@shroud-fi/self-host-relayer 0.1.0

package/dist/cjs/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/cjs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}

package/dist/esm/dev-entry.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Dev entry: reads config from env vars and starts the server.
+ *
+ * Required env:
+ *   SHROUDFI_RELAYER_CONTRACT       - deployed ShroudFiRelayer address
+ *   SHROUDFI_RELAYER_FORWARDER_KEY  - 0x-prefixed 32-byte forwarder EOA key
+ *   SHROUDFI_RELAYER_RPC_URL        - chain RPC URL
+ *
+ * Optional env:
+ *   SHROUDFI_RELAYER_CHAIN_ID       - default 84532
+ *   SHROUDFI_RELAYER_PORT           - default 8787
+ *   SHROUDFI_RELAYER_ORIGINS        - comma-sep allowed origins (default localhost demo)
+ *   SHROUDFI_RELAYER_RATE_LIMIT     - per-IP requests per minute (default 30)
+ *   SHROUDFI_ETH_RELAYER_CONTRACT   - deployed ShroudFiEthRelayer address.
+ *                                     When set, /relay-eth becomes active for
+ *                                     gasless ETH sweeps via EIP-7702. When
+ *                                     unset, /relay-eth returns 501.
+ *
+ * Privacy: this file is the ONLY place that touches process.env for the
+ * forwarder key. Once read, the key flows into a viem account closure inside
+ * the server and never resurfaces.
+ */
+export {};
+//# sourceMappingURL=dev-entry.d.ts.map

package/dist/esm/dev-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-entry.d.ts","sourceRoot":"","sources":["../../src/dev-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG"}

package/dist/esm/dev-entry.js

@@ -0,0 +1,73 @@
+/**
+ * Dev entry: reads config from env vars and starts the server.
+ *
+ * Required env:
+ *   SHROUDFI_RELAYER_CONTRACT       - deployed ShroudFiRelayer address
+ *   SHROUDFI_RELAYER_FORWARDER_KEY  - 0x-prefixed 32-byte forwarder EOA key
+ *   SHROUDFI_RELAYER_RPC_URL        - chain RPC URL
+ *
+ * Optional env:
+ *   SHROUDFI_RELAYER_CHAIN_ID       - default 84532
+ *   SHROUDFI_RELAYER_PORT           - default 8787
+ *   SHROUDFI_RELAYER_ORIGINS        - comma-sep allowed origins (default localhost demo)
+ *   SHROUDFI_RELAYER_RATE_LIMIT     - per-IP requests per minute (default 30)
+ *   SHROUDFI_ETH_RELAYER_CONTRACT   - deployed ShroudFiEthRelayer address.
+ *                                     When set, /relay-eth becomes active for
+ *                                     gasless ETH sweeps via EIP-7702. When
+ *                                     unset, /relay-eth returns 501.
+ *
+ * Privacy: this file is the ONLY place that touches process.env for the
+ * forwarder key. Once read, the key flows into a viem account closure inside
+ * the server and never resurfaces.
+ */
+import { startServer } from './server.js';
+import { RelayConfigError } from './errors.js';
+function envOrThrow(name) {
+    const v = process.env[name];
+    if (v === undefined || v.trim().length === 0) {
+        throw new RelayConfigError(name);
+    }
+    return v.trim();
+}
+function loadConfig() {
+    const chainId = Number(process.env.SHROUDFI_RELAYER_CHAIN_ID?.trim() ?? '84532');
+    const port = Number(process.env.SHROUDFI_RELAYER_PORT?.trim() ?? '8787');
+    const rateLimitPerMinute = Number(process.env.SHROUDFI_RELAYER_RATE_LIMIT?.trim() ?? '30');
+    const originsCsv = process.env.SHROUDFI_RELAYER_ORIGINS?.trim() ??
+        'http://localhost:3000,http://localhost:3001,http://localhost:3002,http://localhost:3003,http://localhost:3005,http://localhost:3006,http://localhost:3008,http://localhost:3009,http://127.0.0.1:3005,http://127.0.0.1:3009';
+    const allowedOrigins = originsCsv
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    const ethRelayerRaw = process.env.SHROUDFI_ETH_RELAYER_CONTRACT?.trim();
+    const ethRelayerContract = ethRelayerRaw !== undefined && ethRelayerRaw.length > 0
+        ? ethRelayerRaw
+        : undefined;
+    const base = {
+        chainId,
+        port,
+        rateLimitPerMinute,
+        allowedOrigins,
+        relayerContract: envOrThrow('SHROUDFI_RELAYER_CONTRACT'),
+        rpcUrl: envOrThrow('SHROUDFI_RELAYER_RPC_URL'),
+        forwarderPrivateKey: envOrThrow('SHROUDFI_RELAYER_FORWARDER_KEY'),
+    };
+    return ethRelayerContract === undefined
+        ? base
+        : { ...base, ethRelayerContract };
+}
+async function main() {
+    const cfg = loadConfig();
+    await startServer(cfg);
+    // Print a single line so the operator knows the service is up. NO key,
+    // NO RPC URL, NO contract address (those are public but we keep the
+    // surface minimal — they can be queried via /health).
+    // eslint-disable-next-line no-console
+    console.log(`self-host-relayer listening on http://127.0.0.1:${cfg.port} (chain ${cfg.chainId})`);
+}
+void main().catch((err) => {
+    // eslint-disable-next-line no-console
+    console.error(err instanceof Error ? err.name : 'StartupError');
+    process.exit(1);
+});
+//# sourceMappingURL=dev-entry.js.map

