@pepu-chain/sdk 0.0.0-stage → 0.2.0

package/dist/privy/react.d.ts

@@ -0,0 +1,194 @@
+import { ReactNode, ComponentType, ReactElement } from 'react';
+import { ConnectedWallet } from '@privy-io/react-auth';
+import { Address } from 'viem';
+import { P as PepuError } from '../errors-CgX1vNj7.js';
+import { C as CreatePepuPrivyConfigOptions } from '../config-COjhIZTh.js';
+import '../chains-DK13zGIp.js';
+
+/**
+ * POST to the ensure-wallet route with the user's Privy access token and return
+ * the wallet address. Bounded by a timeout. Never leaks the token in errors.
+ *
+ * @example
+ * ```ts
+ * const { address } = await requestEnsureWallet({ getAccessToken, endpoint: "/api/wallet/ensure" });
+ * ```
+ */
+declare function requestEnsureWallet(o: {
+    getAccessToken: () => Promise<string | null>;
+    endpoint?: string;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<{
+    address: Address;
+    created: boolean;
+}>;
+
+interface PepuPrivyProviderProps {
+    /** Privy app id. When missing, `fallback` renders instead of throwing deep inside Privy. */
+    appId: string | undefined;
+    /** Overrides for {@link createPepuPrivyConfig}. */
+    config?: Partial<CreatePepuPrivyConfigOptions> | undefined;
+    /** Shown when `appId` is empty. Defaults to a short notice naming the env variable. */
+    fallback?: ReactNode;
+    /**
+     * Extra providers rendered inside PrivyProvider (used by `/privy/wagmi`).
+     * Build one with {@link composeProviders}.
+     */
+    wrapper?: ComponentType<{
+        children?: ReactNode;
+    }> | undefined;
+    children?: ReactNode;
+}
+/**
+ * Compose providers (outermost first) into one wrapper component, with optional
+ * leaf components rendered next to `children` in the innermost position. A
+ * building block for `/privy/wagmi`; it keeps `react` imports in this entry.
+ *
+ * @example
+ * ```ts
+ * const Wrapper = composeProviders([[QueryClientProvider, { client }]], [MyEffectOnlyComponent]);
+ * ```
+ */
+declare function composeProviders(layers: readonly (readonly [ComponentType<any>, Record<string, unknown>])[], // eslint-disable-line @typescript-eslint/no-explicit-any
+leaves?: readonly ComponentType<Record<string, never>>[]): ComponentType<{
+    children?: ReactNode;
+}>;
+/**
+ * `<PrivyProvider>` preconfigured for PEPU: mainnet only, Coinbase pinned to
+ * `eoaOnly`, wallet creation off (the server provisions it, see
+ * {@link WalletGate}). Renders `fallback` instead of crashing when `appId` is
+ * missing.
+ *
+ * Ported from templates/consumer-app/app/providers.tsx.
+ *
+ * @example
+ * ```tsx
+ * <PepuPrivyProvider appId={process.env.NEXT_PUBLIC_PRIVY_APP_ID} config={{ loginMethods: ["email", "google"] }}>
+ *   <App />
+ * </PepuPrivyProvider>
+ * ```
+ */
+declare function PepuPrivyProvider(props: PepuPrivyProviderProps): ReactElement;
+/**
+ * This user's Privy embedded wallet, separated from any external wallet Privy
+ * is tracking (an installed MetaMask or Phantom). Never re-implements the
+ * embedded filter: it calls Privy's `getEmbeddedConnectedWallet`.
+ *
+ * Ported from templates/consumer-app/lib/wallet.ts (`useWalletSnapshot`).
+ *
+ * @example
+ * ```tsx
+ * const { ready, address, external } = useEmbeddedWallet();
+ * ```
+ */
+declare function useEmbeddedWallet(): {
+    ready: boolean;
+    wallet: ConnectedWallet | null;
+    address?: Address;
+    external: ConnectedWallet[];
+};
+/**
+ * Pure decision behind the pin hooks: pin only when enabled, hydrated, an
+ * embedded wallet exists and the active account is not already it. The address
+ * comparison is what prevents a render loop.
+ *
+ * @example
+ * ```ts
