@pepu-chain/sdk 0.0.0-stage → 0.2.1

package/dist/chunk-KVG3AYYR.js

@@ -0,0 +1,99 @@
+import { toPepuKernelAccount, KERNEL_VERSION } from './chunk-ZB6SVBK4.js';
+import { ENTRY_POINT_V07 } from './chunk-IB2FSPMJ.js';
+import { assertCalls, findFunction } from './chunk-ESMNAXUI.js';
+import { serializePermissionAccount, deserializePermissionAccount, toPermissionValidator } from '@zerodev/permissions';
+import { toCallPolicy, CallPolicyVersion, toTimestampPolicy } from '@zerodev/permissions/policies';
+import { toECDSASigner, toEmptyECDSASigner } from '@zerodev/permissions/signers';
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts';
+
+// src/session/store.ts
+function createMemoryStore() {
+  const records = /* @__PURE__ */ new Map();
+  const locks = /* @__PURE__ */ new Set();
+  return {
+    get: (userId) => records.get(userId),
+    set: (record) => {
+      records.set(record.userId, record);
+    },
+    delete: (userId) => {
+      records.delete(userId);
+    },
+    tryLock: (userId) => {
+      if (locks.has(userId)) return false;
+      locks.add(userId);
+      return true;
+    },
+    unlock: (userId) => {
+      locks.delete(userId);
+    }
+  };
+}
+function isLive(record, nowSeconds) {
+  return record.approval !== null && nowSeconds < record.validUntil;
+}
+
+// src/session/kernel.ts
+var CALL_POLICY_V0_0_4_ADDRESS = "0x9a52283276A0ec8740DF50bF01B28A80D880eaf2";
+var TIMESTAMP_POLICY_ADDRESS = "0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F";
+var SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 };
+function zd(client) {
+  return client;
+}
+function buildKernelSessionPolicies(p) {
+  assertCalls(p.calls);
+  return [
+    toCallPolicy({
+      policyVersion: CallPolicyVersion.V0_0_4,
+      permissions: p.calls.map((c) => ({
+        target: c.target,
+        valueLimit: c.valueLimit ?? 0n,
+        abi: [findFunction(c)],
+        functionName: c.functionName
+      }))
+    }),
+    toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil })
+  ];
+}
+function generateSessionKey() {
+  const privateKey = generatePrivateKey();
+  return { privateKey, address: privateKeyToAccount(privateKey).address };
+}
+function permissionFor(publicClient, sessionKeyAddress, policies) {
+  return toPermissionValidator(zd(publicClient), {
+    entryPoint: ENTRY_POINT_V07,
+    kernelVersion: KERNEL_VERSION,
+    signer: toEmptyECDSASigner(sessionKeyAddress),
+    policies
+  });
+}
+async function expectedPermissionId(p) {
+  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);
+  const { permissionId } = permission.getPluginSerializationParams();
+  if (!permissionId) throw new Error("Could not derive the permission id.");
+  return permissionId;
+}
+async function approveKernelSession(p) {
+  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);
+  const account = await toPepuKernelAccount({
+    publicClient: p.publicClient,
+    owner: p.owner,
+    plugins: { regular }
+  });
+  const approval = await serializePermissionAccount(account);
+  return { approval, kernelAddress: account.address };
+}
+async function loadKernelSessionAccount(p) {
+  const sessionSigner = await toECDSASigner({ signer: privateKeyToAccount(p.sessionPrivateKey) });
+  const account = await deserializePermissionAccount(
+    zd(p.publicClient),
+    ENTRY_POINT_V07,
+    KERNEL_VERSION,
+    p.approval,
+    sessionSigner
+  );
+  return account;
+}
+
+export { CALL_POLICY_V0_0_4_ADDRESS, SESSION_GAS_RESERVATION_PEPU, TIMESTAMP_POLICY_ADDRESS, approveKernelSession, buildKernelSessionPolicies, createMemoryStore, expectedPermissionId, generateSessionKey, isLive, loadKernelSessionAccount };
+//# sourceMappingURL=chunk-KVG3AYYR.js.map
+//# sourceMappingURL=chunk-KVG3AYYR.js.map

