@pepu-chain/sdk 0.0.0-stage → 0.2.1

package/dist/chunk-62M2LKQW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/privy/server.ts"],"names":[],"mappings":";;;;;AAOA,gBAAA,CAAiB,8BAA8B,CAAA;AAgDxC,SAAS,YAAY,IAAA,EAAkD;AAC5E,EAAA,MAAM,MAAM,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,MAAM,EAAC;AAC5D,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,SAAA,CAAU,IAAI,GAAG,GAAG,iBAAA,CAAkB,IAAI,CAAC,CAAA,EAAG;AAC7D,IAAA,MAAM,CAAA,GAAI,GAAA,CAAI,CAAC,CAAA,EAAG,IAAA,EAAK;AACvB,IAAA,IAAI,GAAG,OAAO,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,MAAA;AACT;AAYO,SAAS,kBAAA,CAAmB,CAAA,GAA6F,EAAC,EAAmB;AAClJ,EAAA,MAAM,SAAS,CAAA,CAAE,KAAA,IAAS,YAAY,OAAO,CAAA,IAAK,IAAI,IAAA,EAAK;AAC3D,EAAA,MAAM,aAAa,CAAA,CAAE,SAAA,IAAa,YAAY,WAAW,CAAA,IAAK,IAAI,IAAA,EAAK;AACvE,EAAA,MAAM,oBAAoB,CAAA,CAAE,gBAAA,IAAoB,YAAY,kBAAkB,CAAA,IAAK,IAAI,IAAA,EAAK;AAC5F,EAAA,MAAM,eAAe,CAAA,CAAE,WAAA,IAAe,YAAY,aAAa,CAAA,IAAK,IAAI,IAAA,EAAK;AAC7E,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,IAAI,CAAC,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,UAAU,KAAK,CAAA;AACxC,EAAA,IAAI,CAAC,SAAA,EAAW,OAAA,CAAQ,IAAA,CAAK,UAAU,SAAS,CAAA;AAChD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,gBAAgB,oBAAA,EAAsB,CAAA,sBAAA,EAAyB,QAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,mBAAA,CAAA,EAAuB;AAAA,MAChH,OAAA,EAAS,EAAE,OAAA;AAAQ,KACpB,CAAA;AAAA,EACH;AACA,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,SAAA;AAAA,IACA,GAAI,gBAAA,GAAmB,EAAE,gBAAA,KAAqB,EAAC;AAAA,IAC/C,GAAI,WAAA,GAAc,EAAE,WAAA,KAAgB;AAAC,GACvC;AACF;AAEA,IAAM,WAAA,uBAAkB,GAAA,EAAyB;AAgB1C,SAAS,iBAAA,CAAkB,CAAA,GAA6F,EAAC,EAAgB;AAC9I,EAAA,MAAM,EAAE,KAAA,EAAO,SAAA,EAAU,GAAI,mBAAmB,CAAC,CAAA;AACjD,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,KAAK,CAAA,EAAA,EAAS,SAAS,CAAA,CAAA;AACtC,EAAA,IAAI,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAA,GAAS,IAAI,WAAA,CAAY,EAAE,KAAA,EAAO,WAAW,CAAA;AAC7C,IAAA,WAAA,CAAY,GAAA,CAAI,KAAK,MAAM,CAAA;AAAA,EAC7B;AACA,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,MAAA,GAAS,CAAC,IAAA,EAAc,MAAA,KAA4B,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,CAAE,IAAA,CAAK,YAAY,CAAA,GAAI,IAAA;AAoB3G,eAAsB,iBAAA,CACpB,OAAA,EACA,CAAA,GAA6B,EAAC,EACgB;AAC9C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,IAAK,EAAA;AACvD,EAAA,MAAM,QAAQ,MAAA,CAAO,OAAA,CAAQ,aAAA,EAAe,EAAE,EAAE,IAAA,EAAK;AACrD,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAA,CAAc,oBAAA,EAAsB,iEAAiE,CAAA;AAAA,EACjH;AACA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,KAAA,IAAS,iBAAA,EAAkB;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,KAAA,GAAQ,IAAA,EAAK,CAAE,kBAAkB,KAAK,CAAA;AACjE,IAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,OAAA,EAAS,MAAA,EAAO;AAAA,EAC1C,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,MAAA,GAAS,OAAO,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAA,EAAG,KAAK,CAAA;AACvE,IAAA,MAAM,IAAI,aAAA,CAAc,oBAAA,EAAsB,wCAAA,EAA0C;AAAA,MACtF,OAAA,EAAS,EAAE,MAAA;AAAO,KACnB,CAAA;AAAA,EACH;AACF;AAaO,SAAS,2BAA2B,IAAA,EAAsC;AAC/E,EAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,IAAA,IAAI,8BAA8B,OAAO,CAAA,IAAK,OAAA,CAAQ,UAAA,KAAe,YAAY,OAAO,OAAA;AAAA,EAC1F;AACA,EAAA,OAAO,IAAA;AACT;AAaO,SAAS,4BAA4B,IAAA,EAAsC;AAChF,EAAA,KAAA,MAAW,OAAA,IAAW,KAAK,eAAA,EAAiB;AAC1C,IAAA,IAAI,8BAA8B,OAAO,CAAA,IAAK,QAAQ,UAAA,KAAe,UAAA,IAAc,QAAQ,SAAA,EAAW;AACpG,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAkBA,eAAsB,WAAA,CACpB,OAAA,EACA,CAAA,GAA6B,EAAC,EAC6C;AAC3E,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,KAAA,IAAS,iBAAA,EAAkB;AAC3C,IAAA,MAAM,EAAE,QAAO,GAAI,MAAM,kBAAkB,OAAA,EAAS,EAAE,OAAO,CAAA;AAC7D,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI;AACF,MAAA,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,EAAM,CAAE,KAAK,MAAM,CAAA;AAAA,IAC7C,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,IAAI,SAAA,CAAU,SAAA,EAAW,sCAAA,EAAwC,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,CAAA,EAAG,CAAA;AAAA,IACnH;AACA,IAAA,MAAM,MAAA,GAAS,2BAA2B,SAAS,CAAA;AACnD,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,EAAE,MAAA,EAAQ,OAAA,EAAU,MAAA,EAAQ,OAAA,IAAmC,IAAA,EAAM,SAAA,EAAU,EAAE;AAAA,EAC5G,SAAS,CAAA,EAAG;AACV,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAA,EAAU,eAAA,CAAgB,CAAC,CAAA,EAAE;AAAA,EACnD;AACF;AA4BO,SAAS,uBAAA,CACd,CAAA,GAGI,EAAC,EAC0C;AAC/C,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,OAAA,EAAqC;AAC9C,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI;AACF,QAAA,KAAA,GAAQ,CAAA,CAAE,SAAS,iBAAA,EAAkB;AAAA,MACvC,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,gBAAgB,CAAC,CAAA;AAAA,MAC1B;AACA,MAAA,MAAM,OAAO,MAAM,WAAA,CAAY,OAAA,EAAS,EAAE,OAAO,CAAA;AACjD,MAAA,IAAI,CAAC,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,QAAA;AAC1B,MAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,EAAQ,GAAI,IAAA,CAAK,IAAA;AACjC,MAAA,IAAI,OAAA,SAAgB,QAAA,CAAS,IAAA,CAAK,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,CAAA;AAE7D,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,EAAE,UAAA,EAAY,UAAA,EAAY,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,IAAU,CAAA;AAClG,QAAA,MAAM,UAAU,MAAA,CAAO,OAAA;AACvB,QAAA,IAAI,EAAE,SAAA,EAAW;AACf,UAAA,IAAI;AACF,YAAA,MAAM,EAAE,SAAA,CAAU,EAAE,MAAA,EAAQ,OAAA,EAAS,SAAS,CAAA;AAAA,UAChD,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AACA,QAAA,OAAO,SAAS,IAAA,CAAK,EAAE,SAAS,OAAA,EAAS,OAAA,EAAS,MAAM,CAAA;AAAA,MAC1D,SAAS,WAAA,EAAa;AAGpB,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,GAAQ,2BAA2B,MAAM,KAAA,CAAM,OAAM,CAAE,IAAA,CAAK,MAAM,CAAC,CAAA;AACzE,UAAA,IAAI,KAAA,EAAO,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,SAAS,KAAA,CAAM,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,CAAA;AAAA,QAC5E,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,eAAA;AAAA,UACL,IAAI,SAAA,CAAU,wBAAA,EAA0B,4BAAA,EAA8B;AAAA,YACpE,MAAA,EAAQ,GAAA;AAAA,YACR,KAAA,EAAO,YAAY,WAAW;AAAA,WAC/B;AAAA,SACH;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF","file":"chunk-62M2LKQW.js","sourcesContent":["import { isEmbeddedWalletLinkedAccount, PrivyClient } from \"@privy-io/node\";\nimport type { LinkedAccount, LinkedAccountEmbeddedWallet } from \"@privy-io/node\";\nimport type { Address } from \"viem\";\nimport { assertServerOnly } from \"../internal/assert-server.js\";\nimport { PepuAuthError, PepuConfigError, PepuError, toErrorResponse, toPepuError } from \"../errors.js\";\nimport { PRIVY_ENV, PRIVY_ENV_ALIASES } from \"./requirements.js\";\n\nassertServerOnly(\"@pepu-chain/sdk/privy/server\");\n\n/**\n * `@pepu-chain/sdk/privy/server` (server). Privy server client, access-token\n * verification and the ensure-wallet route factory. Never import it from\n * client code: it calls `assertServerOnly()` at import.\n *\n * Optional peer: `@privy-io/node`.\n */\n\n/** A Privy linked embedded-wallet account. */\nexport type LinkedWallet = LinkedAccountEmbeddedWallet;\n\n/** The part of a Privy user object these helpers read. */\nexport interface PrivyUser {\n  linked_accounts: readonly LinkedAccount[];\n}\n\n/** The authenticated caller, as returned by {@link requireUser}. */\nexport interface PepuUser {\n  /** The Privy user id, only ever taken from a verified access token. */\n  userId: string;\n  /** The user's embedded Ethereum wallet address, `null` if not provisioned yet. */\n  address: Address | null;\n  /** The Privy user object the address was read from. */\n  privyUser: PrivyUser;\n}\n\n/** Server-side Privy configuration read from the environment. */\nexport interface PrivyServerEnv {\n  appId: string;\n  appSecret: string;\n  /** Private half of the authorization key. Only sessions need it. */\n  authorizationKey?: string;\n  /** The key quorum id sessions grant. Only sessions need it. */\n  keyQuorumId?: string;\n}\n\n/**\n * The single reader for the Privy variables ({@link PRIVY_ENV}, then its\n * aliases). Trimmed; `undefined` when unset or blank. Session routes use it\n * too, so every module agrees on names.\n *\n * @example\n * ```ts\n * const quorum = privyEnvVar(\"keyQuorumId\");\n * ```\n */\nexport function privyEnvVar(name: keyof typeof PRIVY_ENV): string | undefined {\n  const env = typeof process !== \"undefined\" ? process.env : {};\n  for (const n of [PRIVY_ENV[name], ...PRIVY_ENV_ALIASES[name]]) {\n    const v = env[n]?.trim();\n    if (v) return v;\n  }\n  return undefined;\n}\n\n/**\n * Read the Privy server variables ({@link PRIVY_ENV}), explicit options winning.\n * Throws a `PepuConfigError` that lists every missing variable by NAME only.\n * `PRIVY_AUTHORIZATION_KEY` is optional here (ensure-wallet never needs it).\n *\n * @example\n * ```ts\n * const { appId, appSecret } = readPrivyServerEnv();\n * ```\n */\nexport function readPrivyServerEnv(o: { appId?: string; appSecret?: string; authorizationKey?: string; keyQuorumId?: string } = {}): PrivyServerEnv {\n  const appId = (o.appId ?? privyEnvVar(\"appId\") ?? \"\").trim();\n  const appSecret = (o.appSecret ?? privyEnvVar(\"appSecret\") ?? \"\").trim();\n  const authorizationKey = (o.authorizationKey ?? privyEnvVar(\"authorizationKey\") ?? \"\").trim();\n  const keyQuorumId = (o.keyQuorumId ?? privyEnvVar(\"keyQuorumId\") ?? \"\").trim();\n  const missing: string[] = [];\n  if (!appId) missing.push(PRIVY_ENV.appId);\n  if (!appSecret) missing.push(PRIVY_ENV.appSecret);\n  if (missing.length > 0) {\n    throw new PepuConfigError(\"CONFIG_MISSING_ENV\", `Missing required env: ${missing.join(\", \")}. See .env.example.`, {\n      details: { missing },\n    });\n  }\n  return {\n    appId,\n    appSecret,\n    ...(authorizationKey ? { authorizationKey } : {}),\n    ...