@pepu-chain/sdk 0.2.0 → 0.2.2

package/dist/{chunk-KVG3AYYR.js.map → chunk-NHPWXIA2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/session/store.ts","../src/session/kernel.ts"],"names":[],"mappings":";;;;;;;;;AAyDO,SAAS,iBAAA,GAAkC;AAChD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA2B;AAC/C,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,MAAA,KAAW,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,IACnC,GAAA,EAAK,CAAC,MAAA,KAAW;AACf,MAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACvB,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,MAAA,KAAW;AACnB,MAAA,IAAI,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA,EAAG,OAAO,KAAA;AAC9B,MAAA,KAAA,CAAM,IAAI,MAAM,CAAA;AAChB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAQO,SAAS,MAAA,CAAO,QAAuB,UAAA,EAA6B;AACzE,EAAA,OAAO,MAAA,CAAO,QAAA,KAAa,IAAA,IAAQ,UAAA,GAAa,MAAA,CAAO,UAAA;AACzD;;;ACvCO,IAAM,0BAAA,GAAsC;AAE5C,IAAM,wBAAA,GAAoC;AAW1C,IAAM,4BAAA,GAA+B,EAAE,cAAA,EAAgB,IAAA,EAAM,gBAAgB,GAAA;AAKpF,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,2BAA2B,CAAA,EAI9B;AACX,EAAA,WAAA,CAAY,EAAE,KAAK,CAAA;AACnB,EAAA,OAAO;AAAA,IACL,YAAA,CAAa;AAAA,MACX,eAAe,iBAAA,CAAkB,MAAA;AAAA,MACjC,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAC/B,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAA,EAAY,EAAE,UAAA,IAAc,EAAA;AAAA,QAC5B,GAAA,EAAK,CAAC,YAAA,CAAa,CAAC,CAAC,CAAA;AAAA,QACrB,cAAc,CAAA,CAAE;AAAA,OAClB,CAAE;AAAA,KACmC,CAAA;AAAA,IACvC,iBAAA,CAAkB,EAAE,UAAA,EAAY,CAAA,CAAE,cAAc,CAAA,EAAG,UAAA,EAAY,CAAA,CAAE,UAAA,EAAY;AAAA,GAC/E;AACF;AASO,SAAS,kBAAA,GAA4D;AAC1E,EAAA,MAAM,aAAa,kBAAA,EAAmB;AACtC,EAAA,OAAO,EAAE,UAAA,EAAY,OAAA,EAAS,mBAAA,CAAoB,UAAU,EAAE,OAAA,EAAQ;AACxE;AAEA,SAAS,aAAA,CAAc,YAAA,EAA4B,iBAAA,EAA4B,QAAA,EAAoB;AACjG,EAAA,OAAO,qBAAA,CAAsB,EAAA,CAAG,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAY,eAAA;AAAA,IACZ,aAAA,EAAe,cAAA;AAAA,IACf,MAAA,EAAQ,mBAAmB,iBAAiB,CAAA;AAAA,IAC5C;AAAA,GACD,CAAA;AACH;AASA,eAAsB,qBAAqB,CAAA,EAIvB;AAClB,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACtF,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,UAAA,CAAW,4BAAA,EAA6B;AACjE,EAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACxE,EAAA,OAAO,YAAA;AACT;AAeA,eAAsB,qBAAqB,CAAA,EAKe;AACxD,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACnF,EAAA,MAAM,OAAA,GAAU,MAAM,mBAAA,CAAoB;AAAA,IACxC,cAAc,CAAA,CAAE,YAAA;AAAA,IAChB,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,OAAA,EAAS,EAAE,OAAA;AAAQ,GACpB,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAM,0BAAA,CAA2B,OAAgB,CAAA;AAClE,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,OAAA,CAAQ,OAAA,EAAQ;AACpD;AAUA,eAAsB,yBAAyB,CAAA,EAIf;AAC9B,EAAA,MAAM,aAAA,GAAgB,MAAM,aAAA,CAAc,EAAE,QAAQ,mBAAA,CAAoB,CAAA,CAAE,iBAAiB,CAAA,EAAG,CAAA;AAC9F,EAAA,MAAM,UAAU,MAAM,4BAAA;AAAA,IACpB,EAAA,CAAG,EAAE,YAAY,CAAA;AAAA,IACjB,eAAA;AAAA,IACA,cAAA;AAAA,IACA,CAAA,CAAE,QAAA;AAAA,IACF;AAAA,GACF;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-KVG3AYYR.js","sourcesContent":["import type { Address, Hex } from \"viem\";\n\n/**\n * Server-side session records for the Kernel (on-chain) session flow, keyed by\n * Privy user id. Ported from templates/sponsored-session-app/lib/session-store.ts.\n *\n * WHAT IS STORED: the session private key (a hot key whose power is limited\n * ON-CHAIN by the call and timestamp policies until `validUntil`) and the\n * public approval. The owner's key never reaches the server.\n *\n * PRODUCTION: {@link createMemoryStore} is DEV-GRADE. It is lost on every\n * restart (the user simply starts a new session) and is not shared between\n * serverless instances. A production deployment must implement\n * {@link SessionStore} on a persistent database or KV AND keep\n * `sessionPrivateKey` encrypted at rest (KMS or an envelope key). Nothing else\n * in the SDK changes.\n */\nexport interface SessionRecord {\n  userId: string;\n  ownerAddress: Address;\n  kernelAddress: Address;\n  /** The session key's private half. Encrypt it at rest in any persistent store. */\n  sessionPrivateKey: Hex;\n  sessionKeyAddress: Address;\n  permissionId: string;\n  /** Unix seconds. The on-chain permission is invalid at and after this time. */\n  validUntil: number;\n  /** Present once the owner has signed the grant. */\n  approval: string | null;\n  /** Number of successful sponsored actions in this session. */\n  actions: number;\n}\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * Pluggable storage for {@link SessionRecord}s. Every method may be sync or\n * async. `tryLock` must be atomic per user: it returns `false` when an action\n * is already running for that user (a multi-instance deployment needs a\n * distributed lock, for example a Redis `SET NX PX`).\n */\nexport interface SessionStore {\n  get(userId: string): MaybePromise<SessionRecord | undefined>;\n  set(record: SessionRecord): MaybePromise<void>;\n  delete(userId: string): MaybePromise<void>;\n  tryLock(userId: string): MaybePromise<boolean>;\n  unlock(userId: string): MaybePromise<void>;\n}\n\n/**\n * An in-memory {@link SessionStore} for development and tests. DEV-GRADE: not\n * persistent, not shared across instances, and the session key is held in\n * plaintext in process memory. Production needs an encrypted persistent store.\n *\n * @example\n * const store = createMemoryStore();\n */\nexport function createMemoryStore(): SessionStore {\n  const records = new Map<string, SessionRecord>();\n  const locks = new Set<string>();\n  return {\n    get: (userId) => records.get(userId),\n    set: (record) => {\n      records.set(record.userId, record);\n    },\n    delete: (userId) => {\n      records.delete(userId);\n    },\n    tryLock: (userId) => {\n      if (locks.has(userId)) return false;\n      locks.add(userId);\n      return true;\n    },\n    unlock: (userId) => {\n      locks.delete(userId);\n    },\n  };\n}\n\n/**\n * True while the on-chain permission is still valid: approved and before expiry.\n *\n * @example\n * isLive(record, Math.floor(Date.now() / 1000));\n */\nexport function isLive(record: SessionRecord, nowSeconds: number): boolean {\n  return record.approval !== null && nowSeconds < record.validUntil;\n}\n","import { deserializePermissionAccount, serializePermissionAccount, toPermissionValidator } from \"@zerodev/permissions\";\nimport type { Policy } from \"@zerodev/permissions\";\nimport { CallPolicyVersion, toCallPolicy, toTimestampPolicy } from \"@zerodev/permissions/policies\";\nimport { toECDSASigner, toEmptyECDSASigner } from \"@zerodev/permissions/signers\";\nimport type { createKernelAccount } from \"@zerodev/sdk\";\nimport type { Abi, Address, Hex, PublicClient } from \"viem\";\nimport { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";\n\nimport { ENTRY_POINT_V07 } from \"../aa/clients.js\";\nimport { KERNEL_VERSION, toPepuKernelAccount } from \"../aa/kernel.js\";\nimport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nimport { assertCalls, findFunction } from \"./scope.js\";\nimport type { KernelSessionCall } from \"./scope.js\";\n\nexport { KERNEL_VERSION, getKernelAddress } from \"../aa/kernel.js\";\nexport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nexport { createMemoryStore, isLive } from \"./store.js\";\nexport type { SessionRecord, SessionStore } from \"./store.js\";\nexport { checkApproval, describeKernelSessionScope, isCallInScope, parseApproval } from \"./scope.js\";\nexport type { ApprovalCheck, KernelSessionCall, KernelSessionScope, ParsedApproval } from \"./scope.js\";\n\n/**\n * `@pepu-chain/sdk/session/kernel`: on-chain session keys with ZeroDev Kernel\n * permissions. Extracted from templates/sponsored-session-app/lib/{kernel,\n * session-policy,approval}.ts and built on `toPepuKernelAccount`\n * (`plugins.regular`).\n *\n * The scope is enforced ON-CHAIN by ZeroDev's policy contracts, which the\n * user's Kernel account calls during UserOperation validation:\n *\n * - Call policy v0.0.4: only the listed targets and function selectors, with a\n *   native value no larger than `valueLimit` (default 0).\n * - Timestamp policy: the permission is invalid outside `validAfter`..`validUntil`.\n *\n * A UserOperation outside this scope is rejected by the EntryPoint itself, no\n * matter who relays it or what the app backend does.\n *\n * Deployed on PEPU mainnet (eth_getCode verified 2026-10-02): Kernel v3.1\n * factory 0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419, ECDSA validator\n * 0x845ADb2C711129d4f3966735eD98a9F09fC4cE57, ECDSA signer module\n * 0x6A6F069E2a08c2468e7724Ab3250CdBFBA14D4FF, call policy v0.0.4 and the\n * timestamp policy below. Call policy v0.0.5 is NOT deployed on PEPU, so the\n * version is pinned.\n *\n * Optional peers: `@zerodev/sdk`, `@zerodev/permissions`, `@zerodev/ecdsa-validator`.\n */\n\n/** Call policy v0.0.4. Pinned: v0.0.5 is not deployed on PEPU mainnet. */\nexport const CALL_POLICY_V0_0_4_ADDRESS: Address = \"0x9a52283276A0ec8740DF50bF01B28A80D880eaf2\";\n/** ZeroDev timestamp policy on PEPU mainnet. */\nexport const TIMESTAMP_POLICY_ADDRESS: Address = \"0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F\";\n\n/**\n * Worst-case gas the paymaster policy service RESERVES per sponsored operation,\n * measured on PEPU mainnet with the sponsored-session-app template: the first\n * operation of a session (account deploy plus enabling the permission) about\n * 20.5 PEPU, later operations about 6.9 PEPU. The real first-session cost was\n * about 12.8 PEPU for two operations. Size per-user hourly and daily spend\n * caps above these, or users hit `trailing-hour spend ... would exceed cap`\n * after their first action.\n */\nexport const SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 } as const;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\n\n/** Type-level bridge for ZeroDev's own viem copy (same object at runtime). */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/**\n * The on-chain policies for one session: call policy v0.0.4 plus the timestamp\n * policy. Pure and deterministic given its input. Only the named function\n * fragments go into the policy, which keeps the grant small.\n *\n * @example\n * const policies = buildKernelSessionPolicies({\n *   calls: [{ target: tapScore, abi: tapScoreAbi, functionName: \"tap\" }],\n *   validUntil: Math.floor(Date.now() / 1000) + 900,\n * });\n */\nexport function buildKernelSessionPolicies(p: {\n  calls: readonly KernelSessionCall[];\n  validUntil: number;\n  validAfter?: number;\n}): Policy[] {\n  assertCalls(p.calls);\n  return [\n    toCallPolicy({\n      policyVersion: CallPolicyVersion.V0_0_4,\n      permissions: p.calls.map((c) => ({\n        target: c.target,\n        valueLimit: c.valueLimit ?? 0n,\n        abi: [findFunction(c)] as Abi,\n        functionName: c.functionName,\n      })),\n    } as Parameters<typeof toCallPolicy>[0]),\n    toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil }),\n  ];\n}\n\n/**\n * A fresh random session key. SERVER ONLY: the private key must never reach\n * the browser. Only the address is sent to the owner for approval.\n *\n * @example\n * const { privateKey, address } = generateSessionKey();\n */\nexport function generateSessionKey(): { privateKey: Hex; address: Address } {\n  const privateKey = generatePrivateKey();\n  return { privateKey, address: privateKeyToAccount(privateKey).address };\n}\n\nfunction permissionFor(publicClient: PublicClient, sessionKeyAddress: Address, policies: Policy[]) {\n  return toPermissionValidator(zd(publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    signer: toEmptyECDSASigner(sessionKeyAddress),\n    policies,\n  });\n}\n\n/**\n * The permission id the chain derives for this session key plus these\n * policies. The server compares it with a browser-supplied approval.\n *\n * @example\n * const permissionId = await expectedPermissionId({ publicClient, sessionKeyAddress, policies });\n */\nexport async function expectedPermissionId(p: {\n  publicClient: PublicClient;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<string> {\n  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const { permissionId } = permission.getPluginSerializationParams();\n  if (!permissionId) throw new Error(\"Could not derive the permission id.