agentcard 0.0.21 → 0.0.23

package/dist/src/lib/api.js

@@ -1,6 +1,30 @@
 import chalk from "chalk";
 import { getConfig } from "./config.js";
-const API_URL = process.env.AGENTCARD_API_URL || "https://agentcard.ai";
+export const API_URL = process.env.AGENTCARD_API_URL || "https://agentcard.ai";
+// Thrown by `request()` when the API returns a non-OK response. Callers that
+// care about specific HTTP statuses (e.g. 409 = wallet not provisioned) can
+// branch on `err.status` after `instanceof ApiError`.
+export class ApiError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.name = "ApiError";
+        this.status = status;
+        this.body = body;
+    }
+}
+// Returns the bearer token for the current CLI session, or exits if missing.
+// Used by callers that need to attach Authorization to non-fetch transports
+// (viem http() / alchemy wallet transport) which sit outside `request()`.
+export function requireAuthToken() {
+    const cfg = getConfig();
+    if (!cfg.token) {
+        console.error(chalk.red("Not logged in. Run `agentcard signup` first."));
+        process.exit(1);
+    }
+    return cfg.token;
+}
 async function request(method, path, body, options = { auth: true }) {
     const headers = {
         "Content-Type": "application/json",
@@ -26,14 +50,16 @@ async function request(method, path, body, options = { auth: true }) {
     if (!res.ok) {
         const text = await res.text();
         let message;
+        let body = text;
         try {
             const json = JSON.parse(text);
+            body = json;
             message = json.error || json.message || text;
         }
         catch {
             message = text;
         }
-        throw new Error(message);
+        throw new ApiError(message, res.status, body);
     }
     return res.json();
 }

package/dist/src/lib/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,sBAAsB,CAAC;AAMxE,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,UAAsB,EAAE,IAAI,EAAE,IAAI,EAAE;IAEpC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM;QACN,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,CACtE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,GAAG,CAAI,IAAY,EAAE,OAAoB;IACvD,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,IAAY,EACZ,IAAc,EACd,OAAoB;IAEpB,OAAO,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,IAAY,EACZ,IAAc,EACd,OAAoB;IAEpB,OAAO,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,GAAG,CACjB,IAAY,EACZ,OAAoB;IAEpB,OAAO,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,sBAAsB,CAAC;AAE/E,6EAA6E;AAC7E,4EAA4E;AAC5E,sDAAsD;AACtD,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAU;IACd,YAAY,OAAe,EAAE,MAAc,EAAE,IAAa;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAMD,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,UAAsB,EAAE,IAAI,EAAE,IAAI,EAAE;IAEpC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM;QACN,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,CACtE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAe,CAAC;QACpB,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,GAAG,IAAI,CAAC;YACZ,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,GAAG,CAAI,IAAY,EAAE,OAAoB;IACvD,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,IAAY,EACZ,IAAc,EACd,OAAoB;IAEpB,OAAO,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,IAAY,EACZ,IAAc,EACd,OAAoB;IAEpB,OAAO,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,GAAG,CACjB,IAAY,EACZ,OAAoB;IAEpB,OAAO,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC"}

package/dist/src/lib/policy-intent.d.ts

@@ -0,0 +1,13 @@
+import { type UserOperation } from "viem/account-abstraction";
+export type RegisteredUserOp = Omit<UserOperation<"0.7">, "signature">;
+export declare function lookupUserOp(wireHash: string): RegisteredUserOp | undefined;
+export declare function withPreparedUserOps<T>(ops: RegisteredUserOp[], fn: () => Promise<T>): Promise<T>;
+export declare function serializeUserOp(op: RegisteredUserOp): object;
+export interface RegisteredTypedData {
+    domain: Record<string, unknown>;
+    types: Record<string, unknown>;
+    primaryType: string;
+    message: Record<string, unknown>;
+}
+export declare function withTypedDataIntent<T>(td: RegisteredTypedData, fn: () => Promise<T>): Promise<T>;
+export declare function getCurrentTypedDataIntent(): RegisteredTypedData | null;

