@ambasada/sdk 0.7.4 → 0.8.0

package/dist/index.js

@@ -1,3 +1,190 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../protocol/src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  APP_EVENT_TYPES: () => APP_EVENT_TYPES,
+  APP_NOTIFY_PATH: () => APP_NOTIFY_PATH,
+  APP_SIGNATURE_HEADER: () => APP_SIGNATURE_HEADER,
+  APP_TIMESTAMP_HEADER: () => APP_TIMESTAMP_HEADER,
+  APP_WEBHOOK_TOLERANCE_S: () => APP_WEBHOOK_TOLERANCE_S,
+  AppWebhookError: () => AppWebhookError,
+  DEFAULT_HUB_URL: () => DEFAULT_HUB_URL,
+  DEFAULT_ISSUER: () => DEFAULT_ISSUER,
+  EMPTY_ROOT: () => EMPTY_ROOT,
+  ERROR_STATUS: () => ERROR_STATUS,
+  FETCH_TIMEOUT_MS: () => FETCH_TIMEOUT_MS,
+  HEADERS: () => HEADERS,
+  HOSTED_MANIFEST: () => HOSTED_MANIFEST,
+  ICON_SIZE: () => ICON_SIZE,
+  MANIFEST_CATEGORIES: () => MANIFEST_CATEGORIES,
+  MANIFEST_ID: () => MANIFEST_ID,
+  MANIFEST_KINDS: () => MANIFEST_KINDS,
+  MANIFEST_LIMITS: () => MANIFEST_LIMITS,
+  MANIFEST_SCHEMA: () => MANIFEST_SCHEMA,
+  MANIFEST_URL_PATH: () => MANIFEST_URL_PATH,
+  MANIFEST_VISIBILITY: () => MANIFEST_VISIBILITY,
+  MAX_DEPTH: () => MAX_DEPTH,
+  MAX_PRICE_NANO: () => MAX_PRICE_NANO,
+  MIN_PRICE_NANO: () => MIN_PRICE_NANO,
+  NANO_PER_TON: () => NANO_PER_TON,
+  NOTIFY_LIMITS: () => NOTIFY_LIMITS,
+  RECEIPT_HEADER: () => RECEIPT_HEADER,
+  ReceiptError: () => ReceiptError,
+  SHELL_TOKEN_TTL_S: () => SHELL_TOKEN_TTL_S,
+  SLOW_ENTRY_MS: () => SLOW_ENTRY_MS,
+  SYSTEM_ACCOUNT: () => SYSTEM_ACCOUNT,
+  VillageError: () => VillageError,
+  WEBHOOK_HEADERS: () => WEBHOOK_HEADERS,
+  WebhookError: () => WebhookError,
+  appNotifyBody: () => appNotifyBody,
+  appNotifyResult: () => appNotifyResult,
+  appWebhookHeaders: () => appWebhookHeaders,
+  base64url: () => base64url,
+  checkHtml: () => checkHtml,
+  checkIcon: () => checkIcon,
+  checkRemote: () => checkRemote,
+  createReceiptSigner: () => createReceiptSigner,
+  decodeLeaf: () => decodeLeaf,
+  encodeLeaf: () => encodeLeaf,
+  equalBytes: () => equalBytes,
+  findingLabel: () => findingLabel,
+  formatCheckpoint: () => formatCheckpoint,
+  fromBase64: () => fromBase64,
+  fromBase64url: () => fromBase64url,
+  fromNano: () => fromNano,
+  generateShellKey: () => generateShellKey,
+  generateSigningKey: () => generateSigningKey,
+  generateWebhookSecret: () => generateWebhookSecret,
+  inclusionProof: () => inclusionProof,
+  isErrorBody: () => isErrorBody,
+  jwksLoader: () => jwksLoader,
+  leafHash: () => leafHash,
+  listingLine: () => listingLine,
+  nodeHash: () => nodeHash,
+  parseCheckpoint: () => parseCheckpoint,
+  parseVerifierKey: () => parseVerifierKey,
+  pngInfo: () => pngInfo,
+  publicJwkOf: () => publicJwkOf,
+  randomId: () => randomId,
+  rootFromLeafHashes: () => rootFromLeafHashes,
+  sha256Hex: () => sha256Hex,
+  signAppWebhook: () => signAppWebhook,
+  signNote: () => signNote,
+  signShellToken: () => signShellToken,
+  signWebhook: () => signWebhook,
+  splitPoint: () => splitPoint,
+  summarizeCheck: () => summarizeCheck,
+  toBase64: () => toBase64,
+  toNano: () => toNano,
+  validateManifest: () => validateManifest,
+  verifierKey: () => verifierKey,
+  verifyAppWebhook: () => verifyAppWebhook,
+  verifyCheckoutReceipt: () => verifyCheckoutReceipt,
+  verifyInclusion: () => verifyInclusion,
+  verifyNote: () => verifyNote,
+  verifyReceipt: () => verifyReceipt,
+  verifyWebhook: () => verifyWebhook,
+  webhookHeaders: () => webhookHeaders
+});
+
+// ../protocol/src/money.ts
+var NANO_PER_TON = 1e9;
+var MIN_PRICE_NANO = NANO_PER_TON / 10;
+var MAX_PRICE_NANO = 500 * NANO_PER_TON;
+var DECIMAL = /^(\d+)(?:\.(\d{1,9}))?$/;
+function toNano(value) {
+  let text;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || value < 0) return null;
+    text = value.toFixed(9);
+  } else if (typeof value === "string") {
+    text = value.trim();
+  } else {
+    return null;
+  }
+  const match = DECIMAL.exec(text);
+  if (!match) return null;
+  const whole = Number(match[1]);
+  const frac = Number((match[2] ?? "").padEnd(9, "0"));
+  const nano = whole * NANO_PER_TON + frac;
+  return Number.isSafeInteger(nano) ? nano : null;
+}
+function fromNano(nano) {
+  return Number((nano / NANO_PER_TON).toFixed(9));
+}
+
+// ../protocol/src/errors.ts
+var ERROR_STATUS = {
+  // EXCHANGE.md §5 vocabulary
+  INSUFFICIENT_FUNDS: 402,
+  OFFLINE: 503,
+  TIMEOUT: 504,
+  SCHEMA_INVALID: 502,
+  CAP_BUYER_HOURLY: 429,
+  // the company's spending limit for the last hour
+  CAP_SELLER_RATE: 429,
+  // reserved: seller rate limits land with the rules milestone (day 11)
+  DEAL_EXHAUSTED: 409,
+  // reserved: deals land with the registry/exchange work
+  DEPTH_EXCEEDED: 422,
+  BUDGET_EXCEEDED: 402,
+  CAP_INBOX_RATE: 429,
+  // inbox texts: 20 an hour, 1 unsolicited per counterparty an hour (EXCHANGE.md §8)
+  // Additions needed by the gateway and bank
+  UPSTREAM_ERROR: 502,
+  PRICE_ABOVE_MAX: 409,
+  SELF_PURCHASE: 403,
+  INVALID_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  NOT_FOUND: 404,
+  CONFLICT: 409,
+  IDEMPOTENCY_CONFLICT: 422,
+  IDEMPOTENCY_IN_PROGRESS: 409,
+  HOLD_NOT_ACTIVE: 409,
+  INTERNAL: 500,
+  // Spending limits a team sets for its company wallet (DESIGN.md §0 "Controlling agent spending")
+  CAP_PER_PAYMENT: 403,
+  CAP_BUYER_DAILY: 429,
+  CAP_PAYEE_DAILY: 429,
+  // A person's spend at one company per venue day (DESIGN.md §5 "Visitor rules")
+  CAP_VISITOR_DAILY: 429,
+  // Agent payments over the automatic limit wait for the team (DESIGN.md §5 "Agent approvals")
+  APPROVAL_REQUIRED: 403,
+  APPROVAL_INVALID: 403,
+  APPROVALS_PENDING: 429,
+  // Model and tool provider (LLMOK, docs/LLMOK.md): the village's provider budget is spent, or the
+  // provider refused the model/tool/key (a configuration problem on our side). Never the caller's fault.