package/dist/esm/dev-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-entry.js","sourceRoot":"","sources":["../../src/dev-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI/C,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,MAAM,CACpB,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,OAAO,CACzD,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC;IACzE,MAAM,kBAAkB,GAAG,MAAM,CAC/B,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,IAAI,CACxD,CAAC;IACF,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;QAC5C,6NAA6N,CAAC;IAChO,MAAM,cAAc,GAAG,UAAU;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/B,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,kBAAkB,GACtB,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAE,aAAyB;QAC5B,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,IAAI,GAAG;QACX,OAAO;QACP,IAAI;QACJ,kBAAkB;QAClB,cAAc;QACd,eAAe,EAAE,UAAU,CAAC,2BAA2B,CAAY;QACnE,MAAM,EAAE,UAAU,CAAC,0BAA0B,CAAC;QAC9C,mBAAmB,EAAE,UAAU,CAC7B,gCAAgC,CAC1B;KACT,CAAC;IACF,OAAO,kBAAkB,KAAK,SAAS;QACrC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACvB,uEAAuE;IACvE,oEAAoE;IACpE,sDAAsD;IACtD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CACT,mDAAmD,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,OAAO,GAAG,CACrF,CAAC;AACJ,CAAC;AAED,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACjC,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/esm/errors.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Privacy-safe errors for @shroud-fi/self-host-relayer.
+ *
+ * Invariants mirrored from other packages:
+ *   - No key bytes in messages
+ *   - No amount values in messages
+ *   - No private signature bytes in messages
+ */
+export declare class SelfHostRelayerError extends Error {
+    readonly name: string;
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class InvalidRelayRequestError extends SelfHostRelayerError {
+    readonly name: string;
+    constructor();
+}
+export declare class RelayBroadcastError extends SelfHostRelayerError {
+    readonly name: string;
+    constructor(underlyingName?: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class RelayConfigError extends SelfHostRelayerError {
+    readonly name: string;
+    constructor(field: string);
+}
+export declare class InvalidRelayEthRequestError extends SelfHostRelayerError {
+    readonly name: string;
+    constructor();
+}
+export declare class EthRelayerNotConfiguredError extends SelfHostRelayerError {
+    readonly name: string;
+    constructor();
+}
+export declare class AuthorizationContractMismatchError extends SelfHostRelayerError {
+    readonly name: string;
+    constructor();
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/esm/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,EAAE,MAAM,CAA0B;gBAC5C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,qBAAa,wBAAyB,SAAQ,oBAAoB;IAChE,SAAkB,IAAI,EAAE,MAAM,CAA8B;;CAI7D;AAED,qBAAa,mBAAoB,SAAQ,oBAAoB;IAC3D,SAAkB,IAAI,EAAE,MAAM,CAAyB;gBAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQnE;AAED,qBAAa,gBAAiB,SAAQ,oBAAoB;IACxD,SAAkB,IAAI,EAAE,MAAM,CAAsB;gBACxC,KAAK,EAAE,MAAM;CAG1B;AAED,qBAAa,2BAA4B,SAAQ,oBAAoB;IACnE,SAAkB,IAAI,EAAE,MAAM,CAAiC;;CAIhE;AAED,qBAAa,4BAA6B,SAAQ,oBAAoB;IACpE,SAAkB,IAAI,EAAE,MAAM,CAAkC;;CAIjE;AAED,qBAAa,kCAAmC,SAAQ,oBAAoB;IAC1E,SAAkB,IAAI,EAAE,MAAM,CAAwC;;CAIvE"}

