@anis-ly/partners 0.0.0-stage → 1.0.0

package/dist/index.js

@@ -0,0 +1,2946 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/internal/uuid.ts
+var uuid_exports = {};
+__export(uuid_exports, {
+  canonicalUuid: () => canonicalUuid
+});
+function canonicalUuid(value, argumentName = "UUID") {
+  if (!/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(value)) {
+    throw new TypeError(`${argumentName} must be a canonical UUID.`);
+  }
+  return value.toLowerCase();
+}
+
+// src/signing/keyed-signer.ts
+var KeyedSigner = class {
+  /** Creates a binding; canonical identity avoids a valid signature that names an unknown credential. */
+  constructor(signer, keyId) {
+    this.signer = signer;
+    this.keyId = canonicalUuid(keyId, "keyId");
+  }
+  signer;
+  /** The enrolled credential identifier, canonicalized so Anis can resolve it. */
+  keyId;
+  /** Signs exact bytes through partner-owned key custody without exposing key material. */
+  sign(data) {
+    return this.signer.sign(data);
+  }
+};
+
+// src/signing/pem-p256-signer.ts
+import { readFile } from "fs/promises";
+
+// src/internal/bytes.ts
+import { timingSafeEqual } from "crypto";
+function fixedTimeEqual(left, right) {
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function arrayBufferOf(bytes) {
+  const copy = new Uint8Array(bytes.byteLength);
+  copy.set(bytes);
+  return copy.buffer;
+}
+
+// src/errors/anis-partners-error.ts
+import { inspect } from "util";
+var errorBrandPrefix = "@anis-ly/partners.error:";
+var AnisPartnersError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    let prototype = new.target.prototype;
+    while (prototype !== Error.prototype && prototype !== Object.prototype) {
+      const constructorName = prototype.constructor.name ?? "AnisPartnersError";
+      Object.defineProperty(this, /* @__PURE__ */ Symbol.for(`${errorBrandPrefix}${constructorName}`), { value: true });
+      const parent = Object.getPrototypeOf(prototype);
+      if (parent === null) break;
+      prototype = parent;
+    }
+    this.name = new.target.name;
+  }
+  static [Symbol.hasInstance](value) {
+    if (typeof value !== "object" || value === null) return false;
+    return value[/* @__PURE__ */ Symbol.for(`${errorBrandPrefix}${this.name}`)] === true;
+  }
+  [inspect.custom]() {
+    return `${this.name}: ${this.message}`;
+  }
+};
+
+// src/errors/private-key-error.ts
+var PrivateKeyError = class extends AnisPartnersError {
+};
+
+// src/signing/pem-p256-signer.ts
+var PemP256Signer = class _PemP256Signer {
+  constructor(publicKey, privateKey) {
+    this.publicKey = publicKey;
+    this.#privateKey = privateKey;
+  }
+  publicKey;
+  #privateKey;
+  /** Imports a PKCS#8 PEM key and refuses other curves at load time, before a partner receives an avoidable refusal. */
+  static async fromPem(pem) {
+    if (typeof pem !== "string") throw new PrivateKeyError("The private key must be supplied as PEM text.");
+    const normalized = pem.replace(/^\uFEFF/, "").trim();
+    if (normalized.includes("-----BEGIN ENCRYPTED PRIVATE KEY-----"))
+      throw new PrivateKeyError("Encrypted PEM keys are not supported; decrypt the key before loading it.");
+    if (normalized.includes("-----BEGIN EC PRIVATE KEY-----"))
+      throw new PrivateKeyError("SEC1 PEM keys are not supported; convert to PKCS#8 before loading the key.");
+    const match = /-----BEGIN PRIVATE KEY-----\s*([A-Za-z0-9+/=\r\n]+)\s*-----END PRIVATE KEY-----/.exec(normalized);
+    if (!match?.[1]) throw new PrivateKeyError("Expected a PKCS#8 PEM block labeled PRIVATE KEY.");
+    const pkcs8 = Buffer.from(match[1].replace(/\s/g, ""), "base64");
+    try {
+      const extractableKey = await globalThis.crypto.subtle.importKey(
+        "pkcs8",
+        pkcs8,
+        { name: "ECDSA", namedCurve: "P-256" },
+        true,
+        ["sign"]
+      );
+      const jwk = await globalThis.crypto.subtle.exportKey("jwk", extractableKey);
+      if (!jwk.x || !jwk.y) throw new PrivateKeyError("The private key did not export public coordinates.");
+      const publicKey = await globalThis.crypto.subtle.importKey(
+        "jwk",
+        { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y, ext: true },
+        { name: "ECDSA", namedCurve: "P-256" },
+        true,
+        ["verify"]
+      );
+      const privateKey = await globalThis.crypto.subtle.importKey(
+        "pkcs8",
+        pkcs8,
+        { name: "ECDSA", namedCurve: "P-256" },
+        false,
+        ["sign"]
+      );
+      return new _PemP256Signer(publicKey, privateKey);
+    } catch (cause) {
+      throw new PrivateKeyError("The PEM key must be a valid ECDSA P-256 PKCS#8 private key.", { cause });
+    } finally {
+      pkcs8.fill(0);
+    }
+  }
+  /** Reads and imports a protected PKCS#8 PEM file so the private key can remain in host-controlled storage. */
+  static async fromPemFile(path) {
+    try {
+      return await this.fromPem(await readFile(path, "utf8"));
+    } catch (cause) {
+      if (cause instanceof PrivateKeyError) throw cause;
+      throw new PrivateKeyError("The PEM key file could not be read.", { cause });
+    }
+  }
+  /** Signs bytes in WebCrypto's 64-byte P1363 form; no DER conversion can silently change the wire signature. */
+  async sign(data) {
+    try {
+      return new Uint8Array(
+        await globalThis.crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, this.#privateKey, arrayBufferOf(data))
+      );
+    } catch (cause) {
+      throw new PrivateKeyError("The in-memory P-256 private key could not sign the request.", { cause });
+    }
+  }
+  /** Exports only public coordinates for enrollment and verification; the private half is never part of the JWK. */
+  async publicJwk() {
+    try {
+      const jwk = await globalThis.crypto.subtle.exportKey("jwk", this.publicKey);
+      return {
+        kty: "EC",
+        crv: "P-256",
+        ...jwk.x === void 0 ? {} : { x: jwk.x },
+        ...jwk.y === void 0 ? {} : { y: jwk.y }
+      };
+    } catch (cause) {
+      throw new PrivateKeyError("The P-256 public key could not be exported.", { cause });
+    }
+  }