+  PROVIDER_BUDGET: 503,
+  PROVIDER_DENIED: 502,
+  // Deploy-freeze and unattended windows: agents keep running, but config and steer are closed (DESIGN.md §5)
+  FROZEN: 403
+};
+var VillageError = class extends Error {
+  code;
+  status;
+  details;
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "VillageError";
+    this.code = code;
+    this.status = ERROR_STATUS[code];
+    this.details = details;
+  }
+  toBody() {
+    return { error: { code: this.code, message: this.message, ...this.details } };
+  }
+};
+function isErrorBody(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const error = value.error;
+  return typeof error === "object" && error !== null && typeof error.code === "string";
+}
+
 // ../protocol/src/encoding.ts
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
@@ -7,6 +194,11 @@ function utf8(text) {
 function fromUtf8(bytes) {
   return decoder.decode(bytes);
 }
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function fromBase64url(text) {
   const padded = text.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((text.length + 3) % 4);
   const binary = atob(padded);
@@ -21,9 +213,14 @@ function toBytes(data) {
 }
 async function sha256Hex(data) {
   const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", toBytes(data)));
-  let hex2 = "";
-  for (const byte of digest) hex2 += byte.toString(16).padStart(2, "0");
-  return hex2;
+  let hex3 = "";
+  for (const byte of digest) hex3 += byte.toString(16).padStart(2, "0");
+  return hex3;
+}
+function randomId(prefix, bytes = 12) {
+  const raw = new Uint8Array(bytes);
+  crypto.getRandomValues(raw);
+  return `${prefix}_${base64url(raw)}`;
 }
 
 // ../protocol/src/receipt.ts
@@ -38,6 +235,38 @@ var ReceiptError = class extends Error {
   reason;
 };
 var ED25519 = { name: "Ed25519" };
+function publicJwkOf(jwk) {
+  return { kty: "OKP", crv: "Ed25519", x: jwk.x, kid: jwk.kid ?? jwk.x.slice(0, 16), alg: "EdDSA", use: "sig" };
+}
+async function generateSigningKey() {
+  const pair = await crypto.subtle.generateKey(ED25519, true, ["sign", "verify"]);
+  const exported = await crypto.subtle.exportKey("jwk", pair.privateKey);
+  const kid = `vk-${(await sha256Hex(exported.x)).slice(0, 12)}`;
+  const privateJwk = { kty: "OKP", crv: "Ed25519", x: exported.x, d: exported.d, kid, alg: "EdDSA" };
+  return { privateJwk, publicJwk: publicJwkOf(privateJwk) };
+}
+async function createReceiptSigner(privateJwk) {
+  if (!privateJwk.d) throw new Error("receipt signing key must be a private Ed25519 JWK (missing d)");
+  const publicJwk = publicJwkOf(privateJwk);
+  const kid = publicJwk.kid;
+  const key = await crypto.subtle.importKey(
+    "jwk",
+    { kty: "OKP", crv: "Ed25519", x: privateJwk.x, d: privateJwk.d },
+    ED25519,
+    false,
+    ["sign"]
+  );
+  const header3 = base64url(utf8(JSON.stringify({ alg: "EdDSA", typ: "JWT", kid })));
+  return {
+    kid,
+    publicJwk,
+    async sign(claims) {
+      const signingInput = `${header3}.${base64url(utf8(JSON.stringify(claims)))}`;
+      const signature = new Uint8Array(await crypto.subtle.sign(ED25519, key, utf8(signingInput)));
+      return `${signingInput}.${base64url(signature)}`;
+    }
+  };
+}
 async function verifyReceipt(token, options) {
   const claims = await verifySigned(token, options);
   if (claims.kind !== void 0 || typeof claims.call_id !== "string" || typeof claims.body_sha256 !== "string") {
@@ -93,6 +322,584 @@ async function verifySigned(token, options) {
   if (claims.iss !== (options.issuer ?? DEFAULT_ISSUER)) throw new ReceiptError("wrong_issuer", `unexpected issuer ${String(claims.iss)}`);
   return claims;
 }
+function jwksLoader(url, { ttlMs = 10 * 6e4 } = {}) {
+  let cached;
+  return async () => {
+    if (cached && Date.now() - cached.at < ttlMs) return cached.keys;
+    const res = await fetch(url);
+    if (!res.ok) throw new Error(`failed to load village keys from ${url}: ${res.status}`);
+    const { keys: keys3 } = await res.json();
+    cached = { keys: keys3, at: Date.now() };
+    return keys3;
+  };
+}
+
+// ../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/_u64.js
+var fromNumH = (n) => n / 2 ** 32 | 0;
+var fromNumL = (n) => n >>> 0;
+function setU64FromNum(view, byteOffset, n, isLE) {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE ? l : h, isLE);
+  view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+}
+
+// ../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+var atitle = (title) => title ? `"${title}" ` : "";
+function anumber(n, title = "") {
+  if (typeof n !== "number")
+    throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+  return n;
+}
+function abytes(value, length, title = "") {
+  if (isBytes(value) && (length === void 0 || value.length === length))
+    return value;
+  if (length !== void 0)
+    anumber(length, "length");
+  const bytes = isBytes(value);
+  const ofLen = length !== void 0 ? ` of length ${length}` : "";
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+  const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+  if (!bytes)
+    throw new TypeError(message);
+  throw new RangeError(message);
+}
+var aobject = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+};
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("hash was destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("digest() was already called");
+}
+function aoutput(out, instance) {
+  abytes(out, void 0, "output");
+  const min = instance.outputLen;
+  if (!(out.length >= min)) {
+    throw new RangeError('"output" expected length >= ' + min);
+  }
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+function checkOpts(defaults, opts, title = "opts") {
+  aopts(defaults, "defaults");
+  if (opts !== void 0)
+    aopts(opts, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts);
+  return merged;
+}
+function createHasher(hashCons, info = {}) {
+  if (typeof hashCons !== "function")
+    throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+  info = checkOpts({}, info, "info");
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
+
+// ../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/_md.js
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class {
+  blockLen;
+  outputLen;
+  canXOF = false;
+  padOffset;
+  isLE;
+  // For partial updates less than block size
+  buffer;
+  view;
+  finished = false;
+  length = 0;
+  pos = 0;
+  destroyed = false;
+  constructor(blockLen, outputLen, padOffset, isLE) {
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    let processed = false;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        processed = true;
+        continue;
+      }
+      buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+        processed = true;
+      }
+    }
+    this.length += data.length;
+    if (processed)
+      this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    buffer.fill(0, pos);
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      buffer.fill(0);
+    }
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
+    this.process(view, 0);
+    this.roundClean();
+    const oview = out === buffer ? view : createView(out);
+    const len = this.outputLen;
+    const outLen = len / 4;
+    const state = this.get();
+    if (len % 4 || outLen > state.length)
+      throw new Error("invalid outputLen");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneIntoMeta(to) {
+    const { buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (pos)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// ../../node_modules/.pnpm/@noble+hashes@2.4.0/node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA2_32B = class extends HashMD {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  // Numeric initializers matter: starting the fields as `undefined` changes
+  // V8's field representation and makes sha256 3x slower (measured).
+  A = 0;
+  B = 0;
+  C = 0;
+  D = 0;
+  E = 0;
+  F = 0;
+  G = 0;
+  H = 0;
+  constructor(outputLen, IV) {
+    super(64, outputLen, 8, false);
+    this.A = IV[0] | 0;
+    this.B = IV[1] | 0;
+    this.C = IV[2] | 0;
+    this.D = IV[3] | 0;
+    this.E = IV[4] | 0;
+    this.F = IV[5] | 0;
+    this.G = IV[6] | 0;
+    this.H = IV[7] | 0;
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var _SHA256 = class extends SHA2_32B {
+  constructor() {
+    super(32, SHA256_IV);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(
+  () => new _SHA256(),
+  /* @__PURE__ */ oidNist(1)
+);
+
+// ../protocol/src/merkle.ts
+function leafHash(leaf) {
+  const bytes = typeof leaf === "string" ? utf8(leaf) : leaf;
+  const input = new Uint8Array(bytes.length + 1);
+  input[0] = 0;
+  input.set(bytes, 1);
+  return sha256(input);
+}
+function nodeHash(left, right) {
+  const input = new Uint8Array(65);
+  input[0] = 1;
+  input.set(left, 1);
+  input.set(right, 33);
+  return sha256(input);
+}
+var EMPTY_ROOT = sha256(new Uint8Array(0));
+function splitPoint(n) {
+  let k = 1;
+  while (k * 2 < n) k *= 2;
+  return k;
+}
+function rootFromLeafHashes(hashes) {
+  const stack = [];
+  for (const hash of hashes) {
+    let node = { size: 1, hash };
+    while (stack.length > 0 && stack[stack.length - 1].size === node.size) {
+      const left = stack.pop();
+      node = { size: left.size * 2, hash: nodeHash(left.hash, node.hash) };
+    }
+    stack.push(node);
+  }
+  if (stack.length === 0) return EMPTY_ROOT;
+  let root = stack[stack.length - 1].hash;
+  for (let i = stack.length - 2; i >= 0; i--) root = nodeHash(stack[i].hash, root);
+  return root;
+}
+function inclusionProof(index, size, rangeHash) {
+  if (!(index >= 0 && index < size)) throw new RangeError(`index ${index} not in tree of size ${size}`);
+  const proof = [];
+  let lo = 0;
+  let hi = size;
+  while (hi - lo > 1) {
+    const k = splitPoint(hi - lo);
+    if (index < lo + k) {
+      proof.push(rangeHash(lo + k, hi));
+      hi = lo + k;
+    } else {
+      proof.push(rangeHash(lo, lo + k));
+      lo = lo + k;
+    }
+  }
+  return proof.reverse();
+}
+function verifyInclusion(index, size, leaf, proof, root) {
+  if (!(index >= 0 && index < size)) return false;
+  let fn = index;
+  let sn = size - 1;
+  let r = leaf;
+  for (const p of proof) {
+    if (sn === 0) return false;
+    if (fn % 2 === 1 || fn === sn) {
+      r = nodeHash(p, r);
+      while (fn % 2 === 0 && fn !== 0) {
+        fn = Math.floor(fn / 2);
+        sn = Math.floor(sn / 2);
+      }
+    } else {
+      r = nodeHash(r, p);
+    }
+    fn = Math.floor(fn / 2);
+    sn = Math.floor(sn / 2);
+  }
+  return sn === 0 && equalBytes(r, root);
+}
+function equalBytes(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+
+// ../protocol/src/note.ts
+var ED255192 = { name: "Ed25519" };
+var ALG_ED25519 = 1;
+var DASH = "\u2014";
+function formatCheckpoint({ origin, size, root }) {
+  return `${origin}
+${size}
+${root}
+`;
+}
+function parseCheckpoint(body) {
+  const [origin, sizeText, root] = body.split("\n");
+  const size = Number(sizeText);
+  if (!origin || !Number.isSafeInteger(size) || size < 0 || !root || fromBase64(root).length !== 32) {
+    throw new Error("malformed checkpoint");
+  }
+  return { origin, size, root };
+}
+function keyId(name, publicKey) {
+  const input = new Uint8Array([...utf8(name), 10, ALG_ED25519, ...publicKey]);
+  return sha256(input).slice(0, 4);
+}
+function verifierKey(name, publicJwk) {
+  const publicKey = fromBase64url(publicJwk.x);
+  const id = keyId(name, publicKey);
+  return `${name}+${hex(id)}+${toBase64(new Uint8Array([ALG_ED25519, ...publicKey]))}`;
+}
+function parseVerifierKey(vkey) {
+  const [name, idHex, ...key] = vkey.split("+");
+  const keyB64 = key.join("+");
+  if (!name || !idHex || !keyB64) throw new Error("malformed verifier key");
+  const raw = fromBase64(keyB64);
+  if (raw.length !== 33 || raw[0] !== ALG_ED25519) throw new Error("verifier key is not Ed25519");
+  const publicKey = raw.slice(1);
+  const id = keyId(name, publicKey);
+  if (hex(id) !== idHex) throw new Error("verifier key id does not match its key");
+  return { name, id, publicKey };
+}
+async function signNote(text, name, privateJwk) {
+  if (!text.endsWith("\n")) throw new Error("note text must end with a newline");
+  if (!privateJwk.d) throw new Error("signing key must be a private Ed25519 JWK");