(keyQuorumId ? { keyQuorumId } : {}),\n  };\n}\n\nconst clientCache = new Map<string, PrivyClient>();\n\n/**\n * A cached `PrivyClient` (`@privy-io/node`) built from {@link PRIVY_ENV}. One\n * instance per distinct credential set. The authorization key is not given to\n * the client: Privy takes it per request (`authorization_context`), see\n * {@link readPrivyServerEnv}.\n *\n * Ported from templates/consumer-app/lib/privy-server.ts.\n *\n * @example\n * ```ts\n * const privy = createPrivyServer();\n * const user = await privy.users()._get(userId);\n * ```\n */\nexport function createPrivyServer(o: { appId?: string; appSecret?: string; authorizationKey?: string; keyQuorumId?: string } = {}): PrivyClient {\n  const { appId, appSecret } = readPrivyServerEnv(o);\n  const key = `${appId}\\u0000${appSecret}`;\n  let client = clientCache.get(key);\n  if (!client) {\n    client = new PrivyClient({ appId, appSecret });\n    clientCache.set(key, client);\n  }\n  return client;\n}\n\nconst redact = (text: string, secret: string): string => (secret ? text.split(secret).join(\"[redacted]\") : text);\n\n/**\n * Verify the `Authorization: Bearer <token>` header against Privy and return the\n * caller's Privy user id and claims. Throws `PepuAuthError` (`AUTH_INVALID_TOKEN`,\n * HTTP 401) when the header is missing or the token does not verify. The reason\n * Privy gave goes in `details.reason` (token redacted): a verification failure\n * caused by a mismatched `PRIVY_APP_SECRET` looks exactly like an expired\n * session, so check it first.\n *\n * Note `verifyAccessToken(token)` on `privy.utils().auth()` takes a bare string,\n * not `{ access_token }` (that is the standalone function's signature).\n *\n * Ported from templates/consumer-app/lib/privy-auth.ts.\n *\n * @example\n * ```ts\n * const { userId } = await verifyRequestUser(request);\n * ```\n */\nexport async function verifyRequestUser(\n  request: Request,\n  o: { privy?: PrivyClient } = {},\n): Promise<{ userId: string; claims: unknown }> {\n  const header = request.headers.get(\"authorization\") ?? \"\";\n  const token = header.replace(/^Bearer\\s+/i, \"\").trim();\n  if (!token) {\n    throw new PepuAuthError(\"AUTH_INVALID_TOKEN\", \"Missing Privy access token. Send Authorization: Bearer <token>.\");\n  }\n  const privy = o.privy ?? createPrivyServer();\n  try {\n    const claims = await privy.utils().auth().verifyAccessToken(token);\n    return { userId: claims.user_id, claims };\n  } catch (e) {\n    const reason = redact(e instanceof Error ? e.message : String(e), token);\n    throw new PepuAuthError(\"AUTH_INVALID_TOKEN\", \"Invalid or expired Privy access token.\", {\n      details: { reason },\n    });\n  }\n}\n\n/**\n * The user's Ethereum embedded wallet (delegated or not), or `null`. This is\n * what makes ensure-wallet idempotent.\n *\n * Ported from templates/consumer-app/lib/privy-user.ts.\n *\n * @example\n * ```ts\n * const wallet = findEmbeddedEthereumWallet(user);\n * ```\n */\nexport function findEmbeddedEthereumWallet(user: PrivyUser): LinkedWallet | null {\n  for (const account of user.linked_accounts) {\n    if (isEmbeddedWalletLinkedAccount(account) && account.chain_type === \"ethereum\") return account;\n  }\n  return null;\n}\n\n/**\n * The user's Ethereum embedded wallet that has been delegated (granted a\n * session signer), or `null`.\n *\n * Ported from templates/game-app/lib/privy-user.ts.\n *\n * @example\n * ```ts\n * const wallet = findDelegatedEthereumWallet(user);\n * ```\n */\nexport function findDelegatedEthereumWallet(user: PrivyUser): LinkedWallet | null {\n  for (const account of user.linked_accounts) {\n    if (isEmbeddedWalletLinkedAccount(account) && account.chain_type === \"ethereum\" && account.delegated) {\n      return account;\n    }\n  }\n  return null;\n}\n\n/**\n * Authenticate a request for a route handler. On success returns the user id\n * (from the verified token only) and the user's embedded wallet address. On\n * failure returns a ready JSON `Response` (`{ error: { code, message, hint } }`:\n * 401 for a bad token, 500 for missing config, 502 if Privy cannot be reached).\n * Never throws.\n *\n * @example\n * ```ts\n * export async function POST(request: Request) {\n *   const auth = await requireUser(request);\n *   if (!auth.ok) return auth.response;\n *   return Response.json({ userId: auth.user.userId });\n * }\n * ```\n */\nexport async function requireUser(\n  request: Request,\n  o: { privy?: PrivyClient } = {},\n): Promise<{ ok: true; user: PepuUser } | { ok: false; response: Response }> {\n  try {\n    const privy = o.privy ?? createPrivyServer();\n    const { userId } = await verifyRequestUser(request, { privy });\n    let privyUser: PrivyUser;\n    try {\n      privyUser = await privy.users()._get(userId);\n    } catch (e) {\n      throw new PepuError(\"UNKNOWN\", \"Could not look up the user in Privy.\", { status: 502, retryable: true, cause: e });\n    }\n    const wallet = findEmbeddedEthereumWallet(privyUser);\n    return { ok: true, user: { userId, address: (wallet?.address as Address | undefined) ?? null, privyUser } };\n  } catch (e) {\n    return { ok: false, response: toErrorResponse(e) };\n  }\n}\n\n/**\n * Next.js route handler that creates the signed-in user's Ethereum embedded\n * wallet server-side if they have none. Drop-in:\n * `export const { POST } = createEnsureWalletRoute();` in\n * `app/api/wallet/ensure/route.ts`.\n *\n * Why: Privy's own client-side creation hangs forever for apps whose dashboard\n * creation setting is off; pair it with `createOnLogin: \"off\"` (the default of\n * `createPepuPrivyConfig`) and `WalletGate`.\n *\n * - CUSTODY: the wallet is created with `owner: { user_id }`. This backend holds\n *   no signing authority over it. Do not add a session signer here.\n * - SECURITY: the user id comes only from the verified access token, never from\n *   the body or query string.\n * - IDEMPOTENT: it looks for an existing wallet first and re-checks after a\n *   failed create, so a double submit never makes a second wallet.\n *\n * Ported from templates/consumer-app/app/api/wallet/ensure/route.ts.\n *\n * @example\n * ```ts\n * // app/api/wallet/ensure/route.ts\n * import { createEnsureWalletRoute } from \"@pepu-chain/sdk/privy/server\";\n * export const { POST } = createEnsureWalletRoute();\n * ```\n */\nexport function createEnsureWalletRoute(\n  o: {\n    privy?: PrivyClient;\n    onCreated?: (c: { userId: string; address: Address }) => Promise<void>;\n  } = {},\n): { POST(request: Request): Promise<Response> } {\n  return {\n    async POST(request: Request): Promise<Response> {\n      let privy: PrivyClient;\n      try {\n        privy = o.privy ?? createPrivyServer();\n      } catch (e) {\n        return toErrorResponse(e);\n      }\n      const auth = await requireUser(request, { privy });\n      if (!auth.ok) return auth.response;\n      const { userId, address } = auth.user;\n      if (address) return Response.json({ address, created: false });\n\n      try {\n        const wallet = await privy.wallets().create({ chain_type: \"ethereum\", owner: { user_id: userId } });\n        const created = wallet.address as Address;\n        if (o.onCreated) {\n          try {\n            await o.onCreated({ userId, address: created });\n          } catch {\n            // The wallet exists; a failing hook must not turn that into an error.\n          }\n        }\n        return Response.json({ address: created, created: true });\n      } catch (createError) {\n        // Race guard: a concurrent request may have created the wallet between\n        // the check above and this call. Re-check before surfacing a failure.\n        try {\n          const again = findEmbeddedEthereumWallet(await privy.users()._get(userId));\n          if (again) return Response.json({ address: again.address, created: false });\n        } catch {\n          // fall through to the create error\n        }\n        return toErrorResponse(\n          new PepuError(\"WALLET_NOT_PROVISIONED\", \"Could not create a wallet.\", {\n            status: 502,\n            cause: toPepuError(createError),\n          }),\n        );\n      }\n    },\n  };\n}\n"]}

package/dist/chunk-6DSZ4Z2N.js

@@ -0,0 +1,498 @@
+import { isHex, decodeErrorResult } from 'viem';
+
+// src/errors.ts
+var PEPU_ERRORS_DOCS_URL = "https://guide.pepeunchained.com/reference/errors";
+var PEPU_ERROR_CATALOG = [
+  {
+    code: "PRIVY_KEY_QUORUM_MISMATCH",
+    title: "Privy authorization key does not match the wallet owner",
+    cause: "Privy returned 401 'No valid authorization keys or user signing keys available': the server's PRIVY_AUTHORIZATION_KEY is not a signer on the wallet, or the key quorum id differs from the one the user granted.",
+    fix: "Make sure PRIVY_AUTHORIZATION_KEY is the private half of the key whose quorum id is NEXT_PUBLIC_PRIVY_KEY_QUORUM_ID, and that the user granted that quorum as a signer.",
+    status: 500,
+    retryable: false,
+    matchers: [/No valid authorization keys or user signing keys available/i]
+  },
+  {
+    code: "POLICY_NAME_TOO_LONG",
+    title: "Privy policy or rule name is too long",
+    cause: "Privy rejects policy and rule names of 50 or more characters (the real limit is 49).",
+    fix: "Shorten the policy or rule name to 49 characters or fewer.",
+    status: 400,
+    retryable: false,
+    matchers: [/must be fewer than 50 characters/i, /name[^.\n]{0,40}\b(50|49) characters/i]
+  },
+  {
+    code: "WALLET_COINBASE_UNSUPPORTED_CHAIN",
+    title: "Coinbase Smart Wallet does not support PEPU",
+    cause: "Coinbase Smart Wallet is a smart-contract wallet on chains it knows; PEPU (97741) is not one of them, and it floods the console with unsupported-chain errors.",
