@temporalabs/treasury 0.1.1 → 0.1.3

package/dist/connect/config.js

@@ -0,0 +1,35 @@
+/**
+ * Settings for `treasury connect`. Every value has a working default; each environment variable
+ * here is optional and documented in docs/configuration.md.
+ */
+/**
+ * The Privy app the sign-in page uses. A Privy app ID is a PUBLIC identifier — it ships inside the
+ * page every browser downloads — so it is committed here. A fork or self-host can point at its own
+ * Privy app with `PRIVY_APP_ID`. The app SECRET is never used anywhere in this package.
+ */
+export const DEFAULT_PRIVY_APP_ID = "cmubfegl2028d0ci3n0f2u6z5";
+/**
+ * The local ports the page may be served on, tried in this order. Privy accepts sign-in only from
+ * origins listed in its dashboard, by exact string, so every one of them is listed there as
+ * `http://localhost:<port>`. The first stays 53682, the only port earlier versions used, so an
+ * operator who signed in before keeps the same origin. `TREASURY_CONNECT_PORT` replaces the list with
+ * one port, which must then be listed in the Privy app's allowed domains.
+ */
+export const DEFAULT_CONNECT_PORTS = [53682, 53683, 53684, 53685, 53686];
+export const privyAppId = () => {
+    const v = (process.env["PRIVY_APP_ID"] ?? "").trim();
+    return v.length > 0 && !v.includes("${") ? v : DEFAULT_PRIVY_APP_ID;
+};
+export const connectPorts = () => {
+    const raw = (process.env["TREASURY_CONNECT_PORT"] ?? "").trim();
+    const n = Number(raw);
+    return raw.length > 0 && Number.isInteger(n) && n > 0 && n < 65536 ? [n] : DEFAULT_CONNECT_PORTS;
+};
+/** Where the session file lives; `TREASURY_CONNECT_HOME` moves it (tests use a temporary directory). */
+export const connectHome = () => {
+    const v = (process.env["TREASURY_CONNECT_HOME"] ?? "").trim();
+    return v.length > 0 && !v.includes("${") ? v : undefined;
+};
+/** Set to anything to stop the CLI opening a browser itself (it prints the URL instead). */
+export const noOpen = () => (process.env["TREASURY_CONNECT_NO_OPEN"] ?? "").trim().length > 0;
+//# sourceMappingURL=config.js.map

package/dist/connect/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/connect/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAE5F,MAAM,CAAC,MAAM,UAAU,GAAG,GAAW,EAAE;IACrC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,GAAsB,EAAE;IAClD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACnG,CAAC,CAAC;AAEF,wGAAwG;AACxG,MAAM,CAAC,MAAM,WAAW,GAAG,GAAuB,EAAE;IAClD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,MAAM,GAAG,GAAY,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC"}

package/dist/connect/gate-solana.d.ts

@@ -0,0 +1,8 @@
+import type { SolanaVaultEntry } from "../registry-schema.js";
+export interface AdmittedSolana {
+    kind: "deposit" | "withdraw";
+    vault: SolanaVaultEntry;
+    /** A deposit's base units of the asset, or the shares a withdrawal burns (summed over its legs). */
+    amount: bigint;
+}
+export declare function admitSolana(wireBase64: string, account: string): Promise<AdmittedSolana>;