\");\n  return permissionId;\n}\n\n/**\n * In the user's browser: the owner (the Privy embedded wallet, the only thing\n * that can authorize a session) signs ONE EIP-712 message that enables a\n * permission validator on their Kernel account. That signature is the whole\n * grant. It names the session key's public address (never its private key)\n * and the policies. The returned `approval` holds no secret: it is the enable\n * signature plus the policy parameters, useless without the session key.\n *\n * @example\n * const { approval, kernelAddress } = await approveKernelSession({\n *   publicClient, owner: walletClient, sessionKeyAddress, policies,\n * });\n */\nexport async function approveKernelSession(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<{ approval: string; kernelAddress: Address }> {\n  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const account = await toPepuKernelAccount({\n    publicClient: p.publicClient,\n    owner: p.owner,\n    plugins: { regular },\n  });\n  const approval = await serializePermissionAccount(account as never);\n  return { approval, kernelAddress: account.address };\n}\n\n/**\n * On the server: rebuild the session's Kernel account from the approval and\n * the server-held session key (an ECDSA signer for that key). No owner\n * signature is involved. Pass the result to `createPepuSponsoredClient`.\n *\n * @example\n * const account = await loadKernelSessionAccount({ publicClient, approval, sessionPrivateKey });\n */\nexport async function loadKernelSessionAccount(p: {\n  publicClient: PublicClient;\n  approval: string;\n  sessionPrivateKey: Hex;\n}): Promise<KernelSmartAccount> {\n  const sessionSigner = await toECDSASigner({ signer: privateKeyToAccount(p.sessionPrivateKey) });\n  const account = await deserializePermissionAccount(\n    zd(p.publicClient),\n    ENTRY_POINT_V07,\n    KERNEL_VERSION,\n    p.approval,\n    sessionSigner,\n  );\n  return account as unknown as KernelSmartAccount;\n}\n"]}
+{"version":3,"sources":["../src/session/store.ts","../src/session/kernel.ts"],"names":[],"mappings":";;;;;;;;;AAyDO,SAAS,iBAAA,GAAkC;AAChD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA2B;AAC/C,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,MAAA,KAAW,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,IACnC,GAAA,EAAK,CAAC,MAAA,KAAW;AACf,MAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACvB,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,MAAA,KAAW;AACnB,MAAA,IAAI,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA,EAAG,OAAO,KAAA;AAC9B,MAAA,KAAA,CAAM,IAAI,MAAM,CAAA;AAChB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAQO,SAAS,MAAA,CAAO,QAAuB,UAAA,EAA6B;AACzE,EAAA,OAAO,MAAA,CAAO,QAAA,KAAa,IAAA,IAAQ,UAAA,GAAa,MAAA,CAAO,UAAA;AACzD;;;ACvCO,IAAM,0BAAA,GAAsC;AAE5C,IAAM,wBAAA,GAAoC;AAW1C,IAAM,4BAAA,GAA+B,EAAE,cAAA,EAAgB,IAAA,EAAM,gBAAgB,GAAA;AAKpF,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,2BAA2B,CAAA,EAI9B;AACX,EAAA,WAAA,CAAY,EAAE,KAAK,CAAA;AACnB,EAAA,OAAO;AAAA,IACL,YAAA,CAAa;AAAA,MACX,eAAe,iBAAA,CAAkB,MAAA;AAAA,MACjC,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAC/B,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAA,EAAY,EAAE,UAAA,IAAc,EAAA;AAAA,QAC5B,GAAA,EAAK,CAAC,YAAA,CAAa,CAAC,CAAC,CAAA;AAAA,QACrB,cAAc,CAAA,CAAE;AAAA,OAClB,CAAE;AAAA,KACmC,CAAA;AAAA,IACvC,iBAAA,CAAkB,EAAE,UAAA,EAAY,CAAA,CAAE,cAAc,CAAA,EAAG,UAAA,EAAY,CAAA,CAAE,UAAA,EAAY;AAAA,GAC/E;AACF;AASO,SAAS,kBAAA,GAA4D;AAC1E,EAAA,MAAM,aAAa,kBAAA,EAAmB;AACtC,EAAA,OAAO,EAAE,UAAA,EAAY,OAAA,EAAS,mBAAA,CAAoB,UAAU,EAAE,OAAA,EAAQ;AACxE;AAEA,SAAS,aAAA,CAAc,YAAA,EAA4B,iBAAA,EAA4B,QAAA,EAAoB;AACjG,EAAA,OAAO,qBAAA,CAAsB,EAAA,CAAG,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAY,eAAA;AAAA,IACZ,aAAA,EAAe,cAAA;AAAA,IACf,MAAA,EAAQ,mBAAmB,iBAAiB,CAAA;AAAA,IAC5C;AAAA,GACD,CAAA;AACH;AASA,eAAsB,qBAAqB,CAAA,EAIvB;AAClB,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACtF,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,UAAA,CAAW,4BAAA,EAA6B;AACjE,EAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACxE,EAAA,OAAO,YAAA;AACT;AAeA,eAAsB,qBAAqB,CAAA,EAKe;AACxD,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACnF,EAAA,MAAM,OAAA,GAAU,MAAM,mBAAA,CAAoB;AAAA,IACxC,cAAc,CAAA,CAAE,YAAA;AAAA,IAChB,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,OAAA,EAAS,EAAE,OAAA;AAAQ,GACpB,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAM,0BAAA,CAA2B,OAAgB,CAAA;AAClE,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,OAAA,CAAQ,OAAA,EAAQ;AACpD;AAUA,eAAsB,yBAAyB,CAAA,EAIf;AAC9B,EAAA,MAAM,aAAA,GAAgB,MAAM,aAAA,CAAc,EAAE,QAAQ,mBAAA,CAAoB,CAAA,CAAE,iBAAiB,CAAA,EAAG,CAAA;AAC9F,EAAA,MAAM,UAAU,MAAM,4BAAA;AAAA,IACpB,EAAA,CAAG,EAAE,YAAY,CAAA;AAAA,IACjB,eAAA;AAAA,IACA,cAAA;AAAA,IACA,CAAA,CAAE,QAAA;AAAA,IACF;AAAA,GACF;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-NHPWXIA2.js","sourcesContent":["import type { Address, Hex } from \"viem\";\n\n/**\n * Server-side session records for the Kernel (on-chain) session flow, keyed by\n * Privy user id. Ported from templates/sponsored-session-app/lib/session-store.ts.\n *\n * WHAT IS STORED: the session private key (a hot key whose power is limited\n * ON-CHAIN by the call and timestamp policies until `validUntil`) and the\n * public approval. The owner's key never reaches the server.\n *\n * PRODUCTION: {@link createMemoryStore} is DEV-GRADE. It is lost on every\n * restart (the user simply starts a new session) and is not shared between\n * serverless instances. A production deployment must implement\n * {@link SessionStore} on a persistent database or KV AND keep\n * `sessionPrivateKey` encrypted at rest (KMS or an envelope key). Nothing else\n * in the SDK changes.\n */\nexport interface SessionRecord {\n  userId: string;\n  ownerAddress: Address;\n  kernelAddress: Address;\n  /** The session key's private half. Encrypt it at rest in any persistent store. */\n  sessionPrivateKey: Hex;\n  sessionKeyAddress: Address;\n  permissionId: string;\n  /** Unix seconds. The on-chain permission is invalid at and after this time. */\n  validUntil: number;\n  /** Present once the owner has signed the grant. */\n  approval: string | null;\n  /** Number of successful sponsored actions in this session. */\n  actions: number;\n}\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * Pluggable storage for {@link SessionRecord}s. Every method may be sync or\n * async. `tryLock` must be atomic per user: it returns `false` when an action\n * is already running for that user (a multi-instance deployment needs a\n * distributed lock, for example a Redis `SET NX PX`).\n */\nexport interface SessionStore {\n  get(userId: string): MaybePromise<SessionRecord | undefined>;\n  set(record: SessionRecord): MaybePromise<void>;\n  delete(userId: string): MaybePromise<void>;\n  tryLock(userId: string): MaybePromise<boolean>;\n  unlock(userId: string): MaybePromise<void>;\n}\n\n/**\n * An in-memory {@link SessionStore} for development and tests. DEV-GRADE: not\n * persistent, not shared across instances, and the session key is held in\n * plaintext in process memory. Production needs an encrypted persistent store.\n *\n * @example\n * const store = createMemoryStore();\n */\nexport function createMemoryStore(): SessionStore {\n  const records = new Map<string, SessionRecord>();\n  const locks = new Set<string>();\n  return {\n    get: (userId) => records.get(userId),\n    set: (record) => {\n      records.set(record.userId, record);\n    },\n    delete: (userId) => {\n      records.delete(userId);\n    },\n    tryLock: (userId) => {\n      if (locks.has(userId)) return false;\n      locks.add(userId);\n      return true;\n    },\n    unlock: (userId) => {\n      locks.delete(userId);\n    },\n  };\n}\n\n/**\n * True while the on-chain permission is still valid: approved and before expiry.\n *\n * @example\n * isLive(record, Math.floor(Date.now() / 1000));\n */\nexport function isLive(record: SessionRecord, nowSeconds: number): boolean {\n  return record.approval !== null && nowSeconds < record.validUntil;\n}\n","import { deserializePermissionAccount, serializePermissionAccount, toPermissionValidator } from \"@zerodev/permissions\";\nimport type { Policy } from \"@zerodev/permissions\";\nimport { CallPolicyVersion, toCallPolicy, toTimestampPolicy } from \"@zerodev/permissions/policies\";\nimport { toECDSASigner, toEmptyECDSASigner } from \"@zerodev/permissions/signers\";\nimport type { createKernelAccount } from \"@zerodev/sdk\";\nimport type { Abi, Address, Hex, PublicClient } from \"viem\";\nimport { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";\n\nimport { ENTRY_POINT_V07 } from \"../aa/clients.js\";\nimport { KERNEL_VERSION, toPepuKernelAccount } from \"../aa/kernel.js\";\nimport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nimport { assertCalls, findFunction } from \"./scope.js\";\nimport type { KernelSessionCall } from \"./scope.js\";\n\nexport { KERNEL_VERSION, getKernelAddress } from \"../aa/kernel.js\";\nexport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nexport { createMemoryStore, isLive } from \"./store.js\";\nexport type { SessionRecord, SessionStore } from \"./store.js\";\nexport { checkApproval, describeKernelSessionScope, isCallInScope, parseApproval } from \"./scope.js\";\nexport type { ApprovalCheck, KernelSessionCall, KernelSessionScope, ParsedApproval } from \"./scope.js\";\n\n/**\n * `@pepu-chain/sdk/session/kernel`: on-chain session keys with ZeroDev Kernel\n * permissions. Extracted from templates/sponsored-session-app/lib/{kernel,\n * session-policy,approval}.ts and built on `toPepuKernelAccount`\n * (`plugins.regular`).\n *\n * The scope is enforced ON-CHAIN by ZeroDev's policy contracts, which the\n * user's Kernel account calls during UserOperation validation:\n *\n * - Call policy v0.0.4: only the listed targets and function selectors, with a\n *   native value no larger than `valueLimit` (default 0).\n * - Timestamp policy: the permission is invalid outside `validAfter`..`validUntil`.\n *\n * A UserOperation outside this scope is rejected by the EntryPoint itself, no\n * matter who relays it or what the app backend does.\n *\n * Deployed on PEPU mainnet (eth_getCode verified 2026-10-02): Kernel v3.1\n * factory 0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419, ECDSA validator\n * 0x845ADb2C711129d4f3966735eD98a9F09fC4cE57, ECDSA signer module\n * 0x6A6F069E2a08c2468e7724Ab3250CdBFBA14D4FF, call policy v0.0.4 and the\n * timestamp policy below. Call policy v0.0.5 is NOT deployed on PEPU, so the\n * version is pinned.\n *\n * Optional peers: `@zerodev/sdk`, `@zerodev/permissions`, `@zerodev/ecdsa-validator`.\n */\n\n/** Call policy v0.0.4. Pinned: v0.0.5 is not deployed on PEPU mainnet. */\nexport const CALL_POLICY_V0_0_4_ADDRESS: Address = \"0x9a52283276A0ec8740DF50bF01B28A80D880eaf2\";\n/** ZeroDev timestamp policy on PEPU mainnet. */\nexport const TIMESTAMP_POLICY_ADDRESS: Address = \"0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F\";\n\n/**\n * Worst-case gas the paymaster policy service RESERVES per sponsored operation,\n * measured on PEPU mainnet with the sponsored-session-app template: the first\n * operation of a session (account deploy plus enabling the permission) about\n * 20.5 PEPU, later operations about 6.9 PEPU. The real first-session cost was\n * about 12.8 PEPU for two operations. Size per-user hourly and daily spend\n * caps above these, or users hit `trailing-hour spend ... would exceed cap`\n * after their first action.\n */\nexport const SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 } as const;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\n\n/** Type-level bridge for ZeroDev's own viem copy (same object at runtime). */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/**\n * The on-chain policies for one session: call policy v0.0.4 plus the timestamp\n * policy. Pure and deterministic given its input. Only the named function\n * fragments go into the policy, which keeps the grant small.