+  const key = await crypto.subtle.importKey(
+    "jwk",
+    { kty: "OKP", crv: "Ed25519", x: privateJwk.x, d: privateJwk.d },
+    ED255192,
+    false,
+    ["sign"]
+  );
+  const signature = new Uint8Array(await crypto.subtle.sign(ED255192, key, utf8(text)));
+  const id = keyId(name, fromBase64url(privateJwk.x));
+  return `${text}
+${DASH} ${name} ${toBase64(new Uint8Array([...id, ...signature]))}
+`;
+}
+async function verifyNote(note, vkey) {
+  const { name, id, publicKey } = parseVerifierKey(vkey);
+  const split = note.lastIndexOf("\n\n");
+  if (split < 0 || !note.endsWith("\n")) throw new Error("malformed note");
+  const text = note.slice(0, split + 1);
+  const lines = note.slice(split + 2, -1).split("\n");
+  const key = await crypto.subtle.importKey("raw", publicKey, ED255192, false, ["verify"]);
+  for (const line of lines) {
+    const match = new RegExp(`^${DASH} (\\S+) (\\S+)$`).exec(line);
+    if (!match || match[1] !== name) continue;
+    const raw = fromBase64(match[2]);
+    if (raw.length !== 68 || hex(raw.slice(0, 4)) !== hex(id)) continue;
+    if (await crypto.subtle.verify(ED255192, key, raw.slice(4), utf8(text))) return text;
+  }
+  throw new Error(`note is not signed by ${name}`);
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 32768) binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  return btoa(binary);
+}
+function fromBase64(text) {
+  const binary = atob(text);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function hex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// ../protocol/src/ledger-log.ts
+var SYSTEM_ACCOUNT = "@village";
+function encodeLeaf(leaf) {
+  const ordered = {
+    v: 1,
+    index: leaf.index,
+    id: leaf.id,
+    ts: leaf.ts,
+    kind: leaf.kind,
+    from: leaf.from,
+    to: leaf.to,
+    amount: leaf.amount,
+    from_balance: leaf.from_balance,
+    to_balance: leaf.to_balance,
+    ref: leaf.ref,
+    hold_id: leaf.hold_id,
+    memo: leaf.memo
+  };
+  return JSON.stringify(ordered);
+}
+function decodeLeaf(data) {
+  const leaf = JSON.parse(data);
+  if (leaf.v !== 1 || encodeLeaf(leaf) !== data) throw new Error("leaf is not in canonical form");
+  return leaf;
+}
 
 // ../protocol/src/webhook.ts
 var WEBHOOK_HEADERS = {
@@ -180,6 +987,7 @@ var APP_TIMESTAMP_HEADER = "x-ambasada-timestamp";
 var APP_WEBHOOK_TOLERANCE_S = 300;
 var DEFAULT_HUB_URL = "https://hub.ambasada.id";
 var APP_NOTIFY_PATH = "/api/apps/notify";
+var APP_EVENT_TYPES = ["notifications_enabled", "notifications_disabled", "app_added", "app_removed", "ping"];
 var AppWebhookError = class extends Error {
   constructor(reason, message) {
     super(message);
@@ -198,13 +1006,13 @@ function hmacKey2(secret) {
   }
   return key;
 }
-var hex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+var hex2 = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 async function mac(secret, timestamp, body) {
   return new Uint8Array(await crypto.subtle.sign("HMAC", await hmacKey2(secret), encoder3.encode(`${timestamp}.${body}`)));
 }
 async function signAppWebhook(secret, timestamp, body) {
   if (!secret) throw new AppWebhookError("bad_secret", "no app secret");
-  return `v1=${hex(await mac(secret, String(timestamp), body))}`;
+  return `v1=${hex2(await mac(secret, String(timestamp), body))}`;
 }
 async function appWebhookHeaders(secret, body, timestamp = Math.floor(Date.now() / 1e3)) {
   return { [APP_TIMESTAMP_HEADER]: String(timestamp), [APP_SIGNATURE_HEADER]: await signAppWebhook(secret, timestamp, body), "content-type": "application/json" };
@@ -310,8 +1118,301 @@ function appNotifyResult(json) {
   return { sent: list(o.sent), invalid: list(o.invalid), rate_limited: list(o.rate_limited) };
 }
 
+// ../protocol/src/check.ts
+var MANIFEST_URL_PATH = "/.well-known/ambasada.json";
+var MANIFEST_SCHEMA = 2;
+var MANIFEST_KINDS = ["product", "event", "tool", "assistant"];
+var MANIFEST_CATEGORIES = ["shopping", "food", "events", "tools", "learning", "community", "games", "finance", "other"];
+var MANIFEST_VISIBILITY = ["public", "builders", "unlisted"];
+var MANIFEST_LIMITS = { id: 32, name: 32, subtitle: 40, description: 170, tags: 5, screenshots: 3 };
+var MANIFEST_ID = /^[a-z0-9-]{3,32}$/;
+var HOSTED_MANIFEST = /^https:\/\/hub\.ambasada\.id\/api\/apps\/([a-z0-9-]+)\/manifest$/;
+var ICON_SIZE = 1024;
+var SLOW_ENTRY_MS = 3e3;
+var FETCH_TIMEOUT_MS = 1e4;
+var HEX_COLOR = /^#[0-9a-fA-F]{6}$/;
+var SDK_MARKERS = ["@ambasada/miniapp", "miniapp.js", "ambasadaShell"];
+var findings = () => ({ problems: [], warnings: [] });
+var merge = (into, from) => {
+  into.problems.push(...from.problems);
+  into.warnings.push(...from.warnings);
+};
+function validateManifest(json) {
+  const f = findings();
+  const problem = (code, message) => f.problems.push({ code, message });
+  const warn = (code, message) => f.warnings.push({ code, message });
+  if (!json || typeof json !== "object" || Array.isArray(json)) {
+    problem("manifest_not_object", "the manifest must be a JSON object");
+    return f;
+  }
+  const m = json;
+  const str = (key) => typeof m[key] === "string" ? m[key] : void 0;
+  if (m.schema === 1) warn("schema_1", `schema 1 still works, but the app lists it as Unlisted until it is updated to schema ${MANIFEST_SCHEMA} (ambasada init writes the new one)`);
+  else if (m.schema !== MANIFEST_SCHEMA) problem("schema", `"schema" must be ${MANIFEST_SCHEMA} (got ${JSON.stringify(m.schema)})`);
+  const id = str("id");
+  if (!id) problem("id", '"id" is required: 3\u201332 lowercase letters, digits and dashes');
+  else if (!MANIFEST_ID.test(id)) problem("id", `"id" must match ${MANIFEST_ID} (got ${JSON.stringify(id)})`);
+  const name = str("name");
+  if (!name) problem("name", '"name" is required');
+  else if (name.length > MANIFEST_LIMITS.name) problem("name_length", `"name" is ${name.length} characters; the limit is ${MANIFEST_LIMITS.name}`);
+  const icon = str("icon");
+  if (!icon) problem("icon", '"icon" is required: the path of a 1024\xD71024 opaque PNG, like "/icon.png"');
+  const entry = str("entry");
+  if (!entry) problem("entry", '"entry" is required: the path the app opens, like "/"');
+  else if (!entry.startsWith("/")) problem("entry", `"entry" must be a path starting with / (got ${JSON.stringify(entry)})`);
+  const subtitle = str("subtitle");
+  if (subtitle && subtitle.length > MANIFEST_LIMITS.subtitle) problem("subtitle_length", `"subtitle" is ${subtitle.length} characters; the limit is ${MANIFEST_LIMITS.subtitle}`);
+  const description = str("description");
+  if (description && description.length > MANIFEST_LIMITS.description) problem("description_length", `"description" is ${description.length} characters; the limit is ${MANIFEST_LIMITS.description}`);
+  if (Array.isArray(m.tags) && m.tags.length > MANIFEST_LIMITS.tags) problem("tags_count", `"tags" has ${m.tags.length} items; the limit is ${MANIFEST_LIMITS.tags}`);
+  if (Array.isArray(m.screenshots) && m.screenshots.length > MANIFEST_LIMITS.screenshots) problem("screenshots_count", `"screenshots" has ${m.screenshots.length} items; the limit is ${MANIFEST_LIMITS.screenshots}`);
+  const scopes = Array.isArray(m.scopes) ? m.scopes.filter((s) => typeof s === "string") : [];
+  if (m.scopes !== void 0 && !Array.isArray(m.scopes)) problem("scopes", '"scopes" must be an array of strings');
+  if (scopes.includes("notifications")) {
+    const webhook = m.notifications && typeof m.notifications === "object" ? m.notifications.webhook : void 0;
+    if (typeof webhook !== "string" || !webhook) problem("notifications_webhook", 'the "notifications" scope needs "notifications": { "webhook": "/api/webhook" }, where the app delivers notifications_enabled');
+  }
+  if (scopes.length && !str("privacy_url")) problem("privacy_url", `apps with scopes (${scopes.join(", ")}) need a "privacy_url"`);
+  const visibility = str("visibility");
+  if (m.visibility !== void 0 && (!visibility || !(MANIFEST_VISIBILITY.includes(visibility) || /^event:[a-z0-9-]+$/.test(visibility)))) {
+    problem("visibility", `"visibility" must be one of ${MANIFEST_VISIBILITY.join(", ")} or event:<slug> (got ${JSON.stringify(m.visibility)})`);
+  }
+  const accent = str("accent");
+  if (m.accent !== void 0 && (!accent || !HEX_COLOR.test(accent))) problem("accent", `"accent" must be a #RRGGBB colour (got ${JSON.stringify(m.accent)})`);
+  if (m.splash !== void 0) {
+    const splash = m.splash && typeof m.splash === "object" ? m.splash : null;
+    const color = splash?.color;
+    if (!splash || color !== void 0 && (typeof color !== "string" || !HEX_COLOR.test(color))) problem("splash_color", `"splash.color" must be a #RRGGBB colour (got ${JSON.stringify(color ?? m.splash)})`);
+  }
+  const kind = str("kind");
+  if (m.kind !== void 0 && (!kind || !MANIFEST_KINDS.includes(kind))) warn("kind", `unknown "kind" ${JSON.stringify(m.kind)}: the app knows ${MANIFEST_KINDS.join(", ")} and shows this one as a product`);
+  const category = str("category");
+  if (m.category !== void 0 && (!category || !MANIFEST_CATEGORIES.includes(category))) warn("category", `unknown "category" ${JSON.stringify(m.category)}: the app knows ${MANIFEST_CATEGORIES.join(", ")} and files this one under other`);
+  return f;
+}
+var PNG_SIGNATURE = "89504e470d0a1a0a";
+var hexOf = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+var latin1 = (b) => String.fromCharCode(...b);
+function pngInfo(bytes) {
+  if (bytes.length < 33) return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (hexOf(bytes.subarray(0, 8)) !== PNG_SIGNATURE) return null;
+  if (latin1(bytes.subarray(12, 16)) !== "IHDR") return null;
+  const width = view.getUint32(16);
+  const height = view.getUint32(20);
+  const colorType = bytes[25];
+  let hasAlpha = colorType === 4 || colorType === 6;
+  for (let pos = 8; pos + 8 <= bytes.length && !hasAlpha; ) {
+    const length = view.getUint32(pos);
+    const type = latin1(bytes.subarray(pos + 4, pos + 8));
+    if (type === "IDAT" || type === "IEND") break;
+    if (type === "tRNS") hasAlpha = true;
+    pos += 12 + length;
+  }
+  return { width, height, hasAlpha };
+}
+function checkIcon(bytes) {
+  const f = findings();
+  const info = pngInfo(bytes);
+  if (!info) f.problems.push({ code: "icon_not_png", message: "the icon must be a PNG" });
+  else {
+    if (info.width !== ICON_SIZE || info.height !== ICON_SIZE) f.problems.push({ code: "icon_size", message: `the icon is ${info.width}\xD7${info.height}; it must be ${ICON_SIZE}\xD7${ICON_SIZE}` });
+    if (info.hasAlpha) f.problems.push({ code: "icon_alpha", message: "the icon has transparency; it must be opaque (the app rounds the corners itself)" });
+  }
+  return f;
+}
+function metaTags(html) {
+  const tags = [];
+  for (const [, attrs] of html.matchAll(/<meta\b([^>]*)>/gi)) {
+    const out = {};
+    for (const [, key, dq, sq, bare] of attrs.matchAll(/([a-zA-Z-]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/g)) out[key.toLowerCase()] = (dq ?? sq ?? bare ?? "").trim();
+    tags.push(out);
+  }
+  return tags;
+}
+function checkHtml(html) {
+  const f = findings();
+  const metas = metaTags(html);
+  const viewport = metas.find((m) => m.name?.toLowerCase() === "viewport");
+  if (!viewport || !/width\s*=\s*device-width/i.test(viewport.content ?? "")) {
+    f.problems.push({ code: "no_viewport", message: 'the entry page needs <meta name="viewport" content="width=device-width, initial-scale=1">' });
+  }
+  const scheme = metas.find((m) => m.name?.toLowerCase() === "color-scheme")?.content?.toLowerCase().trim();
+  const darkMeta = scheme !== void 0 && /\bdark\b/.test(scheme) && !/\blight\b/.test(scheme);
+  const darkStyle = [...html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style>/gi)].concat([...html.matchAll(/\bstyle\s*=\s*"([^"]*)"/gi)]).some(([, css]) => [...css.matchAll(/color-scheme\s*:\s*([^;}"]+)/gi)].some(([, v]) => /\bdark\b/i.test(v) && !/\blight\b/i.test(v)));
+  if (darkMeta || darkStyle) f.problems.push({ code: "dark_only", message: "the entry page declares a dark-only color-scheme; the Ambasada app is light (use light, or light dark)" });
+  if (!SDK_MARKERS.some((m) => html.includes(m))) {