package/dist/chunk-KVG3AYYR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session/store.ts","../src/session/kernel.ts"],"names":[],"mappings":";;;;;;;;;AAyDO,SAAS,iBAAA,GAAkC;AAChD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA2B;AAC/C,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,MAAA,KAAW,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,IACnC,GAAA,EAAK,CAAC,MAAA,KAAW;AACf,MAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACvB,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,MAAA,KAAW;AACnB,MAAA,IAAI,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA,EAAG,OAAO,KAAA;AAC9B,MAAA,KAAA,CAAM,IAAI,MAAM,CAAA;AAChB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAQO,SAAS,MAAA,CAAO,QAAuB,UAAA,EAA6B;AACzE,EAAA,OAAO,MAAA,CAAO,QAAA,KAAa,IAAA,IAAQ,UAAA,GAAa,MAAA,CAAO,UAAA;AACzD;;;ACvCO,IAAM,0BAAA,GAAsC;AAE5C,IAAM,wBAAA,GAAoC;AAW1C,IAAM,4BAAA,GAA+B,EAAE,cAAA,EAAgB,IAAA,EAAM,gBAAgB,GAAA;AAKpF,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,2BAA2B,CAAA,EAI9B;AACX,EAAA,WAAA,CAAY,EAAE,KAAK,CAAA;AACnB,EAAA,OAAO;AAAA,IACL,YAAA,CAAa;AAAA,MACX,eAAe,iBAAA,CAAkB,MAAA;AAAA,MACjC,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAC/B,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAA,EAAY,EAAE,UAAA,IAAc,EAAA;AAAA,QAC5B,GAAA,EAAK,CAAC,YAAA,CAAa,CAAC,CAAC,CAAA;AAAA,QACrB,cAAc,CAAA,CAAE;AAAA,OAClB,CAAE;AAAA,KACmC,CAAA;AAAA,IACvC,iBAAA,CAAkB,EAAE,UAAA,EAAY,CAAA,CAAE,cAAc,CAAA,EAAG,UAAA,EAAY,CAAA,CAAE,UAAA,EAAY;AAAA,GAC/E;AACF;AASO,SAAS,kBAAA,GAA4D;AAC1E,EAAA,MAAM,aAAa,kBAAA,EAAmB;AACtC,EAAA,OAAO,EAAE,UAAA,EAAY,OAAA,EAAS,mBAAA,CAAoB,UAAU,EAAE,OAAA,EAAQ;AACxE;AAEA,SAAS,aAAA,CAAc,YAAA,EAA4B,iBAAA,EAA4B,QAAA,EAAoB;AACjG,EAAA,OAAO,qBAAA,CAAsB,EAAA,CAAG,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAY,eAAA;AAAA,IACZ,aAAA,EAAe,cAAA;AAAA,IACf,MAAA,EAAQ,mBAAmB,iBAAiB,CAAA;AAAA,IAC5C;AAAA,GACD,CAAA;AACH;AASA,eAAsB,qBAAqB,CAAA,EAIvB;AAClB,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACtF,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,UAAA,CAAW,4BAAA,EAA6B;AACjE,EAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACxE,EAAA,OAAO,YAAA;AACT;AAeA,eAAsB,qBAAqB,CAAA,EAKe;AACxD,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACnF,EAAA,MAAM,OAAA,GAAU,MAAM,mBAAA,CAAoB;AAAA,IACxC,cAAc,CAAA,CAAE,YAAA;AAAA,IAChB,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,OAAA,EAAS,EAAE,OAAA;AAAQ,GACpB,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAM,0BAAA,CAA2B,OAAgB,CAAA;AAClE,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,OAAA,CAAQ,OAAA,EAAQ;AACpD;AAUA,eAAsB,yBAAyB,CAAA,EAIf;AAC9B,EAAA,MAAM,aAAA,GAAgB,MAAM,aAAA,CAAc,EAAE,QAAQ,mBAAA,CAAoB,CAAA,CAAE,iBAAiB,CAAA,EAAG,CAAA;AAC9F,EAAA,MAAM,UAAU,MAAM,4BAAA;AAAA,IACpB,EAAA,CAAG,EAAE,YAAY,CAAA;AAAA,IACjB,eAAA;AAAA,IACA,cAAA;AAAA,IACA,CAAA,CAAE,QAAA;AAAA,IACF;AAAA,GACF;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-KVG3AYYR.js","sourcesContent":["import type { Address, Hex } from \"viem\";\n\n/**\n * Server-side session records for the Kernel (on-chain) session flow, keyed by\n * Privy user id. Ported from templates/sponsored-session-app/lib/session-store.ts.\n *\n * WHAT IS STORED: the session private key (a hot key whose power is limited\n * ON-CHAIN by the call and timestamp policies until `validUntil`) and the\n * public approval. The owner's key never reaches the server.\n *\n * PRODUCTION: {@link createMemoryStore} is DEV-GRADE. It is lost on every\n * restart (the user simply starts a new session) and is not shared between\n * serverless instances. A production deployment must implement\n * {@link SessionStore} on a persistent database or KV AND keep\n * `sessionPrivateKey` encrypted at rest (KMS or an envelope key). Nothing else\n * in the SDK changes.\n */\nexport interface SessionRecord {\n  userId: string;\n  ownerAddress: Address;\n  kernelAddress: Address;\n  /** The session key's private half. Encrypt it at rest in any persistent store. */\n  sessionPrivateKey: Hex;\n  sessionKeyAddress: Address;\n  permissionId: string;\n  /** Unix seconds. The on-chain permission is invalid at and after this time. */\n  validUntil: number;\n  /** Present once the owner has signed the grant. */\n  approval: string | null;\n  /** Number of successful sponsored actions in this session. */\n  actions: number;\n}\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * Pluggable storage for {@link SessionRecord}s. Every method may be sync or\n * async. `tryLock` must be atomic per user: it returns `false` when an action\n * is already running for that user (a multi-instance deployment needs a\n * distributed lock, for example a Redis `SET NX PX`).\n */\nexport interface SessionStore {\n  get(userId: string): MaybePromise<SessionRecord | undefined>;\n  set(record: SessionRecord): MaybePromise<void>;\n  delete(userId: string): MaybePromise<void>;\n  tryLock(userId: string): MaybePromise<boolean>;\n  unlock(userId: string): MaybePromise<void>;\n}\n\n/**\n * An in-memory {@link SessionStore} for development and tests. DEV-GRADE: not\n * persistent, not shared across instances, and the session key is held in\n * plaintext in process memory. Production needs an encrypted persistent store.\n *\n * @example\n * const store = createMemoryStore();\n */\nexport function createMemoryStore(): SessionStore {\n  const records = new Map<string, SessionRecord>();\n  const locks = new Set<string>();\n  return {\n    get: (userId) => records.get(userId),\n    set: (record) => {\n      records.set(record.userId, record);\n    },\n    delete: (userId) => {\n      records.delete(userId);\n    },\n    tryLock: (userId) => {\n      if (locks.has(userId)) return false;\n      locks.add(userId);\n      return true;\n    },\n    unlock: (userId) => {\n      locks.delete(userId);\n    },\n  };\n}\n\n/**\n * True while the on-chain permission is still valid: approved and before expiry.\n *\n * @example\n * isLive(record, Math.floor(Date.now() / 1000));\n */\nexport function isLive(record: SessionRecord, nowSeconds: number): boolean {\n  return record.approval !== null && nowSeconds < record.validUntil;\n}\n","import { deserializePermissionAccount, serializePermissionAccount, toPermissionValidator } from \"@zerodev/permissions\";\nimport type { Policy } from \"@zerodev/permissions\";\nimport { CallPolicyVersion, toCallPolicy, toTimestampPolicy } from \"@zerodev/permissions/policies\";\nimport { toECDSASigner, toEmptyECDSASigner } from \"@zerodev/permissions/signers\";\nimport type { createKernelAccount } from \"@zerodev/sdk\";\nimport type { Abi, Address, Hex, PublicClient } from \"viem\";\nimport { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";\n\nimport { ENTRY_POINT_V07 } from \"../aa/clients.js\";\nimport { KERNEL_VERSION, toPepuKernelAccount } from \"../aa/kernel.js\";\nimport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nimport { assertCalls, findFunction } from \"./scope.js\";\nimport type { KernelSessionCall } from \"./scope.js\";\n\nexport { KERNEL_VERSION, getKernelAddress } from \"../aa/kernel.js\";\nexport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nexport { createMemoryStore, isLive } from \"./store.js\";\nexport type { SessionRecord, SessionStore } from \"./store.js\";\nexport { checkApproval, describeKernelSessionScope, isCallInScope, parseApproval } from \"./scope.js\";\nexport type { ApprovalCheck, KernelSessionCall, KernelSessionScope, ParsedApproval } from \"./scope.js\";\n\n/**\n * `@pepu-chain/sdk/session/kernel`: on-chain session keys with ZeroDev Kernel\n * permissions. Extracted from templates/sponsored-session-app/lib/{kernel,\n * session-policy,approval}.ts and built on `toPepuKernelAccount`\n * (`plugins.regular`).\n *\n * The scope is enforced ON-CHAIN by ZeroDev's policy contracts, which the\n * user's Kernel account calls during UserOperation validation:\n *\n * - Call policy v0.0.4: only the listed targets and function selectors, with a\n *   native value no larger than `valueLimit` (default 0).\n * - Timestamp policy: the permission is invalid outside `validAfter`..`validUntil`.\n *\n * A UserOperation outside this scope is rejected by the EntryPoint itself, no\n * matter who relays it or what the app backend does.\n *\n * Deployed on PEPU mainnet (eth_getCode verified 2026-10-02): Kernel v3.1\n * factory 0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419, ECDSA validator\n * 0x845ADb2C711129d4f3966735eD98a9F09fC4cE57, ECDSA signer module\n * 0x6A6F069E2a08c2468e7724Ab3250CdBFBA14D4FF, call policy v0.0.4 and the\n * timestamp policy below. Call policy v0.0.5 is NOT deployed on PEPU, so the\n * version is pinned.\n *\n * Optional peers: `@zerodev/sdk`, `@zerodev/permissions`, `@zerodev/ecdsa-validator`.\n */\n\n/** Call policy v0.0.4. Pinned: v0.0.5 is not deployed on PEPU mainnet. */\nexport const CALL_POLICY_V0_0_4_ADDRESS: Address = \"0x9a52283276A0ec8740DF50bF01B28A80D880eaf2\";\n/** ZeroDev timestamp policy on PEPU mainnet. */\nexport const TIMESTAMP_POLICY_ADDRESS: Address = \"0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F\";\n\n/**\n * Worst-case gas the paymaster policy service RESERVES per sponsored operation,\n * measured on PEPU mainnet with the sponsored-session-app template: the first\n * operation of a session (account deploy plus enabling the permission) about\n * 20.5 PEPU, later operations about 6.9 PEPU. The real first-session cost was\n * about 12.8 PEPU for two operations. Size per-user hourly and daily spend\n * caps above these, or users hit `trailing-hour spend ... would exceed cap`\n * after their first action.\n */\nexport const SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 } as const;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\n\n/** Type-level bridge for ZeroDev's own viem copy (same object at runtime). */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/**\n * The on-chain policies for one session: call policy v0.0.4 plus the timestamp\n * policy. Pure and deterministic given its input. Only the named function\n * fragments go into the policy, which keeps the grant small.\n *\n * @example\n * const policies = buildKernelSessionPolicies({\n *   calls: [{ target: tapScore, abi: tapScoreAbi, functionName: \"tap\" }],\n *   validUntil: Math.floor(Date.now() / 1000) + 900,\n * });\n */\nexport function buildKernelSessionPolicies(p: {\n  calls: readonly KernelSessionCall[];\n  validUntil: number;\n  validAfter?: number;\n}): Policy[] {\n  assertCalls(p.calls);\n  return [\n    toCallPolicy({\n      policyVersion: CallPolicyVersion.V0_0_4,\n      permissions: p.calls.map((c) => ({\n        target: c.target,\n        valueLimit: c.valueLimit ?? 0n,\n        abi: [findFunction(c)] as Abi,\n        functionName: c.functionName,\n      })),\n    } as Parameters<typeof toCallPolicy>[0]),\n    toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil }),\n  ];\n}\n\n/**\n * A fresh random session key. SERVER ONLY: the private key must never reach\n * the browser. Only the address is sent to the owner for approval.\n *\n * @example\n * const { privateKey, address } = generateSessionKey();\n */\nexport function generateSessionKey(): { privateKey: Hex; address: Address } {\n  const privateKey = generatePrivateKey();\n  return { privateKey, address: privateKeyToAccount(privateKey).address };\n}\n\nfunction permissionFor(publicClient: PublicClient, sessionKeyAddress: Address, policies: Policy[]) {\n  return toPermissionValidator(zd(publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    signer: toEmptyECDSASigner(sessionKeyAddress),\n    policies,\n  });\n}\n\n/**\n * The permission id the chain derives for this session key plus these\n * policies. The server compares it with a browser-supplied approval.\n *\n * @example\n * const permissionId = await expectedPermissionId({ publicClient, sessionKeyAddress, policies });\n */\nexport async function expectedPermissionId(p: {\n  publicClient: PublicClient;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<string> {\n  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const { permissionId } = permission.getPluginSerializationParams();\n  if (!permissionId) throw new Error(\"Could not derive the permission id.\");\n  return permissionId;\n}\n\n/**\n * In the user's browser: the owner (the Privy embedded wallet, the only thing\n * that can authorize a session) signs ONE EIP-712 message that enables a\n * permission validator on their Kernel account. That signature is the whole\n * grant. It names the session key's public address (never its private key)\n * and the policies. The returned `approval` holds no secret: it is the enable\n * signature plus the policy parameters, useless without the session key.\n *\n * @example\n * const { approval, kernelAddress } = await approveKernelSession({\n *   publicClient, owner: walletClient, sessionKeyAddress, policies,\n * });\n */\nexport async function approveKernelSession(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<{ approval: string; kernelAddress: Address }> {\n  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const account = await toPepuKernelAccount({\n    publicClient: p.publicClient,\n    owner: p.owner,\n    plugins: { regular },\n  });\n  const approval = await serializePermissionAccount(account as never);\n  return { approval, kernelAddress: account.address };\n}\n\n/**\n * On the server: rebuild the session's Kernel account from the approval and\n * the server-held session key (an ECDSA signer for that key). No owner\n * signature is involved. Pass the result to `createPepuSponsoredClient`.\n *\n * @example\n * const account = await loadKernelSessionAccount({ publicClient, approval, sessionPrivateKey });\n */\nexport async function loadKernelSessionAccount(p: {\n  publicClient: PublicClient;\n  approval: string;\n  sessionPrivateKey: Hex;\n}): Promise<KernelSmartAccount> {\n  const sessionSigner = await toECDSASigner({ signer: privateKeyToAccount(p.sessionPrivateKey) });\n  const account = await deserializePermissionAccount(\n    zd(p.publicClient),\n    ENTRY_POINT_V07,\n    KERNEL_VERSION,\n    p.approval,\n    sessionSigner,\n  );\n  return account as unknown as KernelSmartAccount;\n}\n"]}

