@pepu-chain/sdk 0.2.1 → 0.2.2

package/dist/chunk-4GEC7GUU.cjs

@@ -0,0 +1,283 @@
+'use strict';
+
+var chunk65Y5UCQ7_cjs = require('./chunk-65Y5UCQ7.cjs');
+var chunkVF3D6KLQ_cjs = require('./chunk-VF3D6KLQ.cjs');
+var chunkDPCZJLB3_cjs = require('./chunk-DPCZJLB3.cjs');
+var chunkYQL7NISX_cjs = require('./chunk-YQL7NISX.cjs');
+var siwe = require('viem/siwe');
+var viem = require('viem');
+
+var CLIENT_TOKEN_PREFIX = "ppt_";
+var SERVER_KEY_PREFIX = "ppk_";
+function credentialKind(credential) {
+  if (credential.startsWith(CLIENT_TOKEN_PREFIX)) return "client";
+  if (credential.startsWith(SERVER_KEY_PREFIX)) return "server";
+  return null;
+}
+function trimBase(url) {
+  return url.replace(/\/+$/, "");
+}
+function buildErc7677Url(options) {
+  const token = options.token.trim();
+  if (token === "") {
+    throw new chunkYQL7NISX_cjs.PepuConfigError("CONFIG_MISSING_ENV", "buildErc7677Url needs a project client token or server key.");
+  }
+  if (credentialKind(token) === "server" && globalThis.window !== void 0) {
+    throw new chunkYQL7NISX_cjs.PepuConfigError(
+      "CONFIG_SERVER_ONLY",
+      "Refusing to build an ERC-7677 URL from a server key (ppk_) in a browser: the URL embeds the secret. Use the client token (ppt_)."
+    );
+  }
+  let base;
+  try {
+    base = new URL(options.baseUrl);
+  } catch {
+    throw new chunkYQL7NISX_cjs.PepuConfigError("CONFIG_BAD_URL", "buildErc7677Url: baseUrl is not a valid URL.");
+  }
+  if (base.protocol !== "http:" && base.protocol !== "https:") {
+    throw new chunkYQL7NISX_cjs.PepuConfigError("CONFIG_BAD_URL", "buildErc7677Url: baseUrl must be an http(s) URL.");
+  }
+  const prefix = (options.version ?? 2) === 2 ? "/v2/paymaster/" : "/paymaster/";
+  return `${trimBase(options.baseUrl)}${prefix}${encodeURIComponent(token)}`;
+}
+function hostedErc7677Url(token) {
+  if (chunkVF3D6KLQ_cjs.PEPU_HOSTED.paymasterBaseUrl === null) {
+    throw new chunkYQL7NISX_cjs.PepuConfigError("CONFIG_MISSING_ENV", "No hosted paymaster base URL is set.");
+  }
+  return buildErc7677Url({ baseUrl: chunkVF3D6KLQ_cjs.PEPU_HOSTED.paymasterBaseUrl, token });
+}
+function toQuantity(v) {
+  return typeof v === "bigint" ? viem.toHex(v) : v;
+}
+function serializeUserOp(op) {
+  const out = {
+    sender: op.sender,
+    nonce: toQuantity(op.nonce),
+    callData: op.callData,
+    callGasLimit: toQuantity(op.callGasLimit),
+    verificationGasLimit: toQuantity(op.verificationGasLimit),
+    preVerificationGas: toQuantity(op.preVerificationGas),
+    maxFeePerGas: toQuantity(op.maxFeePerGas),
+    maxPriorityFeePerGas: toQuantity(op.maxPriorityFeePerGas)
+  };
+  if (op.factory !== void 0) out["factory"] = op.factory;
+  if (op.factoryData !== void 0) out["factoryData"] = op.factoryData;
+  return out;
+}
+function assertApproved(result) {
+  if (result.status === "approved") return result;
+  throw chunk65Y5UCQ7_cjs.paymasterReasonToError(result.reason, result.message, result.detail ? { detail: result.detail } : void 0);
+}
+function retryAfter(res) {
+  const raw = res.headers.get("retry-after");
+  const n = raw === null ? NaN : Number(raw);
+  return Number.isFinite(n) ? n : void 0;
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function missingBaseUrl() {
+  return new chunkYQL7NISX_cjs.PepuConfigError(
+    "CONFIG_MISSING_ENV",
+    "No paymaster URL configured. Set PEPU_PAYMASTER_URL (or NEXT_PUBLIC_PEPU_PAYMASTER_URL), or pass baseUrl to createPaymasterApi."
+  );
+}
+function createPaymasterApi(options = {}) {
+  const resolved = options.baseUrl ?? chunkVF3D6KLQ_cjs.resolvePepuEndpoints(options.env ? { env: options.env } : {}).paymasterBaseUrl;
+  if (resolved === null || resolved === void 0 || resolved.trim() === "") throw missingBaseUrl();
+  try {
+    const u = new URL(resolved);
+    if (u.protocol !== "http:" && u.protocol !== "https:") throw new Error("protocol");
+  } catch {
+    throw new chunkYQL7NISX_cjs.PepuConfigError("CONFIG_BAD_URL", "The paymaster baseUrl is not a valid http(s) URL.");
+  }
+  const baseUrl = trimBase(resolved.trim());
+  const doFetch = options.fetch ?? ((...args) => fetch(...args));
+  const timeoutMs = options.timeoutMs ?? 15e3;
+  let sessionToken = options.sessionToken ?? null;
+  async function send(url, init) {
+    try {
+      return await doFetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+    } catch (e) {
+      const timedOut = e instanceof Error && (e.name === "TimeoutError" || e.name === "AbortError");
+      throw new chunkYQL7NISX_cjs.PepuPaymasterError(
+        "BUNDLER_UNREACHABLE",
+        timedOut ? "The paymaster did not answer in time." : "Could not reach the paymaster service.",
+        { details: { path: new URL(url).pathname.replace(/\/(ppt_|ppk_)[^/]*/, "/<credential>") } }
+      );
+    }
+  }
+  async function readJson(res) {
+    const text = await res.text().catch(() => "");
+    if (text === "") return void 0;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return void 0;
+    }
+  }
+  function apiError(res, body, quiet) {
+    const rec = isRecord(body) ? body : {};
+    const errorCode = typeof rec["error"] === "string" ? rec["error"] : void 0;
+    const reason = typeof rec["reason"] === "string" ? rec["reason"] : void 0;
+    const serverMessage = typeof rec["message"] === "string" && !quiet ? rec["message"] : void 0;
+    const details = { status: res.status, error: errorCode, reason, retryAfterSeconds: retryAfter(res) };
+    const tagged = reason ?? errorCode;
+    let code;
+    if (res.status === 401 && errorCode === "unauthenticated") code = "PAYMASTER_SESSION_REQUIRED";
+    else if (tagged !== void 0 && chunk65Y5UCQ7_cjs.mapPaymasterReason(tagged) !== "PAYMASTER_DENIED") code = chunk65Y5UCQ7_cjs.mapPaymasterReason(tagged);
+    else if (res.status === 401 && errorCode !== "login_failed") code = "PAYMASTER_SESSION_REQUIRED";
+    else if (res.status === 401) code = "PAYMASTER_DENIED";
+    else if (res.status === 429) code = "PAYMASTER_RATE_LIMITED";
+    else if (res.status === 403) code = "PAYMASTER_DENIED";
+    else code = "PAYMASTER_API_ERROR";
+    const label = `Paymaster API ${res.status}${errorCode ? ` ${errorCode}` : ""}${reason && reason !== errorCode ? ` (${reason})` : ""}`;
+    return new chunkYQL7NISX_cjs.PepuPaymasterError(code, serverMessage ? `${label}: ${serverMessage}` : `${label}.`, {
+      details,
+      ...res.status === 429 || res.status === 503 ? { retryable: true } : {}
+    });
+  }
+  async function request(method, path, o = {}) {
+    const headers = { accept: "application/json" };
+    if (o.body !== void 0) headers["content-type"] = "application/json";
+    if (o.session) {
+      if (!sessionToken) {
+        throw new chunkYQL7NISX_cjs.PepuPaymasterError("PAYMASTER_SESSION_REQUIRED", "This call needs a SIWE session. Call loginWithWallet() first.");
+      }
+      headers["authorization"] = `Bearer ${sessionToken}`;
+    }
+    let url = `${baseUrl}${path}`;
+    if (o.query) {
+      const qs = new URLSearchParams();
+      for (const [k, v] of Object.entries(o.query)) if (v !== void 0) qs.set(k, String(v));
+      const s = qs.toString();
+      if (s) url += `?${s}`;
+    }
+    const res = await send(url, { method, headers, ...o.body !== void 0 ? { body: JSON.stringify(o.body) } : {} });
+    const body = await readJson(res);
+    if (!res.ok) throw apiError(res, body, o.quietErrors === true);
+    return body;
+  }
+  async function sponsor(path, userOp, auth) {
+    if (!auth.apiKey) {
+      throw new chunkYQL7NISX_cjs.PepuConfigError("CONFIG_MISSING_ENV", "sponsor needs auth.apiKey (the project server key or client token).");
+    }
+    const headers = {
+      accept: "application/json",
+      "content-type": "application/json",
+      "x-api-key": auth.apiKey
+    };
+    if (auth.privyAccessToken) headers["authorization"] = `Bearer ${auth.privyAccessToken}`;
+    if (auth.origin) headers["origin"] = auth.origin;
+    const res = await send(`${baseUrl}${path}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ userOp: serializeUserOp(userOp) })
+    });
+    const body = await readJson(res);
+    if (isRecord(body) && (body["status"] === "approved" || body["status"] === "denied")) {
+      return body;
+    }
+    throw apiError(res, body, false);
+  }
+  const projectPath = (id, sub = "") => {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(id)) {
+      throw new chunkYQL7NISX_cjs.PepuPaymasterError("PAYMASTER_DENIED", "projectId must be a 0x-prefixed 32-byte hex string.");
+    }
+    return `/v2/projects/${id}${sub}`;
+  };
+  const v1 = {
+    sponsor: async (userOp, auth) => {
+      if (!auth.privyAccessToken) {
+        throw new chunkYQL7NISX_cjs.PepuPaymasterError(
+          "PAYMASTER_IDENTITY_REQUIRED",
+          "The v1 /sponsor endpoint requires the user's Privy access token (auth.privyAccessToken)."