package/dist/esm/errors.js

@@ -0,0 +1,53 @@
+/**
+ * Privacy-safe errors for @shroud-fi/self-host-relayer.
+ *
+ * Invariants mirrored from other packages:
+ *   - No key bytes in messages
+ *   - No amount values in messages
+ *   - No private signature bytes in messages
+ */
+export class SelfHostRelayerError extends Error {
+    name = 'SelfHostRelayerError';
+    constructor(message, options) {
+        super(message, options);
+    }
+}
+export class InvalidRelayRequestError extends SelfHostRelayerError {
+    name = 'InvalidRelayRequestError';
+    constructor() {
+        super('Relay request body failed validation');
+    }
+}
+export class RelayBroadcastError extends SelfHostRelayerError {
+    name = 'RelayBroadcastError';
+    constructor(underlyingName, options) {
+        super(underlyingName !== undefined
+            ? `Broadcast failed (${underlyingName})`
+            : 'Broadcast failed', options);
+    }
+}
+export class RelayConfigError extends SelfHostRelayerError {
+    name = 'RelayConfigError';
+    constructor(field) {
+        super(`Relayer config missing required field: ${field}`);
+    }
+}
+export class InvalidRelayEthRequestError extends SelfHostRelayerError {
+    name = 'InvalidRelayEthRequestError';
+    constructor() {
+        super('Relay ETH request body failed validation');
+    }
+}
+export class EthRelayerNotConfiguredError extends SelfHostRelayerError {
+    name = 'EthRelayerNotConfiguredError';
+    constructor() {
+        super('ETH relayer contract address not configured');
+    }
+}
+export class AuthorizationContractMismatchError extends SelfHostRelayerError {
+    name = 'AuthorizationContractMismatchError';
+    constructor() {
+        super('EIP-7702 authorization address does not match configured ETH relayer');
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/esm/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAW,sBAAsB,CAAC;IACxD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,oBAAoB;IAC9C,IAAI,GAAW,0BAA0B,CAAC;IAC5D;QACE,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChD,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,oBAAoB;IACzC,IAAI,GAAW,qBAAqB,CAAC;IACvD,YAAY,cAAuB,EAAE,OAA6B;QAChE,KAAK,CACH,cAAc,KAAK,SAAS;YAC1B,CAAC,CAAC,qBAAqB,cAAc,GAAG;YACxC,CAAC,CAAC,kBAAkB,EACtB,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,oBAAoB;IACtC,IAAI,GAAW,kBAAkB,CAAC;IACpD,YAAY,KAAa;QACvB,KAAK,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,oBAAoB;IACjD,IAAI,GAAW,6BAA6B,CAAC;IAC/D;QACE,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,oBAAoB;IAClD,IAAI,GAAW,8BAA8B,CAAC;IAChE;QACE,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACvD,CAAC;CACF;AAED,MAAM,OAAO,kCAAmC,SAAQ,oBAAoB;IACxD,IAAI,GAAW,oCAAoC,CAAC;IACtE;QACE,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/esm/index.d.ts