+ * shouldPinEmbeddedWallet({ enabled: true, ready: true, embeddedAddress: "0xA", activeAddress: "0xB" }); // true
+ * ```
+ */
+declare function shouldPinEmbeddedWallet(o: {
+    enabled: boolean;
+    ready: boolean;
+    embeddedAddress: string | undefined;
+    activeAddress: string | undefined;
+}): boolean;
+/**
+ * Generic half of the active-wallet pin: re-asserts the embedded wallet whenever
+ * the active account drifts away from it. `useActiveWalletPin` in
+ * `/privy/wagmi` supplies wagmi's active address and `setActiveWallet`.
+ *
+ * Ported from templates/consumer-app/lib/wallet.ts (`useActiveWalletSync`).
+ * A user with no embedded wallet is left alone on purpose.
+ *
+ * @example
+ * ```ts
+ * usePinEmbeddedWallet({ enabled: true, activeAddress, setActiveWallet });
+ * ```
+ */
+declare function usePinEmbeddedWallet(o: {
+    enabled: boolean;
+    activeAddress: string | undefined;
+    setActiveWallet: (wallet: ConnectedWallet) => Promise<unknown> | void;
+}): void;
+type FetchInput = Parameters<typeof fetch>[0];
+type EnsureWalletStatus = "idle" | "checking" | "creating" | "ready" | "stalled" | "error";
+/**
+ * Provision this user's embedded wallet through the ensure-wallet route (see
+ * `createEnsureWalletRoute` in `/privy/server`), not Privy's client-side
+ * creation, which hangs for apps with the dashboard's creation setting off.
+ * Gates on the EMBEDDED wallet, never on "any connected wallet".
+ *
+ * Ported from templates/consumer-app/components/wallet-gate.tsx.
+ *
+ * @example
+ * ```tsx
+ * const { status, address, error, retry } = useEnsureWallet();
+ * ```
+ */
+declare function useEnsureWallet(o?: {
+    endpoint?: string;
+    requestTimeoutMs?: number;
+    appearTimeoutMs?: number;
+}): {
+    status: EnsureWalletStatus;
+    address?: Address;
+    error?: PepuError;
+    retry(): void;
+};
+/**
+ * Renders `children` once the user's embedded wallet exists, provisioning it
+ * first through the ensure-wallet route. Shows `loading`, an error (with
+ * retry) or a reload prompt when the wallet exists but has not synced yet.
+ * Each of the three states takes a render prop (`loading`, `error`, `stalled`)
+ * so an app can use the gate directly with its own markup and classes.
+ *
+ * Ported from templates/consumer-app/components/wallet-gate.tsx.
+ *
+ * @example
+ * ```tsx
+ * <WalletGate
+ *   loading={<Spinner />}
+ *   error={(e, retry) => <button onClick={retry}>{e.message}</button>}
+ *   stalled={(address, reload) => <button onClick={reload}>Reload ({address})</button>}
+ * >
+ *   <Dashboard />
+ * </WalletGate>
+ * ```
+ */
+declare function WalletGate(p: {
+    endpoint?: string;
+    loading?: ReactNode;
+    error?: (e: PepuError, retry: () => void) => ReactNode;
+    /**
+     * The server confirmed the wallet but this session has not seen it after a
+     * bounded wait (a client sync delay). `reload` reloads the page.
+     */
+    stalled?: (address: Address, reload: () => void) => ReactNode;
+    children: ReactNode;
+}): ReactElement;
+/**
+ * A `fetch` that attaches `Authorization: Bearer <Privy access token>`. Throws
+ * {@link PepuAuthError} when there is no token (signed out or expired).
+ *
+ * @example
+ * ```tsx
+ * const authFetch = usePepuAuthFetch();
+ * const res = await authFetch("/api/session/status");
+ * ```
+ */
+declare function usePepuAuthFetch(): (input: FetchInput, init?: RequestInit) => Promise<Response>;
+
+export { type EnsureWalletStatus, PepuPrivyProvider, type PepuPrivyProviderProps, WalletGate, composeProviders, requestEnsureWallet, shouldPinEmbeddedWallet, useEmbeddedWallet, useEnsureWallet, usePepuAuthFetch, usePinEmbeddedWallet };