package/dist/connect/gate-solana.js

@@ -0,0 +1,147 @@
+/**
+ * The Solana gate: what the confirm page may hand a connected Solana wallet. The counterpart of `gate.ts`.
+ *
+ * It reads the transaction's own BYTES — the wire transaction the wallet will be given — and admits it only if
+ * every instruction in it is one of these, each for the connected account and a registry vault:
+ *
+ *   ComputeBudget SetComputeUnitLimit           nothing else from that program (no fee price, no heap)
+ *   Associated Token Account CreateIdempotent   payer and owner the connected account; mint the vault's
+ *                                               share mint or its token mint
+ *   Kamino vault `deposit`                      exactly one, signer the connected account, vault a registry vault,
+ *                                               paying from and into the account's own token accounts
+ *   Kamino vault `withdraw`                     one or more, the same checks
+ *
+ * Within a deposit or withdrawal, every account the registry determines is pinned: the vault state (both
+ * places a withdrawal names it), the vault's token vault and authority (PDAs of the vault), its token and
+ * share mints, and the connected account's own token and share accounts. The reserve, market and program
+ * accounts a withdrawal lists are NOT pinned here: they are left to the vault program's own account
+ * constraints, which refuse a reserve the vault does not allocate to.
+ *
+ * The fee payer and the only signer must be the connected account. Anything else — another program, a
+ * transfer, a second signer, a deposit and a withdrawal together, a vault not in the registry — is refused
+ * before any page opens. It checks the bytes, not the builder that made them: a builder bug, or a transaction
+ * from anywhere else, meets the same refusal.
+ */
+import { AccountRole, decompileTransactionMessage, getBase64Encoder, getCompiledTransactionMessageDecoder, getTransactionDecoder, } from "@solana/kit";
+import { listSolanaVaults } from "../registry.js";
+import { ASSOCIATED_TOKEN_PROGRAM_ID, COMPUTE_BUDGET_PROGRAM_ID, KVAULT_PROGRAM_ID, SPL_TOKEN_PROGRAM_ID, SYSTEM_PROGRAM_ID } from "../solana/constants.js";
+import { associatedTokenAccount, DISCRIMINATORS, vaultPdas } from "../solana/kvault.js";
+const same = (a, b) => a.length <= b.length && a.every((x, i) => b[i] === x);
+const u64 = (d, o) => new DataView(d.buffer, d.byteOffset, d.byteLength).getBigUint64(o, true);
+const isSigner = (role) => role === AccountRole.READONLY_SIGNER || role === AccountRole.WRITABLE_SIGNER;
+export async function admitSolana(wireBase64, account) {
+    const refuse = (why) => {
+        throw new Error(`refused: ${why}`);
+    };
+    let ixs;
+    let feePayer;
+    let signers;
+    try {
+        const tx = getTransactionDecoder().decode(getBase64Encoder().encode(wireBase64));
+        const compiled = getCompiledTransactionMessageDecoder().decode(tx.messageBytes);
+        signers = compiled.header.numSignerAccounts;
+        if ("addressTableLookups" in compiled && (compiled.addressTableLookups?.length ?? 0) > 0)
+            refuse("the transaction loads accounts from a lookup table, which this gate cannot read");
+        const message = decompileTransactionMessage(compiled);
+        feePayer = message.feePayer.address;
+        ixs = message.instructions;
+    }
+    catch (e) {
+        if (e instanceof Error && e.message.startsWith("refused:"))
+            throw e;
+        return refuse(`the transaction does not decode (${e instanceof Error ? e.message : String(e)})`);
+    }
+    if (feePayer !== account)
+        refuse(`the fee payer is ${feePayer}, not the connected account ${account}`);
+    if (signers !== 1)
+        refuse(`the transaction needs ${signers} signers; only the connected account may sign`);
+    let kind;
+    let vault;
+    let amount = 0n;
+    const ataMints = new Set();
+    for (const [i, ix] of ixs.entries()) {
+        const at = `instruction ${i + 1}`;
+        const data = Uint8Array.from(ix.data ?? []);
+        const accts = ix.accounts ?? [];
+        for (const a of accts)
+            if (isSigner(a.role) && a.address !== account)
+                refuse(`${at} asks ${a.address} to sign, not the connected account`);
+        switch (ix.programAddress) {
+            case COMPUTE_BUDGET_PROGRAM_ID:
+                if (data.length !== 5 || data[0] !== 2)
+                    refuse(`${at}: only a compute-unit limit is allowed from the Compute Budget program`);
+                break;
+            case ASSOCIATED_TOKEN_PROGRAM_ID: {
+                if (data.length !== 1 || data[0] !== 1)