@@ -0,0 +1,8 @@
+export { buildServer, startServer } from './server.js';
+export { buildRelayCalldata, relayRequest } from './relay.js';
+export type { RelayCtx, RelayResult } from './relay.js';
+export { buildEthSweepCalldata, relayEthRequest, } from './relay-eth.js';
+export type { RelayEthCtx, RelayEthResult } from './relay-eth.js';
+export type { RelayRequest, RelayResponse, RelaySuccess, RelayFailure, ServiceConfig, RelayEthRequest, } from './types.js';
+export { SelfHostRelayerError, InvalidRelayRequestError, RelayBroadcastError, RelayConfigError, InvalidRelayEthRequestError, EthRelayerNotConfiguredError, AuthorizationContractMismatchError, } from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EACL,qBAAqB,EACrB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,2BAA2B,EAC3B,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,aAAa,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,10 @@
+// Public surface — @shroud-fi/self-host-relayer
+//
+// Exports the server builder + the pure relay-logic helpers so the same
+// package can be embedded in another Node process or run standalone via
+// `pnpm dev`.
+export { buildServer, startServer } from './server.js';
+export { buildRelayCalldata, relayRequest } from './relay.js';
+export { buildEthSweepCalldata, relayEthRequest, } from './relay-eth.js';
+export { SelfHostRelayerError, InvalidRelayRequestError, RelayBroadcastError, RelayConfigError, InvalidRelayEthRequestError, EthRelayerNotConfiguredError, AuthorizationContractMismatchError, } from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,cAAc;AAEd,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,EACL,qBAAqB,EACrB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,2BAA2B,EAC3B,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,aAAa,CAAC"}

package/dist/esm/prod-entry.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Production entry: strict env, fail-fast on missing required values, no
+ * permissive defaults that could mask misconfiguration in deployment.
+ *
+ * Required env (no defaults — startup fails if any are missing):
+ *   SHROUDFI_RELAYER_CONTRACT       - deployed ShroudFiRelayer address
+ *   SHROUDFI_RELAYER_FORWARDER_KEY  - 0x-prefixed 32-byte forwarder EOA key
+ *   SHROUDFI_RELAYER_RPC_URL        - chain RPC URL
+ *   SHROUDFI_RELAYER_ORIGINS        - comma-sep allowed origins (e.g. https://app.shroudfi.live)
+ *   SHROUDFI_RELAYER_CHAIN_ID       - chain id (84532 = Base Sepolia, 8453 = Base)
+ *   SHROUDFI_RELAYER_PORT           - bind port (typically 8789 on droplet)
+ *
+ * Optional env:
+ *   SHROUDFI_RELAYER_RATE_LIMIT     - per-IP requests per minute (default 30)
+ *   SHROUDFI_ETH_RELAYER_CONTRACT   - deployed ShroudFiEthRelayer address.
+ *                                     When set, /relay-eth becomes active for
+ *                                     gasless ETH sweeps via EIP-7702. When
+ *                                     unset, /relay-eth returns 501.
+ *   DEBUG_DIAGNOSTICS               - "1" to enable per-request preflight + sig recovery logs
+ *
+ * Differences from dev-entry.ts:
+ *   - Every required field uses envOrThrow; no fallbacks
+ *   - SHROUDFI_RELAYER_ORIGINS is REQUIRED (dev defaults to localhost; prod must be explicit)
+ *   - No startup log line printed to stdout — only journald via PM2 captures fastify's
+ *     own "Server listening at ..." line
+ *   - DEBUG_DIAGNOSTICS env opts into the per-request debug logs (off by default)
+ *
+ * Privacy: this file is the ONLY place that touches process.env for the
+ * forwarder key. Once read, the key flows into a viem account closure inside
+ * the server and never resurfaces.
+ */
+export {};
+//# sourceMappingURL=prod-entry.d.ts.map