+        );
+      }
+      return sponsor("/sponsor", userOp, auth);
+    },
+    health: async () => {
+      const res = await send(`${baseUrl}/health`, { method: "GET" });
+      const body = await readJson(res);
+      if (!res.ok) throw apiError(res, body, false);
+      return isRecord(body) ? body : { status: "ok" };
+    },
+    erc7677Url: (token) => buildErc7677Url({ baseUrl, token, version: 1 })
+  };
+  const v2 = {
+    sponsor: (userOp, auth) => sponsor("/v2/sponsor", userOp, auth),
+    erc7677Url: (token) => buildErc7677Url({ baseUrl, token, version: 2 }),
+    config: () => request("GET", "/v2/config"),
+    contract: () => request("GET", "/v2/contract"),
+    freeTier: () => request("GET", "/v2/free-tier"),
+    auth: {
+      nonce: () => request("GET", "/v2/auth/nonce"),
+      login: async (message, signature) => {
+        const r = await request("POST", "/v2/auth/login", { body: { message, signature } });
+        sessionToken = r.token;
+        return r;
+      },
+      logout: async () => {
+        await request("POST", "/v2/auth/logout", { session: true });
+        sessionToken = null;
+      }
+    },
+    me: () => request("GET", "/v2/me", { session: true }),
+    loginWithWallet: async (sign, o) => {
+      if (!viem.isAddress(o.address, { strict: false })) {
+        throw new chunkYQL7NISX_cjs.PepuPaymasterError("PAYMASTER_DENIED", "loginWithWallet: address is not a valid address.");
+      }
+      const { nonce } = await v2.auth.nonce();
+      const now = (o.now ?? Date.now)();
+      const message = siwe.createSiweMessage({
+        address: o.address,
+        chainId: o.chainId ?? chunkDPCZJLB3_cjs.pepuMainnet.id,
+        domain: o.domain,
+        nonce,
+        uri: o.uri ?? `https://${o.domain}`,
+        version: "1",
+        statement: o.statement ?? "Sign in to manage your PEPU gas sponsorship project. This does not move any funds.",
+        issuedAt: new Date(now),
+        expirationTime: new Date(now + (o.lifetimeSeconds ?? 300) * 1e3)
+      });
+      const signature = await sign(message);
+      return v2.auth.login(message, signature);
+    },
+    getSessionToken: () => sessionToken,
+    setSessionToken: (t) => {
+      sessionToken = t;
+    },
+    projects: {
+      prepare: (body) => request("POST", "/v2/projects/prepare", { session: true, body }),
+      register: (body) => request("POST", "/v2/projects", { session: true, body }),
+      list: () => request("GET", "/v2/projects", { session: true }),
+      get: async (id) => request("GET", projectPath(id), { session: true }),
+      rotateClientToken: async (id) => request("POST", projectPath(id, "/token/rotate"), { session: true }),
+      rotateServerKey: async (id) => request("POST", projectPath(id, "/server-key/rotate"), { session: true }),
+      updateSettings: async (id, body) => request("PATCH", projectPath(id, "/settings"), { session: true, body }),
+      usage: async (id, q = {}) => request("GET", projectPath(id, "/usage"), { session: true, query: { ...q } }),
+      events: async (id, q = {}) => request("GET", projectPath(id, "/events"), { session: true, query: { ...q } }),
+      allowlist: async (id) => request("GET", projectPath(id, "/allowlist"), { session: true })
+    },
+    request
+  };
+  return { baseUrl, v1, v2 };
+}
+function serializeAttestation(a) {
+  return {
+    appId: a.appId,
+    newOwner: a.newOwner,
+    nonce: a.nonce.toString(),
+    deadline: a.deadline.toString(),
+    signature: a.signature
+  };
+}
+
+exports.assertApproved = assertApproved;
+exports.buildErc7677Url = buildErc7677Url;
+exports.createPaymasterApi = createPaymasterApi;
+exports.credentialKind = credentialKind;
+exports.hostedErc7677Url = hostedErc7677Url;
+exports.serializeAttestation = serializeAttestation;
+//# sourceMappingURL=chunk-4GEC7GUU.cjs.map
+//# sourceMappingURL=chunk-4GEC7GUU.cjs.map

package/dist/chunk-4GEC7GUU.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/paymaster/api.ts"],"names":["PepuConfigError","PEPU_HOSTED","toHex","paymasterReasonToError","resolvePepuEndpoints","PepuPaymasterError","mapPaymasterReason","isAddress","createSiweMessage","pepuMainnet"],"mappings":";;;;;;;;;AA8RA,IAAM,mBAAA,GAAsB,MAAA;AAC5B,IAAM,iBAAA,GAAoB,MAAA;AAGnB,SAAS,eAAe,UAAA,EAAgD;AAC7E,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,mBAAmB,CAAA,EAAG,OAAO,QAAA;AACvD,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,iBAAiB,CAAA,EAAG,OAAO,QAAA;AACrD,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,SAAS,GAAA,EAAqB;AACrC,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC/B;AAqBO,SAAS,gBAAgB,OAAA,EAAyC;AACvE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,IAAA,EAAK;AACjC,EAAA,IAAI,UAAU,EAAA,EAAI;AAChB,IAAA,MAAM,IAAIA,iCAAA,CAAgB,oBAAA,EAAsB,6DAA6D,CAAA;AAAA,EAC/G;AACA,EAAA,IAAI,eAAe,KAAK,CAAA,KAAM,QAAA,IAAa,UAAA,CAAoC,WAAW,MAAA,EAAW;AACnG,IAAA,MAAM,IAAIA,iCAAA;AAAA,MACR,oBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAO,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,iCAAA,CAAgB,gBAAA,EAAkB,8CAA8C,CAAA;AAAA,EAC5F;AACA,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,OAAA,IAAW,IAAA,CAAK,aAAa,QAAA,EAAU;AAC3D,IAAA,MAAM,IAAIA,iCAAA,CAAgB,gBAAA,EAAkB,kDAAkD,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,MAAA,GAAA,CAAU,OAAA,CAAQ,OAAA,IAAW,CAAA,MAAO,IAAI,gBAAA,GAAmB,aAAA;AACjE,EAAA,OAAO,CAAA,EAAG,QAAA,CAAS,OAAA,CAAQ,OAAO,CAAC,GAAG,MAAM,CAAA,EAAG,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAC1E;AAUO,SAAS,iBAAiB,KAAA,EAAuB;AACtD,EAAA,IAAIC,6BAAA,CAAY,qBAAqB,IAAA,EAAM;AACzC,IAAA,MAAM,IAAID,iCAAA,CAAgB,oBAAA,EAAsB,sCAAsC,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,gBAAgB,EAAE,OAAA,EAASC,6BAAA,CAAY,gBAAA,EAAkB,OAAO,CAAA;AACzE;AAEA,SAAS,WAAW,CAAA,EAAkB;AACpC,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAWC,UAAA,CAAM,CAAC,CAAA,GAAI,CAAA;AAC5C;AAEA,SAAS,gBAAgB,EAAA,EAA2C;AAClE,EAAA,MAAM,GAAA,GAA8B;AAAA,IAClC,QAAQ,EAAA,CAAG,MAAA;AAAA,IACX,KAAA,EAAO,UAAA,CAAW,EAAA,CAAG,KAAK,CAAA;AAAA,IAC1B,UAAU,EAAA,CAAG,QAAA;AAAA,IACb,YAAA,EAAc,UAAA,CAAW,EAAA,CAAG,YAAY,CAAA;AAAA,IACxC,oBAAA,EAAsB,UAAA,CAAW,EAAA,CAAG,oBAAoB,CAAA;AAAA,IACxD,kBAAA,EAAoB,UAAA,CAAW,EAAA,CAAG,kBAAkB,CAAA;AAAA,IACpD,YAAA,EAAc,UAAA,CAAW,EAAA,CAAG,YAAY,CAAA;AAAA,IACxC,oBAAA,EAAsB,UAAA,CAAW,EAAA,CAAG,oBAAoB;AAAA,GAC1D;AACA,EAAA,IAAI,GAAG,OAAA,KAAY,MAAA,EAAW,GAAA,CAAI,SAAS,IAAI,EAAA,CAAG,OAAA;AAClD,EAAA,IAAI,GAAG,WAAA,KAAgB,MAAA,EAAW,GAAA,CAAI,aAAa,IAAI,EAAA,CAAG,WAAA;AAC1D,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,eAAe,MAAA,EAAwC;AACrE,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,UAAA,EAAY,OAAO,MAAA;AACzC,EAAA,MAAMC,wCAAA,CAAuB,MAAA,CAAO,MAAA,EAAQ,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,MAAA,GAAS,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAO,GAAI,MAAS,CAAA;AACnH;AAGA,SAAS,WAAW,GAAA,EAAmC;AACrD,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACzC,EAAA,MAAM,CAAA,GAAI,GAAA,KAAQ,IAAA,GAAO,GAAA,GAAM,OAAO,GAAG,CAAA;AACzC,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,MAAA;AAClC;AAEA,SAAS,SAAS,CAAA,EAA0C;AAC1D,EAAA,OAAO,OAAO,MAAM,QAAA,IAAY,CAAA,KAAM,QAAQ,CAAC,KAAA,CAAM,QAAQ,CAAC,CAAA;AAChE;AAEA,SAAS,cAAA,GAAkC;AACzC,EAAA,OAAO,IAAIH,iCAAA;AAAA,IACT,oBAAA;AAAA,IACA;AAAA,GACF;AACF;AAiBO,SAAS,kBAAA,CAAmB,OAAA,GAAqC,EAAC,EAAiB;AACxF,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,IAAWI,sCAAA,CAAqB,OAAA,CAAQ,GAAA,GAAM,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAI,GAAI,EAAE,CAAA,CAAE,gBAAA;AAClG,EAAA,IAAI,QAAA,KAAa,QAAQ,QAAA,KAAa,MAAA,IAAa,SAAS,IAAA,EAAK,KAAM,EAAA,EAAI,MAAM,cAAA,EAAe;AAChG,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,QAAQ,CAAA;AAC1B,IAAA,IAAI,CAAA,CAAE,aAAa,OAAA,IAAW,CAAA,CAAE,aAAa,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,UAAU,CAAA;AAAA,EACnF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIJ,iCAAA,CAAgB,gBAAA,EAAkB,mDAAmD,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,QAAA,CAAS,IAAA,EAAM,CAAA;AACxC,EAAA,MAAM,UAAU,OAAA,CAAQ,KAAA,KAAU,IAAI,IAAA,KAAmC,KAAA,CAAM,GAAG,IAAI,CAAA,CAAA;AACtF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACvC,EAAA,IAAI,YAAA,GAA8B,QAAQ,YAAA,IAAgB,IAAA;AAG1D,EAAA,eAAe,IAAA,CAAK,KAAa,IAAA,EAAsC;AACrE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,OAAA,CAAQ,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,EAAG,CAAA;AAAA,IAC/E,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,WAAW,CAAA,YAAa,KAAA,KAAU,EAAE,IAAA,KAAS,cAAA,IAAkB,EAAE,IAAA,KAAS,YAAA,CAAA;AAChF,MAAA,MAAM,IAAIK,oCAAA;AAAA,QACR,qBAAA;AAAA,QACA,WAAW,uCAAA,GAA0C,wCAAA;AAAA,QACrD,EAAE,OAAA,EAAS,EAAE,IAAA,EAAM,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,CAAS,OAAA,CAAQ,oBAAA,EAAsB,eAAe,GAAE;AAAE,OAC5F;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,SAAS,GAAA,EAAiC;AACvD,IAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,IAAA,IAAI,IAAA,KAAS,IAAI,OAAO,MAAA;AACxB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,SAAS,QAAA,CAAS,GAAA,EAAe,IAAA,EAAe,KAAA,EAAoC;AAClF,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAI,CAAA,GAAI,OAAO,EAAC;AACrC,IAAA,MAAM,SAAA,GAAY,OAAO,GAAA,CAAI,OAAO,MAAM,QAAA,GAAW,GAAA,CAAI,OAAO,CAAA,GAAI,MAAA;AACpE,IAAA,MAAM,MAAA,GAAS,OAAO,GAAA,CAAI,QAAQ,MAAM,QAAA,GAAW,GAAA,CAAI,QAAQ,CAAA,GAAI,MAAA;AACnE,IAAA,MAAM,aAAA,GAAgB,OAAO,GAAA,CAAI,SAAS,CAAA,KAAM,YAAY,CAAC,KAAA,GAAQ,GAAA,CAAI,SAAS,CAAA,GAAI,MAAA;AACtF,IAAA,MAAM,OAAA,GAAU,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,iBAAA,EAAmB,UAAA,CAAW,GAAG,CAAA,EAAE;AACnG,IAAA,MAAM,SAAS,MAAA,IAAU,SAAA;AACzB,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,SAAA,KAAc,mBAAmB,IAAA,GAAO,4BAAA;AAAA,SAAA,IACzD,MAAA,KAAW,UAAaC,oCAAA,CAAmB,MAAM,MAAM,kBAAA,EAAoB,IAAA,GAAOA,qCAAmB,MAAM,CAAA;AAAA,SAAA,IAC3G,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,SAAA,KAAc,gBAAgB,IAAA,GAAO,4BAAA;AAAA,SAAA,IAC3D,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,IAAA,GAAO,kBAAA;AAAA,SAAA,IAC3B,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,IAAA,GAAO,wBAAA;AAAA,SAAA,IAC3B,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,IAAA,GAAO,kBAAA;AAAA,SAC/B,IAAA,GAAO,qBAAA;AACZ,IAAA,MAAM,QAAQ,CAAA,cAAA,EAAiB,GAAA,CAAI,MAAM,CAAA,EAAG,YAAY,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,GAAK,EAAE,GAAG,MAAA,IAAU,MAAA,KAAW,YAAY,CAAA,EAAA,EAAK,MAAM,MAAM,EAAE,CAAA,CAAA;AACnI,IAAA,OAAO,IAAID,oCAAA,CAAmB,IAAA,EAAM,aAAA,GAAgB,CAAA,EAAG,KAAK,CAAA,EAAA,EAAK,aAAa,CAAA,CAAA,GAAK,CAAA,EAAG,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MAC9F,OAAA;AAAA,MACA,GAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,MAAA,KAAW,GAAA,GAAM,EAAE,SAAA,EAAW,IAAA,EAAK,GAAI;AAAC,KACvE,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,OAAA,CAAW,MAAA,EAAkC,IAAA,EAAc,CAAA,GAAsB,EAAC,EAAe;AAC9G,IAAA,MAAM,OAAA,GAAkC,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AACrE,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACpD,IAAA,IAAI,EAAE,OAAA,EAAS;AACb,