package/dist/src/lib/policy-intent.js

@@ -0,0 +1,95 @@
+// Binds extra context to in-flight sign requests so /api/wallet/rpc's policy
+// can decode them. Two registries live here:
+//
+//   1. userOp registry — when the smart-wallet client asks our LocalAccount
+//      to sign a userOp hash via secp256k1_sign, the bare hash is all the
+//      adapter sees. The backend policy needs the prepared userOp to verify
+//      the binding (`hashMessage({raw: getUserOperationHash(op)}) === hash`)
+//      and decode callData. We register expected-hash → userOp ahead of the
+//      sign so the adapter can attach it as `intent.userOp` at sign time.
+//
+//   2. typedData intent — MAv2's signTypedData wraps the EIP-3009 in a
+//      ReplaySafeHash envelope before signing. The /api/wallet/rpc payload
+//      carries the wrapper, not the original typed data, and the backend
+//      can't reverse `hashTypedData` back to the EIP-3009 fields. We
+//      register the original typed data here so the adapter can pass it as
+//      `intent.typedData` for the backend to bind against the wrapper.
+import { hashMessage, } from "viem";
+import { getUserOperationHash, } from "viem/account-abstraction";
+import { base } from "viem/chains";
+// Standard EntryPoint v0.7 — same address on every EVM chain.
+const ENTRYPOINT_V07 = "0x0000000071727De22E5E9d8BAf0edAc6f37da032";
+const userOpRegistry = new Map();
+function registerUserOp(op) {
+    const userOpHash = getUserOperationHash({
+        chainId: base.id,
+        entryPointAddress: ENTRYPOINT_V07,
+        entryPointVersion: "0.7",
+        userOperation: { ...op, signature: "0x" },
+    });
+    // signMessage's raw branch hashes via hashMessage({ raw: userOpHash }) before
+    // sending to /api/wallet/rpc, so key by the resulting wire hash.
+    const wireHash = hashMessage({ raw: userOpHash }).toLowerCase();
+    userOpRegistry.set(wireHash, op);
+}
+function clearUserOpRegistry() {
+    userOpRegistry.clear();
+}
+export function lookupUserOp(wireHash) {
+    return userOpRegistry.get(wireHash.toLowerCase());
+}
+// Run an Alchemy sign flow with the prepared userOp(s) registered. Within
+// `fn`, any secp256k1_sign whose hash matches a registered userOp gets sent
+// to /api/wallet/rpc with the userOp attached as intent — so the backend
+// can verify the binding + decode callData for the spend check.
+export async function withPreparedUserOps(ops, fn) {
+    for (const op of ops)
+        registerUserOp(op);
+    try {
+        return await fn();
+    }
+    finally {
+        clearUserOpRegistry();
+    }
+}
+// Serialize a registered userOp for the /api/wallet/rpc `intent` field.
+// Backend's Zod schema expects every numeric field as a string.
+export function serializeUserOp(op) {
+    const out = {
+        sender: op.sender,
+        nonce: op.nonce.toString(),
+        callData: op.callData,
+        callGasLimit: op.callGasLimit.toString(),
+        verificationGasLimit: op.verificationGasLimit.toString(),
+        preVerificationGas: op.preVerificationGas.toString(),
+        maxFeePerGas: op.maxFeePerGas.toString(),
+        maxPriorityFeePerGas: op.maxPriorityFeePerGas.toString(),
+    };
+    if (op.factory)
+        out.factory = op.factory;
+    if (op.factoryData)
+        out.factoryData = op.factoryData;
+    if (op.paymaster)
+        out.paymaster = op.paymaster;
+    if (op.paymasterData)
+        out.paymasterData = op.paymasterData;
+    if (op.paymasterVerificationGasLimit !== undefined)
+        out.paymasterVerificationGasLimit = op.paymasterVerificationGasLimit.toString();
+    if (op.paymasterPostOpGasLimit !== undefined)
+        out.paymasterPostOpGasLimit = op.paymasterPostOpGasLimit.toString();
+    return out;
+}
+let currentTypedDataIntent = null;
+export async function withTypedDataIntent(td, fn) {
+    currentTypedDataIntent = td;
+    try {
+        return await fn();
+    }
+    finally {
+        currentTypedDataIntent = null;
+    }
+}
+export function getCurrentTypedDataIntent() {
+    return currentTypedDataIntent;
+}
+//# sourceMappingURL=policy-intent.js.map