+                    refuse(`${at}: only an idempotent token-account creation is allowed`);
+                const [payer, ata, owner, mint, system, token] = accts.map((a) => a.address);
+                if (payer !== account || owner !== account)
+                    refuse(`${at} creates a token account for ${owner}, paid by ${payer}; only the connected account's own`);
+                if (system !== SYSTEM_PROGRAM_ID || token !== SPL_TOKEN_PROGRAM_ID)
+                    refuse(`${at} names an unexpected program`);
+                if (ata !== (await associatedTokenAccount(account, mint)))
+                    refuse(`${at} names a token account that is not the connected account's for ${mint}`);
+                ataMints.add(mint);
+                break;
+            }
+            case KVAULT_PROGRAM_ID: {
+                const isDeposit = same(DISCRIMINATORS.deposit, data);
+                const isWithdraw = same(DISCRIMINATORS.withdraw, data);
+                if (!isDeposit && !isWithdraw)
+                    refuse(`${at} is a Kamino vault instruction other than deposit or withdraw`);
+                if (data.length !== 16)
+                    refuse(`${at} carries ${data.length} bytes of data, not 16`);
+                const k = isDeposit ? "deposit" : "withdraw";
+                if (kind !== undefined && kind !== k)
+                    refuse("a deposit and a withdrawal in one transaction");
+                if (k === "deposit" && kind === "deposit")
+                    refuse("two deposits in one transaction");
+                kind = k;
+                const user = accts[0]?.address;
+                const state = accts[1]?.address;
+                if (user !== account)
+                    refuse(`${at} acts for ${user}, not the connected account ${account}`);
+                const v = listSolanaVaults().find((x) => x.address === state);
+                if (!v)
+                    refuse(`${at} names ${state}, which is not a vault in the registry`);
+                if (vault && vault.address !== v.address)
+                    refuse("two different vaults in one transaction");
+                vault = v;
+                const [tokenAta, sharesAta, pdas] = await Promise.all([associatedTokenAccount(account, v.asset.address), associatedTokenAccount(account, v.sharesMint), vaultPdas(v.address)]);
+                // The vault's own token vault and authority are PDAs of the vault: pinned, not left to the program.
+                const tokenVault = accts[isDeposit ? 2 : 3]?.address;
+                const authority = accts[4]?.address;
+                if (tokenVault !== pdas.tokenVault || authority !== pdas.baseVaultAuthority)
+                    refuse(`${at} names a token vault or vault authority that is not ${v.symbol}'s`);
+                // A withdrawal names the vault state twice (its reserve-accounts group repeats it): both must be the vault.
+                if (isWithdraw && accts[14]?.address !== state)
+                    refuse(`${at} names a second vault state ${accts[14]?.address}, not ${state}`);
+                // The fixed account positions, as `src/solana/kvault.ts` builds them and Kamino's SDK does.
+                const userToken = accts[isDeposit ? 6 : 5]?.address;
+                const userShares = accts[7]?.address; // both instructions put the user's share account at index 7
+                const mint = accts[isDeposit ? 3 : 6]?.address;
+                const sharesMint = accts[isDeposit ? 5 : 8]?.address;
+                if (mint !== v.asset.address || sharesMint !== v.sharesMint)
+                    refuse(`${at} names a token or share mint that is not the vault's`);
+                if (userToken !== tokenAta)
+                    refuse(`${at} ${isDeposit ? "takes from" : "pays into"} ${userToken}, not the connected account's own ${v.asset.symbol} account`);
+                if (userShares !== sharesAta)
+                    refuse(`${at} names ${userShares} as the share account, not the connected account's own`);
+                const n = u64(data, 8);
+                if (n === 0n)
+                    refuse(`${at} moves 0`);
+                amount += n;
+                break;
+            }
+            default:
+                refuse(`${at} calls ${ix.programAddress}, which is not one this page may send`);
+        }
+    }
+    if (!kind || !vault)
+        return refuse("the transaction contains no deposit or withdrawal");
+    for (const m of ataMints)
+        if (m !== vault.sharesMint && m !== vault.asset.address)
+            refuse(`a token account is created for ${m}, which is not this vault's`);
+    return { kind, vault, amount };
+}
+//# sourceMappingURL=gate-solana.js.map