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,MAAM,IAAIA,oCAAA,CAAmB,4BAAA,EAA8B,+DAA+D,CAAA;AAAA,MAC5H;AACA,MAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,YAAY,CAAA,CAAA;AAAA,IACnD;AACA,IAAA,IAAI,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA;AAC3B,IAAA,IAAI,EAAE,KAAA,EAAO;AACX,MAAA,MAAM,EAAA,GAAK,IAAI,eAAA,EAAgB;AAC/B,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,CAAA,CAAE,KAAK,CAAA,EAAG,IAAI,MAAM,MAAA,EAAW,EAAA,CAAG,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AACtF,MAAA,MAAM,CAAA,GAAI,GAAG,QAAA,EAAS;AACtB,MAAA,IAAI,CAAA,EAAG,GAAA,IAAO,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA;AAAA,IACrB;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,EAAK,EAAE,MAAA,EAAQ,OAAA,EAAS,GAAI,CAAA,CAAE,IAAA,KAAS,SAAY,EAAE,IAAA,EAAM,KAAK,SAAA,CAAU,CAAA,CAAE,IAAI,CAAA,EAAE,GAAI,EAAC,EAAI,CAAA;AAClH,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,GAAG,CAAA;AAC/B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,SAAS,GAAA,EAAK,IAAA,EAAM,CAAA,CAAE,WAAA,KAAgB,IAAI,CAAA;AAC7D,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,eAAe,OAAA,CAAQ,IAAA,EAAc,MAAA,EAAuB,IAAA,EAA2C;AACrG,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAIL,iCAAA,CAAgB,oBAAA,EAAsB,qEAAqE,CAAA;AAAA,IACvH;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,MAAA,EAAQ,kBAAA;AAAA,MACR,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAa,IAAA,CAAK;AAAA,KACpB;AACA,IAAA,IAAI,KAAK,gBAAA,EAAkB,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,gBAAgB,CAAA,CAAA;AACrF,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAA,CAAQ,QAAQ,IAAI,IAAA,CAAK,MAAA;AAC1C,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,GAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MAC1C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA;AAAA,MACA,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,eAAA,CAAgB,MAAM,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,GAAG,CAAA;AAC/B,IAAA,IAAI,QAAA,CAAS,IAAI,CAAA,KAAM,IAAA,CAAK,QAAQ,MAAM,UAAA,IAAc,IAAA,CAAK,QAAQ,CAAA,KAAM,QAAA,CAAA,EAAW;AACpF,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,KAAK,CAAA;AAAA,EACjC;AAEA,EAAA,MAAM,WAAA,GAAc,CAAC,EAAA,EAAS,GAAA,GAAM,EAAA,KAAe;AACjD,IAAA,IAAI,CAAC,qBAAA,CAAsB,IAAA,CAAK,EAAE,CAAA,EAAG;AACnC,MAAA,MAAM,IAAIK,oCAAA,CAAmB,kBAAA,EAAoB,qDAAqD,CAAA;AAAA,IACxG;AACA,IAAA,OAAO,CAAA,aAAA,EAAgB,EAAE,CAAA,EAAG,GAAG,CAAA,CAAA;AAAA,EACjC,CAAA;AAEA,EAAA,MAAM,EAAA,GAAqB;AAAA,IACzB,OAAA,EAAS,OAAO,MAAA,EAAQ,IAAA,KAAS;AAC/B,MAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC1B,QAAA,MAAM,IAAIA,oCAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,OAAA,CAAQ,UAAA,EAAY,MAAA,EAAQ,IAAI,CAAA;AAAA,IACzC,CAAA;AAAA,IACA,QAAQ,YAAY;AAClB,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,CAAA,EAAG,OAAO,CAAA,OAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,KAAA,EAAO,CAAA;AAC7D,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,GAAG,CAAA;AAC/B,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,QAAU,QAAA,CAAS,GAAA,EAAK,MAAM,KAAK,CAAA;AAC5C,MAAA,OAAQ,SAAS,IAAI,CAAA,GAAI,IAAA,GAAO,EAAE,QAAQ,IAAA,EAAK;AAAA,IACjD,CAAA;AAAA,IACA,UAAA,EAAY,CAAC,KAAA,KAAU,eAAA,CAAgB,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,GACvE;AAEA,EAAA,MAAM,EAAA,GAAqB;AAAA,IACzB,SAAS,CAAC,MAAA,EAAQ,SAAS,OAAA,CAAQ,aAAA,EAAe,QAAQ,IAAI,CAAA;AAAA,IAC9D,UAAA,EAAY,CAAC,KAAA,KAAU,eAAA,CAAgB,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,CAAA;AAAA,IACrE,MAAA,EAAQ,MAAM,OAAA,CAAQ,KAAA,EAAO,YAAY,CAAA;AAAA,IACzC,QAAA,EAAU,MAAM,OAAA,CAAQ,KAAA,EAAO,cAAc,CAAA;AAAA,IAC7C,QAAA,EAAU,MAAM,OAAA,CAAQ,KAAA,EAAO,eAAe,CAAA;AAAA,IAC9C,IAAA,EAAM;AAAA,MACJ,KAAA,EAAO,MAAM,OAAA,CAAQ,KAAA,EAAO,gBAAgB,CAAA;AAAA,MAC5C,KAAA,EAAO,OAAO,OAAA,EAAS,SAAA,KAAc;AACnC,QAAA,MAAM,CAAA,GAAI,MAAM,OAAA,CAAuB,MAAA,EAAQ,gBAAA,EAAkB,EAAE,IAAA,EAAM,EAAE,OAAA,EAAS,SAAA,EAAU,EAAG,CAAA;AACjG,QAAA,YAAA,GAAe,CAAA,CAAE,KAAA;AACjB,QAAA,OAAO,CAAA;AAAA,MACT,CAAA;AAAA,MACA,QAAQ,YAAY;AAClB,QAAA,MAAM,QAAQ,MAAA,EAAQ,iBAAA,EAAmB,EAAE,OAAA,EAAS,MAAM,CAAA;AAC1D,QAAA,YAAA,GAAe,IAAA;AAAA,MACjB;AAAA,KACF;AAAA,IACA,EAAA,EAAI,MAAM,OAAA,CAAQ,KAAA,EAAO,UAAU,EAAE,OAAA,EAAS,MAAM,CAAA;AAAA,IACpD,eAAA,EAAiB,OAAO,IAAA,EAAM,CAAA,KAAM;AAClC,MAAA,IAAI,CAACE,eAAU,CAAA,CAAE,OAAA,EAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,CAAA,EAAG;AAC5C,QAAA,MAAM,IAAIF,oCAAA,CAAmB,kBAAA,EAAoB,kDAAkD,CAAA;AAAA,MACrG;AACA,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,EAAA,CAAG,KAAK,KAAA,EAAM;AACtC,MAAA,MAAM,GAAA,GAAA,CAAO,CAAA,CAAE,GAAA,IAAO,IAAA,CAAK,GAAA,GAAK;AAChC,MAAA,MAAM,UAAUG,sBAAA,CAAkB;AAAA,QAChC,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,OAAA,EAAS,CAAA,CAAE,OAAA,IAAWC,6BAAA,CAAY,EAAA;AAAA,QAClC,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,KAAA;AAAA,QACA,GAAA,EAAK,CAAA,CAAE,GAAA,IAAO,CAAA,QAAA,EAAW,EAAE,MAAM,CAAA,CAAA;AAAA,QACjC,OAAA,EAAS,GAAA;AAAA,QACT,SAAA,EAAW,EAAE,SAAA,IAAa,oFAAA;AAAA,QAC1B,QAAA,EAAU,IAAI,IAAA,CAAK,GAAG,CAAA;AAAA,QACtB,gBAAgB,IAAI,IAAA,CAAK,OAAO,CAAA,CAAE,eAAA,IAAmB,OAAO,GAAI;AAAA,OACjE,CAAA;AACD,MAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,OAAO,CAAA;AACpC,MAAA,OAAO,EAAA,CAAG,IAAA,CAAK,KAAA,CAAM,OAAA,EAAS,SAAS,CAAA;AAAA,IACzC,CAAA;AAAA,IACA,iBAAiB,MAAM,YAAA;AAAA,IACvB,eAAA,EAAiB,CAAC,CAAA,KAAM;AACtB,MAAA,YAAA,GAAe,CAAA;AAAA,IACjB,CAAA;AAAA,IACA,QAAA,EAAU;AAAA,MACR,OAAA,EAAS,CAAC,IAAA,KAAS,OAAA,CAAQ,MAAA,EAAQ,wBAAwB,EAAE,OAAA,EAAS,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,MAClF,QAAA,EAAU,CAAC,IAAA,KAAS,OAAA,CAAQ,MAAA,EAAQ,gBAAgB,EAAE,OAAA,EAAS,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,MAC3E,IAAA,EAAM,MAAM,OAAA,CAAQ,KAAA,EAAO,gBAAgB,EAAE,OAAA,EAAS,MAAM,CAAA;AAAA,MAC5D,GAAA,EAAK,OAAO,EAAA,KAAO,OAAA,CAAQ,KAAA,EAAO,WAAA,CAAY,EAAE,CAAA,EAAG,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA;AAAA,MACpE,iBAAA,EAAmB,OAAO,EAAA,KAAO,OAAA,CAAQ,MAAA,EAAQ,WAAA,CAAY,EAAA,EAAI,eAAe,CAAA,EAAG,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA;AAAA,MACpG,eAAA,EAAiB,OAAO,EAAA,KAAO,OAAA,CAAQ,MAAA,EAAQ,WAAA,CAAY,EAAA,EAAI,oBAAoB,CAAA,EAAG,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA;AAAA,MACvG,cAAA,EAAgB,OAAO,EAAA,EAAI,IAAA,KAAS,QAAQ,OAAA,EAAS,WAAA,CAAY,EAAA,EAAI,WAAW,CAAA,EAAG,EAAE,OAAA,EAAS,IAAA,EAAM,MAAM,CAAA;AAAA,MAC1G,KAAA,EAAO,OAAO,EAAA,EAAI,CAAA,GAAI,EAAC,KAAM,OAAA,CAAQ,OAAO,WAAA,CAAY,EAAA,EAAI,QAAQ,CAAA,EAAG,EAAE,SAAS,IAAA,EAAM,KAAA,EAAO,EAAE,GAAG,CAAA,IAAK,CAAA;AAAA,MACzG,MAAA,EAAQ,OAAO,EAAA,EAAI,CAAA,GAAI,EAAC,KAAM,OAAA,CAAQ,OAAO,WAAA,CAAY,EAAA,EAAI,SAAS,CAAA,EAAG,EAAE,SAAS,IAAA,EAAM,KAAA,EAAO,EAAE,GAAG,CAAA,IAAK,CAAA;AAAA,MAC3G,SAAA,EAAW,OAAO,EAAA,KAAO,OAAA,CAAQ,KAAA,EAAO,WAAA,CAAY,EAAA,EAAI,YAAY,CAAA,EAAG,EAAE,OAAA,EAAS,IAAA,EAAM;AAAA,KAC1F;AAAA,IACA;AAAA,GACF;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,EAAA,EAAI,EAAA,EAAG;AAC3B;AAGO,SAAS,qBAAqB,CAAA,EAAmD;AACtF,EAAA,OAAO;AAAA,IACL,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,UAAU,CAAA,CAAE,QAAA;AAAA,IACZ,KAAA,EAAO,CAAA,CAAE,KAAA,CAAM,QAAA,EAAS;AAAA,IACxB,QAAA,EAAU,CAAA,CAAE,QAAA,CAAS,QAAA,EAAS;AAAA,IAC9B,WAAW,CAAA,CAAE;AAAA,GACf;AACF","file":"chunk-4GEC7GUU.cjs","sourcesContent":["import { createSiweMessage } from \"viem/siwe\";\nimport { isAddress, toHex } from \"viem\";\nimport type { Address, Hex } from \"viem\";\n\nimport { pepuMainnet } from \"../chains.js\";\nimport { PEPU_HOSTED, resolvePepuEndpoints } from \"../endpoints.js\";\nimport { PepuConfigError, PepuPaymasterError } from \"../errors.js\";\nimport type { PepuErrorCode } from \"../errors.js\";\nimport type { ProjectClaimAttestation } from \"./onchain.js\";\nimport { mapPaymasterReason, paymasterReasonToError } from \"./reasons.js\";\n\n/**\n * REST client for the PEPU paymaster policy service: v1 (`/sponsor`, ERC-7677 at `/paymaster/<token>`) and\n * v2 (`/v2/*`, tiered, on-chain projects). Isomorphic (plain `fetch`), so it is safe in a browser EXCEPT for\n * the claim attestation call that carries a Privy app secret, which lives in `@pepu-chain/sdk/paymaster/server`.\n *\n * Contract: services/paymaster/policy-service/openapi.yaml and SPONSORSHIP-SPEC.md. Credentials: a server key\n * (`ppk_...`, secret, any wallet) and a client token (`ppt_...`, publishable, bound to allowed origins).\n */\n\n// ---------------------------------------------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------------------------------------------\n\n/** A quantity as the service accepts it: `0x` hex or bigint (converted for you). */\nexport type Quantity = Hex | bigint;\n\n/** The UserOperation fields `POST /sponsor` and `POST /v2/sponsor` read (EntryPoint v0.7, unpacked). */\nexport interface SponsorUserOp {\n  sender: Address;\n  nonce: Quantity;\n  factory?: Address;\n  factoryData?: Hex;\n  callData: Hex;\n  callGasLimit: Quantity;\n  verificationGasLimit: Quantity;\n  preVerificationGas: Quantity;\n  maxFeePerGas: Quantity;\n  maxPriorityFeePerGas: Quantity;\n}\n\nexport interface SponsorApproval {\n  status: \"approved\";\n  chainId: number;\n  paymaster: Address;\n  paymasterVerificationGasLimit: Hex;\n  paymasterPostOpGasLimit: Hex;\n  paymasterData: Hex;\n  validUntil: number;\n  validAfter: number;\n  /** EntryPoint's canonical userOpHash. */\n  userOpHash: Hex;\n  /** v2 only. */\n  sponsor?: { kind: \"project\" | \"free\"; sponsorId: Hex; projectKey: string };\n  /** v2 only: worst-case cost, decimal wei. */\n  maxCostWei?: string;\n}\n\nexport interface SponsorDenial {\n  status: \"denied\";\n  /** Machine-readable reason, see {@link PAYMASTER_DENIAL_REASONS}. */\n  reason: string;\n  message: string;\n  /** v2: per-tier reasons when both tiers were tried. */\n  detail?: { project?: string; free?: string };\n}\n\nexport type SponsorResult = SponsorApproval | SponsorDenial;\n\n/** Credentials for a sponsor call. */\nexport interface SponsorAuth {\n  /** The project's server key (`ppk_`) or client token (`ppt_`). Sent as `X-Api-Key`. */\n  apiKey: string;\n  /** The user's Privy access token. REQUIRED by v1 and by the v2 free tier. Sent as `Authorization: Bearer`. */\n  privyAccessToken?: string;\n  /** Origin header, for server-side calls with a client token (browsers set it themselves). */\n  origin?: string;\n}\n\nexport interface V2LoginResult {\n  token: string;\n  address: Address;\n  /** ISO timestamp. */\n  expiresAt: string;\n}\n\nexport type V2ConfigResponse = Record<string, unknown>;\nexport type V2FreeTierInfo = Record<string, unknown>;\n\nexport interface V2ContractInfo {\n  address: Address;\n  chainId: number;\n  entryPoint: Address;\n  abi: readonly unknown[];\n}\n\n/** `POST /v2/projects/prepare` response: a transaction for the owner's wallet to send. */\nexport interface PreparedTx {\n  chainId: number;\n  to: Address;\n  data: Hex;\n  /** Decimal wei string. */\n  value: string;\n  function: string;\n  description: string;\n}\n\ntype Wei = string;\ntype Bytes32 = Hex;\n\n/** Body of `POST /v2/projects/prepare`. */\nexport type PrepareRequest =\n  | { action: \"claimProject\" | \"reclaimProject\"; attestation: SerializedAttestation }\n  | { action: \"depositFor\"; projectId: Bytes32; amountWei: Wei }\n  | { action: \"executeReclaim\" | \"cancelReclaim\" | \"acceptProjectOwnership\"; projectId: Bytes32 }\n  | { action: \"setTargets\"; projectId: Bytes32; targets: Address[]; allowed: boolean }\n  | { action: \"setDailyLimit\" | \"setSenderDailyLimit\"; projectId: Bytes32; limitWei: Wei }\n  | { action: \"setPaused\"; projectId: Bytes32; paused: boolean }\n  | { action: \"proposeProjectOwner\"; projectId: Bytes32; newOwner: Address };\n\n/** Attestation in the service's wire format (decimal strings). */\nexport interface SerializedAttestation {\n  appId: string;\n  newOwner: Address;\n  nonce: string;\n  deadline: string;\n  signature: Hex;\n}\n\nexport interface RegisterProjectRequest {\n  /** Give `projectId` or `appId` (the id is keccak256(appId)). */\n  projectId?: Bytes32;\n  appId?: string;\n  perUserDailyCapWei?: Wei;\n  /** Opt in: refuse wallets without a verified Privy token. Default false (any wallet). */\n  requireIdentity?: boolean;\n  /** Plain origins (scheme://host[:port], http only for localhost). Max 20. None means server-key only. */\n  allowedOrigins?: string[];\n}\n\nexport interface RegisterProjectResponse {\n  /** Publishable client token (`ppt_...