package/dist/src/lib/policy-intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-intent.js","sourceRoot":"","sources":["../../../src/lib/policy-intent.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,6CAA6C;AAC7C,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,qEAAqE;AACrE,2EAA2E;AAC3E,uEAAuE;AAEvE,OAAO,EACL,WAAW,GAGZ,MAAM,MAAM,CAAC;AACd,OAAO,EACL,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,8DAA8D;AAC9D,MAAM,cAAc,GAAY,4CAA4C,CAAC;AAS7E,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE3D,SAAS,cAAc,CAAC,EAAoB;IAC1C,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,iBAAiB,EAAE,cAAc;QACjC,iBAAiB,EAAE,KAAK;QACxB,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAW,EAAE;KACjD,CAAC,CAAC;IACH,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB;IAC1B,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAuB,EACvB,EAAoB;IAEpB,KAAK,MAAM,EAAE,IAAI,GAAG;QAAE,cAAc,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,mBAAmB,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,EAAoB;IAClD,MAAM,GAAG,GAA2B;QAClC,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC1B,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE;QACxC,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE;QACxD,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE;QACpD,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE;QACxC,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE;KACzD,CAAC;IACF,IAAI,EAAE,CAAC,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACzC,IAAI,EAAE,CAAC,WAAW;QAAE,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC;IACrD,IAAI,EAAE,CAAC,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC;IAC/C,IAAI,EAAE,CAAC,aAAa;QAAE,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,aAAa,CAAC;IAC3D,IAAI,EAAE,CAAC,6BAA6B,KAAK,SAAS;QAChD,GAAG,CAAC,6BAA6B,GAAG,EAAE,CAAC,6BAA6B,CAAC,QAAQ,EAAE,CAAC;IAClF,IAAI,EAAE,CAAC,uBAAuB,KAAK,SAAS;QAC1C,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,IAAI,sBAAsB,GAA+B,IAAI,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAuB,EACvB,EAAoB;IAEpB,sBAAsB,GAAG,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,sBAAsB,GAAG,IAAI,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,sBAAsB,CAAC;AAChC,CAAC"}

package/dist/src/lib/privy.d.ts

@@ -0,0 +1,19 @@
+import { type Address, type LocalAccount } from "viem";
+export declare function ensureWalletReady(): Promise<void>;
+export interface WalletConfig {
+    privyAppId: string;
+    chainId: number;
+    network: string;
+    rpcUrl: string;
+    walletApiUrl: string;
+    gasPolicyId: string;
+}
+export declare function getWalletConfig(): Promise<WalletConfig>;
+interface SessionState {
+    walletId: string;
+    address: Address;
+    authorizationKey: string;
+}
+export declare function getWalletSession(): Promise<SessionState>;
+export declare function getPrivyLocalAccount(): Promise<LocalAccount>;
+export {};