+  /** Binds this key to the issued credential UUID used by Anis to resolve request signatures. */
+  forKey(keyId) {
+    return new KeyedSigner(this, keyId);
+  }
+};
+
+// src/signing/request-signing-error.ts
+var RequestSigningError = class extends AnisPartnersError {
+  /** Preserves the original signer failure as `cause` while keeping sensitive signature material out of the message. */
+  constructor(cause) {
+    super("The request could not be signed and was not sent.", { cause });
+  }
+};
+
+// src/enrollment/key-thumbprint.ts
+import { createHash } from "crypto";
+
+// src/internal/base64url.ts
+function encodeBase64Url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function decodeBase64Url(value) {
+  if (!value || value.length % 4 === 1 || !/^[A-Za-z0-9_-]+$/.test(value)) return void 0;
+  try {
+    const decoded = Buffer.from(value, "base64url");
+    return decoded.toString("base64url") === value ? new Uint8Array(decoded) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/enrollment/key-thumbprint.ts
+function keyThumbprint(publicJwk) {
+  if (publicJwk.kty !== "EC" || publicJwk.crv !== "P-256")
+    throw new TypeError("The key must be a public EC P-256 JWK.");
+  const x = publicJwk.x;
+  const y = publicJwk.y;
+  if (!x || !y) throw new TypeError("A P-256 public key must include both coordinates.");
+  for (const [name, value] of [
+    ["x", x],
+    ["y", y]
+  ])
+    if (decodeBase64Url(value)?.length !== 32)
+      throw new TypeError(`The JWK member "${name}" must be a 32-byte base64url coordinate.`);
+  const canonical = `{"crv":"P-256","kty":"EC","x":"${x}","y":"${y}"}`;
+  return encodeBase64Url(createHash("sha256").update(canonical, "utf8").digest());
+}
+
+// src/enrollment/safety-code.ts
+var alphabet = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function safetyCodeFromThumbprint(thumbprint) {
+  const bytes = decodeBase64Url(thumbprint);
+  if (bytes?.length !== 32) throw new TypeError("A thumbprint must encode 32 bytes.");
+  let buffer = 0;
+  let bits = 0;
+  let code = "";
+  for (const value of bytes.subarray(0, 10)) {
+    buffer = buffer << 8 | value;
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      code += alphabet.charAt(buffer >> bits & 31);
+    }
+    buffer &= (1 << bits) - 1;
+  }
+  return `${code.slice(0, 4)}-${code.slice(4, 8)}-${code.slice(8, 12)}-${code.slice(12)}`;
+}
+
+// src/enrollment/enrollment-proof.ts
+import { createHash as createHash2 } from "crypto";
+var DOMAIN_SEPARATOR = "anis.partners.v2.credential-proof";
+function proofMessage(keyId, challengeGeneration, challenge, thumbprint) {
+  if (challenge.length === 0) throw new TypeError("An enrollment challenge is required for a possession proof.");
+  if (thumbprint.length === 0) throw new TypeError("A key thumbprint is required for a possession proof.");
+  const hash = createHash2("sha256").update(challenge, "utf8").digest("hex");
+  return new TextEncoder().encode(
+    [DOMAIN_SEPARATOR, canonicalUuid(keyId, "keyId"), String(challengeGeneration), hash, thumbprint].join("\n")
+  );
+}
+async function proofSignature(message, signer) {
+  let signature;
+  try {
+    signature = await signer.sign(message);
+  } catch (cause) {
+    throw new RequestSigningError(cause);
+  }
+  if (!(signature instanceof Uint8Array) || signature.length !== 64)
+    throw new RequestSigningError(new Error("An enrollment proof signer must return 64-byte P-256 P1363 bytes."));
+  return encodeBase64Url(signature);
+}
+
+// src/models/model-parsing.ts
+function asObject(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${label} must be a JSON object.`);
+  }
+  return value;
+}
+function requiredString(object, field, label) {
+  const value = object[field];
+  if (typeof value !== "string") {
+    throw new TypeError(`${label}.${field} must be a string.`);
+  }
+  return value;
+}
+function optionalString(object, field, label) {
+  const value = object[field];
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value !== "string") {
+    throw new TypeError(`${label}.${field} must be a string when present.`);
+  }
+  return value;
+}
+function requiredUuid(object, field, label) {
+  const { canonicalUuid: canonicalUuid2 } = uuid_exports;
+  return canonicalUuid2(requiredString(object, field, label), `${label}.${field}`);
+}
+function optionalUuid(object, field, label) {
+  const value = optionalString(object, field, label);
+  return value === void 0 ? void 0 : canonicalUuid(value, `${label}.${field}`);
+}
+function optionalTimestamp(object, field, label) {
+  const value = optionalString(object, field, label);
+  if (value === void 0) {
+    return void 0;
+  }
+  const result = new Date(value);
+  if (!isStrictIsoTimestamp(value) || Number.isNaN(result.getTime())) {
+    throw new TypeError(`${label}.${field} must be a valid timestamp.`);
+  }
+  return result;
+}
+function isStrictIsoTimestamp(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.exec(
+    value
+  );
+  if (match === null) return false;
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const daysInMonth = new Date(Date.UTC(year, month, 0)).getUTCDate();
+  return month >= 1 && month <= 12 && day >= 1 && day <= daysInMonth;
+}
+function optionalInteger(object, field, label) {
+  const value = object[field];
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value !== "number" || !Number.isInteger(value)) {
+    throw new TypeError(`${label}.${field} must be an integer when present.`);
+  }
+  return value;
+}
+function optionalBoolean(object, field, label) {
+  const value = object[field];
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value !== "boolean") {
+    throw new TypeError(`${label}.${field} must be a boolean when present.`);
+  }
+  return value;
+}
+
+// src/models/enrollment.ts
+function parseEnrollmentState(json) {
+  const object = asObject(json, "EnrollmentState");
+  const invitationId = optionalUuid(object, "invitationId", "EnrollmentState");
+  const applicationId = optionalUuid(object, "applicationId", "EnrollmentState");
+  const state = optionalString(object, "state", "EnrollmentState");