`), shown once. */\n  token: string;\n  /** ERC-7677 URL embedding the client token. */\n  paymasterUrl: string;\n  /** SECRET server key (`ppk_...`), shown once. Backend only. */\n  serverKey?: string;\n}\n\nexport interface ProjectSettings {\n  perUserDailyCapWei?: Wei;\n  requireIdentity?: boolean;\n  allowedOrigins?: string[];\n}\n\nexport interface ProjectDetail {\n  projectId: Bytes32;\n  appId: string | null;\n  indexed: boolean;\n  owner: Address;\n  onchain: {\n    balance: Wei;\n    spendable: Wei;\n    outstandingApprovals: Wei;\n    paused: boolean;\n    dailyLimit: Wei;\n    senderDailyLimit: Wei;\n    spentToday: Wei;\n    dailyRemaining: Wei;\n  };\n  adminChangeDelaySeconds: number | null;\n  allowlist: Address[] | null;\n  offchain: Record<string, unknown> | null;\n  usage24h: { ops: number; projectFundedWei: Wei; freeTierFundedWei: Wei } | null;\n  contract: { address: Address; chainId: number };\n}\n\n/** Options for the low-level request escape hatch. */\nexport interface V2RequestOptions {\n  body?: unknown;\n  query?: Record<string, string | number | undefined>;\n  /** Send the stored SIWE session as a bearer token. Default false. */\n  session?: boolean;\n  /**\n   * Never put the service's message into thrown errors (only the HTTP status and error code). Set for calls whose\n   * request body holds a secret.\n   */\n  quietErrors?: boolean;\n}\n\nexport interface CreatePaymasterApiOptions {\n  /**\n   * Policy-service base URL (no trailing path). Defaults to `PEPU_PAYMASTER_URL` /\n   * `NEXT_PUBLIC_PEPU_PAYMASTER_URL`, then the hosted default once it exists.\n   */\n  baseUrl?: string;\n  /** Fetch implementation (tests, custom agents). Defaults to global `fetch`. */\n  fetch?: typeof fetch;\n  /** Environment for URL resolution. Defaults to `process.env`. */\n  env?: Record<string, string | undefined>;\n  /** Request timeout in milliseconds. Default 15000. */\n  timeoutMs?: number;\n  /** Start with an existing SIWE session token. */\n  sessionToken?: string;\n}\n\nexport interface PaymasterApiV1 {\n  /** `POST /sponsor`. Needs the user's Privy access token and the app API key. */\n  sponsor(userOp: SponsorUserOp, auth: SponsorAuth): Promise<SponsorResult>;\n  /** `GET /health`. */\n  health(): Promise<{ status: string }>;\n  /** ERC-7677 URL for this service (`<base>/paymaster/<token>`). */\n  erc7677Url(appToken: string): string;\n}\n\nexport interface PaymasterApiV2 {\n  /** `POST /v2/sponsor`. Denials are returned (not thrown); use {@link assertApproved}. */\n  sponsor(userOp: SponsorUserOp, auth: SponsorAuth): Promise<SponsorResult>;\n  /** ERC-7677 URL for this service (`<base>/v2/paymaster/<token>`). */\n  erc7677Url(appToken: string): string;\n  config(): Promise<V2ConfigResponse>;\n  contract(): Promise<V2ContractInfo>;\n  freeTier(): Promise<V2FreeTierInfo>;\n  auth: {\n    nonce(): Promise<{ nonce: string; expiresAt: string }>;\n    /** Stores the returned session token on this client. */\n    login(message: string, signature: Hex): Promise<V2LoginResult>;\n    logout(): Promise<void>;\n  };\n  /** `GET /v2/me`: the session address. */\n  me(): Promise<{ address: Address }>;\n  /**\n   * Full SIWE sign-in: nonce, EIP-4361 message, your signature, login. The session lasts 1 hour and is stored\n   * on this client.\n   */\n  loginWithWallet(sign: (message: string) => Promise<Hex>, o: LoginWithWalletOptions): Promise<V2LoginResult>;\n  /** Current session token, if signed in. */\n  getSessionToken(): string | null;\n  setSessionToken(token: string | null): void;\n  projects: {\n    /** `POST /v2/projects/prepare`: calldata for the owner's wallet. Sends nothing. */\n    prepare(request: PrepareRequest): Promise<PreparedTx>;\n    /** `POST /v2/projects`: index a claimed project and get its credentials. */\n    register(request: RegisterProjectRequest): Promise<RegisterProjectResponse>;\n    list(): Promise<{ projects: unknown[]; onchainUnindexed?: unknown[] }>;\n    get(projectId: Hex): Promise<ProjectDetail>;\n    rotateClientToken(projectId: Hex): Promise<{ token: string; paymasterUrl: string; note?: string }>;\n    rotateServerKey(projectId: Hex): Promise<{ serverKey: string; note?: string }>;\n    updateSettings(projectId: Hex, settings: ProjectSettings): Promise<Record<string, unknown>>;\n    usage(projectId: Hex, q?: { limit?: number; before?: number }): Promise<Record<string, unknown>>;\n    events(projectId: Hex, q?: { fromBlock?: number; limit?: number }): Promise<{ projectId: Hex; events: unknown[] }>;\n    allowlist(projectId: Hex): Promise<{ projectId: Hex; source: string; targets: Address[] }>;\n  };\n  /**\n   * Low-level call to any `/v2` path, with the same error mapping. Used by `@pepu-chain/sdk/paymaster/server`\n   * for `POST /v2/projects/verify`. Prefer the typed methods.\n   */\n  request<T>(method: \"GET\" | \"POST\" | \"PATCH\", path: string, options?: V2RequestOptions): Promise<T>;\n}\n\nexport interface PaymasterApi {\n  /** Resolved base URL, no trailing slash. */\n  readonly baseUrl: string;\n  v1: PaymasterApiV1;\n  v2: PaymasterApiV2;\n}\n\nexport interface LoginWithWalletOptions {\n  /** The signing wallet's address. */\n  address: Address;\n  /** SIWE domain; must be one of the service's `SIWE_DOMAINS` (for example `app.example.com`). */\n  domain: string;\n  /** SIWE `uri`. Default `https://<domain>`. */\n  uri?: string;\n  /** Chain id in the message. Default 97741. */\n  chainId?: number;\n  statement?: string;\n  /** Message lifetime in seconds (service maximum is 600 by default). Default 300. */\n  lifetimeSeconds?: number;\n  now?: () => number;\n}\n\n// ---------------------------------------------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------------------------------------------\n\nconst CLIENT_TOKEN_PREFIX = \"ppt_\";\nconst SERVER_KEY_PREFIX = \"ppk_\";\n\n/** `\"client\"` for `ppt_` tokens, `\"server\"` for `ppk_` keys, otherwise `null`. Never inspects beyond the prefix. */\nexport function credentialKind(credential: string): \"client\" | \"server\" | null {\n  if (credential.startsWith(CLIENT_TOKEN_PREFIX)) return \"client\";\n  if (credential.startsWith(SERVER_KEY_PREFIX)) return \"server\";\n  return null;\n}\n\nfunction trimBase(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\nexport interface BuildErc7677UrlOptions {\n  /** Policy-service base URL. */\n  baseUrl: string;\n  /** Client token (`ppt_`, browser-safe) or server key (`ppk_`, secret). */\n  token: string;\n  /** Default 2. v1 serves `/paymaster/<token>`, v2 serves `/v2/paymaster/<token>`. */\n  version?: 1 | 2;\n}\n\n/**\n * Build the ERC-7677 paymaster URL for a project credential (paste it into a Privy \"Paymaster URL\" or pass it\n * to a viem paymaster client). Refuses a server key (`ppk_`) in a browser, because the URL embeds it.\n *\n * @example\n * ```ts\n * const url = buildErc7677Url({ baseUrl: \"https://paymaster.example.com\", token: \"ppt_abc\" });\n * // https://paymaster.example.com/v2/paymaster/ppt_abc\n * ```\n */\nexport function buildErc7677Url(options: BuildErc7677UrlOptions): string {\n  const token = options.token.trim();\n  if (token === \"\") {\n    throw new PepuConfigError(\"CONFIG_MISSING_ENV\", \"buildErc7677Url needs a project client token or server key.\");\n  }\n  if (credentialKind(token) === \"server\" && (globalThis as { window?: unknown }).window !== undefined) {\n    throw new PepuConfigError(\n      \"CONFIG_SERVER_ONLY\",\n      \"Refusing to build an ERC-7677 URL from a server key (ppk_) in a browser: the URL embeds the secret. Use the client token (ppt_).\",\n    );\n  }\n  let base: URL;\n  try {\n    base = new URL(options.baseUrl);\n  } catch {\n    throw new PepuConfigError(\"CONFIG_BAD_URL\", \"buildErc7677Url: baseUrl is not a valid URL.\");\n  }\n  if (base.protocol !== \"http:\" && base.protocol !== \"https:\") {\n    throw new PepuConfigError(\"CONFIG_BAD_URL\", \"buildErc7677Url: baseUrl must be an http(s) URL.\");\n  }\n  const prefix = (options.version ?? 2) === 2 ? \"/v2/paymaster/\" : \"/paymaster/\";\n  return `${trimBase(options.baseUrl)}${prefix}${encodeURIComponent(token)}`;\n}\n\n/**\n * The hosted ERC-7677 URL for a project credential: `<hosted base>/v2/paymaster/<token>`.\n * Pass the project's client token (`ppt_`, browser-safe); a server key is refused in a browser.\n *\n * @example\n * const url = hostedErc7677Url(\"ppt_abc\");\n * // https://paymaster.pepeunchained.com/v2/paymaster/ppt_abc\n */\nexport function hostedErc7677Url(token: string): string {\n  if (PEPU_HOSTED.paymasterBaseUrl === null) {\n    throw new PepuConfigError(\"CONFIG_MISSING_ENV\", \"No hosted paymaster base URL is set.\");\n  }\n  return buildErc7677Url({ baseUrl: PEPU_HOSTED.paymasterBaseUrl, token });\n}\n\nfunction toQuantity(v: Quantity): Hex {\n  return typeof v === \"bigint\" ? toHex(v) : v;\n}\n\nfunction serializeUserOp(op: SponsorUserOp): Record<string, string> {\n  const out: Record<string, string> = {\n    sender: op.sender,\n    nonce: toQuantity(op.nonce),\n    callData: op.callData,\n    callGasLimit: toQuantity(op.callGasLimit),\n    verificationGasLimit: toQuantity(op.verificationGasLimit),\n    preVerificationGas: toQuantity(op.preVerificationGas),\n    maxFeePerGas: toQuantity(op.maxFeePerGas),\n    maxPriorityFeePerGas: toQuantity(op.maxPriorityFeePerGas),\n  };\n  if (op.factory !== undefined) out[\"factory\"] = op.factory;\n  if (op.factoryData !