+    f.warnings.push({ code: "no_miniapp_sdk", message: "no @ambasada/miniapp, miniapp.js or ambasadaShell in the entry HTML: a bundled import is fine too, the registry crawler confirms ready() is called at runtime" });
+  }
+  return f;
+}
+var USER_AGENT = "ambasada-check/1 (+https://ambasada.id)";
+async function get(fetchImpl, url) {
+  return fetchImpl(url, { redirect: "manual", signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), headers: { "user-agent": USER_AGENT, accept: "*/*" } });
+}
+async function checkRemote(url, fetchImpl = fetch, options = {}) {
+  const report = { ok: true, target: url, problems: [], warnings: [], notes: [] };
+  let origin;
+  try {
+    origin = new URL(url);
+  } catch {
+    report.problems.push({ code: "bad_url", message: `${url} is not a URL` });
+    report.ok = false;
+    return report;
+  }
+  if (origin.protocol !== "https:") report.problems.push({ code: "not_https", message: "the app must be served over https" });
+  let manifest = null;
+  const manifestUrl = new URL(MANIFEST_URL_PATH, origin).toString();
+  try {
+    let res = await get(fetchImpl, manifestUrl);
+    if (res.status >= 300 && res.status < 400) {
+      const location = res.headers.get("location") ?? "";
+      if (res.status === 307 && HOSTED_MANIFEST.test(location)) {
+        report.notes.push(`manifest hosted by the hub: ${location}`);
+        res = await get(fetchImpl, location);
+      } else report.problems.push({ code: "manifest_redirect", message: `${manifestUrl} redirects (${res.status} \u2192 ${location || "?"}); serve it directly` });
+    }
+    if (res.status !== 200) {
+      if (!report.problems.some((p) => p.code === "manifest_redirect")) report.problems.push({ code: "manifest_status", message: `${manifestUrl} answered ${res.status}` });
+    } else {
+      try {
+        manifest = JSON.parse(await res.text());
+        merge(report, validateManifest(manifest));
+      } catch (error) {
+        report.problems.push({ code: "manifest_json", message: `${manifestUrl} is not valid JSON: ${error.message}` });
+      }
+    }
+  } catch (error) {
+    report.problems.push({ code: "manifest_fetch", message: `could not fetch ${manifestUrl}: ${error.message}` });
+  }
+  const entryPath = typeof manifest?.entry === "string" && manifest.entry.startsWith("/") ? manifest.entry : "/";
+  const entryUrl = new URL(entryPath, origin).toString();
+  try {
+    const started = Date.now();
+    const res = await get(fetchImpl, entryUrl);
+    const html = res.status === 200 ? await res.text() : "";
+    const ms = Date.now() - started;
+    if (res.status !== 200) report.problems.push({ code: "entry_status", message: `${entryUrl} answered ${res.status}${res.headers.get("location") ? ` \u2192 ${res.headers.get("location")}` : ""}; the entry must answer 200 without redirects` });
+    else merge(report, checkHtml(html));
+    if (ms > SLOW_ENTRY_MS) report.warnings.push({ code: "slow_entry", message: `${entryUrl} took ${ms} ms; the splash stays until ready(), aim for under ${SLOW_ENTRY_MS} ms` });
+  } catch (error) {
+    report.problems.push({ code: "entry_fetch", message: `could not fetch ${entryUrl}: ${error.message}` });
+  }
+  if (typeof manifest?.icon === "string" && manifest.icon) {
+    const iconUrl = new URL(manifest.icon, origin).toString();
+    try {
+      const res = await get(fetchImpl, iconUrl);
+      if (res.status !== 200) report.problems.push({ code: "icon_status", message: `${iconUrl} answered ${res.status}` });
+      else merge(report, checkIcon(new Uint8Array(await res.arrayBuffer())));
+    } catch (error) {
+      report.problems.push({ code: "icon_fetch", message: `could not fetch ${iconUrl}: ${error.message}` });
+    }
+  }
+  const scopes = Array.isArray(manifest?.scopes) ? manifest.scopes.filter((x) => typeof x === "string") : [];
+  if (scopes.includes("identity")) {
+    const callbackUrl = new URL("/api/auth/callback", origin).toString();
+    try {
+      const res = await get(fetchImpl, callbackUrl);
+      await res.body?.cancel();
+      if (res.status === 404 || res.status >= 500) report.problems.push({ code: "identity_callback", message: `the identity scope needs Sign in with Ambasada at /api/auth/callback; ${callbackUrl} answered ${res.status}` });
+    } catch (error) {
+      report.problems.push({ code: "identity_callback", message: `could not fetch ${callbackUrl}: ${error.message}` });
+    }
+  }
+  const webhook = manifest?.notifications && typeof manifest.notifications === "object" ? manifest.notifications.webhook : void 0;
+  if (scopes.includes("notifications") && typeof webhook === "string" && webhook) {
+    const webhookUrl = new URL(webhook, origin);
+    if (webhookUrl.origin !== origin.origin) report.problems.push({ code: "webhook_origin", message: `the notifications webhook ${webhookUrl} must be on ${origin.origin}` });
+    else if (!options.appSecret) report.notes.push(`webhook ${webhookUrl.pathname}: not pinged (needs the app secret; the registry pings it)`);
+    else {
+      const body = JSON.stringify({ event: "ping", app: options.appId ?? (typeof manifest?.id === "string" ? manifest.id : ""), at: (/* @__PURE__ */ new Date()).toISOString() });
+      try {
+        const res = await fetchImpl(webhookUrl.toString(), {
+          method: "POST",
+          redirect: "manual",
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+          headers: { "user-agent": USER_AGENT, ...await appWebhookHeaders(options.appSecret, body) },
+          body
+        });
+        await res.body?.cancel();
+        if (res.status !== 200) report.problems.push({ code: "webhook_ping", message: `${webhookUrl} answered the signed ping with ${res.status}; it must answer 200 (verify with ambasada.apps.verifyWebhook)` });
+      } catch (error) {
+        report.problems.push({ code: "webhook_ping", message: `${webhookUrl} did not answer the signed ping: ${error.message}` });
+      }
+    }
+  }
+  report.ok = report.problems.length === 0;
+  return report;
+}
+var LABELS = [
+  [/^icon/, "icon"],
+  [/^manifest|^schema|^id$|^entry$/, "manifest"],
+  [/^name/, "name"],
+  [/^no_viewport$/, "viewport"],
+  [/^dark_only$/, "light theme"],
+  [/^no_miniapp_sdk$/, "ready()"],
+  [/^entry_|^not_https$|^bad_url$/, "entry page"],
+  [/^privacy_url$/, "privacy page"],
+  [/^notifications_webhook$|^webhook_/, "webhook"],
+  [/^identity_callback$/, "sign-in"]
+];
+function findingLabel(code) {
+  return LABELS.find(([re]) => re.test(code))?.[1] ?? code.replace(/_/g, " ");
+}
+function summarizeCheck(report, now = /* @__PURE__ */ new Date()) {
+  const issues = [
+    ...report.problems.map((p) => ({ ...p, level: "problem", label: findingLabel(p.code) })),
+    ...report.warnings.map((w) => ({ ...w, level: "warning", label: findingLabel(w.code) }))
+  ];
+  const needs = [...new Set(issues.filter((i) => i.level === "problem").map((i) => i.label))];
+  return { ok: report.ok, issues, needs, checked_at: now.toISOString() };
+}
+function listingLine(tier, check) {
+  if (tier === "verified") return "Verified";
+  if (tier === "listed") return "Listed for the event";
+  if (tier === "unlisted") return check?.needs.length ? `Unlisted \xB7 needs: ${check.needs.join(", ")}` : "Unlisted";
+  return check?.needs.length ? `Not registered yet \xB7 needs: ${check.needs.join(", ")}` : "Not registered yet";
+}
+
+// ../protocol/src/shell-token.ts
+var SHELL_TOKEN_TTL_S = 60;
+var RSA = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+async function generateShellKey(kid = `ins_${crypto.randomUUID().slice(0, 8)}`) {
+  const pair = await crypto.subtle.generateKey({ ...RSA, modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]) }, true, ["sign", "verify"]);
+  const pub = await crypto.subtle.exportKey("jwk", pair.publicKey);
+  return { kid, privateKey: pair.privateKey, jwk: { kty: "RSA", n: pub.n, e: pub.e, kid, alg: "RS256", use: "sig" } };
+}
+var utf82 = (s) => new TextEncoder().encode(s);
+async function signShellToken(key, claims) {
+  const now = Math.floor(Date.now() / 1e3);
+  const header3 = base64url(utf82(JSON.stringify({ alg: "RS256", typ: "JWT", kid: key.kid })));
+  const payload = base64url(utf82(JSON.stringify({ iat: now, nbf: now, exp: now + SHELL_TOKEN_TTL_S, ...claims })));
+  const sig = new Uint8Array(await crypto.subtle.sign(RSA.name, key.privateKey, utf82(`${header3}.${payload}`)));
+  return `${header3}.${payload}.${base64url(sig)}`;
+}
+
+// ../protocol/src/index.ts
+var HEADERS = {
+  receipt: "x-village-receipt",
+  callId: "x-village-call-id",
+  amount: "x-village-amount",
+  /** Position of the payment in the public ledger log; fetch an inclusion proof with it. */
+  logIndex: "x-village-log-index",
+  depth: "x-village-depth",
+  budget: "x-village-budget",
+  maxPrice: "x-village-max-price",
+  buyer: "x-village-buyer",
+  idempotencyKey: "idempotency-key",
+  /** An approved approval request id, to retry an agent payment that was over the automatic limit. */
+  approval: "x-village-approval",
+  /** The agent's own reason for a payment, shown to the team next to the Gateway's facts. */
+  reason: "x-village-reason",
+  idempotentReplay: "idempotent-replayed"
+};
+var MAX_DEPTH = 4;
+
 // ../sdk/src/errors.ts
-var ERROR_STATUS = {
+var ERROR_STATUS2 = {
   // EXCHANGE.md §5 vocabulary
   INSUFFICIENT_FUNDS: 402,
   OFFLINE: 503,
@@ -355,17 +1456,24 @@ var ERROR_STATUS = {
   RECEIPT_INVALID: 402,
   WEBHOOK_INVALID: 400
 };
-var VillageError = class extends Error {
+var BRAND = /* @__PURE__ */ Symbol.for("ambasada.error");
+var AmbasadaError = class _AmbasadaError extends Error {
   code;
   /** HTTP status (0 when the request never got an answer). */
   status;
   details;
   constructor(code, message, status, details = {}) {
     super(message);
-    this.name = "VillageError";
+    this.name = "AmbasadaError";
     this.code = code;
-    this.status = status ?? ERROR_STATUS[code] ?? 500;
+    this.status = status ?? ERROR_STATUS2[code] ?? 500;
     this.details = details;
+    Object.defineProperty(this, BRAND, { value: true });
+  }
+  /** `instanceof AmbasadaError` holds across bundled copies; subclasses keep the usual prototype check. */
+  static [Symbol.hasInstance](value) {
+    if (this !== _AmbasadaError) return Function.prototype[Symbol.hasInstance].call(this, value);
+    return typeof value === "object" && value !== null && value[BRAND] === true;
   }
   get callId() {
     return this.details.call_id;
@@ -385,15 +1493,7 @@ var VillageError = class extends Error {
     return Response.json(this.toJSON(), { status: this.status || 500 });
   }
 };
-var ReceiptInvalidError = class extends VillageError {
-  reason;
-  constructor(reason, message) {
-    super("RECEIPT_INVALID", `payment required: ${message}`, 402, { reason });
-    this.name = "ReceiptInvalidError";
-    this.reason = reason;
-  }
-};
-var WebhookInvalidError = class extends VillageError {
+var WebhookInvalidError = class extends AmbasadaError {
   reason;
   constructor(reason, message) {
     super("WEBHOOK_INVALID", message, 400, { reason });
@@ -401,17 +1501,17 @@ var WebhookInvalidError = class extends VillageError {
     this.reason = reason;
   }
 };
-function isVillageError(value, code) {
-  return value instanceof VillageError && (code === void 0 || value.code === code);
+function isAmbasadaError(value, code) {
+  return value instanceof AmbasadaError && (code === void 0 || value.code === code);
 }
 function errorFromResponse(status, body, fallback) {
   const error = typeof body === "object" && body !== null ? body.error : void 0;
   if (typeof error === "object" && error !== null && typeof error.code === "string") {
     const { code: code2, message, ...details } = error;
-    return new VillageError(code2, typeof message === "string" ? message : code2, status, details);
+    return new AmbasadaError(code2, typeof message === "string" ? message : code2, status, details);
   }
   const code = status === 401 ? "UNAUTHORIZED" : status === 404 ? "NOT_FOUND" : status >= 500 ? "INTERNAL" : "INVALID_REQUEST";
-  return new VillageError(code, fallback, status);
+  return new AmbasadaError(code, fallback, status);
 }
 
 // ../sdk/src/apps.ts
@@ -449,16 +1549,16 @@ var AmbasadaApps = class {
   /**
    * Sends a push to the people behind `tokens` (or `users`, for Verified apps with `identity`) through the hub.