package/dist/privy/react.js

@@ -0,0 +1,7 @@
+export { PepuPrivyProvider, WalletGate, composeProviders, requestEnsureWallet, shouldPinEmbeddedWallet, useEmbeddedWallet, useEnsureWallet, usePepuAuthFetch, usePinEmbeddedWallet } from '../chunk-EHBPIYY4.js';
+import '../chunk-JLZ4LZ4Z.js';
+import '../chunk-VTQIHMF3.js';
+import '../chunk-3XUGQODR.js';
+import '../chunk-6DSZ4Z2N.js';
+//# sourceMappingURL=react.js.map
+//# sourceMappingURL=react.js.map

package/dist/privy/react.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"react.js"}

package/dist/privy/server.cjs

@@ -0,0 +1,43 @@
+'use strict';
+
+var chunk45KSZH26_cjs = require('../chunk-45KSZH26.cjs');
+require('../chunk-SVWRRALU.cjs');
+require('../chunk-C2XW44FI.cjs');
+require('../chunk-YQL7NISX.cjs');
+
+
+
+Object.defineProperty(exports, "createEnsureWalletRoute", {
+  enumerable: true,
+  get: function () { return chunk45KSZH26_cjs.createEnsureWalletRoute; }
+});
+Object.defineProperty(exports, "createPrivyServer", {
+  enumerable: true,
+  get: function () { return chunk45KSZH26_cjs.createPrivyServer; }
+});
+Object.defineProperty(exports, "findDelegatedEthereumWallet", {
+  enumerable: true,
+  get: function () { return chunk45KSZH26_cjs.findDelegatedEthereumWallet; }
+});
+Object.defineProperty(exports, "findEmbeddedEthereumWallet", {
+  enumerable: true,
+  get: function () { return chunk45KSZH26_cjs.findEmbeddedEthereumWallet; }
+});
+Object.defineProperty(exports, "privyEnvVar", {
+  enumerable: true,
+  get: function () { return chunk45KSZH26_cjs.privyEnvVar; }
+});
+Object.defineProperty(exports, "readPrivyServerEnv", {
+  enumerable: true,
+  get: function () { return chunk45KSZH26_cjs.readPrivyServerEnv; }
+});
+Object.defineProperty(exports, "requireUser", {
+  enumerable: true,
+  get: function () { return chunk45KSZH26_cjs.requireUser; }
+});
+Object.defineProperty(exports, "verifyRequestUser", {
+  enumerable: true,
+  get: function () { return chunk45KSZH26_cjs.verifyRequestUser; }
+});
+//# sourceMappingURL=server.cjs.map
+//# sourceMappingURL=server.cjs.map

package/dist/privy/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"server.cjs"}