+    fix: "Pin Coinbase to eoaOnly via createPepuPrivyConfig() from @pepu-chain/sdk/privy.",
+    status: 400,
+    retryable: false,
+    matchers: [
+      /coinbase[\s\S]{0,120}(unsupported|not supported)[\s\S]{0,60}chain/i,
+      /(unsupported|not supported) chain[\s\S]{0,120}coinbase/i
+    ]
+  },
+  {
+    code: "PRIVY_CHAIN_REJECTED_97741",
+    title: "Privy rejects server-side eth_sendTransaction on PEPU",
+    cause: "Privy's server-side send path does not know chain 97741 and rejects it. Signing works; sending does not.",
+    fix: "Sign with eth_signTransaction on the server and broadcast the raw transaction yourself (signAndBroadcast from @pepu-chain/sdk/session).",
+    status: 502,
+    retryable: false,
+    matchers: [
+      /eip155:97741[\s\S]{0,160}(unsupported|not supported|invalid|unknown|not found)/i,
+      /(unsupported|not supported|unknown|invalid) (chain|network|caip2)[\s\S]{0,80}97741/i
+    ]
+  },
+  {
+    code: "PAYMASTER_ORIGIN_NOT_ALLOWED",
+    title: "Paymaster refused the request origin",
+    cause: "The request Origin is not on the project's allowlist.",
+    fix: "Add the exact origin (scheme, host and port) to the project's allowed origins.",
+    status: 403,
+    retryable: false,
+    matchers: [/origin_not_allowed/i]
+  },
+  {
+    code: "PAYMASTER_DESTINATION_NOT_ALLOWED",
+    title: "Paymaster refused the call destination",
+    cause: "The UserOperation targets a contract that is not on the project's target allowlist.",
+    fix: "Add the contract to the project's targets, or sponsor only calls to allowed targets.",
+    status: 403,
+    retryable: false,
+    matchers: [/(destination|target)_not_allowed/i]
+  },
+  {
+    code: "PAYMASTER_PROJECT_NOT_CLAIMED",
+    title: "Sponsorship project is not claimed on-chain",
+    cause: "Deposits can sit in an unclaimed project, but nothing is sponsored until its owner has claimed it on-chain (the contract reports ProjectNotClaimed, the service project_not_claimed_onchain).",
+    fix: "Prove the Privy app (requestClaimAttestation from @pepu-chain/sdk/paymaster/server), call claimProject, then configureProject (setTargets, setDailyLimit, setSenderDailyLimit).",
+    status: 409,
+    retryable: false,
+    matchers: [/project_not_claimed_onchain/i, /ProjectNotClaimed/i]
+  },
+  {
+    code: "PAYMASTER_PROJECT_OWNER_CHANGED",
+    title: "Project owner changed since the credentials were issued",
+    cause: "The on-chain owner of the project is no longer the address the off-chain credentials were issued to (an ownership transfer or re-claim completed).",
+    fix: "As the new owner, sign in with SIWE, register the project again and rotate the client token and server key.",
+    status: 403,
+    retryable: false,
+    matchers: [/project_owner_changed/i]
+  },
+  {
+    code: "PAYMASTER_PROJECT_PAUSED",
+    title: "Sponsorship project is paused",
+    cause: "The project owner paused sponsorship on-chain.",
+    fix: "The owner can resume it with setPaused(projectId, false).",
+    status: 403,
+    retryable: false,
+    matchers: [/project_paused/i, /SponsorPaused/i]
+  },
+  {
+    code: "PAYMASTER_IDENTITY_REQUIRED",
+    title: "A verified Privy account is required",
+    cause: "The free tier (and any project with requireIdentity on) only sponsors users with a verified Privy access token.",
+    fix: "Send the user's Privy access token as Authorization: Bearer (or context.privyAccessToken for ERC-7677).",
+    status: 401,
+    retryable: false,
+    matchers: [/(project|free_tier)_identity_required/i]
+  },
+  {
+    code: "PAYMASTER_FREE_TIER_UNAVAILABLE",
+    title: "Free tier cannot sponsor this operation",
+    cause: "The free tier is disabled, its pool is empty, or the operation is larger than the per-op cap.",
+    fix: "Deposit into your own project and use its credentials, or retry later.",
+    status: 429,
+    retryable: true,
+    matchers: [/free_tier_disabled/i, /free_pool_(empty|op_too_large)/i]
+  },
+  {
+    code: "PAYMASTER_RATE_LIMITED",
+    title: "Paymaster API rate limit",
+    cause: "Too many requests to the paymaster API from this IP or account.",
+    fix: "Back off for the Retry-After interval (error.details.retryAfterSeconds when present).",
+    status: 429,
+    retryable: true,
+    matchers: [/\brate_limited\b/i]
+  },
+  {
+    code: "PAYMASTER_SESSION_REQUIRED",
+    title: "Paymaster owner session missing or expired",
+    cause: "Owner endpoints need a SIWE session token (1 h lifetime) for the project's current on-chain owner.",
+    fix: "Call loginWithWallet() on the paymaster API client, then retry.",
+    status: 401,
+    retryable: false,
+    matchers: []
+  },
+  {
+    code: "PAYMASTER_API_ERROR",
+    title: "Paymaster API request failed",
+    cause: "The paymaster API returned an error that has no more specific PEPU code.",
+    fix: "Read error.details (HTTP status and the service's error code) and the OpenAPI spec for that route.",
+    status: 502,
+    retryable: false,
+    matchers: []
+  },
+  {
+    code: "PAYMASTER_DENIED",
+    title: "Paymaster denied the sponsorship",
+    cause: "The paymaster rejected the credential or the sender (for example unknown_or_invalid_app_credential or sender_not_owned_by_token_user).",
+    fix: "Check the app credential or token, and that the smart account belongs to the user whose access token you sent.",
+    status: 403,
+    retryable: false,
+    matchers: [
+      /unknown_or_invalid_app_credential/i,
+      /sender_not_owned_by_token_user/i,
+      /paymaster[\s\S]{0,40}(denied|rejected)/i
+    ]
+  },
+  {
+    code: "PAYMASTER_NO_BALANCE",
+    title: "Sponsorship project has no balance",
+    cause: "The project's paymaster deposit cannot cover this operation.",
+    fix: "Deposit more PEPU to the project, then retry.",
+    status: 429,
+    retryable: true,
+    matchers: [/(project_)?(no|insufficient)_balance/i, /project_balance_exhausted/i, /InsufficientSponsorBalance/i, /insufficient (project )?(balance|deposit)[\s\S]{0,40}paymaster/i]
+  },
+  {
+    code: "PAYMASTER_CAP",
+    title: "Sponsorship cap reached",
+    cause: "A daily, per-sender or per-operation sponsorship cap was hit.",
+    fix: "Wait for the cap window to reset, or raise the project's daily and sender limits.",
+    status: 429,
+    retryable: true,
+    matchers: [/(daily|sender|per_sender)[_ -]?(cap|limit)[_ ]?(exceeded|reached)/i, /cap_exceeded|limit_exceeded/i, /free_tier_[a-z_]*_(exceeded|reached)/i, /fee_above_onchain_cap/i]
+  },
+  {
+    code: "BUNDLER_AA_FAILED",
+    title: "EntryPoint rejected the UserOperation",
+    cause: "The EntryPoint reported FailedOp with an AAxx code during validation or execution.",
+    fix: "Read the AAxx code: AA21 prefund missing, AA23 signature or validation reverted, AA25 invalid nonce, AA31/AA33/AA34 paymaster problems.",
+    status: 502,
+    retryable: false,
+    matchers: [/\bAA(1\d|2\d|3\d|4\d|5\d|9\d)\b/, /FailedOp(WithRevert)?/]
+  },
+  {
+    code: "BUNDLER_UNREACHABLE",
+    title: "Bundler or paymaster is unreachable",
+    cause: "The request to the bundler or paymaster URL failed before any response.",
+    fix: "Check PEPU_BUNDLER_URL and PEPU_PAYMASTER_URL. The hosted services may not be live yet; use checkSponsorship().",
+    status: 502,
+    retryable: true,
+    matchers: [/ECONNREFUSED|ENOTFOUND|ETIMEDOUT|fetch failed|bundler[\s\S]{0,30}unreachable/i]
+  },
+  {
+    code: "TX_NONCE_RACE",
+    title: "Nonce conflict",
+    cause: "Two transactions raced for one nonce, or a replacement was underpriced.",
+    fix: "Serialize sends per account (a lock), re-read the pending nonce, and retry.",
+    status: 409,
+    retryable: true,
+    matchers: [/nonce too (low|high)/i, /replacement transaction underpriced/i, /already known/i]
+  },
+  {
+    code: "TX_GAS_UNDERSHOOT",
+    title: "Gas limit too low",
+    cause: "Nitro gas estimation undershoots on PEPU: the L1 data component is not covered by the plain estimate.",
+    fix: "Add headroom to the estimate, 20% via withGasLimitBuffer() from @pepu-chain/sdk/session.",
+    status: 502,
+    retryable: true,
+    matchers: [/intrinsic gas too low/i, /gas required exceeds allowance/i, /gas limit too low/i]
+  },
+  {
+    code: "TX_REVERTED",
+    title: "Transaction reverted",
+    cause: "The contract call reverted.",
+    fix: "Decode the revert reason with explainError(<revert data>) and check arguments, allowances and balances.",
+    status: 502,
+    retryable: false,
+    matchers: [/execution reverted/i, /transaction (has )?reverted/i]
+  },
+  {
+    code: "MULTICALL3_CANONICAL_ADDRESS",
+    title: "Canonical Multicall3 address used on PEPU",
+    cause: "PEPU's Multicall3 is not at the canonical 0xcA11...CA11 address.",
+    fix: "Use getMulticall3() or pepuMulticall() from @pepu-chain/sdk, or the pepuMainnet chain object, which carries the right address.",
+    status: 500,
+    retryable: false,
+    matchers: [/0xcA11bde05977b3631167028862bE2a173976CA11/i]
+  },
+  {
+    code: "WALLET_INJECTED_ACTIVE",
+    title: "An injected browser wallet is the active account",
+    cause: "wagmi's active account is a browser extension rather than the Privy embedded wallet.",
+    fix: "Pin the embedded wallet with useActiveWalletPin() from @pepu-chain/sdk/privy/wagmi.",
+    status: 400,
+    retryable: false,
+    matchers: [/ConnectorNotConnectedError/i, /chrome-extension:\/\//i, /injected (wallet|provider|connector)/i]
+  },
+  {