package/dist/src/lib/privy.js

@@ -0,0 +1,214 @@
+// Privy bridge: HPKE handshake to fetch the user's authorization_key, plus a
+// viem LocalAccount that signs every request through /api/wallet/rpc (the
+// backend cosigns + forwards to Privy with App auth). No Alchemy or x402
+// concerns here — those live in smart-wallet.ts.
+import canonicalize from "canonicalize";
+import { CipherSuite, DhkemP256HkdfSha256, HkdfSha256, } from "@hpke/core";
+import { Chacha20Poly1305 } from "@hpke/chacha20poly1305";
+import { createSign } from "node:crypto";
+import { toAccount } from "viem/accounts";
+import { hashMessage, } from "viem";
+import chalk from "chalk";
+import { get, post } from "./api.js";
+import { lookupUserOp, serializeUserOp, getCurrentTypedDataIntent, } from "./policy-intent.js";
+// Pre-flight check for wallet-bound CLI commands. Existing users from before
+// the wallets PR shipped won't have a Wallet row yet; rather than letting
+// them fall into the cryptic 409 from /api/wallet/session-key, fail fast
+// with a clear self-heal hint. `agentcard setup` is idempotent — it skips
+// payment method, profile, and agent email if those are already set, and
+// just provisions + 7702-delegates the wallet.
+export async function ensureWalletReady() {
+    const me = await get("/api/me");
+    if (!me.walletAddress) {
+        console.error(chalk.red("Wallet isn't set up yet. Run `agentcard setup` to provision it — your payment method and profile will be preserved."));
+        process.exit(1);
+    }
+}
+let walletConfig = null;
+export async function getWalletConfig() {
+    if (walletConfig)
+        return walletConfig;
+    walletConfig = await get("/api/wallet/config");
+    return walletConfig;
+}
+async function setupHpkeRecipient() {
+    const suite = new CipherSuite({
+        kem: new DhkemP256HkdfSha256(),
+        kdf: new HkdfSha256(),
+        aead: new Chacha20Poly1305(),
+    });
+    const kp = await suite.kem.generateKeyPair();
+    const pub = await globalThis.crypto.subtle.exportKey("spki", kp.publicKey);
+    return {
+        publicKeySpki: new Uint8Array(pub),
+        decrypt: async (enc, ct) => {
+            const r = await suite.createRecipientContext({
+                recipientKey: kp.privateKey,
+                enc,
+            });
+            return new Uint8Array(await r.open(ct));
+        },
+    };
+}
+export async function getWalletSession() {
+    const recipient = await setupHpkeRecipient();
+    const recipientPubB64 = Buffer.from(recipient.publicKeySpki).toString("base64");
+    const { token: userJwt } = await post("/api/auth/jwt", {});
+    const res = await post("/api/wallet/session-key", {
+        recipient_public_key: recipientPubB64,
+        userJwt,
+    });
+    const decrypted = await recipient.decrypt(Buffer.from(res.encrypted_authorization_key.encapsulated_key, "base64"), Buffer.from(res.encrypted_authorization_key.ciphertext, "base64"));
+    return {
+        walletId: res.walletId,
+        address: res.address,
+        authorizationKey: new TextDecoder().decode(decrypted),
+    };
+}
+// ---- Privy 2-of-2 cosigning bridge ----------------------------------------
+function pemFromPkcs8B64(b64) {
+    return `-----BEGIN PRIVATE KEY-----\n${b64.replace(/^wallet-auth:/, "").replace(/^wallet-api:/, "")}\n-----END PRIVATE KEY-----`;
+}
+function ecdsaSign(privPem, payloadJson) {
+    return createSign("sha256")
+        .update(Buffer.from(payloadJson, "utf8"))
+        .sign({ key: privPem, dsaEncoding: "der" })
+        .toString("base64");
+}
+// Recursively convert BigInts to strings for JSON serialization. EIP-3009
+// typed-data messages carry uint256 values as BigInts; the /api/wallet/rpc
+// body has to JSON.stringify cleanly.
+function jsonSafe(value) {
+    if (typeof value === "bigint")
+        return value.toString();
+    if (Array.isArray(value))
+        return value.map(jsonSafe);
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = jsonSafe(v);
+        return out;
+    }
+    return value;
+}
+// We sign the canonicalized payload with the user's HPKE-decrypted
+// authorization_key (the user half of the 2-of-2), then POST to
+// /api/wallet/rpc which:
+//   1. re-canonicalizes the payload server-side
+//   2. enforces spend rules (using `intent` for userOp / typedData branches)
+//   3. computes the backend half of the 2-of-2
+//   4. calls Privy with app auth (Basic) + combined signature
+//   5. returns Privy's response verbatim
+//
+// Going through our backend means the Privy app secret never ships in the
+// CLI — same architectural reason we proxy Alchemy.
+async function signRpc(rpcBody, intent) {