package/dist/connect/gate-solana.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-solana.js","sourceRoot":"","sources":["../../src/connect/gate-solana.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,gBAAgB,EAChB,oCAAoC,EACpC,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC5J,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASxF,MAAM,IAAI,GAAG,CAAC,CAAoB,EAAE,CAAa,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5G,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACnH,MAAM,QAAQ,GAAG,CAAC,IAAiB,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,eAAe,IAAI,IAAI,KAAK,WAAW,CAAC,eAAe,CAAC;AAErH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,OAAe;IACnE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,IAAI,GAA2B,CAAC;IAChC,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,qBAAqB,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,oCAAoC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;QAChF,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC5C,IAAI,qBAAqB,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,iFAAiF,CAAC,CAAC;QACpL,MAAM,OAAO,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QACtD,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QACpC,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,CAAC,CAAC;QACpE,OAAO,MAAM,CAAC,oCAAoC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO;QAAE,MAAM,CAAC,oBAAoB,QAAQ,+BAA+B,OAAO,EAAE,CAAC,CAAC;IACvG,IAAI,OAAO,KAAK,CAAC;QAAE,MAAM,CAAC,yBAAyB,OAAO,+CAA+C,CAAC,CAAC;IAE3G,IAAI,IAAwC,CAAC;IAC7C,IAAI,KAAmC,CAAC;IACxC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;gBAAE,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,qCAAqC,CAAC,CAAC;QAC3I,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,yBAAyB;gBAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,GAAG,EAAE,wEAAwE,CAAC,CAAC;gBAC9H,MAAM;YACR,KAAK,2BAA2B,CAAC,CAAC,CAAC;gBACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;gBAC9G,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC7E,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO;oBAAE,MAAM,CAAC,GAAG,EAAE,gCAAgC,KAAK,aAAa,KAAK,oCAAoC,CAAC,CAAC;gBACrJ,IAAI,MAAM,KAAK,iBAAiB,IAAI,KAAK,KAAK,oBAAoB;oBAAE,MAAM,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;gBAChH,IAAI,GAAG,KAAK,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,IAAK,CAAC,CAAC;oBAAE,MAAM,CAAC,GAAG,EAAE,kEAAkE,IAAI,EAAE,CAAC,CAAC;gBAClJ,QAAQ,CAAC,GAAG,CAAC,IAAK,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;YACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACrD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACvD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU;oBAAE,MAAM,CAAC,GAAG,EAAE,+DAA+D,CAAC,CAAC;gBAC5G,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;oBAAE,MAAM,CAAC,GAAG,EAAE,YAAY,IAAI,CAAC,MAAM,wBAAwB,CAAC,CAAC;gBACrF,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,CAAC;oBAAE,MAAM,CAAC,+CAA+C,CAAC,CAAC;gBAC9F,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,CAAC,iCAAiC,CAAC,CAAC;gBACrF,IAAI,GAAG,CAAC,CAAC;gBACT,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBAChC,IAAI,IAAI,KAAK,OAAO;oBAAE,MAAM,CAAC,GAAG,EAAE,aAAa,IAAI,+BAA+B,OAAO,EAAE,CAAC,CAAC;gBAC7F,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;gBAC9D,IAAI,CAAC,CAAC;oBAAE,MAAM,CAAC,GAAG,EAAE,UAAU,KAAK,wCAAwC,CAAC,CAAC;gBAC7E,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,CAAE,CAAC,OAAO;oBAAE,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBAC7F,KAAK,GAAG,CAAE,CAAC;gBACX,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC,OAAO,EAAE,CAAE,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAClL,oGAAoG;gBACpG,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACrD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACpC,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,IAAI,SAAS,KAAK,IAAI,CAAC,kBAAkB;oBAAE,MAAM,CAAC,GAAG,EAAE,uDAAuD,CAAE,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC/J,4GAA4G;gBAC5G,IAAI,UAAU,IAAI,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,KAAK,KAAK;oBAAE,MAAM,CAAC,GAAG,EAAE,+BAA+B,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,SAAS,KAAK,EAAE,CAAC,CAAC;gBAC/H,4FAA4F;gBAC5F,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACpD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,4DAA4D;gBAClG,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACrD,IAAI,IAAI,KAAK,CAAE,CAAC,KAAK,CAAC,OAAO,IAAI,UAAU,KAAK,CAAE,CAAC,UAAU;oBAAE,MAAM,CAAC,GAAG,EAAE,sDAAsD,CAAC,CAAC;gBACnI,IAAI,SAAS,KAAK,QAAQ;oBAAE,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,IAAI,SAAS,qCAAqC,CAAE,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,CAAC;gBAC/J,IAAI,UAAU,KAAK,SAAS;oBAAE,MAAM,CAAC,GAAG,EAAE,UAAU,UAAU,wDAAwD,CAAC,CAAC;gBACxH,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,KAAK,EAAE;oBAAE,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBACtC,MAAM,IAAI,CAAC,CAAC;gBACZ,MAAM;YACR,CAAC;YACD;gBACE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,cAAc,uCAAuC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,mDAAmD,CAAC,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,KAAK,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,CAAC,kCAAkC,CAAC,6BAA6B,CAAC,CAAC;IAC5J,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC"}

