@pepu-chain/sdk 0.0.0-stage → 0.2.0

package/dist/session/server.cjs

@@ -0,0 +1,267 @@
+'use strict';
+
+var chunkC7IC36XS_cjs = require('../chunk-C7IC36XS.cjs');
+var chunk4GINFJO6_cjs = require('../chunk-4GINFJO6.cjs');
+var chunkVF3D6KLQ_cjs = require('../chunk-VF3D6KLQ.cjs');
+var chunkDPCZJLB3_cjs = require('../chunk-DPCZJLB3.cjs');
+var chunk45KSZH26_cjs = require('../chunk-45KSZH26.cjs');
+var chunkSVWRRALU_cjs = require('../chunk-SVWRRALU.cjs');
+var chunkC2XW44FI_cjs = require('../chunk-C2XW44FI.cjs');
+var chunkIG7RSL2Y_cjs = require('../chunk-IG7RSL2Y.cjs');
+var chunkYQL7NISX_cjs = require('../chunk-YQL7NISX.cjs');
+var viem = require('viem');
+
+chunkSVWRRALU_cjs.assertServerOnly("@pepu-chain/sdk/session/server");
+function isBlank(address) {
+  return address === void 0 || address === null || address.trim() === "";
+}
+function unconfiguredResponse(envName) {
+  return chunkYQL7NISX_cjs.toErrorResponse(
+    new chunkYQL7NISX_cjs.PepuConfigError(
+      "CONFIG_MISSING_ENV",
+      `${envName ?? "The session contract address"} is not set to a valid address. See .env.example.`,
+      { hint: envName ? `Set ${envName} and restart the server.` : "Set the contract address and restart the server." }
+    )
+  );
+}
+function missing(names) {
+  return new chunkYQL7NISX_cjs.PepuConfigError(
+    "CONFIG_MISSING_ENV",
+    `Missing required environment variable(s): ${names.join(", ")}.`
+  );
+}
+function resolvePrivy(o) {
+  return o.privy ?? chunk45KSZH26_cjs.createPrivyServer();
+}
+async function authenticate(request, privy, verifyUser) {
+  let result;
+  if (verifyUser) {
+    result = await verifyUser(request);
+  } else {
+    result = await chunk45KSZH26_cjs.verifyRequestUser(request, { privy });
+  }
+  const userId = typeof result === "string" ? result : result?.userId;
+  if (!userId) {
+    throw new chunkYQL7NISX_cjs.PepuAuthError("AUTH_INVALID_TOKEN", "Missing or invalid Privy access token.");
+  }
+  return userId;
+}
+async function findDelegated(privy, userId) {
+  const wallet = chunk45KSZH26_cjs.findDelegatedEthereumWallet(await privy.users()._get(userId));
+  return wallet ? { id: wallet.id ?? null, address: wallet.address } : null;
+}
+function validateScope(scope) {
+  chunkIG7RSL2Y_cjs.buildSessionPolicy({ ...scope, expiresAtUnixSeconds: 1 });
+}
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+}
+function upstream(e, op) {
+  const err = chunkYQL7NISX_cjs.toPepuError(e, { op });
+  if (err.code === "UNKNOWN" && !(e instanceof chunkYQL7NISX_cjs.PepuError)) {
+    return new chunkYQL7NISX_cjs.PepuChainError("UNKNOWN", err.message, { status: 502, cause: e });
+  }
+  if (err.status === 409 && !err.code.startsWith("SESSION_")) {
+    return new chunkYQL7NISX_cjs.PepuChainError(err.code, err.message, { status: 502, cause: e });
+  }
+  return err;
+}
+async function guard(op, fn) {
+  try {
+    return await fn();
+  } catch (e) {
+    return chunkYQL7NISX_cjs.toErrorResponse(upstream(e, op));
+  }
+}
+function createSessionRoutes(o) {
+  if (isBlank(o.scope.contractAddress)) {
+    const unset = async () => unconfiguredResponse(o.contractAddressEnv);
+    return { grant: { POST: unset }, status: { GET: unset }, revoke: { POST: unset } };
+  }
+  const scope = o.scope;
+  validateScope(scope);
+  const scopeContract = scope.contractAddress.toLowerCase();
+  return {
+    grant: {
+      POST: (req) => guard("session grant", async () => {
+        const signerId = o.keyQuorumId ?? chunk45KSZH26_cjs.privyEnvVar("keyQuorumId");
+        if (!signerId) throw missing([chunkC2XW44FI_cjs.PRIVY_ENV.keyQuorumId]);
+        const privy = resolvePrivy(o);
+        const userId = await authenticate(req, privy, o.verifyUser);
+        try {
+          if (await findDelegated(privy, userId)) return json({ alreadyGranted: true });
+        } catch {
+        }
+        const minutes = o.minutes ?? chunkIG7RSL2Y_cjs.resolveSessionMinutes(process.env.SESSION_DURATION_MINUTES);
+        const expiresAt = chunkIG7RSL2Y_cjs.sessionExpiry(Math.floor(Date.now() / 1e3), minutes);
+        const policy = await privy.policies().create(
+          chunkIG7RSL2Y_cjs.buildSessionPolicy({ ...scope, expiresAtUnixSeconds: expiresAt })
+        );
+        return json({
+          alreadyGranted: false,
+          policyId: policy.id,
+          expiresAt,
+          signerId,
+          durationMinutes: minutes
+        });
+      })
+    },
+    status: {
+      GET: (req) => guard("session status", async () => {
+        const privy = resolvePrivy(o);
+        const userId = await authenticate(req, privy, o.verifyUser);
+        const wallet = await findDelegated(privy, userId);
+        return json({ delegated: wallet !== null, active: wallet !== null, address: wallet?.address ?? null });
+      })
+    },
+    revoke: {
+      POST: (req) => guard("session revoke", async () => {
+        const privy = resolvePrivy(o);
+        const userId = await authenticate(req, privy, o.verifyUser);
+        const wallet = await findDelegated(privy, userId);
+        if (wallet) {
+          return json({ revoked: false, delegated: true, policyDeleted: false });
+        }
+        let policyDeleted = false;
+        const body = await req.json().catch(() => null);
+        const policyId = typeof body?.policyId === "string" ? body.policyId : void 0;
+        if (policyId) {
+          try {
+            const policy = await privy.policies().get(policyId);
+            const scoped = policy.rules.every(
+              (r) => r.conditions.some(
+                (c) => c.field_source === "ethereum_transaction" && c.field === "to" && typeof c.value === "string" && c.value.toLowerCase() === scopeContract
+              )
+            );
+            if (scoped && policy.rules.length > 0) {
+              await privy.policies()._delete(policyId);
+              policyDeleted = true;
+            }
+          } catch {
+          }
+        }
+        return json({ revoked: true, delegated: false, policyDeleted });
+      })
+    }
+  };
+}
+function defaultClient() {
+  const { rpcUrl } = chunkVF3D6KLQ_cjs.resolvePepuEndpoints();
+  return chunkC7IC36XS_cjs.getPublicClient(chunkDPCZJLB3_cjs.pepuMainnet, { transport: viem.http(rpcUrl) });
+}
+function privySessionSigner(o) {
+  let client = o.client;
+  const signTransaction = async (tx) => {
+    const key = o.authorizationKey ?? chunk45KSZH26_cjs.privyEnvVar("authorizationKey");
+    if (!key) throw missing([chunkC2XW44FI_cjs.PRIVY_ENV.authorizationKey]);
+    const signed = await o.privy.wallets().ethereum().signTransaction(o.walletId, {
+      params: { transaction: tx },
+      authorization_context: { authorization_private_keys: [key] }
+    });
+    return signed.signed_transaction;
+  };
+  return {
+    signTransaction,
+    signAndBroadcast: (p) => {
+      client ??= defaultClient();
+      return chunkIG7RSL2Y_cjs.signAndBroadcast({
+        ...p,
+        client,
+        from: o.address,
+        chainId: chunkDPCZJLB3_cjs.pepuMainnet.id,
+        sign: signTransaction
+      });
+    }
+  };
+}
+function createSessionActionRoute(o) {
+  if (isBlank(o.scope.contractAddress)) {
+    return { POST: async () => unconfiguredResponse(o.contractAddressEnv) };
+  }
+  const scope = o.scope;
+  validateScope(scope);
+  const contract = scope.contractAddress.toLowerCase();
+  const selectors = new Set(scope.functions.map((f) => viem.toFunctionSelector(f)));
+  const hits = /* @__PURE__ */ new Map();
+  const denied = (message) => new chunkYQL7NISX_cjs.PepuPolicyError("POLICY_UNSCOPED", message, { status: 403 });
+  return {
+    POST: (req) => guard("session action", async () => {
+      const privy = resolvePrivy(o);
+      const userId = await authenticate(req, privy, o.verifyUser);
+      if (o.rateLimit) {
+        const now = Date.now();
+        const recent = (hits.get(userId) ?? []).filter((t) => now - t < 6e4);
+        if (recent.length >= o.rateLimit.perMinute) {
+          throw new chunkYQL7NISX_cjs.PepuChainError("UNKNOWN", "Too many session actions; slow down.", {
+            status: 429,
+            retryable: true,
+            hint: "Wait a few seconds and retry."
