" | \"error\";\n\n/**\n * Grant a session: POST the grant route, then ask the user to approve with\n * Privy's `addSigners`. Skips `addSigners` when the server says\n * `alreadyGranted`, and swallows Privy's \"duplicate signer\" error.\n *\n * @example\n * const { grant, status, error } = useSessionGrant();\n * <button onClick={grant} disabled={status === \"creating-policy\"}>Grant</button>\n */\nexport function useSessionGrant(o: BaseOptions & { grantEndpoint?: string } = {}): {\n  grant(): Promise<void>;\n  status: SessionGrantStatus;\n  error?: PepuError;\n} {\n  const { authFetch, address } = useAuthFetch(o);\n  const { addSigners } = useSigners();\n  const [status, setStatus] = useState<SessionGrantStatus>(\"idle\");\n  const [error, setError] = useState<PepuError | undefined>();\n  const endpoint = o.grantEndpoint ?? \"/api/session/grant\";\n\n  const grant = useCallback(async () => {\n    setError(undefined);\n    try {\n      if (!address) throw new PepuAuthError(\"WALLET_NOT_PROVISIONED\", \"No embedded wallet address yet.\");\n      setStatus(\"creating-policy\");\n      const res = await authFetch(endpoint, { method: \"POST\" });\n      if (!res.ok) throw await errorFromResponse(res);\n      const body = (await res.json()) as\n        | { alreadyGranted: true }\n        | { alreadyGranted: false; policyId: string; expiresAt: number; signerId: string };\n      if (!body.alreadyGranted) {\n        setStatus(\"awaiting-consent\");\n        try {\n          await addSigners({ address, signers: [{ signerId: body.signerId, policyIds: [body.policyId] }] });\n        } catch (caught) {\n          const msg = caught instanceof Error ? caught.message : \"\";\n          if (!/duplicate signer/i.test(msg)) throw caught;\n        }\n        writeStored(address, { expiresAt: body.expiresAt, policyId: body.policyId });\n      } else {\n        (globalThis as G).dispatchEvent?.(new Event(CHANGE_EVENT));\n      }\n      setStatus(\"granted\");\n    } catch (e) {\n      setError(toPepuError(e, { op: \"session grant\" }));\n      setStatus(\"error\");\n    }\n  }, [address, authFetch, endpoint, addSigners]);\n\n  return { grant, status, ...(error ? { error } : {}) };\n}\n\n/**\n * Current session state. Asks the status route whether a signer is attached\n * and combines it with the expiry tracked from the grant. Ticks every second\n * for `secondsLeft`; re-polls every `pollMs` if given.\n *\n * @example\n * const { state, secondsLeft } = useSessionStatus({ pollMs: 30_000 });\n */\nexport function useSessionStatus(o: BaseOptions & { statusEndpoint?: string; pollMs?: number } = {}): {\n  state: SessionState;\n  /**\n   * True until the first status response (or failure) has been applied. Show a\n   * spinner while it is true so the \"start a session\" UI does not flash on reload.\n   */\n  loading: boolean;\n  expiresAt?: number;\n  secondsLeft?: number;\n  refetch(): void;\n} {\n  const { authFetch, address } = useAuthFetch(o);\n  const endpoint = o.statusEndpoint ?? \"/api/session/status\";\n  const [delegated, setDelegated] = useState(false);\n  const [loading, setLoading] = useState(true);\n  const [serverExpiresAt, setServerExpiresAt] = useState<number | undefined>();\n  const [now, setNow] = useState(() => Math.floor(Date.now() / 1000));\n  const [tick, setTick] = useState(0);\n  const refetch = useCallback(() => setTick((t) => t + 1), []);\n\n  useEffect(() => {\n    let cancelled = false;\n    void (async () => {\n      try {\n        const res = await authFetch(endpoint);\n        if (!res.ok) return;\n        const body = (await res.json()) as { delegated?: boolean; expiresAt?: number };\n        if (cancelled) return;\n        setDelegated(Boolean(body.delegated));\n        setServerExpiresAt(body.expiresAt);\n      } catch {\n        // Keep the last known state on a transient failure.\n      } finally {\n        if (!cancelled) setLoading(false);\n      }\n    })();\n    return () => {\n      cancelled = true;\n    };\n  }, [authFetch, endpoint, tick]);\n\n  useEffect(() => {\n    const onChange = (): void => setTick((t) => t + 1);\n    (globalThis as G).addEventListener?.