package/dist/esm/prod-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prod-entry.d.ts","sourceRoot":"","sources":["../../src/prod-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG"}

package/dist/esm/prod-entry.js

@@ -0,0 +1,96 @@
+/**
+ * Production entry: strict env, fail-fast on missing required values, no
+ * permissive defaults that could mask misconfiguration in deployment.
+ *
+ * Required env (no defaults — startup fails if any are missing):
+ *   SHROUDFI_RELAYER_CONTRACT       - deployed ShroudFiRelayer address
+ *   SHROUDFI_RELAYER_FORWARDER_KEY  - 0x-prefixed 32-byte forwarder EOA key
+ *   SHROUDFI_RELAYER_RPC_URL        - chain RPC URL
+ *   SHROUDFI_RELAYER_ORIGINS        - comma-sep allowed origins (e.g. https://app.shroudfi.live)
+ *   SHROUDFI_RELAYER_CHAIN_ID       - chain id (84532 = Base Sepolia, 8453 = Base)
+ *   SHROUDFI_RELAYER_PORT           - bind port (typically 8789 on droplet)
+ *
+ * Optional env:
+ *   SHROUDFI_RELAYER_RATE_LIMIT     - per-IP requests per minute (default 30)
+ *   SHROUDFI_ETH_RELAYER_CONTRACT   - deployed ShroudFiEthRelayer address.
+ *                                     When set, /relay-eth becomes active for
+ *                                     gasless ETH sweeps via EIP-7702. When
+ *                                     unset, /relay-eth returns 501.
+ *   DEBUG_DIAGNOSTICS               - "1" to enable per-request preflight + sig recovery logs
+ *
+ * Differences from dev-entry.ts:
+ *   - Every required field uses envOrThrow; no fallbacks
+ *   - SHROUDFI_RELAYER_ORIGINS is REQUIRED (dev defaults to localhost; prod must be explicit)
+ *   - No startup log line printed to stdout — only journald via PM2 captures fastify's
+ *     own "Server listening at ..." line
+ *   - DEBUG_DIAGNOSTICS env opts into the per-request debug logs (off by default)
+ *
+ * Privacy: this file is the ONLY place that touches process.env for the
+ * forwarder key. Once read, the key flows into a viem account closure inside
+ * the server and never resurfaces.
+ */
+import { startServer } from './server.js';
+import { RelayConfigError } from './errors.js';
+function envOrThrow(name) {
+    const v = process.env[name];
+    if (v === undefined || v.trim().length === 0) {
+        throw new RelayConfigError(name);
+    }
+    return v.trim();
+}
+function loadConfig() {
+    const chainId = Number(envOrThrow('SHROUDFI_RELAYER_CHAIN_ID'));
+    if (!Number.isFinite(chainId) || chainId <= 0) {
+        throw new RelayConfigError('SHROUDFI_RELAYER_CHAIN_ID');
+    }
+    const port = Number(envOrThrow('SHROUDFI_RELAYER_PORT'));
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new RelayConfigError('SHROUDFI_RELAYER_PORT');
+    }
+    const rateLimitRaw = process.env.SHROUDFI_RELAYER_RATE_LIMIT?.trim();
+    const rateLimitPerMinute = rateLimitRaw && rateLimitRaw.length > 0 ? Number(rateLimitRaw) : 30;
+    if (!Number.isFinite(rateLimitPerMinute) || rateLimitPerMinute <= 0) {
+        throw new RelayConfigError('SHROUDFI_RELAYER_RATE_LIMIT');
+    }
+    const originsCsv = envOrThrow('SHROUDFI_RELAYER_ORIGINS');
+    const allowedOrigins = originsCsv
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    if (allowedOrigins.length === 0) {
+        throw new RelayConfigError('SHROUDFI_RELAYER_ORIGINS');
+    }
+    const debugDiagnostics = process.env.DEBUG_DIAGNOSTICS === '1';
+    const ethRelayerRaw = process.env.SHROUDFI_ETH_RELAYER_CONTRACT?.trim();
+    const ethRelayerContract = ethRelayerRaw !== undefined && ethRelayerRaw.length > 0
+        ? ethRelayerRaw
+        : undefined;
+    const base = {
+        chainId,
+        port,
+        rateLimitPerMinute,
+        allowedOrigins,
+        relayerContract: envOrThrow('SHROUDFI_RELAYER_CONTRACT'),
+        rpcUrl: envOrThrow('SHROUDFI_RELAYER_RPC_URL'),
+        forwarderPrivateKey: envOrThrow('SHROUDFI_RELAYER_FORWARDER_KEY'),
+        debugDiagnostics,
+    };
+    return ethRelayerContract === undefined
+        ? base
+        : { ...base, ethRelayerContract };
+}
+async function main() {
+    const cfg = loadConfig();
+    await startServer(cfg);
+    // Intentionally no stdout — Fastify's logger already emits a "Server
+    // listening at ..." line that PM2/journald captures. Avoid extra surface.
+}
+void main().catch((err) => {
+    // Startup failure → emit only the error class name to stderr, then exit 1.
+    // PM2 will record this and (per ecosystem config) attempt restart up to
+    // max_restarts before giving up.
+    // eslint-disable-next-line no-console
+    console.error(err instanceof Error ? err.name : 'StartupError');
+    process.exit(1);
+});
+//# sourceMappingURL=prod-entry.js.map