package/dist/chunk-NE3QKDOB.cjs

@@ -0,0 +1,24 @@
+'use strict';
+
+var chunkDPCZJLB3_cjs = require('./chunk-DPCZJLB3.cjs');
+
+// src/privy/config.ts
+function createPepuPrivyConfig(options = {}) {
+  const chain = options.chain ?? chunkDPCZJLB3_cjs.pepuMainnet;
+  return {
+    ...options.loginMethods ? { loginMethods: options.loginMethods } : {},
+    ...options.appearance ? { appearance: options.appearance } : {},
+    defaultChain: chain,
+    supportedChains: [chain],
+    embeddedWallets: {
+      ethereum: { createOnLogin: options.createOnLogin ?? "off" }
+    },
+    externalWallets: {
+      coinbaseWallet: { config: { preference: { options: "eoaOnly" } } }
+    }
+  };
+}
+
+exports.createPepuPrivyConfig = createPepuPrivyConfig;
+//# sourceMappingURL=chunk-NE3QKDOB.cjs.map
+//# sourceMappingURL=chunk-NE3QKDOB.cjs.map

package/dist/chunk-NE3QKDOB.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/privy/config.ts"],"names":["pepuMainnet"],"mappings":";;;;;AAwDO,SAAS,qBAAA,CACd,OAAA,GAAwC,EAAC,EAClB;AACvB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAASA,6BAAA;AAC/B,EAAA,OAAO;AAAA,IACL,GAAI,QAAQ,YAAA,GAAe,EAAE,cAAc,OAAA,CAAQ,YAAA,KAAiB,EAAC;AAAA,IACrE,GAAI,QAAQ,UAAA,GAAa,EAAE,YAAY,OAAA,CAAQ,UAAA,KAAe,EAAC;AAAA,IAC/D,YAAA,EAAc,KAAA;AAAA,IACd,eAAA,EAAiB,CAAC,KAAK,CAAA;AAAA,IACvB,eAAA,EAAiB;AAAA,MACf,QAAA,EAAU,EAAE,aAAA,EAAe,OAAA,CAAQ,iBAAiB,KAAA;AAAM,KAC5D;AAAA,IACA,eAAA,EAAiB;AAAA,MACf,cAAA,EAAgB,EAAE,MAAA,EAAQ,EAAE,YAAY,EAAE,OAAA,EAAS,SAAA,EAAU,EAAE;AAAE;AACnE,GACF;AACF","file":"chunk-NE3QKDOB.cjs","sourcesContent":["import { pepuMainnet } from \"../chains.js\";\nimport type { PepuChain } from \"../chains.js\";\n\n/**\n * Typed Privy client config for PEPU (`@pepu-chain/sdk/privy`). Client-safe:\n * no secrets, no Node APIs, and no dependency on any Privy package (the result\n * is structurally assignable to `PrivyClientConfig` from\n * `@privy-io/react-auth`).\n *\n * What it encodes, each a real, reproduced PEPU requirement:\n *\n * - `defaultChain` / `supportedChains` are PEPU mainnet only.\n * - `embeddedWallets.ethereum.createOnLogin` defaults to `\"off\"`: the\n *   recommended pattern is to provision the wallet server-side (see the\n *   wallet-provisioning recipe). NOTE the Privy Dashboard's setting wins over\n *   this value at runtime; it is kept for intent and documentation.\n * - Coinbase Wallet is pinned to `eoaOnly`: Coinbase Smart Wallet does not\n *   support chain 97741, and the default floods the console with \"The\n *   configured chains are not supported by Coinbase Smart Wallet\".\n */\n\nexport type PrivyLoginMethod =\n  | \"email\"\n  | \"google\"\n  | \"wallet\"\n  | \"sms\"\n  | \"apple\"\n  | \"twitter\"\n  | \"discord\"\n  | \"github\";\n\nexport type EmbeddedWalletCreateOnLogin = \"off\" | \"users-without-wallets\" | \"all-users\";\n\nexport interface PepuPrivyClientConfig {\n  loginMethods?: PrivyLoginMethod[];\n  appearance?: { theme?: \"light\" | \"dark\" | `#${string}`; accentColor?: `#${string}`; logo?: string };\n  defaultChain: PepuChain;\n  supportedChains: PepuChain[];\n  embeddedWallets: {\n    ethereum: { createOnLogin: EmbeddedWalletCreateOnLogin };\n  };\n  externalWallets: {\n    coinbaseWallet: { config: { preference: { options: \"eoaOnly\" } } };\n  };\n}\n\nexport interface CreatePepuPrivyConfigOptions {\n  loginMethods?: PrivyLoginMethod[];\n  appearance?: PepuPrivyClientConfig[\"appearance\"];\n  /** Default `\"off\"`. The Privy Dashboard setting overrides this at runtime. */\n  createOnLogin?: EmbeddedWalletCreateOnLogin;\n  /** Default {@link pepuMainnet}. Only pass a different PEPU chain deliberately. */\n  chain?: PepuChain;\n}\n\n/** Build the `config` prop for Privy's `<PrivyProvider>` on PEPU. */\nexport function createPepuPrivyConfig(\n  options: CreatePepuPrivyConfigOptions = {},\n): PepuPrivyClientConfig {\n  const chain = options.chain ?? pepuMainnet;\n  return {\n    ...(options.loginMethods ? { loginMethods: options.loginMethods } : {}),\n    ...(options.appearance ? { appearance: options.appearance } : {}),\n    defaultChain: chain,\n    supportedChains: [chain],\n    embeddedWallets: {\n      ethereum: { createOnLogin: options.createOnLogin ?? \"off\" },\n    },\n    externalWallets: {\n      coinbaseWallet: { config: { preference: { options: \"eoaOnly\" } } },\n    },\n  };\n}\n\nexport * from \"./requirements.js\";\n"]}