package/dist/privy/server.d.cts

@@ -0,0 +1,192 @@
+import { LinkedAccountEmbeddedWallet, LinkedAccount, PrivyClient } from '@privy-io/node';
+import { Address } from 'viem';
+import { a as PRIVY_ENV } from '../requirements-C-QiJkL9.cjs';
+
+/**
+ * `@pepu-chain/sdk/privy/server` (server). Privy server client, access-token
+ * verification and the ensure-wallet route factory. Never import it from
+ * client code: it calls `assertServerOnly()` at import.
+ *
+ * Optional peer: `@privy-io/node`.
+ */
+/** A Privy linked embedded-wallet account. */
+type LinkedWallet = LinkedAccountEmbeddedWallet;
+/** The part of a Privy user object these helpers read. */
+interface PrivyUser {
+    linked_accounts: readonly LinkedAccount[];
+}
+/** The authenticated caller, as returned by {@link requireUser}. */
+interface PepuUser {
+    /** The Privy user id, only ever taken from a verified access token. */
+    userId: string;
+    /** The user's embedded Ethereum wallet address, `null` if not provisioned yet. */
+    address: Address | null;
+    /** The Privy user object the address was read from. */
+    privyUser: PrivyUser;
+}
+/** Server-side Privy configuration read from the environment. */
+interface PrivyServerEnv {
+    appId: string;
+    appSecret: string;
+    /** Private half of the authorization key. Only sessions need it. */
+    authorizationKey?: string;
+    /** The key quorum id sessions grant. Only sessions need it. */
+    keyQuorumId?: string;
+}
+/**
+ * The single reader for the Privy variables ({@link PRIVY_ENV}, then its
+ * aliases). Trimmed; `undefined` when unset or blank. Session routes use it
+ * too, so every module agrees on names.
+ *
+ * @example
+ * ```ts
+ * const quorum = privyEnvVar("keyQuorumId");
+ * ```
+ */
+declare function privyEnvVar(name: keyof typeof PRIVY_ENV): string | undefined;
+/**
+ * Read the Privy server variables ({@link PRIVY_ENV}), explicit options winning.
+ * Throws a `PepuConfigError` that lists every missing variable by NAME only.
+ * `PRIVY_AUTHORIZATION_KEY` is optional here (ensure-wallet never needs it).
+ *
+ * @example
+ * ```ts
+ * const { appId, appSecret } = readPrivyServerEnv();
+ * ```
+ */
+declare function readPrivyServerEnv(o?: {
+    appId?: string;
+    appSecret?: string;
+    authorizationKey?: string;
+    keyQuorumId?: string;
+}): PrivyServerEnv;
+/**
+ * A cached `PrivyClient` (`@privy-io/node`) built from {@link PRIVY_ENV}. One
+ * instance per distinct credential set. The authorization key is not given to
+ * the client: Privy takes it per request (`authorization_context`), see
+ * {@link readPrivyServerEnv}.
+ *
+ * Ported from templates/consumer-app/lib/privy-server.ts.
+ *
+ * @example
+ * ```ts
+ * const privy = createPrivyServer();
+ * const user = await privy.users()._get(userId);
+ * ```
+ */
+declare function createPrivyServer(o?: {
+    appId?: string;
+    appSecret?: string;
+    authorizationKey?: string;
+    keyQuorumId?: string;
+}): PrivyClient;
+/**
+ * Verify the `Authorization: Bearer <token>` header against Privy and return the
+ * caller's Privy user id and claims. Throws `PepuAuthError` (`AUTH_INVALID_TOKEN`,
+ * HTTP 401) when the header is missing or the token does not verify. The reason
+ * Privy gave goes in `details.reason` (token redacted): a verification failure
+ * caused by a mismatched `PRIVY_APP_SECRET` looks exactly like an expired
+ * session, so check it first.
+ *
+ * Note `verifyAccessToken(token)` on `privy.utils().auth()` takes a bare string,