+    code: "CONFIG_PRIVY_CREATE_ON_LOGIN",
+    title: "Embedded wallet never appears after login",
+    cause: "The dashboard's automatic embedded wallet creation is off, so createOnLogin never resolves.",
+    fix: "Create the wallet server-side with the ensure-wallet route (createEnsureWalletRoute), or enable creation in the Privy dashboard.",
+    status: 500,
+    retryable: false,
+    matchers: [/createOnLogin/i, /embedded wallet[\s\S]{0,60}(never|did not|didn't) (appear|created)/i]
+  },
+  {
+    code: "CONFIG_ORIGIN_MISMATCH",
+    title: "Origin is not allowed by Privy",
+    cause: "The page origin (scheme, host and port) is not in the Privy app's allowed origins. A different dev port is the usual cause.",
+    fix: "Add the exact origin, including the port, to Privy dashboard Allowed origins.",
+    status: 500,
+    retryable: false,
+    matchers: [/origin[^.\n]{0,60}(not allowed|not configured|not in (the )?allowed)/i, /allowed origins?/i]
+  },
+  {
+    code: "CONFIG_PRIVY_DASHBOARD",
+    title: "Privy dashboard misconfiguration",
+    cause: "A required Privy dashboard setting is missing.",
+    fix: "Run checkPrivyDashboardConfig() and follow its fix list.",
+    status: 500,
+    retryable: false,
+    matchers: []
+  },
+  {
+    code: "CONFIG_MISSING_ENV",
+    title: "Missing environment variable",
+    cause: "A required environment variable is not set.",
+    fix: "Set the listed variables (see .env.example) and restart the process.",
+    status: 500,
+    retryable: false,
+    matchers: [/missing required env/i]
+  },
+  {
+    code: "CONFIG_BAD_URL",
+    title: "Invalid endpoint URL",
+    cause: "A configured bundler, paymaster or RPC URL is not a valid http(s) URL.",
+    fix: "Use a full URL such as https://bundler.example.com.",
+    status: 500,
+    retryable: false,
+    matchers: []
+  },
+  {
+    code: "CONFIG_SERVER_ONLY",
+    title: "Server-only module imported in the browser",
+    cause: "A server entry point was bundled into client code.",
+    fix: "Import server entries only from route handlers, server actions and scripts.",
+    status: 500,
+    retryable: false,
+    matchers: []
+  },
+  {
+    code: "AUTH_INVALID_TOKEN",
+    title: "Invalid or missing Privy access token",
+    cause: "The request carried no bearer token, or Privy could not verify it.",
+    fix: "Send Authorization: Bearer <getAccessToken()> and verify the token server-side.",
+    status: 401,
+    retryable: false,
+    matchers: [/invalid (auth(orization)?|access|jwt|id) token/i, /\bjwt (expired|malformed|invalid)/i]
+  },
+  {
+    code: "WALLET_NOT_PROVISIONED",
+    title: "User has no embedded wallet yet",
+    cause: "The user is signed in but no embedded Ethereum wallet exists.",
+    fix: "Call the ensure-wallet route (useEnsureWallet or WalletGate) before acting.",
+    status: 409,
+    retryable: true,
+    matchers: []
+  },
+  {
+    code: "POLICY_UNSCOPED",
+    title: "Session policy is not scoped",
+    cause: "A session policy needs a target contract, at least one function and an expiry.",
+    fix: "Pass contractAddress, functions and expiresAtUnixSeconds to buildSessionPolicy().",
+    status: 400,
+    retryable: false,
+    matchers: []
+  },
+  {
+    code: "SESSION_EXPIRED",
+    title: "Session expired",
+    cause: "The session's expiry has passed.",
+    fix: "Grant a new session.",
+    status: 410,
+    retryable: false,
+    matchers: []
+  },
+  {
+    code: "SESSION_NONE",
+    title: "No active session",
+    cause: "The user has not granted a session, or it was revoked.",
+    fix: "Ask the user to grant a session first.",
+    status: 409,
+    retryable: false,
+    matchers: []
+  },
+  {
+    code: "SESSION_APPROVAL_MISMATCH",
+    title: "Session approval does not match",
+    cause: "The approval was made for another account, permission id or mode.",
+    fix: "Re-run prepare, have the owner sign again, then activate.",
+    status: 409,
+    retryable: false,
+    matchers: []
+  },
+  {
+    code: "UNKNOWN",
+    title: "Unknown error",
+    cause: "The error did not match any known PEPU failure.",
+    fix: "Read the original message. Run pepu_known_gotchas in the MCP server, or search the docs.",
+    status: 500,
+    retryable: false,
+    matchers: []
+  }
+];
+var catalogByCode = new Map(
+  PEPU_ERROR_CATALOG.map((e) => [e.code, e])
+);
+function getErrorEntry(code) {
+  const entry = catalogByCode.get(code) ?? catalogByCode.get("UNKNOWN");
+  if (!entry) throw new Error("PEPU_ERROR_CATALOG is missing the UNKNOWN entry");
+  return entry;
+}
+function errorDocsUrl(code) {
+  return `${PEPU_ERRORS_DOCS_URL}#${code}`;
+}
+var PepuError = class extends Error {
+  code;
+  hint;
+  docsUrl;
+  retryable;
+  status;
+  details;
+  constructor(code, message, options = {}) {
+    const entry = getErrorEntry(code);
+    super(message ?? entry.title, options.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = new.target.name;
+    this.code = code;
+    this.hint = options.hint ?? entry.fix;
+    this.docsUrl = options.docsUrl ?? errorDocsUrl(code);
+    this.retryable = options.retryable ?? entry.retryable;
+    this.status = options.status ?? entry.status;
+    if (options.details !== void 0) this.details = options.details;
+  }
+};
+var PepuConfigError = class extends PepuError {
+};
+var PepuAuthError = class extends PepuError {
+};
+var PepuPolicyError = class extends PepuError {
+};
+var PepuSessionError = class extends PepuError {
+};
+var PepuBundlerError = class extends PepuError {
+};
+var PepuPaymasterError = class extends PepuError {
+};
+var PepuChainError = class extends PepuError {
+};
+function classForCode(code) {
+  if (code.startsWith("CONFIG_") || code.startsWith("PRIVY_")) return PepuConfigError;
+  if (code === "AUTH_INVALID_TOKEN" || code === "WALLET_NOT_PROVISIONED") return PepuAuthError;
+  if (code.startsWith("POLICY_")) return PepuPolicyError;
+  if (code.startsWith("SESSION_")) return PepuSessionError;
+  if (code.startsWith("BUNDLER_")) return PepuBundlerError;
+  if (code.startsWith("PAYMASTER_")) return PepuPaymasterError;
+  if (code.startsWith("TX_") || code.startsWith("MULTICALL3_") || code.startsWith("WALLET_")) return PepuChainError;
+  return PepuError;
+}
+var REVERT_ABI = [
+  { type: "error", name: "Error", inputs: [{ name: "message", type: "string" }] },
+  { type: "error", name: "Panic", inputs: [{ name: "code", type: "uint256" }] },
+  {
+    type: "error",
+    name: "FailedOp",
+    inputs: [
+      { name: "opIndex", type: "uint256" },
+      { name: "reason", type: "string" }
+    ]
+  },
+  {
+    type: "error",
+    name: "FailedOpWithRevert",
+    inputs: [
+      { name: "opIndex", type: "uint256" },
+      { name: "reason", type: "string" },
+      { name: "inner", type: "bytes" }
+    ]
+  }
+];
+function flatten(e) {
+  const seen = /* @__PURE__ */ new Set();
+  const parts = [];
+  let cur = e;
+  for (let depth = 0; depth < 6 && cur !== void 0 && cur !== null && !seen.has(cur); depth++) {
+    seen.add(cur);
+    if (typeof cur === "object") {
+      const o = cur;
+      for (const k of ["shortMessage", "message", "details", "reason"]) {
+        const v = o[k];
+        if (typeof v === "string") parts.push(v);
+      }
+      cur = o["cause"];
+    } else {
+      parts.push(String(cur));
+      break;
+    }
+  }
+  return parts.join("\n");
+}
+function matchCatalog(text) {
+  return PEPU_ERROR_CATALOG.find((entry) => entry.matchers.some((m) => m.test(text)));
+}
+function explanation(entry, matched) {
+  return {
+    code: entry.code,
+    title: entry.title,
+    cause: entry.cause,
+    fix: entry.fix,
+    docsUrl: errorDocsUrl(entry.code),
+    matched
+  };
+}
+function explainError(e) {
+  if (e instanceof PepuError) return explanation(getErrorEntry(e.code), "catalog");
+  if (typeof e === "string" && isHex(e) && e.length >= 10) {
+    try {
+      const decoded = decodeErrorResult({ abi: REVERT_ABI, data: e });
+      const argText = (decoded.args ?? []).map((a) => typeof a === "string" ? a : "").join("\n");
+      const hit2 = matchCatalog(`${argText}
+${decoded.errorName}`);
+      if (hit2) return explanation(hit2, "abi-decode");
+      return explanation(getErrorEntry("TX_REVERTED"), "abi-decode");
+    } catch {
+      return explanation(getErrorEntry("UNKNOWN"), "unknown");
+    }
+  }
+  const text = typeof e === "string" ? e : flatten(e);
+  const hit = matchCatalog(text);
+  return hit ? explanation(hit, "catalog") : explanation(getErrorEntry("UNKNOWN"), "unknown");
+}
+function toPepuError(e, ctx) {
+  if (e instanceof PepuError) return e;
+  const explained = explainError(e);
+  const original = (typeof e === "string" ? e : flatten(e)) || "Unknown error";
+  const message = ctx ? `${ctx.op}: ${original}` : original;
+  const Cls = classForCode(explained.code);
+  return new Cls(explained.code, message, { cause: e });
+}
+function toErrorBody(e) {
+  const err = toPepuError(e);
+  return { error: { code: err.code, message: err.message, hint: err.hint } };
+}
+function toErrorResponse(e) {
+  const err = toPepuError(e);
+  return new Response(JSON.stringify(toErrorBody(err)), {
+    status: err.status,
+    headers: { "content-type": "application/json" }
+  });
+}
+
+export { PEPU_ERRORS_DOCS_URL, PEPU_ERROR_CATALOG, PepuAuthError, PepuBundlerError, PepuChainError, PepuConfigError, PepuError, PepuPaymasterError, PepuPolicyError, PepuSessionError, errorDocsUrl, explainError, getErrorEntry, toErrorBody, toErrorResponse, toPepuError };
+//# sourceMappingURL=chunk-6DSZ4Z2N.js.map