+          });
+        }
+        recent.push(now);
+        hits.set(userId, recent);
+      }
+      const wallet = await findDelegated(privy, userId);
+      if (!wallet || !wallet.id) {
+        throw new chunkYQL7NISX_cjs.PepuSessionError(
+          "SESSION_NONE",
+          "No delegated session signer found for this account. Grant a session first."
+        );
+      }
+      let input;
+      try {
+        input = o.parse(await req.json().catch(() => ({})));
+      } catch (e) {
+        throw new chunkYQL7NISX_cjs.PepuPolicyError("UNKNOWN", e instanceof Error ? e.message : "Invalid request body.", {
+          status: 400,
+          hint: "Fix the request body.",
+          cause: e
+        });
+      }
+      const call = o.buildCall(input, { from: wallet.address });
+      if (!viem.isAddress(call.to, { strict: false }) || call.to.toLowerCase() !== contract) {
+        throw denied("The call targets a contract outside the session scope.");
+      }
+      if ((call.value ?? 0n) !== 0n) throw denied("A session call must carry zero value.");
+      const fn = call.functionName ? scope.functions.find((f) => f.name === call.functionName) : void 0;
+      const selector = call.data ? call.data.slice(0, 10).toLowerCase() : fn ? viem.toFunctionSelector(fn) : void 0;
+      if (!selector || !selectors.has(selector)) {
+        throw denied("The call uses a function outside the session scope.");
+      }
+      const signer = privySessionSigner({
+        privy,
+        walletId: wallet.id,
+        address: wallet.address,
+        ...o.authorizationKey !== void 0 ? { authorizationKey: o.authorizationKey } : {},
+        ...o.client !== void 0 ? { client: o.client } : {}
+      });
+      const hash = await signer.signAndBroadcast({
+        to: call.to,
+        ...call.data !== void 0 ? { data: call.data } : {},
+        ...call.abi !== void 0 ? { abi: call.abi } : {},
+        ...call.functionName !== void 0 ? { functionName: call.functionName } : {},
+        ...call.args !== void 0 ? { args: call.args } : {},
+        value: 0n
+      });
+      return json({ hash, address: wallet.address, explorerUrl: chunk4GINFJO6_cjs.txUrl(chunkDPCZJLB3_cjs.pepuMainnet, hash) });
+    })
+  };
+}
+
+Object.defineProperty(exports, "broadcastSignedTransaction", {
+  enumerable: true,
+  get: function () { return chunkIG7RSL2Y_cjs.broadcastSignedTransaction; }
+});
+Object.defineProperty(exports, "signAndBroadcast", {
+  enumerable: true,
+  get: function () { return chunkIG7RSL2Y_cjs.signAndBroadcast; }
+});
+Object.defineProperty(exports, "withGasLimitBuffer", {
+  enumerable: true,
+  get: function () { return chunkIG7RSL2Y_cjs.withGasLimitBuffer; }
+});
+exports.createSessionActionRoute = createSessionActionRoute;
+exports.createSessionRoutes = createSessionRoutes;
+exports.privySessionSigner = privySessionSigner;
+//# sourceMappingURL=server.cjs.map
+//# sourceMappingURL=server.cjs.map

package/dist/session/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/session/server.ts"],"names":["assertServerOnly","toErrorResponse","PepuConfigError","createPrivyServer","verifyRequestUser","PepuAuthError","findDelegatedEthereumWallet","buildSessionPolicy","toPepuError","PepuError","PepuChainError","privyEnvVar","PRIVY_ENV","resolveSessionMinutes","sessionExpiry","resolvePepuEndpoints","getPublicClient","pepuMainnet","http","signAndBroadcast","toFunctionSelector","PepuPolicyError","PepuSessionError","isAddress","txUrl"],"mappings":";;;;;;;;;;;;;AA6BAA,kCAAA,CAAiB,gCAAgC,CAAA;AAiCjD,SAAS,QAAQ,OAAA,EAA6C;AAC5D,EAAA,OAAO,YAAY,MAAA,IAAa,OAAA,KAAY,IAAA,IAAQ,OAAA,CAAQ,MAAK,KAAM,EAAA;AACzE;AAGA,SAAS,qBAAqB,OAAA,EAAuC;AACnE,EAAA,OAAOC,iCAAA;AAAA,IACL,IAAIC,iCAAA;AAAA,MACF,oBAAA;AAAA,MACA,CAAA,EAAG,WAAW,8BAA8B,CAAA,iDAAA,CAAA;AAAA,MAC5C,EAAE,IAAA,EAAM,OAAA,GAAU,CAAA,IAAA,EAAO,OAAO,6BAA6B,kDAAA;AAAmD;AAClH,GACF;AACF;AAoBA,SAAS,QAAQ,KAAA,EAA2C;AAC1D,EAAA,OAAO,IAAIA,iCAAA;AAAA,IACT,oBAAA;AAAA,IACA,CAAA,0CAAA,EAA6C,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,GAC/D;AACF;AAEA,SAAS,aAAa,CAAA,EAA+B;AAEnD,EAAA,OAAO,CAAA,CAAE,SAASC,mCAAA,EAAkB;AACtC;AAEA,eAAe,YAAA,CAAa,OAAA,EAAkB,KAAA,EAAoB,UAAA,EAA0C;AAC1G,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAA,GAAS,MAAM,WAAW,OAAO,CAAA;AAAA,EACnC,CAAA,MAAO;AAEL,IAAA,MAAA,GAAS,MAAMC,mCAAA,CAAkB,OAAA,EAAS,EAAE,OAAO,CAAA;AAAA,EACrD;AACA,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAW,QAAA,GAAW,SAAS,MAAA,EAAQ,MAAA;AAC7D,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAIC,+BAAA,CAAc,oBAAA,EAAsB,wCAAwC,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,MAAA;AACT;AAQA,eAAe,aAAA,CAAc,OAAoB,MAAA,EAAiD;AAChG,EAAA,MAAM,MAAA,GAASC,8CAA4B,MAAM,KAAA,CAAM,OAAM,CAAE,IAAA,CAAK,MAAM,CAAC,CAAA;AAC3E,EAAA,OAAO,MAAA,GAAS,EAAE,EAAA,EAAI,MAAA,CAAO,MAAM,IAAA,EAAM,OAAA,EAAS,MAAA,CAAO,OAAA,EAAmB,GAAI,IAAA;AAClF;AAEA,SAAS,cAAc,KAAA,EAAgC;AAErD,EAAAC,oCAAA,CAAmB,EAAE,GAAG,KAAA,EAAO,oBAAA,EAAsB,GAAG,CAAA;AAC1D;AAEA,SAAS,IAAA,CAAK,IAAA,EAAe,MAAA,GAAS,GAAA,EAAe;AACnD,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,MAAA,EAAQ,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,IAAsB,CAAA;AACvG;AAGA,SAAS,QAAA,CAAS,GAAY,EAAA,EAAuB;AACnD,EAAA,MAAM,GAAA,GAAMC,6BAAA,CAAY,CAAA,EAAG,EAAE,IAAI,CAAA;AACjC,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,SAAA,IAAa,EAAE,aAAaC,2BAAA,CAAA,EAAY;AACvD,IAAA,OAAO,IAAIC,gCAAA,CAAe,SAAA,EAAW,GAAA,CAAI,OAAA,EAAS,EAAE,MAAA,EAAQ,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,CAAA;AAAA,EAC7E;AAEA,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,IAAO,CAAC,IAAI,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,EAAG;AAC1D,IAAA,OAAO,IAAIA,gCAAA,CAAe,GAAA,CAAI,IAAA,EAAM,GAAA,CAAI,OAAA,EAAS,EAAE,MAAA,EAAQ,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,GAAA;AACT;AAEA,eAAe,KAAA,CAAM,IAAY,EAAA,EAAgD;AAC/E,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,EAAA,EAAG;AAAA,EAClB,SAAS,CAAA,EAAG;AACV,IAAA,OAAOT,iCAAA,CAAgB,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAA;AAAA,EACxC;AACF;AAmCO,SAAS,oBAAoB,CAAA,EAIlC;AACA,EAAA,IAAI,OAAA,CAAQ,CAAA,CAAE,KAAA,CAAM,eAAe,CAAA,EAAG;AACpC,IAAA,MAAM,KAAA,GAAQ,YAA+B,oBAAA,CAAqB,CAAA,CAAE,kBAAkB,CAAA;AACtF,IAAA,OAAO,EAAE,KAAA,EAAO,EAAE,IAAA,EAAM,OAAM,EAAG,MAAA,EAAQ,EAAE,GAAA,EAAK,OAAM,EAAG,MAAA,EAAQ,EAAE,IAAA,EAAM,OAAM,EAAE;AAAA,EACnF;AACA,EAAA,MAAM,QAAQ,CAAA,CAAE,KAAA;AAChB,EAAA,aAAA,CAAc,KAAK,CAAA;AACnB,EAAA,MAAM,aAAA,GAAgB,KAAA,CAAM,eAAA,CAAgB,WAAA,EAAY;AAExD,EAAA,OAAO;AAAA,IACL,KAAA,EAAO;AAAA,MACL,IAAA,EAAM,CAAC,GAAA,KACL,KAAA,CAAM,iBAAiB,YAAY;AACjC,QAAA,MAAM,QAAA,GAAW,CAAA,CAAE,WAAA,IAAeU,6BAAA,CAAY,aAAa,CAAA;AAC3D,QAAA,IAAI,CAAC,QAAA,EAAU,MAAM,QAAQ,CAACC,2BAAA,CAAU,WAAW,CAAC,CAAA;AACpD,QAAA,MAAM,KAAA,GAAQ,aAAa,CAAC,CAAA;AAC5B,QAAA,MAAM,SAAS,MAAM,YAAA,CAAa,GAAA,EAAK,KAAA,EAAO,EAAE,UAAU,CAAA;AAE1D,QAAA,IAAI;AACF,UAAA,IAAI,MAAM,aAAA,CAAc,KAAA,EAAO,MAAM,CAAA,SAAU,IAAA,CAAK,EAAE,cAAA,EAAgB,IAAA,EAAM,CAAA;AAAA,QAC9E,CAAA,CAAA,MAAQ;AAAA,QAER;AAEA,QAAA,MAAM,UAAU,CAAA,CAAE,OAAA,IAAWC,uCAAA,CAAsB,OAAA,CAAQ,IAAI,wBAAwB,CAAA;AACvF,QAAA,MAAM,SAAA,GAAYC,gCAAc,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,EAAG,OAAO,CAAA;AACtE,QAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,QAAA,EAAS,CAAE,MAAA;AAAA,UACpCP,qCAAmB,EAAE,GAAG,KAAA,EAAO,oBAAA,EAAsB,WAAW;AAAA,SAClE;AACA,QAAA,OAAO,IAAA,CAAK;AAAA,UACV,cAAA,EAAgB,KAAA;AAAA,UAChB,UAAU,MAAA,CAAO,EAAA;AAAA,UACjB,SAAA;AAAA,UACA,QAAA;AAAA,UACA,eAAA,EAAiB;AAAA,SAClB,CAAA;AAAA,MACH,CAAC;AAAA,KACL;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK,CAAC,GAAA,KACJ,KAAA,CAAM,kBAAkB,YAAY;AAClC,QAAA,MAAM,KAAA,GAAQ,aAAa,CAAC,CAAA;AAC5B,QAAA,MAAM,SAAS,MAAM,YAAA,CAAa,GAAA,EAAK,KAAA,EAAO,EAAE,UAAU,CAAA;AAC1D,QAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,KAAA,EAAO,MAAM,CAAA;AAChD,QAAA,OAAO,IAAA,CAAK,EAAE,SAAA,EAAW,MAAA,KAAW,IAAA,EAAM,MAAA,EAAQ,MAAA,KAAW,IAAA,EAAM,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,IAAA,EAAM,CAAA;AAAA,MACvG,CAAC;AAAA,KACL;AAAA,IACA,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,CAAC,GAAA,KACL,KAAA,CAAM,kBAAkB,YAAY;AAClC,QAAA,MAAM,KAAA,GAAQ,aAAa,CAAC,CAAA;AAC5B,QAAA,MAAM,SAAS,MAAM,YAAA,CAAa,GAAA,EAAK,KAAA,EAAO,EAAE,UAAU,CAAA;AAC1D,QAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,KAAA,EAAO,MAAM,CAAA;AAChD,QAAA,IAAI,MAAA,EAAQ;AAEV,UAAA,OAAO,IAAA,CAAK,EAAE,OAAA,EAAS,KAAA,EAAO,WAAW,IAAA,EAAM,aAAA,EAAe,OAAO,CAAA;AAAA,QACvE;AACA,QAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,QAAA,MAAM,OAAQ,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC/C,QAAA,MAAM,WAAW,OAAO,IAAA,EAAM,QAAA,KAAa,QAAA,GAAW,KAAK,QAAA,GAAW,KAAA,CAAA;AACtE,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,IAAI;AACF,YAAA,MAAM,SAAS,MAAM,KAAA,CAAM,QAAA,EAAS,CAAE,IAAI,QAAQ,CAAA;AAClD,YAAA,MAAM,MAAA,GAAS,OAAO,KAAA,CAAM,KAAA;AAAA,cAAM,CAAC,CAAA,KACjC,CAAA,CAAE,UAAA,CAAW,IAAA;AAAA,gBACX,CAAC,CAAA,KACC,CAAA,CAAE,YAAA,KAAiB,0BACnB,CAAA,CAAE,KAAA,KAAU,IAAA,IACZ,OAAO,EAAE,KAAA,KAAU,QAAA,IACnB,CAAA,CAAE,KAAA,CAAM,aAAY,KAAM;AAAA;AAC9B,aACF;AACA,YAAA,IAAI,MAAA,IAAU,MAAA,CAAO,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AACrC,cAAA,MAAM,KAAA,CAAM,QAAA,EAAS,CAAE,OAAA,CAAQ,QAAQ,CAAA;AACvC,cAAA,aAAA,GAAgB,IAAA;AAAA,YAClB;AAAA,UACF,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AACA,QAAA,OAAO,KAAK,EAAE,OAAA,EAAS,MAAM,SAAA,EAAW,KAAA,EAAO,eAAe,CAAA;AAAA,MAChE,CAAC;AAAA;AACL,GACF;AACF;AAaA,SAAS,aAAA,GAAwC;AAC/C,EAAA,MAAM,EAAE,MAAA,EAAO,GAAIQ,sCAAA,EAAqB;AACxC,EAAA,OAAOC,kCAAgBC,6BAAA,EAAa,EAAE,WAAWC,SAAA,CAAK,MAAM,GAAG,CAAA;AACjE;AAYO,SAAS,mBAAmB,CAAA,EAGjC;AACA,EAAA,IAAI,SAAS,CAAA,CAAE,MAAA;AACf,EAAA,MAAM,eAAA,GAAkB,OAAO,EAAA,KAA+C;AAC5E,IAAA,MAAM,GAAA,GAAM,CAAA,CAAE,gBAAA,IAAoBP,6BAAA,CAAY,kBAAkB,CAAA;AAChE,IAAA,IAAI,CAAC,GAAA,EAAK,MAAM,QAAQ,CAACC,2BAAA,CAAU,gBAAgB,CAAC,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,MAAM,CAAA,CAAE,KAAA,CAAM,OAAA,GAAU,QAAA,EAAS,CAAE,eAAA,CAAgB,CAAA,CAAE,QAAA,EAAU;AAAA,MAC5E,MAAA,EAAQ,EAAE,WAAA,EAAa,EAAA,EAAG;AAAA,MAC1B,qBAAA,EAAuB,EAAE,0BAAA,EAA4B,CAAC,GAAG,CAAA;AAAE,KAC5D,CAAA;AACD,IAAA,OAAO,MAAA,CAAO,kBAAA;AAAA,EAChB,CAAA;AACA,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA,gBAAA,EAAkB,CAAC,CAAA,KAAM;AACvB,MAAA,MAAA,KAAW,aAAA,EAAc;AACzB,MAAA,OAAOO,kCAAA,CAAqB;AAAA,QAC1B,GAAG,CAAA;AAAA,QACH,MAAA;AAAA,QACA,MAAM,CAAA,CAAE,OAAA;AAAA,QACR,SAASF,6BAAA,CAAY,EAAA;AAAA,QACrB,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AAAA,GACF;AACF;AA0CO,SAAS,yBAA4B,CAAA,EAE1C;AACA,EAAA,IAAI,OAAA,CAAQ,CAAA,CAAE,KAAA,CAAM,eAAe,CAAA,EAAG;AACpC,IAAA,OAAO,EAAE,IAAA,EAAM,YAAY,oBAAA,CAAqB,CAAA,CAAE,kBAAkB,CAAA,EAAE;AAAA,EACxE;AACA,EAAA,MAAM,QAAQ,CAAA,CAAE,KAAA;AAChB,EAAA,aAAA,CAAc,KAAK,CAAA;AACnB,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,eAAA,CAAgB,WAAA,EAAY;AACnD,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,KAAA,CAAM,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAMG,uBAAA,CAAmB,CAAC,CAAC,CAAC,CAAA;AAC3E,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAsB;AAEvC,EAAA,MAAM,MAAA,GAAS,CAAC,OAAA,KACd,IAAIC,iCAAA,CAAgB,mBAAmB,OAAA,EAAS,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAEjE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,CAAC,GAAA,KACL,KAAA,CAAM,kBAAkB,YAAY;AAClC,MAAA,MAAM,KAAA,GAAQ,aAAa,CAAC,CAAA;AAC5B,MAAA,MAAM,SAAS,MAAM,YAAA,CAAa,GAAA,EAAK,KAAA,EAAO,EAAE,UAAU,CAAA;AAE1D,MAAA,IAAI,EAAE,SAAA,EAAW;AACf,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,IAAK,EAAC,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,GAAA,GAAM,CAAA,GAAI,GAAM,CAAA;AACtE,QAAA,IAAI,MAAA,CAAO,MAAA,IAAU,CAAA,CAAE,SAAA,CAAU,SAAA,EAAW;AAC1C,UAAA,MAAM,IAAIX,gCAAA,CAAe,SAAA,EAAW,sCAAA,EAAwC;AAAA,YAC1E,MAAA,EAAQ,GAAA;AAAA,YACR,SAAA,EAAW,IAAA;AAAA,YACX,IAAA,EAAM;AAAA,WACP,CAAA;AAAA,QACH;AACA,QAAA,MAAA,CAAO,KAAK,GAAG,CAAA;AACf,QAAA,IAAA,CAAK,GAAA,CAAI,QAAQ,MAAM,CAAA;AAAA,MACzB;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,KAAA,EAAO,MAAM,CAAA;AAChD,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,CAAO,EAAA,EAAI;AACzB,QAAA,MAAM,IAAIY,kCAAA;AAAA,UACR,cAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAEA,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI;AACF,QAAA,KAAA,GAAQ,CAAA,CAAE,KAAA,CAAM,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAC,CAAA;AAAA,MACpD,SAAS,CAAA,EAAG;AACV,QAAA,MAAM,IAAID,iCAAA,CAAgB,SAAA,EAAW,aAAa,KAAA,GAAQ,CAAA,CAAE,UAAU,uBAAA,EAAyB;AAAA,UAC7F,MAAA,EAAQ,GAAA;AAAA,UACR,IAAA,EAAM,uBAAA;AAAA,UACN,KAAA,EAAO;AAAA,SACR,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,IAAA,GAAO,EAAE,SAAA,CAAU,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,CAAO,SAAS,CAAA;AACxD,MAAA,IAAI,CAACE,cAAA,CAAU,IAAA,CAAK,EAAA,EAAI,EAAE,MAAA,EAAQ,KAAA,EAAO,CAAA,IAAK,IAAA,CAAK,EAAA,CAAG,WAAA,OAAkB,QAAA,EAAU;AAChF,QAAA,MAAM,OAAO,wDAAwD,CAAA;AAAA,MACvE;AACA,MAAA,IAAA,CAAK,KAAK,KAAA,IAAS,EAAA,MAAQ,EAAA,EAAI,MAAM,OAAO,uCAAuC,CAAA;AACnF,MAAA,MAAM,EAAA,GAAK,IAAA,CAAK,YAAA,GACZ,KAAA,CAAM,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAA,CAAK,YAAY,CAAA,GACxD,KAAA,CAAA;AACJ,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,GACjB,IAAA,CAAK,KAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,WAAA,EAAY,GACpC,EAAA,GACEH,uBAAA,CAAmB,EAAE,CAAA,GACrB,KAAA,CAAA;AACN,MAAA,IAAI,CAAC,QAAA,IAAY,CAAC,SAAA,CAAU,GAAA,CAAI,QAAe,CAAA,EAAG;AAChD,QAAA,MAAM,OAAO,qDAAqD,CAAA;AAAA,MACpE;AAEA,MAAA,MAAM,SAAS,kBAAA,CAAmB;AAAA,QAChC