package/dist/esm/prod-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prod-entry.js","sourceRoot":"","sources":["../../src/prod-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI/C,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACrE,MAAM,kBAAkB,GACtB,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAC1D,MAAM,cAAc,GAAG,UAAU;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,CAAC;IAE/D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,kBAAkB,GACtB,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAE,aAAyB;QAC5B,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,IAAI,GAAG;QACX,OAAO;QACP,IAAI;QACJ,kBAAkB;QAClB,cAAc;QACd,eAAe,EAAE,UAAU,CAAC,2BAA2B,CAAY;QACnE,MAAM,EAAE,UAAU,CAAC,0BAA0B,CAAC;QAC9C,mBAAmB,EAAE,UAAU,CAC7B,gCAAgC,CAC1B;QACR,gBAAgB;KACjB,CAAC;IACF,OAAO,kBAAkB,KAAK,SAAS;QACrC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACvB,qEAAqE;IACrE,0EAA0E;AAC5E,CAAC;AAED,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACjC,2EAA2E;IAC3E,wEAAwE;IACxE,iCAAiC;IACjC,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/esm/relay-eth.d.ts

@@ -0,0 +1,43 @@
+/**
+ * ETH gasless sweep relay — broadcasts an EIP-7702 type-0x04 tx that delegates
+ * the stealth EOA to ShroudFiEthRelayer and calls sweepETH(destination,
+ * deadline, signature).
+ *
+ * Privacy invariants:
+ *   - Relayer EOA's private key held in the viem account closure. Never
+ *     logged or attached to thrown errors.
+ *   - The EIP-712 signature in the request is a one-time spending
+ *     authorization bound to (destination, deadline, chainId, stealthEOA).
+ *     We pass it through verbatim — never store or re-sign.
+ *   - No amount fields anywhere in the request or response.
+ */
+import { type Account, type Chain, type Hex, type PublicClient, type Transport, type WalletClient } from 'viem';
+import type { RelayEthRequest } from './types.js';
+/**
+ * Same generic-loose shape as RelayCtx. Holds the broadcast-side viem clients
+ * plus the relayer EOA. The relayer EOA pays gas for the outer tx.
+ */
+export interface RelayEthCtx {
+    readonly publicClient: PublicClient<Transport, Chain | undefined>;
+    readonly walletClient: WalletClient<Transport, Chain | undefined, Account>;
+    readonly account: Account;
+}
+export interface RelayEthResult {
+    readonly txHash: Hex;
+    readonly blockNumber: bigint;
+}
+/**
+ * Build the inner sweepETH calldata. The OUTER tx is the type-0x04 transaction
+ * itself which carries the authorization list and the `to: stealthAddress`;
+ * the inner data is what executes once the EOA's code is set to the relayer.
+ */
+export declare function buildEthSweepCalldata(req: RelayEthRequest): Hex;
+/**
+ * Submit the type-0x04 tx and wait for receipt.
+ *
+ * On any viem error we wrap with RelayBroadcastError(name, { cause: err }) so
+ * the server can walk the cause chain and log the actual revert reason
+ * (public on-chain data) without surfacing it to clients.
+ */
+export declare function relayEthRequest(ctx: RelayEthCtx, req: RelayEthRequest): Promise<RelayEthResult>;
+//# sourceMappingURL=relay-eth.d.ts.map