+//# sourceMappingURL=chunk-6DSZ4Z2N.js.map

package/dist/chunk-6DSZ4Z2N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts"],"names":["hit"],"mappings":";;;AAUO,IAAM,oBAAA,GAAuB;AA4D7B,IAAM,kBAAA,GAAmD;AAAA,EAC9D;AAAA,IACE,IAAA,EAAM,2BAAA;AAAA,IACN,KAAA,EAAO,yDAAA;AAAA,IACP,KAAA,EACE,kNAAA;AAAA,IACF,GAAA,EAAK,yKAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,6DAA6D;AAAA,GAC1E;AAAA,EACA;AAAA,IACE,IAAA,EAAM,sBAAA;AAAA,IACN,KAAA,EAAO,uCAAA;AAAA,IACP,KAAA,EAAO,sFAAA;AAAA,IACP,GAAA,EAAK,4DAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,mCAAA,EAAqC,uCAAuC;AAAA,GACzF;AAAA,EACA;AAAA,IACE,IAAA,EAAM,mCAAA;AAAA,IACN,KAAA,EAAO,6CAAA;AAAA,IACP,KAAA,EACE,gKAAA;AAAA,IACF,GAAA,EAAK,iFAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU;AAAA,MACR,oEAAA;AAAA,MACA;AAAA;AACF,GACF;AAAA,EACA;AAAA,IACE,IAAA,EAAM,4BAAA;AAAA,IACN,KAAA,EAAO,uDAAA;AAAA,IACP,KAAA,EAAO,0GAAA;AAAA,IACP,GAAA,EAAK,yIAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU;AAAA,MACR,iFAAA;AAAA,MACA;AAAA;AACF,GACF;AAAA,EACA;AAAA,IACE,IAAA,EAAM,8BAAA;AAAA,IACN,KAAA,EAAO,sCAAA;AAAA,IACP,KAAA,EAAO,uDAAA;AAAA,IACP,GAAA,EAAK,gFAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,qBAAqB;AAAA,GAClC;AAAA,EACA;AAAA,IACE,IAAA,EAAM,mCAAA;AAAA,IACN,KAAA,EAAO,wCAAA;AAAA,IACP,KAAA,EAAO,qFAAA;AAAA,IACP,GAAA,EAAK,sFAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,mCAAmC;AAAA,GAChD;AAAA,EACA;AAAA,IACE,IAAA,EAAM,+BAAA;AAAA,IACN,KAAA,EAAO,6CAAA;AAAA,IACP,KAAA,EACE,+LAAA;AAAA,IACF,GAAA,EAAK,iLAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,8BAAA,EAAgC,oBAAoB;AAAA,GACjE;AAAA,EACA;AAAA,IACE,IAAA,EAAM,iCAAA;AAAA,IACN,KAAA,EAAO,yDAAA;AAAA,IACP,KAAA,EACE,oJAAA;AAAA,IACF,GAAA,EAAK,6GAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,wBAAwB;AAAA,GACrC;AAAA,EACA;AAAA,IACE,IAAA,EAAM,0BAAA;AAAA,IACN,KAAA,EAAO,+BAAA;AAAA,IACP,KAAA,EAAO,gDAAA;AAAA,IACP,GAAA,EAAK,2DAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,iBAAA,EAAmB,gBAAgB;AAAA,GAChD;AAAA,EACA;AAAA,IACE,IAAA,EAAM,6BAAA;AAAA,IACN,KAAA,EAAO,sCAAA;AAAA,IACP,KAAA,EAAO,iHAAA;AAAA,IACP,GAAA,EAAK,yGAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,wCAAwC;AAAA,GACrD;AAAA,EACA;AAAA,IACE,IAAA,EAAM,iCAAA;AAAA,IACN,KAAA,EAAO,yCAAA;AAAA,IACP,KAAA,EAAO,+FAAA;AAAA,IACP,GAAA,EAAK,wEAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,QAAA,EAAU,CAAC,qBAAA,EAAuB,iCAAiC;AAAA,GACrE;AAAA,EACA;AAAA,IACE,IAAA,EAAM,wBAAA;AAAA,IACN,KAAA,EAAO,0BAAA;AAAA,IACP,KAAA,EAAO,iEAAA;AAAA,IACP,GAAA,EAAK,uFAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,QAAA,EAAU,CAAC,mBAAmB;AAAA,GAChC;AAAA,EACA;AAAA,IACE,IAAA,EAAM,4BAAA;AAAA,IACN,KAAA,EAAO,4CAAA;AAAA,IACP,KAAA,EAAO,oGAAA;AAAA,IACP,GAAA,EAAK,iEAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,qBAAA;AAAA,IACN,KAAA,EAAO,8BAAA;AAAA,IACP,KAAA,EAAO,0EAAA;AAAA,IACP,GAAA,EAAK,oGAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,kBAAA;AAAA,IACN,KAAA,EAAO,kCAAA;AAAA,IACP,KAAA,EACE,wIAAA;AAAA,IACF,GAAA,EAAK,gHAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU;AAAA,MACR,oCAAA;AAAA,MACA,iCAAA;AAAA,MACA;AAAA;AACF,GACF;AAAA,EACA;AAAA,IACE,IAAA,EAAM,sBAAA;AAAA,IACN,KAAA,EAAO,oCAAA;AAAA,IACP,KAAA,EAAO,8DAAA;AAAA,IACP,GAAA,EAAK,+CAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,QAAA,EAAU,CAAC,uCAAA,EAAyC,4BAAA,EAA8B,+BAA+B,iEAAiE;AAAA,GACpL;AAAA,EACA;AAAA,IACE,IAAA,EAAM,eAAA;AAAA,IACN,KAAA,EAAO,yBAAA;AAAA,IACP,KAAA,EAAO,+DAAA;AAAA,IACP,GAAA,EAAK,mFAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,QAAA,EAAU,CAAC,oEAAA,EAAsE,8BAAA,EAAgC,yCAAyC,wBAAwB;AAAA,GACpL;AAAA,EACA;AAAA,IACE,IAAA,EAAM,mBAAA;AAAA,IACN,KAAA,EAAO,uCAAA;AAAA,IACP,KAAA,EAAO,oFAAA;AAAA,IACP,GAAA,EAAK,yIAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,iCAAA,EAAmC,uBAAuB;AAAA,GACvE;AAAA,EACA;AAAA,IACE,IAAA,EAAM,qBAAA;AAAA,IACN,KAAA,EAAO,qCAAA;AAAA,IACP,KAAA,EAAO,yEAAA;AAAA,IACP,GAAA,EAAK,iHAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,QAAA,EAAU,CAAC,+EAA+E;AAAA,GAC5F;AAAA,EACA;AAAA,IACE,IAAA,EAAM,eAAA;AAAA,IACN,KAAA,EAAO,gBAAA;AAAA,IACP,KAAA,EAAO,yEAAA;AAAA,IACP,GAAA,EAAK,6EAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,QAAA,EAAU,CAAC,uBAAA,EAAyB,sCAAA,EAAwC,gBAAgB;AAAA,GAC9F;AAAA,EACA;AAAA,IACE,IAAA,EAAM,mBAAA;AAAA,IACN,KAAA,EAAO,mBAAA;AAAA,IACP,KAAA,EAAO,uGAAA;AAAA,IACP,GAAA,EAAK,0FAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,QAAA,EAAU,CAAC,wBAAA,EAA0B,iCAAA,EAAmC,oBAAoB;AAAA,GAC9F;AAAA,EACA;AAAA,IACE,IAAA,EAAM,aAAA;AAAA,IACN,KAAA,EAAO,sBAAA;AAAA,IACP,KAAA,EAAO,6BAAA;AAAA,IACP,GAAA,EAAK,yGAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,qBAAA,EAAuB,8BAA8B;AAAA,GAClE;AAAA,EACA;AAAA,IACE,IAAA,EAAM,8BAAA;AAAA,IACN,KAAA,EAAO,2CAAA;AAAA,IACP,KAAA,EAAO,kEAAA;AAAA,IACP,GAAA,EAAK,gIAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,6CAA6C;AAAA,GAC1D;AAAA,EACA;AAAA,IACE,IAAA,EAAM,wBAAA;AAAA,IACN,KAAA,EAAO,kDAAA;AAAA,IACP,KAAA,EAAO,sFAAA;AAAA,IACP,GAAA,EAAK,qFAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,6BAAA,EAA+B,wBAAA,EAA0B,uCAAuC;AAAA,GAC7G;AAAA,EACA;AAAA,IACE,IAAA,EAAM,8BAAA;AAAA,IACN,KAAA,EAAO,2CAAA;AAAA,IACP,KAAA,EAAO,6FAAA;AAAA,IACP,GAAA,EAAK,kIAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,gBAAA,EAAkB,qEAAqE;AAAA,GACpG;AAAA,EACA;AAAA,IACE,IAAA,EAAM,wBAAA;AAAA,IACN,KAAA,EAAO,gCAAA;AAAA,IACP,KAAA,EACE,6HAAA;AAAA,IACF,GAAA,EAAK,+EAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,uEAAA,EAAyE,mBAAmB;AAAA,GACzG;AAAA,EACA;AAAA,IACE,IAAA,EAAM,wBAAA;AAAA,IACN,KAAA,EAAO,kCAAA;AAAA,IACP,KAAA,EAAO,gDAAA;AAAA,IACP,GAAA,EAAK,0DAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,oBAAA;AAAA,IACN,KAAA,EAAO,8BAAA;AAAA,IACP,KAAA,EAAO,6CAAA;AAAA,IACP,GAAA,EAAK,sEAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,uBAAuB;AAAA,GACpC;AAAA,EACA;AAAA,IACE,IAAA,EAAM,gBAAA;AAAA,IACN,KAAA,EAAO,sBAAA;AAAA,IACP,KAAA,EAAO,wEAAA;AAAA,IACP,GAAA,EAAK,qDAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,oBAAA;AAAA,IACN,KAAA,EAAO,4CAAA;AAAA,IACP,KAAA,EAAO,oDAAA;AAAA,IACP,GAAA,EAAK,6EAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,oBAAA;AAAA,IACN,KAAA,EAAO,uCAAA;AAAA,IACP,KAAA,EAAO,oEAAA;AAAA,IACP,GAAA,EAAK,iFAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,QAAA,EAAU,CAAC,iDAAA,EAAmD,oCAAoC;AAAA,GACpG;AAAA,EACA;AAAA,IACE,IAAA,EAAM,wBAAA;AAAA,IACN,KAAA,EAAO,iCAAA;AAAA,IACP,KAAA,EAAO,+DAAA;AAAA,IACP,GAAA,EAAK,6EAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,iBAAA;AAAA,IACN,KAAA,EAAO,8BAAA;AAAA,IACP,KAAA,EAAO,gFAAA;AAAA,IACP,GAAA,EAAK,mFAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,iBAAA;AAAA,IACN,KAAA,EAAO,iBAAA;AAAA,IACP,KAAA,EAAO,kCAAA;AAAA,IACP,GAAA,EAAK,sBAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,cAAA;AAAA,IACN,KAAA,EAAO,mBAAA;AAAA,IACP,KAAA,EAAO,wDAAA;AAAA,IACP,GAAA,EAAK,wCAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,2BAAA;AAAA,IACN,KAAA,EAAO,iCAAA;AAAA,IACP,KAAA,EAAO,mEAAA;AAAA,IACP,GAAA,EAAK,2DAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC,GACb;AAAA,EACA;AAAA,IACE,IAAA,EAAM,SAAA;AAAA,IACN,KAAA,EAAO,eAAA;AAAA,IACP,KAAA,EAAO,iDAAA;AAAA,IACP,GAAA,EAAK,0FAAA;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,SAAA,EAAW,KAAA;AAAA,IACX,UAAU;AAAC;AAEf;AAEA,IAAM,gBAA+D,IAAI,GAAA;AAAA,EACvE,kBAAA,CAAmB,IAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAC;AAC3C,CAAA;AAGO,SAAS,cAAc,IAAA,EAAwC;AACpE,EAAA,MAAM,QAAQ,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA,IAAK,aAAA,CAAc,IAAI,SAAS,CAAA;AACpE,EAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAC7E,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,aAAa,IAAA,EAA6B;AACxD,EAAA,OAAO,CAAA,EAAG,oBAAoB,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AACxC;AAWO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EAC1B,IAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAAqB,OAAA,EAAkB,OAAA,GAA4B,EAAC,EAAG;AACjF,IAAA,MAAM,KAAA,GAAQ,cAAc,IAAI,CAAA;AAChC,IAAA,KAAA,CAAM,OAAA,IAAW,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,KAAA,KAAU,MAAA,GAAY,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,CAAA;AAChG,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,OAAA,CAAQ,IAAA,IAAQ,KAAA,CAAM,GAAA;AAClC,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,YAAA,CAAa,IAAI,CAAA;AACnD,IAAA,IAAA,CAAK,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,KAAA,CAAM,SAAA;AAC5C,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,KAAA,CAAM,MAAA;AACtC,IAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAW,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AAAA,EAC5D;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,SAAA,CAAU;AAAC;AAEzC,IAAM,aAAA,GAAN,cAA4B,SAAA,CAAU;AAAC;AAEvC,IAAM,eAAA,GAAN,cAA8B,SAAA,CAAU;AAAC;AAEzC,IAAM,gBAAA,GAAN,cAA+B,SAAA,CAAU;AAAC;AAE1C,IAAM,gBAAA,GAAN,cAA+B,SAAA,CAAU;AAAC;AAE1C,IAAM,kBAAA,GAAN,cAAiC,SAAA,CAAU;AAAC;AAE5C,IAAM,cAAA,GAAN,cAA6B,SAAA,CAAU;AAAC;AAI/C,SAAS,aAAa,IAAA,EAAqC;AACzD,EAAA,IAAI,IAAA,CAAK,WAAW,SAAS,CAAA,IAAK,KAAK,UAAA,CAAW,QAAQ,GAAG,OAAO,eAAA;AACpE,EAAA,IAAI,IAAA,KAAS,oBAAA,IAAwB,IAAA,KAAS,wBAAA,EAA0B,OAAO,aAAA;AAC/E,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,eAAA;AACvC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,EAAG,OAAO,gBAAA;AACxC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,UAAU,CAAA,EAAG,OAAO,gBAAA;AACxC,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,YAAY,CAAA,EAAG,OAAO,kBAAA;AAC1C,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,KAAK,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,aAAa,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,cAAA;AACnG,EAAA,OAAO,SAAA;AACT;AAEA,IAAM,UAAA,GAAa;AAAA,EACjB,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,MAAA,EAAQ,CAAC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,QAAA,EAAU,CAAA,EAAE;AAAA,EAC9E,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,MAAA,EAAQ,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