@pepu-chain/sdk 0.0.0-stage → 0.2.0

package/dist/chunk-3XUGQODR.js

@@ -0,0 +1,194 @@
+// src/privy/requirements.ts
+var PRIVY_ENV = {
+  appId: "NEXT_PUBLIC_PRIVY_APP_ID",
+  appSecret: "PRIVY_APP_SECRET",
+  authorizationKey: "PRIVY_AUTHORIZATION_KEY",
+  keyQuorumId: "NEXT_PUBLIC_PRIVY_KEY_QUORUM_ID"
+};
+var PRIVY_ENV_ALIASES = {
+  appId: ["PRIVY_APP_ID"],
+  appSecret: [],
+  authorizationKey: [],
+  keyQuorumId: ["PRIVY_KEY_QUORUM_ID"]
+};
+var PRIVY_DOCS = "https://guide.pepeunchained.com/privy";
+var normOrigin = (o) => o.trim().replace(/\/+$/, "").toLowerCase();
+var PEPU_PRIVY_REQUIREMENTS = [
+  {
+    id: "app-id",
+    where: "env",
+    label: `${PRIVY_ENV.appId} is set`,
+    required: true,
+    pillars: ["login", "session", "sponsor"],
+    fix: `Copy the App ID from the Privy dashboard (Settings, Basics) into ${PRIVY_ENV.appId}.`,
+    docsUrl: `${PRIVY_DOCS}#app-id`
+  },
+  {
+    id: "app-secret",
+    where: "env",
+    label: `${PRIVY_ENV.appSecret} is set (server only)`,
+    required: true,
+    pillars: ["login", "session", "sponsor"],
+    fix: `Create an app secret in the Privy dashboard and put it in ${PRIVY_ENV.appSecret}. Never prefix it with NEXT_PUBLIC_.`,
+    docsUrl: `${PRIVY_DOCS}#app-secret`
+  },
+  {
+    id: "allowed-origins",
+    where: "dashboard",
+    label: "The page origin (including the port) is in Allowed origins",
+    required: true,
+    pillars: ["login", "session", "sponsor"],
+    check: (cfg, ctx) => {
+      if (!ctx.origin) return { ok: "unknown", detail: "No origin was given to check." };
+      if (!Array.isArray(cfg.allowed_domains)) {
+        return { ok: "unknown", detail: "Privy did not report allowed origins." };
+      }
+      const want = normOrigin(ctx.origin);
+      const hit = cfg.allowed_domains.some((d) => normOrigin(d) === want || normOrigin(d) === "*");
+      return hit ? { ok: true, detail: `${ctx.origin} is allowed.` } : { ok: false, detail: `${ctx.origin} is not in Allowed origins.` };
+    },
+    fix: "Add the exact origin, scheme, host and port, to Privy dashboard, Configuration, App settings, Allowed origins. A different dev port counts as a different origin.",
+    docsUrl: `${PRIVY_DOCS}#allowed-origins`
+  },
+  {
+    id: "login-methods",
+    where: "dashboard",
+    label: "At least one login method is enabled",
+    required: true,
+    pillars: ["login"],
+    check: (cfg) => {
+      if (!Array.isArray(cfg.login_methods)) {
+        return { ok: "unknown", detail: "Privy did not report login methods." };
+      }
+      return cfg.login_methods.length > 0 ? { ok: true, detail: `Enabled: ${cfg.login_methods.join(", ")}.` } : { ok: false, detail: "No login methods are enabled." };
+    },
+    fix: "Enable the methods you list in loginMethods under Privy dashboard, User management, Authentication. Methods not enabled there are hidden even if listed in code.",
+    docsUrl: `${PRIVY_DOCS}#login-methods`
+  },
+  {
+    id: "login-methods.google",
+    where: "dashboard",
+    label: "Google login is enabled",
+    required: false,
+    pillars: ["login"],
+    check: (cfg) => {
+      if (!Array.isArray(cfg.login_methods)) {
+        return { ok: "unknown", detail: "Privy did not report login methods." };
+      }
+      return cfg.login_methods.some((m) => m === "google" || m === "google_oauth") ? { ok: true, detail: "Google login is enabled." } : { ok: false, detail: "Google login is not enabled." };
+    },
+    fix: "Enable Google under Privy dashboard, User management, Authentication, Socials.",
+    docsUrl: `${PRIVY_DOCS}#google`
+  },
+  {
+    id: "embedded-wallets",
+    where: "dashboard",
+    label: "Embedded wallets are enabled for Ethereum",
+    required: true,
+    pillars: ["login", "session", "sponsor"],
+    check: (cfg) => {
+      const eth = cfg.embedded_wallet_config?.ethereum;
+      if (!eth) return { ok: "unknown", detail: "Privy did not report the Ethereum embedded wallet config." };
+      const mode = eth.create_on_login;
+      return {
+        ok: true,
+        detail: typeof mode === "string" ? `Dashboard create-on-login is "${mode}". The SDK provisions wallets server-side either way (WalletGate).` : "Ethereum embedded wallets are configured."
+      };
+    },
+    fix: "Turn on embedded wallets for Ethereum in Privy dashboard, Wallets. Wallet creation itself is handled server-side by createEnsureWalletRoute().",
+    docsUrl: `${PRIVY_DOCS}#embedded-wallets`
+  },
+  {
+    id: "coinbase-eoa-only",
+    where: "code",
+    label: "Coinbase Wallet is pinned to eoaOnly",
+    required: true,
+    pillars: ["login"],
+    fix: "Build the Privy config with createPepuPrivyConfig() (or use PepuPrivyProvider). Coinbase Smart Wallet does not support chain 97741.",
+    docsUrl: `${PRIVY_DOCS}#coinbase`
+  },
+  {
+    id: "authorization-key-quorum",
+    where: "env",
+    label: `${PRIVY_ENV.authorizationKey} is set and ${PRIVY_ENV.keyQuorumId} is its key quorum id`,
+    required: false,
+    pillars: ["session"],
+    fix: `Create an authorization key in the Privy dashboard, put the private half in ${PRIVY_ENV.authorizationKey} and its key quorum id in ${PRIVY_ENV.keyQuorumId}. A mismatch gives "No valid authorization keys or user signing keys available".`,
+    docsUrl: `${PRIVY_DOCS}#key-quorum`
+  },
+  {
+    id: "smart-wallets",
+    where: "dashboard",
+    label: "Smart wallets are enabled with the PEPU bundler and paymaster URLs (Privy transport only)",
+    required: false,
+    pillars: ["sponsor"],
+    check: (cfg) => cfg.smart_wallet_config === void 0 ? { ok: "unknown", detail: "Privy did not report smart wallet settings." } : { ok: true, detail: "Smart wallet settings are present." },
+    fix: "Only needed for the Privy Smart Wallets transport: add the PEPU chain with bundler and paymaster URLs under Privy dashboard, Wallets, Smart wallets. The direct transport does not need this.",
+    docsUrl: `${PRIVY_DOCS}#smart-wallets`
+  }
+];
+var PRIVY_APP_CONFIG_URL = "https://auth.privy.io/api/v1/apps/";
+async function checkPrivyDashboardConfig(o) {
+  const rows = PEPU_PRIVY_REQUIREMENTS.filter((r) => r.where === "dashboard");
+  const unknownAll = (detail) => ({
+    ok: true,
+    items: rows.map((r) => ({ id: r.id, ok: "unknown", detail, fix: r.fix }))
+  });
+  const appId = o.appId?.trim() ?? "";
+  if (!appId) return unknownAll(`${PRIVY_ENV.appId} is empty, so nothing could be checked.`);
+  let cfg;
+  try {
+    const doFetch = o.fetch ?? globalThis.fetch;
+    const res = await doFetch(`${PRIVY_APP_CONFIG_URL}${encodeURIComponent(appId)}`, {
+      headers: {
+        "privy-app-id": appId,
+        ...o.origin ? { origin: o.origin } : {}
+      }
+    });
+    if (!res.ok) return unknownAll(`Privy's public app config returned HTTP ${res.status}.`);
+    const json = await res.json();
+    if (typeof json !== "object" || json === null) return unknownAll("Privy's public app config was not an object.");
+    cfg = json;
+  } catch {
+    return unknownAll("Could not reach Privy's public app config (network error).");
+  }
+  const items = rows.map((r) => {
+    let result = { ok: "unknown", detail: "No automatic check." };
+    if (r.check) {
+      try {
+        result = r.check(cfg, o.origin !== void 0 ? { origin: o.origin } : {});
+      } catch {
+        result = { ok: "unknown", detail: "The check could not read Privy's response." };
+      }
+    }
+    return result.ok === true ? { id: r.id, ok: true, detail: result.detail } : { id: r.id, ok: result.ok, detail: result.detail, fix: r.fix };
+  });
+  const ok = !items.some((i) => i.ok === false && rows.find((r) => r.id === i.id)?.required);
+  return { ok, items };
+}
+async function privyDashboardChecker(input) {
+  const report = await checkPrivyDashboardConfig({
+    appId: input.appId,
+    fetch: input.fetch,
+    ...input.origin !== void 0 ? { origin: input.origin } : {}
+  });
+  return input.requirementKeys.map((key) => {
+    const id = `privy.${key}`;
+    const row = PEPU_PRIVY_REQUIREMENTS.find((r) => r.id === key);
+    if (!row) {
+      return { id, status: "fail", message: `Unknown Privy requirement key "${key}".`, fix: "Use a key from PEPU_PRIVY_REQUIREMENTS." };
+    }
+    if (row.where !== "dashboard") {
+      return { id, status: "skip", message: `${row.label}: checked by the env/code checks, not the dashboard.` };
+    }