\n *\n * @example\n * const policies = buildKernelSessionPolicies({\n *   calls: [{ target: tapScore, abi: tapScoreAbi, functionName: \"tap\" }],\n *   validUntil: Math.floor(Date.now() / 1000) + 900,\n * });\n */\nexport function buildKernelSessionPolicies(p: {\n  calls: readonly KernelSessionCall[];\n  validUntil: number;\n  validAfter?: number;\n}): Policy[] {\n  assertCalls(p.calls);\n  return [\n    toCallPolicy({\n      policyVersion: CallPolicyVersion.V0_0_4,\n      permissions: p.calls.map((c) => ({\n        target: c.target,\n        valueLimit: c.valueLimit ?? 0n,\n        abi: [findFunction(c)] as Abi,\n        functionName: c.functionName,\n      })),\n    } as Parameters<typeof toCallPolicy>[0]),\n    toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil }),\n  ];\n}\n\n/**\n * A fresh random session key. SERVER ONLY: the private key must never reach\n * the browser. Only the address is sent to the owner for approval.\n *\n * @example\n * const { privateKey, address } = generateSessionKey();\n */\nexport function generateSessionKey(): { privateKey: Hex; address: Address } {\n  const privateKey = generatePrivateKey();\n  return { privateKey, address: privateKeyToAccount(privateKey).address };\n}\n\nfunction permissionFor(publicClient: PublicClient, sessionKeyAddress: Address, policies: Policy[]) {\n  return toPermissionValidator(zd(publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    signer: toEmptyECDSASigner(sessionKeyAddress),\n    policies,\n  });\n}\n\n/**\n * The permission id the chain derives for this session key plus these\n * policies. The server compares it with a browser-supplied approval.\n *\n * @example\n * const permissionId = await expectedPermissionId({ publicClient, sessionKeyAddress, policies });\n */\nexport async function expectedPermissionId(p: {\n  publicClient: PublicClient;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<string> {\n  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const { permissionId } = permission.getPluginSerializationParams();\n  if (!permissionId) throw new Error(\"Could not derive the permission id.\");\n  return permissionId;\n}\n\n/**\n * In the user's browser: the owner (the Privy embedded wallet, the only thing\n * that can authorize a session) signs ONE EIP-712 message that enables a\n * permission validator on their Kernel account. That signature is the whole\n * grant. It names the session key's public address (never its private key)\n * and the policies. The returned `approval` holds no secret: it is the enable\n * signature plus the policy parameters, useless without the session key.\n *\n * @example\n * const { approval, kernelAddress } = await approveKernelSession({\n *   publicClient, owner: walletClient, sessionKeyAddress, policies,\n * });\n */\nexport async function approveKernelSession(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<{ approval: string; kernelAddress: Address }> {\n  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const account = await toPepuKernelAccount({\n    publicClient: p.publicClient,\n    owner: p.owner,\n    plugins: { regular },\n  });\n  const approval = await serializePermissionAccount(account as never);\n  return { approval, kernelAddress: account.address };\n}\n\n/**\n * On the server: rebuild the session's Kernel account from the approval and\n * the server-held session key (an ECDSA signer for that key). No owner\n * signature is involved. Pass the result to `createPepuSponsoredClient`.\n *\n * @example\n * const account = await loadKernelSessionAccount({ publicClient, approval, sessionPrivateKey });\n */\nexport async function loadKernelSessionAccount(p: {\n  publicClient: PublicClient;\n  approval: string;\n  sessionPrivateKey: Hex;\n}): Promise<KernelSmartAccount> {\n  const sessionSigner = await toECDSASigner({ signer: privateKeyToAccount(p.sessionPrivateKey) });\n  const account = await deserializePermissionAccount(\n    zd(p.publicClient),\n    ENTRY_POINT_V07,\n    KERNEL_VERSION,\n    p.approval,\n    sessionSigner,\n  );\n  return account as unknown as KernelSmartAccount;\n}\n"]}

package/dist/{chunk-ZB6SVBK4.js → chunk-QIDMFFAQ.js}

@@ -1,6 +1,6 @@
-import { ENTRY_POINT_V07, createPepuPaymasterClient, estimatePepuUserOpFees, requireBundlerUrl } from './chunk-IB2FSPMJ.js';
+import { ENTRY_POINT_V07, createPepuPaymasterClient, estimatePepuUserOpFees, requireBundlerUrl } from './chunk-QZKUPCUD.js';
 import { normalizeCalls } from './chunk-VBH3JLQ5.js';
-import { describeUserOpFailure } from './chunk-D52PADVY.js';
+import { describeUserOpFailure } from './chunk-GFKIM7HT.js';
 import { txUrl } from './chunk-J6UXXHBE.js';
 import { resolvePepuEndpoints } from './chunk-XC4IBCI2.js';
 import { pepuMainnet } from './chunk-VTQIHMF3.js';
@@ -85,5 +85,5 @@ async function sendSponsored(p) {
 }
 
 export { KERNEL_VERSION, createPepuSponsoredClient, getKernelAddress, sendSponsored, toPepuKernelAccount };
-//# sourceMappingURL=chunk-ZB6SVBK4.js.map
-//# sourceMappingURL=chunk-ZB6SVBK4.js.map
+//# sourceMappingURL=chunk-QIDMFFAQ.js.map
+//# sourceMappingURL=chunk-QIDMFFAQ.js.map

package/dist/{chunk-ZB6SVBK4.js.map → chunk-QIDMFFAQ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/aa/kernel.ts"],"names":[],"mappings":";;;;;;;;;;AAiCO,IAAM,iBAAiB,SAAA,CAAU;AAUxC,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,mBAAA,GAAoC;AAC3C,EAAA,OAAO,kBAAA,CAAmB,EAAE,KAAA,EAAO,WAAA,EAAa,SAAA,EAAW,KAAK,oBAAA,EAAqB,CAAE,MAAM,CAAA,EAAG,CAAA;AAClG;AAWA,eAAsB,oBAAoB,CAAA,EAUV;AAC9B,EAAA,MAAM,OAAO,MAAM,sBAAA,CAAuB,EAAA,CAAG,CAAA,CAAE,YAAY,CAAA,EAAG;AAAA,IAC5D,QAAQ,CAAA,CAAE,KAAA;AAAA,IACV,UAAA,EAAY,eAAA;AAAA,IACZ,aAAA,EAAe;AAAA,GAChB,CAAA;AACD,EAAA,OAAO,mBAAA,CAAoB,EAAA,CAAG,CAAA,CAAE,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAY,eAAA;AAAA,IACZ,aAAA,EAAe,cAAA;AAAA,IACf,OAAA,EAAS,EAAE,IAAA,EAAM,GAAI,EAAE,OAAA,EAAS,OAAA,GAAU,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,OAAA,EAAQ,GAAI,EAAC,EAAG;AAAA,IAC/E,GAAI,EAAE,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI;AAAC,GAC5B,CAAA;AAC1B;AAEA,SAAS,eAAe,OAAA,EAAgC;AACtD,EAAA,MAAM,SAAS,YAA4B;AACzC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,IAAA,EAAM,OAAA;AAAA,IACN,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,WAAA,EAAa,MAAA;AAAA,IACb,eAAA,EAAiB,MAAA;AAAA,IACjB,aAAA,EAAe;AAAA,GACjB;AACF;AASA,eAAsB,gBAAA,CAAiB,cAA4B,KAAA,EAAkC;AACnG,EAAA,MAAM,OAAA,GAAU,MAAM,mBAAA,CAAoB,EAAE,cAAc,KAAA,EAAO,cAAA,CAAe,KAAK,CAAA,EAAG,CAAA;AACxF,EAAA,OAAO,OAAA,CAAQ,OAAA;AACjB;AASO,SAAS,0BAA0B,CAAA,EAQlB;AACtB,EAAA,MAAM,YAAA,GAAe,CAAA,CAAE,YAAA,IAAgB,mBAAA,EAAoB;AAC3D,EAAA,MAAM,YAAY,yBAAA,CAA0B;AAAA,IAC1C,GAAI,EAAE,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,CAAA,CAAE,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,EAAE,cAAA,KAAmB,MAAA,GAAY,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI,EAAC;AAAA,IAC7E,GAAI,EAAE,gBAAA,GAAmB,EAAE,SAAS,CAAA,CAAE,gBAAA,KAAqB;AAAC,GAC7D,CAAA;AACD,EAAA,OAAO,yBAAA,CAA0B;AAAA,IAC/B,SAAS,CAAA,CAAE,OAAA;AAAA,IACX,KAAA,EAAO,WAAA;AAAA,IACP,MAAA,EAAQ,GAAG,YAAY,CAAA;AAAA,IACvB,gBAAA,EAAkB,IAAA,CAAK,iBAAA,CAAkB,CAAA,CAAE,UAAU,CAAC,CAAA;AAAA,IACtD,SAAA;AAAA,IACA,eAAe,EAAE,kBAAA,EAAoB,YAAY,sBAAA,CAAuB,YAAY,CAAA;AAAE,GACzB,CAAA;AACjE;AAsBA,eAAsB,cAAc,CAAA,EAIH;AAC/B,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,CAAA,CAAE,KAAK,CAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,EAAE,MAAA,CAAO,OAAA;AACzB,IAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,WAAA,CAAY,KAAK,CAAA;AAChD,IAAA,MAAM,aAAa,MAAM,CAAA,CAAE,OAAO,iBAAA,CAAkB,EAAE,UAAU,CAAA;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,CAAA,CAAE,MAAA,CAAO,2BAAA,CAA4B,EAAE,IAAA,EAAM,UAAA,EAAY,OAAA,EAAS,CAAA,CAAE,SAAA,IAAa,GAAA,EAAQ,CAAA;AAC/G,IAAA,MAAM,eAAA,GAAkB,QAAQ,OAAA,CAAQ,eAAA;AACxC,IAAA,OAAO;AAAA,MACL,UAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,SAAA,EAAW,QAAQ,SAAA,IAAa,IAAA;AAAA,MAChC,kBAAkB,OAAA,CAAQ,aAAA;AAAA,MAC1B,WAAA,EAAa,KAAA,CAAM,WAAA,EAAa,eAAe;AAAA,KACjD;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,sBAAsB,CAAC,CAAA;AAAA,EAC/B;AACF","file":"chunk-ZB6SVBK4.js","sourcesContent":["/**\n * @pepu-chain/sdk/aa/kernel: Kernel v3.1 smart account plus sponsored-send\n * helpers for the \"direct\" transport (your own bundler and paymaster URLs).\n * Needs the optional peers `@zerodev/sdk` and `@zerodev/ecdsa-validator`.\n *\n * This is the only module in the SDK (with `session/kernel` and `combo`) that\n * imports ZeroDev. Ported from `templates/sponsored-session-app/lib/kernel.ts`\n * (Kernel v3.1 build, 20% fee headroom because Alto lacks\n * `zd_getUserOperationGasPrice`).\n *\n * Session keys: `toPepuKernelAccount` takes an optional `plugins.regular`\n * validator, which is the plug point WP-B6 (`/session/kernel`, `/combo`) uses\n * to add a permission validator on top of the ECDSA root.\n */\nimport { signerToEcdsaValidator } from \"@zerodev/ecdsa-validator\";\nimport { constants, createKernelAccount, createKernelAccountClient } from \"@zerodev/sdk\";\nimport type { Signer } from \"@zerodev/sdk/types\";\nimport { createPublicClient, http } from \"viem\";\nimport type { Address, Hex, LocalAccount, PublicClient, WalletClient } from \"viem\";\n\nimport { pepuMainnet } from \"../chains.js\";\nimport { resolvePepuEndpoints } from \"../endpoints.js\";\nimport { txUrl } from \"../explorer.js\";\nimport type { PaymasterContext } from \"../erc7677.js\";\nimport { normalizeCalls } from \"./calls.js\";\nimport { ENTRY_POINT_V07, createPepuPaymasterClient, estimatePepuUserOpFees, requireBundlerUrl } from \"./clients.js\";\nimport { describeUserOpFailure } from \"./describe.js\";\nimport type { Call } from \"./types.js\";\n\nexport type { Call } from \"./types.js\";\nexport { encodeKernelExecute } from \"./calls.js\";\n\n/** Kernel v3.1, the version deployed on PEPU mainnet (factory in the contract registry). */\nexport const KERNEL_VERSION = constants.KERNEL_V3_1;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\ntype KernelAccountParams = Parameters<typeof createKernelAccount>[1];\n\n/**\n * The ZeroDev packages resolve their own copy of viem as a peer. In a monorepo\n * with several viem installs two identical `PublicClient` types are nominally\n * different; this is a type-level bridge only (same object at runtime).\n */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/** The Kernel account type this module builds. */\nexport type KernelSmartAccount = Awaited<ReturnType<typeof createKernelAccount>>;\n/** The sponsored client type {@link createPepuSponsoredClient} returns. */\nexport type KernelAccountClient = ReturnType<typeof createKernelAccountClient>;\n\n/** Anything that can sign for the Kernel owner. */\nexport type KernelOwner = LocalAccount | Signer | WalletClient;\n\nfunction defaultPublicClient(): PublicClient {\n  return createPublicClient({ chain: pepuMainnet, transport: http(resolvePepuEndpoints().rpcUrl) }) as PublicClient;\n}\n\n/**\n * Build a Kernel v3.1 smart account owned by `owner` (ECDSA root validator).\n * The address depends only on the owner and `index`, never on a session.\n * Pass `plugins.regular` to add a permission (session-key) validator on top\n * of the root; that is how `@pepu-chain/sdk/session/kernel` builds on this.\n *\n * @example\n * const account = await toPepuKernelAccount({ publicClient, owner: privateKeyToAccount(key) });\n */\nexport async function toPepuKernelAccount(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  index?: bigint;\n  /**\n   * `regular` is a ZeroDev validator plugin, for example the permission\n   * validator from `@zerodev/permissions` (see `@pepu-chain/sdk/session/kernel`).\n   * Typed as `object` so this entry does not need `@zerodev/permissions` types.\n   */\n  plugins?: { regular?: object };\n}): Promise<KernelSmartAccount> {\n  const sudo = await signerToEcdsaValidator(zd(p.publicClient), {\n    signer: p.owner as Signer,\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n  });\n  return createKernelAccount(zd(p.publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    plugins: { sudo, ...(p.plugins?.regular ? { regular: p.plugins.regular } : {}) },\n    ...