EAC5E;AAAA,IACE,IAAA,EAAM,OAAA;AAAA,IACN,IAAA,EAAM,UAAA;AAAA,IACN,MAAA,EAAQ;AAAA,MACN,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,SAAA,EAAU;AAAA,MACnC,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,QAAA;AAAS;AACnC,GACF;AAAA,EACA;AAAA,IACE,IAAA,EAAM,OAAA;AAAA,IACN,IAAA,EAAM,oBAAA;AAAA,IACN,MAAA,EAAQ;AAAA,MACN,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,SAAA,EAAU;AAAA,MACnC,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,QAAA,EAAS;AAAA,MACjC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,OAAA;AAAQ;AACjC;AAEJ,CAAA;AAEA,SAAS,QAAQ,CAAA,EAAoB;AACnC,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAa;AAC9B,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI,GAAA,GAAe,CAAA;AACnB,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,CAAA,IAAK,GAAA,KAAQ,MAAA,IAAa,GAAA,KAAQ,IAAA,IAAQ,CAAC,IAAA,CAAK,GAAA,CAAI,GAAG,GAAG,KAAA,EAAA,EAAS;AAC7F,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,KAAA,MAAW,KAAK,CAAC,cAAA,EAAgB,SAAA,EAAW,SAAA,EAAW,QAAQ,CAAA,EAAG;AAChE,QAAA,MAAM,CAAA,GAAI,EAAE,CAAC,CAAA;AACb,QAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,MACzC;AACA,MAAA,GAAA,GAAM,EAAE,OAAO,CAAA;AAAA,IACjB,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAC,CAAA;AACtB,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAWA,SAAS,aAAa,IAAA,EAA6C;AACjE,EAAA,OAAO,kBAAA,CAAmB,IAAA,CAAK,CAAC,KAAA,KAAU,KAAA,CAAM,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AACpF;AAEA,SAAS,WAAA,CAAY,OAA0B,OAAA,EAAwD;AACrG,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,KAAK,KAAA,CAAM,GAAA;AAAA,IACX,OAAA,EAAS,YAAA,CAAa,KAAA,CAAM,IAAI,CAAA;AAAA,IAChC;AAAA,GACF;AACF;AAMO,SAAS,aAAa,CAAA,EAA6C;AACxE,EAAA,IAAI,CAAA,YAAa,WAAW,OAAO,WAAA,CAAY,cAAc,CAAA,CAAE,IAAI,GAAG,SAAS,CAAA;AAE/E,EAAA,IAAI,OAAO,MAAM,QAAA,IAAY,KAAA,CAAM,CAAC,CAAA,IAAK,CAAA,CAAE,UAAU,EAAA,EAAI;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,UAAU,iBAAA,CAAkB,EAAE,KAAK,UAAA,EAAY,IAAA,EAAM,GAAG,CAAA;AAC9D,MAAA,MAAM,OAAA,GAAA,CAAW,OAAA,CAAQ,IAAA,IAAQ,IAAI,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,MAAM,QAAA,GAAW,CAAA,GAAI,EAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AAC3F,MAAA,MAAMA,IAAAA,GAAM,YAAA,CAAa,CAAA,EAAG,OAAO;AAAA,EAAK,OAAA,CAAQ,SAAS,CAAA,CAAE,CAAA;AAC3D,MAAA,IAAIA,IAAAA,EAAK,OAAO,WAAA,CAAYA,IAAAA,EAAK,YAAY,CAAA;AAC7C,MAAA,OAAO,WAAA,CAAY,aAAA,CAAc,aAAa,CAAA,EAAG,YAAY,CAAA;AAAA,IAC/D,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,WAAA,CAAY,aAAA,CAAc,SAAS,CAAA,EAAG,SAAS,CAAA;AAAA,IACxD;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,QAAQ,CAAC,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,aAAa,IAAI,CAAA;AAC7B,EAAA,OAAO,GAAA,GAAM,YAAY,GAAA,EAAK,SAAS,IAAI,WAAA,CAAY,aAAA,CAAc,SAAS,CAAA,EAAG,SAAS,CAAA;AAC5F;AAGO,SAAS,WAAA,CAAY,GAAY,GAAA,EAAiC;AACvE,EAAA,IAAI,CAAA,YAAa,WAAW,OAAO,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,aAAa,CAAC,CAAA;AAChC,EAAA,MAAM,YAAY,OAAO,CAAA,KAAM,WAAW,CAAA,GAAI,OAAA,CAAQ,CAAC,CAAA,KAAM,eAAA;AAC7D,EAAA,MAAM,UAAU,GAAA,GAAM,CAAA,EAAG,IAAI,EAAE,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAA,GAAK,QAAA;AACjD,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,SAAA,CAAU,IAAI,CAAA;AACvC,EAAA,OAAO,IAAI,IAAI,SAAA,CAAU,IAAA,EAAM,SAAS,EAAE,KAAA,EAAO,GAAG,CAAA;AACtD;AAGO,SAAS,YAAY,CAAA,EAA+E;AACzG,EAAA,MAAM,GAAA,GAAM,YAAY,CAAC,CAAA;AACzB,EAAA,OAAO,EAAE,KAAA,EAAO,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,IAAA,EAAK,EAAE;AAC3E;AAGO,SAAS,gBAAgB,CAAA,EAAsB;AACpD,EAAA,MAAM,GAAA,GAAM,YAAY,CAAC,CAAA;AACzB,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,UAAU,WAAA,CAAY,GAAG,CAAC,CAAA,EAAG;AAAA,IACpD,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAC/C,CAAA;AACH","file":"chunk-6DSZ4Z2N.js","sourcesContent":["import { decodeErrorResult, isHex } from \"viem\";\nimport type { Abi, Hex } from \"viem\";\n\n/**\n * The SDK error model. Everything the SDK throws is a {@link PepuError}\n * subclass carrying a stable `code`, a one-sentence `hint` and a `docsUrl`.\n * Messages never contain secrets: they name environment variables, never\n * their values.\n */\n\nexport const PEPU_ERRORS_DOCS_URL = \"https://guide.pepeunchained.com/reference/errors\";\n\nexport type PepuErrorCode =\n  | \"CONFIG_MISSING_ENV\"\n  | \"CONFIG_BAD_URL\"\n  | \"CONFIG_SERVER_ONLY\"\n  | \"CONFIG_PRIVY_DASHBOARD\"\n  | \"CONFIG_PRIVY_CREATE_ON_LOGIN\"\n  | \"CONFIG_ORIGIN_MISMATCH\"\n  | \"AUTH_INVALID_TOKEN\"\n  | \"WALLET_NOT_PROVISIONED\"\n  | \"WALLET_COINBASE_UNSUPPORTED_CHAIN\"\n  | \"WALLET_INJECTED_ACTIVE\"\n  | \"POLICY_UNSCOPED\"\n  | \"POLICY_NAME_TOO_LONG\"\n  | \"SESSION_EXPIRED\"\n  | \"SESSION_NONE\"\n  | \"SESSION_APPROVAL_MISMATCH\"\n  | \"PRIVY_CHAIN_REJECTED_97741\"\n  | \"PRIVY_KEY_QUORUM_MISMATCH\"\n  | \"BUNDLER_UNREACHABLE\"\n  | \"BUNDLER_AA_FAILED\"\n  | \"PAYMASTER_DENIED\"\n  | \"PAYMASTER_NO_BALANCE\"\n  | \"PAYMASTER_CAP\"\n  | \"PAYMASTER_ORIGIN_NOT_ALLOWED\"\n  | \"PAYMASTER_DESTINATION_NOT_ALLOWED\"\n  | \"PAYMASTER_PROJECT_NOT_CLAIMED\"\n  | \"PAYMASTER_PROJECT_OWNER_CHANGED\"\n  | \"PAYMASTER_PROJECT_PAUSED\"\n  | \"PAYMASTER_IDENTITY_REQUIRED\"\n  | \"PAYMASTER_FREE_TIER_UNAVAILABLE\"\n  | \"PAYMASTER_RATE_LIMITED\"\n  | \"PAYMASTER_SESSION_REQUIRED\"\n  | \"PAYMASTER_API_ERROR\"\n  | \"TX_REVERTED\"\n  | \"TX_NONCE_RACE\"\n  | \"TX_GAS_UNDERSHOOT\"\n  | \"MULTICALL3_CANONICAL_ADDRESS\"\n  | \"UNKNOWN\";\n\nexport interface ErrorCatalogEntry {\n  readonly code: PepuErrorCode;\n  readonly title: string;\n  /** What went wrong, in one or two sentences. */\n  readonly cause: string;\n  /** How to fix it. */\n  readonly fix: string;\n  /** Suggested HTTP status for route factories. */\n  readonly status: number;\n  readonly retryable: boolean;\n  /** Tested, in order, against the flattened error text. Empty for code-only entries. */\n  readonly matchers: readonly RegExp[];\n}\n\n/**\n * Single source for the SDK `explainError`, the MCP `pepu_explain_error` tool\n * and the generated docs error page. ORDER MATTERS: the first entry whose\n * matcher hits wins, so specific entries come before general ones.\n */\nexport const PEPU_ERROR_CATALOG: readonly ErrorCatalogEntry[] = [\n  {\n    code: \"PRIVY_KEY_QUORUM_MISMATCH\",\n    title: \"Privy authorization key does not match the wallet owner\",\n    cause:\n      \"Privy returned 401 'No valid authorization keys or user signing keys available': the server's PRIVY_AUTHORIZATION_KEY is not a signer on the wallet, or the key quorum id differs from the one the user granted.\",\n    fix: \"Make sure PRIVY_AUTHORIZATION_KEY is the private half of the key whose quorum id is NEXT_PUBLIC_PRIVY_KEY_QUORUM_ID, and that the user granted that quorum as a signer.\",\n    status: 500,\n    retryable: false,\n    matchers: [/No valid authorization keys or user signing keys available/i],\n  },\n  {\n    code: \"POLICY_NAME_TOO_LONG\",\n    title: \"Privy policy or rule name is too long\",\n    cause: \"Privy rejects policy and rule names of 50 or more characters (the real limit is 49).\",\n    fix: \"Shorten the policy or rule name to 49 characters or fewer.\",\n    status: 400,\n    retryable: false,\n    matchers: [/must be fewer than 50 characters/i, /name[^.\\n]{0,40}\\b(50|49) characters/i],\n  },\n  {\n    code: \"WALLET_COINBASE_UNSUPPORTED_CHAIN\",\n    title: \"Coinbase Smart Wallet does not support PEPU\",\n    cause:\n      \"Coinbase Smart Wallet is a smart-contract wallet on chains it knows; PEPU (97741) is not one of them, and it floods the console with unsupported-chain errors.\",\n    fix: \"Pin Coinbase to eoaOnly via createPepuPrivyConfig() from @pepu-chain/sdk/privy.\",\n    status: 400,\n    retryable: false,\n    matchers: [\n      /coinbase[\\s\\S]{0,120}(unsupported|not supported)[\\s\\S]{0,60}chain/i,\n      /(unsupported|not supported) chain[\\s\\S]{0,120}coinbase/i,\n    ],\n  },\n  {\n    code: \"PRIVY_CHAIN_REJECTED_97741\",\n    title: \"Privy rejects server-side eth_sendTransaction on PEPU\",\n    cause: \"Privy's server-side send path does not know chain 97741 and rejects it. Signing works; sending does not.\",\n    fix: \"Sign with eth_signTransaction on the server and broadcast the raw transaction yourself (signAndBroadcast from @pepu-chain/sdk/session).\",\n    status: 502,\n    retryable: false,\n    matchers: [\n      /eip155:97741[\\s\\S]{0,160}(unsupported|not supported|invalid|unknown|not found)/i,\n      /(unsupported|not supported|unknown|invalid) (chain|network|caip2)[\\s\\S]{0,80}97741/i,\n    ],\n  },\n  {\n    code: \"PAYMASTER_ORIGIN_NOT_ALLOWED\",\n    title: \"Paymaster refused the request origin\",\n    cause: \"The request Origin is not on the project's allowlist.\",\n    fix: \"Add the exact origin (scheme, host and port) to the project's allowed origins.\",\n    status: 403,\n    retryable: false,\n    matchers: [/origin_not_allowed/i],\n  },\n  {\n    code: \"PAYMASTER_DESTINATION_NOT_ALLOWED\",\n    title: \"Paymaster refused the call destination\",\n    cause: \"The UserOperation targets a contract that is not on the project's target allowlist.\",\n    fix: \"Add the contract to the project's targets, or sponsor only calls to allowed targets.\",\n    status: 403,\n    retryable: false,\n    matchers: [/(destination|target)_not_allowed/i],\n  },\n  {\n    code: \"PAYMASTER_PROJECT_NOT_CLAIMED\",\n    title: \"Sponsorship project is not claimed on-chain\",\n    cause:\n      \"Deposits can sit in an unclaimed project, but nothing is sponsored until its owner has claimed it on-chain (the contract reports ProjectNotClaimed, the service project_not_claimed_onchain).