    * Checks the limits first (title ≤ 40, body ≤ 140, id ≤ 128, ≤ 100 recipients, `url` on your origin) and
-   * throws `VillageError("INVALID_REQUEST")` before sending anything. Tokens in `invalid` are gone: forget them.
+   * throws `AmbasadaError("INVALID_REQUEST")` before sending anything. Tokens in `invalid` are gone: forget them.
    */
   async notify(input) {
     const c = this.config();
-    if (!c.appSecret) throw new VillageError("CONFIG", "no app secret: set AMBASADA_APP_SECRET (injected on ambasada.dev; `ambasada dev` sets one for the mock hub)");
+    if (!c.appSecret) throw new AmbasadaError("CONFIG", "no app secret: set AMBASADA_APP_SECRET (injected on ambasada.dev; `ambasada dev` sets one for the mock hub)");
     let body;
     try {
       body = appNotifyBody(input, c.origin);
     } catch (error) {
-      throw new VillageError("INVALID_REQUEST", error.message, 400);
+      throw new AmbasadaError("INVALID_REQUEST", error.message, 400);
     }
     const url = `${(c.hubUrl ?? DEFAULT_HUB_URL).replace(/\/+$/, "")}${APP_NOTIFY_PATH}`;
     const doFetch = c.fetch ?? ((i, init) => fetch(i, init));
@@ -471,14 +1571,14 @@ var AmbasadaApps = class {
         signal: AbortSignal.timeout(15e3)
       });
     } catch (error) {
-      throw new VillageError("NETWORK", `POST ${url}: ${error.message}`, 0);
+      throw new AmbasadaError("NETWORK", `POST ${url}: ${error.message}`, 0);
     }
     const json = await res.json().catch(() => null);
     if (!res.ok) {
       const err = json?.error;
       const code = typeof err === "object" && err?.code ? err.code : res.status === 401 || res.status === 403 ? "UNAUTHORIZED" : res.status === 429 ? "CAP_SELLER_RATE" : res.status >= 500 ? "UPSTREAM_ERROR" : "INVALID_REQUEST";
       const message = typeof err === "string" ? err : err?.message ?? `the hub answered ${res.status}`;
-      throw new VillageError(code, `notify: ${message}`, res.status);
+      throw new AmbasadaError(code, `notify: ${message}`, res.status);
     }
     return appNotifyResult(json);
   }
@@ -576,13 +1676,13 @@ async function jwks(issuer, doFetch, refresh = false) {
   if (cached && !refresh && Date.now() - cached.at < JWKS_TTL_MS) return cached.keys;
   if (cached && refresh && Date.now() - cached.at < 6e4) return cached.keys;
   const res = await doFetch(`${issuer}/.well-known/jwks.json`, { headers: { accept: "application/json" } });
-  if (!res.ok) throw new VillageError("UPSTREAM_ERROR", `could not read the Ambasada ID keys (${res.status})`, 502);
+  if (!res.ok) throw new AmbasadaError("UPSTREAM_ERROR", `could not read the Ambasada ID keys (${res.status})`, 502);
   const body = await res.json();
   const keys3 = (body.keys ?? []).filter((k) => k.kty === "RSA" && k.n && k.e);
   jwksCache.set(issuer, { at: Date.now(), keys: keys3 });
   return keys3;
 }
-var shellRefused = (message) => new VillageError("UNAUTHORIZED", `shell token refused: ${message}`, 401);
+var shellRefused = (message) => new AmbasadaError("UNAUTHORIZED", `shell token refused: ${message}`, 401);
 var AmbasadaAuth = class {
   constructor(config) {
     this.config = config;
@@ -596,7 +1696,7 @@ var AmbasadaAuth = class {
   settings(req) {
     const c = this.config();
     if (!c.clientId || !c.clientSecret || !c.issuer) {
-      throw new VillageError("CONFIG", "Sign in with Ambasada is not set up: it works on https://<slug>.ambasada.dev after `ambasada deploy`, and locally under `ambasada dev` (AMBASADA_AUTH_CLIENT_ID / _SECRET / _ISSUER)");
+      throw new AmbasadaError("CONFIG", "Sign in with Ambasada is not set up: it works on https://<slug>.ambasada.dev after `ambasada deploy`, and locally under `ambasada dev` (AMBASADA_AUTH_CLIENT_ID / _SECRET / _ISSUER)");
     }
     const origin = (c.publicUrl ? new URL(c.publicUrl) : new URL(req.url)).origin;
     return {
@@ -632,7 +1732,7 @@ var AmbasadaAuth = class {
   }
   /**
    * Ambasada ID sends the person back here: checks the state, exchanges the code (with the PKCE
-   * verifier and the client secret), reads their profile from the village, sets the session cookie
+   * verifier and the client secret), reads their profile from the Ambasada API, sets the session cookie
    * and redirects to `returnTo`. A refused consent goes back to `returnTo` signed out.
    */
   async callback(req) {
@@ -641,12 +1741,12 @@ var AmbasadaAuth = class {
     const clear = setCookie(STATE_COOKIE, "", s.secure, 0);
     const saved = await verifyCookie(s.clientSecret, "state", readOurCookie(req, STATE_COOKIE));
     if (!saved || !params.get("state") || params.get("state") !== saved.state) {
-      throw new VillageError("UNAUTHORIZED", "sign-in expired or was started elsewhere: try again", 400);
+      throw new AmbasadaError("UNAUTHORIZED", "sign-in expired or was started elsewhere: try again", 400);
     }
     const returnTo = safeReturnTo(saved.returnTo);
     if (params.get("error")) return redirect(returnTo, [clear]);
     const code = params.get("code");
-    if (!code) throw new VillageError("INVALID_REQUEST", "no authorization code", 400);
+    if (!code) throw new AmbasadaError("INVALID_REQUEST", "no authorization code", 400);
     const token = await s.fetch(`${s.issuer}/oauth/token`, {
       method: "POST",
       headers: {
@@ -657,9 +1757,9 @@ var AmbasadaAuth = class {
       body: new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: s.redirectUri, code_verifier: saved.verifier })
     });
     const tokens = await token.json().catch(() => ({}));
-    if (!token.ok || !tokens.access_token) throw new VillageError("UNAUTHORIZED", `Ambasada ID refused the sign-in (${tokens.error ?? token.status})`, 401);
+    if (!token.ok || !tokens.access_token) throw new AmbasadaError("UNAUTHORIZED", `Ambasada ID refused the sign-in (${tokens.error ?? token.status})`, 401);
     const res = await s.fetch(`${s.apiUrl}/v1/auth/profile`, { headers: { authorization: `Bearer ${tokens.access_token}`, accept: "application/json" } });
-    if (!res.ok) throw new VillageError("UPSTREAM_ERROR", `could not read the Ambasada profile (${res.status})`, 502);
+    if (!res.ok) throw new AmbasadaError("UPSTREAM_ERROR", `could not read the Ambasada profile (${res.status})`, 502);
     const user = await res.json();
     const exp = Math.floor(Date.now() / 1e3) + SESSION_TTL_S;
     const session = await signCookie(s.clientSecret, "session", { user, exp });
@@ -674,14 +1774,14 @@ var AmbasadaAuth = class {
   /**
    * Verifies a shell token (Clerk JWT template `ambasada-miniapp`, RS256, 60 s) against
    * `<AMBASADA_AUTH_ISSUER>/.well-known/jwks.json` (cached 1 h): signature, expiry, issuer, and that its `aud`
-   * is this app (its id or origin). Returns who it is, or throws `VillageError("UNAUTHORIZED")`.
+   * is this app (its id or origin). Returns who it is, or throws `AmbasadaError("UNAUTHORIZED")`.