+  const expiresAt = optionalTimestamp(object, "expiresAt", "EnrollmentState");
+  return {
+    ...invitationId === void 0 ? {} : { invitationId },
+    ...applicationId === void 0 ? {} : { applicationId },
+    ...state === void 0 ? {} : { state },
+    ...expiresAt === void 0 ? {} : { expiresAt }
+  };
+}
+function parseEnrollmentKeyResult(json) {
+  const object = asObject(json, "EnrollmentKeyResult");
+  const keyId = requiredUuid(object, "keyId", "EnrollmentKeyResult");
+  const thumbprint = optionalString(object, "thumbprint", "EnrollmentKeyResult");
+  const safetyCode = optionalString(object, "safetyCode", "EnrollmentKeyResult");
+  const challenge = optionalString(object, "challenge", "EnrollmentKeyResult");
+  const challengeGeneration = optionalInteger(object, "challengeGeneration", "EnrollmentKeyResult");
+  return {
+    keyId,
+    ...thumbprint === void 0 ? {} : { thumbprint },
+    ...safetyCode === void 0 ? {} : { safetyCode },
+    ...challenge === void 0 ? {} : { challenge },
+    ...challengeGeneration === void 0 ? {} : { challengeGeneration }
+  };
+}
+function parseEnrollmentStatus(json) {
+  const object = asObject(json, "EnrollmentStatus");
+  const keyId = optionalUuid(object, "keyId", "EnrollmentStatus");
+  const challengeGeneration = optionalInteger(object, "challengeGeneration", "EnrollmentStatus");
+  const proofState = optionalString(object, "proofState", "EnrollmentStatus");
+  const approvalState = optionalString(object, "approvalState", "EnrollmentStatus");
+  const state = optionalString(object, "state", "EnrollmentStatus");
+  const expiresAt = optionalTimestamp(object, "expiresAt", "EnrollmentStatus");
+  const keyExpiresAt = optionalTimestamp(object, "keyExpiresAt", "EnrollmentStatus");
+  return {
+    ...keyId === void 0 ? {} : { keyId },
+    ...challengeGeneration === void 0 ? {} : { challengeGeneration },
+    ...proofState === void 0 ? {} : { proofState },
+    ...approvalState === void 0 ? {} : { approvalState },
+    ...state === void 0 ? {} : { state },
+    ...expiresAt === void 0 ? {} : { expiresAt },
+    ...keyExpiresAt === void 0 ? {} : { keyExpiresAt }
+  };
+}
+function parseSignatureDiagnostic(json) {
+  const object = asObject(json, "SignatureDiagnostic");
+  const routeId = optionalString(object, "routeId", "SignatureDiagnostic");
+  const method = optionalString(object, "method", "SignatureDiagnostic");
+  const authority = optionalString(object, "authority", "SignatureDiagnostic");
+  const path = optionalString(object, "path", "SignatureDiagnostic");
+  const canonicalQuery = optionalString(object, "canonicalQuery", "SignatureDiagnostic");
+  const requestKind = optionalString(object, "requestKind", "SignatureDiagnostic");
+  const requiredScope = optionalString(object, "requiredScope", "SignatureDiagnostic");
+  const coveredComponents = stringArray(object.coveredComponents, "SignatureDiagnostic.coveredComponents");
+  const keyId = optionalUuid(object, "keyId", "SignatureDiagnostic");
+  const partnerId = optionalUuid(object, "partnerId", "SignatureDiagnostic");
+  const applicationId = optionalUuid(object, "applicationId", "SignatureDiagnostic");
+  const policyVersion = optionalInteger(object, "policyVersion", "SignatureDiagnostic");
+  const effectiveScopes = stringArray(object.effectiveScopes, "SignatureDiagnostic.effectiveScopes");
+  const receivedAt = optionalTimestamp(object, "receivedAt", "SignatureDiagnostic");
+  return {
+    coveredComponents,
+    effectiveScopes,
+    ...routeId === void 0 ? {} : { routeId },
+    ...method === void 0 ? {} : { method },
+    ...authority === void 0 ? {} : { authority },
+    ...path === void 0 ? {} : { path },
+    ...canonicalQuery === void 0 ? {} : { canonicalQuery },
+    ...requestKind === void 0 ? {} : { requestKind },
+    ...requiredScope === void 0 ? {} : { requiredScope },
+    ...keyId === void 0 ? {} : { keyId },
+    ...partnerId === void 0 ? {} : { partnerId },
+    ...applicationId === void 0 ? {} : { applicationId },
+    ...policyVersion === void 0 ? {} : { policyVersion },
+    ...receivedAt === void 0 ? {} : { receivedAt }
+  };
+}
+function stringArray(value, label) {
+  const items = value ?? [];
+  if (!Array.isArray(items) || !items.every((item) => typeof item === "string")) {
+    throw new TypeError(`${label} must be an array of strings.`);
+  }
+  return items;
+}
+
+// src/operations/partner-transport.ts
+import { SpanStatusCode } from "@opentelemetry/api";
+
+// src/errors/error-codes.generated.ts
+var ERROR_CODES = [
+  "account_inactive",
+  "allowed_debt_consent_required",
+  "binding_not_authorized",
+  "business_subscription_required",
+  "card_not_found",
+  "card_unavailable",
+  "challenge_expired",
+  "currency_not_supported",
+  "daily_limit_exceeded",
+  "dependency_unavailable",
+  "idempotency_conflict",
+  "insufficient_balance",
+  "insufficient_scope",
+  "internal_error",
+  "invalid_content_digest",
+  "invalid_credentials",
+  "invitation_invalid",
+  "invoice_reveal_limit_exceeded",
+  "key_duplicate",
+  "key_proof_invalid",
+  "malformed_signed_request",
+  "operation_processing",
+  "owner_limit_exceeded",
+  "price_changed",
+  "purchase_not_allowed",
+  "quantity_unavailable",
+  "rate_limited",
+  "replay_detected",
+  "request_timeout",
+  "resource_not_found",
+  "reveal_not_allowed",
+  "signature_expired",
+  "source_ip_not_allowed",
+  "validation_failed",
+  "wallet_disabled",
+  "wallet_expired",
+  "wallet_not_granted"
+];
+var RETRYABLE_ERROR_CODES = /* @__PURE__ */ new Set([
+  "dependency_unavailable",
+  "internal_error",
+  "operation_processing",
+  "rate_limited",
+  "replay_detected",
+  "request_timeout",
+  "signature_expired"
+]);
+function parseErrorCode(code) {
+  if (code === null || code === void 0) {
+    return "unknown";
+  }
+  return ERROR_CODES.find((known) => known === code) ?? "unknown";
+}
+
+// src/models/problem.ts
+function parseProblem(json) {
+  const object = asObject(json, "Problem");
+  const type = optionalString(object, "type", "Problem");
+  const title = optionalString(object, "title", "Problem");