(p.index !== undefined ? { index: p.index } : {}),\n  } as KernelAccountParams);\n}\n\nfunction toEmptyAccount(address: Address): LocalAccount {\n  const refuse = async (): Promise<never> => {\n    throw new Error(\"read-only account cannot sign\");\n  };\n  return {\n    address,\n    type: \"local\",\n    source: \"custom\",\n    publicKey: \"0x\" as Hex,\n    signMessage: refuse,\n    signTransaction: refuse,\n    signTypedData: refuse,\n  } as unknown as LocalAccount;\n}\n\n/**\n * The counterfactual Kernel address for an owner, with no signature needed.\n * Lifted from `templates/sponsored-session-app/lib/kernel.ts`.\n *\n * @example\n * const smartAccount = await getKernelAddress(publicClient, ownerAddress);\n */\nexport async function getKernelAddress(publicClient: PublicClient, owner: Address): Promise<Address> {\n  const account = await toPepuKernelAccount({ publicClient, owner: toEmptyAccount(owner) });\n  return account.address;\n}\n\n/**\n * A Kernel client that sends through YOUR bundler and has gas paid by YOUR\n * paymaster (ERC-7677). Fees come from the chain with 20% headroom.\n *\n * @example\n * const client = createPepuSponsoredClient({ account, paymasterContext: { privyAccessToken } });\n */\nexport function createPepuSponsoredClient(p: {\n  account: KernelSmartAccount;\n  bundlerUrl?: string;\n  paymasterUrl?: string;\n  /** Project client token; builds the ERC-7677 URL against the paymaster base when no URL is configured. */\n  paymasterToken?: string;\n  paymasterContext?: PaymasterContext;\n  publicClient?: PublicClient;\n}): KernelAccountClient {\n  const publicClient = p.publicClient ?? defaultPublicClient();\n  const paymaster = createPepuPaymasterClient({\n    ...(p.paymasterUrl !== undefined ? { paymasterUrl: p.paymasterUrl } : {}),\n    ...(p.paymasterToken !== undefined ? { paymasterToken: p.paymasterToken } : {}),\n    ...(p.paymasterContext ? { context: p.paymasterContext } : {}),\n  });\n  return createKernelAccountClient({\n    account: p.account,\n    chain: pepuMainnet,\n    client: zd(publicClient),\n    bundlerTransport: http(requireBundlerUrl(p.bundlerUrl)),\n    paymaster,\n    userOperation: { estimateFeesPerGas: async () => estimatePepuUserOpFees(publicClient) },\n  } as unknown as Parameters<typeof createKernelAccountClient>[0]);\n}\n\n/** Result of {@link sendSponsored}. */\nexport interface SendSponsoredResult {\n  userOpHash: Hex;\n  transactionHash: Hex;\n  success: boolean;\n  paymaster: Address | null;\n  actualGasCostWei: bigint;\n  explorerUrl: string;\n}\n\n/**\n * Encode `calls`, send one UserOperation, wait for its receipt, and report\n * who paid. Failures are mapped through `describeUserOpFailure` (AAxx and\n * paymaster reasons become typed PepuErrors). Flow ported from\n * `sendSessionTap` in the sponsored-session-app template.\n *\n * @example\n * const r = await sendSponsored({ client, calls: [{ to, abi, functionName: \"tap\" }] });\n * console.log(r.paymaster, r.explorerUrl);\n */\nexport async function sendSponsored(p: {\n  client: KernelAccountClient;\n  calls: Call[];\n  timeoutMs?: number;\n}): Promise<SendSponsoredResult> {\n  const calls = normalizeCalls(p.calls);\n  try {\n    const account = p.client.account;\n    if (!account) throw new Error(\"The Kernel client has no account.\");\n    const callData = await account.encodeCalls(calls);\n    const userOpHash = await p.client.sendUserOperation({ callData });\n    const receipt = await p.client.waitForUserOperationReceipt({ hash: userOpHash, timeout: p.timeoutMs ?? 90_000 });\n    const transactionHash = receipt.receipt.transactionHash;\n    return {\n      userOpHash,\n      transactionHash,\n      success: receipt.success,\n      paymaster: receipt.paymaster ?? null,\n      actualGasCostWei: receipt.actualGasCost,\n      explorerUrl: txUrl(pepuMainnet, transactionHash),\n    };\n  } catch (e) {\n    throw describeUserOpFailure(e);\n  }\n}\n"]}
+{"version":3,"sources":["../src/aa/kernel.ts"],"names":[],"mappings":";;;;;;;;;;AAiCO,IAAM,iBAAiB,SAAA,CAAU;AAUxC,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAUA,SAAS,mBAAA,GAAoC;AAC3C,EAAA,OAAO,kBAAA,CAAmB,EAAE,KAAA,EAAO,WAAA,EAAa,SAAA,EAAW,KAAK,oBAAA,EAAqB,CAAE,MAAM,CAAA,EAAG,CAAA;AAClG;AAWA,eAAsB,oBAAoB,CAAA,EAUV;AAC9B,EAAA,MAAM,OAAO,MAAM,sBAAA,CAAuB,EAAA,CAAG,CAAA,CAAE,YAAY,CAAA,EAAG;AAAA,IAC5D,QAAQ,CAAA,CAAE,KAAA;AAAA,IACV,UAAA,EAAY,eAAA;AAAA,IACZ,aAAA,EAAe;AAAA,GAChB,CAAA;AACD,EAAA,OAAO,mBAAA,CAAoB,EAAA,CAAG,CAAA,CAAE,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAY,eAAA;AAAA,IACZ,aAAA,EAAe,cAAA;AAAA,IACf,OAAA,EAAS,EAAE,IAAA,EAAM,GAAI,EAAE,OAAA,EAAS,OAAA,GAAU,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,CAAQ,OAAA,EAAQ,GAAI,EAAC,EAAG;AAAA,IAC/E,GAAI,EAAE,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI;AAAC,GAC5B,CAAA;AAC1B;AAEA,SAAS,eAAe,OAAA,EAAgC;AACtD,EAAA,MAAM,SAAS,YAA4B;AACzC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD,CAAA;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,IAAA,EAAM,OAAA;AAAA,IACN,MAAA,EAAQ,QAAA;AAAA,IACR,SAAA,EAAW,IAAA;AAAA,IACX,WAAA,EAAa,MAAA;AAAA,IACb,eAAA,EAAiB,MAAA;AAAA,IACjB,aAAA,EAAe;AAAA,GACjB;AACF;AASA,eAAsB,gBAAA,CAAiB,cAA4B,KAAA,EAAkC;AACnG,EAAA,MAAM,OAAA,GAAU,MAAM,mBAAA,CAAoB,EAAE,cAAc,KAAA,EAAO,cAAA,CAAe,KAAK,CAAA,EAAG,CAAA;AACxF,EAAA,OAAO,OAAA,CAAQ,OAAA;AACjB;AASO,SAAS,0BAA0B,CAAA,EAQlB;AACtB,EAAA,MAAM,YAAA,GAAe,CAAA,CAAE,YAAA,IAAgB,mBAAA,EAAoB;AAC3D,EAAA,MAAM,YAAY,yBAAA,CAA0B;AAAA,IAC1C,GAAI,EAAE,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,CAAA,CAAE,YAAA,EAAa,GAAI,EAAC;AAAA,IACvE,GAAI,EAAE,cAAA,KAAmB,MAAA,GAAY,EAAE,cAAA,EAAgB,CAAA,CAAE,cAAA,EAAe,GAAI,EAAC;AAAA,IAC7E,GAAI,EAAE,gBAAA,GAAmB,EAAE,SAAS,CAAA,CAAE,gBAAA,KAAqB;AAAC,GAC7D,CAAA;AACD,EAAA,OAAO,yBAAA,CAA0B;AAAA,IAC/B,SAAS,CAAA,CAAE,OAAA;AAAA,IACX,KAAA,EAAO,WAAA;AAAA,IACP,MAAA,EAAQ,GAAG,YAAY,CAAA;AAAA,IACvB,gBAAA,EAAkB,IAAA,CAAK,iBAAA,CAAkB,CAAA,CAAE,UAAU,CAAC,CAAA;AAAA,IACtD,SAAA;AAAA,IACA,eAAe,EAAE,kBAAA,EAAoB,YAAY,sBAAA,CAAuB,YAAY,CAAA;AAAE,GACzB,CAAA;AACjE;AAsBA,eAAsB,cAAc,CAAA,EAIH;AAC/B,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,CAAA,CAAE,KAAK,CAAA;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,EAAE,MAAA,CAAO,OAAA;AACzB,IAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,WAAA,CAAY,KAAK,CAAA;AAChD,IAAA,MAAM,aAAa,MAAM,CAAA,CAAE,OAAO,iBAAA,CAAkB,EAAE,UAAU,CAAA;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,CAAA,CAAE,MAAA,CAAO,2BAAA,CAA4B,EAAE,IAAA,EAAM,UAAA,EAAY,OAAA,EAAS,CAAA,CAAE,SAAA,IAAa,GAAA,EAAQ,CAAA;AAC/G,IAAA,MAAM,eAAA,GAAkB,QAAQ,OAAA,CAAQ,eAAA;AACxC,IAAA,OAAO;AAAA,MACL,UAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,SAAA,EAAW,QAAQ,SAAA,IAAa,IAAA;AAAA,MAChC,kBAAkB,OAAA,CAAQ,aAAA;AAAA,MAC1B,WAAA,EAAa,KAAA,CAAM,WAAA,EAAa,eAAe;AAAA,KACjD;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,sBAAsB,CAAC,CAAA;AAAA,EAC/B;AACF","file":"chunk-QIDMFFAQ.js","sourcesContent":["/**\n * @pepu-chain/sdk/aa/kernel: Kernel v3.1 smart account plus sponsored-send\n * helpers for the \"direct\" transport (your own bundler and paymaster URLs).\n * Needs the optional peers `@zerodev/sdk` and `@zerodev/ecdsa-validator`.\n *\n * This is the only module in the SDK (with `session/kernel` and `combo`) that\n * imports ZeroDev. Ported from `templates/sponsored-session-app/lib/kernel.ts`\n * (Kernel v3.1 build, 20% fee headroom because Alto lacks\n * `zd_getUserOperationGasPrice`).\n *\n * Session keys: `toPepuKernelAccount` takes an optional `plugins.regular`\n * validator, which is the plug point WP-B6 (`/session/kernel`, `/combo`) uses\n * to add a permission validator on top of the ECDSA root.\n */\nimport { signerToEcdsaValidator } from \"@zerodev/ecdsa-validator\";\nimport { constants, createKernelAccount, createKernelAccountClient } from \"@zerodev/sdk\";\nimport type { Signer } from \"@zerodev/sdk/types\";\nimport { createPublicClient, http } from \"viem\";\nimport type { Address, Hex, LocalAccount, PublicClient, WalletClient } from \"viem\";\n\nimport { pepuMainnet } from \"../chains.js\";\nimport { resolvePepuEndpoints } from \"../endpoints.js\";\nimport { txUrl } from \"../explorer.js\";\nimport type { PaymasterContext } from \"../erc7677.js\";\nimport { normalizeCalls } from \"./calls.js\";\nimport { ENTRY_POINT_V07, createPepuPaymasterClient, estimatePepuUserOpFees, requireBundlerUrl } from \"./clients.js\";\nimport { describeUserOpFailure } from \"./describe.js\";\nimport type { Call } from \"./types.js\";\n\nexport type { Call } from \"./types.js\";\nexport { encodeKernelExecute } from \"./calls.js\";\n\n/** Kernel v3.1, the version deployed on PEPU mainnet (factory in the contract registry). */\nexport const KERNEL_VERSION = constants.KERNEL_V3_1;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\ntype KernelAccountParams = Parameters<typeof createKernelAccount>[1];\n\n/**\n * The ZeroDev packages resolve their own copy of viem as a peer. In a monorepo\n * with several viem installs two identical `PublicClient` types are nominally\n * different; this is a type-level bridge only (same object at runtime).\n */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/** The Kernel account type this module builds. */\nexport type KernelSmartAccount = Awaited<ReturnType<typeof createKernelAccount>>;\n/** The sponsored client type {@link createPepuSponsoredClient} returns. */\nexport type KernelAccountClient = ReturnType<typeof createKernelAccountClient>;\n\n/** Anything that can sign for the Kernel owner. */\nexport type KernelOwner = LocalAccount | Signer | WalletClient;\n\nfunction defaultPublicClient(): PublicClient {\n  return createPublicClient({ chain: pepuMainnet, transport: http(resolvePepuEndpoints().rpcUrl) }) as PublicClient;\n}\n\n/**\n * Build a Kernel v3.1 smart account owned by `owner` (ECDSA root validator).\n * The address depends only on the owner and `index`, never on a session.\n * Pass `plugins.regular` to add a permission (session-key) validator on top\n * of the root; that is how `@pepu-chain/sdk/session/kernel` builds on this.\n *\n * @example\n * const account = await toPepuKernelAccount({ publicClient, owner: privateKeyToAccount(key) });\n */\nexport async function toPepuKernelAccount(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  index?: bigint;\n  /**\n   * `regular` is a ZeroDev validator plugin, for example the permission\n   * validator from `@zerodev/permissions` (see `@pepu-chain/sdk/session/kernel`).\n   * Typed as `object` so this entry does not need `@zerodev/permissions` types.\n   */\n  plugins?: { regular?: object };\n}): Promise<KernelSmartAccount> {\n  const sudo = await signerToEcdsaValidator(zd(p.publicClient), {\n    signer: p.owner as Signer,\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n  });\n  return createKernelAccount(zd(p.publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    plugins: { sudo, ...(p.plugins?.regular ? { regular: p.plugins.regular } : {}) },\n    ...(p.index !== undefined ? { index: p.index } : {}),\n  } as KernelAccountParams);\n}\n\nfunction toEmptyAccount(address: Address): LocalAccount {\n  const refuse = async (): Promise<never> => {\n    throw new Error(\"read-only account cannot sign\");\n  };\n  return {\n    address,\n    type: \"local\",\n    source: \"custom\",\n    publicKey: \"0x\" as Hex,\n    signMessage: refuse,\n    signTransaction: refuse,\n    signTypedData: refuse,\n  } as unknown as LocalAccount;\n}\n\n/**\n * The counterfactual Kernel address for an owner, with no signature needed.\n * Lifted from `templates/sponsored-session-app/lib/kernel.ts`.\n *\n * @example\n * const smartAccount = await getKernelAddress(publicClient, ownerAddress);\n */\nexport async function getKernelAddress(publicClient: PublicClient, owner: Address): Promise<Address> {\n  const account = await toPepuKernelAccount({ publicClient, owner: toEmptyAccount(owner) });\n  return account.address;\n}\n\n/**\n * A Kernel client that sends through YOUR bundler and has gas paid by YOUR\n * paymaster (ERC-7677). Fees come from the chain with 20% headroom.