+    const [session, cfg] = await Promise.all([
+        getWalletSession(),
+        getWalletConfig(),
+    ]);
+    const payloadToSign = {
+        version: 1,
+        method: "POST",
+        url: `https://api.privy.io/v1/wallets/${session.walletId}/rpc`,
+        body: rpcBody,
+        headers: { "privy-app-id": cfg.privyAppId },
+    };
+    const serialized = canonicalize(payloadToSign);
+    const userSig = ecdsaSign(pemFromPkcs8B64(session.authorizationKey), serialized);
+    // /api/wallet/rpc is always-array. Single sig is just a 1-element batch.
+    const item = {
+        payload: payloadToSign,
+        userSig,
+    };
+    if (intent)
+        item.intent = intent;
+    const { results } = await post("/api/wallet/rpc", { signatures: [item] });
+    const r = results[0];
+    if (!r)
+        throw new Error("/api/wallet/rpc returned empty results");
+    if (!r.ok) {
+        throw new Error(`privy /rpc ${r.status}: ${r.error ?? "<unknown error>"}`);
+    }
+    return r.data;
+}
+// ---- viem LocalAccount that routes through Privy 2-of-2 -------------------
+export async function getPrivyLocalAccount() {
+    const session = await getWalletSession();
+    return toAccount({
+        address: session.address,
+        async signMessage({ message }) {
+            // Smart-wallet UserOp hashes arrive as { raw: 32-byte hex }.
+            // Sign with raw ECDSA after applying EIP-191 prefixing client-side
+            // so MAv2 can recover via 1271.
+            const isHexString = typeof message === "string" && /^0x[0-9a-fA-F]+$/.test(message);
+            const isRaw = typeof message === "object" && "raw" in message;
+            if (isHexString || isRaw) {
+                const raw = (isHexString ? message : message.raw);
+                const wireHash = hashMessage({ raw });
+                // If this hash corresponds to a userOp we registered before kicking
+                // off the smart-wallet flow, attach it so the backend can policy-
+                // check the underlying call. Without it, /api/wallet/rpc rejects.
+                const op = lookupUserOp(wireHash);
+                const intent = op ? { userOp: serializeUserOp(op) } : undefined;
+                const r = await signRpc({
+                    chain_type: "ethereum",
+                    method: "secp256k1_sign",
+                    params: { hash: wireHash },
+                }, intent);
+                return r.data.signature;
+            }
+            const r = await signRpc({
+                chain_type: "ethereum",
+                method: "personal_sign",
+                params: { message: message, encoding: "utf-8" },
+            });
+            return r.data.signature;
+        },
+        async signTypedData(parameters) {
+            const p = parameters;
+            // If a typed-data intent was registered before this signing round (x402
+            // path: getX402Signer wraps the call in withTypedDataIntent), attach it
+            // so the backend can recover the inner EIP-3009 from the ReplaySafeHash
+            // wrapper Alchemy hands us. JSON-safe-ify since EIP-3009 messages carry
+            // BigInts for uint256 fields and JSON.stringify chokes on those.
+            const td = getCurrentTypedDataIntent();
+            const intent = td
+                ? { typedData: jsonSafe(td) }
+                : undefined;
+            const r = await signRpc({
+                chain_type: "ethereum",
+                method: "eth_signTypedData_v4",
+                params: {
+                    typed_data: {
+                        domain: p.domain,
+                        types: p.types,
+                        primary_type: p.primaryType,
+                        message: p.message,
+                    },
+                },
+            }, intent);
+            return r.data.signature;
+        },
+        async signTransaction() {
+            throw new Error("signTransaction is not used; smart wallet flow signs userOps via signMessage");
+        },
+        async signAuthorization({ chainId, address: contractAddress, nonce }) {
+            const r = await signRpc({
+                chain_type: "ethereum",
+                method: "eth_sign7702Authorization",
+                params: { chain_id: chainId, contract: contractAddress, nonce },
+            });
+            const a = r.data.authorization;
+            return {
+                address: contractAddress,
+                chainId,
+                nonce,
+                r: a.r,
+                s: a.s,
+                yParity: a.y_parity,
+            };
+        },
+    });
+}
+//# sourceMappingURL=privy.js.map