+  const detail = optionalString(object, "detail", "Problem");
+  const code = optionalString(object, "code", "Problem");
+  const requestId = optionalString(object, "requestId", "Problem");
+  const status = optionalInteger(object, "status", "Problem") ?? 0;
+  const extensions = object.extensions;
+  return {
+    status,
+    ...type === void 0 ? {} : { type },
+    ...title === void 0 ? {} : { title },
+    ...detail === void 0 ? {} : { detail },
+    ...code === void 0 ? {} : { code },
+    ...requestId === void 0 ? {} : { requestId },
+    ...extensions === void 0 || extensions === null ? {} : { extensions }
+  };
+}
+
+// src/internal/retry-after.ts
+function retryAfterSeconds(value) {
+  const first = value?.split(",")[0]?.trim();
+  if (first === void 0 || !/^\d+$/.test(first)) return void 0;
+  const seconds = Number(first);
+  return Number.isSafeInteger(seconds) && seconds <= 2147483647 ? seconds : void 0;
+}
+
+// src/errors/anis-api-error.ts
+var AnisApiError = class extends AnisPartnersError {
+  /** Complete parsed problem returned by Anis. */
+  problem;
+  /** Known machine code, or unknown when this SDK has not seen the value. */
+  code;
+  /** Exact wire code, including an unknown future value. */
+  rawCode;
+  /** HTTP status of the verified response. */
+  status;
+  /** Correlation id to quote when asking Anis about the call. */
+  requestId;
+  /** Permanent documentation link for this code. */
+  typeUri;
+  /** Signed Retry-After value in seconds, when supplied. */
+  retryAfter;
+  /** True when Anis returned the recorded refusal for this operation id. */
+  isReplayed;
+  /** Whether the catalogue marks this code retryable; this does not decide order recovery. */
+  isRetryable;
+  /** Whether the refusal leaves an order open for resume. */
+  orderOutcome;
+  /**
+   * Creates a structured API error from a verified problem.
+   *
+   * @remarks The code is the stable branching contract. Titles and details change with language and copy updates, so
+   * callers that branch on the message can break without any API behavior changing.
+   */
+  constructor(problem, status, retryAfter, isReplayed = false) {
+    super(
+      `Anis returned ${String(status)} ${problem.code ?? "unknown"}${isReplayed ? " (recorded answer for this operation)" : ""}${problem.requestId === void 0 ? "" : ` (request ${problem.requestId})`}. Branch on the code, not on this message.`
+    );
+    this.problem = problem;
+    Object.defineProperty(this, "problem", { enumerable: false });
+    this.status = status;
+    this.code = parseErrorCode(problem.code);
+    this.isReplayed = isReplayed;
+    this.isRetryable = RETRYABLE_ERROR_CODES.has(this.code);
+    this.orderOutcome = isReplayed ? "notPlaced" : outcomeOf(this.code);
+    if (problem.code !== void 0) {
+      this.rawCode = problem.code;
+    }
+    if (problem.requestId !== void 0) {
+      this.requestId = problem.requestId;
+    }
+    if (problem.type !== void 0) {
+      this.typeUri = problem.type;
+    }
+    if (retryAfter !== void 0) {
+      this.retryAfter = retryAfter;
+    }
+  }
+};
+var InsufficientBalanceError = class extends AnisApiError {
+};
+var PriceChangedError = class extends AnisApiError {
+};
+var OutOfStockError = class extends AnisApiError {
+};
+var IdempotencyConflictError = class extends AnisApiError {
+};
+var RateLimitedError = class extends AnisApiError {
+};
+var LimitExceededError = class extends AnisApiError {
+};
+var InvalidCredentialsError = class extends AnisApiError {
+};
+var ReplayDetectedError = class extends AnisApiError {
+};
+var AuthorizationError = class extends AnisApiError {
+};
+var ResourceNotFoundError = class extends AnisApiError {
+};
+var ValidationFailedError = class extends AnisApiError {
+};
+var DependencyUnavailableError = class extends AnisApiError {
+};
+var EnrollmentRefusedError = class extends AnisApiError {
+};
+function outcomeOf(code) {
+  return code === "dependency_unavailable" || code === "request_timeout" || code === "internal_error" || code === "operation_processing" || code === "replay_detected" || code === "rate_limited" || code === "unknown" || refusedAtTheDoor(code) ? "unknown" : "notPlaced";
+}
+function refusedAtTheDoor(code) {
+  return code === "invalid_credentials" || code === "signature_expired" || code === "insufficient_scope" || code === "wallet_not_granted" || code === "malformed_signed_request";
+}
+function createAnisApiError(body, status, headers) {
+  const problem = parseProblemOrFallback(body, status);
+  const retryAfter = retryAfterSeconds(headers?.get("retry-after"));
+  const isReplayed = headerValues(headers?.get("idempotency-replayed")).some((value) => value.toLowerCase() === "true");
+  const ErrorType = errorTypeFor(problem.code);
+  return new ErrorType(problem, status, retryAfter, isReplayed);
+}
+function parseProblemOrFallback(body, status) {
+  try {
+    const text = typeof body === "string" ? body : new TextDecoder().decode(body);
+    return parseProblem(JSON.parse(text));
+  } catch {
+    return { type: "about:blank", title: "Unreadable problem", status, code: "internal_error" };
+  }
+}
+function headerValues(value) {
+  return value === void 0 || value === null ? [] : value.split(",").map((part) => part.trim());
+}
+function errorTypeFor(code) {
+  switch (parseErrorCode(code)) {
+    case "insufficient_balance":
+      return InsufficientBalanceError;
+    case "price_changed":
+      return PriceChangedError;
+    case "quantity_unavailable":
+    case "card_unavailable":
+      return OutOfStockError;
+    case "idempotency_conflict":
+      return IdempotencyConflictError;
+    case "rate_limited":
+      return RateLimitedError;
+    case "owner_limit_exceeded":
+    case "daily_limit_exceeded":
+      return LimitExceededError;
+    case "invalid_credentials":
+    case "signature_expired":
+      return InvalidCredentialsError;
+    case "replay_detected":
+      return ReplayDetectedError;
+    case "insufficient_scope":
+    case "source_ip_not_allowed":
+    case "binding_not_authorized":
+    case "account_inactive":
+    case "business_subscription_required":