    */
   async verifyShellToken(token, options = {}) {
     const c = this.config();
-    if (!c.issuer) throw new VillageError("CONFIG", "silent sign-in needs AMBASADA_AUTH_ISSUER (injected on ambasada.dev and by `ambasada dev`)");
+    if (!c.issuer) throw new AmbasadaError("CONFIG", "silent sign-in needs AMBASADA_AUTH_ISSUER (injected on ambasada.dev and by `ambasada dev`)");
     const trusted = [c.issuer, c.hubUrl].filter((v) => !!v).map((v) => v.replace(/\/+$/, ""));
     const audiences = [options.audience ?? c.audiences ?? []].flat().filter(Boolean).map((a) => a.replace(/\/+$/, ""));
-    if (!audiences.length) throw new VillageError("CONFIG", "silent sign-in needs to know this app: set AMBASADA_APP_ORIGIN or PUBLIC_URL, or pass { audience }");
+    if (!audiences.length) throw new AmbasadaError("CONFIG", "silent sign-in needs to know this app: set AMBASADA_APP_ORIGIN or PUBLIC_URL, or pass { audience }");
     const doFetch = c.fetch ?? ((input, init) => fetch(input, init));
     const parts = typeof token === "string" ? token.split(".") : [];
     if (parts.length !== 3) throw shellRefused("not a JWT");
@@ -725,14 +1825,14 @@ var AmbasadaAuth = class {
    */
   async shell(req) {
     const s = this.settings(req);
-    if (req.method !== "POST") throw new VillageError("INVALID_REQUEST", "POST the shell token as JSON { token }", 405);
+    if (req.method !== "POST") throw new AmbasadaError("INVALID_REQUEST", "POST the shell token as JSON { token }", 405);
     let token = /^Bearer\s+(.+)$/i.exec(req.headers.get("authorization") ?? "")?.[1]?.trim();
     if (!token) {
-      if (!(req.headers.get("content-type") ?? "").includes("application/json")) throw new VillageError("INVALID_REQUEST", "send the token as JSON { token }", 415);
+      if (!(req.headers.get("content-type") ?? "").includes("application/json")) throw new AmbasadaError("INVALID_REQUEST", "send the token as JSON { token }", 415);
       const body = await req.json().catch(() => null);
       token = typeof body?.token === "string" ? body.token : void 0;
     }
-    if (!token) throw new VillageError("INVALID_REQUEST", "no shell token", 400);
+    if (!token) throw new AmbasadaError("INVALID_REQUEST", "no shell token", 400);
     const audiences = [...this.config().audiences ?? [], s.origin];
     const who = await this.verifyShellToken(token, { audience: audiences });
     let user = { id: who.user_id, name: who.name, avatar_url: who.avatar, builder: false, builder_since: null, member_since: null, pass: null };
@@ -763,57 +1863,238 @@ var AmbasadaAuth = class {
   }
 };
 
-// ../sdk/src/webhook.ts
-function getHeader(headers, name) {
-  if (typeof headers.get === "function") return headers.get(name);
-  const record = headers;
-  const key = Object.keys(record).find((k) => k.toLowerCase() === name);
-  const value = key === void 0 ? void 0 : record[key];
-  return Array.isArray(value) ? value[0] ?? null : value ?? null;
+// ../sdk/src/client.ts
+var DEFAULT_API_URL = "https://api.ambasada.dev";
+function processEnv() {
+  const p = globalThis.process;
+  return p?.env ?? {};
 }
-function plainHeaders(headers) {
-  const out = {};
-  for (const name of ["webhook-id", "webhook-timestamp", "webhook-signature"]) {
-    const v = getHeader(headers, name);
-    if (v !== null) out[name] = v;
+var Ambasada = class {
+  options;
+  keyLoader;
+  projectPromise;
+  constructor(options = {}) {
+    this.options = options;
   }
-  return out;
-}
-async function verifyWebhookPayload(secret, headers, body, options = {}) {
-  if (!secret) throw new WebhookInvalidError("bad_secret", "no webhook secret: set AMBASADA_WEBHOOK_SECRET or pass it");
-  const plain = plainHeaders(headers);
-  let parsed;
-  try {
-    parsed = await verifyWebhook(secret, plain, body, options);
-  } catch (error) {
-    if (error instanceof WebhookError) throw new WebhookInvalidError(error.reason, error.message);
-    if (error instanceof SyntaxError) throw new WebhookInvalidError("bad_body", "webhook body is not JSON");
-    if (error instanceof DOMException || error instanceof TypeError) throw new WebhookInvalidError("bad_secret", "webhook secret is not whsec_<base64>");
-    throw error;
+  env(name) {
+    const v = this.options.env?.[name];
+    return typeof v === "string" ? v : processEnv()[name];
   }
-  return { id: plain["webhook-id"], type: String(parsed.type), timestamp: String(parsed.timestamp ?? ""), data: parsed.data };
-}
-
-// ../sdk/src/receipt.ts
-var RECEIPT_HEADER2 = "x-village-receipt";
-async function readIncoming(req) {
-  if (typeof req.clone === "function" && typeof req.arrayBuffer === "function") {
-    const r = req;
-    return { headers: r.headers, body: new Uint8Array(await r.clone().arrayBuffer()) };
+  get apiUrl() {
+    return (this.options.apiUrl ?? this.env("AMBASADA_API_URL") ?? this.env("VILLAGE_API_URL") ?? DEFAULT_API_URL).replace(/\/+$/, "");
   }
-  const node = req;
-  const raw = toBytes2(node.rawBody) ?? toBytes2(node.body);
-  if (raw) return { headers: node.headers, body: raw };
-  if (node.body !== void 0 && node.body !== null && !(typeof node.body === "object" && Object.keys(node.body).length === 0)) {
-    throw new VillageError(
-      "CONFIG",
-      "the request body was already parsed as JSON; receipts commit to the raw bytes. Use express.raw({ type: '*/*' }) on paid routes (or keep req.rawBody)."
-    );
+  get apiKey() {
+    const key = this.options.apiKey ?? (this.env("AMBASADA_API_KEY") ?? this.env("VILLAGE_API_KEY"));
+    if (!key) throw new AmbasadaError("CONFIG", "no API key: set AMBASADA_API_KEY (a project key from developer.ambasada.dev, or `ambasada login`) or pass { apiKey }");
+    return key;
   }
-  if (typeof node[Symbol.asyncIterator] === "function") {
-    const chunks = [];
-    for await (const chunk of node) chunks.push(toBytes2(chunk) ?? new Uint8Array());
-    const body = concat(chunks);
+  /**
+   * Sign in with Ambasada (docs/AUTH.md): `login(req)`, `callback(req)`, `user(req)`, `logout(req)`.
+   * Credentials come with the deploy to ambasada.dev, and from `ambasada dev` locally.
+   */
+  auth = new AmbasadaAuth(() => ({
+    clientId: this.options.auth?.clientId ?? this.env("AMBASADA_AUTH_CLIENT_ID"),
+    clientSecret: this.options.auth?.clientSecret ?? this.env("AMBASADA_AUTH_CLIENT_SECRET"),
+    issuer: this.options.auth?.issuer ?? this.env("AMBASADA_AUTH_ISSUER"),
+    publicUrl: this.options.auth?.publicUrl ?? this.env("PUBLIC_URL"),
+    apiUrl: this.apiUrl,
+    // Silent sign-in: a shell token must be for this app, by id or origin.
+    audiences: [this.appOrigin, this.options.app?.id ?? this.env("AMBASADA_APP_ID") ?? this.env("AMBASADA_COMPANY")].filter((a) => !!a),
+    hubUrl: this.hubUrl,
+    fetch: this.options.fetch
+  }));
+  get appOrigin() {
+    const url = this.options.app?.origin ?? this.env("AMBASADA_APP_ORIGIN") ?? this.options.auth?.publicUrl ?? this.env("PUBLIC_URL");
+    return url && URL.canParse(url) ? new URL(url).origin : void 0;
+  }
+  get hubUrl() {
+    return this.options.app?.hubUrl ?? this.env("AMBASADA_HUB_URL");
+  }
+  /**
+   * The mini-app platform (docs/MINI-APPS.md §7): `verifyWebhook(req)` for the hub's app events and
+   * `notify({ … })` to push to people who turned notifications on. Uses `AMBASADA_APP_SECRET`.
+   */
+  apps = new AmbasadaApps(() => ({
+    appSecret: this.options.app?.secret ?? this.env("AMBASADA_APP_SECRET"),
+    hubUrl: this.hubUrl,
+    origin: this.appOrigin,
+    fetch: this.options.fetch
+  }));
+  // ── HTTP ──────────────────────────────────────────────────────────────────
+  async send(method, path, opts = {}) {
+    const url = new URL(this.apiUrl + path);
+    for (const [k, v] of Object.entries(opts.query ?? {})) if (v !== void 0) url.searchParams.set(k, String(v));
+    const headers = { accept: "application/json" };
+    if (opts.auth !== false) headers.authorization = `Bearer ${this.apiKey}`;
+    let body = opts.raw;
+    if (opts.body !== void 0) {
+      body = JSON.stringify(opts.body);
+      headers["content-type"] = "application/json";
+    }
+    for (const [k, v] of Object.entries(opts.headers ?? {})) if (v !== void 0) headers[k.toLowerCase()] = v;
+    const doFetch = this.options.fetch ?? fetch;
+    const attempt = () => {
+      const timeout = AbortSignal.timeout(this.options.timeoutMs ?? 45e3);
+      const signal = opts.signal ? AbortSignal.any([opts.signal, timeout]) : timeout;
+      return doFetch(url, { method, headers, body, signal });
+    };
+    let res;
+    try {
+      res = await attempt();
+    } catch (error) {
+      if (opts.signal?.aborted) throw error;
+      if (!opts.retry) throw new AmbasadaError("NETWORK", `${method} ${url.pathname}: ${error.message}`, 0);
+      try {
+        res = await attempt();
+      } catch (again) {
+        throw new AmbasadaError("NETWORK", `${method} ${url.pathname}: ${again.message}`, 0);
+      }
+    }
+    const text = await res.text();
+    let json = text;
+    if (text && (res.headers.get("content-type") ?? "").includes("json")) {
+      try {
+        json = JSON.parse(text);
+      } catch {
+      }
+    }
+    if (!res.ok) throw errorFromResponse(res.status, json, `${method} ${url.pathname} \u2192 ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
+    return { status: res.status, headers: res.headers, json };
+  }
+  async call(method, path, opts) {
+    return (await this.send(method, path, opts)).json;
+  }
+  // ── identity, keys ────────────────────────────────────────────────────────
+  /** Your app's id (from options, `AMBASADA_APP_ID`, or the project the API key belongs to). */
+  project() {
+    const known = this.options.project ?? this.env("AMBASADA_APP_ID") ?? this.env("AMBASADA_COMPANY");
+    if (known) return Promise.resolve(known);
+    this.projectPromise ??= this.call("GET", "/v1/key").then(
+      (k) => k.id,
+      (error) => {
+        this.projectPromise = void 0;
+        throw error;
+      }
+    );
+    return this.projectPromise;
+  }
+  /** The API's signing keys (`/.well-known/jwks.json`, cached). */
+  keys() {
+    const given = this.options.keys;
+    if (Array.isArray(given)) return Promise.resolve(given);
+    if (typeof given === "function") return given();
+    this.keyLoader ??= cachedKeys(() => this.call("GET", "/.well-known/jwks.json", { auth: false }).then((r) => r.keys));
+    return this.keyLoader();
+  }
+  // ── storage ───────────────────────────────────────────────────────────────
+  files = {
+    /**
+     * Stores bytes, a Blob, or a URL to copy (`POST /v1/files`). Returns a public URL. For an app's own
+     * uploads prefer its bucket, `env.FILES` (docs/STORAGE.md).
+     */
+    put: (data, options = {}) => {
+      const query = { ttl_seconds: options.ttlSeconds };
+      if (typeof data === "string") return this.call("POST", "/v1/files", { body: { url: data, content_type: options.contentType }, query });
+      const contentType = options.contentType ?? (data instanceof Blob && data.type ? data.type : "application/octet-stream");
+      return this.call("POST", "/v1/files", { raw: data, headers: { "content-type": contentType }, query });
+    }
+  };
+  /**
+   * Your project's JSON key-value store (`/v1/store`): 1 MB per project (keys + values), free. For more,
+   * use the app's own D1, KV and R2 (docs/STORAGE.md).