package/dist/chunk-NVOPDXTA.cjs

@@ -0,0 +1,95 @@
+'use strict';
+
+var chunk7MNJF2OB_cjs = require('./chunk-7MNJF2OB.cjs');
+var chunkAJS4UFQX_cjs = require('./chunk-AJS4UFQX.cjs');
+var chunkWANILJZQ_cjs = require('./chunk-WANILJZQ.cjs');
+var chunk4GINFJO6_cjs = require('./chunk-4GINFJO6.cjs');
+var chunkVF3D6KLQ_cjs = require('./chunk-VF3D6KLQ.cjs');
+var chunkDPCZJLB3_cjs = require('./chunk-DPCZJLB3.cjs');
+var ecdsaValidator = require('@zerodev/ecdsa-validator');
+var sdk = require('@zerodev/sdk');
+var viem = require('viem');
+
+var KERNEL_VERSION = sdk.constants.KERNEL_V3_1;
+function zd(client) {
+  return client;
+}
+function defaultPublicClient() {
+  return viem.createPublicClient({ chain: chunkDPCZJLB3_cjs.pepuMainnet, transport: viem.http(chunkVF3D6KLQ_cjs.resolvePepuEndpoints().rpcUrl) });
+}
+async function toPepuKernelAccount(p) {
+  const sudo = await ecdsaValidator.signerToEcdsaValidator(zd(p.publicClient), {
+    signer: p.owner,
+    entryPoint: chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
+    kernelVersion: KERNEL_VERSION
+  });
+  return sdk.createKernelAccount(zd(p.publicClient), {
+    entryPoint: chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
+    kernelVersion: KERNEL_VERSION,
+    plugins: { sudo, ...p.plugins?.regular ? { regular: p.plugins.regular } : {} },
+    ...p.index !== void 0 ? { index: p.index } : {}
+  });
+}
+function toEmptyAccount(address) {
+  const refuse = async () => {
+    throw new Error("read-only account cannot sign");
+  };
+  return {
+    address,
+    type: "local",
+    source: "custom",
+    publicKey: "0x",
+    signMessage: refuse,
+    signTransaction: refuse,
+    signTypedData: refuse
+  };
+}
+async function getKernelAddress(publicClient, owner) {
+  const account = await toPepuKernelAccount({ publicClient, owner: toEmptyAccount(owner) });
+  return account.address;
+}
+function createPepuSponsoredClient(p) {
+  const publicClient = p.publicClient ?? defaultPublicClient();
+  const paymaster = chunk7MNJF2OB_cjs.createPepuPaymasterClient({
+    ...p.paymasterUrl !== void 0 ? { paymasterUrl: p.paymasterUrl } : {},
+    ...p.paymasterToken !== void 0 ? { paymasterToken: p.paymasterToken } : {},
+    ...p.paymasterContext ? { context: p.paymasterContext } : {}
+  });
+  return sdk.createKernelAccountClient({
+    account: p.account,
+    chain: chunkDPCZJLB3_cjs.pepuMainnet,
+    client: zd(publicClient),
+    bundlerTransport: viem.http(chunk7MNJF2OB_cjs.requireBundlerUrl(p.bundlerUrl)),
+    paymaster,
+    userOperation: { estimateFeesPerGas: async () => chunk7MNJF2OB_cjs.estimatePepuUserOpFees(publicClient) }
+  });
+}
+async function sendSponsored(p) {
+  const calls = chunkAJS4UFQX_cjs.normalizeCalls(p.calls);
+  try {
+    const account = p.client.account;
+    if (!account) throw new Error("The Kernel client has no account.");
+    const callData = await account.encodeCalls(calls);
+    const userOpHash = await p.client.sendUserOperation({ callData });
+    const receipt = await p.client.waitForUserOperationReceipt({ hash: userOpHash, timeout: p.timeoutMs ?? 9e4 });
+    const transactionHash = receipt.receipt.transactionHash;
+    return {
+      userOpHash,
+      transactionHash,
+      success: receipt.success,
+      paymaster: receipt.paymaster ?? null,
+      actualGasCostWei: receipt.actualGasCost,
+      explorerUrl: chunk4GINFJO6_cjs.txUrl(chunkDPCZJLB3_cjs.pepuMainnet, transactionHash)
+    };
+  } catch (e) {
+    throw chunkWANILJZQ_cjs.describeUserOpFailure(e);
+  }
+}
+
+exports.KERNEL_VERSION = KERNEL_VERSION;
+exports.createPepuSponsoredClient = createPepuSponsoredClient;
+exports.getKernelAddress = getKernelAddress;
+exports.sendSponsored = sendSponsored;
+exports.toPepuKernelAccount = toPepuKernelAccount;
+//# sourceMappingURL=chunk-NVOPDXTA.cjs.map
+//# sourceMappingURL=chunk-NVOPDXTA.cjs.map