package/dist/src/lib/privy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privy.js","sourceRoot":"","sources":["../../../src/lib/privy.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,iDAAiD;AAEjD,OAAO,YAAY,MAAM,cAAc,CAAC;AACxC,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,WAAW,GAIZ,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,yBAAyB,GAE1B,MAAM,oBAAoB,CAAC;AAE5B,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,EAAE,GAAG,MAAM,GAAG,CAAmC,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,qHAAqH,CACtH,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAcD,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,YAAY,GAAG,MAAM,GAAG,CAAe,oBAAoB,CAAC,CAAC;IAC7D,OAAO,YAAY,CAAC;AACtB,CAAC;AASD,KAAK,UAAU,kBAAkB;IAC/B,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;QAC5B,GAAG,EAAE,IAAI,mBAAmB,EAAE;QAC9B,GAAG,EAAE,IAAI,UAAU,EAAE;QACrB,IAAI,EAAE,IAAI,gBAAgB,EAAE;KAC7B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3E,OAAO;QACL,aAAa,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC;gBAC3C,YAAY,EAAE,EAAE,CAAC,UAAU;gBAC3B,GAAG;aACJ,CAAC,CAAC;YACH,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC7C,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAoB,eAAe,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAInB,yBAAyB,EAAE;QAC5B,oBAAoB,EAAE,eAAe;QACrC,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CACvC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,gBAAgB,EAAE,QAAQ,CAAC,EACvE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAClE,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,gBAAgB,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,gCAAgC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,6BAA6B,CAAC;AACnI,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,WAAmB;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;SACxC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SAC1C,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxB,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,sCAAsC;AACtC,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASD,mEAAmE;AACnE,gEAAgE;AAChE,yBAAyB;AACzB,gDAAgD;AAChD,6EAA6E;AAC7E,+CAA+C;AAC/C,8DAA8D;AAC9D,yCAAyC;AACzC,EAAE;AACF,0EAA0E;AAC1E,oDAAoD;AACpD,KAAK,UAAU,OAAO,CAAI,OAAe,EAAE,MAAe;IACxD,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvC,gBAAgB,EAAE;QAClB,eAAe,EAAE;KAClB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG;QACpB,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAe;QACvB,GAAG,EAAE,mCAAmC,OAAO,CAAC,QAAQ,MAAM;QAC9D,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE;KAC5C,CAAC;IACF,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAW,CAAC;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC,CAAC;IAEjF,yEAAyE;IACzE,MAAM,IAAI,GAAwE;QAChF,OAAO,EAAE,aAAa;QACtB,OAAO;KACR,CAAC;IACF,IAAI,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACjC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAC5B,iBAAiB,EACjB,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;IACF,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,IAAS,CAAC;AACrB,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,OAAO,SAAS,CAAC;QACf,OAAO,EAAE,OAAO,CAAC,OAAO;QAExB,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE;YAC3B,6DAA6D;YAC7D,mEAAmE;YACnE,gCAAgC;YAChC,MAAM,WAAW,GACf,OAAO,OAAO,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,CAAC;YAC9D,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,OAAwB,CAAC,GAAG,CAAQ,CAAC;gBAC3E,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;gBACtC,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAClC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChE,MAAM,CAAC,GAAG,MAAM,OAAO,CACrB;oBACE,UAAU,EAAE,UAAU;oBACtB,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC3B,EACD,MAAM,CACP,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YAC1B,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAA+B;gBACpD,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,EAAE,OAAO,EAAE,OAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE;aAC1D,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,UAAU;YAC5B,MAAM,CAAC,GAAG,UAKT,CAAC;YACF,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjE,MAAM,EAAE,GAAG,yBAAyB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,EAAE;gBACf,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAwB,EAAE;gBACpD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,OAAO,CACrB;gBACE,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE;oBACN,UAAU,EAAE;wBACV,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,YAAY,EAAE,CAAC,CAAC,WAAW;wBAC3B,OAAO,EAAE,CAAC,CAAC,OAAO;qBACnB;iBACF;aACF,EACD,MAAM,CACP,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,eAAe;YACnB,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE;YAClE,MAAM,CAAC,GAAG,MAAM,OAAO,CAIpB;gBACD,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE;aAChE,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,eAAe;gBACxB,OAAO;gBACP,KAAK;gBACL,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,OAAO,EAAE,CAAC,CAAC,QAAQ;aACX,CAAC;QACb,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/src/lib/smart-wallet.d.ts