package/dist/connect/gate.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The hard gate every call passes before a page opens: what `treasury connect` will put in front of
+ * the operator's wallet at all. It re-derives everything from the calldata and the registry and
+ * trusts nothing the call's own fields say about themselves (`description`, `args`, `function`).
+ *
+ * Allowed, and nothing else:
+ *   - `approve(vault, n)` on a registry vault's own asset, for exactly the amount the deposit after
+ *     it pulls — never unlimited, never to anything but that vault;
+ *   - `deposit(assets, receiver)` on a registry vault, receiver = the connected account;
+ *   - `withdraw(assets, receiver, owner)` / `redeem(shares, receiver, owner)` on a registry vault,
+ *     receiver = owner = the connected account.
+ * Every call carries no value and names a supported chain that matches its vault.
+ *
+ * And one batch is one operation on one vault, on one chain, in one of the shapes the builders
+ * emit: `[approve, deposit]`, `[withdraw]` or `[redeem]`. Calldata must be exactly the canonical
+ * encoding of what it decodes to: no trailing bytes, no stray bits in an address word.
+ *
+ * This is the rule of AGENTS.md / CONTRIBUTING.md that the relay refuses any destination outside
+ * the registry, made executable. Paying an address other than the
+ * connected account is refused here on purpose: that is what the prepare commands are for, with the
+ * operator's own signer.
+ */
+import { type Address, type Hex } from "viem";
+import type { VaultEntry } from "../registry-schema.js";
+export interface GateCall {
+    chainId: number;
+    to: Address;
+    data: Hex;
+    value: string;
+}
+export interface Admitted {
+    kind: "approve" | "deposit" | "withdraw" | "redeem";
+    vault: VaultEntry;
+    /** Raw units: the approved/deposited/withdrawn assets, or the redeemed shares. */
+    amount: bigint;
+}
+export declare function admit(calls: GateCall[], account: Address): Admitted[];