+   */
+  store = {
+    /** The value, or null when the key is not set. */
+    get: async (key) => {
+      try {
+        return (await this.call("GET", `/v1/store/${encodeURIComponent(key)}`)).value;
+      } catch (error) {
+        if (error instanceof AmbasadaError && error.status === 404) return null;
+        throw error;
+      }
+    },
+    /** Saves any JSON value (fails with INVALID_REQUEST when the store would pass 1 MB). */
+    set: (key, value) => {
+      if (value === void 0) throw new AmbasadaError("INVALID_REQUEST", "store.set needs a JSON value (use store.delete to remove a key)");
+      return this.call("PUT", `/v1/store/${encodeURIComponent(key)}`, { body: value });
+    },
+    /** `set` under its other name. */
+    put: (key, value) => this.store.set(key, value),
+    /** True when the key existed. */
+    delete: async (key) => (await this.call("DELETE", `/v1/store/${encodeURIComponent(key)}`)).deleted,
+    /** Keys (up to 1000, optionally under a prefix) and how much of the 1 MB is used. */
+    list: (prefix) => this.call("GET", "/v1/store", { query: { prefix } })
+  };
+};
+function cachedKeys(load, ttlMs = 10 * 6e4) {
+  let cached;
+  return () => {
+    if (!cached || Date.now() - cached.at > ttlMs) {
+      const keys3 = load();
+      const entry = { at: Date.now(), keys: keys3 };
+      cached = entry;
+      keys3.catch(() => {
+        if (cached === entry) cached = void 0;
+      });
+    }
+    return cached.keys;
+  };
+}
+function createAmbasada(options = {}) {
+  return new Ambasada(options);
+}
+
+// ../sdk/src/headers.ts
+function getHeader(headers, name) {
+  if (typeof headers.get === "function") return headers.get(name);
+  const record = headers;
+  const key = Object.keys(record).find((k) => k.toLowerCase() === name);
+  const value = key === void 0 ? void 0 : record[key];
+  return Array.isArray(value) ? value[0] ?? null : value ?? null;
+}
+
+// ../sdk/src/define.ts
+function defineApp(config) {
+  if (typeof config.id !== "string" || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(config.id)) throw new Error(`app id "${String(config.id)}" must be a lowercase slug (a-z, 0-9, -)`);
+  return config;
+}
+
+// ../sdk/src/platform.ts
+var ambasada = new Ambasada();
+var platform_default = ambasada;
+
+// ../village/src/errors.ts
+var VillageError2 = AmbasadaError;
+var isVillageError = isAmbasadaError;
+var ReceiptInvalidError = class extends AmbasadaError {
+  reason;
+  constructor(reason, message) {
+    super("RECEIPT_INVALID", `payment required: ${message}`, 402, { reason });
+    this.name = "ReceiptInvalidError";
+    this.reason = reason;
+  }
+};
+
+// ../village/src/receipt.ts
+var RECEIPT_HEADER2 = "x-village-receipt";
+async function readIncoming(req) {
+  if (typeof req.clone === "function" && typeof req.arrayBuffer === "function") {
+    const r = req;
+    return { headers: r.headers, body: new Uint8Array(await r.clone().arrayBuffer()) };
+  }
+  const node = req;
+  const raw = toBytes2(node.rawBody) ?? toBytes2(node.body);
+  if (raw) return { headers: node.headers, body: raw };
+  if (node.body !== void 0 && node.body !== null && !(typeof node.body === "object" && Object.keys(node.body).length === 0)) {
+    throw new AmbasadaError(
+      "CONFIG",
+      "the request body was already parsed as JSON; receipts commit to the raw bytes. Use express.raw({ type: '*/*' }) on paid routes (or keep req.rawBody)."
+    );
+  }
+  if (typeof node[Symbol.asyncIterator] === "function") {
+    const chunks = [];
+    for await (const chunk of node) chunks.push(toBytes2(chunk) ?? new Uint8Array());
+    const body = concat(chunks);
     node.rawBody = body;
     return { headers: node.headers, body };
   }
@@ -879,13 +2160,37 @@ function concat(chunks) {
   return out;
 }
 
-// ../sdk/src/client.ts
-var DEFAULT_API_URL = "https://hackaton.ambasada.id";
-var DEFAULT_MODEL = "deepseek-v4.1-flash";
-function processEnv() {
-  const p = globalThis.process;
-  return p?.env ?? {};
+// ../village/src/webhook.ts
+var { WebhookError: WebhookError2, verifyWebhook: verifyProtocolWebhook } = src_exports;
+var WEBHOOK_HEADERS2 = WEBHOOK_HEADERS;
+var generateWebhookSecret2 = generateWebhookSecret;
+var webhookHeaders2 = webhookHeaders;
+function plainHeaders(headers) {
+  const out = {};
+  for (const name of ["webhook-id", "webhook-timestamp", "webhook-signature"]) {
+    const v = getHeader(headers, name);
+    if (v !== null) out[name] = v;
+  }
+  return out;
 }
+async function verifyWebhookPayload(secret, headers, body, options = {}) {
+  if (!secret) throw new WebhookInvalidError("bad_secret", "no webhook secret: set AMBASADA_WEBHOOK_SECRET or pass it");
+  const plain = plainHeaders(headers);
+  let parsed;
+  try {
+    parsed = await verifyProtocolWebhook(secret, plain, body, options);
+  } catch (error) {
+    if (error instanceof WebhookError2) throw new WebhookInvalidError(error.reason, error.message);
+    if (error instanceof SyntaxError) throw new WebhookInvalidError("bad_body", "webhook body is not JSON");
+    if (error instanceof DOMException || error instanceof TypeError) throw new WebhookInvalidError("bad_secret", "webhook secret is not whsec_<base64>");
+    throw error;
+  }
+  return { id: plain["webhook-id"], type: String(parsed.type), timestamp: String(parsed.timestamp ?? ""), data: parsed.data };
+}
+
+// ../village/src/client.ts
+var DEFAULT_VILLAGE_API_URL = "https://hackaton.ambasada.id";
+var DEFAULT_MODEL = "deepseek-v4.1-flash";
 function randomKey() {
   return `sdk_${crypto.randomUUID()}`;
 }
@@ -894,111 +2199,28 @@ function num(value) {
   const n = Number(value);
   return Number.isFinite(n) ? n : null;
 }
-function splitOffering(offering2) {
-  const [company, name, ...rest] = offering2.split("/");
-  if (!company || !name || rest.length) throw new VillageError("INVALID_REQUEST", `offering must be "company/name", got "${offering2}"`);
+function splitOffering(offering3) {
+  const [company, name, ...rest] = offering3.split("/");
+  if (!company || !name || rest.length) throw new AmbasadaError("INVALID_REQUEST", `offering must be "company/name", got "${offering3}"`);
   return [company, name];
 }
-var Village = class {
-  options;
-  keyLoader;
+var Village = class extends Ambasada {
+  villageOptions;
   companyPromise;
   replays = new ReplayGuard();
   constructor(options = {}) {
-    this.options = options;
-  }
-  env(name) {
-    const v = this.options.env?.[name];
-    return typeof v === "string" ? v : processEnv()[name];
+    super(options);
+    this.villageOptions = options;
   }
   get apiUrl() {
-    return (this.options.apiUrl ?? (this.env("AMBASADA_API_URL") ?? this.env("VILLAGE_API_URL")) ?? DEFAULT_API_URL).replace(/\/+$/, "");
-  }
-  get apiKey() {
-    const key = this.options.apiKey ?? (this.env("AMBASADA_API_KEY") ?? this.env("VILLAGE_API_KEY"));
-    if (!key) throw new VillageError("CONFIG", "no API key: set AMBASADA_API_KEY (from the village app, or `ambasada login`) or pass { apiKey }");
-    return key;
-  }
-  /**
-   * Sign in with Ambasada (docs/AUTH.md): `login(req)`, `callback(req)`, `user(req)`, `logout(req)`.
-   * Credentials come with the deploy to ambasada.dev, and from `ambasada dev` locally.
-   */
-  auth = new AmbasadaAuth(() => ({
-    clientId: this.options.auth?.clientId ?? this.env("AMBASADA_AUTH_CLIENT_ID"),
-    clientSecret: this.options.auth?.clientSecret ?? this.env("AMBASADA_AUTH_CLIENT_SECRET"),
-    issuer: this.options.auth?.issuer ?? this.env("AMBASADA_AUTH_ISSUER"),
-    publicUrl: this.options.auth?.publicUrl ?? this.env("PUBLIC_URL"),
-    apiUrl: this.apiUrl,
-    // Silent sign-in: a shell token must be for this app, by id or origin.
-    audiences: [this.appOrigin, this.options.app?.id ?? this.env("AMBASADA_APP_ID") ?? this.env("AMBASADA_COMPANY")].filter((a) => !!a),
-    hubUrl: this.hubUrl,
-    fetch: this.options.fetch
-  }));
-  get appOrigin() {
-    const url = this.options.app?.origin ?? this.env("AMBASADA_APP_ORIGIN") ?? this.options.auth?.publicUrl ?? this.env("PUBLIC_URL");
-    return url && URL.canParse(url) ? new URL(url).origin : void 0;
+    const shared = this.env("AMBASADA_API_URL") ?? this.env("VILLAGE_API_URL");
+    const legacy = shared && !/^https:\/\/api\.ambasada\.dev\/?$/.test(shared) ? shared : void 0;
+    return (this.villageOptions.apiUrl ?? this.env("AMBASADA_VILLAGE_API_URL") ?? legacy ?? DEFAULT_VILLAGE_API_URL).replace(/\/+$/, "");
   }
-  get hubUrl() {
-    return this.options.app?.hubUrl ?? this.env("AMBASADA_HUB_URL");
-  }
-  /**
-   * The mini-app platform (docs/MINI-APPS.md §7): `verifyWebhook(req)` for the hub's app events and
-   * `notify({ … })` to push to people who turned notifications on. Uses `AMBASADA_APP_SECRET`.