,KAAA;AAAA,QACA,UAAU,MAAA,CAAO,EAAA;AAAA,QACjB,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,GAAI,EAAE,gBAAA,KAAqB,KAAA,CAAA,GAAY,EAAE,gBAAA,EAAkB,CAAA,CAAE,gBAAA,EAAiB,GAAI,EAAC;AAAA,QACnF,GAAI,EAAE,MAAA,KAAW,KAAA,CAAA,GAAY,EAAE,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,GAAI;AAAC,OACtD,CAAA;AACD,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,gBAAA,CAAiB;AAAA,QACzC,IAAI,IAAA,CAAK,EAAA;AAAA,QACT,GAAI,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,GAAI,EAAC;AAAA,QACrD,GAAI,KAAK,GAAA,KAAQ,KAAA,CAAA,GAAY,EAAE,GAAA,EAAK,IAAA,CAAK,GAAA,EAAI,GAAI,EAAC;AAAA,QAClD,GAAI,KAAK,YAAA,KAAiB,KAAA,CAAA,GAAY,EAAE,YAAA,EAAc,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,QAC7E,GAAI,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,GAAI,EAAC;AAAA,QACrD,KAAA,EAAO;AAAA,OACR,CAAA;AACD,MAAA,OAAO,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,WAAA,EAAaI,uBAAA,CAAMP,6BAAA,EAAa,IAAI,CAAA,EAAG,CAAA;AAAA,IACtF,CAAC;AAAA,GACL;AACF","file":"server.cjs","sourcesContent":["import type { PrivyClient } from \"@privy-io/node\";\nimport type { PrivyPoliciesService } from \"@privy-io/node\";\nimport { http, isAddress, toFunctionSelector } from \"viem\";\nimport type { Abi, AbiFunction, Address, Hash, Hex } from \"viem\";\nimport { pepuMainnet } from \"../chains.js\";\nimport { getPublicClient } from \"../client.js\";\nimport { resolvePepuEndpoints } from \"../endpoints.js\";\nimport {\n  PepuAuthError,\n  PepuChainError,\n  PepuConfigError,\n  PepuError,\n  PepuPolicyError,\n  PepuSessionError,\n  toErrorResponse,\n  toPepuError,\n} from \"../errors.js\";\nimport { txUrl } from \"../explorer.js\";\nimport { assertServerOnly } from \"../internal/assert-server.js\";\nimport { PRIVY_ENV } from \"../privy/requirements.js\";\nimport { createPrivyServer, findDelegatedEthereumWallet, privyEnvVar, verifyRequestUser } from \"../privy/server.js\";\nimport {\n  buildSessionPolicy,\n  resolveSessionMinutes,\n  sessionExpiry,\n  signAndBroadcast as signAndBroadcastFlow,\n} from \"./policy.js\";\nimport type { PrivyUnsignedTransaction, SignAndBroadcastClient, SignAndBroadcastParams } from \"./policy.js\";\n\nassertServerOnly(\"@pepu-chain/sdk/session/server\");\n\n/** Derived from the exported service type; the package does not re-export PolicyCreateParams (game-app lib/session-policy.ts). */\ntype PolicyCreateParams = Parameters<PrivyPoliciesService[\"create\"]>[0];\n\n/**\n * Server half of the Privy-mode session layer. Ported from\n * templates/game-app (app/api/session/*, app/api/game/tap/route.ts).\n *\n * Trust model: scope is enforced by Privy's off-chain policy engine. The\n * client `removeSigners` call is the real revoke; the server revoke route is\n * cleanup only.\n */\n\nexport { signAndBroadcast, broadcastSignedTransaction, withGasLimitBuffer } from \"./policy.js\";\n\n/** Contract and functions a session may touch. */\nexport interface SessionScopeInput {\n  contractAddress: Address;\n  functions: readonly AbiFunction[];\n}\n\n/**\n * Like {@link SessionScopeInput}, but the address may be empty or undefined,\n * which is what an unset env variable looks like. The route factories accept\n * it and answer every request with a `CONFIG_MISSING_ENV` JSON error instead\n * of throwing when the module loads.\n */\nexport interface LazySessionScopeInput {\n  contractAddress: Address | \"\" | undefined;\n  functions: readonly AbiFunction[];\n}\n\nfunction isBlank(address: string | undefined | null): boolean {\n  return address === undefined || address === null || address.trim() === \"\";\n}\n\n/** The handler used when the scope's contract address is unset: a `CONFIG_MISSING_ENV` JSON error. */\nfunction unconfiguredResponse(envName: string | undefined): Response {\n  return toErrorResponse(\n    new PepuConfigError(\n      \"CONFIG_MISSING_ENV\",\n      `${envName ?? \"The session contract address\"} is not set to a valid address. See .env.example.`,\n      { hint: envName ? `Set ${envName} and restart the server.` : \"Set the contract address and restart the server.\" },\n    ),\n  );\n}\n\n/**\n * Resolves the authenticated user for a request. Return the user id (or\n * `{ userId }`), return `null` for \"not authenticated\", or throw a\n * `PepuAuthError`. Integration point for WP-B1: pass\n * `async (req) => { const r = await requireUser(req); ... }`. Default (when\n * omitted): `verifyRequestUser` from `@pepu-chain/sdk/privy/server`.\n */\nexport type VerifyUser = (request: Request) => Promise<{ userId: string } | string | null>;\n\n/** The slice of a Privy client these routes use. Tests pass a fake. */\nexport type SessionPrivyClient = PrivyClient;\n\ninterface CommonOptions {\n  privy?: PrivyClient;\n  /** Custom auth. Default: verify the bearer access token with the Privy client. */\n  verifyUser?: VerifyUser;\n}\n\nfunction missing(names: readonly string[]): PepuConfigError {\n  return new PepuConfigError(\n    \"CONFIG_MISSING_ENV\",\n    `Missing required environment variable(s): ${names.join(\", \")}.`,\n  );\n}\n\nfunction resolvePrivy(o: CommonOptions): PrivyClient {\n  // One source for env names and client caching: B1's createPrivyServer (PRIVY_ENV).\n  return o.privy ?? createPrivyServer();\n}\n\nasync function authenticate(request: Request, privy: PrivyClient, verifyUser?: VerifyUser): Promise<string> {\n  let result: { userId: string } | string | null;\n  if (verifyUser) {\n    result = await verifyUser(request);\n  } else {\n    // Default: B1's verifyRequestUser (throws PepuAuthError AUTH_INVALID_TOKEN with a redacted reason).\n    result = await verifyRequestUser(request, { privy });\n  }\n  const userId = typeof result === \"string\" ? result : result?.userId;\n  if (!userId) {\n    throw new PepuAuthError(\"AUTH_INVALID_TOKEN\", \"Missing or invalid Privy access token.\");\n  }\n  return userId;\n}\n\ninterface DelegatedWallet {\n  id: string | null;\n  address: Address;\n}\n\n/** The user's embedded Ethereum wallet that has a session signer attached. Ported from game-app lib/privy-user.ts. */\nasync function findDelegated(privy: PrivyClient, userId: string): Promise<DelegatedWallet | null> {\n  const wallet = findDelegatedEthereumWallet(await privy.users()._get(userId));\n  return wallet ? { id: wallet.id ?? null, address: wallet.address as Address } : null;\n}\n\nfunction validateScope(scope: SessionScopeInput): void {\n  // Same checks as buildSessionPolicy, run at factory time so misuse fails at startup.