@@ -0,0 +1,13 @@
+import { type Address, type Hex } from "viem";
+export declare function getSmartWalletClient(): Promise<any>;
+export declare function ensureDelegated(): Promise<void>;
+export interface ClientEvmSigner {
+    readonly address: Address;
+    signTypedData(message: {
+        domain: Record<string, unknown>;
+        types: Record<string, unknown>;
+        primaryType: string;
+        message: Record<string, unknown>;
+    }): Promise<Hex>;
+}
+export declare function getX402Signer(): Promise<ClientEvmSigner>;

package/dist/src/lib/smart-wallet.js

@@ -0,0 +1,90 @@
+// Alchemy MAv2 smart wallet bridge: builds the @alchemy/wallet-apis client
+// using our Privy-backed signer, and exposes the helpers built on top of it
+// (7702 setup-time delegation, x402 signer adapter).
+import { base } from "viem/chains";
+import { createSmartWalletClient, alchemyWalletTransport, } from "@alchemy/wallet-apis";
+import { requireAuthToken } from "./api.js";
+import { getPrivyLocalAccount, getWalletConfig } from "./privy.js";
+import { withPreparedUserOps, withTypedDataIntent, } from "./policy-intent.js";
+import { publicClient } from "./usdc.js";
+// Talks to Alchemy via our backend proxy so the API key stays server-side.
+// We pass `url` to override the default (api.g.alchemy.com/v2) and inject
+// the CLI's session token via fetchOptions. We deliberately omit
+// `apiKey`/`jwt` because withAlchemyHeaders would otherwise overwrite our
+// Authorization header.
+export async function getSmartWalletClient() {
+    const cfg = await getWalletConfig();
+    const account = await getPrivyLocalAccount();
+    return createSmartWalletClient({
+        signer: account,
+        transport: alchemyWalletTransport({
+            url: cfg.walletApiUrl,
+            fetchOptions: {
+                headers: { Authorization: `Bearer ${requireAuthToken()}` },
+            },
+        }),
+        chain: base,
+        paymaster: cfg.gasPolicyId ? { policyId: cfg.gasPolicyId } : undefined,
+    });
+}
+// 7702-delegate the wallet if it has no code yet. Drives an empty userOp
+// (`execute(0x0, 0, 0x)`) through Alchemy's bundler so the 7702 authorization
+// is included in the bundle. The backend policy classifies this as no-spend.
+//
+// Idempotent — short-circuits via `eth_getCode` if the wallet is already
+// delegated. Safe to call before any signing-only flow (x402, ReplaySafeHash
+// typed-data signing) that won't otherwise originate a userOp.
+export async function ensureDelegated() {
+    const client = await getSmartWalletClient();
+    const address = client.account.address;
+    const code = await publicClient().getCode({ address });
+    if (code && code !== "0x")
+        return;
+    const prepared = await client.prepareCalls({
+        calls: [
+            {
+                to: "0x0000000000000000000000000000000000000000",
+                value: 0n,
+                data: "0x",
+            },
+        ],
+    });
+    // Bootstrap returns an array of [authorization, userOp]. Subsequent prepares
+    // would return a plain user-operation-v070 — we accept either.
+    const userOps = prepared.type === "user-operation-v070"
+        ? [prepared.data]
+        : prepared.type === "array"
+            ? prepared.data