package/dist/chunk-NVOPDXTA.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/aa/kernel.ts"],"names":["constants","createPublicClient","pepuMainnet","http","resolvePepuEndpoints","signerToEcdsaValidator","ENTRY_POINT_V07","createKernelAccount","createPepuPaymasterClient","createKernelAccountClient","requireBundlerUrl","estimatePepuUserOpFees","normalizeCalls","txUrl","describeUserOpFailure"],"mappings":";;;;;;;;;;;;AAiCO,IAAM,iBAAiBA,aAAA,CAAU;AAUxC,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,mBAAA,GAAoC;AAC3C,EAAA,OAAOC,uBAAA,CAAmB,EAAE,KAAA,EAAOC,6BAAA,EAAa,SAAA,EAAWC,UAAKC,sCAAA,EAAqB,CAAE,MAAM,CAAA,EAAG,CAAA;AAClG;AAWA,eAAsB,oBAAoB,CAAA,EAUV;AAC9B,EAAA,MAAM,OAAO,MAAMC,qCAAA,CAAuB,EAAA,CAAG,CAAA,CAAE,YAAY,CAAA,EAAG;AAAA,IAC5D,QAAQ,CAAA,CAAE,KAAA;AAAA,IACV,UAAA,EAAYC,iCAAA;AAAA,IACZ,aAAA,EAAe;AAAA,GAChB,CAAA;AACD,EAAA,OAAOC,uBAAA,CAAoB,EAAA,CAAG,CAAA,CAAE,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAYD,iCAAA;AAAA,IACZ,aAAA,EAAe,cAAA;AAAA,IACf,OAAA,EAAS,EAAE,IAAA,EAAM,GAAI,EAAE,OAAA,EAAS,OAAA,GAAU,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,OAAA,EAAQ,GAAI,EAAC,EAAG;AAAA,IAC/E,GAAI,EAAE,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI;AAAC,GAC5B,CAAA;AAC1B;AAEA,SAAS,eAAe,OAAA,EAAgC;AACtD,EAAA,MAAM,SAAS,YAA4B;AACzC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,IAAA,EAAM,OAAA;AAAA,IACN,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,WAAA,EAAa,MAAA;AAAA,IACb,eAAA,EAAiB,MAAA;AAAA,IACjB,aAAA,EAAe;AAAA,GACjB;AACF;AASA,eAAsB,gBAAA,CAAiB,cAA4B,KAAA,EAAkC;AACnG,EAAA,MAAM,OAAA,GAAU,MAAM,mBAAA,CAAoB,EAAE,cAAc,KAAA,EAAO,cAAA,CAAe,KAAK,CAAA,EAAG,CAAA;AACxF,EAAA,OAAO,OAAA,CAAQ,OAAA;AACjB;AASO,SAAS,0BAA0B,CAAA,EAQlB;AACtB,EAAA,MAAM,YAAA,GAAe,CAAA,CAAE,YAAA,IAAgB,mBAAA,EAAoB;AAC3D,EAAA,MAAM,YAAYE,2CAAA,CAA0B;AAAA,IAC1C,GAAI,EAAE,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,CAAA,CAAE,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,EAAE,cAAA,KAAmB,MAAA,GAAY,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI,EAAC;AAAA,IAC7E,GAAI,EAAE,gBAAA,GAAmB,EAAE,SAAS,CAAA,CAAE,gBAAA,KAAqB;AAAC,GAC7D,CAAA;AACD,EAAA,OAAOC,6BAAA,CAA0B;AAAA,IAC/B,SAAS,CAAA,CAAE,OAAA;AAAA,IACX,KAAA,EAAOP,6BAAA;AAAA,IACP,MAAA,EAAQ,GAAG,YAAY,CAAA;AAAA,IACvB,gBAAA,EAAkBC,SAAA,CAAKO,mCAAA,CAAkB,CAAA,CAAE,UAAU,CAAC,CAAA;AAAA,IACtD,SAAA;AAAA,IACA,eAAe,EAAE,kBAAA,EAAoB,YAAYC,wCAAA,CAAuB,YAAY,CAAA;AAAE,GACzB,CAAA;AACjE;AAsBA,eAAsB,cAAc,CAAA,EAIH;AAC/B,EAAA,MAAM,KAAA,GAAQC,gCAAA,CAAe,CAAA,CAAE,KAAK,CAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,EAAE,MAAA,CAAO,OAAA;AACzB,IAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,WAAA,CAAY,KAAK,CAAA;AAChD,IAAA,MAAM,aAAa,MAAM,CAAA,CAAE,OAAO,iBAAA,CAAkB,EAAE,UAAU,CAAA;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,CAAA,CAAE,MAAA,CAAO,2BAAA,CAA4B,EAAE,IAAA,EAAM,UAAA,EAAY,OAAA,EAAS,CAAA,CAAE,SAAA,IAAa,GAAA,EAAQ,CAAA;AAC/G,IAAA,MAAM,eAAA,GAAkB,QAAQ,OAAA,CAAQ,eAAA;AACxC,IAAA,OAAO;AAAA,MACL,UAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,SAAA,EAAW,QAAQ,SAAA,IAAa,IAAA;AAAA,MAChC,kBAAkB,OAAA,CAAQ,aAAA;AAAA,MAC1B,WAAA,EAAaC,uBAAA,CAAMX,6BAAA,EAAa,eAAe;AAAA,KACjD;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAMY,wCAAsB,CAAC,CAAA;AAAA,EAC/B;AACF","file":"chunk-NVOPDXTA.cjs","sourcesContent":["/**\n * @pepu-chain/sdk/aa/kernel: Kernel v3.1 smart account plus sponsored-send\n * helpers for the \"direct\" transport (your own bundler and paymaster URLs).\n * Needs the optional peers `@zerodev/sdk` and `@zerodev/ecdsa-validator`.\n *\n * This is the only module in the SDK (with `session/kernel` and `combo`) that\n * imports ZeroDev. Ported from `templates/sponsored-session-app/lib/kernel.ts`\n * (Kernel v3.1 build, 20% fee headroom because Alto lacks\n * `zd_getUserOperationGasPrice`).\n *\n * Session keys: `toPepuKernelAccount` takes an optional `plugins.regular`\n * validator, which is the plug point WP-B6 (`/session/kernel`, `/combo`) uses\n * to add a permission validator on top of the ECDSA root.\n */\nimport { signerToEcdsaValidator } from \"@zerodev/ecdsa-validator\";\nimport { constants, createKernelAccount, createKernelAccountClient } from \"@zerodev/sdk\";\nimport type { Signer } from \"@zerodev/sdk/types\";\nimport { createPublicClient, http } from \"viem\";\nimport type { Address, Hex, LocalAccount, PublicClient, WalletClient } from \"viem\";\n\nimport { pepuMainnet } from \"../chains.js\";\nimport { resolvePepuEndpoints } from \"../endpoints.js\";\nimport { txUrl } from \"../explorer.js\";\nimport type { PaymasterContext } from \"../erc7677.js\";\nimport { normalizeCalls } from \"./calls.js\";\nimport { ENTRY_POINT_V07, createPepuPaymasterClient, estimatePepuUserOpFees, requireBundlerUrl } from \"./clients.js\";\nimport { describeUserOpFailure } from \"./describe.js\";\nimport type { Call } from \"./types.js\";\n\nexport type { Call } from \"./types.js\";\nexport { encodeKernelExecute } from \"./calls.js\";\n\n/** Kernel v3.1, the version deployed on PEPU mainnet (factory in the contract registry). */\nexport const KERNEL_VERSION = constants.KERNEL_V3_1;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\ntype KernelAccountParams = Parameters<typeof createKernelAccount>[1];\n\n/**\n * The ZeroDev packages resolve their own copy of viem as a peer. In a monorepo\n * with several viem installs two identical `PublicClient` types are nominally\n * different; this is a type-level bridge only (same object at runtime).\n */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/** The Kernel account type this module builds. */\nexport type KernelSmartAccount = Awaited<ReturnType<typeof createKernelAccount>>;\n/** The sponsored client type {@link createPepuSponsoredClient} returns. */\nexport type KernelAccountClient = ReturnType<typeof createKernelAccountClient>;\n\n/** Anything that can sign for the Kernel owner. */\nexport type KernelOwner = LocalAccount | Signer | WalletClient;\n\nfunction defaultPublicClient(): PublicClient {\n  return createPublicClient({ chain: pepuMainnet, transport: http(resolvePepuEndpoints().rpcUrl) }) as PublicClient;\n}\n\n/**\n * Build a Kernel v3.1 smart account owned by `owner` (ECDSA root validator).\n * The address depends only on the owner and `index`, never on a session.\n * Pass `plugins.regular` to add a permission (session-key) validator on top\n * of the root; that is how `@pepu-chain/sdk/session/kernel` builds on this.\n *\n * @example\n * const account = await toPepuKernelAccount({ publicClient, owner: privateKeyToAccount(key) });\n */\nexport async function toPepuKernelAccount(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  index?: bigint;\n  /**\n   * `regular` is a ZeroDev validator plugin, for example the permission\n   * validator from `@zerodev/permissions` (see `@pepu-chain/sdk/session/kernel`).\n   * Typed as `object` so this entry does not need `@zerodev/permissions` types.\n   */\n  plugins?: { regular?: object };\n}): Promise<KernelSmartAccount> {\n  const sudo = await signerToEcdsaValidator(zd(p.publicClient), {\n    signer: p.owner as Signer,\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n  });\n  return createKernelAccount(zd(p.publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    plugins: { sudo, ...(p.plugins?.regular ? { regular: p.plugins.regular } : {}) },\n    ...(p.index !== undefined ? { index: p.index } : {}),\n  } as KernelAccountParams);\n}\n\nfunction toEmptyAccount(address: Address): LocalAccount {\n  const refuse = async (): Promise<never> => {\n    throw new Error(\"read-only account cannot sign\");\n  };\n  return {\n    address,\n    type: \"local\",\n    source: \"custom\",\n    publicKey: \"0x\" as Hex,\n    signMessage: refuse,\n    signTransaction: refuse,\n    signTypedData: refuse,\n  } as unknown as LocalAccount;\n}\n\n/**\n * The counterfactual Kernel address for an owner, with no signature needed.\n * Lifted from `templates/sponsored-session-app/lib/kernel.ts`.\n *\n * @example\n * const smartAccount = await getKernelAddress(publicClient, ownerAddress);\n */\nexport async function getKernelAddress(publicClient: PublicClient, owner: Address): Promise<Address> {\n  const account = await toPepuKernelAccount({ publicClient, owner: toEmptyAccount(owner) });\n  return account.address;\n}\n\n/**\n * A Kernel client that sends through YOUR bundler and has gas paid by YOUR\n * paymaster (ERC-7677). Fees come from the chain with 20% headroom.\n *\n * @example\n * const client = createPepuSponsoredClient({ account, paymasterContext: { privyAccessToken } });\n */\nexport function createPepuSponsoredClient(p: {\n  account: KernelSmartAccount;\n  bundlerUrl?: string;\n  paymasterUrl?: string;\n  /** Project client token; builds the ERC-7677 URL against the paymaster base when no URL is configured. */\n  paymasterToken?: string;\n  paymasterContext?: PaymasterContext;\n  publicClient?: PublicClient;\n}): KernelAccountClient {\n  const publicClient = p.publicClient ?? defaultPublicClient();\n  const paymaster = createPepuPaymasterClient({\n    ...(p.paymasterUrl !== undefined ? { paymasterUrl: p.paymasterUrl } : {}),\n    ...(p.paymasterToken !== undefined ? { paymasterToken: p.paymasterToken } : {}),\n    ...(p.paymasterContext ? { context: p.paymasterContext } : {}),\n  });\n  return createKernelAccountClient({\n    account: p.account,\n    chain: pepuMainnet,\n    client: zd(publicClient),\n    bundlerTransport: http(requireBundlerUrl(p.bundlerUrl)),\n    paymaster,\n    userOperation: { estimateFeesPerGas: async () => estimatePepuUserOpFees(publicClient) },\n  } as unknown as Parameters<typeof createKernelAccountClient>[0]);\n}\n\n/** Result of {@link sendSponsored}. */\nexport interface SendSponsoredResult {\n  userOpHash: Hex;\n  transactionHash: Hex;\n  success: boolean;\n  paymaster: Address | null;\n  actualGasCostWei: bigint;\n  explorerUrl: string;\n}\n\n/**\n * Encode `calls`, send one UserOperation, wait for its receipt, and report\n * who paid. Failures are mapped through `describeUserOpFailure` (AAxx and\n * paymaster reasons become typed PepuErrors). Flow ported from\n * `sendSessionTap` in the sponsored-session-app template.\n *\n * @example\n * const r = await sendSponsored({ client, calls: [{ to, abi, functionName: \"tap\" }] });\n * console.log(r.paymaster, r.explorerUrl);\n */\nexport async function sendSponsored(p: {\n  client: KernelAccountClient;\n  calls: Call[];\n  timeoutMs?: number;\n}): Promise<SendSponsoredResult> {\n  const calls = normalizeCalls(p.calls);\n  try {\n    const account = p.client.account;\n    if (!account) throw new Error(\"The Kernel client has no account.\");\n    const callData = await account.encodeCalls(calls);\n    const userOpHash = await p.client.sendUserOperation({ callData });\n    const receipt = await p.client.waitForUserOperationReceipt({ hash: userOpHash, timeout: p.timeoutMs ?? 90_000 });\n    const transactionHash = receipt.receipt.transactionHash;\n    return {\n      userOpHash,\n      transactionHash,\n      success: receipt.success,\n      paymaster: receipt.paymaster ?? null,\n      actualGasCostWei: receipt.actualGasCost,\n      explorerUrl: txUrl(pepuMainnet, transactionHash),\n    };\n  } catch (e) {\n    throw describeUserOpFailure(e);\n  }\n}\n"]}