\n  buildSessionPolicy({ ...scope, expiresAtUnixSeconds: 1 });\n}\n\nfunction json(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), { status, headers: { \"content-type\": \"application/json\" } });\n}\n\n/** Anything unclassified that reaches a route is an upstream failure, not our 500. */\nfunction upstream(e: unknown, op: string): PepuError {\n  const err = toPepuError(e, { op });\n  if (err.code === \"UNKNOWN\" && !(e instanceof PepuError)) {\n    return new PepuChainError(\"UNKNOWN\", err.message, { status: 502, cause: e });\n  }\n  // Only SESSION_* may be 409: clients treat 409 as \"no session\" (a nonce race is a failed tx, not a lost session).\n  if (err.status === 409 && !err.code.startsWith(\"SESSION_\")) {\n    return new PepuChainError(err.code, err.message, { status: 502, cause: e });\n  }\n  return err;\n}\n\nasync function guard(op: string, fn: () => Promise<Response>): Promise<Response> {\n  try {\n    return await fn();\n  } catch (e) {\n    return toErrorResponse(upstream(e, op));\n  }\n}\n\nexport interface CreateSessionRoutesOptions extends CommonOptions {\n  /**\n   * An empty or undefined `contractAddress` is allowed: the routes then answer\n   * every request with `CONFIG_MISSING_ENV`. A non-empty malformed one still\n   * throws at creation.\n   */\n  scope: LazySessionScopeInput;\n  /** Env variable named in the `CONFIG_MISSING_ENV` message when the address is unset, e.g. `\"NEXT_PUBLIC_GAME_CONTRACT_ADDRESS\"`. */\n  contractAddressEnv?: string;\n  /** Session length. Default env `SESSION_DURATION_MINUTES`, clamped to 1..1440. */\n  minutes?: number;\n  /** The Privy key quorum the user grants. Default env `NEXT_PUBLIC_PRIVY_KEY_QUORUM_ID`. */\n  keyQuorumId?: string;\n}\n\n/**\n * Route handlers for granting, checking and revoking a Privy session.\n *\n * - `grant.POST` creates a fresh scoped, time-bound policy and returns\n *   `{ alreadyGranted: false, policyId, expiresAt, signerId, durationMinutes }`,\n *   or `{ alreadyGranted: true }` when a signer is already attached (the client\n *   must then NOT call `addSigners` again: Privy fails with \"Duplicate signer\").\n * - `status.GET` returns `{ delegated, active, address }`. Privy does not\n *   expose a policy's expiry, so the client tracks `expiresAt` from the grant.\n * - `revoke.POST` is server cleanup. Call it after the client `removeSigners`;\n *   body `{ policyId }` deletes that policy if it is this scope's and the\n *   wallet is no longer delegated.\n *\n * @example\n * // app/api/session/grant/route.ts\n * const routes = createSessionRoutes({ scope: { contractAddress, functions: [tapAbi] } });\n * export const { POST } = routes.grant;\n */\nexport function createSessionRoutes(o: CreateSessionRoutesOptions): {\n  grant: { POST(req: Request): Promise<Response> };\n  status: { GET(req: Request): Promise<Response> };\n  revoke: { POST(req: Request): Promise<Response> };\n} {\n  if (isBlank(o.scope.contractAddress)) {\n    const unset = async (): Promise<Response> => unconfiguredResponse(o.contractAddressEnv);\n    return { grant: { POST: unset }, status: { GET: unset }, revoke: { POST: unset } };\n  }\n  const scope = o.scope as SessionScopeInput;\n  validateScope(scope);\n  const scopeContract = scope.contractAddress.toLowerCase();\n\n  return {\n    grant: {\n      POST: (req) =>\n        guard(\"session grant\", async () => {\n          const signerId = o.keyQuorumId ?? privyEnvVar(\"keyQuorumId\");\n          if (!signerId) throw missing([PRIVY_ENV.keyQuorumId]);\n          const privy = resolvePrivy(o);\n          const userId = await authenticate(req, privy, o.verifyUser);\n\n          try {\n            if (await findDelegated(privy, userId)) return json({ alreadyGranted: true });\n          } catch {\n            // The check failing must not block a first grant; a real Privy problem surfaces below.\n          }\n\n          const minutes = o.minutes ?? resolveSessionMinutes(process.env.SESSION_DURATION_MINUTES);\n          const expiresAt = sessionExpiry(Math.floor(Date.now() / 1000), minutes);\n          const policy = await privy.policies().create(\n            buildSessionPolicy({ ...scope, expiresAtUnixSeconds: expiresAt }) as unknown as PolicyCreateParams,\n          );\n          return json({\n            alreadyGranted: false,\n            policyId: policy.id,\n            expiresAt,\n            signerId,\n            durationMinutes: minutes,\n          });\n        }),\n    },\n    status: {\n      GET: (req) =>\n        guard(\"session status\", async () => {\n          const privy = resolvePrivy(o);\n          const userId = await authenticate(req, privy, o.verifyUser);\n          const wallet = await findDelegated(privy, userId);\n          return json({ delegated: wallet !== null, active: wallet !== null, address: wallet?.address ?? null });\n        }),\n    },\n    revoke: {\n      POST: (req) =>\n        guard(\"session revoke\", async () => {\n          const privy = resolvePrivy(o);\n          const userId = await authenticate(req, privy, o.verifyUser);\n          const wallet = await findDelegated(privy, userId);\n          if (wallet) {\n            // Client removeSigners has not happened yet; never delete a policy that is still attached.\n            return json({ revoked: false, delegated: true, policyDeleted: false });\n          }\n          let policyDeleted = false;\n          const body = (await req.json().catch(() => null)) as { policyId?: unknown } | null;\n          const policyId = typeof body?.policyId === \"string\" ? body.policyId : undefined;\n          if (policyId) {\n            try {\n              const policy = await privy.policies().get(policyId);\n              const scoped = policy.rules.every((r) =>\n                r.conditions.some(\n                  (c) =>\n                    c.field_source === \"ethereum_transaction\" &&\n                    c.field === \"to\" &&\n                    typeof c.value === \"string\" &&\n                    c.value.toLowerCase() === scopeContract,\n                ),\n              );\n              if (scoped && policy.rules.length > 0) {\n                await privy.policies()._delete(policyId);\n                policyDeleted = true;\n              }\n            } catch {\n              // Cleanup is best effort; the signer is already removed.