\n *\n * @example\n * const client = createPepuSponsoredClient({ account, paymasterContext: { privyAccessToken } });\n */\nexport function createPepuSponsoredClient(p: {\n  account: KernelSmartAccount;\n  bundlerUrl?: string;\n  paymasterUrl?: string;\n  /** Project client token; builds the ERC-7677 URL against the paymaster base when no URL is configured. */\n  paymasterToken?: string;\n  paymasterContext?: PaymasterContext;\n  publicClient?: PublicClient;\n}): KernelAccountClient {\n  const publicClient = p.publicClient ?? defaultPublicClient();\n  const paymaster = createPepuPaymasterClient({\n    ...(p.paymasterUrl !== undefined ? { paymasterUrl: p.paymasterUrl } : {}),\n    ...(p.paymasterToken !== undefined ? { paymasterToken: p.paymasterToken } : {}),\n    ...(p.paymasterContext ? { context: p.paymasterContext } : {}),\n  });\n  return createKernelAccountClient({\n    account: p.account,\n    chain: pepuMainnet,\n    client: zd(publicClient),\n    bundlerTransport: http(requireBundlerUrl(p.bundlerUrl)),\n    paymaster,\n    userOperation: { estimateFeesPerGas: async () => estimatePepuUserOpFees(publicClient) },\n  } as unknown as Parameters<typeof createKernelAccountClient>[0]);\n}\n\n/** Result of {@link sendSponsored}. */\nexport interface SendSponsoredResult {\n  userOpHash: Hex;\n  transactionHash: Hex;\n  success: boolean;\n  paymaster: Address | null;\n  actualGasCostWei: bigint;\n  explorerUrl: string;\n}\n\n/**\n * Encode `calls`, send one UserOperation, wait for its receipt, and report\n * who paid. Failures are mapped through `describeUserOpFailure` (AAxx and\n * paymaster reasons become typed PepuErrors). Flow ported from\n * `sendSessionTap` in the sponsored-session-app template.\n *\n * @example\n * const r = await sendSponsored({ client, calls: [{ to, abi, functionName: \"tap\" }] });\n * console.log(r.paymaster, r.explorerUrl);\n */\nexport async function sendSponsored(p: {\n  client: KernelAccountClient;\n  calls: Call[];\n  timeoutMs?: number;\n}): Promise<SendSponsoredResult> {\n  const calls = normalizeCalls(p.calls);\n  try {\n    const account = p.client.account;\n    if (!account) throw new Error(\"The Kernel client has no account.\");\n    const callData = await account.encodeCalls(calls);\n    const userOpHash = await p.client.sendUserOperation({ callData });\n    const receipt = await p.client.waitForUserOperationReceipt({ hash: userOpHash, timeout: p.timeoutMs ?? 90_000 });\n    const transactionHash = receipt.receipt.transactionHash;\n    return {\n      userOpHash,\n      transactionHash,\n      success: receipt.success,\n      paymaster: receipt.paymaster ?? null,\n      actualGasCostWei: receipt.actualGasCost,\n      explorerUrl: txUrl(pepuMainnet, transactionHash),\n    };\n  } catch (e) {\n    throw describeUserOpFailure(e);\n  }\n}\n"]}

package/dist/{chunk-IB2FSPMJ.js → chunk-QZKUPCUD.js}

@@ -1,4 +1,4 @@
-import { buildErc7677Url } from './chunk-IY3ALPUJ.js';
+import { buildErc7677Url } from './chunk-RSPAN44L.js';
 import { resolvePepuEndpoints, PEPU_ENV } from './chunk-XC4IBCI2.js';
 import { pepuMainnet } from './chunk-VTQIHMF3.js';
 import { PepuConfigError } from './chunk-6DSZ4Z2N.js';
@@ -62,5 +62,5 @@ function createPepuBundlerClient(o) {
 }
 
 export { ENTRY_POINT_V07, createPepuBundlerClient, createPepuPaymasterClient, estimatePepuUserOpFees, requireBundlerUrl };
-//# sourceMappingURL=chunk-IB2FSPMJ.js.map
-//# sourceMappingURL=chunk-IB2FSPMJ.js.map
+//# sourceMappingURL=chunk-QZKUPCUD.js.map
+//# sourceMappingURL=chunk-QZKUPCUD.js.map

package/dist/{chunk-IB2FSPMJ.js.map → chunk-QZKUPCUD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/aa/clients.ts"],"names":[],"mappings":";;;;;;;AAYO,IAAM,eAAA,GAAkB;AAAA,EAC7B,OAAA,EAAS,4CAAA;AAAA,EACT,OAAA,EAAS;AACX;AAGA,IAAM,gBAAA,GAAmB,GAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AAWzB,eAAsB,uBACpB,YAAA,EACiE;AACjE,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,kBAAA,EAAmB;AACnD,EAAA,OAAO;AAAA,IACL,YAAA,EAAe,IAAA,CAAK,YAAA,GAAe,gBAAA,GAAoB,gBAAA;AAAA,IACvD,sBAAsB,IAAA,CAAK;AAAA,GAC7B;AACF;AAGO,SAAS,kBAAkB,QAAA,EAA2B;AAC3D,EAAA,MAAM,EAAE,UAAA,EAAW,GAAI,oBAAA,CAAqB,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,QAAA,EAAU,CAAA;AAClG,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAM,IAAI,eAAA,CAAgB,oBAAA,EAAsB,CAAA,oBAAA,EAAuB,QAAA,CAAS,UAAU,CAAA,oBAAA,CAAA,EAAwB;AAAA,MAChH,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,UAAA;AACT;AAQO,SAAS,mBAAA,CAAoB,UAAmB,KAAA,EAAwB;AAC7E,EAAA,MAAM,EAAE,YAAA,EAAc,gBAAA,EAAiB,GAAI,oBAAA,CAAqB,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,YAAA,EAAc,QAAA,EAAU,CAAA;AACxH,EAAA,IAAI,YAAA,KAAiB,MAAM,OAAO,YAAA;AAClC,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,CAAM,MAAK,KAAM,EAAA,IAAM,qBAAqB,IAAA,EAAM;AAC3E,IAAA,OAAO,eAAA,CAAgB,EAAE,OAAA,EAAS,gBAAA,EAAkB,OAAO,CAAA;AAAA,EAC7D;AACA,EAAA,MAAM,IAAI,eAAA,CAAgB,oBAAA,EAAsB,CAAA,+BAAA,EAAkC,QAAA,CAAS,YAAY,CAAA,uCAAA,CAAA,EAA2C;AAAA,IAChJ,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAcO,SAAS,yBAAA,CACd,CAAA,GAAoF,EAAC,EACpE;AACjB,EAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,EAAE,SAAA,EAAW,IAAA,CAAK,mBAAA,CAAoB,CAAA,CAAE,YAAA,EAAc,CAAA,CAAE,cAAc,CAAC,CAAA,EAAG,CAAA;AAC/G,EAAA,MAAM,MAAM,CAAA,CAAE,OAAA;AACd,EAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,gBAAA,EAAkB,CAAC,CAAA,KAAM,MAAA,CAAO,gBAAA,CAAiB,EAAE,GAAG,CAAA,EAAG,OAAA,EAAS,CAAA,CAAE,OAAA,IAAW,GAAA,EAAK,CAAA;AAAA,IACpF,oBAAA,EAAsB,CAAC,CAAA,KAAM,MAAA,CAAO,oBAAA,CAAqB,EAAE,GAAG,CAAA,EAAG,OAAA,EAAS,CAAA,CAAE,OAAA,IAAW,GAAA,EAAK;AAAA,GAC9F;AACF;AAUO,SAAS,wBAAwB,CAAA,EAMtB;AAChB,EAAA,MAAM,MAAA,GAAS,sBAAqB,CAAE,MAAA;AACtC,EAAA,MAAM,YAAA,GAAe,CAAA,CAAE,YAAA,IAAgB,kBAAA,CAAmB,EAAE,KAAA,EAAO,WAAA,EAAa,SAAA,EAAW,IAAA,CAAK,MAAM,CAAA,EAAG,CAAA;AACzG,EAAA,OAAO,mBAAA,CAAoB;AAAA,IACzB,SAAS,CAAA,CAAE,OAAA;AAAA,IACX,KAAA,EAAO,WAAA;AAAA,IACP,MAAA,EAAQ,YAAA;AAAA,IACR,SAAA,EAAW,IAAA,CAAK,iBAAA,CAAkB,CAAA,CAAE,UAAU,CAAC,CAAA;AAAA,IAC/C,GAAI,EAAE,SAAA,GAAY,EAAE,WAAW,CAAA,CAAE,SAAA,KAAc,EAAC;AAAA,IAChD,GAAI,EAAE,gBAAA,GAAmB,EAAE,kBAAkB,CAAA,CAAE,gBAAA,KAAqB,EAAC;AAAA,IACrE,eAAe,EAAE,kBAAA,EAAoB,YAAY,sBAAA,CAAuB,YAAY,CAAA;AAAE,GACvF,CAAA;AACH","file":"chunk-IB2FSPMJ.js","sourcesContent":["import { createPublicClient, http } from \"viem\";\nimport type { PublicClient } from \"viem\";\nimport { createBundlerClient, createPaymasterClient } from \"viem/account-abstraction\";\nimport type { BundlerClient, PaymasterClient, SmartAccount } from \"viem/account-abstraction\";\n\nimport { pepuMainnet } from \"../chains.js\";\nimport { PEPU_ENV, resolvePepuEndpoints } from \"../endpoints.js\";\nimport { PepuConfigError } from \"../errors.js\";\nimport type { PaymasterContext } from \"../erc7677.js\";\nimport { buildErc7677Url } from \"../paymaster/api.js\";\n\n/** EntryPoint v0.7, the only version PEPU's bundler and paymaster speak. */\nexport const ENTRY_POINT_V07 = {\n  address: \"0x0000000071727De22E5E9d8BAf0edAc6f37da032\",\n  version: \"0.7\",\n} as const;\n\n/** Fee headroom numerator/denominator: 12/10 = +20%. */\nconst FEE_HEADROOM_NUM = 12n;\nconst FEE_HEADROOM_DEN = 10n;\n\n/**\n * The Alto-compatible fee estimator: the chain's own `estimateFeesPerGas`,\n * with `maxFeePerGas` x 1.2. Alto does not implement ZeroDev's\n * `zd_getUserOperationGasPrice`, so the default estimator would fail.\n * Ported from `templates/sponsored-session-app/lib/kernel.ts`.\n *\n * @example\n * const fees = await estimatePepuUserOpFees(publicClient);\n */\nexport async function estimatePepuUserOpFees(\n  publicClient: Pick<PublicClient, \"estimateFeesPerGas\">,\n): Promise<{ maxFeePerGas: bigint; maxPriorityFeePerGas: bigint }> {\n  const fees = await publicClient.estimateFeesPerGas();\n  return {\n    maxFeePerGas: (fees.maxFeePerGas * FEE_HEADROOM_NUM) / FEE_HEADROOM_DEN,\n    maxPriorityFeePerGas: fees.maxPriorityFeePerGas,\n  };\n}\n\n/** Resolve the bundler URL or throw `CONFIG_MISSING_ENV` naming the variable. */\nexport function requireBundlerUrl(explicit?: string): string {\n  const { bundlerUrl } = resolvePepuEndpoints(explicit === undefined ? {} : { bundlerUrl: explicit });\n  if (bundlerUrl === null) {\n    throw new PepuConfigError(\"CONFIG_MISSING_ENV\", `No bundler URL. Set ${PEPU_ENV.bundlerUrl} or pass bundlerUrl.`, {\n      hint: \"The hosted PEPU bundler is the default; if it was cleared, set PEPU_BUNDLER_URL to https://bundler.pepeunchained.com or your own bundler.\",\n    });\n  }\n  return bundlerUrl;\n}\n\n/**\n * Resolve the complete ERC-7677 paymaster URL or throw `CONFIG_MISSING_ENV`.\n * Order: `explicit` URL, then `PEPU_PAYMASTER_URL`, then `token` (a project client token, built against the\n * paymaster base: the hosted service unless a custom URL is configured). The hosted paymaster has no tokenless\n * ERC-7677 URL, because the token names the project (or free-tier app) that is billed.\n */\nexport function requirePaymasterUrl(explicit?: string, token?: string): string {\n  const { paymasterUrl, paymasterBaseUrl } = resolvePepuEndpoints(explicit === undefined ? {} : { paymasterUrl: explicit });\n  if (paymasterUrl !== null) return paymasterUrl;\n  if (token !== undefined && token.trim() !== \"\" && paymasterBaseUrl !== null) {\n    return buildErc7677Url({ baseUrl: paymasterBaseUrl, token });\n  }\n  throw new PepuConfigError(\"CONFIG_MISSING_ENV\", `No ERC-7677 paymaster URL. Set ${PEPU_ENV.paymasterUrl} or pass paymasterUrl / paymasterToken.`, {\n    hint: \"The hosted paymaster (https://paymaster.pepeunchained.com) needs your project's client token: set PEPU_PAYMASTER_URL to https://paymaster.pepeunchained.com/v2/paymaster/<client token>.\",\n  });\n}\n\n/**\n * An ERC-7677 paymaster client for PEPU (viem `createPaymasterClient`), using\n * the endpoints registry for the URL. A `context` (for example\n * `buildPaymasterContext({ privyAccessToken })`) is injected into every\n * `pm_getPaymasterStubData` and `pm_getPaymasterData` call unless the caller\n * passes one.\n *\n * @example\n * const paymaster = createPepuPaymasterClient({\n *   context: buildPaymasterContext({ privyAccessToken }),\n * });\n */\nexport function createPepuPaymasterClient(\n  o: { paymasterUrl?: string; paymasterToken?: string; context?: PaymasterContext } = {},\n): PaymasterClient {\n  const client = createPaymasterClient({ transport: http(requirePaymasterUrl(o.paymasterUrl, o.paymasterToken)) });\n  const ctx = o.context;\n  if (!ctx) return client;\n  return {\n    ...client,\n    getPaymasterData: (p) => client.getPaymasterData({ ...p, context: p.context ?? ctx }),\n    getPaymasterStubData: (p) => client.getPaymasterStubData({ ...p, context: p.context ?? ctx }),\n  };\n}\n\n/**\n * A viem bundler client for PEPU's bundler, with the fee estimator\n * pre-wired ({@link estimatePepuUserOpFees}).\n *\n * @example\n * const bundler = createPepuBundlerClient({ account, paymaster: createPepuPaymasterClient() });\n * const hash = await bundler.sendUserOperation({ calls: [{ to, data }] });\n */\nexport function createPepuBundlerClient(o: {\n  bundlerUrl?: string;\n  account: SmartAccount;\n  paymaster?: PaymasterClient;\n  paymasterContext?: PaymasterContext;\n  publicClient?: PublicClient;\n}): BundlerClient {\n  const rpcUrl = resolvePepuEndpoints().rpcUrl;\n  const publicClient = o.publicClient ?? createPublicClient({ chain: pepuMainnet, transport: http(rpcUrl) });\n  return createBundlerClient({\n    account: o.account,\n    chain: pepuMainnet,\n    client: publicClient,\n    transport: http(requireBundlerUrl(o.bundlerUrl)),\n    ...(o.paymaster ? { paymaster: o.paymaster } : {}),\n    ...(o.paymasterContext ? { paymasterContext: o.paymasterContext } : {}),\n    userOperation: { estimateFeesPerGas: async () => estimatePepuUserOpFees(publicClient) },\n  }) as BundlerClient;\n}\n"]}