+    case "wallet_disabled":
+    case "wallet_expired":
+    case "purchase_not_allowed":
+    case "reveal_not_allowed":
+      return AuthorizationError;
+    case "resource_not_found":
+    case "card_not_found":
+    case "wallet_not_granted":
+      return ResourceNotFoundError;
+    case "validation_failed":
+    case "currency_not_supported":
+      return ValidationFailedError;
+    case "dependency_unavailable":
+    case "request_timeout":
+    case "internal_error":
+      return DependencyUnavailableError;
+    case "invitation_invalid":
+    case "challenge_expired":
+    case "key_proof_invalid":
+    case "key_duplicate":
+      return EnrollmentRefusedError;
+    default:
+      return AnisApiError;
+  }
+}
+
+// src/signing/content-digest.ts
+import { createHash as createHash3 } from "crypto";
+var EMPTY_OBJECT_BODY = new TextEncoder().encode("{}");
+function contentDigestOf(bytes) {
+  return `sha-256=:${createHash3("sha256").update(bytes).digest("base64")}:`;
+}
+
+// src/signing/partner-request-signer.ts
+import { inspect as inspect2 } from "util";
+
+// src/signing/signature-profile.ts
+function componentsOf(profile) {
+  switch (profile) {
+    case "SafeRead":
+      return ["@method", "@authority", "@path", "@query", "x-anis-date"];
+    case "BodylessNonceMutation":
+      return ["@method", "@authority", "@path", "@query", "content-digest", "nonce", "x-anis-date"];
+    case "OrderMutation":
+      return ["@method", "@authority", "@path", "@query", "content-digest", "nonce", "idempotency-key", "x-anis-date"];
+  }
+}
+
+// src/signing/signature-inputs.ts
+function canonicalizeSignatureInputs(inputs) {
+  if (inputs.path.includes("%")) throw new TypeError("Paths containing percent escapes cannot be signed.");
+  return {
+    method: inputs.method.toUpperCase(),
+    authority: inputs.authority.toLowerCase(),
+    path: inputs.path,
+    canonicalQuery: inputs.canonicalQuery,
+    anisDate: inputs.anisDate,
+    ...inputs.contentDigest === void 0 ? {} : { contentDigest: inputs.contentDigest },
+    ...inputs.nonce === void 0 ? {} : { nonce: inputs.nonce },
+    ...inputs.idempotencyKey === void 0 ? {} : { idempotencyKey: canonicalUuid(inputs.idempotencyKey, "idempotencyKey") }
+  };
+}
+function valueOf(inputs, component) {
+  const values = {
+    "@method": inputs.method,
+    "@authority": inputs.authority,
+    "@path": inputs.path,
+    "@query": `?${inputs.canonicalQuery}`,
+    "content-digest": inputs.contentDigest,
+    nonce: inputs.nonce,
+    "idempotency-key": inputs.idempotencyKey,
+    "x-anis-date": inputs.anisDate
+  };
+  const value = values[component];
+  if (value === void 0) throw new TypeError(`The covered component '${component}' has no value.`);
+  return value;
+}
+
+// src/signing/partner-request-signature-base.ts
+var PartnerRequestSignatureBase = {
+  /** The sole signature label accepted by Anis; an alternate label is rejected before signature verification. */
+  label: "sig1",
+  /** The only algorithm negotiated by neither side, preventing a fallback with different signature semantics. */
+  algorithm: "ecdsa-p256-sha256",
+  /** The gateway's independent upper bound; longer windows are refused before a request can be accepted. */
+  maxSignatureLifetimeSeconds: 300,
+  /** Builds exact UTF-8 bytes; the final line has no newline because even one extra byte invalidates the signature. */
+  build(profile, inputs, created, expires, keyId) {
+    const nonce = inputs.nonce;
+    const params = this.parameters(profile, created, expires, keyId, nonce);
+    const lines = componentsOf(profile).map((component) => `"${component}": ${valueOf(inputs, component)}
+`);
+    lines.push(`"@signature-params": ${params}`);
+    return new TextEncoder().encode(lines.join(""));
+  },
+  /** Renders contract-ordered parameters, including the nonce only when the route profile requires it. */
+  parameters(profile, created, expires, keyId, nonce) {
+    if (expires - created > this.maxSignatureLifetimeSeconds)
+      throw new RangeError("A Partner signature may live at most 300 seconds.");
+    let invalidNonce = nonce === void 0 || nonce.length === 0;
+    if (nonce !== void 0) {
+      for (const character of nonce)
+        if (character === '"' || character === "\\" || character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)
+          invalidNonce = true;
+    }
+    if (profile === "SafeRead" ? nonce !== void 0 : invalidNonce) {
+      throw new TypeError("The nonce does not match the selected signature profile.");
+    }
+    const ids = componentsOf(profile).map((part) => `"${part}"`).join(" ");
+    return `(${ids});created=${String(created)};expires=${String(expires)};keyid="${canonicalUuid(keyId, "keyId")}";alg="${PartnerRequestSignatureBase.algorithm}"${nonce === void 0 ? "" : `;nonce="${nonce}"`}`;
+  },
+  /** Renders the sole supported label with the same parameters used to build the signed bytes. */
+  signatureInputHeader(parameters) {
+    return `${this.label}=${parameters}`;
+  },
+  /** Renders the exact P1363 bytes; converting to DER would make Anis refuse this otherwise valid signature. */
+  signatureHeader(signature) {
+    return `${this.label}=:${Buffer.from(signature).toString("base64")}:`;
+  }
+};
+
+// src/signing/partner-request-signer.ts
+var PartnerRequestSigner = class {
+  /** Creates a signer backed by partner-owned key custody; the private key never enters this API. */
+  constructor(signer) {
+    this.signer = signer;
+  }
+  signer;
+  /** Builds and signs one attempt; errors retain the signer cause without exposing the base or signature in the message. */
+  async sign(profile, source, created, expires) {
+    const inputs = canonicalizeSignatureInputs(source);
+    if (profile === "SafeRead" !== (inputs.nonce === void 0))
+      throw new TypeError("The nonce does not match the selected signature profile.");
+    for (const name of componentsOf(profile)) {
+      if (name === "content-digest" && inputs.contentDigest === void 0)
+        throw new TypeError("The selected profile requires Content-Digest.");