\n            }\n          }\n          return json({ revoked: true, delegated: false, policyDeleted });\n        }),\n    },\n  };\n}\n\nexport interface PrivySessionSignerOptions {\n  privy: PrivyClient;\n  walletId: string;\n  /** The wallet's address (the `from` of the transaction). */\n  address: Address;\n  /** Default env `PRIVY_AUTHORIZATION_KEY`. Never logged or put in errors. */\n  authorizationKey?: string;\n  /** Default: a viem client on the PEPU RPC (`PEPU_RPC_URL` aware). */\n  client?: SignAndBroadcastClient;\n}\n\nfunction defaultClient(): SignAndBroadcastClient {\n  const { rpcUrl } = resolvePepuEndpoints();\n  return getPublicClient(pepuMainnet, { transport: http(rpcUrl) }) as unknown as SignAndBroadcastClient;\n}\n\n/**\n * A signer for a Privy session wallet. Signs with `eth_signTransaction` and\n * broadcasts the raw transaction itself, because Privy's server-side\n * `eth_sendTransaction` rejects chain 97741. Ported from\n * templates/game-app/app/api/game/tap/route.ts.\n *\n * @example\n * const signer = privySessionSigner({ privy, walletId, address });\n * const hash = await signer.signAndBroadcast({ to, abi, functionName: \"tap\" });\n */\nexport function privySessionSigner(o: PrivySessionSignerOptions): {\n  signTransaction(tx: PrivyUnsignedTransaction): Promise<Hex>;\n  signAndBroadcast(p: Omit<SignAndBroadcastParams, \"client\" | \"sign\" | \"from\" | \"chainId\">): Promise<Hash>;\n} {\n  let client = o.client;\n  const signTransaction = async (tx: PrivyUnsignedTransaction): Promise<Hex> => {\n    const key = o.authorizationKey ?? privyEnvVar(\"authorizationKey\");\n    if (!key) throw missing([PRIVY_ENV.authorizationKey]);\n    const signed = await o.privy.wallets().ethereum().signTransaction(o.walletId, {\n      params: { transaction: tx },\n      authorization_context: { authorization_private_keys: [key] },\n    });\n    return signed.signed_transaction as Hex;\n  };\n  return {\n    signTransaction,\n    signAndBroadcast: (p) => {\n      client ??= defaultClient();\n      return signAndBroadcastFlow({\n        ...p,\n        client,\n        from: o.address,\n        chainId: pepuMainnet.id,\n        sign: signTransaction,\n      });\n    },\n  };\n}\n\nexport interface SessionCall {\n  to: Address;\n  abi?: Abi;\n  functionName?: string;\n  args?: readonly unknown[];\n  data?: Hex;\n  value?: bigint;\n}\n\nexport interface CreateSessionActionRouteOptions<I> extends CommonOptions {\n  /** As in {@link CreateSessionRoutesOptions}: an unset address yields `CONFIG_MISSING_ENV` at request time. */\n  scope: LazySessionScopeInput;\n  /** Env variable named in the `CONFIG_MISSING_ENV` message when the address is unset. */\n  contractAddressEnv?: string;\n  /** Validate the client input. Throw to reject with 400. */\n  parse(body: unknown): I;\n  /** Turn the input into the one call to make. Checked against `scope` before signing. */\n  buildCall(i: I, ctx: { from: Address }): SessionCall;\n  /** Per-user in-memory limit (per server instance). */\n  rateLimit?: { perMinute: number };\n  authorizationKey?: string;\n  client?: SignAndBroadcastClient;\n}\n\n/**\n * Route that acts on the user's behalf with their session: finds the\n * delegated wallet (409 `SESSION_NONE` if none, the only \"no session\"\n * signal), re-checks the call against `scope`, signs with Privy and\n * broadcasts. Responds `{ hash, address, explorerUrl }`.\n *\n * A non-409 failure (policy denial, revert, nonce race) is a failed\n * transaction, not proof the session is gone.\n *\n * @example\n * export const { POST } = createSessionActionRoute({\n *   scope: { contractAddress, functions: [tapAbi] },\n *   parse: () => ({}),\n *   buildCall: () => ({ to: contractAddress, abi: [tapAbi], functionName: \"tap\" }),\n * });\n */\nexport function createSessionActionRoute<I>(o: CreateSessionActionRouteOptions<I>): {\n  POST(req: Request): Promise<Response>;\n} {\n  if (isBlank(o.scope.contractAddress)) {\n    return { POST: async () => unconfiguredResponse(o.contractAddressEnv) };\n  }\n  const scope = o.scope as SessionScopeInput;\n  validateScope(scope);\n  const contract = scope.contractAddress.toLowerCase();\n  const selectors = new Set(scope.functions.map((f) => toFunctionSelector(f)));\n  const hits = new Map<string, number[]>();\n\n  const denied = (message: string): PepuPolicyError =>\n    new PepuPolicyError(\"POLICY_UNSCOPED\", message, { status: 403 });\n\n  return {\n    POST: (req) =>\n      guard(\"session action\", async () => {\n        const privy = resolvePrivy(o);\n        const userId = await authenticate(req, privy, o.verifyUser);\n\n        if (o.rateLimit) {\n          const now = Date.now();\n          const recent = (hits.get(userId) ?? []).filter((t) => now - t < 60_000);\n          if (recent.length >= o.rateLimit.perMinute) {\n            throw new PepuChainError(\"UNKNOWN\", \"Too many session actions; slow down.\", {\n              status: 429,\n              retryable: true,\n              hint: \"Wait a few seconds and retry.\",\n            });\n          }\n          recent.push(now);\n          hits.set(userId, recent);\n        }\n\n        const wallet = await findDelegated(privy, userId);\n        if (!wallet || !wallet.id) {\n          throw new PepuSessionError(\n            \"SESSION_NONE\",\n            \"No delegated session signer found for this account. Grant a session first.\",\n          );\n        }\n\n        let input: I;\n        try {\n          input = o.parse(await req.json().catch(() => ({})));\n        } catch (e) {\n          throw new PepuPolicyError(\"UNKNOWN\", e instanceof Error ? e.message : \"Invalid request body.\", {\n            status: 400,\n            hint: \"Fix the request body.\",\n            cause: e,\n          });\n        }\n\n        const call = o.buildCall(input, { from: wallet.address });\n        if (!isAddress(call.to, { strict: false }) || call.to.toLowerCase() !== contract) {\n          throw denied(\"The call targets a contract outside the session scope.\");\n        }\n        if ((call.value ?? 0n) !== 0n) throw denied(\"A session call must carry zero value.\");\n        const fn = call.functionName\n          ? scope.functions.find((f) => f.name === call.functionName)\n          : undefined;\n        const selector = call.data\n          ? (call.data.slice(0, 10).toLowerCase() as Hex)\n          : fn\n            ? toFunctionSelector(fn)\n            : undefined;\n        if (!selector || !selectors.has(selector as Hex)) {\n          throw denied(\"The call uses a function outside the session scope.\");\n        }\n\n        const signer = privySessionSigner({\n          privy,\n          walletId: wallet.id,\n          address: wallet.address,\n          ...(o.authorizationKey !== undefined ? { authorizationKey: o.authorizationKey } : {}),\n          ...(o.client !== undefined ? { client: o.client } : {}),\n        });\n        const hash = await signer.signAndBroadcast({\n          to: call.to,\n          ...(call.data !== undefined ? { data: call.data } : {}),\n          ...(call.abi !== undefined ? { abi: call.abi } : {}),\n          ...(call.functionName !== undefined ? { functionName: call.functionName } : {}),\n          ...(call.args !== undefined ? { args: call.args } : {}),\n          value: 0n,\n        });\n        return json({ hash, address: wallet.address, explorerUrl: txUrl(pepuMainnet, hash) });\n      }),\n  };\n}\n"]}