+{"version":3,"sources":["../src/aa/clients.ts"],"names":[],"mappings":";;;;;;;AAYO,IAAM,eAAA,GAAkB;AAAA,EAC7B,OAAA,EAAS,4CAAA;AAAA,EACT,OAAA,EAAS;AACX;AAGA,IAAM,gBAAA,GAAmB,GAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AAWzB,eAAsB,uBACpB,YAAA,EACiE;AACjE,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,kBAAA,EAAmB;AACnD,EAAA,OAAO;AAAA,IACL,YAAA,EAAe,IAAA,CAAK,YAAA,GAAe,gBAAA,GAAoB,gBAAA;AAAA,IACvD,sBAAsB,IAAA,CAAK;AAAA,GAC7B;AACF;AAGO,SAAS,kBAAkB,QAAA,EAA2B;AAC3D,EAAA,MAAM,EAAE,UAAA,EAAW,GAAI,oBAAA,CAAqB,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,UAAA,EAAY,QAAA,EAAU,CAAA;AAClG,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAM,IAAI,eAAA,CAAgB,oBAAA,EAAsB,CAAA,oBAAA,EAAuB,QAAA,CAAS,UAAU,CAAA,oBAAA,CAAA,EAAwB;AAAA,MAChH,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,UAAA;AACT;AAQO,SAAS,mBAAA,CAAoB,UAAmB,KAAA,EAAwB;AAC7E,EAAA,MAAM,EAAE,YAAA,EAAc,gBAAA,EAAiB,GAAI,oBAAA,CAAqB,QAAA,KAAa,MAAA,GAAY,EAAC,GAAI,EAAE,YAAA,EAAc,QAAA,EAAU,CAAA;AACxH,EAAA,IAAI,YAAA,KAAiB,MAAM,OAAO,YAAA;AAClC,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,CAAM,MAAK,KAAM,EAAA,IAAM,qBAAqB,IAAA,EAAM;AAC3E,IAAA,OAAO,eAAA,CAAgB,EAAE,OAAA,EAAS,gBAAA,EAAkB,OAAO,CAAA;AAAA,EAC7D;AACA,EAAA,MAAM,IAAI,eAAA,CAAgB,oBAAA,EAAsB,CAAA,+BAAA,EAAkC,QAAA,CAAS,YAAY,CAAA,uCAAA,CAAA,EAA2C;AAAA,IAChJ,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAcO,SAAS,yBAAA,CACd,CAAA,GAAoF,EAAC,EACpE;AACjB,EAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,EAAE,SAAA,EAAW,IAAA,CAAK,mBAAA,CAAoB,CAAA,CAAE,YAAA,EAAc,CAAA,CAAE,cAAc,CAAC,CAAA,EAAG,CAAA;AAC/G,EAAA,MAAM,MAAM,CAAA,CAAE,OAAA;AACd,EAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,gBAAA,EAAkB,CAAC,CAAA,KAAM,MAAA,CAAO,gBAAA,CAAiB,EAAE,GAAG,CAAA,EAAG,OAAA,EAAS,CAAA,CAAE,OAAA,IAAW,GAAA,EAAK,CAAA;AAAA,IACpF,oBAAA,EAAsB,CAAC,CAAA,KAAM,MAAA,CAAO,oBAAA,CAAqB,EAAE,GAAG,CAAA,EAAG,OAAA,EAAS,CAAA,CAAE,OAAA,IAAW,GAAA,EAAK;AAAA,GAC9F;AACF;AAUO,SAAS,wBAAwB,CAAA,EAMtB;AAChB,EAAA,MAAM,MAAA,GAAS,sBAAqB,CAAE,MAAA;AACtC,EAAA,MAAM,YAAA,GAAe,CAAA,CAAE,YAAA,IAAgB,kBAAA,CAAmB,EAAE,KAAA,EAAO,WAAA,EAAa,SAAA,EAAW,IAAA,CAAK,MAAM,CAAA,EAAG,CAAA;AACzG,EAAA,OAAO,mBAAA,CAAoB;AAAA,IACzB,SAAS,CAAA,CAAE,OAAA;AAAA,IACX,KAAA,EAAO,WAAA;AAAA,IACP,MAAA,EAAQ,YAAA;AAAA,IACR,SAAA,EAAW,IAAA,CAAK,iBAAA,CAAkB,CAAA,CAAE,UAAU,CAAC,CAAA;AAAA,IAC/C,GAAI,EAAE,SAAA,GAAY,EAAE,WAAW,CAAA,CAAE,SAAA,KAAc,EAAC;AAAA,IAChD,GAAI,EAAE,gBAAA,GAAmB,EAAE,kBAAkB,CAAA,CAAE,gBAAA,KAAqB,EAAC;AAAA,IACrE,eAAe,EAAE,kBAAA,EAAoB,YAAY,sBAAA,CAAuB,YAAY,CAAA;AAAE,GACvF,CAAA;AACH","file":"chunk-QZKUPCUD.js","sourcesContent":["import { createPublicClient, http } from \"viem\";\nimport type { PublicClient } from \"viem\";\nimport { createBundlerClient, createPaymasterClient } from \"viem/account-abstraction\";\nimport type { BundlerClient, PaymasterClient, SmartAccount } from \"viem/account-abstraction\";\n\nimport { pepuMainnet } from \"../chains.js\";\nimport { PEPU_ENV, resolvePepuEndpoints } from \"../endpoints.js\";\nimport { PepuConfigError } from \"../errors.js\";\nimport type { PaymasterContext } from \"../erc7677.js\";\nimport { buildErc7677Url } from \"../paymaster/api.js\";\n\n/** EntryPoint v0.7, the only version PEPU's bundler and paymaster speak. */\nexport const ENTRY_POINT_V07 = {\n  address: \"0x0000000071727De22E5E9d8BAf0edAc6f37da032\",\n  version: \"0.7\",\n} as const;\n\n/** Fee headroom numerator/denominator: 12/10 = +20%. */\nconst FEE_HEADROOM_NUM = 12n;\nconst FEE_HEADROOM_DEN = 10n;\n\n/**\n * The Alto-compatible fee estimator: the chain's own `estimateFeesPerGas`,\n * with `maxFeePerGas` x 1.2. Alto does not implement ZeroDev's\n * `zd_getUserOperationGasPrice`, so the default estimator would fail.\n * Ported from `templates/sponsored-session-app/lib/kernel.ts`.\n *\n * @example\n * const fees = await estimatePepuUserOpFees(publicClient);\n */\nexport async function estimatePepuUserOpFees(\n  publicClient: Pick<PublicClient, \"estimateFeesPerGas\">,\n): Promise<{ maxFeePerGas: bigint; maxPriorityFeePerGas: bigint }> {\n  const fees = await publicClient.estimateFeesPerGas();\n  return {\n    maxFeePerGas: (fees.maxFeePerGas * FEE_HEADROOM_NUM) / FEE_HEADROOM_DEN,\n    maxPriorityFeePerGas: fees.maxPriorityFeePerGas,\n  };\n}\n\n/** Resolve the bundler URL or throw `CONFIG_MISSING_ENV` naming the variable. */\nexport function requireBundlerUrl(explicit?: string): string {\n  const { bundlerUrl } = resolvePepuEndpoints(explicit === undefined ? {} : { bundlerUrl: explicit });\n  if (bundlerUrl === null) {\n    throw new PepuConfigError(\"CONFIG_MISSING_ENV\", `No bundler URL. Set ${PEPU_ENV.bundlerUrl} or pass bundlerUrl.`, {\n      hint: \"The hosted PEPU bundler is the default; if it was cleared, set PEPU_BUNDLER_URL to https://bundler.pepeunchained.com or your own bundler.\",\n    });\n  }\n  return bundlerUrl;\n}\n\n/**\n * Resolve the complete ERC-7677 paymaster URL or throw `CONFIG_MISSING_ENV`.\n * Order: `explicit` URL, then `PEPU_PAYMASTER_URL`, then `token` (a project client token, built against the\n * paymaster base: the hosted service unless a custom URL is configured). The hosted paymaster has no tokenless\n * ERC-7677 URL, because the token names the project (or free-tier app) that is billed.\n */\nexport function requirePaymasterUrl(explicit?: string, token?: string): string {\n  const { paymasterUrl, paymasterBaseUrl } = resolvePepuEndpoints(explicit === undefined ? {} : { paymasterUrl: explicit });\n  if (paymasterUrl !== null) return paymasterUrl;\n  if (token !== undefined && token.trim() !== \"\" && paymasterBaseUrl !== null) {\n    return buildErc7677Url({ baseUrl: paymasterBaseUrl, token });\n  }\n  throw new PepuConfigError(\"CONFIG_MISSING_ENV\", `No ERC-7677 paymaster URL. Set ${PEPU_ENV.paymasterUrl} or pass paymasterUrl / paymasterToken.`, {\n    hint: \"The hosted paymaster (https://paymaster.pepeunchained.com) needs your project's client token: set PEPU_PAYMASTER_URL to https://paymaster.pepeunchained.com/v2/paymaster/<client token>.\",\n  });\n}\n\n/**\n * An ERC-7677 paymaster client for PEPU (viem `createPaymasterClient`), using\n * the endpoints registry for the URL. A `context` (for example\n * `buildPaymasterContext({ privyAccessToken })`) is injected into every\n * `pm_getPaymasterStubData` and `pm_getPaymasterData` call unless the caller\n * passes one.\n *\n * @example\n * const paymaster = createPepuPaymasterClient({\n *   context: buildPaymasterContext({ privyAccessToken }),\n * });\n */\nexport function createPepuPaymasterClient(\n  o: { paymasterUrl?: string; paymasterToken?: string; context?: PaymasterContext } = {},\n): PaymasterClient {\n  const client = createPaymasterClient({ transport: http(requirePaymasterUrl(o.paymasterUrl, o.paymasterToken)) });\n  const ctx = o.context;\n  if (!ctx) return client;\n  return {\n    ...client,\n    getPaymasterData: (p) => client.getPaymasterData({ ...p, context: p.context ?? ctx }),\n    getPaymasterStubData: (p) => client.getPaymasterStubData({ ...p, context: p.context ?? ctx }),\n  };\n}\n\n/**\n * A viem bundler client for PEPU's bundler, with the fee estimator\n * pre-wired ({@link estimatePepuUserOpFees}).\n *\n * @example\n * const bundler = createPepuBundlerClient({ account, paymaster: createPepuPaymasterClient() });\n * const hash = await bundler.sendUserOperation({ calls: [{ to, data }] });\n */\nexport function createPepuBundlerClient(o: {\n  bundlerUrl?: string;\n  account: SmartAccount;\n  paymaster?: PaymasterClient;\n  paymasterContext?: PaymasterContext;\n  publicClient?: PublicClient;\n}): BundlerClient {\n  const rpcUrl = resolvePepuEndpoints().rpcUrl;\n  const publicClient = o.publicClient ?? createPublicClient({ chain: pepuMainnet, transport: http(rpcUrl) });\n  return createBundlerClient({\n    account: o.account,\n    chain: pepuMainnet,\n    client: publicClient,\n    transport: http(requireBundlerUrl(o.bundlerUrl)),\n    ...(o.paymaster ? { paymaster: o.paymaster } : {}),\n    ...(o.paymasterContext ? { paymasterContext: o.paymasterContext } : {}),\n    userOperation: { estimateFeesPerGas: async () => estimatePepuUserOpFees(publicClient) },\n  }) as BundlerClient;\n}\n"]}

package/dist/{chunk-ET3P6TX6.cjs → chunk-RCMKPJZO.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkTIEAZYHF_cjs = require('./chunk-TIEAZYHF.cjs');
+var chunkK7JSQPZO_cjs = require('./chunk-K7JSQPZO.cjs');
 var chunkDPCZJLB3_cjs = require('./chunk-DPCZJLB3.cjs');
 var viem = require('viem');
 
@@ -19,7 +19,7 @@ function buildPaymasterContext(entries = {}) {
   return context;
 }
 function buildParams(options) {
-  const entryPointEntry = chunkTIEAZYHF_cjs.getContract(chunkDPCZJLB3_cjs.pepuMainnet.id, "entryPoint07");
+  const entryPointEntry = chunkK7JSQPZO_cjs.getContract(chunkDPCZJLB3_cjs.pepuMainnet.id, "entryPoint07");
   const entryPoint = options.entryPoint ?? (entryPointEntry?.status === "deployed" ? entryPointEntry.address : void 0);
   if (!entryPoint) throw new Error("buildPaymasterRequest: no EntryPoint v0.7 address available.");
   const chainId = viem.toHex(options.chainId ?? chunkDPCZJLB3_cjs.pepuMainnet.id);
@@ -45,5 +45,5 @@ function buildPaymasterDataRequest(options) {
 exports.buildPaymasterContext = buildPaymasterContext;
 exports.buildPaymasterDataRequest = buildPaymasterDataRequest;
 exports.buildPaymasterStubDataRequest = buildPaymasterStubDataRequest;
-//# sourceMappingURL=chunk-ET3P6TX6.cjs.map
-//# sourceMappingURL=chunk-ET3P6TX6.cjs.map
+//# sourceMappingURL=chunk-RCMKPJZO.cjs.map
+//# sourceMappingURL=chunk-RCMKPJZO.cjs.map

package/dist/{chunk-ET3P6TX6.cjs.map → chunk-RCMKPJZO.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/erc7677.ts"],"names":["getContract","pepuMainnet","toHex"],"mappings":";;;;;;AAkGO,SAAS,qBAAA,CACd,OAAA,GAA6C,EAAC,EAC5B;AAClB,EAAA,MAAM,UAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,OAAO,OAAO,KAAA;AACpB,IAAA,IAAI,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,UAAA,IAAc,SAAS,QAAA,EAAU;AACjE,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,wBAAA,EAA2B,GAAG,CAAA,OAAA,EAAU,IAAI,CAAA,yEAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,GAAG,CAAA,GAAI,KAAA;AAAA,EACjB;AACA,EAAA,OAAO,OAAA;AACT;AAYA,SAAS,YAAY,OAAA,EAA2D;AAC9E,EAAA,MAAM,eAAA,GAAkBA,6BAAA,CAAYC,6BAAA,CAAY,EAAA,EAAI,cAAc,CAAA;AAClE,EAAA,MAAM,aACJ,OAAA,CAAQ,UAAA,KACP,iBAAiB,MAAA,KAAW,UAAA,GAAa,gBAAgB,OAAA,GAAU,MAAA,CAAA;AACtE,EAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAC/F,EAAA,MAAM,OAAA,GAAUC,UAAA,CAAM,OAAA,CAAQ,OAAA,IAAWD,8BAAY,EAAE,CAAA;AACvD,EAAA,OAAO,OAAA,CAAQ,OAAA,GACX,CAAC,OAAA,CAAQ,eAAe,UAAA,EAAY,OAAA,EAAS,OAAA,CAAQ,OAAO,CAAA,GAC5D,CAAC,OAAA,CAAQ,aAAA,EAAe,YAAY,OAAO,CAAA;AACjD;AAGO,SAAS,8BACd,OAAA,EAC0B;AAC1B,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,EAAA,EAAI,QAAQ,EAAA,IAAM,CAAA;AAAA,IAClB,MAAA,EAAQ,yBAAA;AAAA,IACR,MAAA,EAAQ,YAAY,OAAO;AAAA,GAC7B;AACF;AAGO,SAAS,0BACd,OAAA,EACsB;AACtB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,EAAA,EAAI,QAAQ,EAAA,IAAM,CAAA;AAAA,IAClB,MAAA,EAAQ,qBAAA;AAAA,IACR,MAAA,EAAQ,YAAY,OAAO;AAAA,GAC7B;AACF","file":"chunk-ET3P6TX6.cjs","sourcesContent":["import { toHex } from \"viem\";\nimport type { Address, Hex } from \"viem\";\n\nimport { pepuMainnet } from \"./chains.js\";\nimport { getContract } from \"./contracts.js\";\n\n/**\n * ERC-7677 paymaster web-service types, for the two JSON-RPC methods PEPU's\n * paymaster policy service implements: `pm_getPaymasterStubData` and\n * `pm_getPaymasterData`. See https://eips.ethereum.org/EIPS/eip-7677.\n *\n * Pure types plus a few tiny builders: no network, no secrets, safe in a\n * browser bundle. Quantities are `0x`-prefixed hex strings, as on the wire.\n *\n * Note this package never implies sponsorship is available to an app: see\n * `getSponsorshipStatus()`. These types describe the protocol only.