package/dist/connect/gate.js

@@ -0,0 +1,115 @@
+/**
+ * The hard gate every call passes before a page opens: what `treasury connect` will put in front of
+ * the operator's wallet at all. It re-derives everything from the calldata and the registry and
+ * trusts nothing the call's own fields say about themselves (`description`, `args`, `function`).
+ *
+ * Allowed, and nothing else:
+ *   - `approve(vault, n)` on a registry vault's own asset, for exactly the amount the deposit after
+ *     it pulls — never unlimited, never to anything but that vault;
+ *   - `deposit(assets, receiver)` on a registry vault, receiver = the connected account;
+ *   - `withdraw(assets, receiver, owner)` / `redeem(shares, receiver, owner)` on a registry vault,
+ *     receiver = owner = the connected account.
+ * Every call carries no value and names a supported chain that matches its vault.
+ *
+ * And one batch is one operation on one vault, on one chain, in one of the shapes the builders
+ * emit: `[approve, deposit]`, `[withdraw]` or `[redeem]`. Calldata must be exactly the canonical
+ * encoding of what it decodes to: no trailing bytes, no stray bits in an address word.
+ *
+ * This is the rule of AGENTS.md / CONTRIBUTING.md that the relay refuses any destination outside
+ * the registry, made executable. Paying an address other than the
+ * connected account is refused here on purpose: that is what the prepare commands are for, with the
+ * operator's own signer.
+ */
+import { decodeFunctionData, encodeFunctionData, getAddress } from "viem";
+import { erc4626Abi } from "../abi/erc4626.js";
+import { isSupportedChainId } from "../client.js";
+import { listVaults } from "../registry.js";
+/** Anything at or above this is an "unlimited" approval, which the gate never admits. */
+const UNLIMITED = 2n ** 128n;
+const same = (a, b) => getAddress(a) === getAddress(b);
+/** The only batches the builders emit; anything else is refused whole. */
+const SHAPES = new Set(["approve,deposit", "withdraw", "redeem"]);
+export function admit(calls, account) {
+    if (calls.length === 0)
+        throw new Error("refused: there is nothing to confirm");
+    // The page switches the wallet to one chain for the whole batch, so a batch never spans two.
+    if (calls.some((c) => c.chainId !== calls[0].chainId))
+        throw new Error("refused: the calls are on more than one chain");
+    const vaults = listVaults();
+    const out = [];
+    calls.forEach((c, i) => {
+        const at = `call ${i + 1} of ${calls.length}`;
+        if (!isSupportedChainId(c.chainId))
+            throw new Error(`refused (${at}): chain ${c.chainId} is not supported`);
+        if (BigInt(c.value) !== 0n)
+            throw new Error(`refused (${at}): it attaches native value, which no vault call needs`);
+        let decoded;
+        try {
+            decoded = decodeFunctionData({ abi: erc4626Abi, data: c.data });
+        }
+        catch {
+            throw new Error(`refused (${at}): its calldata is not an approve, deposit, withdraw or redeem`);
+        }
+        const name = decoded.functionName;
+        const args = (decoded.args ?? []);
+        // Decoding forgives trailing bytes and keeps only the low 20 bytes of an address word; the
+        // wallet would sign the bytes as sent. Admit only calldata that is its own canonical encoding.
+        const canonical = encodeFunctionData({ abi: erc4626Abi, functionName: name, args });
+        if (canonical !== c.data)
+            throw new Error(`refused (${at}): its calldata is not the canonical encoding of ${name} (trailing bytes, stray bits in an address, or hex not in lowercase)`);
+        if (name === "approve") {
+            const vault = vaults.find((v) => v.chainId === c.chainId && same(v.asset.address, c.to));
+            if (!vault)
+                throw new Error(`refused (${at}): approve on ${c.to}, which is not the asset of a listed vault on chain ${c.chainId}`);
+            const [spender, value] = args;
+            const target = vaults.find((v) => v.chainId === c.chainId && same(v.address, spender) && same(v.asset.address, c.to));
+            if (!target)
+                throw new Error(`refused (${at}): the approval goes to ${spender}, not to a listed vault for this asset`);
+            if (value === 0n)
+                throw new Error(`refused (${at}): an approval of 0`);
+            if (value >= UNLIMITED)
+                throw new Error(`refused (${at}): an unlimited approval`);
+            out.push({ kind: "approve", vault: target, amount: value });
+            return;
+        }
+        const vault = vaults.find((v) => v.chainId === c.chainId && same(v.address, c.to));
+        if (!vault)
+            throw new Error(`refused (${at}): ${c.to} is not a listed vault on chain ${c.chainId}`);
+        if (name === "deposit") {
+            const [assets, receiver] = args;
+            if (assets === 0n)
+                throw new Error(`refused (${at}): a deposit of 0`);
+            if (!same(receiver, account))
+                throw new Error(`refused (${at}): the shares would go to ${receiver}, not the connected account ${account}`);
+            out.push({ kind: "deposit", vault, amount: assets });
+            return;
+        }
+        if (name === "withdraw" || name === "redeem") {
+            const [amount, receiver, owner] = args;
+            if (amount === 0n)
+                throw new Error(`refused (${at}): a ${name} of 0`);
+            if (!same(receiver, account))
+                throw new Error(`refused (${at}): the funds would go to ${receiver}, not the connected account ${account}`);
+            if (!same(owner, account))
+                throw new Error(`refused (${at}): it burns the shares of ${owner}, not the connected account ${account}`);
+            out.push({ kind: name, vault, amount });
+            return;
+        }
+        throw new Error(`refused (${at}): ${name} is not something this page hands to a wallet`);
+    });
+    // An approval only ever precedes the deposit it pays for: same vault, same amount, next call.
+    out.forEach((a, i) => {
+        if (a.kind !== "approve")
+            return;
+        const next = out[i + 1];
+        if (!next || next.kind !== "deposit" || next.vault.address !== a.vault.address || next.amount !== a.amount) {
+            throw new Error(`refused (call ${i + 1}): an approval must be followed by a deposit of exactly that amount into the same vault`);
+        }
+    });
+    const shape = out.map((a) => a.kind).join(",");
+    // With the pairing above, these shapes also mean one vault per batch.
+    if (!SHAPES.has(shape))
+        throw new Error(`refused: ${shape} is not a batch this page confirms (only approve+deposit, withdraw, or redeem)`);
+    return out;
+}
+//# sourceMappingURL=gate.js.map