+    const item = report.items.find((i) => i.id === key);
+    if (!item || item.ok === "unknown") {
+      return { id, status: "warn", message: `${row.label}: could not be verified. ${item?.detail ?? ""}`.trim(), fix: row.fix };
+    }
+    return item.ok ? { id, status: "pass", message: `${row.label}: ${item.detail}` } : { id, status: "fail", message: `${row.label}: ${item.detail}`, fix: row.fix };
+  });
+}
+
+export { PEPU_PRIVY_REQUIREMENTS, PRIVY_ENV, PRIVY_ENV_ALIASES, checkPrivyDashboardConfig, privyDashboardChecker };
+//# sourceMappingURL=chunk-3XUGQODR.js.map
+//# sourceMappingURL=chunk-3XUGQODR.js.map

package/dist/chunk-3XUGQODR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/privy/requirements.ts"],"names":[],"mappings":";AAMO,IAAM,SAAA,GAAY;AAAA,EACvB,KAAA,EAAO,0BAAA;AAAA,EACP,SAAA,EAAW,kBAAA;AAAA,EACX,gBAAA,EAAkB,yBAAA;AAAA,EAClB,WAAA,EAAa;AACf;AAMO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,KAAA,EAAO,CAAC,cAAc,CAAA;AAAA,EACtB,WAAW,EAAC;AAAA,EACZ,kBAAkB,EAAC;AAAA,EACnB,WAAA,EAAa,CAAC,qBAAqB;AACrC;AAuCA,IAAM,UAAA,GAAa,uCAAA;AAEnB,IAAM,UAAA,GAAa,CAAC,CAAA,KAAsB,CAAA,CAAE,IAAA,GAAO,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,CAAE,WAAA,EAAY;AAY5E,IAAM,uBAAA,GAAuD;AAAA,EAClE;AAAA,IACE,EAAA,EAAI,QAAA;AAAA,IACJ,KAAA,EAAO,KAAA;AAAA,IACP,KAAA,EAAO,CAAA,EAAG,SAAA,CAAU,KAAK,CAAA,OAAA,CAAA;AAAA,IACzB,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS,CAAC,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,IACvC,GAAA,EAAK,CAAA,iEAAA,EAAoE,SAAA,CAAU,KAAK,CAAA,CAAA,CAAA;AAAA,IACxF,OAAA,EAAS,GAAG,UAAU,CAAA,OAAA;AAAA,GACxB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,YAAA;AAAA,IACJ,KAAA,EAAO,KAAA;AAAA,IACP,KAAA,EAAO,CAAA,EAAG,SAAA,CAAU,SAAS,CAAA,qBAAA,CAAA;AAAA,IAC7B,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS,CAAC,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,IACvC,GAAA,EAAK,CAAA,0DAAA,EAA6D,SAAA,CAAU,SAAS,CAAA,oCAAA,CAAA;AAAA,IACrF,OAAA,EAAS,GAAG,UAAU,CAAA,WAAA;AAAA,GACxB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,iBAAA;AAAA,IACJ,KAAA,EAAO,WAAA;AAAA,IACP,KAAA,EAAO,4DAAA;AAAA,IACP,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS,CAAC,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,IACvC,KAAA,EAAO,CAAC,GAAA,EAAK,GAAA,KAAQ;AACnB,MAAA,IAAI,CAAC,IAAI,MAAA,EAAQ,OAAO,EAAE,EAAA,EAAI,SAAA,EAAW,QAAQ,+BAAA,EAAgC;AACjF,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,EAAG;AACvC,QAAA,OAAO,EAAE,EAAA,EAAI,SAAA,EAAW,MAAA,EAAQ,uCAAA,EAAwC;AAAA,MAC1E;AACA,MAAA,MAAM,IAAA,GAAO,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAClC,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,eAAA,CAAgB,IAAA,CAAK,CAAC,CAAA,KAAM,UAAA,CAAW,CAAC,CAAA,KAAM,IAAA,IAAQ,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC3F,MAAA,OAAO,MACH,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,GAAG,GAAA,CAAI,MAAM,CAAA,YAAA,CAAA,EAAe,GAChD,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,2BAAA,CAAA,EAA8B;AAAA,IACtE,CAAA;AAAA,IACA,GAAA,EAAK,mKAAA;AAAA,IACL,OAAA,EAAS,GAAG,UAAU,CAAA,gBAAA;AAAA,GACxB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,eAAA;AAAA,IACJ,KAAA,EAAO,WAAA;AAAA,IACP,KAAA,EAAO,sCAAA;AAAA,IACP,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS,CAAC,OAAO,CAAA;AAAA,IACjB,KAAA,EAAO,CAAC,GAAA,KAAQ;AACd,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA,EAAG;AACrC,QAAA,OAAO,EAAE,EAAA,EAAI,SAAA,EAAW,MAAA,EAAQ,qCAAA,EAAsC;AAAA,MACxE;AACA,MAAA,OAAO,GAAA,CAAI,cAAc,MAAA,GAAS,CAAA,GAC9B,EAAE,EAAA,EAAI,IAAA,EAAM,QAAQ,CAAA,SAAA,EAAY,GAAA,CAAI,cAAc,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA,EAAI,GAChE,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,+BAAA,EAAgC;AAAA,IAC3D,CAAA;AAAA,IACA,GAAA,EAAK,kKAAA;AAAA,IACL,OAAA,EAAS,GAAG,UAAU,CAAA,cAAA;AAAA,GACxB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,sBAAA;AAAA,IACJ,KAAA,EAAO,WAAA;AAAA,IACP,KAAA,EAAO,yBAAA;AAAA,IACP,QAAA,EAAU,KAAA;AAAA,IACV,OAAA,EAAS,CAAC,OAAO,CAAA;AAAA,IACjB,KAAA,EAAO,CAAC,GAAA,KAAQ;AACd,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA,EAAG;AACrC,QAAA,OAAO,EAAE,EAAA,EAAI,SAAA,EAAW,MAAA,EAAQ,qCAAA,EAAsC;AAAA,MACxE;AACA,MAAA,OAAO,GAAA,CAAI,cAAc,IAAA,CAAK,CAAC,MAAM,CAAA,KAAM,QAAA,IAAY,MAAM,cAAc,CAAA,GACvE,EAAE,EAAA,EAAI,IAAA,EAAM,QAAQ,0BAAA,EAA2B,GAC/C,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,8BAAA,EAA+B;AAAA,IAC1D,CAAA;AAAA,IACA,GAAA,EAAK,gFAAA;AAAA,IACL,OAAA,EAAS,GAAG,UAAU,CAAA,OAAA;AAAA,GACxB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,KAAA,EAAO,WAAA;AAAA,IACP,KAAA,EAAO,2CAAA;AAAA,IACP,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS,CAAC,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,IACvC,KAAA,EAAO,CAAC,GAAA,KAAQ;AACd,MAAA,MAAM,GAAA,GAAM,IAAI,sBAAA,EAAwB,QAAA;AACxC,MAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,EAAA,EAAI,SAAA,EAAW,QAAQ,2DAAA,EAA4D;AACtG,MAAA,MAAM,OAAO,GAAA,CAAI,eAAA;AACjB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,QACE,OAAO,IAAA,KAAS,QAAA,GACZ,CAAA,8BAAA,EAAiC,IAAI,CAAA,kEAAA,CAAA,GACrC;AAAA,OACR;AAAA,IACF,CAAA;AAAA,IACA,GAAA,EAAK,gJAAA;AAAA,IACL,OAAA,EAAS,GAAG,UAAU,CAAA,iBAAA;AAAA,GACxB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mBAAA;AAAA,IACJ,KAAA,EAAO,MAAA;AAAA,IACP,KAAA,EAAO,sCAAA;AAAA,IACP,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS,CAAC,OAAO,CAAA;AAAA,IACjB,GAAA,EAAK,qIAAA;AAAA,IACL,OAAA,EAAS,GAAG,UAAU,CAAA,SAAA;AAAA,GACxB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,0BAAA;AAAA,IACJ,KAAA,EAAO,KAAA;AAAA,IACP,OAAO,CAAA,EAAG,SAAA,CAAU,gBAAgB,CAAA,YAAA,EAAe,UAAU,WAAW,CAAA,qBAAA,CAAA;AAAA,IACxE,QAAA,EAAU,KAAA;AAAA,IACV,OAAA,EAAS,CAAC,SAAS,CAAA;AAAA,IACnB,KAAK,CAAA,4EAAA,EAA+E,SAAA,CAAU,gBAAgB,CAAA,0BAAA,EAA6B,UAAU,WAAW,CAAA,gFAAA,CAAA;AAAA,IAChK,OAAA,EAAS,GAAG,UAAU,CAAA,WAAA;AAAA,GACxB;AAAA,EACA;AAAA,IACE,EAAA,EAAI,eAAA;AAAA,IACJ,KAAA,EAAO,WAAA;AAAA,IACP,KAAA,EAAO,2FAAA;AAAA,IACP,QAAA,EAAU,KAAA;AAAA,IACV,OAAA,EAAS,CAAC,SAAS,CAAA;AAAA,IACnB,OAAO,CAAC,GAAA,KACN,GAAA,CAAI,mBAAA,KAAwB,SACxB,EAAE,EAAA,EAAI,SAAA,EAAW,MAAA,EAAQ,+CAA8C,GACvE,EAAE,EAAA,EAAI,IAAA,EAAM,QAAQ,oCAAA,EAAqC;AAAA,IAC/D,GAAA,EAAK,+LAAA;AAAA,IACL,OAAA,EAAS,GAAG,UAAU,CAAA,cAAA;AAAA;AAE1B;AASA,IAAM,oBAAA,GAAuB,oCAAA;AA0B7B,eAAsB,0BAA0B,CAAA,EAIe;AAC7D,EAAA,MAAM,OAAO,uBAAA,CAAwB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,WAAW,CAAA;AAC1E,EAAA,MAAM,UAAA,GAAa,CAAC,MAAA,MAAuE;AAAA,IACzF,EAAA,EAAI,IAAA;AAAA,IACJ,KAAA,EAAO,IAAA,CAAK,GAAA,CAAI,CAAC,OAAO,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAI,IAAI,SAAA,EAAW,MAAA,EAAQ,GAAA,EAAK,CAAA,CAAE,KAAI,CAAE;AAAA,GAC1E,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,KAAA,EAAO,IAAA,EAAK,IAAK,EAAA;AACjC,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,WAAW,CAAA,EAAG,SAAA,CAAU,KAAK,CAAA,uCAAA,CAAyC,CAAA;AAEzF,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,KAAA,IAAS,UAAA,CAAW,KAAA;AACtC,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,CAAA,EAAG,oBAAoB,CAAA,EAAG,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA,EAAI;AAAA,MAC/E,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,KAAA;AAAA,QAChB,GAAI,EAAE,MAAA,GAAS,EAAE,QAAQ,CAAA,CAAE,MAAA,KAAW;AAAC;AACzC,KACD,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI,OAAO,WAAW,CAAA,wCAAA,EAA2C,GAAA,CAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AACvF,IAAA,MAAM,IAAA,GAAgB,MAAM,GAAA,CAAI,IAAA,EAAK;AACrC,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,SAAS,IAAA,EAAM,OAAO,WAAW,8CAA8C,CAAA;AAC/G,IAAA,GAAA,GAAM,IAAA;AAAA,EACR,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,WAAW,4DAA4D,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAA+B;AACrD,IAAA,IAAI,MAAA,GAAiC,EAAE,EAAA,EAAI,SAAA,EAAW,QAAQ,qBAAA,EAAsB;AACpF,IAAA,IAAI,EAAE,KAAA,EAAO;AACX,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,CAAA,CAAE,KAAA,CAAM,GAAA,EAAK,CAAA,CAAE,MAAA,KAAW,KAAA,CAAA,GAAY,EAAE,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,GAAI,EAAE,CAAA;AAAA,MAC1E,CAAA,CAAA,MAAQ;AACN,QAAA,MAAA,GAAS,EAAE,EAAA,EAAI,SAAA,EAAW,MAAA,EAAQ,4CAAA,EAA6C;AAAA,MACjF;AAAA,IACF;AACA,IAAA,OAAO,MAAA,CAAO,EAAA,KAAO,IAAA,GACjB,EAAE,EAAA,EAAI,EAAE,EAAA,EAAI,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,KACrC,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAI,EAAA,EAAI,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,GAAA,EAAK,CAAA,CAAE,GAAA,EAAI;AAAA,EACnE,CAAC,CAAA;AAED,EAAA,MAAM,KAAK,CAAC,KAAA,CAAM,KAAK,CAAC,CAAA,KAAM,EAAE,EAAA,KAAO,KAAA,IAAS,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,CAAA,CAAE,EAAE,GAAG,QAAQ,CAAA;AACzF,EAAA,OAAO,EAAE,IAAI,KAAA,EAAM;AACrB;AA2BA,eAAsB,sBAAsB,KAAA,EAMZ;AAC9B,EAAA,MAAM,MAAA,GAAS,MAAM,yBAAA,CAA0B;AAAA,IAC7C,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,GAAI,MAAM,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAO,GAAI;AAAC,GAC9D,CAAA;AACD,EAAA,OAAO,KAAA,CAAM,eAAA,CAAgB,GAAA,CAAI,CAAC,GAAA,KAA0B;AAC1D,IAAA,MAAM,EAAA,GAAK,SAAS,GAAG,CAAA,CAAA;AACvB,IAAA,MAAM,MAAM,uBAAA,CAAwB,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,GAAG,CAAA;AAC5D,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,OAAO,EAAE,IAAI,MAAA,EAAQ,MAAA,EAAQ,SAAS,CAAA,+BAAA,EAAkC,GAAG,CAAA,EAAA,CAAA,EAAM,GAAA,EAAK,yCAAA,EAA0C;AAAA,IAClI;AACA,IAAA,IAAI,GAAA,CAAI,UAAU,WAAA,EAAa;AAC7B,MAAA,OAAO,EAAE,IAAI,MAAA,EAAQ,MAAA,EAAQ,SAAS,CAAA,EAAG,GAAA,CAAI,KAAK,CAAA,oDAAA,CAAA,EAAuD;AAAA,IAC3G;AACA,IAAA,MAAM,IAAA,GAAO,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,GAAG,CAAA;AAClD,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,EAAA,KAAO,SAAA,EAAW;AAClC,MAAA,OAAO,EAAE,EAAA,EAAI,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,GAAG,GAAA,CAAI,KAAK,CAAA,yBAAA,EAA4B,IAAA,EAAM,UAAU,EAAE,CAAA,CAAA,CAAG,MAAK,EAAG,GAAA,EAAK,IAAI,GAAA,EAAI;AAAA,IAC1H;AACA,IAAA,OAAO,IAAA,CAAK,EAAA,GACR,EAAE,EAAA,EAAI,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,CAAA,EAAG,GAAA,CAAI,KAAK,CAAA,EAAA,EAAK,IAAA,CAAK,MAAM,CAAA,CAAA,EAAG,GAC9D,EAAE,EAAA,EAAI,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,CAAA,EAAG,GAAA,CAAI,KAAK,CAAA,EAAA,EAAK,IAAA,CAAK,MAAM,CAAA,CAAA,EAAI,GAAA,EAAK,IAAI,GAAA,EAAI;AAAA,EAClF,CAAC,CAAA;AACH","file":"chunk-3XUGQODR.js","sourcesContent":["/**\n * Privy requirements table and dashboard check (`@pepu-chain/sdk/privy`).\n * Client-safe: no secrets, no Privy packages. Re-exported from `config.ts`.\n */\n\n/** Environment variable names the Privy layer reads. Names only, never values. */\nexport const PRIVY_ENV = {\n  appId: \"NEXT_PUBLIC_PRIVY_APP_ID\",\n  appSecret: \"PRIVY_APP_SECRET\",\n  authorizationKey: \"PRIVY_AUTHORIZATION_KEY\",\n  keyQuorumId: \"NEXT_PUBLIC_PRIVY_KEY_QUORUM_ID\",\n} as const;\n\n/**\n * Accepted fallback names, read only when the canonical {@link PRIVY_ENV} name\n * is empty. The canonical name is what docs, the doctor and error messages use.\n */\nexport const PRIVY_ENV_ALIASES = {\n  appId: [\"PRIVY_APP_ID\"],\n  appSecret: [],\n  authorizationKey: [],\n  keyQuorumId: [\"PRIVY_KEY_QUORUM_ID\"],\n} as const satisfies Record<keyof typeof PRIVY_ENV, readonly string[]>;\n\n/**\n * The subset of Privy's public app-config response this SDK looks at. Every\n * field is optional: the endpoint is undocumented, so a missing field means\n * \"unknown\", never \"wrong\".\n */\nexport interface PrivyPublicAppConfig {\n  /** Origins the dashboard allows (scheme, host and port). */\n  allowed_domains?: string[];\n  /** Enabled login methods, e.g. `\"google_oauth\"`, `\"email\"`, `\"wallet\"`. */\n  login_methods?: string[];\n  embedded_wallet_config?: {\n    ethereum?: { create_on_login?: string };\n    [key: string]: unknown;\n  };\n  smart_wallet_config?: unknown;\n  [key: string]: unknown;\n}\n\n/** Result of one requirement check. `\"unknown\"` means it could not be verified. */\nexport interface PrivyRequirementResult {\n  ok: boolean | \"unknown\";\n  detail: string;\n}\n\n/** One row of {@link PEPU_PRIVY_REQUIREMENTS}. */\nexport interface PrivyRequirement {\n  id: string;\n  where: \"dashboard\" | \"env\" | \"code\";\n  label: string;\n  required: boolean;\n  pillars: (\"login\" | \"session\" | \"sponsor\")[];\n  /** Only dashboard rows have a check, and it only sees Privy's public app config. */\n  check?: (cfg: PrivyPublicAppConfig, ctx: { origin?: string }) => PrivyRequirementResult;\n  fix: string;\n  docsUrl: string;\n}\n\nconst PRIVY_DOCS = \"https://guide.pepeunchained.com/privy\";\n\nconst normOrigin = (o: string): string => o.trim().replace(/\\/+$/, \"\").toLowerCase();\n\n/**\n * Everything a PEPU app needs from Privy, as one data table. It feeds the docs,\n * the MCP `pepu_check_privy_config` tool, the CLI `doctor` and in-app notices.\n *\n * @example\n * ```ts\n * import { PEPU_PRIVY_REQUIREMENTS } from \"@pepu-chain/sdk/privy\";\n * const forSessions = PEPU_PRIVY_REQUIREMENTS.filter((r) => r.pillars.includes(\"session\"));\n * ```\n */\nexport const PEPU_PRIVY_REQUIREMENTS: readonly PrivyRequirement[] = [\n  {\n    id: \"app-id\",\n    where: \"env\",\n    label: `${PRIVY_ENV.appId} is set`,\n    required: true,\n    pillars: [\"login\", \"session\", \"sponsor\"],\n    fix: `Copy the App ID from the Privy dashboard (Settings, Basics) into ${PRIVY_ENV.appId}.`,\n    docsUrl: `${PRIVY_DOCS}#app-id`,\n  },\n  {\n    id: \"app-secret\",\n    where: \"env\",\n    label: `${PRIVY_ENV.appSecret} is set (server only)`,\n    required: true,\n    pillars: [\"login\", \"session\", \"sponsor\"],\n    fix: `Create an app secret in the Privy dashboard and put it in ${PRIVY_ENV.appSecret}. Never prefix it with NEXT_PUBLIC_.`,\n    docsUrl: `${PRIVY_DOCS}#app-secret`,\n  },\n  {\n    id: \"allowed-origins\",\n    where: \"dashboard\",\n    label: \"The page origin (including the port) is in Allowed origins\",\n    required: true,\n    pillars: [\"login\", \"session\", \"sponsor\"],\n    check: (cfg, ctx) => {\n      if (!ctx.origin) return { ok: \"unknown\", detail: \"No origin was given to check.\" };\n      if (!Array.isArray(cfg.allowed_domains)) {\n        return { ok: \"unknown\", detail: \"Privy did not report allowed origins.\" };\n      }\n      const want = normOrigin(ctx.origin);\n      const hit = cfg.allowed_domains.some((d) => normOrigin(d) === want || normOrigin(d) === \"*\");\n      return hit\n        ? { ok: true, detail: `${ctx.origin} is allowed.` }\n        : { ok: false, detail: `${ctx.origin} is not in Allowed origins.` };\n    },\n    fix: \"Add the exact origin, scheme, host and port, to Privy dashboard, Configuration, App settings, Allowed origins. A different dev port counts as a different origin.\",\n    docsUrl: `${PRIVY_DOCS}#allowed-origins`,\n  },\n  {\n    id: \"login-methods\",\n    where: \"dashboard\",\n    label: \"At least one login method is enabled\",\n    required: true,\n    pillars: [\"login\"],\n    check: (cfg) => {\n      if (!Array.isArray(cfg.login_methods)) {\n        return { ok: \"unknown\", detail: \"Privy did not report login methods.\" };\n      }\n      return cfg.login_methods.length > 0\n        ? { ok: true, detail: `Enabled: ${cfg.login_methods.join(\", \")}.` }\n        : { ok: false, detail: \"No login methods are enabled.\" };\n    },\n    fix: \"Enable the methods you list in loginMethods under Privy dashboard, User management, Authentication. Methods not enabled there are hidden even if listed in code.\",\n    docsUrl: `${PRIVY_DOCS}#login-methods`,\n  },\n  {\n    id: \"login-methods.google\",\n    where: \"dashboard\",\n    label: \"Google login is enabled\",\n    required: false,\n    pillars: [\"login\"],\n    check: (cfg) => {\n      if (!Array.isArray(cfg.login_methods)) {\n        return { ok: \"unknown\", detail: \"Privy did not report login methods.\" };\n      }\n      return cfg.login_methods.some((m) => m === \"google\" || m === \"google_oauth\")\n        ? { ok: true, detail: \"Google login is enabled.\" }\n        : { ok: false, detail: \"Google login is not enabled.\" };\n    },\n    fix: \"Enable Google under Privy dashboard, User management, Authentication, Socials.\",\n    docsUrl: `${PRIVY_DOCS}#google`,\n  },\n  {\n    id: \"embedded-wallets\",\n    where: \"dashboard\",\n    label: \"Embedded wallets are enabled for Ethereum\",\n    required: true,\n    pillars: [\"login\", \"session\", \"sponsor\"],\n    check: (cfg) => {\n      const eth = cfg.embedded_wallet_config?.ethereum;\n      if (!eth) return { ok: \"unknown\", detail: \"Privy did not report the Ethereum embedded wallet config.\" };\n      const mode = eth.create_on_login;\n      return {\n        ok: true,\n        detail:\n          typeof mode === \"string\"\n            ? `Dashboard create-on-login is \"${mode}\". The SDK provisions wallets server-side either way (WalletGate).`\n            : \"Ethereum embedded wallets are configured.\",\n      };\n    },\n    fix: \"Turn on embedded wallets for Ethereum in Privy dashboard, Wallets. Wallet creation itself is handled server-side by createEnsureWalletRoute().\",\n    docsUrl: `${PRIVY_DOCS}#embedded-wallets`,\n  },\n  {\n    id: \"coinbase-eoa-only\",\n    where: \"code\",\n    label: \"Coinbase Wallet is pinned to eoaOnly\",\n    required: true,\n    pillars: [\"login\"],\n    fix: \"Build the Privy config with createPepuPrivyConfig() (or use PepuPrivyProvider). Coinbase Smart Wallet does not support chain 97741.