\n */\n\n/** An ERC-4337 v0.7 UserOperation in its unpacked JSON-RPC shape. */\nexport interface Erc7677UserOperation {\n  sender: Address;\n  nonce: Hex;\n  factory?: Address;\n  factoryData?: Hex;\n  callData: Hex;\n  callGasLimit: Hex;\n  verificationGasLimit: Hex;\n  preVerificationGas: Hex;\n  maxFeePerGas: Hex;\n  maxPriorityFeePerGas: Hex;\n  paymaster?: Address;\n  paymasterVerificationGasLimit?: Hex;\n  paymasterPostOpGasLimit?: Hex;\n  paymasterData?: Hex;\n  signature: Hex;\n}\n\n/** Paymaster-defined, JSON-serializable context (params[3]). */\nexport type PaymasterContext = Record<string, unknown>;\n\nexport type PaymasterRpcParams = readonly [\n  userOperation: Partial<Erc7677UserOperation> & Pick<Erc7677UserOperation, \"sender\" | \"callData\">,\n  entryPoint: Address,\n  chainId: Hex,\n  context?: PaymasterContext,\n];\n\nexport interface PaymasterStubDataRequest {\n  jsonrpc: \"2.0\";\n  id: number | string;\n  method: \"pm_getPaymasterStubData\";\n  params: PaymasterRpcParams;\n}\n\nexport interface PaymasterDataRequest {\n  jsonrpc: \"2.0\";\n  id: number | string;\n  method: \"pm_getPaymasterData\";\n  params: PaymasterRpcParams;\n}\n\n/** Result of `pm_getPaymasterStubData`. Stub values are for gas estimation only. */\nexport interface PaymasterStubDataResult {\n  paymaster: Address;\n  paymasterData: Hex;\n  paymasterVerificationGasLimit?: Hex;\n  paymasterPostOpGasLimit?: Hex;\n  /** `true` when the stub values are also the final values. */\n  isFinal?: boolean;\n  sponsor?: { name: string; icon?: string };\n}\n\n/** Result of `pm_getPaymasterData`: the signed values to submit. */\nexport interface PaymasterDataResult {\n  paymaster: Address;\n  paymasterData: Hex;\n  paymasterVerificationGasLimit?: Hex;\n  paymasterPostOpGasLimit?: Hex;\n}\n\nexport interface PaymasterRpcError {\n  code: number;\n  message: string;\n  /** PEPU's policy service puts the machine-readable denial reason in `data.reason`. */\n  data?: { reason?: string } & Record<string, unknown>;\n}\n\nexport type PaymasterRpcResponse<TResult> =\n  | { jsonrpc: \"2.0\"; id: number | string | null; result: TResult }\n  | { jsonrpc: \"2.0\"; id: number | string | null; error: PaymasterRpcError };\n\n/**\n * Build a paymaster `context` object: drops `undefined` entries and throws on\n * anything that would not survive `JSON.stringify` (bigint, function, symbol),\n * so a bad value fails here instead of as an opaque RPC error. Returns `{}`\n * for no input. The context is paymaster-defined; PEPU's policy service\n * currently accepts and ignores it.\n */\nexport function buildPaymasterContext(\n  entries: Readonly<Record<string, unknown>> = {},\n): PaymasterContext {\n  const context: PaymasterContext = {};\n  for (const [key, value] of Object.entries(entries)) {\n    if (value === undefined) continue;\n    const kind = typeof value;\n    if (kind === \"bigint\" || kind === \"function\" || kind === \"symbol\") {\n      throw new Error(\n        `buildPaymasterContext: \"${key}\" is a ${kind}, which is not JSON-serializable. Convert it to a string or number first.`,\n      );\n    }\n    context[key] = value;\n  }\n  return context;\n}\n\nexport interface BuildPaymasterRequestOptions {\n  userOperation: PaymasterRpcParams[0];\n  /** Defaults to PEPU mainnet's EntryPoint v0.7. */\n  entryPoint?: Address;\n  /** Defaults to 97741 (PEPU mainnet). */\n  chainId?: number;\n  context?: PaymasterContext;\n  id?: number | string;\n}\n\nfunction buildParams(options: BuildPaymasterRequestOptions): PaymasterRpcParams {\n  const entryPointEntry = getContract(pepuMainnet.id, \"entryPoint07\");\n  const entryPoint =\n    options.entryPoint ??\n    (entryPointEntry?.status === \"deployed\" ? entryPointEntry.address : undefined);\n  if (!entryPoint) throw new Error(\"buildPaymasterRequest: no EntryPoint v0.7 address available.\");\n  const chainId = toHex(options.chainId ?? pepuMainnet.id);\n  return options.context\n    ? [options.userOperation, entryPoint, chainId, options.context]\n    : [options.userOperation, entryPoint, chainId];\n}\n\n/** Build a `pm_getPaymasterStubData` JSON-RPC request body. */\nexport function buildPaymasterStubDataRequest(\n  options: BuildPaymasterRequestOptions,\n): PaymasterStubDataRequest {\n  return {\n    jsonrpc: \"2.0\",\n    id: options.id ?? 1,\n    method: \"pm_getPaymasterStubData\",\n    params: buildParams(options),\n  };\n}\n\n/** Build a `pm_getPaymasterData` JSON-RPC request body. */\nexport function buildPaymasterDataRequest(\n  options: BuildPaymasterRequestOptions,\n): PaymasterDataRequest {\n  return {\n    jsonrpc: \"2.0\",\n    id: options.id ?? 1,\n    method: \"pm_getPaymasterData\",\n    params: buildParams(options),\n  };\n}\n"]}
+{"version":3,"sources":["../src/erc7677.ts"],"names":["getContract","pepuMainnet","toHex"],"mappings":";;;;;;AAkGO,SAAS,qBAAA,CACd,OAAA,GAA6C,EAAC,EAC5B;AAClB,EAAA,MAAM,UAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,OAAO,OAAO,KAAA;AACpB,IAAA,IAAI,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,UAAA,IAAc,SAAS,QAAA,EAAU;AACjE,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,wBAAA,EAA2B,GAAG,CAAA,OAAA,EAAU,IAAI,CAAA,yEAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,GAAG,CAAA,GAAI,KAAA;AAAA,EACjB;AACA,EAAA,OAAO,OAAA;AACT;AAYA,SAAS,YAAY,OAAA,EAA2D;AAC9E,EAAA,MAAM,eAAA,GAAkBA,6BAAA,CAAYC,6BAAA,CAAY,EAAA,EAAI,cAAc,CAAA;AAClE,EAAA,MAAM,aACJ,OAAA,CAAQ,UAAA,KACP,iBAAiB,MAAA,KAAW,UAAA,GAAa,gBAAgB,OAAA,GAAU,MAAA,CAAA;AACtE,EAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAC/F,EAAA,MAAM,OAAA,GAAUC,UAAA,CAAM,OAAA,CAAQ,OAAA,IAAWD,8BAAY,EAAE,CAAA;AACvD,EAAA,OAAO,OAAA,CAAQ,OAAA,GACX,CAAC,OAAA,CAAQ,eAAe,UAAA,EAAY,OAAA,EAAS,OAAA,CAAQ,OAAO,CAAA,GAC5D,CAAC,OAAA,CAAQ,aAAA,EAAe,YAAY,OAAO,CAAA;AACjD;AAGO,SAAS,8BACd,OAAA,EAC0B;AAC1B,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,EAAA,EAAI,QAAQ,EAAA,IAAM,CAAA;AAAA,IAClB,MAAA,EAAQ,yBAAA;AAAA,IACR,MAAA,EAAQ,YAAY,OAAO;AAAA,GAC7B;AACF;AAGO,SAAS,0BACd,OAAA,EACsB;AACtB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,EAAA,EAAI,QAAQ,EAAA,IAAM,CAAA;AAAA,IAClB,MAAA,EAAQ,qBAAA;AAAA,IACR,MAAA,EAAQ,YAAY,OAAO;AAAA,GAC7B;AACF","file":"chunk-RCMKPJZO.cjs","sourcesContent":["import { toHex } from \"viem\";\nimport type { Address, Hex } from \"viem\";\n\nimport { pepuMainnet } from \"./chains.js\";\nimport { getContract } from \"./contracts.js\";\n\n/**\n * ERC-7677 paymaster web-service types, for the two JSON-RPC methods PEPU's\n * paymaster policy service implements: `pm_getPaymasterStubData` and\n * `pm_getPaymasterData`. See https://eips.ethereum.org/EIPS/eip-7677.\n *\n * Pure types plus a few tiny builders: no network, no secrets, safe in a\n * browser bundle. Quantities are `0x`-prefixed hex strings, as on the wire.\n *\n * Note this package never implies sponsorship is available to an app: see\n * `getSponsorshipStatus()`. These types describe the protocol only.\n */\n\n/** An ERC-4337 v0.7 UserOperation in its unpacked JSON-RPC shape. */\nexport interface Erc7677UserOperation {\n  sender: Address;\n  nonce: Hex;\n  factory?: Address;\n  factoryData?: Hex;\n  callData: Hex;\n  callGasLimit: Hex;\n  verificationGasLimit: Hex;\n  preVerificationGas: Hex;\n  maxFeePerGas: Hex;\n  maxPriorityFeePerGas: Hex;\n  paymaster?: Address;\n  paymasterVerificationGasLimit?: Hex;\n  paymasterPostOpGasLimit?: Hex;\n  paymasterData?: Hex;\n  signature: Hex;\n}\n\n/** Paymaster-defined, JSON-serializable context (params[3]). */\nexport type PaymasterContext = Record<string, unknown>;\n\nexport type PaymasterRpcParams = readonly [\n  userOperation: Partial<Erc7677UserOperation> & Pick<Erc7677UserOperation, \"sender\" | \"callData\">,\n  entryPoint: Address,\n  chainId: Hex,\n  context?: PaymasterContext,\n];\n\nexport interface PaymasterStubDataRequest {\n  jsonrpc: \"2.0\";\n  id: number | string;\n  method: \"pm_getPaymasterStubData\";\n  params: PaymasterRpcParams;\n}\n\nexport interface PaymasterDataRequest {\n  jsonrpc: \"2.0\";\n  id: number | string;\n  method: \"pm_getPaymasterData\";\n  params: PaymasterRpcParams;\n}\n\n/** Result of `pm_getPaymasterStubData`. Stub values are for gas estimation only. */\nexport interface PaymasterStubDataResult {\n  paymaster: Address;\n  paymasterData: Hex;\n  paymasterVerificationGasLimit?: Hex;\n  paymasterPostOpGasLimit?: Hex;\n  /** `true` when the stub values are also the final values. */\n  isFinal?: boolean;\n  sponsor?: { name: string; icon?: string };\n}\n\n/** Result of `pm_getPaymasterData`: the signed values to submit. */\nexport interface PaymasterDataResult {\n  paymaster: Address;\n  paymasterData: Hex;\n  paymasterVerificationGasLimit?: Hex;\n  paymasterPostOpGasLimit?: Hex;\n}\n\nexport interface PaymasterRpcError {\n  code: number;\n  message: string;\n  /** PEPU's policy service puts the machine-readable denial reason in `data.reason`. */\n  data?: { reason?: string } & Record<string, unknown>;\n}\n\nexport type PaymasterRpcResponse<TResult> =\n  | { jsonrpc: \"2.0\"; id: number | string | null; result: TResult }\n  | { jsonrpc: \"2.0\"; id: number | string | null; error: PaymasterRpcError };\n\n/**\n * Build a paymaster `context` object: drops `undefined` entries and throws on\n * anything that would not survive `JSON.stringify` (bigint, function, symbol),\n * so a bad value fails here instead of as an opaque RPC error. Returns `{}`\n * for no input. The context is paymaster-defined; PEPU's policy service\n * currently accepts and ignores it.\n */\nexport function buildPaymasterContext(\n  entries: Readonly<Record<string, unknown>> = {},\n): PaymasterContext {\n  const context: PaymasterContext = {};\n  for (const [key, value] of Object.entries(entries)) {\n    if (value === undefined) continue;\n    const kind = typeof value;\n    if (kind === \"bigint\" || kind === \"function\" || kind === \"symbol\") {\n      throw new Error(\n        `buildPaymasterContext: \"${key}\" is a ${kind}, which is not JSON-serializable. Convert it to a string or number first.`,\n      );\n    }\n    context[key] = value;\n  }\n  return context;\n}\n\nexport interface BuildPaymasterRequestOptions {\n  userOperation: PaymasterRpcParams[0];\n  /** Defaults to PEPU mainnet's EntryPoint v0.7. */\n  entryPoint?: Address;\n  /** Defaults to 97741 (PEPU mainnet). */\n  chainId?: number;\n  context?: PaymasterContext;\n  id?: number | string;\n}\n\nfunction buildParams(options: BuildPaymasterRequestOptions): PaymasterRpcParams {\n  const entryPointEntry = getContract(pepuMainnet.id, \"entryPoint07\");\n  const entryPoint =\n    options.entryPoint ??\n    (entryPointEntry?.status === \"deployed\" ? entryPointEntry.address : undefined);\n  if (!entryPoint) throw new Error(\"buildPaymasterRequest: no EntryPoint v0.7 address available.\");\n  const chainId = toHex(options.chainId ?? pepuMainnet.id);\n  return options.context\n    ? [options.userOperation, entryPoint, chainId, options.context]\n    : [options.userOperation, entryPoint, chainId];\n}\n\n/** Build a `pm_getPaymasterStubData` JSON-RPC request body. */\nexport function buildPaymasterStubDataRequest(\n  options: BuildPaymasterRequestOptions,\n): PaymasterStubDataRequest {\n  return {\n    jsonrpc: \"2.0\",\n    id: options.id ?? 1,\n    method: \"pm_getPaymasterStubData\",\n    params: buildParams(options),\n  };\n}\n\n/** Build a `pm_getPaymasterData` JSON-RPC request body. */\nexport function buildPaymasterDataRequest(\n  options: BuildPaymasterRequestOptions,\n): PaymasterDataRequest {\n  return {\n    jsonrpc: \"2.0\",\n    id: options.id ?? 1,\n    method: \"pm_getPaymasterData\",\n    params: buildParams(options),\n  };\n}\n"]}

package/dist/chunk-RSPAN44L.js

@@ -0,0 +1,276 @@
+import { paymasterReasonToError, mapPaymasterReason } from './chunk-GIZNH65Q.js';
+import { PEPU_HOSTED, resolvePepuEndpoints } from './chunk-XC4IBCI2.js';
+import { pepuMainnet } from './chunk-VTQIHMF3.js';
+import { PepuConfigError, PepuPaymasterError } from './chunk-6DSZ4Z2N.js';
+import { createSiweMessage } from 'viem/siwe';
+import { isAddress, toHex } from 'viem';
+
+var CLIENT_TOKEN_PREFIX = "ppt_";
+var SERVER_KEY_PREFIX = "ppk_";
+function credentialKind(credential) {
+  if (credential.startsWith(CLIENT_TOKEN_PREFIX)) return "client";
+  if (credential.startsWith(SERVER_KEY_PREFIX)) return "server";
+  return null;
+}
+function trimBase(url) {
+  return url.replace(/\/+$/, "");
+}
+function buildErc7677Url(options) {
+  const token = options.token.trim();
+  if (token === "") {
+    throw new PepuConfigError("CONFIG_MISSING_ENV", "buildErc7677Url needs a project client token or server key.");
+  }
+  if (credentialKind(token) === "server" && globalThis.window !== void 0) {
+    throw new PepuConfigError(
+      "CONFIG_SERVER_ONLY",
+      "Refusing to build an ERC-7677 URL from a server key (ppk_) in a browser: the URL embeds the secret. Use the client token (ppt_)."