package/dist/esm/relay-eth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-eth.d.ts","sourceRoot":"","sources":["../../src/relay-eth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,GAAG,EACR,KAAK,YAAY,EAEjB,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,MAAM,CAAC;AAEd,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAgBlD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;IAClE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,GAAG,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAmBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,GAAG,GAAG,CAM/D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,cAAc,CAAC,CAyBzB"}

package/dist/esm/relay-eth.js

@@ -0,0 +1,91 @@
+/**
+ * ETH gasless sweep relay — broadcasts an EIP-7702 type-0x04 tx that delegates
+ * the stealth EOA to ShroudFiEthRelayer and calls sweepETH(destination,
+ * deadline, signature).
+ *
+ * Privacy invariants:
+ *   - Relayer EOA's private key held in the viem account closure. Never
+ *     logged or attached to thrown errors.
+ *   - The EIP-712 signature in the request is a one-time spending
+ *     authorization bound to (destination, deadline, chainId, stealthEOA).
+ *     We pass it through verbatim — never store or re-sign.
+ *   - No amount fields anywhere in the request or response.
+ */
+import { encodeFunctionData, } from 'viem';
+import { RelayBroadcastError } from './errors.js';
+const SWEEP_ETH_ABI = [
+    {
+        type: 'function',
+        name: 'sweepETH',
+        stateMutability: 'nonpayable',
+        inputs: [
+            { name: 'destination', type: 'address' },
+            { name: 'deadline', type: 'uint256' },
+            { name: 'signature', type: 'bytes' },
+        ],
+        outputs: [],
+    },
+];
+/**
+ * Reconstruct a viem `SignedAuthorization` from the wire-encoded fields. The
+ * fields are exactly what the SDK serialises in @shroud-fi/relayer's
+ * eth-sweep.ts — `nonce` arrives as a number, `chainId` as a number, `r`/`s`
+ * as 0x-prefixed hex, `yParity` as 0 or 1.
+ */
+function reconstructAuthorization(req) {
+    return {
+        address: req.authorization.address,
+        chainId: req.authorization.chainId,
+        nonce: req.authorization.nonce,
+        r: req.authorization.r,
+        s: req.authorization.s,
+        yParity: req.authorization.yParity,
+    };
+}
+/**
+ * Build the inner sweepETH calldata. The OUTER tx is the type-0x04 transaction
+ * itself which carries the authorization list and the `to: stealthAddress`;
+ * the inner data is what executes once the EOA's code is set to the relayer.
+ */
+export function buildEthSweepCalldata(req) {
+    return encodeFunctionData({
+        abi: SWEEP_ETH_ABI,
+        functionName: 'sweepETH',
+        args: [req.destination, BigInt(req.deadline), req.signature],
+    });
+}
+/**
+ * Submit the type-0x04 tx and wait for receipt.
+ *
+ * On any viem error we wrap with RelayBroadcastError(name, { cause: err }) so
+ * the server can walk the cause chain and log the actual revert reason
+ * (public on-chain data) without surfacing it to clients.
+ */
+export async function relayEthRequest(ctx, req) {
+    const data = buildEthSweepCalldata(req);
+    const authorization = reconstructAuthorization(req);
+    try {
+        const txHash = await ctx.walletClient.sendTransaction({
+            account: ctx.account,
+            chain: ctx.walletClient.chain ?? null,
+            to: req.stealthAddress,
+            data,
+            value: 0n,
+            authorizationList: [authorization],
+        });
+        const receipt = await ctx.publicClient.waitForTransactionReceipt({
+            hash: txHash,
+        });
+        if (receipt.status !== 'success') {
+            throw new RelayBroadcastError('TransactionReverted');
+        }
+        return { txHash, blockNumber: receipt.blockNumber };
+    }
+    catch (err) {
+        if (err instanceof RelayBroadcastError)
+            throw err;
+        const name = err instanceof Error ? err.name : 'UnknownError';
+        throw new RelayBroadcastError(name, { cause: err });
+    }
+}
+//# sourceMappingURL=relay-eth.js.map