\",\n    docsUrl: `${PRIVY_DOCS}#coinbase`,\n  },\n  {\n    id: \"authorization-key-quorum\",\n    where: \"env\",\n    label: `${PRIVY_ENV.authorizationKey} is set and ${PRIVY_ENV.keyQuorumId} is its key quorum id`,\n    required: false,\n    pillars: [\"session\"],\n    fix: `Create an authorization key in the Privy dashboard, put the private half in ${PRIVY_ENV.authorizationKey} and its key quorum id in ${PRIVY_ENV.keyQuorumId}. A mismatch gives \"No valid authorization keys or user signing keys available\".`,\n    docsUrl: `${PRIVY_DOCS}#key-quorum`,\n  },\n  {\n    id: \"smart-wallets\",\n    where: \"dashboard\",\n    label: \"Smart wallets are enabled with the PEPU bundler and paymaster URLs (Privy transport only)\",\n    required: false,\n    pillars: [\"sponsor\"],\n    check: (cfg) =>\n      cfg.smart_wallet_config === undefined\n        ? { ok: \"unknown\", detail: \"Privy did not report smart wallet settings.\" }\n        : { ok: true, detail: \"Smart wallet settings are present.\" },\n    fix: \"Only needed for the Privy Smart Wallets transport: add the PEPU chain with bundler and paymaster URLs under Privy dashboard, Wallets, Smart wallets. The direct transport does not need this.\",\n    docsUrl: `${PRIVY_DOCS}#smart-wallets`,\n  },\n];\n\n/**\n * Privy's public app-config endpoint, the one the browser SDK calls itself.\n * Confirmed live: an unknown app id returns HTTP 400\n * `missing_or_invalid_privy_app_id`. The response fields below are NOT\n * verified against a real app (no app id was available when this was written),\n * so every field is treated as optional and maps to \"unknown\" when absent.\n */\nconst PRIVY_APP_CONFIG_URL = \"https://auth.privy.io/api/v1/apps/\";\n\n/** One row of a {@link checkPrivyDashboardConfig} result. */\nexport interface PrivyDashboardCheckItem {\n  id: string;\n  ok: boolean | \"unknown\";\n  detail: string;\n  fix?: string;\n}\n\n/**\n * Check the Privy dashboard settings that can be read without a secret, by\n * calling the public app-config endpoint the browser SDK itself uses. Best\n * effort and never throws: anything that cannot be verified (network error,\n * non-200, field missing) is reported as `\"unknown\"`, not as a failure.\n *\n * Only `where: \"dashboard\"` requirements are returned. Env and code\n * requirements cannot be checked from here.\n *\n * @example\n * ```ts\n * import { checkPrivyDashboardConfig } from \"@pepu-chain/sdk/privy\";\n * const r = await checkPrivyDashboardConfig({ appId: \"cl...\", origin: \"http://localhost:3001\" });\n * for (const i of r.items.filter((i) => i.ok === false)) console.log(i.id, i.fix);\n * ```\n */\nexport async function checkPrivyDashboardConfig(o: {\n  appId: string;\n  origin?: string;\n  fetch?: typeof fetch;\n}): Promise<{ ok: boolean; items: PrivyDashboardCheckItem[] }> {\n  const rows = PEPU_PRIVY_REQUIREMENTS.filter((r) => r.where === \"dashboard\");\n  const unknownAll = (detail: string): { ok: boolean; items: PrivyDashboardCheckItem[] } => ({\n    ok: true,\n    items: rows.map((r) => ({ id: r.id, ok: \"unknown\", detail, fix: r.fix })),\n  });\n\n  const appId = o.appId?.trim() ?? \"\";\n  if (!appId) return unknownAll(`${PRIVY_ENV.appId} is empty, so nothing could be checked.`);\n\n  let cfg: PrivyPublicAppConfig;\n  try {\n    const doFetch = o.fetch ?? globalThis.fetch;\n    const res = await doFetch(`${PRIVY_APP_CONFIG_URL}${encodeURIComponent(appId)}`, {\n      headers: {\n        \"privy-app-id\": appId,\n        ...(o.origin ? { origin: o.origin } : {}),\n      },\n    });\n    if (!res.ok) return unknownAll(`Privy's public app config returned HTTP ${res.status}.`);\n    const json: unknown = await res.json();\n    if (typeof json !== \"object\" || json === null) return unknownAll(\"Privy's public app config was not an object.\");\n    cfg = json as PrivyPublicAppConfig;\n  } catch {\n    return unknownAll(\"Could not reach Privy's public app config (network error).\");\n  }\n\n  const items = rows.map((r): PrivyDashboardCheckItem => {\n    let result: PrivyRequirementResult = { ok: \"unknown\", detail: \"No automatic check.\" };\n    if (r.check) {\n      try {\n        result = r.check(cfg, o.origin !== undefined ? { origin: o.origin } : {});\n      } catch {\n        result = { ok: \"unknown\", detail: \"The check could not read Privy's response.\" };\n      }\n    }\n    return result.ok === true\n      ? { id: r.id, ok: true, detail: result.detail }\n      : { id: r.id, ok: result.ok, detail: result.detail, fix: r.fix };\n  });\n  // Only a definite failure of a required row fails the report.\n  const ok = !items.some((i) => i.ok === false && rows.find((r) => r.id === i.id)?.required);\n  return { ok, items };\n}\n\n/**\n * Structurally identical to `DoctorCheck` in `@pepu-chain/sdk/doctor`\n * (defined locally so `/privy` does not import `/doctor`).\n */\nexport interface PrivyDoctorCheck {\n  id: string;\n  status: \"pass\" | \"fail\" | \"warn\" | \"skip\";\n  message: string;\n  fix?: string;\n}\n\n/**\n * Adapter matching `PrivyDashboardChecker` from `@pepu-chain/sdk/doctor`, so the\n * doctor can run the Privy dashboard checks: pass it as the doctor's injected\n * checker. Unknown keys fail, env and code rows are skipped (the doctor's env\n * check covers them), and anything Privy did not report is a warning, not a\n * failure. `appSecret` is accepted for signature compatibility and never used\n * or logged. Messages contain no URLs or values.\n *\n * @example\n * ```ts\n * import { privyDashboardChecker } from \"@pepu-chain/sdk/privy\";\n * const checks = await privyDashboardChecker({ appId, requirementKeys: [\"login-methods\"], fetch });\n * ```\n */\nexport async function privyDashboardChecker(input: {\n  appId: string;\n  requirementKeys: string[];\n  appSecret?: string;\n  fetch: typeof fetch;\n  origin?: string;\n}): Promise<PrivyDoctorCheck[]> {\n  const report = await checkPrivyDashboardConfig({\n    appId: input.appId,\n    fetch: input.fetch,\n    ...(input.origin !== undefined ? { origin: input.origin } : {}),\n  });\n  return input.requirementKeys.map((key): PrivyDoctorCheck => {\n    const id = `privy.${key}`;\n    const row = PEPU_PRIVY_REQUIREMENTS.find((r) => r.id === key);\n    if (!row) {\n      return { id, status: \"fail\", message: `Unknown Privy requirement key \"${key}\".`, fix: \"Use a key from PEPU_PRIVY_REQUIREMENTS.\" };\n    }\n    if (row.where !== \"dashboard\") {\n      return { id, status: \"skip\", message: `${row.label}: checked by the env/code checks, not the dashboard.` };\n    }\n    const item = report.items.find((i) => i.id === key);\n    if (!item || item.ok === \"unknown\") {\n      return { id, status: \"warn\", message: `${row.label}: could not be verified. ${item?.detail ?? \"\"}`.trim(), fix: row.fix };\n    }\n    return item.ok\n      ? { id, status: \"pass\", message: `${row.label}: ${item.detail}` }\n      : { id, status: \"fail\", message: `${row.label}: ${item.detail}`, fix: row.fix };\n  });\n}\n"]}

package/dist/chunk-45KSZH26.cjs

@@ -0,0 +1,145 @@
+'use strict';
+
+var chunkSVWRRALU_cjs = require('./chunk-SVWRRALU.cjs');
+var chunkC2XW44FI_cjs = require('./chunk-C2XW44FI.cjs');
+var chunkYQL7NISX_cjs = require('./chunk-YQL7NISX.cjs');
+var node = require('@privy-io/node');
+
+chunkSVWRRALU_cjs.assertServerOnly("@pepu-chain/sdk/privy/server");
+function privyEnvVar(name) {
+  const env = typeof process !== "undefined" ? process.env : {};
+  for (const n of [chunkC2XW44FI_cjs.PRIVY_ENV[name], ...chunkC2XW44FI_cjs.PRIVY_ENV_ALIASES[name]]) {
+    const v = env[n]?.trim();
+    if (v) return v;
+  }
+  return void 0;
+}
+function readPrivyServerEnv(o = {}) {
+  const appId = (o.appId ?? privyEnvVar("appId") ?? "").trim();
+  const appSecret = (o.appSecret ?? privyEnvVar("appSecret") ?? "").trim();
+  const authorizationKey = (o.authorizationKey ?? privyEnvVar("authorizationKey") ?? "").trim();
+  const keyQuorumId = (o.keyQuorumId ?? privyEnvVar("keyQuorumId") ?? "").trim();
+  const missing = [];
+  if (!appId) missing.push(chunkC2XW44FI_cjs.PRIVY_ENV.appId);
+  if (!appSecret) missing.push(chunkC2XW44FI_cjs.PRIVY_ENV.appSecret);
+  if (missing.length > 0) {
+    throw new chunkYQL7NISX_cjs.PepuConfigError("CONFIG_MISSING_ENV", `Missing required env: ${missing.join(", ")}. See .env.example.`, {