package/dist/chunk-OH3QMAIB.js

@@ -0,0 +1,11 @@
+import { http, createPublicClient } from 'viem';
+
+// src/client.ts
+function getPublicClient(chain, options) {
+  const transport = options?.transport ?? http();
+  return createPublicClient({ chain, transport });
+}
+
+export { getPublicClient };
+//# sourceMappingURL=chunk-OH3QMAIB.js.map
+//# sourceMappingURL=chunk-OH3QMAIB.js.map

package/dist/chunk-OH3QMAIB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts"],"names":[],"mappings":";;;AAWO,SAAS,eAAA,CACd,OACA,OAAA,EACoC;AAIpC,EAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,IAAA,EAAK;AAC7C,EAAA,OAAO,kBAAA,CAAmB,EAAE,KAAA,EAAO,SAAA,EAAW,CAAA;AAChD","file":"chunk-OH3QMAIB.js","sourcesContent":["import { type PublicClient, type Transport, createPublicClient, http } from \"viem\";\n\nimport type { PepuChain } from \"./chains.js\";\n\n/**\n * Create a viem `PublicClient` for a Pepe Unchained V2 chain, defaulting\n * its transport to the chain's first `rpcUrls.default.http` entry.\n *\n * Pass `transport` to use a different RPC endpoint (e.g. an authenticated\n * provider URL) while keeping the rest of the chain definition.\n */\nexport function getPublicClient(\n  chain: PepuChain,\n  options?: { transport?: Transport },\n): PublicClient<Transport, PepuChain> {\n  // `http()` with no URL falls back to `chain.rpcUrls.default.http[0]`\n  // internally (see viem's `http` transport), so the chain definition\n  // stays the single source of truth for the default RPC endpoint.\n  const transport = options?.transport ?? http();\n  return createPublicClient({ chain, transport });\n}\n"]}

package/dist/chunk-PHM3ZORG.cjs

@@ -0,0 +1,110 @@
+'use strict';
+
+var chunkNVOPDXTA_cjs = require('./chunk-NVOPDXTA.cjs');
+var chunk7MNJF2OB_cjs = require('./chunk-7MNJF2OB.cjs');
+var chunkJ3O2ZGG3_cjs = require('./chunk-J3O2ZGG3.cjs');
+var permissions = require('@zerodev/permissions');
+var policies = require('@zerodev/permissions/policies');
+var signers = require('@zerodev/permissions/signers');
+var accounts = require('viem/accounts');
+
+// src/session/store.ts
+function createMemoryStore() {
+  const records = /* @__PURE__ */ new Map();
+  const locks = /* @__PURE__ */ new Set();
+  return {
+    get: (userId) => records.get(userId),
+    set: (record) => {
+      records.set(record.userId, record);
+    },
+    delete: (userId) => {
+      records.delete(userId);
+    },
+    tryLock: (userId) => {
+      if (locks.has(userId)) return false;
+      locks.add(userId);
+      return true;
+    },
+    unlock: (userId) => {
+      locks.delete(userId);
+    }
+  };
+}
+function isLive(record, nowSeconds) {
+  return record.approval !== null && nowSeconds < record.validUntil;
+}
+
+// src/session/kernel.ts
+var CALL_POLICY_V0_0_4_ADDRESS = "0x9a52283276A0ec8740DF50bF01B28A80D880eaf2";
+var TIMESTAMP_POLICY_ADDRESS = "0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F";
+var SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 };
+function zd(client) {
+  return client;
+}
+function buildKernelSessionPolicies(p) {
+  chunkJ3O2ZGG3_cjs.assertCalls(p.calls);
+  return [
+    policies.toCallPolicy({
+      policyVersion: policies.CallPolicyVersion.V0_0_4,
+      permissions: p.calls.map((c) => ({
+        target: c.target,
+        valueLimit: c.valueLimit ?? 0n,
+        abi: [chunkJ3O2ZGG3_cjs.findFunction(c)],
+        functionName: c.functionName
+      }))
+    }),
+    policies.toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil })
+  ];
+}
+function generateSessionKey() {
+  const privateKey = accounts.generatePrivateKey();
+  return { privateKey, address: accounts.privateKeyToAccount(privateKey).address };
+}
+function permissionFor(publicClient, sessionKeyAddress, policies) {
+  return permissions.toPermissionValidator(zd(publicClient), {
+    entryPoint: chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
+    kernelVersion: chunkNVOPDXTA_cjs.KERNEL_VERSION,
+    signer: signers.toEmptyECDSASigner(sessionKeyAddress),
+    policies
+  });
+}
+async function expectedPermissionId(p) {
+  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);
+  const { permissionId } = permission.getPluginSerializationParams();
+  if (!permissionId) throw new Error("Could not derive the permission id.");
+  return permissionId;
+}
+async function approveKernelSession(p) {
+  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);
+  const account = await chunkNVOPDXTA_cjs.toPepuKernelAccount({
+    publicClient: p.publicClient,
+    owner: p.owner,
+    plugins: { regular }
+  });
+  const approval = await permissions.serializePermissionAccount(account);
+  return { approval, kernelAddress: account.address };
+}
+async function loadKernelSessionAccount(p) {
+  const sessionSigner = await signers.toECDSASigner({ signer: accounts.privateKeyToAccount(p.sessionPrivateKey) });
+  const account = await permissions.deserializePermissionAccount(
+    zd(p.publicClient),
+    chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
+    chunkNVOPDXTA_cjs.KERNEL_VERSION,
+    p.approval,
+    sessionSigner
+  );
+  return account;
+}
+
+exports.CALL_POLICY_V0_0_4_ADDRESS = CALL_POLICY_V0_0_4_ADDRESS;
+exports.SESSION_GAS_RESERVATION_PEPU = SESSION_GAS_RESERVATION_PEPU;
+exports.TIMESTAMP_POLICY_ADDRESS = TIMESTAMP_POLICY_ADDRESS;
+exports.approveKernelSession = approveKernelSession;
+exports.buildKernelSessionPolicies = buildKernelSessionPolicies;
+exports.createMemoryStore = createMemoryStore;
+exports.expectedPermissionId = expectedPermissionId;
+exports.generateSessionKey = generateSessionKey;
+exports.isLive = isLive;
+exports.loadKernelSessionAccount = loadKernelSessionAccount;
+//# sourceMappingURL=chunk-PHM3ZORG.cjs.map
+//# sourceMappingURL=chunk-PHM3ZORG.cjs.map