+ * not `{ access_token }` (that is the standalone function's signature).
+ *
+ * Ported from templates/consumer-app/lib/privy-auth.ts.
+ *
+ * @example
+ * ```ts
+ * const { userId } = await verifyRequestUser(request);
+ * ```
+ */
+declare function verifyRequestUser(request: Request, o?: {
+    privy?: PrivyClient;
+}): Promise<{
+    userId: string;
+    claims: unknown;
+}>;
+/**
+ * The user's Ethereum embedded wallet (delegated or not), or `null`. This is
+ * what makes ensure-wallet idempotent.
+ *
+ * Ported from templates/consumer-app/lib/privy-user.ts.
+ *
+ * @example
+ * ```ts
+ * const wallet = findEmbeddedEthereumWallet(user);
+ * ```
+ */
+declare function findEmbeddedEthereumWallet(user: PrivyUser): LinkedWallet | null;
+/**
+ * The user's Ethereum embedded wallet that has been delegated (granted a
+ * session signer), or `null`.
+ *
+ * Ported from templates/game-app/lib/privy-user.ts.
+ *
+ * @example
+ * ```ts
+ * const wallet = findDelegatedEthereumWallet(user);
+ * ```
+ */
+declare function findDelegatedEthereumWallet(user: PrivyUser): LinkedWallet | null;
+/**
+ * Authenticate a request for a route handler. On success returns the user id
+ * (from the verified token only) and the user's embedded wallet address. On
+ * failure returns a ready JSON `Response` (`{ error: { code, message, hint } }`:
+ * 401 for a bad token, 500 for missing config, 502 if Privy cannot be reached).
+ * Never throws.
+ *
+ * @example
+ * ```ts
+ * export async function POST(request: Request) {
+ *   const auth = await requireUser(request);
+ *   if (!auth.ok) return auth.response;
+ *   return Response.json({ userId: auth.user.userId });
+ * }
+ * ```
+ */
+declare function requireUser(request: Request, o?: {
+    privy?: PrivyClient;
+}): Promise<{
+    ok: true;
+    user: PepuUser;
+} | {
+    ok: false;
+    response: Response;
+}>;
+/**
+ * Next.js route handler that creates the signed-in user's Ethereum embedded
+ * wallet server-side if they have none. Drop-in:
+ * `export const { POST } = createEnsureWalletRoute();` in
+ * `app/api/wallet/ensure/route.ts`.
+ *
+ * Why: Privy's own client-side creation hangs forever for apps whose dashboard
+ * creation setting is off; pair it with `createOnLogin: "off"` (the default of
+ * `createPepuPrivyConfig`) and `WalletGate`.
+ *
+ * - CUSTODY: the wallet is created with `owner: { user_id }`. This backend holds
+ *   no signing authority over it. Do not add a session signer here.
+ * - SECURITY: the user id comes only from the verified access token, never from
+ *   the body or query string.
+ * - IDEMPOTENT: it looks for an existing wallet first and re-checks after a
+ *   failed create, so a double submit never makes a second wallet.
+ *
+ * Ported from templates/consumer-app/app/api/wallet/ensure/route.ts.
+ *
+ * @example
+ * ```ts
+ * // app/api/wallet/ensure/route.ts
+ * import { createEnsureWalletRoute } from "@pepu-chain/sdk/privy/server";
+ * export const { POST } = createEnsureWalletRoute();
+ * ```
+ */
+declare function createEnsureWalletRoute(o?: {
+    privy?: PrivyClient;
+    onCreated?: (c: {
+        userId: string;
+        address: Address;
+    }) => Promise<void>;
+}): {
+    POST(request: Request): Promise<Response>;
+};
+
+export { type LinkedWallet, type PepuUser, type PrivyServerEnv, type PrivyUser, createEnsureWalletRoute, createPrivyServer, findDelegatedEthereumWallet, findEmbeddedEthereumWallet, privyEnvVar, readPrivyServerEnv, requireUser, verifyRequestUser };