== undefined) out[\"factoryData\"] = op.factoryData;\n  return out;\n}\n\n/**\n * Turn a sponsor result into the approval, or throw the mapped {@link PepuPaymasterError}\n * (`project_not_claimed_onchain` becomes `PAYMASTER_PROJECT_NOT_CLAIMED`, and so on).\n *\n * @example\n * ```ts\n * const approval = assertApproved(await api.v2.sponsor(userOp, { apiKey }));\n * ```\n */\nexport function assertApproved(result: SponsorResult): SponsorApproval {\n  if (result.status === \"approved\") return result;\n  throw paymasterReasonToError(result.reason, result.message, result.detail ? { detail: result.detail } : undefined);\n}\n\n/** Pull `retryAfterSeconds` out of a Retry-After header. */\nfunction retryAfter(res: Response): number | undefined {\n  const raw = res.headers.get(\"retry-after\");\n  const n = raw === null ? NaN : Number(raw);\n  return Number.isFinite(n) ? n : undefined;\n}\n\nfunction isRecord(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null && !Array.isArray(v);\n}\n\nfunction missingBaseUrl(): PepuConfigError {\n  return new PepuConfigError(\n    \"CONFIG_MISSING_ENV\",\n    \"No paymaster URL configured. Set PEPU_PAYMASTER_URL (or NEXT_PUBLIC_PEPU_PAYMASTER_URL), or pass baseUrl to createPaymasterApi.\",\n  );\n}\n\n// ---------------------------------------------------------------------------------------------------------------\n// Client\n// ---------------------------------------------------------------------------------------------------------------\n\n/**\n * Create the paymaster REST client.\n *\n * @example\n * ```ts\n * const api = createPaymasterApi({ baseUrl: \"https://paymaster.example.com\" });\n * const free = await api.v2.freeTier();\n * const result = await api.v2.sponsor(userOp, { apiKey: process.env.PEPU_SERVER_KEY!, privyAccessToken });\n * if (result.status === \"denied\") console.log(result.reason);\n * ```\n */\nexport function createPaymasterApi(options: CreatePaymasterApiOptions = {}): PaymasterApi {\n  const resolved = options.baseUrl ?? resolvePepuEndpoints(options.env ? { env: options.env } : {}).paymasterBaseUrl;\n  if (resolved === null || resolved === undefined || resolved.trim() === \"\") throw missingBaseUrl();\n  try {\n    const u = new URL(resolved);\n    if (u.protocol !== \"http:\" && u.protocol !== \"https:\") throw new Error(\"protocol\");\n  } catch {\n    throw new PepuConfigError(\"CONFIG_BAD_URL\", \"The paymaster baseUrl is not a valid http(s) URL.\");\n  }\n  const baseUrl = trimBase(resolved.trim());\n  const doFetch = options.fetch ?? ((...args: Parameters<typeof fetch>) => fetch(...args));\n  const timeoutMs = options.timeoutMs ?? 15_000;\n  let sessionToken: string | null = options.sessionToken ?? null;\n\n  /** Fetch with timeout; network failures become BUNDLER_UNREACHABLE without echoing request details. */\n  async function send(url: string, init: RequestInit): Promise<Response> {\n    try {\n      return await doFetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });\n    } catch (e) {\n      const timedOut = e instanceof Error && (e.name === \"TimeoutError\" || e.name === \"AbortError\");\n      throw new PepuPaymasterError(\n        \"BUNDLER_UNREACHABLE\",\n        timedOut ? \"The paymaster did not answer in time.\" : \"Could not reach the paymaster service.\",\n        { details: { path: new URL(url).pathname.replace(/\\/(ppt_|ppk_)[^/]*/, \"/<credential>\") } },\n      );\n    }\n  }\n\n  async function readJson(res: Response): Promise<unknown> {\n    const text = await res.text().catch(() => \"\");\n    if (text === \"\") return undefined;\n    try {\n      return JSON.parse(text) as unknown;\n    } catch {\n      return undefined;\n    }\n  }\n\n  function apiError(res: Response, body: unknown, quiet: boolean): PepuPaymasterError {\n    const rec = isRecord(body) ? body : {};\n    const errorCode = typeof rec[\"error\"] === \"string\" ? rec[\"error\"] : undefined;\n    const reason = typeof rec[\"reason\"] === \"string\" ? rec[\"reason\"] : undefined;\n    const serverMessage = typeof rec[\"message\"] === \"string\" && !quiet ? rec[\"message\"] : undefined;\n    const details = { status: res.status, error: errorCode, reason, retryAfterSeconds: retryAfter(res) };\n    const tagged = reason ?? errorCode;\n    let code: PepuErrorCode;\n    if (res.status === 401 && errorCode === \"unauthenticated\") code = \"PAYMASTER_SESSION_REQUIRED\";\n    else if (tagged !== undefined && mapPaymasterReason(tagged) !== \"PAYMASTER_DENIED\") code = mapPaymasterReason(tagged);\n    else if (res.status === 401 && errorCode !== \"login_failed\") code = \"PAYMASTER_SESSION_REQUIRED\";\n    else if (res.status === 401) code = \"PAYMASTER_DENIED\";\n    else if (res.status === 429) code = \"PAYMASTER_RATE_LIMITED\";\n    else if (res.status === 403) code = \"PAYMASTER_DENIED\";\n    else code = \"PAYMASTER_API_ERROR\";\n    const label = `Paymaster API ${res.status}${errorCode ? ` ${errorCode}` : \"\"}${reason && reason !== errorCode ? ` (${reason})` : \"\"}`;\n    return new PepuPaymasterError(code, serverMessage ? `${label}: ${serverMessage}` : `${label}.`, {\n      details,\n      ...(res.status === 429 || res.status === 503 ? { retryable: true } : {}),\n    });\n  }\n\n  async function request<T>(method: \"GET\" | \"POST\" | \"PATCH\", path: string, o: V2RequestOptions = {}): Promise<T> {\n    const headers: Record<string, string> = { accept: \"application/json\" };\n    if (o.body !== undefined) headers[\"content-type\"] = \"application/json\";\n    if (o.session) {\n      if (!sessionToken) {\n        throw new PepuPaymasterError(\"PAYMASTER_SESSION_REQUIRED\", \"This call needs a SIWE session. Call loginWithWallet() first.\");\n      }\n      headers[\"authorization\"] = `Bearer ${sessionToken}`;\n    }\n    let url = `${baseUrl}${path}`;\n    if (o.query) {\n      const qs = new URLSearchParams();\n      for (const [k, v] of Object.entries(o.query)) if (v !== undefined) qs.set(k, String(v));\n      const s = qs.toString();\n      if (s) url += `?${s}`;\n    }\n    const res = await send(url, { method, headers, ...(o.body !== undefined ? { body: JSON.stringify(o.body) } : {}) });\n    const body = await readJson(res);\n    if (!res.ok) throw apiError(res, body, o.quietErrors === true);\n    return body as T;\n  }\n\n  async function sponsor(path: string, userOp: SponsorUserOp, auth: SponsorAuth): Promise<SponsorResult> {\n    if (!auth.apiKey) {\n      throw new PepuConfigError(\"CONFIG_MISSING_ENV\", \"sponsor needs auth.apiKey (the project server key or client token).\");\n    }\n    const headers: Record<string, string> = {\n      accept: \"application/json\",\n      \"content-type\": \"application/json\",\n      \"x-api-key\": auth.apiKey,\n    };\n    if (auth.privyAccessToken) headers[\"authorization\"] = `Bearer ${auth.privyAccessToken}`;\n    if (auth.origin) headers[\"origin\"] = auth.origin;\n    const res = await send(`${baseUrl}${path}`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({ userOp: serializeUserOp(userOp) }),\n    });\n    const body = await readJson(res);\n    if (isRecord(body) && (body[\"status\"] === \"approved\" || body[\"status\"] === \"denied\")) {\n      return body as unknown as SponsorResult;\n    }\n    throw apiError(res, body, false);\n  }\n\n  const projectPath = (id: Hex, sub = \"\"): string => {\n    if (!/^0x[0-9a-fA-F]{64}$/.test(id)) {\n      throw new PepuPaymasterError(\"PAYMASTER_DENIED\", \"projectId must be a 0x-prefixed 32-byte hex string.\");\n    }\n    return `/v2/projects/${id}${sub}`;\n  };\n\n  const v1: PaymasterApiV1 = {\n    sponsor: async (userOp, auth) => {\n      if (!auth.privyAccessToken) {\n        throw new PepuPaymasterError(\n          \"PAYMASTER_IDENTITY_REQUIRED\",\n          \"The v1 /sponsor endpoint requires the user's Privy access token (auth.privyAccessToken).\",\n        );\n      }\n      return sponsor(\"/sponsor\", userOp, auth);\n    },\n    health: async () => {\n      const res = await send(`${baseUrl}/health`, { method: \"GET\" });\n      const body = await readJson(res);\n      if (!res.ok) throw apiError(res, body, false);\n      return (isRecord(body) ? body : { status: \"ok\" }) as { status: string };\n    },\n    erc7677Url: (token) => buildErc7677Url({ baseUrl, token, version: 1 }),\n  };\n\n  const v2: PaymasterApiV2 = {\n    sponsor: (userOp, auth) => sponsor(\"/v2/sponsor\", userOp, auth),\n    erc7677Url: (token) => buildErc7677Url({ baseUrl, token, version: 2 }),\n    config: () => request(\"GET\", \"/v2/config\"),\n    contract: () => request(\"GET\", \"/v2/contract\"),\n    freeTier: () => request(\"GET\", \"/v2/free-tier\"),\n    auth: {\n      nonce: () => request(\"GET\", \"/v2/auth/nonce\"),\n      login: async (message, signature) => {\n        const r = await request<V2LoginResult>(\"POST\", \"/v2/auth/login\", { body: { message, signature } });\n        sessionToken = r.token;\n        return r;\n      },\n      logout: async () => {\n        await request(\"POST\", \"/v2/auth/logout\", { session: true });\n        sessionToken = null;\n      },\n    },\n    me: () => request(\"GET\", \"/v2/me\", { session: true }),\n    loginWithWallet: async (sign, o) => {\n      if (!isAddress(o.address, { strict: false })) {\n        throw new PepuPaymasterError(\"PAYMASTER_DENIED\", \"loginWithWallet: address is not a valid address.\");\n      }\n      const { nonce } = await v2.auth.nonce();\n      const now = (o.now ?? Date.now)();\n      const message = createSiweMessage({\n        address: o.address,\n        chainId: o.chainId ?? pepuMainnet.id,\n        domain: o.domain,\n        nonce,\n        uri: o.uri ?? `https://${o.domain}`,\n        version: \"1\",\n        statement: o.statement ?? \"Sign in to manage your PEPU gas sponsorship project. This does not move any funds.\",\n        issuedAt: new Date(now),\n        expirationTime: new Date(now + (o.lifetimeSeconds ?? 300) * 1000),\n      });\n      const signature = await sign(message);\n      return v2.auth.login(message, signature);\n    },\n    getSessionToken: () => sessionToken,\n    setSessionToken: (t) => {\n      sessionToken = t;\n    },\n    projects: {\n      prepare: (body) => request(\"POST\", \"/v2/projects/prepare\", { session: true, body }),\n      register: (body) => request(\"POST\", \"/v2/projects\", { session: true, body }),\n      list: () => request(\"GET\", \"/v2/projects\", { session: true }),\n      get: async (id) => request(\"GET\", projectPath(id), { session: true }),\n      rotateClientToken: async (id) => request(\"POST\", projectPath(id, \"/token/rotate\"), { session: true }),\n      rotateServerKey: async (id) => request(\"POST\", projectPath(id, \"/server-key/rotate\"), { session: true }),\n      updateSettings: async (id, body) => request(\"PATCH\", projectPath(id, \"/settings\"), { session: true, body }),\n      usage: async (id, q = {}) => request(\"GET\", projectPath(id, \"/usage\"), { session: true, query: { ...q } }),\n      events: async (id, q = {}) => request(\"GET\", projectPath(id, \"/events\"), { session: true, query: { ...q } }),\n      allowlist: async (id) => request(\"GET\", projectPath(id, \"/allowlist\"), { session: true }),\n    },\n    request,\n  };\n\n  return { baseUrl, v1, v2 };\n}\n\n/** Serialize a typed attestation into the wire format for `projects.prepare`. */\nexport function serializeAttestation(a: ProjectClaimAttestation): SerializedAttestation {\n  return {\n    appId: a.appId,\n    newOwner: a.newOwner,\n    nonce: a.nonce.toString(),\n    deadline: a.deadline.toString(),\n    signature: a.signature,\n  };\n}\n"]}