package/dist/chunk-PHM3ZORG.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session/store.ts","../src/session/kernel.ts"],"names":["assertCalls","toCallPolicy","CallPolicyVersion","findFunction","toTimestampPolicy","generatePrivateKey","privateKeyToAccount","toPermissionValidator","ENTRY_POINT_V07","KERNEL_VERSION","toEmptyECDSASigner","toPepuKernelAccount","serializePermissionAccount","toECDSASigner","deserializePermissionAccount"],"mappings":";;;;;;;;;;;AAyDO,SAAS,iBAAA,GAAkC;AAChD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA2B;AAC/C,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,MAAA,KAAW,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,IACnC,GAAA,EAAK,CAAC,MAAA,KAAW;AACf,MAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACvB,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,MAAA,KAAW;AACnB,MAAA,IAAI,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA,EAAG,OAAO,KAAA;AAC9B,MAAA,KAAA,CAAM,IAAI,MAAM,CAAA;AAChB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAQO,SAAS,MAAA,CAAO,QAAuB,UAAA,EAA6B;AACzE,EAAA,OAAO,MAAA,CAAO,QAAA,KAAa,IAAA,IAAQ,UAAA,GAAa,MAAA,CAAO,UAAA;AACzD;;;ACvCO,IAAM,0BAAA,GAAsC;AAE5C,IAAM,wBAAA,GAAoC;AAW1C,IAAM,4BAAA,GAA+B,EAAE,cAAA,EAAgB,IAAA,EAAM,gBAAgB,GAAA;AAKpF,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,2BAA2B,CAAA,EAI9B;AACX,EAAAA,6BAAA,CAAY,EAAE,KAAK,CAAA;AACnB,EAAA,OAAO;AAAA,IACLC,qBAAA,CAAa;AAAA,MACX,eAAeC,0BAAA,CAAkB,MAAA;AAAA,MACjC,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAC/B,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAA,EAAY,EAAE,UAAA,IAAc,EAAA;AAAA,QAC5B,GAAA,EAAK,CAACC,8BAAA,CAAa,CAAC,CAAC,CAAA;AAAA,QACrB,cAAc,CAAA,CAAE;AAAA,OAClB,CAAE;AAAA,KACmC,CAAA;AAAA,IACvCC,0BAAA,CAAkB,EAAE,UAAA,EAAY,CAAA,CAAE,cAAc,CAAA,EAAG,UAAA,EAAY,CAAA,CAAE,UAAA,EAAY;AAAA,GAC/E;AACF;AASO,SAAS,kBAAA,GAA4D;AAC1E,EAAA,MAAM,aAAaC,2BAAA,EAAmB;AACtC,EAAA,OAAO,EAAE,UAAA,EAAY,OAAA,EAASC,4BAAA,CAAoB,UAAU,EAAE,OAAA,EAAQ;AACxE;AAEA,SAAS,aAAA,CAAc,YAAA,EAA4B,iBAAA,EAA4B,QAAA,EAAoB;AACjG,EAAA,OAAOC,iCAAA,CAAsB,EAAA,CAAG,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAYC,iCAAA;AAAA,IACZ,aAAA,EAAeC,gCAAA;AAAA,IACf,MAAA,EAAQC,2BAAmB,iBAAiB,CAAA;AAAA,IAC5C;AAAA,GACD,CAAA;AACH;AASA,eAAsB,qBAAqB,CAAA,EAIvB;AAClB,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACtF,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,UAAA,CAAW,4BAAA,EAA6B;AACjE,EAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACxE,EAAA,OAAO,YAAA;AACT;AAeA,eAAsB,qBAAqB,CAAA,EAKe;AACxD,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACnF,EAAA,MAAM,OAAA,GAAU,MAAMC,qCAAA,CAAoB;AAAA,IACxC,cAAc,CAAA,CAAE,YAAA;AAAA,IAChB,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,OAAA,EAAS,EAAE,OAAA;AAAQ,GACpB,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAMC,sCAAA,CAA2B,OAAgB,CAAA;AAClE,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,OAAA,CAAQ,OAAA,EAAQ;AACpD;AAUA,eAAsB,yBAAyB,CAAA,EAIf;AAC9B,EAAA,MAAM,aAAA,GAAgB,MAAMC,qBAAA,CAAc,EAAE,QAAQP,4BAAA,CAAoB,CAAA,CAAE,iBAAiB,CAAA,EAAG,CAAA;AAC9F,EAAA,MAAM,UAAU,MAAMQ,wCAAA;AAAA,IACpB,EAAA,CAAG,EAAE,YAAY,CAAA;AAAA,IACjBN,iCAAA;AAAA,IACAC,gCAAA;AAAA,IACA,CAAA,CAAE,QAAA;AAAA,IACF;AAAA,GACF;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-PHM3ZORG.cjs","sourcesContent":["import type { Address, Hex } from \"viem\";\n\n/**\n * Server-side session records for the Kernel (on-chain) session flow, keyed by\n * Privy user id. Ported from templates/sponsored-session-app/lib/session-store.ts.\n *\n * WHAT IS STORED: the session private key (a hot key whose power is limited\n * ON-CHAIN by the call and timestamp policies until `validUntil`) and the\n * public approval. The owner's key never reaches the server.\n *\n * PRODUCTION: {@link createMemoryStore} is DEV-GRADE. It is lost on every\n * restart (the user simply starts a new session) and is not shared between\n * serverless instances. A production deployment must implement\n * {@link SessionStore} on a persistent database or KV AND keep\n * `sessionPrivateKey` encrypted at rest (KMS or an envelope key). Nothing else\n * in the SDK changes.\n */\nexport interface SessionRecord {\n  userId: string;\n  ownerAddress: Address;\n  kernelAddress: Address;\n  /** The session key's private half. Encrypt it at rest in any persistent store. */\n  sessionPrivateKey: Hex;\n  sessionKeyAddress: Address;\n  permissionId: string;\n  /** Unix seconds. The on-chain permission is invalid at and after this time. */\n  validUntil: number;\n  /** Present once the owner has signed the grant. */\n  approval: string | null;\n  /** Number of successful sponsored actions in this session. */\n  actions: number;\n}\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * Pluggable storage for {@link SessionRecord}s. Every method may be sync or\n * async. `tryLock` must be atomic per user: it returns `false` when an action\n * is already running for that user (a multi-instance deployment needs a\n * distributed lock, for example a Redis `SET NX PX`).\n */\nexport interface SessionStore {\n  get(userId: string): MaybePromise<SessionRecord | undefined>;\n  set(record: SessionRecord): MaybePromise<void>;\n  delete(userId: string): MaybePromise<void>;\n  tryLock(userId: string): MaybePromise<boolean>;\n  unlock(userId: string): MaybePromise<void>;\n}\n\n/**\n * An in-memory {@link SessionStore} for development and tests. DEV-GRADE: not\n * persistent, not shared across instances, and the session key is held in\n * plaintext in process memory. Production needs an encrypted persistent store.\n *\n * @example\n * const store = createMemoryStore();\n */\nexport function createMemoryStore(): SessionStore {\n  const records = new Map<string, SessionRecord>();\n  const locks = new Set<string>();\n  return {\n    get: (userId) => records.get(userId),\n    set: (record) => {\n      records.set(record.userId, record);\n    },\n    delete: (userId) => {\n      records.delete(userId);\n    },\n    tryLock: (userId) => {\n      if (locks.has(userId)) return false;\n      locks.add(userId);\n      return true;\n    },\n    unlock: (userId) => {\n      locks.delete(userId);\n    },\n  };\n}\n\n/**\n * True while the on-chain permission is still valid: approved and before expiry.\n *\n * @example\n * isLive(record, Math.floor(Date.now() / 1000));\n */\nexport function isLive(record: SessionRecord, nowSeconds: number): boolean {\n  return record.approval !== null && nowSeconds < record.validUntil;\n}\n","import { deserializePermissionAccount, serializePermissionAccount, toPermissionValidator } from \"@zerodev/permissions\";\nimport type { Policy } from \"@zerodev/permissions\";\nimport { CallPolicyVersion, toCallPolicy, toTimestampPolicy } from \"@zerodev/permissions/policies\";\nimport { toECDSASigner, toEmptyECDSASigner } from \"@zerodev/permissions/signers\";\nimport type { createKernelAccount } from \"@zerodev/sdk\";\nimport type { Abi, Address, Hex, PublicClient } from \"viem\";\nimport { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";\n\nimport { ENTRY_POINT_V07 } from \"../aa/clients.js\";\nimport { KERNEL_VERSION, toPepuKernelAccount } from \"../aa/kernel.js\";\nimport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nimport { assertCalls, findFunction } from \"./scope.js\";\nimport type { KernelSessionCall } from \"./scope.js\";\n\nexport { KERNEL_VERSION, getKernelAddress } from \"../aa/kernel.js\";\nexport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nexport { createMemoryStore, isLive } from \"./store.js\";\nexport type { SessionRecord, SessionStore } from \"./store.js\";\nexport { checkApproval, describeKernelSessionScope, isCallInScope, parseApproval } from \"./scope.js\";\nexport type { ApprovalCheck, KernelSessionCall, KernelSessionScope, ParsedApproval } from \"./scope.js\";\n\n/**\n * `@pepu-chain/sdk/session/kernel`: on-chain session keys with ZeroDev Kernel\n * permissions. Extracted from templates/sponsored-session-app/lib/{kernel,\n * session-policy,approval}.ts and built on `toPepuKernelAccount`\n * (`plugins.regular`).