package/dist/privy/server.d.ts

@@ -0,0 +1,192 @@
+import { LinkedAccountEmbeddedWallet, LinkedAccount, PrivyClient } from '@privy-io/node';
+import { Address } from 'viem';
+import { a as PRIVY_ENV } from '../requirements-C-QiJkL9.js';
+
+/**
+ * `@pepu-chain/sdk/privy/server` (server). Privy server client, access-token
+ * verification and the ensure-wallet route factory. Never import it from
+ * client code: it calls `assertServerOnly()` at import.
+ *
+ * Optional peer: `@privy-io/node`.
+ */
+/** A Privy linked embedded-wallet account. */
+type LinkedWallet = LinkedAccountEmbeddedWallet;
+/** The part of a Privy user object these helpers read. */
+interface PrivyUser {
+    linked_accounts: readonly LinkedAccount[];
+}
+/** The authenticated caller, as returned by {@link requireUser}. */
+interface PepuUser {
+    /** The Privy user id, only ever taken from a verified access token. */
+    userId: string;
+    /** The user's embedded Ethereum wallet address, `null` if not provisioned yet. */
+    address: Address | null;
+    /** The Privy user object the address was read from. */
+    privyUser: PrivyUser;
+}
+/** Server-side Privy configuration read from the environment. */
+interface PrivyServerEnv {
+    appId: string;
+    appSecret: string;
+    /** Private half of the authorization key. Only sessions need it. */
+    authorizationKey?: string;
+    /** The key quorum id sessions grant. Only sessions need it. */
+    keyQuorumId?: string;
+}
+/**
+ * The single reader for the Privy variables ({@link PRIVY_ENV}, then its
+ * aliases). Trimmed; `undefined` when unset or blank. Session routes use it
+ * too, so every module agrees on names.
+ *
+ * @example
+ * ```ts
+ * const quorum = privyEnvVar("keyQuorumId");
+ * ```
+ */
+declare function privyEnvVar(name: keyof typeof PRIVY_ENV): string | undefined;
+/**
+ * Read the Privy server variables ({@link PRIVY_ENV}), explicit options winning.
+ * Throws a `PepuConfigError` that lists every missing variable by NAME only.
+ * `PRIVY_AUTHORIZATION_KEY` is optional here (ensure-wallet never needs it).
+ *
+ * @example
+ * ```ts
+ * const { appId, appSecret } = readPrivyServerEnv();
+ * ```
+ */
+declare function readPrivyServerEnv(o?: {
+    appId?: string;
+    appSecret?: string;
+    authorizationKey?: string;
+    keyQuorumId?: string;
+}): PrivyServerEnv;
+/**
+ * A cached `PrivyClient` (`@privy-io/node`) built from {@link PRIVY_ENV}. One
+ * instance per distinct credential set. The authorization key is not given to
+ * the client: Privy takes it per request (`authorization_context`), see
+ * {@link readPrivyServerEnv}.
+ *
+ * Ported from templates/consumer-app/lib/privy-server.ts.
+ *
+ * @example
+ * ```ts
+ * const privy = createPrivyServer();
+ * const user = await privy.users()._get(userId);
+ * ```
+ */
+declare function createPrivyServer(o?: {
+    appId?: string;
+    appSecret?: string;
+    authorizationKey?: string;
+    keyQuorumId?: string;
+}): PrivyClient;
+/**
+ * Verify the `Authorization: Bearer <token>` header against Privy and return the
+ * caller's Privy user id and claims. Throws `PepuAuthError` (`AUTH_INVALID_TOKEN`,
+ * HTTP 401) when the header is missing or the token does not verify. The reason
+ * Privy gave goes in `details.reason` (token redacted): a verification failure
+ * caused by a mismatched `PRIVY_APP_SECRET` looks exactly like an expired
+ * session, so check it first.
+ *
+ * Note `verifyAccessToken(token)` on `privy.utils().auth()` takes a bare string,
+ * not `{ access_token }` (that is the standalone function's signature).
+ *
+ * Ported from templates/consumer-app/lib/privy-auth.ts.
+ *
+ * @example
+ * ```ts
+ * const { userId } = await verifyRequestUser(request);
+ * ```
+ */