package/dist/{chunk-PHM3ZORG.cjs → chunk-4L4CHIXE.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkNVOPDXTA_cjs = require('./chunk-NVOPDXTA.cjs');
-var chunk7MNJF2OB_cjs = require('./chunk-7MNJF2OB.cjs');
+var chunkUQH4ZAXD_cjs = require('./chunk-UQH4ZAXD.cjs');
+var chunkDNWWZWUW_cjs = require('./chunk-DNWWZWUW.cjs');
 var chunkJ3O2ZGG3_cjs = require('./chunk-J3O2ZGG3.cjs');
 var permissions = require('@zerodev/permissions');
 var policies = require('@zerodev/permissions/policies');
@@ -62,8 +62,8 @@ function generateSessionKey() {
 }
 function permissionFor(publicClient, sessionKeyAddress, policies) {
   return permissions.toPermissionValidator(zd(publicClient), {
-    entryPoint: chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
-    kernelVersion: chunkNVOPDXTA_cjs.KERNEL_VERSION,
+    entryPoint: chunkDNWWZWUW_cjs.ENTRY_POINT_V07,
+    kernelVersion: chunkUQH4ZAXD_cjs.KERNEL_VERSION,
     signer: signers.toEmptyECDSASigner(sessionKeyAddress),
     policies
   });
@@ -76,7 +76,7 @@ async function expectedPermissionId(p) {
 }
 async function approveKernelSession(p) {
   const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);
-  const account = await chunkNVOPDXTA_cjs.toPepuKernelAccount({
+  const account = await chunkUQH4ZAXD_cjs.toPepuKernelAccount({
     publicClient: p.publicClient,
     owner: p.owner,
     plugins: { regular }
@@ -88,8 +88,8 @@ async function loadKernelSessionAccount(p) {
   const sessionSigner = await signers.toECDSASigner({ signer: accounts.privateKeyToAccount(p.sessionPrivateKey) });
   const account = await permissions.deserializePermissionAccount(
     zd(p.publicClient),
-    chunk7MNJF2OB_cjs.ENTRY_POINT_V07,
-    chunkNVOPDXTA_cjs.KERNEL_VERSION,
+    chunkDNWWZWUW_cjs.ENTRY_POINT_V07,
+    chunkUQH4ZAXD_cjs.KERNEL_VERSION,
     p.approval,
     sessionSigner
   );
@@ -106,5 +106,5 @@ exports.expectedPermissionId = expectedPermissionId;
 exports.generateSessionKey = generateSessionKey;
 exports.isLive = isLive;
 exports.loadKernelSessionAccount = loadKernelSessionAccount;
-//# sourceMappingURL=chunk-PHM3ZORG.cjs.map
-//# sourceMappingURL=chunk-PHM3ZORG.cjs.map
+//# sourceMappingURL=chunk-4L4CHIXE.cjs.map
+//# sourceMappingURL=chunk-4L4CHIXE.cjs.map

package/dist/{chunk-PHM3ZORG.cjs.map → chunk-4L4CHIXE.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/session/store.ts","../src/session/kernel.ts"],"names":["assertCalls","toCallPolicy","CallPolicyVersion","findFunction","toTimestampPolicy","generatePrivateKey","privateKeyToAccount","toPermissionValidator","ENTRY_POINT_V07","KERNEL_VERSION","toEmptyECDSASigner","toPepuKernelAccount","serializePermissionAccount","toECDSASigner","deserializePermissionAccount"],"mappings":";;;;;;;;;;;AAyDO,SAAS,iBAAA,GAAkC;AAChD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA2B;AAC/C,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,MAAA,KAAW,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,IACnC,GAAA,EAAK,CAAC,MAAA,KAAW;AACf,MAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACvB,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,MAAA,KAAW;AACnB,MAAA,IAAI,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA,EAAG,OAAO,KAAA;AAC9B,MAAA,KAAA,CAAM,IAAI,MAAM,CAAA;AAChB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAQO,SAAS,MAAA,CAAO,QAAuB,UAAA,EAA6B;AACzE,EAAA,OAAO,MAAA,CAAO,QAAA,KAAa,IAAA,IAAQ,UAAA,GAAa,MAAA,CAAO,UAAA;AACzD;;;ACvCO,IAAM,0BAAA,GAAsC;AAE5C,IAAM,wBAAA,GAAoC;AAW1C,IAAM,4BAAA,GAA+B,EAAE,cAAA,EAAgB,IAAA,EAAM,gBAAgB,GAAA;AAKpF,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,2BAA2B,CAAA,EAI9B;AACX,EAAAA,6BAAA,CAAY,EAAE,KAAK,CAAA;AACnB,EAAA,OAAO;AAAA,IACLC,qBAAA,CAAa;AAAA,MACX,eAAeC,0BAAA,CAAkB,MAAA;AAAA,MACjC,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAC/B,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAA,EAAY,EAAE,UAAA,IAAc,EAAA;AAAA,QAC5B,GAAA,EAAK,CAACC,8BAAA,CAAa,CAAC,CAAC,CAAA;AAAA,QACrB,cAAc,CAAA,CAAE;AAAA,OAClB,CAAE;AAAA,KACmC,CAAA;AAAA,IACvCC,0BAAA,CAAkB,EAAE,UAAA,EAAY,CAAA,CAAE,cAAc,CAAA,EAAG,UAAA,EAAY,CAAA,CAAE,UAAA,EAAY;AAAA,GAC/E;AACF;AASO,SAAS,kBAAA,GAA4D;AAC1E,EAAA,MAAM,aAAaC,2BAAA,EAAmB;AACtC,EAAA,OAAO,EAAE,UAAA,EAAY,OAAA,EAASC,4BAAA,CAAoB,UAAU,EAAE,OAAA,EAAQ;AACxE;AAEA,SAAS,aAAA,CAAc,YAAA,EAA4B,iBAAA,EAA4B,QAAA,EAAoB;AACjG,EAAA,OAAOC,iCAAA,CAAsB,EAAA,CAAG,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAYC,iCAAA;AAAA,IACZ,aAAA,EAAeC,gCAAA;AAAA,IACf,MAAA,EAAQC,2BAAmB,iBAAiB,CAAA;AAAA,IAC5C;AAAA,GACD,CAAA;AACH;AASA,eAAsB,qBAAqB,CAAA,EAIvB;AAClB,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACtF,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,UAAA,CAAW,4BAAA,EAA6B;AACjE,EAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACxE,EAAA,OAAO,YAAA;AACT;AAeA,eAAsB,qBAAqB,CAAA,EAKe;AACxD,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACnF,EAAA,MAAM,OAAA,GAAU,MAAMC,qCAAA,CAAoB;AAAA,IACxC,cAAc,CAAA,CAAE,YAAA;AAAA,IAChB,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,OAAA,EAAS,EAAE,OAAA;AAAQ,GACpB,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAMC,sCAAA,CAA2B,OAAgB,CAAA;AAClE,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,OAAA,CAAQ,OAAA,EAAQ;AACpD;AAUA,eAAsB,yBAAyB,CAAA,EAIf;AAC9B,EAAA,MAAM,aAAA,GAAgB,MAAMC,qBAAA,CAAc,EAAE,QAAQP,4BAAA,CAAoB,CAAA,CAAE,iBAAiB,CAAA,EAAG,CAAA;AAC9F,EAAA,MAAM,UAAU,MAAMQ,wCAAA;AAAA,IACpB,EAAA,CAAG,EAAE,YAAY,CAAA;AAAA,IACjBN,iCAAA;AAAA,IACAC,gCAAA;AAAA,IACA,CAAA,CAAE,QAAA;AAAA,IACF;AAAA,GACF;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-PHM3ZORG.cjs","sourcesContent":["import type { Address, Hex } from \"viem\";\n\n/**\n * Server-side session records for the Kernel (on-chain) session flow, keyed by\n * Privy user id. Ported from templates/sponsored-session-app/lib/session-store.ts.\n *\n * WHAT IS STORED: the session private key (a hot key whose power is limited\n * ON-CHAIN by the call and timestamp policies until `validUntil`) and the\n * public approval. The owner's key never reaches the server.\n *\n * PRODUCTION: {@link createMemoryStore} is DEV-GRADE. It is lost on every\n * restart (the user simply starts a new session) and is not shared between\n * serverless instances. A production deployment must implement\n * {@link SessionStore} on a persistent database or KV AND keep\n * `sessionPrivateKey` encrypted at rest (KMS or an envelope key). Nothing else\n * in the SDK changes.\n */\nexport interface SessionRecord {\n  userId: string;\n  ownerAddress: Address;\n  kernelAddress: Address;\n  /** The session key's private half. Encrypt it at rest in any persistent store. */\n  sessionPrivateKey: Hex;\n  sessionKeyAddress: Address;\n  permissionId: string;\n  /** Unix seconds. The on-chain permission is invalid at and after this time. */\n  validUntil: number;\n  /** Present once the owner has signed the grant. */\n  approval: string | null;\n  /** Number of successful sponsored actions in this session. */\n  actions: number;\n}\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * Pluggable storage for {@link SessionRecord}s. Every method may be sync or\n * async. `tryLock` must be atomic per user: it returns `false` when an action\n * is already running for that user (a multi-instance deployment needs a\n * distributed lock, for example a Redis `SET NX PX`).\n */\nexport interface SessionStore {\n  get(userId: string): MaybePromise<SessionRecord | undefined>;\n  set(record: SessionRecord): MaybePromise<void>;\n  delete(userId: string): MaybePromise<void>;\n  tryLock(userId: string): MaybePromise<boolean>;\n  unlock(userId: string): MaybePromise<void>;\n}\n\n/**\n * An in-memory {@link SessionStore} for development and tests. DEV-GRADE: not\n * persistent, not shared across instances, and the session key is held in\n * plaintext in process memory. Production needs an encrypted persistent store.\n *\n * @example\n * const store = createMemoryStore();\n */\nexport function createMemoryStore(): SessionStore {\n  const records = new Map<string, SessionRecord>();\n  const locks = new Set<string>();\n  return {\n    get: (userId) => records.get(userId),\n    set: (record) => {\n      records.set(record.userId, record);\n    },\n    delete: (userId) => {\n      records.delete(userId);\n    },\n    tryLock: (userId) => {\n      if (locks.has(userId)) return false;\n      locks.add(userId);\n      return true;\n    },\n    unlock: (userId) => {\n      locks.delete(userId);\n    },\n  };\n}\n\n/**\n * True while the on-chain permission is still valid: approved and before expiry.\n *\n * @example\n * isLive(record, Math.floor(Date.now() / 1000));\n */\nexport function isLive(record: SessionRecord, nowSeconds: number): boolean {\n  return record.approval !== null && nowSeconds < record.validUntil;\n}\n","import { deserializePermissionAccount, serializePermissionAccount, toPermissionValidator } from \"@zerodev/permissions\";\nimport type { Policy } from \"@zerodev/permissions\";\nimport { CallPolicyVersion, toCallPolicy, toTimestampPolicy } from \"@zerodev/permissions/policies\";\nimport { toECDSASigner, toEmptyECDSASigner } from \"@zerodev/permissions/signers\";\nimport type { createKernelAccount } from \"@zerodev/sdk\";\nimport type { Abi, Address, Hex, PublicClient } from \"viem\";\nimport { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";\n\nimport { ENTRY_POINT_V07 } from \"../aa/clients.js\";\nimport { KERNEL_VERSION, toPepuKernelAccount } from \"../aa/kernel.js\";\nimport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nimport { assertCalls, findFunction } from \"./scope.js\";\nimport type { KernelSessionCall } from \"./scope.js\";\n\nexport { KERNEL_VERSION, getKernelAddress } from \"../aa/kernel.js\";\nexport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nexport { createMemoryStore, isLive } from \"./store.js\";\nexport type { SessionRecord, SessionStore } from \"./store.js\";\nexport { checkApproval, describeKernelSessionScope, isCallInScope, parseApproval } from \"./scope.js\";\nexport type { ApprovalCheck, KernelSessionCall, KernelSessionScope, ParsedApproval } from \"./scope.js\";\n\n/**\n * `@pepu-chain/sdk/session/kernel`: on-chain session keys with ZeroDev Kernel\n * permissions. Extracted from templates/sponsored-session-app/lib/{kernel,\n * session-policy,approval}.ts and built on `toPepuKernelAccount`\n * (`plugins.regular`).