+      if (name === "idempotency-key" && inputs.idempotencyKey === void 0)
+        throw new TypeError("The order profile requires a caller-owned idempotency key.");
+    }
+    const base = PartnerRequestSignatureBase.build(profile, inputs, created, expires, this.signer.keyId);
+    let signature;
+    try {
+      signature = await this.signer.sign(base);
+    } catch (cause) {
+      throw new RequestSigningError(cause);
+    }
+    if (!(signature instanceof Uint8Array) || signature.length !== 64)
+      throw new RequestSigningError(
+        new Error(
+          `The signer must return a 64-byte Uint8Array for P-256 P1363. A 70\u201372 byte result is almost certainly DER.`
+        )
+      );
+    const params = PartnerRequestSignatureBase.parameters(profile, created, expires, this.signer.keyId, inputs.nonce);
+    return {
+      signatureInput: PartnerRequestSignatureBase.signatureInputHeader(params),
+      signature: PartnerRequestSignatureBase.signatureHeader(signature),
+      anisDate: inputs.anisDate,
+      ...inputs.contentDigest === void 0 ? {} : { contentDigest: inputs.contentDigest },
+      ...inputs.nonce === void 0 ? {} : { nonce: inputs.nonce },
+      ...inputs.idempotencyKey === void 0 ? {} : { idempotencyKey: inputs.idempotencyKey },
+      signatureBase: base,
+      [inspect2.custom]() {
+        return "SignedRequestHeaders { signatureInput: <redacted>, signature: <redacted>, nonce: <redacted>, signatureBase: <redacted> }";
+      }
+    };
+  }
+};
+
+// src/verification/partner-response-verifier.ts
+import { createHash as createHash4 } from "crypto";
+
+// src/internal/clock.ts
+var systemClock = { now: () => /* @__PURE__ */ new Date() };
+
+// src/verification/signature-input-parser.ts
+function parseSignatureInput(value) {
+  if (!value) return void 0;
+  const equal = value.indexOf("=");
+  if (equal <= 0 || value[equal + 1] !== "(") return void 0;
+  const label = value.slice(0, equal);
+  let index = equal + 2;
+  const identifiers = [];
+  while (index < value.length && value[index] !== ")") {
+    if (value[index] === " ") {
+      while (value[index] === " ") index++;
+      continue;
+    }
+    if (value[index] !== '"') return void 0;
+    const end = value.indexOf('"', index + 1);
+    if (end < 0) return void 0;
+    const name = value.slice(index + 1, end);
+    index = end + 1;
+    let requestBound = false;
+    if (value[index] === ";") {
+      if (!value.startsWith(";req", index)) return void 0;
+      index += 4;
+      requestBound = true;
+    }
+    identifiers.push(requestBound ? `${name};req` : name);
+  }
+  if (value[index] !== ")") return void 0;
+  index++;
+  let created;
+  let keyId;
+  let algorithm;
+  while (index < value.length) {
+    if (value[index] !== ";") return void 0;
+    const start = index + 1;
+    const eq = value.indexOf("=", start);
+    if (eq < 0) return void 0;
+    const name = value.slice(start, eq);
+    index = eq + 1;
+    if (value[index] === '"') {
+      const end = value.indexOf('"', index + 1);
+      if (end < 0) return void 0;
+      const text = value.slice(index + 1, end);
+      index = end + 1;
+      if (name === "keyid") keyId = text;
+      else if (name === "alg") algorithm = text;
+    } else {
+      let end = index;
+      while (end < value.length && value[end] !== ";") end++;
+      const text = value.slice(index, end);
+      if (!/^\d+$/.test(text)) return void 0;
+      if (name === "created") {
+        const integer = BigInt(text);
+        if (integer > 9223372036854775807n) return void 0;
+        created = Number(integer);
+      }
+      index = end;
+    }
+  }
+  if (created === void 0 || keyId === void 0) return void 0;
+  return { label, identifiers, created, keyId, ...algorithm === void 0 ? {} : { algorithm } };
+}
+
+// src/verification/partner-response-signature-base.ts
+var PartnerResponseSignatureBase = {
+  /** Response signatures are accepted within this whole-second window to match the gateway's freshness calculation. */
+  MAX_AGE_SECONDS: 60,
+  /** The sole response label; disagreement between headers is refused. */
+  label: "sig1",
+  /** The only supported algorithm; there is no weaker fallback for responses. */
+  algorithm: "ecdsa-p256-sha256",
+  /** Derives covered fields from what actually arrived so absent optional values are never signed as empty fields. */
+  components(status, digest, requestId, requestSignatureInput, location, retryAfter, replayed, cacheControl) {
+    const result = [
+      { name: "@status", value: String(status), requestBound: false },
+      { name: "content-digest", value: digest, requestBound: false },
+      { name: "x-request-id", value: requestId, requestBound: false }
+    ];
+    if (requestSignatureInput)
+      result.push({ name: "signature-input", value: requestSignatureInput, requestBound: true });
+    for (const [name, value] of [
+      ["location", location],
+      ["retry-after", retryAfter],
+      ["idempotency-replayed", replayed],
+      ["cache-control", cacheControl]
+    ])
+      if (value) result.push({ name, value, requestBound: false });
+    return result;
+  },
+  /** Builds exact UTF-8 bytes; request binding and its `;req` identifier must agree in both places. */
+  build(components, created, keyId) {
+    const params = `(${components.map((part) => `"${part.name}"${part.requestBound ? ";req" : ""}`).join(" ")});created=${String(created)};keyid="${keyId}";alg="${PartnerResponseSignatureBase.algorithm}"`;
+    const lines = components.map((part) => `"${part.name}"${part.requestBound ? ";req" : ""}: ${part.value}
+`);
+    lines.push(`"@signature-params": ${params}`);
+    return new TextEncoder().encode(lines.join(""));
+  }
+};
+
+// src/verification/unverifiable-response-error.ts
+var UnverifiableResponseError = class extends AnisPartnersError {
+  /** The contract reason for refusing the response, without requiring callers to parse message text. */
+  failure;
+  /** Creates a response refusal while keeping its body, signature, base, and key material out of the message. */
+  constructor(failure, detail) {