+    );
+  }
+  let base;
+  try {
+    base = new URL(options.baseUrl);
+  } catch {
+    throw new PepuConfigError("CONFIG_BAD_URL", "buildErc7677Url: baseUrl is not a valid URL.");
+  }
+  if (base.protocol !== "http:" && base.protocol !== "https:") {
+    throw new PepuConfigError("CONFIG_BAD_URL", "buildErc7677Url: baseUrl must be an http(s) URL.");
+  }
+  const prefix = (options.version ?? 2) === 2 ? "/v2/paymaster/" : "/paymaster/";
+  return `${trimBase(options.baseUrl)}${prefix}${encodeURIComponent(token)}`;
+}
+function hostedErc7677Url(token) {
+  if (PEPU_HOSTED.paymasterBaseUrl === null) {
+    throw new PepuConfigError("CONFIG_MISSING_ENV", "No hosted paymaster base URL is set.");
+  }
+  return buildErc7677Url({ baseUrl: PEPU_HOSTED.paymasterBaseUrl, token });
+}
+function toQuantity(v) {
+  return typeof v === "bigint" ? toHex(v) : v;
+}
+function serializeUserOp(op) {
+  const out = {
+    sender: op.sender,
+    nonce: toQuantity(op.nonce),
+    callData: op.callData,
+    callGasLimit: toQuantity(op.callGasLimit),
+    verificationGasLimit: toQuantity(op.verificationGasLimit),
+    preVerificationGas: toQuantity(op.preVerificationGas),
+    maxFeePerGas: toQuantity(op.maxFeePerGas),
+    maxPriorityFeePerGas: toQuantity(op.maxPriorityFeePerGas)
+  };
+  if (op.factory !== void 0) out["factory"] = op.factory;
+  if (op.factoryData !== void 0) out["factoryData"] = op.factoryData;
+  return out;
+}
+function assertApproved(result) {
+  if (result.status === "approved") return result;
+  throw paymasterReasonToError(result.reason, result.message, result.detail ? { detail: result.detail } : void 0);
+}
+function retryAfter(res) {
+  const raw = res.headers.get("retry-after");
+  const n = raw === null ? NaN : Number(raw);
+  return Number.isFinite(n) ? n : void 0;
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function missingBaseUrl() {
+  return new PepuConfigError(
+    "CONFIG_MISSING_ENV",
+    "No paymaster URL configured. Set PEPU_PAYMASTER_URL (or NEXT_PUBLIC_PEPU_PAYMASTER_URL), or pass baseUrl to createPaymasterApi."
+  );
+}
+function createPaymasterApi(options = {}) {
+  const resolved = options.baseUrl ?? resolvePepuEndpoints(options.env ? { env: options.env } : {}).paymasterBaseUrl;
+  if (resolved === null || resolved === void 0 || resolved.trim() === "") throw missingBaseUrl();
+  try {
+    const u = new URL(resolved);
+    if (u.protocol !== "http:" && u.protocol !== "https:") throw new Error("protocol");
+  } catch {
+    throw new PepuConfigError("CONFIG_BAD_URL", "The paymaster baseUrl is not a valid http(s) URL.");
+  }
+  const baseUrl = trimBase(resolved.trim());
+  const doFetch = options.fetch ?? ((...args) => fetch(...args));
+  const timeoutMs = options.timeoutMs ?? 15e3;
+  let sessionToken = options.sessionToken ?? null;
+  async function send(url, init) {
+    try {
+      return await doFetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+    } catch (e) {
+      const timedOut = e instanceof Error && (e.name === "TimeoutError" || e.name === "AbortError");
+      throw new PepuPaymasterError(
+        "BUNDLER_UNREACHABLE",
+        timedOut ? "The paymaster did not answer in time." : "Could not reach the paymaster service.",
+        { details: { path: new URL(url).pathname.replace(/\/(ppt_|ppk_)[^/]*/, "/<credential>") } }
+      );
+    }
+  }
+  async function readJson(res) {
+    const text = await res.text().catch(() => "");
+    if (text === "") return void 0;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return void 0;
+    }
+  }
+  function apiError(res, body, quiet) {
+    const rec = isRecord(body) ? body : {};
+    const errorCode = typeof rec["error"] === "string" ? rec["error"] : void 0;
+    const reason = typeof rec["reason"] === "string" ? rec["reason"] : void 0;
+    const serverMessage = typeof rec["message"] === "string" && !quiet ? rec["message"] : void 0;
+    const details = { status: res.status, error: errorCode, reason, retryAfterSeconds: retryAfter(res) };
+    const tagged = reason ?? errorCode;
+    let code;
+    if (res.status === 401 && errorCode === "unauthenticated") code = "PAYMASTER_SESSION_REQUIRED";
+    else if (tagged !== void 0 && mapPaymasterReason(tagged) !== "PAYMASTER_DENIED") code = mapPaymasterReason(tagged);
+    else if (res.status === 401 && errorCode !== "login_failed") code = "PAYMASTER_SESSION_REQUIRED";
+    else if (res.status === 401) code = "PAYMASTER_DENIED";
+    else if (res.status === 429) code = "PAYMASTER_RATE_LIMITED";
+    else if (res.status === 403) code = "PAYMASTER_DENIED";
+    else code = "PAYMASTER_API_ERROR";
+    const label = `Paymaster API ${res.status}${errorCode ? ` ${errorCode}` : ""}${reason && reason !== errorCode ? ` (${reason})` : ""}`;
+    return new PepuPaymasterError(code, serverMessage ? `${label}: ${serverMessage}` : `${label}.`, {
+      details,
+      ...res.status === 429 || res.status === 503 ? { retryable: true } : {}
+    });
+  }
+  async function request(method, path, o = {}) {
+    const headers = { accept: "application/json" };
+    if (o.body !== void 0) headers["content-type"] = "application/json";
+    if (o.session) {
+      if (!sessionToken) {
+        throw new PepuPaymasterError("PAYMASTER_SESSION_REQUIRED", "This call needs a SIWE session. Call loginWithWallet() first.");
+      }
+      headers["authorization"] = `Bearer ${sessionToken}`;
+    }
+    let url = `${baseUrl}${path}`;
+    if (o.query) {
+      const qs = new URLSearchParams();
+      for (const [k, v] of Object.entries(o.query)) if (v !== void 0) qs.set(k, String(v));
+      const s = qs.toString();
+      if (s) url += `?${s}`;
+    }
+    const res = await send(url, { method, headers, ...o.body !== void 0 ? { body: JSON.stringify(o.body) } : {} });
+    const body = await readJson(res);
+    if (!res.ok) throw apiError(res, body, o.quietErrors === true);
+    return body;
+  }
+  async function sponsor(path, userOp, auth) {
+    if (!auth.apiKey) {
+      throw new PepuConfigError("CONFIG_MISSING_ENV", "sponsor needs auth.apiKey (the project server key or client token).");
+    }
+    const headers = {
+      accept: "application/json",
+      "content-type": "application/json",
+      "x-api-key": auth.apiKey
+    };
+    if (auth.privyAccessToken) headers["authorization"] = `Bearer ${auth.privyAccessToken}`;
+    if (auth.origin) headers["origin"] = auth.origin;
+    const res = await send(`${baseUrl}${path}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ userOp: serializeUserOp(userOp) })
+    });
+    const body = await readJson(res);
+    if (isRecord(body) && (body["status"] === "approved" || body["status"] === "denied")) {
+      return body;
+    }
+    throw apiError(res, body, false);
+  }
+  const projectPath = (id, sub = "") => {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(id)) {
+      throw new PepuPaymasterError("PAYMASTER_DENIED", "projectId must be a 0x-prefixed 32-byte hex string.");
+    }
+    return `/v2/projects/${id}${sub}`;
+  };
+  const v1 = {
+    sponsor: async (userOp, auth) => {
+      if (!auth.privyAccessToken) {
+        throw new PepuPaymasterError(
+          "PAYMASTER_IDENTITY_REQUIRED",
+          "The v1 /sponsor endpoint requires the user's Privy access token (auth.privyAccessToken)."
+        );
+      }
+      return sponsor("/sponsor", userOp, auth);
+    },
+    health: async () => {
+      const res = await send(`${baseUrl}/health`, { method: "GET" });
+      const body = await readJson(res);
+      if (!res.ok) throw apiError(res, body, false);
+      return isRecord(body) ? body : { status: "ok" };
+    },
+    erc7677Url: (token) => buildErc7677Url({ baseUrl, token, version: 1 })
+  };
+  const v2 = {
+    sponsor: (userOp, auth) => sponsor("/v2/sponsor", userOp, auth),
+    erc7677Url: (token) => buildErc7677Url({ baseUrl, token, version: 2 }),
+    config: () => request("GET", "/v2/config"),
+    contract: () => request("GET", "/v2/contract"),
+    freeTier: () => request("GET", "/v2/free-tier"),
+    auth: {
+      nonce: () => request("GET", "/v2/auth/nonce"),
+      login: async (message, signature) => {
+        const r = await request("POST", "/v2/auth/login", { body: { message, signature } });
+        sessionToken = r.token;
+        return r;
+      },
+      logout: async () => {
+        await request("POST", "/v2/auth/logout", { session: true });
+        sessionToken = null;
+      }
+    },
+    me: () => request("GET", "/v2/me", { session: true }),
+    loginWithWallet: async (sign, o) => {
+      if (!isAddress(o.address, { strict: false })) {
+        throw new PepuPaymasterError("PAYMASTER_DENIED", "loginWithWallet: address is not a valid address.");
+      }
+      const { nonce } = await v2.auth.nonce();
+      const now = (o.now ?? Date.now)();
+      const message = createSiweMessage({
+        address: o.address,
+        chainId: o.chainId ?? pepuMainnet.id,
+        domain: o.domain,
+        nonce,
+        uri: o.uri ?? `https://${o.domain}`,
+        version: "1",
+        statement: o.statement ?? "Sign in to manage your PEPU gas sponsorship project. This does not move any funds.",
+        issuedAt: new Date(now),
+        expirationTime: new Date(now + (o.lifetimeSeconds ?? 300) * 1e3)
+      });
+      const signature = await sign(message);
+      return v2.auth.login(message, signature);
+    },
+    getSessionToken: () => sessionToken,
+    setSessionToken: (t) => {
+      sessionToken = t;
+    },
+    projects: {
+      prepare: (body) => request("POST", "/v2/projects/prepare", { session: true, body }),
+      register: (body) => request("POST", "/v2/projects", { session: true, body }),
+      list: () => request("GET", "/v2/projects", { session: true }),
+      get: async (id) => request("GET", projectPath(id), { session: true }),
+      rotateClientToken: async (id) => request("POST", projectPath(id, "/token/rotate"), { session: true }),
+      rotateServerKey: async (id) => request("POST", projectPath(id, "/server-key/rotate"), { session: true }),
+      updateSettings: async (id, body) => request("PATCH", projectPath(id, "/settings"), { session: true, body }),
+      usage: async (id, q = {}) => request("GET", projectPath(id, "/usage"), { session: true, query: { ...q } }),
+      events: async (id, q = {}) => request("GET", projectPath(id, "/events"), { session: true, query: { ...q } }),
+      allowlist: async (id) => request("GET", projectPath(id, "/allowlist"), { session: true })
+    },
+    request
+  };
+  return { baseUrl, v1, v2 };
+}
+function serializeAttestation(a) {
+  return {
+    appId: a.appId,
+    newOwner: a.newOwner,
+    nonce: a.nonce.toString(),
+    deadline: a.deadline.toString(),
+    signature: a.signature
+  };
+}
+
+export { assertApproved, buildErc7677Url, createPaymasterApi, credentialKind, hostedErc7677Url, serializeAttestation };
+//# sourceMappingURL=chunk-RSPAN44L.js.map
+//# sourceMappingURL=chunk-RSPAN44L.js.map