package/dist/connect/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/connect/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,UAAU,EAA0B,MAAM,MAAM,CAAC;AAClG,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAiB5C,yFAAyF;AACzF,MAAM,SAAS,GAAG,EAAE,IAAI,IAAI,CAAC;AAE7B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,UAAU,KAAK,CAAC,KAAiB,EAAE,OAAgB;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChF,6FAA6F;IAC7F,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,OAAO,mBAAmB,CAAC,CAAC;QAC5G,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,wDAAwD,CAAC,CAAC;QACpH,IAAI,OAAiE,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,gEAAgE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACxD,2FAA2F;QAC3F,+FAA+F;QAC/F,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAA8C,CAAC,CAAC;QAChI,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,oDAAoD,IAAI,sEAAsE,CAAC,CAAC;QAExL,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,EAAE,uDAAuD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACnI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,IAAyB,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACtH,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,2BAA2B,OAAO,wCAAwC,CAAC,CAAC;YACvH,IAAI,KAAK,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YACvE,IAAI,KAAK,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,IAAyB,CAAC;YACrD,IAAI,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,6BAA6B,QAAQ,+BAA+B,OAAO,EAAE,CAAC,CAAC;YAC3I,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,IAAkC,CAAC;YACrE,IAAI,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,4BAA4B,QAAQ,+BAA+B,OAAO,EAAE,CAAC,CAAC;YAC1I,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,6BAA6B,KAAK,+BAA+B,OAAO,EAAE,CAAC,CAAC;YACrI,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,MAAM,IAAI,+CAA+C,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,8FAA8F;IAC9F,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3G,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACnI,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,gFAAgF,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/connect/http.d.ts

@@ -0,0 +1,60 @@
+export type Accepted<T> = {
+    ok: true;
+    final: true;
+    value: T;
+    reply?: Record<string, unknown>;
+} | {
+    ok: true;
+    final: false;
+    reply?: Record<string, unknown>;
+} | {
+    ok: false;
+    reason: string;
+    fatal?: boolean;
+};
+export type Settled<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface Flow<T> {
+    mode: "connect" | "confirm";
+    ttlMs: number;
+    /** The page served at `/<mode>`, as a function of the flow's secret. */
+    html: (secret: string) => string;
+    csp: string;
+    /** Static assets served at their path. */
+    assets: Record<string, {
+        type: string;
+        body: string | Buffer;
+    }>;
+    info: () => Record<string, unknown>;
+    challenge?: (address: string, origin: string, nonce: string) => string;
+    /**
+     * Reads the address a sign-in challenge is for, or `undefined` for one that is not an address. An EVM
+     * address (checksummed) unless the flow says otherwise; the Solana sign-in takes a base58 one.
+     */
+    challengeAddress?: (a: unknown) => string | undefined;
+    accept: (body: Record<string, unknown>, ctx: {
+        nonce: string;
+        origin: string;
+        message?: string;
+        challengedAddress?: string;
+    }) => Promise<Accepted<T>>;
+    /** Called with the page's body when it reports a rejection, before the flow ends. */
+    onReject?: (body: Record<string, unknown>) => void;
+    /** Why the flow ended when the time limit ran out; the default says nothing happened. */
+    timeoutReason?: () => string;
+    /** Overrides the cancel grace period (tests). */
+    cancelGraceMs?: number;
+    /** Tried in order; the page takes the first one free. Each must be an origin the Privy app allows. */
+    ports: readonly number[];
+}
+export interface Handle<T> {
+    url: string;
+    done: Promise<Settled<T>>;
+    close: () => void;
+}
+export declare function serveOnce<T>(flow: Flow<T>): Promise<Handle<T>>;