+      details: { missing }
+    });
+  }
+  return {
+    appId,
+    appSecret,
+    ...authorizationKey ? { authorizationKey } : {},
+    ...keyQuorumId ? { keyQuorumId } : {}
+  };
+}
+var clientCache = /* @__PURE__ */ new Map();
+function createPrivyServer(o = {}) {
+  const { appId, appSecret } = readPrivyServerEnv(o);
+  const key = `${appId}\0${appSecret}`;
+  let client = clientCache.get(key);
+  if (!client) {
+    client = new node.PrivyClient({ appId, appSecret });
+    clientCache.set(key, client);
+  }
+  return client;
+}
+var redact = (text, secret) => secret ? text.split(secret).join("[redacted]") : text;
+async function verifyRequestUser(request, o = {}) {
+  const header = request.headers.get("authorization") ?? "";
+  const token = header.replace(/^Bearer\s+/i, "").trim();
+  if (!token) {
+    throw new chunkYQL7NISX_cjs.PepuAuthError("AUTH_INVALID_TOKEN", "Missing Privy access token. Send Authorization: Bearer <token>.");
+  }
+  const privy = o.privy ?? createPrivyServer();
+  try {
+    const claims = await privy.utils().auth().verifyAccessToken(token);
+    return { userId: claims.user_id, claims };
+  } catch (e) {
+    const reason = redact(e instanceof Error ? e.message : String(e), token);
+    throw new chunkYQL7NISX_cjs.PepuAuthError("AUTH_INVALID_TOKEN", "Invalid or expired Privy access token.", {
+      details: { reason }
+    });
+  }
+}
+function findEmbeddedEthereumWallet(user) {
+  for (const account of user.linked_accounts) {
+    if (node.isEmbeddedWalletLinkedAccount(account) && account.chain_type === "ethereum") return account;
+  }
+  return null;
+}
+function findDelegatedEthereumWallet(user) {
+  for (const account of user.linked_accounts) {
+    if (node.isEmbeddedWalletLinkedAccount(account) && account.chain_type === "ethereum" && account.delegated) {
+      return account;
+    }
+  }
+  return null;
+}
+async function requireUser(request, o = {}) {
+  try {
+    const privy = o.privy ?? createPrivyServer();
+    const { userId } = await verifyRequestUser(request, { privy });
+    let privyUser;
+    try {
+      privyUser = await privy.users()._get(userId);
+    } catch (e) {
+      throw new chunkYQL7NISX_cjs.PepuError("UNKNOWN", "Could not look up the user in Privy.", { status: 502, retryable: true, cause: e });
+    }
+    const wallet = findEmbeddedEthereumWallet(privyUser);
+    return { ok: true, user: { userId, address: wallet?.address ?? null, privyUser } };
+  } catch (e) {
+    return { ok: false, response: chunkYQL7NISX_cjs.toErrorResponse(e) };
+  }
+}
+function createEnsureWalletRoute(o = {}) {
+  return {
+    async POST(request) {
+      let privy;
+      try {
+        privy = o.privy ?? createPrivyServer();
+      } catch (e) {
+        return chunkYQL7NISX_cjs.toErrorResponse(e);
+      }
+      const auth = await requireUser(request, { privy });
+      if (!auth.ok) return auth.response;
+      const { userId, address } = auth.user;
+      if (address) return Response.json({ address, created: false });
+      try {
+        const wallet = await privy.wallets().create({ chain_type: "ethereum", owner: { user_id: userId } });
+        const created = wallet.address;
+        if (o.onCreated) {
+          try {
+            await o.onCreated({ userId, address: created });
+          } catch {
+          }
+        }
+        return Response.json({ address: created, created: true });
+      } catch (createError) {
+        try {
+          const again = findEmbeddedEthereumWallet(await privy.users()._get(userId));
+          if (again) return Response.json({ address: again.address, created: false });
+        } catch {
+        }
+        return chunkYQL7NISX_cjs.toErrorResponse(
+          new chunkYQL7NISX_cjs.PepuError("WALLET_NOT_PROVISIONED", "Could not create a wallet.", {
+            status: 502,
+            cause: chunkYQL7NISX_cjs.toPepuError(createError)
+          })
+        );
+      }
+    }
+  };
+}
+
+exports.createEnsureWalletRoute = createEnsureWalletRoute;
+exports.createPrivyServer = createPrivyServer;
+exports.findDelegatedEthereumWallet = findDelegatedEthereumWallet;
+exports.findEmbeddedEthereumWallet = findEmbeddedEthereumWallet;
+exports.privyEnvVar = privyEnvVar;
+exports.readPrivyServerEnv = readPrivyServerEnv;
+exports.requireUser = requireUser;
+exports.verifyRequestUser = verifyRequestUser;
+//# sourceMappingURL=chunk-45KSZH26.cjs.map
+//# sourceMappingURL=chunk-45KSZH26.cjs.map

package/dist/chunk-45KSZH26.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/privy/server.ts"],"names":["assertServerOnly","PRIVY_ENV","PRIVY_ENV_ALIASES","PepuConfigError","PrivyClient","PepuAuthError","isEmbeddedWalletLinkedAccount","PepuError","toErrorResponse","toPepuError"],"mappings":";;;;;;;AAOAA,kCAAA,CAAiB,8BAA8B,CAAA;AAgDxC,SAAS,YAAY,IAAA,EAAkD;AAC5E,EAAA,MAAM,MAAM,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,MAAM,EAAC;AAC5D,EAAA,KAAA,MAAW,CAAA,IAAK,CAACC,2BAAA,CAAU,IAAI,GAAG,GAAGC,mCAAA,CAAkB,IAAI,CAAC,CAAA,EAAG;AAC7D,IAAA,MAAM,CAAA,GAAI,GAAA,CAAI,CAAC,CAAA,EAAG,IAAA,EAAK;AACvB,IAAA,IAAI,GAAG,OAAO,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,MAAA;AACT;AAYO,SAAS,kBAAA,CAAmB,CAAA,GAA6F,EAAC,EAAmB;AAClJ,EAAA,MAAM,SAAS,CAAA,CAAE,KAAA,IAAS,YAAY,OAAO,CAAA,IAAK,IAAI,IAAA,EAAK;AAC3D,EAAA,MAAM,aAAa,CAAA,CAAE,SAAA,IAAa,YAAY,WAAW,CAAA,IAAK,IAAI,IAAA,EAAK;AACvE,EAAA,MAAM,oBAAoB,CAAA,CAAE,gBAAA,IAAoB,YAAY,kBAAkB,CAAA,IAAK,IAAI,IAAA,EAAK;AAC5F,EAAA,MAAM,eAAe,CAAA,CAAE,WAAA,IAAe,YAAY,aAAa,CAAA,IAAK,IAAI,IAAA,EAAK;AAC7E,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,IAAI,CAAC,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAKD,4BAAU,KAAK,CAAA;AACxC,EAAA,IAAI,CAAC,SAAA,EAAW,OAAA,CAAQ,IAAA,CAAKA,4BAAU,SAAS,CAAA;AAChD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,MAAM,IAAIE,kCAAgB,oBAAA,EAAsB,CAAA,sBAAA,EAAyB,QAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,mBAAA,CAAA,EAAuB;AAAA,MAChH,OAAA,EAAS,EAAE,OAAA;AAAQ,KACpB,CAAA;AAAA,EACH;AACA,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,SAAA;AAAA,IACA,GAAI,gBAAA,GAAmB,EAAE,gBAAA,KAAqB,EAAC;AAAA,IAC/C,GAAI,WAAA,GAAc,EAAE,WAAA,KAAgB;AAAC,GACvC;AACF;AAEA,IAAM,WAAA,uBAAkB,GAAA,EAAyB;AAgB1C,SAAS,iBAAA,CAAkB,CAAA,GAA6F,EAAC,EAAgB;AAC9I,EAAA,MAAM,EAAE,KAAA,EAAO,SAAA,EAAU,GAAI,mBAAmB,CAAC,CAAA;AACjD,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,KAAK,CAAA,EAAA,EAAS,SAAS,CAAA,CAAA;AACtC,EAAA,IAAI,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,IAAIC,gBAAA,CAAY,EAAE,KAAA,EAAO,WAAW,CAAA;AAC7C,IAAA,WAAA,CAAY,GAAA,CAAI,KAAK,MAAM,CAAA;AAAA,EAC7B;AACA,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,MAAA,GAAS,CAAC,IAAA,EAAc,MAAA,KAA4B,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,IAAA,CAAK,YAAY,CAAA,GAAI,IAAA;AAoB3G,eAAsB,iBAAA,CACpB,OAAA,EACA,CAAA,GAA6B,EAAC,EACgB;AAC9C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACvD,EAAA,MAAM,QAAQ,MAAA,CAAO,OAAA,CAAQ,aAAA,EAAe,EAAE,EAAE,IAAA,EAAK;AACrD,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAIC,+BAAA,CAAc,oBAAA,EAAsB,iEAAiE,CAAA;AAAA,EACjH;AACA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,KAAA,IAAS,iBAAA,EAAkB;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,KAAA,GAAQ,IAAA,EAAK,CAAE,kBAAkB,KAAK,CAAA;AACjE,IAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,OAAA,EAAS,MAAA,EAAO;AAAA,EAC1C,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,MAAA,GAAS,OAAO,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAA,EAAG,KAAK,CAAA;AACvE,IAAA,MAAM,IAAIA,+BAAA,CAAc,oBAAA,EAAsB,wCAAA,EAA0C;AAAA,MACtF,OAAA,EAAS,EAAE,MAAA;AAAO,KACnB,CAAA;AAAA,EACH;AACF;AAaO,SAAS,2BAA2B,IAAA,EAAsC;AAC/E,EAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,IAAA,IAAIC,mCAA8B,OAAO,CAAA,IAAK,OAAA,CAAQ,UAAA,KAAe,YAAY,OAAO,OAAA;AAAA,EAC1F;AACA,EAAA,OAAO,IAAA;AACT;AAaO,SAAS,4BAA4B,IAAA,EAAsC;AAChF,EAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,IAAA,IAAIA,mCAA8B,OAAO,CAAA,IAAK,QAAQ,UAAA,KAAe,UAAA,IAAc,QAAQ,SAAA,EAAW;AACpG,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAkBA,eAAsB,WAAA,CACpB,OAAA,EACA,CAAA,GAA6B,EAAC,EAC6C;AAC3E,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,KAAA,IAAS,iBAAA,EAAkB;AAC3C,IAAA,MAAM,EAAE,QAAO,GAAI,MAAM,kBAAkB,OAAA,EAAS,EAAE,OAAO,CAAA;AAC7D,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI;AACF,MAAA,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,EAAM,CAAE,KAAK,MAAM,CAAA;AAAA,IAC7C,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAIC,2BAAA,CAAU,SAAA,EAAW,sCAAA,EAAwC,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,CAAA,EAAG,CAAA;AAAA,IACnH;AACA,IAAA,MAAM,MAAA,GAAS,2BAA2B,SAAS,CAAA;AACnD,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,EAAE,MAAA,EAAQ,OAAA,EAAU,MAAA,EAAQ,OAAA,IAAmC,IAAA,EAAM,SAAA,EAAU,EAAE;AAAA,EAC5G,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAA,EAAUC,iCAAA,CAAgB,CAAC,CAAA,EAAE;AAAA,EACnD;AACF;AA4BO,SAAS,uBAAA,CACd,CAAA,GAGI,EAAC,EAC0C;AAC/C,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,OAAA,EAAqC;AAC9C,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI;AACF,QAAA,KAAA,GAAQ,CAAA,CAAE,SAAS,iBAAA,EAAkB;AAAA,MACvC,SAAS,CAAA,EAAG;AACV,QAAA,OAAOA,kCAAgB,CAAC,CAAA;AAAA,MAC1B;AACA,MAAA,MAAM,OAAO,MAAM,WAAA,CAAY,OAAA,EAAS,EAAE,OAAO,CAAA;AACjD,MAAA,IAAI,CAAC,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,QAAA;AAC1B,MAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,EAAQ,GAAI,IAAA,CAAK,IAAA;AACjC,MAAA,IAAI,OAAA,SAAgB,QAAA,CAAS,IAAA,CAAK,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,CAAA;AAE7D,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,EAAE,UAAA,EAAY,UAAA,EAAY,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,IAAU,CAAA;AAClG,QAAA,MAAM,UAAU,MAAA,CAAO,OAAA;AACvB,QAAA,IAAI,EAAE,SAAA,EAAW;AACf,UAAA,IAAI;AACF,YAAA,MAAM,EAAE,SAAA,CAAU,EAAE,MAAA,EAAQ,OAAA,EAAS,SAAS,CAAA;AAAA,UAChD,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AACA,QAAA,OAAO,SAAS,IAAA,CAAK,EAAE,SAAS,OAAA,EAAS,OAAA,EAAS,MAAM,CAAA;AAAA,MAC1D,SAAS,WAAA,EAAa;AAGpB,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,GAAQ,2BAA2B,MAAM,KAAA,CAAM,OAAM,CAAE,IAAA,CAAK,MAAM,CAAC,CAAA;AACzE,UAAA,IAAI,KAAA,EAAO,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,SAAS,KAAA,CAAM,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,CAAA;AAAA,QAC5E,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAOA,iCAAA;AAAA,UACL,IAAID,2BAAA,CAAU,wBAAA,EAA0B,4BAAA,EAA8B;AAAA,YACpE,MAAA,EAAQ,GAAA;AAAA,YACR,KAAA,EAAOE,8BAAY,WAAW;AAAA,WAC/B;AAAA,SACH;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF","file":"chunk-45KSZH26.cjs","sourcesContent":["import { isEmbeddedWalletLinkedAccount, PrivyClient } from \"@privy-io/node\";\nimport type { LinkedAccount, LinkedAccountEmbeddedWallet } from \"@privy-io/node\";\nimport type { Address } from \"viem\";\nimport { assertServerOnly } from \"../internal/assert-server.js\";\nimport { PepuAuthError, PepuConfigError, PepuError, toErrorResponse, toPepuError } from \"../errors.js\";\nimport { PRIVY_ENV, PRIVY_ENV_ALIASES } from \"./requirements.js\";\n\nassertServerOnly(\"@pepu-chain/sdk/privy/server\");\n\n/**\n * `@pepu-chain/sdk/privy/server` (server). Privy server client, access-token\n * verification and the ensure-wallet route factory. Never import it from\n * client code: it calls `assertServerOnly()` at import.\n *\n * Optional peer: `@privy-io/node`.\n */\n\n/** A Privy linked embedded-wallet account. */\nexport type LinkedWallet = LinkedAccountEmbeddedWallet;\n\n/** The part of a Privy user object these helpers read. */\nexport interface PrivyUser {\n  linked_accounts: readonly LinkedAccount[];\n}\n\n/** The authenticated caller, as returned by {@link requireUser}. */\nexport interface PepuUser {\n  /** The Privy user id, only ever taken from a verified access token. */\n  userId: string;\n  /** The user's embedded Ethereum wallet address, `null` if not provisioned yet. */\n  address: Address | null;\n  /** The Privy user object the address was read from. */\n  privyUser: PrivyUser;\n}\n\n/** Server-side Privy configuration read from the environment. */\nexport interface PrivyServerEnv {\n  appId: string;\n  appSecret: string;\n  /** Private half of the authorization key. Only sessions need it. */\n  authorizationKey?: string;\n  /** The key quorum id sessions grant. Only sessions need it. */\n  keyQuorumId?: string;\n}\n\n/**\n * The single reader for the Privy variables ({@link PRIVY_ENV}, then its\n * aliases). Trimmed; `undefined` when unset or blank. Session routes use it\n * too, so every module agrees on names.\n *\n * @example\n * ```ts\n * const quorum = privyEnvVar(\"keyQuorumId\");\n * ```\n */\nexport function privyEnvVar(name: keyof typeof PRIVY_ENV): string | undefined {\n  const env = typeof process !== \"undefined\" ? process.env : {};\n  for (const n of [PRIVY_ENV[name], ...PRIVY_ENV_ALIASES[name]]) {\n    const v = env[n]?.trim();\n    if (v) return v;\n  }\n  return undefined;\n}\n\n/**\n * Read the Privy server variables ({@link PRIVY_ENV}), explicit options winning.\n * Throws a `PepuConfigError` that lists every missing variable by NAME only.\n * `PRIVY_AUTHORIZATION_KEY` is optional here (ensure-wallet never needs it).\n *\n * @example\n * ```ts\n * const { appId, appSecret } = readPrivyServerEnv();\n * ```\n */\nexport function readPrivyServerEnv(o: { appId?: string; appSecret?: string; authorizationKey?: string; keyQuorumId?: string } = {}): PrivyServerEnv {\n  const appId = (o.appId ?? privyEnvVar(\"appId\") ?? \"\").trim();\n  const appSecret = (o.appSecret ?? privyEnvVar(\"appSecret\") ?? \"\").trim();\n  const authorizationKey = (o.authorizationKey ?? privyEnvVar(\"authorizationKey\") ?? \"\").trim();\n  const keyQuorumId = (o.keyQuorumId ?? privyEnvVar(\"keyQuorumId\") ?? \"\").trim();\n  const missing: string[] = [];\n  if (!appId) missing.push(PRIVY_ENV.appId);\n  if (!appSecret) missing.push(PRIVY_ENV.appSecret);\n  if (missing.length > 0) {\n    throw new PepuConfigError(\"CONFIG_MISSING_ENV\", `Missing required env: ${missing.join(\", \")}. See .env.example.`, {\n      details: { missing },\n    });\n  }\n  return {\n    appId,\n    appSecret,\n    ...(authorizationKey ? { authorizationKey } : {}),\n    ...(keyQuorumId ? { keyQuorumId } : {}),\n  };\n}\n\nconst clientCache = new Map<string, PrivyClient>();\n\n/**\n * A cached `PrivyClient` (`@privy-io/node`) built from {@link PRIVY_ENV}. One\n * instance per distinct credential set. The authorization key is not given to\n * the client: Privy takes it per request (`authorization_context`), see\n * {@link readPrivyServerEnv}.\n *\n * Ported from templates/consumer-app/lib/privy-server.ts.\n *\n * @example\n * ```ts\n * const privy = createPrivyServer();\n * const user = await privy.users()._get(userId);\n * ```\n */\nexport function createPrivyServer(o: { appId?: string; appSecret?: string; authorizationKey?: string; keyQuorumId?: string } = {}): PrivyClient {\n  const { appId, appSecret } = readPrivyServerEnv(o);\n  const key = `${appId}\\u0000${appSecret}`;\n  let client = clientCache.get(key);\n  if (!client) {\n    client = new PrivyClient({ appId, appSecret });\n    clientCache.set(key, client);\n  }\n  return client;\n}\n\nconst redact = (text: string, secret: string): string => (secret ? text.split(secret).join(\"[redacted]\") : text);\n\n/**\n * Verify the `Authorization: Bearer <token>` header against Privy and return the\n * caller's Privy user id and claims. Throws `PepuAuthError` (`AUTH_INVALID_TOKEN`,\n * HTTP 401) when the header is missing or the token does not verify. The reason\n * Privy gave goes in `details.reason` (token redacted): a verification failure\n * caused by a mismatched `PRIVY_APP_SECRET` looks exactly like an expired\n * session, so check it first.\n *\n * Note `verifyAccessToken(token)` on `privy.utils().auth()` takes a bare string,\n * not `{ access_token }` (that is the standalone function's signature).\n *\n * Ported from templates/consumer-app/lib/privy-auth.ts.\n *\n * @example\n * ```ts\n * const { userId } = await verifyRequestUser(request);\n * ```\n */\nexport async function verifyRequestUser(\n  request: Request,\n  o: { privy?: PrivyClient } = {},\n): Promise<{ userId: string; claims: unknown }> {\n  const header = request.headers.get(\"authorization\") ?? \"\";\n  const token = header.replace(/^Bearer\\s+/i, \"\").trim();\n  if (!token) {\n    throw new PepuAuthError(\"AUTH_INVALID_TOKEN\", \"Missing Privy access token. Send Authorization: Bearer <token>.\");\n  }\n  const privy = o.privy ?? createPrivyServer();\n  try {\n    const claims = await privy.utils().auth().verifyAccessToken(token);\n    return { userId: claims.user_id, claims };\n  } catch (e) {\n    const reason = redact(e instanceof Error ? e.message : String(e), token);\n    throw new PepuAuthError(\"AUTH_INVALID_TOKEN\", \"Invalid or expired Privy access token.