\n *\n * The scope is enforced ON-CHAIN by ZeroDev's policy contracts, which the\n * user's Kernel account calls during UserOperation validation:\n *\n * - Call policy v0.0.4: only the listed targets and function selectors, with a\n *   native value no larger than `valueLimit` (default 0).\n * - Timestamp policy: the permission is invalid outside `validAfter`..`validUntil`.\n *\n * A UserOperation outside this scope is rejected by the EntryPoint itself, no\n * matter who relays it or what the app backend does.\n *\n * Deployed on PEPU mainnet (eth_getCode verified 2026-10-02): Kernel v3.1\n * factory 0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419, ECDSA validator\n * 0x845ADb2C711129d4f3966735eD98a9F09fC4cE57, ECDSA signer module\n * 0x6A6F069E2a08c2468e7724Ab3250CdBFBA14D4FF, call policy v0.0.4 and the\n * timestamp policy below. Call policy v0.0.5 is NOT deployed on PEPU, so the\n * version is pinned.\n *\n * Optional peers: `@zerodev/sdk`, `@zerodev/permissions`, `@zerodev/ecdsa-validator`.\n */\n\n/** Call policy v0.0.4. Pinned: v0.0.5 is not deployed on PEPU mainnet. */\nexport const CALL_POLICY_V0_0_4_ADDRESS: Address = \"0x9a52283276A0ec8740DF50bF01B28A80D880eaf2\";\n/** ZeroDev timestamp policy on PEPU mainnet. */\nexport const TIMESTAMP_POLICY_ADDRESS: Address = \"0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F\";\n\n/**\n * Worst-case gas the paymaster policy service RESERVES per sponsored operation,\n * measured on PEPU mainnet with the sponsored-session-app template: the first\n * operation of a session (account deploy plus enabling the permission) about\n * 20.5 PEPU, later operations about 6.9 PEPU. The real first-session cost was\n * about 12.8 PEPU for two operations. Size per-user hourly and daily spend\n * caps above these, or users hit `trailing-hour spend ... would exceed cap`\n * after their first action.\n */\nexport const SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 } as const;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\n\n/** Type-level bridge for ZeroDev's own viem copy (same object at runtime). */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/**\n * The on-chain policies for one session: call policy v0.0.4 plus the timestamp\n * policy. Pure and deterministic given its input. Only the named function\n * fragments go into the policy, which keeps the grant small.\n *\n * @example\n * const policies = buildKernelSessionPolicies({\n *   calls: [{ target: tapScore, abi: tapScoreAbi, functionName: \"tap\" }],\n *   validUntil: Math.floor(Date.now() / 1000) + 900,\n * });\n */\nexport function buildKernelSessionPolicies(p: {\n  calls: readonly KernelSessionCall[];\n  validUntil: number;\n  validAfter?: number;\n}): Policy[] {\n  assertCalls(p.calls);\n  return [\n    toCallPolicy({\n      policyVersion: CallPolicyVersion.V0_0_4,\n      permissions: p.calls.map((c) => ({\n        target: c.target,\n        valueLimit: c.valueLimit ?? 0n,\n        abi: [findFunction(c)] as Abi,\n        functionName: c.functionName,\n      })),\n    } as Parameters<typeof toCallPolicy>[0]),\n    toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil }),\n  ];\n}\n\n/**\n * A fresh random session key. SERVER ONLY: the private key must never reach\n * the browser. Only the address is sent to the owner for approval.\n *\n * @example\n * const { privateKey, address } = generateSessionKey();\n */\nexport function generateSessionKey(): { privateKey: Hex; address: Address } {\n  const privateKey = generatePrivateKey();\n  return { privateKey, address: privateKeyToAccount(privateKey).address };\n}\n\nfunction permissionFor(publicClient: PublicClient, sessionKeyAddress: Address, policies: Policy[]) {\n  return toPermissionValidator(zd(publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    signer: toEmptyECDSASigner(sessionKeyAddress),\n    policies,\n  });\n}\n\n/**\n * The permission id the chain derives for this session key plus these\n * policies. The server compares it with a browser-supplied approval.\n *\n * @example\n * const permissionId = await expectedPermissionId({ publicClient, sessionKeyAddress, policies });\n */\nexport async function expectedPermissionId(p: {\n  publicClient: PublicClient;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<string> {\n  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const { permissionId } = permission.getPluginSerializationParams();\n  if (!permissionId) throw new Error(\"Could not derive the permission id.\");\n  return permissionId;\n}\n\n/**\n * In the user's browser: the owner (the Privy embedded wallet, the only thing\n * that can authorize a session) signs ONE EIP-712 message that enables a\n * permission validator on their Kernel account. That signature is the whole\n * grant. It names the session key's public address (never its private key)\n * and the policies. The returned `approval` holds no secret: it is the enable\n * signature plus the policy parameters, useless without the session key.\n *\n * @example\n * const { approval, kernelAddress } = await approveKernelSession({\n *   publicClient, owner: walletClient, sessionKeyAddress, policies,\n * });\n */\nexport async function approveKernelSession(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<{ approval: string; kernelAddress: Address }> {\n  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const account = await toPepuKernelAccount({\n    publicClient: p.publicClient,\n    owner: p.owner,\n    plugins: { regular },\n  });\n  const approval = await serializePermissionAccount(account as never);\n  return { approval, kernelAddress: account.address };\n}\n\n/**\n * On the server: rebuild the session's Kernel account from the approval and\n * the server-held session key (an ECDSA signer for that key). No owner\n * signature is involved. Pass the result to `createPepuSponsoredClient`.\n *\n * @example\n * const account = await loadKernelSessionAccount({ publicClient, approval, sessionPrivateKey });\n */\nexport async function loadKernelSessionAccount(p: {\n  publicClient: PublicClient;\n  approval: string;\n  sessionPrivateKey: Hex;\n}): Promise<KernelSmartAccount> {\n  const sessionSigner = await toECDSASigner({ signer: privateKeyToAccount(p.sessionPrivateKey) });\n  const account = await deserializePermissionAccount(\n    zd(p.publicClient),\n    ENTRY_POINT_V07,\n    KERNEL_VERSION,\n    p.approval,\n    sessionSigner,\n  );\n  return account as unknown as KernelSmartAccount;\n}\n"]}
+{"version":3,"sources":["../src/session/store.ts","../src/session/kernel.ts"],"names":["assertCalls","toCallPolicy","CallPolicyVersion","findFunction","toTimestampPolicy","generatePrivateKey","privateKeyToAccount","toPermissionValidator","ENTRY_POINT_V07","KERNEL_VERSION","toEmptyECDSASigner","toPepuKernelAccount","serializePermissionAccount","toECDSASigner","deserializePermissionAccount"],"mappings":";;;;;;;;;;;AAyDO,SAAS,iBAAA,GAAkC;AAChD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA2B;AAC/C,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,MAAA,KAAW,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,IACnC,GAAA,EAAK,CAAC,MAAA,KAAW;AACf,MAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACvB,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,MAAA,KAAW;AACnB,MAAA,IAAI,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA,EAAG,OAAO,KAAA;AAC9B,MAAA,KAAA,CAAM,IAAI,MAAM,CAAA;AAChB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,MAAA,KAAW;AAClB,MAAA,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAQO,SAAS,MAAA,CAAO,QAAuB,UAAA,EAA6B;AACzE,EAAA,OAAO,MAAA,CAAO,QAAA,KAAa,IAAA,IAAQ,UAAA,GAAa,MAAA,CAAO,UAAA;AACzD;;;ACvCO,IAAM,0BAAA,GAAsC;AAE5C,IAAM,wBAAA,GAAoC;AAW1C,IAAM,4BAAA,GAA+B,EAAE,cAAA,EAAgB,IAAA,EAAM,gBAAgB,GAAA;AAKpF,SAAS,GAAG,MAAA,EAAqC;AAC/C,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,2BAA2B,CAAA,EAI9B;AACX,EAAAA,6BAAA,CAAY,EAAE,KAAK,CAAA;AACnB,EAAA,OAAO;AAAA,IACLC,qBAAA,CAAa;AAAA,MACX,eAAeC,0BAAA,CAAkB,MAAA;AAAA,MACjC,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAC/B,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAA,EAAY,EAAE,UAAA,IAAc,EAAA;AAAA,QAC5B,GAAA,EAAK,CAACC,8BAAA,CAAa,CAAC,CAAC,CAAA;AAAA,QACrB,cAAc,CAAA,CAAE;AAAA,OAClB,CAAE;AAAA,KACmC,CAAA;AAAA,IACvCC,0BAAA,CAAkB,EAAE,UAAA,EAAY,CAAA,CAAE,cAAc,CAAA,EAAG,UAAA,EAAY,CAAA,CAAE,UAAA,EAAY;AAAA,GAC/E;AACF;AASO,SAAS,kBAAA,GAA4D;AAC1E,EAAA,MAAM,aAAaC,2BAAA,EAAmB;AACtC,EAAA,OAAO,EAAE,UAAA,EAAY,OAAA,EAASC,4BAAA,CAAoB,UAAU,EAAE,OAAA,EAAQ;AACxE;AAEA,SAAS,aAAA,CAAc,YAAA,EAA4B,iBAAA,EAA4B,QAAA,EAAoB;AACjG,EAAA,OAAOC,iCAAA,CAAsB,EAAA,CAAG,YAAY,CAAA,EAAG;AAAA,IAC7C,UAAA,EAAYC,iCAAA;AAAA,IACZ,aAAA,EAAeC,gCAAA;AAAA,IACf,MAAA,EAAQC,2BAAmB,iBAAiB,CAAA;AAAA,IAC5C;AAAA,GACD,CAAA;AACH;AASA,eAAsB,qBAAqB,CAAA,EAIvB;AAClB,EAAA,MAAM,UAAA,GAAa,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACtF,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,UAAA,CAAW,4BAAA,EAA6B;AACjE,EAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACxE,EAAA,OAAO,YAAA;AACT;AAeA,eAAsB,qBAAqB,CAAA,EAKe;AACxD,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,CAAA,CAAE,cAAc,CAAA,CAAE,iBAAA,EAAmB,EAAE,QAAQ,CAAA;AACnF,EAAA,MAAM,OAAA,GAAU,MAAMC,qCAAA,CAAoB;AAAA,IACxC,cAAc,CAAA,CAAE,YAAA;AAAA,IAChB,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,OAAA,EAAS,EAAE,OAAA;AAAQ,GACpB,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAMC,sCAAA,CAA2B,OAAgB,CAAA;AAClE,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,OAAA,CAAQ,OAAA,EAAQ;AACpD;AAUA,eAAsB,yBAAyB,CAAA,EAIf;AAC9B,EAAA,MAAM,aAAA,GAAgB,MAAMC,qBAAA,CAAc,EAAE,QAAQP,4BAAA,CAAoB,CAAA,CAAE,iBAAiB,CAAA,EAAG,CAAA;AAC9F,EAAA,MAAM,UAAU,MAAMQ,wCAAA;AAAA,IACpB,EAAA,CAAG,EAAE,YAAY,CAAA;AAAA,IACjBN,iCAAA;AAAA,IACAC,gCAAA;AAAA,IACA,CAAA,CAAE,QAAA;AAAA,IACF;AAAA,GACF;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-4L4CHIXE.cjs","sourcesContent":["import type { Address, Hex } from \"viem\";\n\n/**\n * Server-side session records for the Kernel (on-chain) session flow, keyed by\n * Privy user id. Ported from templates/sponsored-session-app/lib/session-store.ts.\n *\n * WHAT IS STORED: the session private key (a hot key whose power is limited\n * ON-CHAIN by the call and timestamp policies until `validUntil`) and the\n * public approval. The owner's key never reaches the server.\n *\n * PRODUCTION: {@link createMemoryStore} is DEV-GRADE. It is lost on every\n * restart (the user simply starts a new session) and is not shared between\n * serverless instances. A production deployment must implement\n * {@link SessionStore} on a persistent database or KV AND keep\n * `sessionPrivateKey` encrypted at rest (KMS or an envelope key). Nothing else\n * in the SDK changes.