(CHANGE_EVENT, onChange);\n    return () => (globalThis as G).removeEventListener?.(CHANGE_EVENT, onChange);\n  }, []);\n\n  useEffect(() => {\n    const id = setInterval(() => setNow(Math.floor(Date.now() / 1000)), 1000);\n    return () => clearInterval(id);\n  }, []);\n\n  useEffect(() => {\n    if (!o.pollMs) return;\n    const id = setInterval(() => setTick((t) => t + 1), o.pollMs);\n    return () => clearInterval(id);\n  }, [o.pollMs]);\n\n  const expiresAt = serverExpiresAt ?? readStored(address)?.expiresAt;\n  const derived = deriveSessionState({ delegated, expiresAt, nowSeconds: now });\n  return {\n    state: derived.state,\n    loading,\n    ...(expiresAt !== undefined ? { expiresAt } : {}),\n    ...(derived.secondsLeft !== undefined ? { secondsLeft: derived.secondsLeft } : {}),\n    refetch,\n  };\n}\n\nexport type SessionRevokeStatus = \"idle\" | \"revoking\" | \"revoked\" | \"error\";\n\n/**\n * Revoke the session. The Privy `removeSigners` call is the real revoke; the\n * server revoke route afterwards is best-effort cleanup of the policy.\n *\n * @example\n * const { revoke, status } = useSessionRevoke();\n */\nexport function useSessionRevoke(o: BaseOptions & { revokeEndpoint?: string } = {}): {\n  revoke(): Promise<void>;\n  status: SessionRevokeStatus;\n  error?: PepuError;\n} {\n  const { authFetch, address } = useAuthFetch(o);\n  const { removeSigners } = useSigners();\n  const [status, setStatus] = useState<SessionRevokeStatus>(\"idle\");\n  const [error, setError] = useState<PepuError | undefined>();\n  const endpoint = o.revokeEndpoint ?? \"/api/session/revoke\";\n\n  const revoke = useCallback(async () => {\n    setError(undefined);\n    try {\n      if (!address) throw new PepuAuthError(\"WALLET_NOT_PROVISIONED\", \"No embedded wallet address yet.\");\n      setStatus(\"revoking\");\n      const stored = readStored(address);\n      await removeSigners({ address });\n      try {\n        await authFetch(endpoint, {\n          method: \"POST\",\n          headers: { \"content-type\": \"application/json\" },\n          body: JSON.stringify({ policyId: stored?.policyId }),\n        });\n      } catch {\n        // Cleanup only; the signer is already gone.\n      }\n      writeStored(address, null);\n      setStatus(\"revoked\");\n    } catch (e) {\n      setError(toPepuError(e, { op: \"session revoke\" }));\n      setStatus(\"error\");\n    }\n  }, [address, authFetch, endpoint, removeSigners]);\n\n  return { revoke, status, ...(error ? { error } : {}) };\n}\n\nexport type SessionActStatus = \"idle\" | \"pending\" | \"success\" | \"error\";\n\n/**\n * Call a session action route (built with `createSessionActionRoute`). A 409\n * is the only \"no session\" signal and surfaces as `error.code ===\n * \"SESSION_NONE\"`; any other failure is a failed transaction, so do not send\n * the user back to the consent screen for it.\n *\n * @example\n * const { act } = useSessionAct<{}, { hash: string }>({ endpoint: \"/api/game/tap\" });\n * const { hash } = await act({});\n */\nexport function useSessionAct<I, O>(o: BaseOptions & { endpoint: string }): {\n  act(input: I): Promise<O>;\n  status: SessionActStatus;\n  error?: PepuError;\n} {\n  const { authFetch } = useAuthFetch(o);\n  const [status, setStatus] = useState<SessionActStatus>(\"idle\");\n  const [error, setError] = useState<PepuError | undefined>();\n\n  const act = useCallback(\n    async (input: I): Promise<O> => {\n      setStatus(\"pending\");\n      setError(undefined);\n      try {\n        const res = await authFetch(o.endpoint, {\n          method: \"POST\",\n          headers: { \"content-type\": \"application/json\" },\n          body: JSON.stringify(input ?? {}),\n        });\n        if (!res.ok) throw await errorFromResponse(res);\n        const out = (await res.json()) as O;\n        setStatus(\"success\");\n        return out;\n      } catch (e) {\n        const err = toPepuError(e, { op: \"session action\" });\n        setError(err);\n        setStatus(\"error\");\n        throw err;\n      }\n    },\n    [authFetch, o.endpoint],\n  );\n\n  return { act, status, ...(error ? { error } : {}) };\n}\n"]}