+                .filter((item) => item.type === "user-operation-v070")
+                .map((item) => item.data)
+            : (() => {
+                throw new Error(`unexpected prepared.type: ${prepared.type}`);
+            })();
+    const sent = await withPreparedUserOps(userOps, async () => {
+        const signed = await client.signPreparedCalls(prepared);
+        return client.sendPreparedCalls(signed);
+    });
+    await client.waitForCallsStatus({ id: sent.id });
+}
+export async function getX402Signer() {
+    const client = await getSmartWalletClient();
+    return {
+        address: client.account.address,
+        signTypedData: async (params) => {
+            // Register the EIP-3009 we're about to sign so the privy LocalAccount
+            // can attach it as `intent.typedData` when Alchemy hands back a
+            // ReplaySafeHash wrapper. The backend uses it to bind the wrapper to
+            // the inner authorization and run TransferWithAuthorization policy.
+            return (await withTypedDataIntent({
+                domain: params.domain,
+                types: params.types,
+                primaryType: params.primaryType,
+                message: params.message,
+            }, 
+            // Smart wallet method — produces the SemiModular-format 72-byte sig
+            // that USDC's bytes overload + 1271 verification accepts.
+            async () => (await client.signTypedData(params))));
+        },
+    };
+}
+//# sourceMappingURL=smart-wallet.js.map

package/dist/src/lib/smart-wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smart-wallet.js","sourceRoot":"","sources":["../../../src/lib/smart-wallet.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,4EAA4E;AAC5E,qDAAqD;AAGrD,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,2EAA2E;AAC3E,0EAA0E;AAC1E,iEAAiE;AACjE,0EAA0E;AAC1E,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,OAAO,uBAAuB,CAAC;QAC7B,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,sBAAsB,CAAC;YAChC,GAAG,EAAE,GAAG,CAAC,YAAY;YACrB,YAAY,EAAE;gBACZ,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,gBAAgB,EAAE,EAAE,EAAE;aAC3D;SACF,CAAC;QACF,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAkB,CAAC;IAElD,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO;IAElC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;QACzC,KAAK,EAAE;YACL;gBACE,EAAE,EAAE,4CAA4C;gBAChD,KAAK,EAAE,EAAE;gBACT,IAAI,EAAE,IAAW;aAClB;SACF;KACF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,KAAK,qBAAqB;QACrC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;YACzB,CAAC,CAAE,QAAQ,CAAC,IAAwD;iBAC/D,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC;iBACrD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,IAAc,EAAE,CACvD,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;IAEb,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC5C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAkB;QAC1C,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9B,sEAAsE;YACtE,gEAAgE;YAChE,qEAAqE;YACrE,oEAAoE;YACpE,OAAO,CAAC,MAAM,mBAAmB,CAC/B;gBACE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB;YACD,oEAAoE;YACpE,0DAA0D;YAC1D,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,MAAe,CAAC,CAAQ,CACjE,CAAQ,CAAC;QACZ,CAAC;KACF,CAAC;AACJ,CAAC"}