\",\n    fix: \"Prove the Privy app (requestClaimAttestation from @pepu-chain/sdk/paymaster/server), call claimProject, then configureProject (setTargets, setDailyLimit, setSenderDailyLimit).\",\n    status: 409,\n    retryable: false,\n    matchers: [/project_not_claimed_onchain/i, /ProjectNotClaimed/i],\n  },\n  {\n    code: \"PAYMASTER_PROJECT_OWNER_CHANGED\",\n    title: \"Project owner changed since the credentials were issued\",\n    cause:\n      \"The on-chain owner of the project is no longer the address the off-chain credentials were issued to (an ownership transfer or re-claim completed).\",\n    fix: \"As the new owner, sign in with SIWE, register the project again and rotate the client token and server key.\",\n    status: 403,\n    retryable: false,\n    matchers: [/project_owner_changed/i],\n  },\n  {\n    code: \"PAYMASTER_PROJECT_PAUSED\",\n    title: \"Sponsorship project is paused\",\n    cause: \"The project owner paused sponsorship on-chain.\",\n    fix: \"The owner can resume it with setPaused(projectId, false).\",\n    status: 403,\n    retryable: false,\n    matchers: [/project_paused/i, /SponsorPaused/i],\n  },\n  {\n    code: \"PAYMASTER_IDENTITY_REQUIRED\",\n    title: \"A verified Privy account is required\",\n    cause: \"The free tier (and any project with requireIdentity on) only sponsors users with a verified Privy access token.\",\n    fix: \"Send the user's Privy access token as Authorization: Bearer (or context.privyAccessToken for ERC-7677).\",\n    status: 401,\n    retryable: false,\n    matchers: [/(project|free_tier)_identity_required/i],\n  },\n  {\n    code: \"PAYMASTER_FREE_TIER_UNAVAILABLE\",\n    title: \"Free tier cannot sponsor this operation\",\n    cause: \"The free tier is disabled, its pool is empty, or the operation is larger than the per-op cap.\",\n    fix: \"Deposit into your own project and use its credentials, or retry later.\",\n    status: 429,\n    retryable: true,\n    matchers: [/free_tier_disabled/i, /free_pool_(empty|op_too_large)/i],\n  },\n  {\n    code: \"PAYMASTER_RATE_LIMITED\",\n    title: \"Paymaster API rate limit\",\n    cause: \"Too many requests to the paymaster API from this IP or account.\",\n    fix: \"Back off for the Retry-After interval (error.details.retryAfterSeconds when present).\",\n    status: 429,\n    retryable: true,\n    matchers: [/\\brate_limited\\b/i],\n  },\n  {\n    code: \"PAYMASTER_SESSION_REQUIRED\",\n    title: \"Paymaster owner session missing or expired\",\n    cause: \"Owner endpoints need a SIWE session token (1 h lifetime) for the project's current on-chain owner.\",\n    fix: \"Call loginWithWallet() on the paymaster API client, then retry.\",\n    status: 401,\n    retryable: false,\n    matchers: [],\n  },\n  {\n    code: \"PAYMASTER_API_ERROR\",\n    title: \"Paymaster API request failed\",\n    cause: \"The paymaster API returned an error that has no more specific PEPU code.\",\n    fix: \"Read error.details (HTTP status and the service's error code) and the OpenAPI spec for that route.\",\n    status: 502,\n    retryable: false,\n    matchers: [],\n  },\n  {\n    code: \"PAYMASTER_DENIED\",\n    title: \"Paymaster denied the sponsorship\",\n    cause:\n      \"The paymaster rejected the credential or the sender (for example unknown_or_invalid_app_credential or sender_not_owned_by_token_user).\",\n    fix: \"Check the app credential or token, and that the smart account belongs to the user whose access token you sent.\",\n    status: 403,\n    retryable: false,\n    matchers: [\n      /unknown_or_invalid_app_credential/i,\n      /sender_not_owned_by_token_user/i,\n      /paymaster[\\s\\S]{0,40}(denied|rejected)/i,\n    ],\n  },\n  {\n    code: \"PAYMASTER_NO_BALANCE\",\n    title: \"Sponsorship project has no balance\",\n    cause: \"The project's paymaster deposit cannot cover this operation.\",\n    fix: \"Deposit more PEPU to the project, then retry.\",\n    status: 429,\n    retryable: true,\n    matchers: [/(project_)?(no|insufficient)_balance/i, /project_balance_exhausted/i, /InsufficientSponsorBalance/i, /insufficient (project )?(balance|deposit)[\\s\\S]{0,40}paymaster/i],\n  },\n  {\n    code: \"PAYMASTER_CAP\",\n    title: \"Sponsorship cap reached\",\n    cause: \"A daily, per-sender or per-operation sponsorship cap was hit.\",\n    fix: \"Wait for the cap window to reset, or raise the project's daily and sender limits.\",\n    status: 429,\n    retryable: true,\n    matchers: [/(daily|sender|per_sender)[_ -]?(cap|limit)[_ ]?(exceeded|reached)/i, /cap_exceeded|limit_exceeded/i, /free_tier_[a-z_]*_(exceeded|reached)/i, /fee_above_onchain_cap/i],\n  },\n  {\n    code: \"BUNDLER_AA_FAILED\",\n    title: \"EntryPoint rejected the UserOperation\",\n    cause: \"The EntryPoint reported FailedOp with an AAxx code during validation or execution.\",\n    fix: \"Read the AAxx code: AA21 prefund missing, AA23 signature or validation reverted, AA25 invalid nonce, AA31/AA33/AA34 paymaster problems.\",\n    status: 502,\n    retryable: false,\n    matchers: [/\\bAA(1\\d|2\\d|3\\d|4\\d|5\\d|9\\d)\\b/, /FailedOp(WithRevert)?/],\n  },\n  {\n    code: \"BUNDLER_UNREACHABLE\",\n    title: \"Bundler or paymaster is unreachable\",\n    cause: \"The request to the bundler or paymaster URL failed before any response.\",\n    fix: \"Check PEPU_BUNDLER_URL and PEPU_PAYMASTER_URL. The hosted services may not be live yet; use checkSponsorship().\",\n    status: 502,\n    retryable: true,\n    matchers: [/ECONNREFUSED|ENOTFOUND|ETIMEDOUT|fetch failed|bundler[\\s\\S]{0,30}unreachable/i],\n  },\n  {\n    code: \"TX_NONCE_RACE\",\n    title: \"Nonce conflict\",\n    cause: \"Two transactions raced for one nonce, or a replacement was underpriced.\",\n    fix: \"Serialize sends per account (a lock), re-read the pending nonce, and retry.\",\n    status: 409,\n    retryable: true,\n    matchers: [/nonce too (low|high)/i, /replacement transaction underpriced/i, /already known/i],\n  },\n  {\n    code: \"TX_GAS_UNDERSHOOT\",\n    title: \"Gas limit too low\",\n    cause: \"Nitro gas estimation undershoots on PEPU: the L1 data component is not covered by the plain estimate.\",\n    fix: \"Add headroom to the estimate, 20% via withGasLimitBuffer() from @pepu-chain/sdk/session.\",\n    status: 502,\n    retryable: true,\n    matchers: [/intrinsic gas too low/i, /gas required exceeds allowance/i, /gas limit too low/i],\n  },\n  {\n    code: \"TX_REVERTED\",\n    title: \"Transaction reverted\",\n    cause: \"The contract call reverted.\",\n    fix: \"Decode the revert reason with explainError(<revert data>) and check arguments, allowances and balances.\",\n    status: 502,\n    retryable: false,\n    matchers: [/execution reverted/i, /transaction (has )?reverted/i],\n  },\n  {\n    code: \"MULTICALL3_CANONICAL_ADDRESS\",\n    title: \"Canonical Multicall3 address used on PEPU\",\n    cause: \"PEPU's Multicall3 is not at the canonical 0xcA11...CA11 address.\",\n    fix: \"Use getMulticall3() or pepuMulticall() from @pepu-chain/sdk, or the pepuMainnet chain object, which carries the right address.\",\n    status: 500,\n    retryable: false,\n    matchers: [/0xcA11bde05977b3631167028862bE2a173976CA11/i],\n  },\n  {\n    code: \"WALLET_INJECTED_ACTIVE\",\n    title: \"An injected browser wallet is the active account\",\n    cause: \"wagmi's active account is a browser extension rather than the Privy embedded wallet.\",\n    fix: \"Pin the embedded wallet with useActiveWalletPin() from @pepu-chain/sdk/privy/wagmi.\",\n    status: 400,\n    retryable: false,\n    matchers: [/ConnectorNotConnectedError/i, /chrome-extension:\\/\\//i, /injected (wallet|provider|connector)/i],\n  },\n  {\n    code: \"CONFIG_PRIVY_CREATE_ON_LOGIN\",\n    title: \"Embedded wallet never appears after login\",\n    cause: \"The dashboard's automatic embedded wallet creation is off, so createOnLogin never resolves.\",\n    fix: \"Create the wallet server-side with the ensure-wallet route (createEnsureWalletRoute), or enable creation in the Privy dashboard.\",\n    status: 500,\n    retryable: false,\n    matchers: [/createOnLogin/i, /embedded wallet[\\s\\S]{0,60}(never|did not|didn't) (appear|created)/i],\n  },\n  {\n    code: \"CONFIG_ORIGIN_MISMATCH\",\n    title: \"Origin is not allowed by Privy\",\n    cause:\n      \"The page origin (scheme, host and port) is not in the Privy app's allowed origins. A different dev port is the usual cause.\",\n    fix: \"Add the exact origin, including the port, to Privy dashboard Allowed origins.\",\n    status: 500,\n    retryable: false,\n    matchers: [/origin[^.\\n]{0,60}(not allowed|not configured|not in (the )?allowed)/i, /allowed origins?/i],\n  },\n  {\n    code: \"CONFIG_PRIVY_DASHBOARD\",\n    title: \"Privy dashboard misconfiguration\",\n    cause: \"A required Privy dashboard setting is missing.\",\n    fix: \"Run checkPrivyDashboardConfig() and follow its fix list.\",\n    status: 500,\n    retryable: false,\n    matchers: [],\n  },\n  {\n    code: \"CONFIG_MISSING_ENV\",\n    title: \"Missing environment variable\",\n    cause: \"A required environment variable is not set.\",\n    fix: \"Set the listed variables (see .env.example) and restart the process.\",\n    status: 500,\n    retryable: false,\n    matchers: [/missing required env/i],\n  },\n  {\n    code: \"CONFIG_BAD_URL\",\n    title: \"Invalid endpoint URL\",\n    cause: \"A configured bundler, paymaster or RPC URL is not a valid http(s) URL.\",\n    fix: \"Use a full URL such as https://bundler.example.com.\",\n    status: 500,\n    retryable: false,\n    matchers: [],\n  },\n  {\n    code: \"CONFIG_SERVER_ONLY\",\n    title: \"Server-only module imported in the browser\",\n    cause: \"A server entry point was bundled into client code.