\n */\nexport interface SessionRecord {\n  userId: string;\n  ownerAddress: Address;\n  kernelAddress: Address;\n  /** The session key's private half. Encrypt it at rest in any persistent store. */\n  sessionPrivateKey: Hex;\n  sessionKeyAddress: Address;\n  permissionId: string;\n  /** Unix seconds. The on-chain permission is invalid at and after this time. */\n  validUntil: number;\n  /** Present once the owner has signed the grant. */\n  approval: string | null;\n  /** Number of successful sponsored actions in this session. */\n  actions: number;\n}\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * Pluggable storage for {@link SessionRecord}s. Every method may be sync or\n * async. `tryLock` must be atomic per user: it returns `false` when an action\n * is already running for that user (a multi-instance deployment needs a\n * distributed lock, for example a Redis `SET NX PX`).\n */\nexport interface SessionStore {\n  get(userId: string): MaybePromise<SessionRecord | undefined>;\n  set(record: SessionRecord): MaybePromise<void>;\n  delete(userId: string): MaybePromise<void>;\n  tryLock(userId: string): MaybePromise<boolean>;\n  unlock(userId: string): MaybePromise<void>;\n}\n\n/**\n * An in-memory {@link SessionStore} for development and tests. DEV-GRADE: not\n * persistent, not shared across instances, and the session key is held in\n * plaintext in process memory. Production needs an encrypted persistent store.\n *\n * @example\n * const store = createMemoryStore();\n */\nexport function createMemoryStore(): SessionStore {\n  const records = new Map<string, SessionRecord>();\n  const locks = new Set<string>();\n  return {\n    get: (userId) => records.get(userId),\n    set: (record) => {\n      records.set(record.userId, record);\n    },\n    delete: (userId) => {\n      records.delete(userId);\n    },\n    tryLock: (userId) => {\n      if (locks.has(userId)) return false;\n      locks.add(userId);\n      return true;\n    },\n    unlock: (userId) => {\n      locks.delete(userId);\n    },\n  };\n}\n\n/**\n * True while the on-chain permission is still valid: approved and before expiry.\n *\n * @example\n * isLive(record, Math.floor(Date.now() / 1000));\n */\nexport function isLive(record: SessionRecord, nowSeconds: number): boolean {\n  return record.approval !== null && nowSeconds < record.validUntil;\n}\n","import { deserializePermissionAccount, serializePermissionAccount, toPermissionValidator } from \"@zerodev/permissions\";\nimport type { Policy } from \"@zerodev/permissions\";\nimport { CallPolicyVersion, toCallPolicy, toTimestampPolicy } from \"@zerodev/permissions/policies\";\nimport { toECDSASigner, toEmptyECDSASigner } from \"@zerodev/permissions/signers\";\nimport type { createKernelAccount } from \"@zerodev/sdk\";\nimport type { Abi, Address, Hex, PublicClient } from \"viem\";\nimport { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";\n\nimport { ENTRY_POINT_V07 } from \"../aa/clients.js\";\nimport { KERNEL_VERSION, toPepuKernelAccount } from \"../aa/kernel.js\";\nimport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nimport { assertCalls, findFunction } from \"./scope.js\";\nimport type { KernelSessionCall } from \"./scope.js\";\n\nexport { KERNEL_VERSION, getKernelAddress } from \"../aa/kernel.js\";\nexport type { KernelOwner, KernelSmartAccount } from \"../aa/kernel.js\";\nexport { createMemoryStore, isLive } from \"./store.js\";\nexport type { SessionRecord, SessionStore } from \"./store.js\";\nexport { checkApproval, describeKernelSessionScope, isCallInScope, parseApproval } from \"./scope.js\";\nexport type { ApprovalCheck, KernelSessionCall, KernelSessionScope, ParsedApproval } from \"./scope.js\";\n\n/**\n * `@pepu-chain/sdk/session/kernel`: on-chain session keys with ZeroDev Kernel\n * permissions. Extracted from templates/sponsored-session-app/lib/{kernel,\n * session-policy,approval}.ts and built on `toPepuKernelAccount`\n * (`plugins.regular`).\n *\n * The scope is enforced ON-CHAIN by ZeroDev's policy contracts, which the\n * user's Kernel account calls during UserOperation validation:\n *\n * - Call policy v0.0.4: only the listed targets and function selectors, with a\n *   native value no larger than `valueLimit` (default 0).\n * - Timestamp policy: the permission is invalid outside `validAfter`..`validUntil`.\n *\n * A UserOperation outside this scope is rejected by the EntryPoint itself, no\n * matter who relays it or what the app backend does.\n *\n * Deployed on PEPU mainnet (eth_getCode verified 2026-10-02): Kernel v3.1\n * factory 0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419, ECDSA validator\n * 0x845ADb2C711129d4f3966735eD98a9F09fC4cE57, ECDSA signer module\n * 0x6A6F069E2a08c2468e7724Ab3250CdBFBA14D4FF, call policy v0.0.4 and the\n * timestamp policy below. Call policy v0.0.5 is NOT deployed on PEPU, so the\n * version is pinned.\n *\n * Optional peers: `@zerodev/sdk`, `@zerodev/permissions`, `@zerodev/ecdsa-validator`.\n */\n\n/** Call policy v0.0.4. Pinned: v0.0.5 is not deployed on PEPU mainnet. */\nexport const CALL_POLICY_V0_0_4_ADDRESS: Address = \"0x9a52283276A0ec8740DF50bF01B28A80D880eaf2\";\n/** ZeroDev timestamp policy on PEPU mainnet. */\nexport const TIMESTAMP_POLICY_ADDRESS: Address = \"0xB9f8f524bE6EcD8C945b1b87f9ae5C192FdCE20F\";\n\n/**\n * Worst-case gas the paymaster policy service RESERVES per sponsored operation,\n * measured on PEPU mainnet with the sponsored-session-app template: the first\n * operation of a session (account deploy plus enabling the permission) about\n * 20.5 PEPU, later operations about 6.9 PEPU. The real first-session cost was\n * about 12.8 PEPU for two operations. Size per-user hourly and daily spend\n * caps above these, or users hit `trailing-hour spend ... would exceed cap`\n * after their first action.\n */\nexport const SESSION_GAS_RESERVATION_PEPU = { firstOperation: 20.5, laterOperation: 6.9 } as const;\n\ntype ZeroDevClient = Parameters<typeof createKernelAccount>[0];\n\n/** Type-level bridge for ZeroDev's own viem copy (same object at runtime). */\nfunction zd(client: PublicClient): ZeroDevClient {\n  return client as unknown as ZeroDevClient;\n}\n\n/**\n * The on-chain policies for one session: call policy v0.0.4 plus the timestamp\n * policy. Pure and deterministic given its input. Only the named function\n * fragments go into the policy, which keeps the grant small.\n *\n * @example\n * const policies = buildKernelSessionPolicies({\n *   calls: [{ target: tapScore, abi: tapScoreAbi, functionName: \"tap\" }],\n *   validUntil: Math.floor(Date.now() / 1000) + 900,\n * });\n */\nexport function buildKernelSessionPolicies(p: {\n  calls: readonly KernelSessionCall[];\n  validUntil: number;\n  validAfter?: number;\n}): Policy[] {\n  assertCalls(p.calls);\n  return [\n    toCallPolicy({\n      policyVersion: CallPolicyVersion.V0_0_4,\n      permissions: p.calls.map((c) => ({\n        target: c.target,\n        valueLimit: c.valueLimit ?? 0n,\n        abi: [findFunction(c)] as Abi,\n        functionName: c.functionName,\n      })),\n    } as Parameters<typeof toCallPolicy>[0]),\n    toTimestampPolicy({ validAfter: p.validAfter ?? 0, validUntil: p.validUntil }),\n  ];\n}\n\n/**\n * A fresh random session key. SERVER ONLY: the private key must never reach\n * the browser. Only the address is sent to the owner for approval.\n *\n * @example\n * const { privateKey, address } = generateSessionKey();\n */\nexport function generateSessionKey(): { privateKey: Hex; address: Address } {\n  const privateKey = generatePrivateKey();\n  return { privateKey, address: privateKeyToAccount(privateKey).address };\n}\n\nfunction permissionFor(publicClient: PublicClient, sessionKeyAddress: Address, policies: Policy[]) {\n  return toPermissionValidator(zd(publicClient), {\n    entryPoint: ENTRY_POINT_V07,\n    kernelVersion: KERNEL_VERSION,\n    signer: toEmptyECDSASigner(sessionKeyAddress),\n    policies,\n  });\n}\n\n/**\n * The permission id the chain derives for this session key plus these\n * policies. The server compares it with a browser-supplied approval.\n *\n * @example\n * const permissionId = await expectedPermissionId({ publicClient, sessionKeyAddress, policies });\n */\nexport async function expectedPermissionId(p: {\n  publicClient: PublicClient;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<string> {\n  const permission = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const { permissionId } = permission.getPluginSerializationParams();\n  if (!permissionId) throw new Error(\"Could not derive the permission id.\");\n  return permissionId;\n}\n\n/**\n * In the user's browser: the owner (the Privy embedded wallet, the only thing\n * that can authorize a session) signs ONE EIP-712 message that enables a\n * permission validator on their Kernel account. That signature is the whole\n * grant. It names the session key's public address (never its private key)\n * and the policies. The returned `approval` holds no secret: it is the enable\n * signature plus the policy parameters, useless without the session key.\n *\n * @example\n * const { approval, kernelAddress } = await approveKernelSession({\n *   publicClient, owner: walletClient, sessionKeyAddress, policies,\n * });\n */\nexport async function approveKernelSession(p: {\n  publicClient: PublicClient;\n  owner: KernelOwner;\n  sessionKeyAddress: Address;\n  policies: Policy[];\n}): Promise<{ approval: string; kernelAddress: Address }> {\n  const regular = await permissionFor(p.publicClient, p.sessionKeyAddress, p.policies);\n  const account = await toPepuKernelAccount({\n    publicClient: p.publicClient,\n    owner: p.owner,\n    plugins: { regular },\n  });\n  const approval = await serializePermissionAccount(account as never);\n  return { approval, kernelAddress: account.address };\n}\n\n/**\n * On the server: rebuild the session's Kernel account from the approval and\n * the server-held session key (an ECDSA signer for that key). No owner\n * signature is involved. Pass the result to `createPepuSponsoredClient`.\n *\n * @example\n * const account = await loadKernelSessionAccount({ publicClient, approval, sessionPrivateKey });\n */\nexport async function loadKernelSessionAccount(p: {\n  publicClient: PublicClient;\n  approval: string;\n  sessionPrivateKey: Hex;\n}): Promise<KernelSmartAccount> {\n  const sessionSigner = await toECDSASigner({ signer: privateKeyToAccount(p.sessionPrivateKey) });\n  const account = await deserializePermissionAccount(\n    zd(p.publicClient),\n    ENTRY_POINT_V07,\n    KERNEL_VERSION,\n    p.approval,\n    sessionSigner,\n  );\n  return account as unknown as KernelSmartAccount;\n}\n"]}