package/dist/session/server.d.cts

@@ -0,0 +1,151 @@
+import { PrivyClient } from '@privy-io/node';
+import { Address, AbiFunction, Abi, Hex, Hash } from 'viem';
+import { SignAndBroadcastClient, PrivyUnsignedTransaction, SignAndBroadcastParams } from '../server.cjs';
+export { broadcastSignedTransaction, signAndBroadcast, withGasLimitBuffer } from '../server.cjs';
+
+/** Contract and functions a session may touch. */
+interface SessionScopeInput {
+    contractAddress: Address;
+    functions: readonly AbiFunction[];
+}
+/**
+ * Like {@link SessionScopeInput}, but the address may be empty or undefined,
+ * which is what an unset env variable looks like. The route factories accept
+ * it and answer every request with a `CONFIG_MISSING_ENV` JSON error instead
+ * of throwing when the module loads.
+ */
+interface LazySessionScopeInput {
+    contractAddress: Address | "" | undefined;
+    functions: readonly AbiFunction[];
+}
+/**
+ * Resolves the authenticated user for a request. Return the user id (or
+ * `{ userId }`), return `null` for "not authenticated", or throw a
+ * `PepuAuthError`. Integration point for WP-B1: pass
+ * `async (req) => { const r = await requireUser(req); ... }`. Default (when
+ * omitted): `verifyRequestUser` from `@pepu-chain/sdk/privy/server`.
+ */
+type VerifyUser = (request: Request) => Promise<{
+    userId: string;
+} | string | null>;
+/** The slice of a Privy client these routes use. Tests pass a fake. */
+type SessionPrivyClient = PrivyClient;
+interface CommonOptions {
+    privy?: PrivyClient;
+    /** Custom auth. Default: verify the bearer access token with the Privy client. */
+    verifyUser?: VerifyUser;
+}
+interface CreateSessionRoutesOptions extends CommonOptions {
+    /**
+     * An empty or undefined `contractAddress` is allowed: the routes then answer
+     * every request with `CONFIG_MISSING_ENV`. A non-empty malformed one still
+     * throws at creation.
+     */
+    scope: LazySessionScopeInput;
+    /** Env variable named in the `CONFIG_MISSING_ENV` message when the address is unset, e.g. `"NEXT_PUBLIC_GAME_CONTRACT_ADDRESS"`. */
+    contractAddressEnv?: string;
+    /** Session length. Default env `SESSION_DURATION_MINUTES`, clamped to 1..1440. */
+    minutes?: number;
+    /** The Privy key quorum the user grants. Default env `NEXT_PUBLIC_PRIVY_KEY_QUORUM_ID`. */
+    keyQuorumId?: string;
+}
+/**
+ * Route handlers for granting, checking and revoking a Privy session.
+ *
+ * - `grant.POST` creates a fresh scoped, time-bound policy and returns
+ *   `{ alreadyGranted: false, policyId, expiresAt, signerId, durationMinutes }`,
+ *   or `{ alreadyGranted: true }` when a signer is already attached (the client
+ *   must then NOT call `addSigners` again: Privy fails with "Duplicate signer").
+ * - `status.GET` returns `{ delegated, active, address }`. Privy does not
+ *   expose a policy's expiry, so the client tracks `expiresAt` from the grant.
+ * - `revoke.POST` is server cleanup. Call it after the client `removeSigners`;
+ *   body `{ policyId }` deletes that policy if it is this scope's and the
+ *   wallet is no longer delegated.
+ *
+ * @example
+ * // app/api/session/grant/route.ts
+ * const routes = createSessionRoutes({ scope: { contractAddress, functions: [tapAbi] } });
+ * export const { POST } = routes.grant;
+ */
+declare function createSessionRoutes(o: CreateSessionRoutesOptions): {
+    grant: {
+        POST(req: Request): Promise<Response>;
+    };
+    status: {
+        GET(req: Request): Promise<Response>;
+    };
+    revoke: {
+        POST(req: Request): Promise<Response>;
+    };
+};
+interface PrivySessionSignerOptions {
+    privy: PrivyClient;
+    walletId: string;
+    /** The wallet's address (the `from` of the transaction). */
+    address: Address;
+    /** Default env `PRIVY_AUTHORIZATION_KEY`. Never logged or put in errors. */
+    authorizationKey?: string;
+    /** Default: a viem client on the PEPU RPC (`PEPU_RPC_URL` aware). */
+    client?: SignAndBroadcastClient;
+}
+/**
+ * A signer for a Privy session wallet. Signs with `eth_signTransaction` and
+ * broadcasts the raw transaction itself, because Privy's server-side
+ * `eth_sendTransaction` rejects chain 97741. Ported from
+ * templates/game-app/app/api/game/tap/route.ts.
+ *
+ * @example
+ * const signer = privySessionSigner({ privy, walletId, address });
+ * const hash = await signer.signAndBroadcast({ to, abi, functionName: "tap" });
+ */
+declare function privySessionSigner(o: PrivySessionSignerOptions): {
+    signTransaction(tx: PrivyUnsignedTransaction): Promise<Hex>;
+    signAndBroadcast(p: Omit<SignAndBroadcastParams, "client" | "sign" | "from" | "chainId">): Promise<Hash>;
+};
+interface SessionCall {
+    to: Address;
+    abi?: Abi;
+    functionName?: string;
+    args?: readonly unknown[];
+    data?: Hex;
+    value?: bigint;
+}
+interface CreateSessionActionRouteOptions<I> extends CommonOptions {
+    /** As in {@link CreateSessionRoutesOptions}: an unset address yields `CONFIG_MISSING_ENV` at request time. */
+    scope: LazySessionScopeInput;
+    /** Env variable named in the `CONFIG_MISSING_ENV` message when the address is unset. */
+    contractAddressEnv?: string;
+    /** Validate the client input. Throw to reject with 400. */
+    parse(body: unknown): I;
+    /** Turn the input into the one call to make. Checked against `scope` before signing. */
+    buildCall(i: I, ctx: {
+        from: Address;
+    }): SessionCall;
+    /** Per-user in-memory limit (per server instance). */
+    rateLimit?: {
+        perMinute: number;
+    };
+    authorizationKey?: string;
+    client?: SignAndBroadcastClient;
+}
+/**
+ * Route that acts on the user's behalf with their session: finds the
+ * delegated wallet (409 `SESSION_NONE` if none, the only "no session"
+ * signal), re-checks the call against `scope`, signs with Privy and
+ * broadcasts. Responds `{ hash, address, explorerUrl }`.