\",\n    fix: \"Import server entries only from route handlers, server actions and scripts.\",\n    status: 500,\n    retryable: false,\n    matchers: [],\n  },\n  {\n    code: \"AUTH_INVALID_TOKEN\",\n    title: \"Invalid or missing Privy access token\",\n    cause: \"The request carried no bearer token, or Privy could not verify it.\",\n    fix: \"Send Authorization: Bearer <getAccessToken()> and verify the token server-side.\",\n    status: 401,\n    retryable: false,\n    matchers: [/invalid (auth(orization)?|access|jwt|id) token/i, /\\bjwt (expired|malformed|invalid)/i],\n  },\n  {\n    code: \"WALLET_NOT_PROVISIONED\",\n    title: \"User has no embedded wallet yet\",\n    cause: \"The user is signed in but no embedded Ethereum wallet exists.\",\n    fix: \"Call the ensure-wallet route (useEnsureWallet or WalletGate) before acting.\",\n    status: 409,\n    retryable: true,\n    matchers: [],\n  },\n  {\n    code: \"POLICY_UNSCOPED\",\n    title: \"Session policy is not scoped\",\n    cause: \"A session policy needs a target contract, at least one function and an expiry.\",\n    fix: \"Pass contractAddress, functions and expiresAtUnixSeconds to buildSessionPolicy().\",\n    status: 400,\n    retryable: false,\n    matchers: [],\n  },\n  {\n    code: \"SESSION_EXPIRED\",\n    title: \"Session expired\",\n    cause: \"The session's expiry has passed.\",\n    fix: \"Grant a new session.\",\n    status: 410,\n    retryable: false,\n    matchers: [],\n  },\n  {\n    code: \"SESSION_NONE\",\n    title: \"No active session\",\n    cause: \"The user has not granted a session, or it was revoked.\",\n    fix: \"Ask the user to grant a session first.\",\n    status: 409,\n    retryable: false,\n    matchers: [],\n  },\n  {\n    code: \"SESSION_APPROVAL_MISMATCH\",\n    title: \"Session approval does not match\",\n    cause: \"The approval was made for another account, permission id or mode.\",\n    fix: \"Re-run prepare, have the owner sign again, then activate.\",\n    status: 409,\n    retryable: false,\n    matchers: [],\n  },\n  {\n    code: \"UNKNOWN\",\n    title: \"Unknown error\",\n    cause: \"The error did not match any known PEPU failure.\",\n    fix: \"Read the original message. Run pepu_known_gotchas in the MCP server, or search the docs.\",\n    status: 500,\n    retryable: false,\n    matchers: [],\n  },\n];\n\nconst catalogByCode: ReadonlyMap<PepuErrorCode, ErrorCatalogEntry> = new Map(\n  PEPU_ERROR_CATALOG.map((e) => [e.code, e]),\n);\n\n/** Look up a catalog entry by code. */\nexport function getErrorEntry(code: PepuErrorCode): ErrorCatalogEntry {\n  const entry = catalogByCode.get(code) ?? catalogByCode.get(\"UNKNOWN\");\n  if (!entry) throw new Error(\"PEPU_ERROR_CATALOG is missing the UNKNOWN entry\");\n  return entry;\n}\n\n/** `https://guide.pepeunchained.com/reference/errors#<CODE>` */\nexport function errorDocsUrl(code: PepuErrorCode): string {\n  return `${PEPU_ERRORS_DOCS_URL}#${code}`;\n}\n\nexport interface PepuErrorOptions {\n  hint?: string;\n  docsUrl?: string;\n  retryable?: boolean;\n  status?: number;\n  details?: unknown;\n  cause?: unknown;\n}\n\nexport class PepuError extends Error {\n  readonly code: PepuErrorCode;\n  readonly hint: string;\n  readonly docsUrl: string;\n  readonly retryable: boolean;\n  readonly status: number;\n  readonly details?: unknown;\n\n  constructor(code: PepuErrorCode, message?: string, options: PepuErrorOptions = {}) {\n    const entry = getErrorEntry(code);\n    super(message ?? entry.title, options.cause === undefined ? undefined : { cause: options.cause });\n    this.name = new.target.name;\n    this.code = code;\n    this.hint = options.hint ?? entry.fix;\n    this.docsUrl = options.docsUrl ?? errorDocsUrl(code);\n    this.retryable = options.retryable ?? entry.retryable;\n    this.status = options.status ?? entry.status;\n    if (options.details !== undefined) this.details = options.details;\n  }\n}\n\n/** Missing env, bad URL, dashboard misconfiguration. */\nexport class PepuConfigError extends PepuError {}\n/** Bad or missing Privy token, wrong owner. */\nexport class PepuAuthError extends PepuError {}\n/** Unscoped policy, name too long, expiry, denied by policy. */\nexport class PepuPolicyError extends PepuError {}\n/** No session, expired, mismatched approval. */\nexport class PepuSessionError extends PepuError {}\n/** AAxx, JSON-RPC errors, timeouts. */\nexport class PepuBundlerError extends PepuError {}\n/** Reason codes, caps, balance, origin. */\nexport class PepuPaymasterError extends PepuError {}\n/** Revert, nonce race, gas, rpc rate limit. */\nexport class PepuChainError extends PepuError {}\n\ntype PepuErrorClass = new (code: PepuErrorCode, message?: string, options?: PepuErrorOptions) => PepuError;\n\nfunction classForCode(code: PepuErrorCode): PepuErrorClass {\n  if (code.startsWith(\"CONFIG_\") || code.startsWith(\"PRIVY_\")) return PepuConfigError;\n  if (code === \"AUTH_INVALID_TOKEN\" || code === \"WALLET_NOT_PROVISIONED\") return PepuAuthError;\n  if (code.startsWith(\"POLICY_\")) return PepuPolicyError;\n  if (code.startsWith(\"SESSION_\")) return PepuSessionError;\n  if (code.startsWith(\"BUNDLER_\")) return PepuBundlerError;\n  if (code.startsWith(\"PAYMASTER_\")) return PepuPaymasterError;\n  if (code.startsWith(\"TX_\") || code.startsWith(\"MULTICALL3_\") || code.startsWith(\"WALLET_\")) return PepuChainError;\n  return PepuError;\n}\n\nconst REVERT_ABI = [\n  { type: \"error\", name: \"Error\", inputs: [{ name: \"message\", type: \"string\" }] },\n  { type: \"error\", name: \"Panic\", inputs: [{ name: \"code\", type: \"uint256\" }] },\n  {\n    type: \"error\",\n    name: \"FailedOp\",\n    inputs: [\n      { name: \"opIndex\", type: \"uint256\" },\n      { name: \"reason\", type: \"string\" },\n    ],\n  },\n  {\n    type: \"error\",\n    name: \"FailedOpWithRevert\",\n    inputs: [\n      { name: \"opIndex\", type: \"uint256\" },\n      { name: \"reason\", type: \"string\" },\n      { name: \"inner\", type: \"bytes\" },\n    ],\n  },\n] as const satisfies Abi;\n\nfunction flatten(e: unknown): string {\n  const seen = new Set<unknown>();\n  const parts: string[] = [];\n  let cur: unknown = e;\n  for (let depth = 0; depth < 6 && cur !== undefined && cur !== null && !seen.has(cur); depth++) {\n    seen.add(cur);\n    if (typeof cur === \"object\") {\n      const o = cur as Record<string, unknown>;\n      for (const k of [\"shortMessage\", \"message\", \"details\", \"reason\"]) {\n        const v = o[k];\n        if (typeof v === \"string\") parts.push(v);\n      }\n      cur = o[\"cause\"];\n    } else {\n      parts.push(String(cur));\n      break;\n    }\n  }\n  return parts.join(\"\\n\");\n}\n\nexport interface ErrorExplanation {\n  code: PepuErrorCode;\n  title: string;\n  cause: string;\n  fix: string;\n  docsUrl: string;\n  matched: \"catalog\" | \"abi-decode\" | \"unknown\";\n}\n\nfunction matchCatalog(text: string): ErrorCatalogEntry | undefined {\n  return PEPU_ERROR_CATALOG.find((entry) => entry.matchers.some((m) => m.test(text)));\n}\n\nfunction explanation(entry: ErrorCatalogEntry, matched: ErrorExplanation[\"matched\"]): ErrorExplanation {\n  return {\n    code: entry.code,\n    title: entry.title,\n    cause: entry.cause,\n    fix: entry.fix,\n    docsUrl: errorDocsUrl(entry.code),\n    matched,\n  };\n}\n\n/**\n * Explain an error, an error message, or raw revert data (`0x...`). Pure and\n * synchronous; never throws.\n */\nexport function explainError(e: unknown | string | Hex): ErrorExplanation {\n  if (e instanceof PepuError) return explanation(getErrorEntry(e.code), \"catalog\");\n\n  if (typeof e === \"string\" && isHex(e) && e.length >= 10) {\n    try {\n      const decoded = decodeErrorResult({ abi: REVERT_ABI, data: e });\n      const argText = (decoded.args ?? []).map((a) => (typeof a === \"string\" ? a : \"\")).join(\"\\n\");\n      const hit = matchCatalog(`${argText}\\n${decoded.errorName}`);\n      if (hit) return explanation(hit, \"abi-decode\");\n      return explanation(getErrorEntry(\"TX_REVERTED\"), \"abi-decode\");\n    } catch {\n      return explanation(getErrorEntry(\"UNKNOWN\"), \"unknown\");\n    }\n  }\n\n  const text = typeof e === \"string\" ? e : flatten(e);\n  const hit = matchCatalog(text);\n  return hit ? explanation(hit, \"catalog\") : explanation(getErrorEntry(\"UNKNOWN\"), \"unknown\");\n}\n\n/** Wrap anything thrown into a typed {@link PepuError}. PepuErrors pass through. */\nexport function toPepuError(e: unknown, ctx?: { op: string }): PepuError {\n  if (e instanceof PepuError) return e;\n  const explained = explainError(e);\n  const original = (typeof e === \"string\" ? e : flatten(e)) || \"Unknown error\";\n  const message = ctx ? `${ctx.op}: ${original}` : original;\n  const Cls = classForCode(explained.code);\n  return new Cls(explained.code, message, { cause: e });\n}\n\n/** The `{ error: { code, message, hint } }` body route factories return. */\nexport function toErrorBody(e: unknown): { error: { code: PepuErrorCode; message: string; hint: string } } {\n  const err = toPepuError(e);\n  return { error: { code: err.code, message: err.message, hint: err.hint } };\n}\n\n/** A JSON `Response` with the error body and the status from the error model. */\nexport function toErrorResponse(e: unknown): Response {\n  const err = toPepuError(e);\n  return new Response(JSON.stringify(toErrorBody(err)), {\n    status: err.status,\n    headers: { \"content-type\": \"application/json\" },\n  });\n}\n"]}