+declare function verifyRequestUser(request: Request, o?: {
+    privy?: PrivyClient;
+}): Promise<{
+    userId: string;
+    claims: unknown;
+}>;
+/**
+ * The user's Ethereum embedded wallet (delegated or not), or `null`. This is
+ * what makes ensure-wallet idempotent.
+ *
+ * Ported from templates/consumer-app/lib/privy-user.ts.
+ *
+ * @example
+ * ```ts
+ * const wallet = findEmbeddedEthereumWallet(user);
+ * ```
+ */
+declare function findEmbeddedEthereumWallet(user: PrivyUser): LinkedWallet | null;
+/**
+ * The user's Ethereum embedded wallet that has been delegated (granted a
+ * session signer), or `null`.
+ *
+ * Ported from templates/game-app/lib/privy-user.ts.
+ *
+ * @example
+ * ```ts
+ * const wallet = findDelegatedEthereumWallet(user);
+ * ```
+ */
+declare function findDelegatedEthereumWallet(user: PrivyUser): LinkedWallet | null;
+/**
+ * Authenticate a request for a route handler. On success returns the user id
+ * (from the verified token only) and the user's embedded wallet address. On
+ * failure returns a ready JSON `Response` (`{ error: { code, message, hint } }`:
+ * 401 for a bad token, 500 for missing config, 502 if Privy cannot be reached).
+ * Never throws.
+ *
+ * @example
+ * ```ts
+ * export async function POST(request: Request) {
+ *   const auth = await requireUser(request);
+ *   if (!auth.ok) return auth.response;
+ *   return Response.json({ userId: auth.user.userId });
+ * }
+ * ```
+ */
+declare function requireUser(request: Request, o?: {
+    privy?: PrivyClient;
+}): Promise<{
+    ok: true;
+    user: PepuUser;
+} | {
+    ok: false;
+    response: Response;
+}>;
+/**
+ * Next.js route handler that creates the signed-in user's Ethereum embedded
+ * wallet server-side if they have none. Drop-in:
+ * `export const { POST } = createEnsureWalletRoute();` in
+ * `app/api/wallet/ensure/route.ts`.
+ *
+ * Why: Privy's own client-side creation hangs forever for apps whose dashboard
+ * creation setting is off; pair it with `createOnLogin: "off"` (the default of
+ * `createPepuPrivyConfig`) and `WalletGate`.
+ *
+ * - CUSTODY: the wallet is created with `owner: { user_id }`. This backend holds
+ *   no signing authority over it. Do not add a session signer here.
+ * - SECURITY: the user id comes only from the verified access token, never from
+ *   the body or query string.
+ * - IDEMPOTENT: it looks for an existing wallet first and re-checks after a
+ *   failed create, so a double submit never makes a second wallet.
+ *
+ * Ported from templates/consumer-app/app/api/wallet/ensure/route.ts.
+ *
+ * @example
+ * ```ts
+ * // app/api/wallet/ensure/route.ts
+ * import { createEnsureWalletRoute } from "@pepu-chain/sdk/privy/server";
+ * export const { POST } = createEnsureWalletRoute();
+ * ```
+ */
+declare function createEnsureWalletRoute(o?: {
+    privy?: PrivyClient;
+    onCreated?: (c: {
+        userId: string;
+        address: Address;
+    }) => Promise<void>;
+}): {
+    POST(request: Request): Promise<Response>;
+};
+
+export { type LinkedWallet, type PepuUser, type PrivyServerEnv, type PrivyUser, createEnsureWalletRoute, createPrivyServer, findDelegatedEthereumWallet, findEmbeddedEthereumWallet, privyEnvVar, readPrivyServerEnv, requireUser, verifyRequestUser };

package/dist/privy/server.js

@@ -0,0 +1,6 @@
+export { createEnsureWalletRoute, createPrivyServer, findDelegatedEthereumWallet, findEmbeddedEthereumWallet, privyEnvVar, readPrivyServerEnv, requireUser, verifyRequestUser } from '../chunk-62M2LKQW.js';
+import '../chunk-W3JN3YIW.js';
+import '../chunk-3XUGQODR.js';
+import '../chunk-6DSZ4Z2N.js';
+//# sourceMappingURL=server.js.map
+//# sourceMappingURL=server.js.map

package/dist/privy/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"server.js"}