+ *
+ * A non-409 failure (policy denial, revert, nonce race) is a failed
+ * transaction, not proof the session is gone.
+ *
+ * @example
+ * export const { POST } = createSessionActionRoute({
+ *   scope: { contractAddress, functions: [tapAbi] },
+ *   parse: () => ({}),
+ *   buildCall: () => ({ to: contractAddress, abi: [tapAbi], functionName: "tap" }),
+ * });
+ */
+declare function createSessionActionRoute<I>(o: CreateSessionActionRouteOptions<I>): {
+    POST(req: Request): Promise<Response>;
+};
+
+export { type CreateSessionActionRouteOptions, type CreateSessionRoutesOptions, type LazySessionScopeInput, type PrivySessionSignerOptions, type SessionCall, type SessionPrivyClient, type SessionScopeInput, type VerifyUser, createSessionActionRoute, createSessionRoutes, privySessionSigner };

package/dist/session/server.d.ts

@@ -0,0 +1,151 @@
+import { PrivyClient } from '@privy-io/node';
+import { Address, AbiFunction, Abi, Hex, Hash } from 'viem';
+import { SignAndBroadcastClient, PrivyUnsignedTransaction, SignAndBroadcastParams } from '../server.js';
+export { broadcastSignedTransaction, signAndBroadcast, withGasLimitBuffer } from '../server.js';
+
+/** Contract and functions a session may touch. */
+interface SessionScopeInput {
+    contractAddress: Address;
+    functions: readonly AbiFunction[];
+}
+/**
+ * Like {@link SessionScopeInput}, but the address may be empty or undefined,
+ * which is what an unset env variable looks like. The route factories accept
+ * it and answer every request with a `CONFIG_MISSING_ENV` JSON error instead
+ * of throwing when the module loads.
+ */
+interface LazySessionScopeInput {
+    contractAddress: Address | "" | undefined;
+    functions: readonly AbiFunction[];
+}
+/**
+ * Resolves the authenticated user for a request. Return the user id (or
+ * `{ userId }`), return `null` for "not authenticated", or throw a
+ * `PepuAuthError`. Integration point for WP-B1: pass
+ * `async (req) => { const r = await requireUser(req); ... }`. Default (when
+ * omitted): `verifyRequestUser` from `@pepu-chain/sdk/privy/server`.
+ */
+type VerifyUser = (request: Request) => Promise<{
+    userId: string;
+} | string | null>;
+/** The slice of a Privy client these routes use. Tests pass a fake. */
+type SessionPrivyClient = PrivyClient;
+interface CommonOptions {
+    privy?: PrivyClient;
+    /** Custom auth. Default: verify the bearer access token with the Privy client. */
+    verifyUser?: VerifyUser;
+}
+interface CreateSessionRoutesOptions extends CommonOptions {
+    /**
+     * An empty or undefined `contractAddress` is allowed: the routes then answer
+     * every request with `CONFIG_MISSING_ENV`. A non-empty malformed one still
+     * throws at creation.
+     */
+    scope: LazySessionScopeInput;
+    /** Env variable named in the `CONFIG_MISSING_ENV` message when the address is unset, e.g. `"NEXT_PUBLIC_GAME_CONTRACT_ADDRESS"`. */
+    contractAddressEnv?: string;
+    /** Session length. Default env `SESSION_DURATION_MINUTES`, clamped to 1..1440. */
+    minutes?: number;
+    /** The Privy key quorum the user grants. Default env `NEXT_PUBLIC_PRIVY_KEY_QUORUM_ID`. */
+    keyQuorumId?: string;
+}
+/**
+ * Route handlers for granting, checking and revoking a Privy session.
+ *
+ * - `grant.POST` creates a fresh scoped, time-bound policy and returns
+ *   `{ alreadyGranted: false, policyId, expiresAt, signerId, durationMinutes }`,
+ *   or `{ alreadyGranted: true }` when a signer is already attached (the client
+ *   must then NOT call `addSigners` again: Privy fails with "Duplicate signer").
+ * - `status.GET` returns `{ delegated, active, address }`. Privy does not
+ *   expose a policy's expiry, so the client tracks `expiresAt` from the grant.
+ * - `revoke.POST` is server cleanup. Call it after the client `removeSigners`;
+ *   body `{ policyId }` deletes that policy if it is this scope's and the
+ *   wallet is no longer delegated.
+ *
+ * @example
+ * // app/api/session/grant/route.ts
+ * const routes = createSessionRoutes({ scope: { contractAddress, functions: [tapAbi] } });
+ * export const { POST } = routes.grant;
+ */
+declare function createSessionRoutes(o: CreateSessionRoutesOptions): {
+    grant: {
+        POST(req: Request): Promise<Response>;
+    };
+    status: {
+        GET(req: Request): Promise<Response>;
+    };
+    revoke: {
+        POST(req: Request): Promise<Response>;
+    };
+};
+interface PrivySessionSignerOptions {
+    privy: PrivyClient;
+    walletId: string;
+    /** The wallet's address (the `from` of the transaction). */
+    address: Address;
+    /** Default env `PRIVY_AUTHORIZATION_KEY`. Never logged or put in errors. */
+    authorizationKey?: string;
+    /** Default: a viem client on the PEPU RPC (`PEPU_RPC_URL` aware). */
+    client?: SignAndBroadcastClient;
+}
+/**
+ * A signer for a Privy session wallet. Signs with `eth_signTransaction` and
+ * broadcasts the raw transaction itself, because Privy's server-side
+ * `eth_sendTransaction` rejects chain 97741. Ported from
+ * templates/game-app/app/api/game/tap/route.ts.
+ *
+ * @example
+ * const signer = privySessionSigner({ privy, walletId, address });
+ * const hash = await signer.signAndBroadcast({ to, abi, functionName: "tap" });
+ */
+declare function privySessionSigner(o: PrivySessionSignerOptions): {
+    signTransaction(tx: PrivyUnsignedTransaction): Promise<Hex>;
+    signAndBroadcast(p: Omit<SignAndBroadcastParams, "client" | "sign" | "from" | "chainId">): Promise<Hash>;
+};
+interface SessionCall {
+    to: Address;
+    abi?: Abi;
+    functionName?: string;
+    args?: readonly unknown[];
+    data?: Hex;
+    value?: bigint;
+}
+interface CreateSessionActionRouteOptions<I> extends CommonOptions {
+    /** As in {@link CreateSessionRoutesOptions}: an unset address yields `CONFIG_MISSING_ENV` at request time. */
+    scope: LazySessionScopeInput;
+    /** Env variable named in the `CONFIG_MISSING_ENV` message when the address is unset. */
+    contractAddressEnv?: string;
+    /** Validate the client input. Throw to reject with 400. */
+    parse(body: unknown): I;
+    /** Turn the input into the one call to make. Checked against `scope` before signing. */
+    buildCall(i: I, ctx: {
+        from: Address;
+    }): SessionCall;
+    /** Per-user in-memory limit (per server instance). */
+    rateLimit?: {
+        perMinute: number;
+    };
+    authorizationKey?: string;
+    client?: SignAndBroadcastClient;
+}
+/**
+ * Route that acts on the user's behalf with their session: finds the
+ * delegated wallet (409 `SESSION_NONE` if none, the only "no session"
+ * signal), re-checks the call against `scope`, signs with Privy and
+ * broadcasts. Responds `{ hash, address, explorerUrl }`.
+ *
+ * A non-409 failure (policy denial, revert, nonce race) is a failed
+ * transaction, not proof the session is gone.
+ *
+ * @example
+ * export const { POST } = createSessionActionRoute({
+ *   scope: { contractAddress, functions: [tapAbi] },
+ *   parse: () => ({}),
+ *   buildCall: () => ({ to: contractAddress, abi: [tapAbi], functionName: "tap" }),
+ * });
+ */
+declare function createSessionActionRoute<I>(o: CreateSessionActionRouteOptions<I>): {
+    POST(req: Request): Promise<Response>;
+};
+
+export { type CreateSessionActionRouteOptions, type CreateSessionRoutesOptions, type LazySessionScopeInput, type PrivySessionSignerOptions, type SessionCall, type SessionPrivyClient, type SessionScopeInput, type VerifyUser, createSessionActionRoute, createSessionRoutes, privySessionSigner };