+    super(`The Anis response could not be verified (${failure}): ${detail} Its content has been discarded.`);
+    this.failure = failure;
+  }
+};
+
+// src/internal/safe-telemetry.ts
+import {
+  metrics,
+  SpanKind,
+  trace
+} from "@opentelemetry/api";
+
+// src/observability/telemetry-names.ts
+var AnisPartnersTelemetry = {
+  /** Instrumentation scope used for every SDK span and metric. */
+  scope: "@anis-ly/partners",
+  /** Stable low-cardinality attribute names. */
+  attributes: {
+    client: "anis.client",
+    route: "anis.route",
+    method: "http.request.method",
+    statusCode: "http.response.status_code",
+    errorType: "error.type",
+    errorCode: "anis.error.code",
+    operationId: "anis.operation_id",
+    requestId: "anis.request_id"
+  },
+  /** Metric instrument names emitted by the SDK. */
+  instruments: {
+    requestDuration: "anis.partners.request.duration",
+    signatureDuration: "anis.partners.signature.duration",
+    verificationFailures: "anis.partners.response.verification.failures",
+    orderOutcomes: "anis.partners.order.outcomes",
+    signingKeyFetches: "anis.partners.signing_keys.fetches"
+  }
+};
+
+// src/internal/safe-telemetry.ts
+var packageVersion = "1.0.0";
+var histograms = /* @__PURE__ */ new WeakMap();
+var counters = /* @__PURE__ */ new WeakMap();
+async function withSafeSpan(name, action) {
+  let callbackResult;
+  try {
+    const tracer = trace.getTracer(AnisPartnersTelemetry.scope, packageVersion);
+    const result = tracer.startActiveSpan(name, { kind: SpanKind.CLIENT }, (span) => {
+      callbackResult = Promise.resolve().then(() => action(span));
+      return callbackResult;
+    });
+    void Promise.resolve(result).catch(() => void 0);
+    if (callbackResult !== void 0) return await callbackResult;
+    await result;
+  } catch {
+    if (callbackResult !== void 0) return callbackResult;
+  }
+  return action(void 0);
+}
+function safeSpan(span, action) {
+  if (span === void 0) return;
+  try {
+    action(span);
+  } catch {
+  }
+}
+function safeLog(logger, level, message, fields) {
+  if (logger === void 0) return;
+  try {
+    const result = logger[level]?.(message, fields);
+    if (result !== void 0 && typeof result.then === "function") {
+      void Promise.resolve(result).catch(() => void 0);
+    }
+  } catch {
+  }
+}
+function safeHistogram(name, value, attributes, options) {
+  try {
+    const meter = metrics.getMeter(AnisPartnersTelemetry.scope, packageVersion);
+    const instruments = instrumentsFor(histograms, meter);
+    let instrument = instruments.get(name);
+    if (instrument === void 0) {
+      instrument = meter.createHistogram(name, { ...options, description: `${name} for signed Partner API calls` });
+      instruments.set(name, instrument);
+    }
+    instrument.record(value, attributes);
+  } catch {
+  }
+}
+function safeCounter(name, attributes) {
+  try {
+    const meter = metrics.getMeter(AnisPartnersTelemetry.scope, packageVersion);
+    const instruments = instrumentsFor(counters, meter);
+    let instrument = instruments.get(name);
+    if (instrument === void 0) {
+      instrument = meter.createCounter(name, { description: `${name} for signed Partner API calls` });
+      instruments.set(name, instrument);
+    }
+    instrument.add(1, attributes);
+  } catch {
+  }
+}
+function instrumentsFor(cache, meter) {
+  let instruments = cache.get(meter);
+  if (instruments === void 0) {
+    instruments = /* @__PURE__ */ new Map();
+    cache.set(meter, instruments);
+  }
+  return instruments;
+}
+
+// src/verification/partner-response-verifier.ts
+var PartnerResponseVerifier = class {
+  /** Creates a verifier with key rotation and time supplied separately so neither weakens the wire checks. */
+  constructor(keys, clock = systemClock, logger) {
+    this.keys = keys;
+    this.clock = clock;
+    this.logger = logger;
+  }
+  keys;
+  clock;
+  logger;
+  /** Resolves only for a verifiable response; every refusal throws so untrusted content cannot reach a caller. */
+  async verify(response, options) {
+    const signatureInput = header(response, "Signature-Input");
+    const signature = header(response, "Signature");
+    if (!signatureInput || !signature) fail("signature_missing", "The response carried no signature headers.");
+    const parsed = parseSignatureInput(signatureInput);
+    if (!parsed) fail("signature_malformed", "Signature-Input could not be parsed.");
+    if (parsed.label !== "sig1" || !signature.startsWith("sig1="))
+      fail("label_unexpected", "The label is frozen at sig1 on both headers.");
+    if (parsed.algorithm !== void 0 && parsed.algorithm !== "ecdsa-p256-sha256")
+      fail("algorithm_not_supported", "There is no alternate algorithm to negotiate.");
+    const digest = header(response, "Content-Digest");
+    if (!digest || !fixedTimeEqual(
+      new TextEncoder().encode(digest),
+      new TextEncoder().encode(`sha-256=:${createHash4("sha256").update(response.body).digest("base64")}:`)
+    ))
+      fail("content_digest_mismatch", "The Content-Digest does not describe the body.");
+    const requestId = header(response, "X-Request-Id");
+    if (!requestId) fail("covered_components_mismatch", "The response carried no X-Request-Id.");
+    const components = PartnerResponseSignatureBase.components(
+      response.status,
+      digest,
+      requestId,
+      response.requestSignatureInput,
+      header(response, "Location"),
+      header(response, "Retry-After"),
+      header(response, "Idempotency-Replayed"),
+      header(response, "Cache-Control")
+    );
+    const expected = components.map((part) => `${part.name}${part.requestBound ? ";req" : ""}`);
+    if (expected.length !== parsed.identifiers.length || expected.some((part, i) => part !== parsed.identifiers[i]))
+      fail("covered_components_mismatch", "The advertised components differ from the frozen response profile.");
+    if (parsed.identifiers.some((id) => id.endsWith(";req")) && !response.requestSignatureInput)
+      fail("covered_components_mismatch", "The request binding cannot be rebuilt.");