\n *\n * The scope is enforced ON-CHAIN by ZeroDev's policy contracts, which the\n * user's Kernel account calls during UserOperation validation:\n *\n * - Call policy v0.0.4: only the listed targets and function selectors, with a\n *   native value no larger than `valueLimit` (default 0).\n * - Timestamp policy: the permission is invalid outside `validAfter`..`validUntil`.\n *\n * A UserOperation outside this scope is rejected by the EntryPoint itself, no\n * matter who relays it or what the app backend does.\n *\n * Deployed on PEPU mainnet (eth_getCode verified 2026-10-02): Kernel v3.1\n * factory 0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419, ECDSA validator\n * 0x845ADb2C711129d4f3966735eD98a9F09fC4cE57, ECDSA signer module\n * 0x6A6F069E2a08c2468e7724Ab3250CdBFBA14D4FF, call policy v0.0.4 and the\n * timestamp policy below. Call policy v0.0.5 is NOT deployed on PEPU, so the\n * version is pinned.\n *\n * Optional peers: `@zerodev/sdk`, `@zerodev/permissions`, `@zerodev/ecdsa-validator`.\n */\n\n/** Call policy v0.0.4. Pinned: v0.0.5 is not deployed on PEPU mainnet. */\nexport const CALL_POLICY_V0_0_4_ADDRESS: Address = \"0x9a52283276A0ec8740DF50bF01B28A80D880eaf2\";\n/** ZeroDev timestamp policy on PEPU mainnet. */\nexport const TIMESTAMP_POLICY_ADDRESS: Address = \"0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F\";\n\n/**\n * Worst-case gas the paymaster policy service RESERVES per sponsored operation,\n * measured on PEPU mainnet with the sponsored-session-app template: the first\n * operation of a session (account deploy plus enabling the permission) about\n * 20.5 PEPU, later operations about 6.9 PEPU. The real first-session cost was\n * about 12.8 PEPU for two operations. Size per-user hourly and daily spend\n * caps above these, or users hit `trailing-hour spend ... would exceed cap`\n * after their first action.\n */\nexport const SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 } as const;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\n\n/** Type-level bridge for ZeroDev's own viem copy (same object at runtime). */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/**\n * The on-chain policies for one session: call policy v0.0.4 plus the timestamp\n * policy. Pure and deterministic given its input. Only the named function\n * fragments go into the policy, which keeps the grant small.\n *\n * @example\n * const policies = buildKernelSessionPolicies({\n *   calls: [{ target: tapScore, abi: tapScoreAbi, functionName: \"tap\" }],\n *   validUntil: Math.floor(Date.now() / 1000) + 900,\n * });\n */\nexport function buildKernelSessionPolicies(p: {\n  calls: readonly KernelSessionCall[];\n  validUntil: number;\n  validAfter?: number;\n}): Policy[] {\n  assertCalls(p.calls);\n  return [\n    toCallPolicy({\n      policyVersion: CallPolicyVersion.V0_0_4,\n      permissions: p.calls.map((c) => ({\n        target: c.target,\n        valueLimit: c.valueLimit ?? 0n,\n        abi: [findFunction(c)] as Abi,\n        functionName: c.functionName,\n      })),\n    } as Parameters<typeof toCallPolicy>[0]),\n    toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil }),\n  ];\n}\n\n/**\n * A fresh random session key. SERVER ONLY: the private key must never reach\n * the browser. Only the address is sent to the owner for approval.\n *\n * @example\n * const { privateKey, address } = generateSessionKey();\n */\nexport function generateSessionKey(): { privateKey: Hex; address: Address } {\n  const privateKey = generatePrivateKey();\n  return { privateKey, address: privateKeyToAccount(privateKey).address };\n}\n\nfunction permissionFor(publicClient: PublicClient, sessionKeyAddress: Address, policies: Policy[]) {\n  return toPermissionValidator(zd(publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    signer: toEmptyECDSASigner(sessionKeyAddress),\n    policies,\n  });\n}\n\n/**\n * The permission id the chain derives for this session key plus these\n * policies. The server compares it with a browser-supplied approval.\n *\n * @example\n * const permissionId = await expectedPermissionId({ publicClient, sessionKeyAddress, policies });\n */\nexport async function expectedPermissionId(p: {\n  publicClient: PublicClient;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<string> {\n  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const { permissionId } = permission.getPluginSerializationParams();\n  if (!permissionId) throw new Error(\"Could not derive the permission id.\");\n  return permissionId;\n}\n\n/**\n * In the user's browser: the owner (the Privy embedded wallet, the only thing\n * that can authorize a session) signs ONE EIP-712 message that enables a\n * permission validator on their Kernel account. That signature is the whole\n * grant. It names the session key's public address (never its private key)\n * and the policies. The returned `approval` holds no secret: it is the enable\n * signature plus the policy parameters, useless without the session key.\n *\n * @example\n * const { approval, kernelAddress } = await approveKernelSession({\n *   publicClient, owner: walletClient, sessionKeyAddress, policies,\n * });\n */\nexport async function approveKernelSession(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<{ approval: string; kernelAddress: Address }> {\n  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const account = await toPepuKernelAccount({\n    publicClient: p.publicClient,\n    owner: p.owner,\n    plugins: { regular },\n  });\n  const approval = await serializePermissionAccount(account as never);\n  return { approval, kernelAddress: account.address };\n}\n\n/**\n * On the server: rebuild the session's Kernel account from the approval and\n * the server-held session key (an ECDSA signer for that key). No owner\n * signature is involved. Pass the result to `createPepuSponsoredClient`.\n *\n * @example\n * const account = await loadKernelSessionAccount({ publicClient, approval, sessionPrivateKey });\n */\nexport async function loadKernelSessionAccount(p: {\n  publicClient: PublicClient;\n  approval: string;\n  sessionPrivateKey: Hex;\n}): Promise<KernelSmartAccount> {\n  const sessionSigner = await toECDSASigner({ signer: privateKeyToAccount(p.sessionPrivateKey) });\n  const account = await deserializePermissionAccount(\n    zd(p.publicClient),\n    ENTRY_POINT_V07,\n    KERNEL_VERSION,\n    p.approval,\n    sessionSigner,\n  );\n  return account as unknown as KernelSmartAccount;\n}\n"]}