\", {\n      details: { reason },\n    });\n  }\n}\n\n/**\n * The user's Ethereum embedded wallet (delegated or not), or `null`. This is\n * what makes ensure-wallet idempotent.\n *\n * Ported from templates/consumer-app/lib/privy-user.ts.\n *\n * @example\n * ```ts\n * const wallet = findEmbeddedEthereumWallet(user);\n * ```\n */\nexport function findEmbeddedEthereumWallet(user: PrivyUser): LinkedWallet | null {\n  for (const account of user.linked_accounts) {\n    if (isEmbeddedWalletLinkedAccount(account) && account.chain_type === \"ethereum\") return account;\n  }\n  return null;\n}\n\n/**\n * The user's Ethereum embedded wallet that has been delegated (granted a\n * session signer), or `null`.\n *\n * Ported from templates/game-app/lib/privy-user.ts.\n *\n * @example\n * ```ts\n * const wallet = findDelegatedEthereumWallet(user);\n * ```\n */\nexport function findDelegatedEthereumWallet(user: PrivyUser): LinkedWallet | null {\n  for (const account of user.linked_accounts) {\n    if (isEmbeddedWalletLinkedAccount(account) && account.chain_type === \"ethereum\" && account.delegated) {\n      return account;\n    }\n  }\n  return null;\n}\n\n/**\n * Authenticate a request for a route handler. On success returns the user id\n * (from the verified token only) and the user's embedded wallet address. On\n * failure returns a ready JSON `Response` (`{ error: { code, message, hint } }`:\n * 401 for a bad token, 500 for missing config, 502 if Privy cannot be reached).\n * Never throws.\n *\n * @example\n * ```ts\n * export async function POST(request: Request) {\n *   const auth = await requireUser(request);\n *   if (!auth.ok) return auth.response;\n *   return Response.json({ userId: auth.user.userId });\n * }\n * ```\n */\nexport async function requireUser(\n  request: Request,\n  o: { privy?: PrivyClient } = {},\n): Promise<{ ok: true; user: PepuUser } | { ok: false; response: Response }> {\n  try {\n    const privy = o.privy ?? createPrivyServer();\n    const { userId } = await verifyRequestUser(request, { privy });\n    let privyUser: PrivyUser;\n    try {\n      privyUser = await privy.users()._get(userId);\n    } catch (e) {\n      throw new PepuError(\"UNKNOWN\", \"Could not look up the user in Privy.\", { status: 502, retryable: true, cause: e });\n    }\n    const wallet = findEmbeddedEthereumWallet(privyUser);\n    return { ok: true, user: { userId, address: (wallet?.address as Address | undefined) ?? null, privyUser } };\n  } catch (e) {\n    return { ok: false, response: toErrorResponse(e) };\n  }\n}\n\n/**\n * Next.js route handler that creates the signed-in user's Ethereum embedded\n * wallet server-side if they have none. Drop-in:\n * `export const { POST } = createEnsureWalletRoute();` in\n * `app/api/wallet/ensure/route.ts`.\n *\n * Why: Privy's own client-side creation hangs forever for apps whose dashboard\n * creation setting is off; pair it with `createOnLogin: \"off\"` (the default of\n * `createPepuPrivyConfig`) and `WalletGate`.\n *\n * - CUSTODY: the wallet is created with `owner: { user_id }`. This backend holds\n *   no signing authority over it. Do not add a session signer here.\n * - SECURITY: the user id comes only from the verified access token, never from\n *   the body or query string.\n * - IDEMPOTENT: it looks for an existing wallet first and re-checks after a\n *   failed create, so a double submit never makes a second wallet.\n *\n * Ported from templates/consumer-app/app/api/wallet/ensure/route.ts.\n *\n * @example\n * ```ts\n * // app/api/wallet/ensure/route.ts\n * import { createEnsureWalletRoute } from \"@pepu-chain/sdk/privy/server\";\n * export const { POST } = createEnsureWalletRoute();\n * ```\n */\nexport function createEnsureWalletRoute(\n  o: {\n    privy?: PrivyClient;\n    onCreated?: (c: { userId: string; address: Address }) => Promise<void>;\n  } = {},\n): { POST(request: Request): Promise<Response> } {\n  return {\n    async POST(request: Request): Promise<Response> {\n      let privy: PrivyClient;\n      try {\n        privy = o.privy ?? createPrivyServer();\n      } catch (e) {\n        return toErrorResponse(e);\n      }\n      const auth = await requireUser(request, { privy });\n      if (!auth.ok) return auth.response;\n      const { userId, address } = auth.user;\n      if (address) return Response.json({ address, created: false });\n\n      try {\n        const wallet = await privy.wallets().create({ chain_type: \"ethereum\", owner: { user_id: userId } });\n        const created = wallet.address as Address;\n        if (o.onCreated) {\n          try {\n            await o.onCreated({ userId, address: created });\n          } catch {\n            // The wallet exists; a failing hook must not turn that into an error.\n          }\n        }\n        return Response.json({ address: created, created: true });\n      } catch (createError) {\n        // Race guard: a concurrent request may have created the wallet between\n        // the check above and this call. Re-check before surfacing a failure.\n        try {\n          const again = findEmbeddedEthereumWallet(await privy.users()._get(userId));\n          if (again) return Response.json({ address: again.address, created: false });\n        } catch {\n          // fall through to the create error\n        }\n        return toErrorResponse(\n          new PepuError(\"WALLET_NOT_PROVISIONED\", \"Could not create a wallet.\", {\n            status: 502,\n            cause: toPepuError(createError),\n          }),\n        );\n      }\n    },\n  };\n}\n"]}

package/dist/chunk-4GINFJO6.cjs

@@ -0,0 +1,44 @@
+'use strict';
+
+var chunkDPCZJLB3_cjs = require('./chunk-DPCZJLB3.cjs');
+
+// src/explorer.ts
+function explorerUrl(chain, type, value) {
+  const explorer = chain.blockExplorers?.default;
+  if (!explorer) {
+    throw new Error(
+      `explorerUrl: no block explorer is configured for chain "${chain.name}" (id ${chain.id}).`
+    );
+  }
+  return `${explorer.url}/${type}/${value}`;
+}
+function txUrl(chain, hash) {
+  return explorerUrl(chain, "tx", hash);
+}
+function addressUrl(chain, address) {
+  return explorerUrl(chain, "address", address);
+}
+function tokenUrl(chain, address) {
+  return explorerUrl(chain, "token", address);
+}
+function blockUrl(chain, blockNumberOrHash) {
+  return explorerUrl(chain, "block", blockNumberOrHash);
+}
+function explorerLinks(o, chain = chunkDPCZJLB3_cjs.pepuMainnet) {
+  const out = {};
+  if (o.tx !== void 0) out.tx = txUrl(chain, o.tx);
+  if (o.address !== void 0) out.address = addressUrl(chain, o.address);
+  if (o.sender !== void 0) out.sender = addressUrl(chain, o.sender);
+  if (o.token !== void 0) out.token = tokenUrl(chain, o.token);
+  if (o.block !== void 0) out.block = blockUrl(chain, String(o.block));
+  return out;
+}
+
+exports.addressUrl = addressUrl;
+exports.blockUrl = blockUrl;
+exports.explorerLinks = explorerLinks;
+exports.explorerUrl = explorerUrl;
+exports.tokenUrl = tokenUrl;
+exports.txUrl = txUrl;
+//# sourceMappingURL=chunk-4GINFJO6.cjs.map
+//# sourceMappingURL=chunk-4GINFJO6.cjs.map

package/dist/chunk-4GINFJO6.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/explorer.ts"],"names":["pepuMainnet"],"mappings":";;;;;AAaO,SAAS,WAAA,CACd,KAAA,EACA,IAAA,EACA,KAAA,EACQ;AACR,EAAA,MAAM,QAAA,GAAW,MAAM,cAAA,EAAgB,OAAA;AACvC,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wDAAA,EAA2D,KAAA,CAAM,IAAI,CAAA,MAAA,EAAS,MAAM,EAAE,CAAA,EAAA;AAAA,KACxF;AAAA,EACF;AACA,EAAA,OAAO,GAAG,QAAA,CAAS,GAAG,CAAA,CAAA,EAAI,IAAI,IAAI,KAAK,CAAA,CAAA;AACzC;AAGO,SAAS,KAAA,CAAM,OAAkB,IAAA,EAAsB;AAC5D,EAAA,OAAO,WAAA,CAAY,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AACtC;AAGO,SAAS,UAAA,CAAW,OAAkB,OAAA,EAAyB;AACpE,EAAA,OAAO,WAAA,CAAY,KAAA,EAAO,SAAA,EAAW,OAAO,CAAA;AAC9C;AAGO,SAAS,QAAA,CAAS,OAAkB,OAAA,EAAyB;AAClE,EAAA,OAAO,WAAA,CAAY,KAAA,EAAO,OAAA,EAAS,OAAO,CAAA;AAC5C;AAGO,SAAS,QAAA,CAAS,OAAkB,iBAAA,EAA4C;AACrF,EAAA,OAAO,WAAA,CAAY,KAAA,EAAO,OAAA,EAAS,iBAAiB,CAAA;AACtD;AAaO,SAAS,aAAA,CACd,CAAA,EAOA,KAAA,GAAmBA,6BAAA,EACiE;AACpF,EAAA,MAAM,MAA0F,EAAC;AACjG,EAAA,IAAI,CAAA,CAAE,OAAO,MAAA,EAAW,GAAA,CAAI,KAAK,KAAA,CAAM,KAAA,EAAO,EAAE,EAAE,CAAA;AAClD,EAAA,IAAI,CAAA,CAAE,YAAY,MAAA,EAAW,GAAA,CAAI,UAAU,UAAA,CAAW,KAAA,EAAO,EAAE,OAAO,CAAA;AACtE,EAAA,IAAI,CAAA,CAAE,WAAW,MAAA,EAAW,GAAA,CAAI,SAAS,UAAA,CAAW,KAAA,EAAO,EAAE,MAAM,CAAA;AACnE,EAAA,IAAI,CAAA,CAAE,UAAU,MAAA,EAAW,GAAA,CAAI,QAAQ,QAAA,CAAS,KAAA,EAAO,EAAE,KAAK,CAAA;AAC9D,EAAA,IAAI,CAAA,CAAE,KAAA,KAAU,MAAA,EAAW,GAAA,CAAI,KAAA,GAAQ,SAAS,KAAA,EAAO,MAAA,CAAO,CAAA,CAAE,KAAK,CAAC,CAAA;AACtE,EAAA,OAAO,GAAA;AACT","file":"chunk-4GINFJO6.cjs","sourcesContent":["import { type PepuChain, pepuMainnet } from \"./chains.js\";\n\n/** Resource types supported by Blockscout's URL scheme. */\nexport type ExplorerResourceType = \"tx\" | \"address\" | \"token\" | \"block\";\n\n/**\n * Build a Blockscout explorer URL for a transaction hash, address, token\n * address, or block (by number or hash) on a Pepe Unchained V2 chain.