-   */
-  apps = new AmbasadaApps(() => ({
-    appSecret: this.options.app?.secret ?? this.env("AMBASADA_APP_SECRET"),
-    hubUrl: this.hubUrl,
-    origin: this.appOrigin,
-    fetch: this.options.fetch
-  }));
-  // ── HTTP ──────────────────────────────────────────────────────────────────
-  async send(method, path, opts = {}) {
-    const url = new URL(this.apiUrl + path);
-    for (const [k, v] of Object.entries(opts.query ?? {})) if (v !== void 0) url.searchParams.set(k, String(v));
-    const headers = { accept: "application/json" };
-    if (opts.auth !== false) headers.authorization = `Bearer ${this.apiKey}`;
-    let body = opts.raw;
-    if (opts.body !== void 0) {
-      body = JSON.stringify(opts.body);
-      headers["content-type"] = "application/json";
-    }
-    for (const [k, v] of Object.entries(opts.headers ?? {})) if (v !== void 0) headers[k.toLowerCase()] = v;
-    const doFetch = this.options.fetch ?? fetch;
-    const attempt = () => {
-      const timeout = AbortSignal.timeout(this.options.timeoutMs ?? 45e3);
-      const signal = opts.signal ? AbortSignal.any([opts.signal, timeout]) : timeout;
-      return doFetch(url, { method, headers, body, signal });
-    };
-    let res;
-    try {
-      res = await attempt();
-    } catch (error) {
-      if (opts.signal?.aborted) throw error;
-      if (!opts.retry) throw new VillageError("NETWORK", `${method} ${url.pathname}: ${error.message}`, 0);
-      try {
-        res = await attempt();
-      } catch (again) {
-        throw new VillageError("NETWORK", `${method} ${url.pathname}: ${again.message}`, 0);
-      }
-    }
-    const text = await res.text();
-    let json = text;
-    if (text && (res.headers.get("content-type") ?? "").includes("json")) {
-      try {
-        json = JSON.parse(text);
-      } catch {
-      }
-    }
-    if (!res.ok) throw errorFromResponse(res.status, json, `${method} ${url.pathname} \u2192 ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
-    return { status: res.status, headers: res.headers, json };
-  }
-  async call(method, path, opts) {
-    return (await this.send(method, path, opts)).json;
-  }
-  // ── identity, keys ────────────────────────────────────────────────────────
+  // ── identity ──────────────────────────────────────────────────────────────
   /** Your company id (from options, `AMBASADA_COMPANY`, or the wallet the API key belongs to). */
   company() {
-    const known = this.options.company ?? (this.env("AMBASADA_COMPANY") ?? this.env("VILLAGE_COMPANY"));
+    const known = this.villageOptions.company ?? (this.env("AMBASADA_COMPANY") ?? this.env("VILLAGE_COMPANY"));
     if (known) return Promise.resolve(known);
     this.companyPromise ??= this.wallet().then(
       (w) => w.account,
@@ -1009,14 +2231,6 @@ var Village = class {
     );
     return this.companyPromise;
   }
-  /** Village receipt keys (cached). */
-  keys() {
-    const given = this.options.keys;
-    if (Array.isArray(given)) return Promise.resolve(given);
-    if (typeof given === "function") return given();
-    this.keyLoader ??= cachedKeys(() => this.call("GET", "/.well-known/jwks.json", { auth: false }).then((r) => r.keys));
-    return this.keyLoader();
-  }
   keySource() {
     return () => this.keys();
   }
@@ -1052,26 +2266,26 @@ var Village = class {
   }
   /**
    * Wraps a paid offering as a fetch handler: verifies the receipt (402 if missing or bad), runs
-   * `handler(input, call, req)` and answers JSON. A thrown `VillageError` keeps its status (the
+   * `handler(input, call, req)` and answers JSON. A thrown `AmbasadaError` keeps its status (the
    * Gateway then refunds the buyer).
    *
    *   export default village.sell("translate", async ({ text, to }) => ({ text: await village.llm(`…`) }));
    */
-  sell(offering2, handler) {
+  sell(offering3, handler) {
     return async (req) => {
       if (req.method !== "POST") return Response.json({ error: { code: "INVALID_REQUEST", message: "POST only" } }, { status: 405 });
       let call;
       try {
-        call = await this.verifyReceipt(req, { offering: offering2 });
+        call = await this.verifyReceipt(req, { offering: offering3 });
       } catch (error) {
-        if (error instanceof VillageError) return error.toResponse();
+        if (error instanceof AmbasadaError) return error.toResponse();
         throw error;
       }
       try {
         const out = await handler(call.input, call, req);
         return out instanceof Response ? out : Response.json(out);
       } catch (error) {
-        if (error instanceof VillageError) return error.toResponse();
+        if (error instanceof AmbasadaError) return error.toResponse();
         console.error(error);
         return Response.json({ error: { code: "INTERNAL", message: "handler failed" } }, { status: 500 });
       }
@@ -1080,7 +2294,7 @@ var Village = class {
   /** Verifies a signed webhook (`checkout.paid`, `webhook.test`) and returns the event. Throws `WebhookInvalidError`. */
   async verifyWebhook(req, secret) {
     const { headers, body } = await readIncoming(req);
-    return verifyWebhookPayload(secret ?? this.options.webhookSecret ?? (this.env("AMBASADA_WEBHOOK_SECRET") ?? this.env("VILLAGE_WEBHOOK_SECRET")) ?? "", headers, body);
+    return verifyWebhookPayload(secret ?? this.villageOptions.webhookSecret ?? (this.env("AMBASADA_WEBHOOK_SECRET") ?? this.env("VILLAGE_WEBHOOK_SECRET")) ?? "", headers, body);
   }
   /** Verifies a checkout receipt (pay.js `village:paid` → `e.detail.receipt`, or `session.receipt`). */
   async verifyCheckoutReceipt(token, options = {}) {
@@ -1128,8 +2342,8 @@ var Village = class {
   }
   // ── buying (machines) ─────────────────────────────────────────────────────
   /** Buys one call of `company/offering` through the Gateway. Money moves only if the seller answers 2xx with valid output. */
-  async buy(offering2, input, options = {}) {
-    const [company, name] = splitOffering(offering2);
+  async buy(offering3, input, options = {}) {
+    const [company, name] = splitOffering(offering3);
     return this.paid(`/v1/pay/${encodeURIComponent(company)}/${encodeURIComponent(name)}`, input, options);
   }
   /**
@@ -1208,42 +2422,6 @@ var Village = class {
       };
     }
   };
-  files = {
-    /**
-     * Stores bytes, a Blob, or a URL to copy, for the event (`POST /v1/files`, 0.1 TON). Returns a
-     * public URL other products can fetch.
-     */
-    put: (data, options = {}) => {
-      const query = { ttl_seconds: options.ttlSeconds };
-      if (typeof data === "string") return this.call("POST", "/v1/files", { body: { url: data, content_type: options.contentType }, query });
-      const contentType = options.contentType ?? (data instanceof Blob && data.type ? data.type : "application/octet-stream");
-      return this.call("POST", "/v1/files", { raw: data, headers: { "content-type": contentType }, query });
-    }
-  };
-  /**
-   * Your company's JSON key-value store (`/v1/store`): 1 MB per company (keys + values), free. State for
-   * a hosted product that needs no database.
-   */
-  store = {
-    /** The value, or null when the key is not set. */
-    get: async (key) => {
-      try {
-        return (await this.call("GET", `/v1/store/${encodeURIComponent(key)}`)).value;
-      } catch (error) {
-        if (error instanceof VillageError && error.status === 404) return null;
-        throw error;
-      }
-    },
-    /** Saves any JSON value (fails with INVALID_REQUEST when the store would pass 1 MB). */
-    set: (key, value) => {
-      if (value === void 0) throw new VillageError("INVALID_REQUEST", "store.set needs a JSON value (use store.delete to remove a key)");
-      return this.call("PUT", `/v1/store/${encodeURIComponent(key)}`, { body: value });
-    },
-    /** True when the key existed. */
-    delete: async (key) => (await this.call("DELETE", `/v1/store/${encodeURIComponent(key)}`)).deleted,
-    /** Keys (up to 1000, optionally under a prefix) and how much of the 1 MB is used. */
-    list: (prefix) => this.call("GET", "/v1/store", { query: { prefix } })
-  };
   // ── listings, wallet, ledger ──────────────────────────────────────────────
   listings = {
     /** Creates or updates an offering (price changes are versioned). */
@@ -1279,26 +2457,14 @@ var Village = class {
     state: () => this.call("GET", "/v1/agent/state")
   };
 };
-function cachedKeys(load, ttlMs = 10 * 6e4) {
-  let cached;
-  return () => {
-    if (!cached || Date.now() - cached.at > ttlMs) {
-      const keys3 = load();
-      const entry = { at: Date.now(), keys: keys3 };
-      cached = entry;
-      keys3.catch(() => {
-        if (cached === entry) cached = void 0;
-      });
-    }
-    return cached.keys;
-  };
-}
-function createAmbasada(options = {}) {
+function createVillage(options = {}) {
   return new Village(options);
 }
 
-// ../sdk/src/define.ts
-function defineCompany(config) {
+// ../village/src/define.ts
+function defineCompany(app, village3) {
+  const config = { ...app, ...village3 };
+  if (!config.idea || typeof config.idea.title !== "string") throw new Error(`${config.id}: the village needs idea: { title }`);
   return config;
 }
 function offering(def) {
@@ -1307,39 +2473,66 @@ function offering(def) {
   return def;
 }
 
-// ../sdk/src/index.ts
+// ../village/src/index.ts
 var village = new Village();
-var index_default = village;
+
+// ../sdk/src/index.ts
+var village2 = village;
+var createVillage2 = createVillage;
+var Village2 = Village;
+var VillageError3 = VillageError2;
+var isVillageError2 = isVillageError;
+var ReceiptInvalidError2 = ReceiptInvalidError;
+var DEFAULT_MODEL2 = DEFAULT_MODEL;
+var verifyWebhookPayload2 = verifyWebhookPayload;
+var webhookHeaders3 = webhookHeaders2;
+var generateWebhookSecret3 = generateWebhookSecret2;
+var WEBHOOK_HEADERS3 = WEBHOOK_HEADERS2;
+var RECEIPT_HEADER3 = RECEIPT_HEADER2;
+var readIncoming2 = readIncoming;
+var verifyCallReceipt2 = verifyCallReceipt;
+var verifyCheckoutReceiptToken2 = verifyCheckoutReceiptToken;
+var defineCompany2 = defineCompany;
+var offering2 = offering;
+var DEFAULT_VILLAGE_API_URL2 = DEFAULT_VILLAGE_API_URL;
 export {
   APP_SIGNATURE_HEADER2 as APP_SIGNATURE_HEADER,
   APP_TIMESTAMP_HEADER2 as APP_TIMESTAMP_HEADER,
   AUTH_PATHS,
+  Ambasada,
   AmbasadaApps,
   AmbasadaAuth,
+  AmbasadaError,
   DEFAULT_API_URL,
-  DEFAULT_MODEL,
-  ERROR_STATUS,
+  DEFAULT_MODEL2 as DEFAULT_MODEL,
+  DEFAULT_VILLAGE_API_URL2 as DEFAULT_VILLAGE_API_URL,
+  ERROR_STATUS2 as ERROR_STATUS,
   JWKS_TTL_MS,
-  RECEIPT_HEADER2 as RECEIPT_HEADER,
-  ReceiptInvalidError,
+  RECEIPT_HEADER3 as RECEIPT_HEADER,
+  ReceiptInvalidError2 as ReceiptInvalidError,
   SESSION_TTL_S,
-  Village,
-  VillageError,
-  WEBHOOK_HEADERS,
+  Village2 as Village,
+  VillageError3 as VillageError,
+  WEBHOOK_HEADERS3 as WEBHOOK_HEADERS,
   WebhookInvalidError,
+  ambasada,
   appWebhookHeaders2 as appWebhookHeaders,
   createAmbasada,
-  index_default as default,
-  defineCompany,
+  createVillage2 as createVillage,
+  platform_default as default,
+  defineApp,
+  defineCompany2 as defineCompany,
   errorFromResponse,
-  generateWebhookSecret,
-  isVillageError,
-  offering,
-  readIncoming,
+  generateWebhookSecret3 as generateWebhookSecret,
+  getHeader,
+  isAmbasadaError,
+  isVillageError2 as isVillageError,
+  offering2 as offering,
+  readIncoming2 as readIncoming,
   signAppWebhook2 as signAppWebhook,
-  verifyCallReceipt,
-  verifyCheckoutReceiptToken,
-  verifyWebhookPayload,
-  village,
-  webhookHeaders
+  verifyCallReceipt2 as verifyCallReceipt,
+  verifyCheckoutReceiptToken2 as verifyCheckoutReceiptToken,
+  verifyWebhookPayload2 as verifyWebhookPayload,
+  village2 as village,
+  webhookHeaders3 as webhookHeaders
 };