package/dist/esm/relay-eth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-eth.js","sourceRoot":"","sources":["../../src/relay-eth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,kBAAkB,GAQnB,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,aAAa,GAAG;IACpB;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,UAAU;QAChB,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;YACxC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;YACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;SACrC;QACD,OAAO,EAAE,EAAE;KACZ;CACO,CAAC;AAiBX;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,GAAoB;IACpD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,OAAO;QAClC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,OAAO;QAClC,KAAK,EAAE,GAAG,CAAC,aAAa,CAAC,KAAK;QAC9B,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACtB,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACtB,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,OAAO;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAoB;IACxD,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,UAAU;QACxB,IAAI,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgB,EAChB,GAAoB;IAEpB,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC;YACpD,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,IAAI;YACrC,EAAE,EAAE,GAAG,CAAC,cAAc;YACtB,IAAI;YACJ,KAAK,EAAE,EAAE;YACT,iBAAiB,EAAE,CAAC,aAAa,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,yBAAyB,CAAC;YAC/D,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB;YAAE,MAAM,GAAG,CAAC;QAClD,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/esm/relay.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Core relay logic. Pure function — given a validated request + viem clients,
+ * encodes the ERC-2771 wrapped calldata and broadcasts via the relayer EOA.
+ *
+ * Privacy invariants:
+ *   - The relayer EOA's private key is held in a viem account closure. It is
+ *     never logged, serialized, or attached to thrown errors.
+ *   - The stealth address is data, not key material.
+ *   - The permit (v, r, s, deadline) is a one-time authorization for the
+ *     specific (owner, spender, value, deadline) bound at signing time.
+ */
+import { type Account, type Address, type Chain, type Hex, type PublicClient, type Transport, type WalletClient } from 'viem';
+import type { RelayRequest } from './types.js';
+export interface RelayCtx {
+    readonly publicClient: PublicClient<Transport, Chain | undefined>;
+    readonly walletClient: WalletClient<Transport, Chain | undefined, Account>;
+    readonly account: Account;
+    readonly relayerContract: Address;
+}
+export interface RelayResult {
+    readonly txHash: Hex;
+    readonly blockNumber: bigint;
+}
+/**
+ * Build the ERC-2771-wrapped calldata: encoded sweepERC20WithPermit(...) with
+ * the 20-byte stealth address appended. ShroudFiRelayer's ERC2771Context
+ * reads _msgSender() as the appended address when msg.sender is the trusted
+ * forwarder (= the relayer EOA = `account` here).
+ */
+export declare function buildRelayCalldata(req: RelayRequest): Hex;
+/**
+ * Broadcast the wrapped tx. Waits for the receipt before returning.
+ *
+ * Throws RelayBroadcastError on any underlying viem error. Errors are wrapped
+ * to strip out potentially key-bearing payloads from the visible message.
+ */
+export declare function relayRequest(ctx: RelayCtx, req: RelayRequest): Promise<RelayResult>;
+//# sourceMappingURL=relay.d.ts.map

package/dist/esm/relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.d.ts","sourceRoot":"","sources":["../../src/relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,GAAG,EACR,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,MAAM,CAAC;AAEd,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAuB/C,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;IAClE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,GAAG,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,GAAG,CAgBzD;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,WAAW,CAAC,CAkBtB"}