\n *\n * Throws if the given chain has no `blockExplorers.default` configured\n * (this is currently the case for {@link pepuTestnet} — see `chains.ts`\n * for why).\n */\nexport function explorerUrl(\n  chain: PepuChain,\n  type: ExplorerResourceType,\n  value: string | number,\n): string {\n  const explorer = chain.blockExplorers?.default;\n  if (!explorer) {\n    throw new Error(\n      `explorerUrl: no block explorer is configured for chain \"${chain.name}\" (id ${chain.id}).`,\n    );\n  }\n  return `${explorer.url}/${type}/${value}`;\n}\n\n/** Build a transaction-page URL. Shorthand for `explorerUrl(chain, \"tx\", hash)`. */\nexport function txUrl(chain: PepuChain, hash: string): string {\n  return explorerUrl(chain, \"tx\", hash);\n}\n\n/** Build an address-page URL. Shorthand for `explorerUrl(chain, \"address\", address)`. */\nexport function addressUrl(chain: PepuChain, address: string): string {\n  return explorerUrl(chain, \"address\", address);\n}\n\n/** Build a token-page URL. Shorthand for `explorerUrl(chain, \"token\", address)`. */\nexport function tokenUrl(chain: PepuChain, address: string): string {\n  return explorerUrl(chain, \"token\", address);\n}\n\n/** Build a block-page URL, by block number or block hash. Shorthand for `explorerUrl(chain, \"block\", value)`. */\nexport function blockUrl(chain: PepuChain, blockNumberOrHash: string | number): string {\n  return explorerUrl(chain, \"block\", blockNumberOrHash);\n}\n\n/**\n * Convenience bundle of explorer links. pepuscan (Blockscout) has no UserOp\n * pages, so a UserOperation is linked through its bundle `tx` and its\n * `sender` (the smart account address).\n *\n * @example\n * ```ts\n * explorerLinks({ tx: \"0xabc\", sender: \"0xdef\" });\n * // { tx: \"https://pepuscan.com/tx/0xabc\", sender: \"https://pepuscan.com/address/0xdef\" }\n * ```\n */\nexport function explorerLinks(\n  o: {\n    tx?: string;\n    address?: string;\n    sender?: string;\n    token?: string;\n    block?: bigint | number | string;\n  },\n  chain: PepuChain = pepuMainnet,\n): { tx?: string; address?: string; sender?: string; token?: string; block?: string } {\n  const out: { tx?: string; address?: string; sender?: string; token?: string; block?: string } = {};\n  if (o.tx !== undefined) out.tx = txUrl(chain, o.tx);\n  if (o.address !== undefined) out.address = addressUrl(chain, o.address);\n  if (o.sender !== undefined) out.sender = addressUrl(chain, o.sender);\n  if (o.token !== undefined) out.token = tokenUrl(chain, o.token);\n  if (o.block !== undefined) out.block = blockUrl(chain, String(o.block));\n  return out;\n}\n"]}

package/dist/chunk-62M2LKQW.js

@@ -0,0 +1,136 @@
+import { assertServerOnly } from './chunk-W3JN3YIW.js';
+import { PRIVY_ENV, PRIVY_ENV_ALIASES } from './chunk-3XUGQODR.js';
+import { PepuConfigError, PepuAuthError, PepuError, toErrorResponse, toPepuError } from './chunk-6DSZ4Z2N.js';
+import { PrivyClient, isEmbeddedWalletLinkedAccount } from '@privy-io/node';
+
+assertServerOnly("@pepu-chain/sdk/privy/server");
+function privyEnvVar(name) {
+  const env = typeof process !== "undefined" ? process.env : {};
+  for (const n of [PRIVY_ENV[name], ...PRIVY_ENV_ALIASES[name]]) {
+    const v = env[n]?.trim();
+    if (v) return v;
+  }
+  return void 0;
+}
+function readPrivyServerEnv(o = {}) {
+  const appId = (o.appId ?? privyEnvVar("appId") ?? "").trim();
+  const appSecret = (o.appSecret ?? privyEnvVar("appSecret") ?? "").trim();
+  const authorizationKey = (o.authorizationKey ?? privyEnvVar("authorizationKey") ?? "").trim();
+  const keyQuorumId = (o.keyQuorumId ?? privyEnvVar("keyQuorumId") ?? "").trim();
+  const missing = [];
+  if (!appId) missing.push(PRIVY_ENV.appId);
+  if (!appSecret) missing.push(PRIVY_ENV.appSecret);
+  if (missing.length > 0) {
+    throw new PepuConfigError("CONFIG_MISSING_ENV", `Missing required env: ${missing.join(", ")}. See .env.example.`, {
+      details: { missing }
+    });
+  }
+  return {
+    appId,
+    appSecret,
+    ...authorizationKey ? { authorizationKey } : {},
+    ...keyQuorumId ? { keyQuorumId } : {}
+  };
+}
+var clientCache = /* @__PURE__ */ new Map();
+function createPrivyServer(o = {}) {
+  const { appId, appSecret } = readPrivyServerEnv(o);
+  const key = `${appId}\0${appSecret}`;
+  let client = clientCache.get(key);
+  if (!client) {
+    client = new PrivyClient({ appId, appSecret });
+    clientCache.set(key, client);
+  }
+  return client;
+}
+var redact = (text, secret) => secret ? text.split(secret).join("[redacted]") : text;
+async function verifyRequestUser(request, o = {}) {
+  const header = request.headers.get("authorization") ?? "";
+  const token = header.replace(/^Bearer\s+/i, "").trim();
+  if (!token) {
+    throw new PepuAuthError("AUTH_INVALID_TOKEN", "Missing Privy access token. Send Authorization: Bearer <token>.");
+  }
+  const privy = o.privy ?? createPrivyServer();
+  try {
+    const claims = await privy.utils().auth().verifyAccessToken(token);
+    return { userId: claims.user_id, claims };
+  } catch (e) {
+    const reason = redact(e instanceof Error ? e.message : String(e), token);
+    throw new PepuAuthError("AUTH_INVALID_TOKEN", "Invalid or expired Privy access token.", {
+      details: { reason }
+    });
+  }
+}
+function findEmbeddedEthereumWallet(user) {
+  for (const account of user.linked_accounts) {
+    if (isEmbeddedWalletLinkedAccount(account) && account.chain_type === "ethereum") return account;
+  }
+  return null;
+}
+function findDelegatedEthereumWallet(user) {
+  for (const account of user.linked_accounts) {
+    if (isEmbeddedWalletLinkedAccount(account) && account.chain_type === "ethereum" && account.delegated) {
+      return account;
+    }
+  }
+  return null;
+}
+async function requireUser(request, o = {}) {
+  try {
+    const privy = o.privy ?? createPrivyServer();
+    const { userId } = await verifyRequestUser(request, { privy });
+    let privyUser;
+    try {
+      privyUser = await privy.users()._get(userId);
+    } catch (e) {
+      throw new PepuError("UNKNOWN", "Could not look up the user in Privy.", { status: 502, retryable: true, cause: e });
+    }
+    const wallet = findEmbeddedEthereumWallet(privyUser);
+    return { ok: true, user: { userId, address: wallet?.address ?? null, privyUser } };
+  } catch (e) {
+    return { ok: false, response: toErrorResponse(e) };
+  }
+}
+function createEnsureWalletRoute(o = {}) {
+  return {
+    async POST(request) {
+      let privy;
+      try {
+        privy = o.privy ?? createPrivyServer();
+      } catch (e) {
+        return toErrorResponse(e);
+      }
+      const auth = await requireUser(request, { privy });
+      if (!auth.ok) return auth.response;
+      const { userId, address } = auth.user;
+      if (address) return Response.json({ address, created: false });
+      try {
+        const wallet = await privy.wallets().create({ chain_type: "ethereum", owner: { user_id: userId } });
+        const created = wallet.address;
+        if (o.onCreated) {
+          try {
+            await o.onCreated({ userId, address: created });
+          } catch {
+          }
+        }
+        return Response.json({ address: created, created: true });
+      } catch (createError) {
+        try {
+          const again = findEmbeddedEthereumWallet(await privy.users()._get(userId));
+          if (again) return Response.json({ address: again.address, created: false });
+        } catch {
+        }
+        return toErrorResponse(
+          new PepuError("WALLET_NOT_PROVISIONED", "Could not create a wallet.", {
+            status: 502,
+            cause: toPepuError(createError)
+          })
+        );
+      }
+    }
+  };
+}
+
+export { createEnsureWalletRoute, createPrivyServer, findDelegatedEthereumWallet, findEmbeddedEthereumWallet, privyEnvVar, readPrivyServerEnv, requireUser, verifyRequestUser };
+//# sourceMappingURL=chunk-62M2LKQW.js.map
+//# sourceMappingURL=chunk-62M2LKQW.js.map