+    const age = Math.floor(this.clock.now().getTime() / 1e3) - parsed.created;
+    if (!Number.isFinite(age) || Math.abs(age) > PartnerResponseSignatureBase.MAX_AGE_SECONDS)
+      fail("created_out_of_window", `created is ${String(age)}s from this clock.`);
+    let document = await this.keys.get(options);
+    let key = resolve(document, parsed.keyId);
+    if (!key) {
+      safeLog(this.logger, "warn", "Anis response used an unpublished signing key", {
+        keyId: parsed.keyId,
+        eventId: 1006
+      });
+      document = await this.keys.refresh(options);
+      key = resolve(document, parsed.keyId);
+    }
+    if (document.keys.some((candidate) => candidate.d !== void 0 && candidate.d !== ""))
+      fail("key_rejected", "The published key document carries a private member.");
+    if (!key) fail("unknown_key", `keyid ${parsed.keyId} is not published.`);
+    const signatureBytes = byteSequence(signature);
+    if (signatureBytes?.length !== 64) fail("signature_malformed", "P-256 P1363 signatures must be exactly 64 bytes.");
+    const x = decodeBase64Url(key.x);
+    const y = decodeBase64Url(key.y);
+    if (!x || !y || x.length !== 32 || y.length !== 32)
+      fail("key_rejected", "The published key must have two 32-byte P-256 coordinates.");
+    let publicKey;
+    const keyX = key.x;
+    const keyY = key.y;
+    if (!keyX || !keyY) fail("key_rejected", "The published key has missing coordinates.");
+    try {
+      publicKey = await globalThis.crypto.subtle.importKey(
+        "jwk",
+        { kty: "EC", crv: "P-256", x: keyX, y: keyY, ext: true },
+        { name: "ECDSA", namedCurve: "P-256" },
+        false,
+        ["verify"]
+      );
+    } catch {
+      fail("key_rejected", "The published coordinates are not a valid P-256 point.");
+    }
+    const base = PartnerResponseSignatureBase.build(components, parsed.created, parsed.keyId);
+    try {
+      if (!await globalThis.crypto.subtle.verify(
+        { name: "ECDSA", hash: "SHA-256" },
+        publicKey,
+        arrayBufferOf(signatureBytes),
+        arrayBufferOf(base)
+      ))
+        fail("signature_invalid", "The signature does not verify over the rebuilt base.");
+    } catch (cause) {
+      if (cause instanceof UnverifiableResponseError) throw cause;
+      fail("signature_invalid", "The signature could not be verified over the rebuilt base.");
+    }
+  }
+};
+function header(response, name) {
+  for (const key of Object.keys(response.headers))
+    if (key.toLowerCase() === name.toLowerCase()) return response.headers[key];
+  return void 0;
+}
+function resolve(document, keyId) {
+  return document.keys.find((key) => key.kid === keyId && key.x && key.y);
+}
+function byteSequence(value) {
+  const match = /^sig1=:([A-Za-z0-9+/]+={0,2}):$/.exec(value);
+  if (!match) return void 0;
+  const encoded = match[1];
+  if (encoded === void 0) return void 0;
+  try {
+    const bytes = Buffer.from(encoded, "base64");
+    return bytes.toString("base64") === encoded ? new Uint8Array(bytes) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function fail(reason, detail) {
+  throw new UnverifiableResponseError(reason, detail);
+}
+
+// src/operations/partner-routes.ts
+var PARTNER_ROUTES = [
+  { method: "GET", template: "/v1/profile", profile: "SafeRead" },
+  { method: "GET", template: "/v1/wallets", profile: "SafeRead" },
+  { method: "GET", template: "/v1/wallets/{walletId}", profile: "SafeRead" },
+  { method: "GET", template: "/v1/wallets/{walletId}/catalog/categories", profile: "SafeRead" },
+  {
+    method: "GET",
+    template: "/v1/wallets/{walletId}/catalog/categories/{categoryId}/subcategories",
+    profile: "SafeRead"
+  },
+  { method: "GET", template: "/v1/wallets/{walletId}/catalog/subcategories/{subcategoryId}", profile: "SafeRead" },
+  {
+    method: "GET",
+    template: "/v1/wallets/{walletId}/catalog/subcategories/{subcategoryId}/cards",
+    profile: "SafeRead"
+  },
+  { method: "POST", template: "/v1/wallets/{walletId}/orders", profile: "OrderMutation" },
+  { method: "GET", template: "/v1/orders/{operationId}", profile: "SafeRead" },
+  { method: "GET", template: "/v1/wallets/{walletId}/cards", profile: "SafeRead" },
+  { method: "GET", template: "/v1/wallets/{walletId}/cards/{soldCardId}", profile: "SafeRead" },
+  { method: "POST", template: "/v1/wallets/{walletId}/cards/{soldCardId}/reveal", profile: "BodylessNonceMutation" },
+  {
+    method: "POST",
+    template: "/v1/wallets/{walletId}/invoices/{invoiceId}/cards/reveal",
+    profile: "BodylessNonceMutation"
+  },
+  { method: "POST", template: "/v1/diagnostics/signature", profile: "BodylessNonceMutation" },
+  { method: "GET", template: "/v1/enrollments/{invitationId}" },
+  { method: "POST", template: "/v1/enrollments/{invitationId}/keys" },
+  { method: "POST", template: "/v1/enrollments/{invitationId}/proof" },
+  { method: "GET", template: "/v1/enrollments/{invitationId}/status" },
+  { method: "GET", template: "/.well-known/partner-signing-keys.json" }
+];
+
+// src/signing/nonce-factory.ts
+import { randomBytes } from "crypto";
+var RandomNonceFactory = class {
+  /** Generates a fresh 16-byte nonce so retries do not reuse a replayable request value. */
+  create() {
+    return encodeBase64Url(randomBytes(16));
+  }
+};
+
+// src/errors/malformed-response-error.ts
+var MalformedResponseError = class extends AnisPartnersError {
+  model;
+  constructor(model) {
+    super(`The verified Anis response did not match the ${model} contract.`);
+    this.model = model;
+  }
+};
+
+// src/errors/signing-key-document-unavailable-error.ts
+var SigningKeyDocumentUnavailableError = class extends AnisPartnersError {
+  constructor() {
+    super("The Anis signing-key document could not be loaded.");
+  }
+};
+
+// src/operations/partner-transport.ts
+var PartnerTransport = class {
+  /** Keeps request signing and response verification together so callers cannot return an unverified answer. */
+  constructor(settings) {
+    this.settings = settings;
+    if (settings.signer !== void 0) this.requestSigner = new PartnerRequestSigner(settings.signer);
+    this.verifier = new PartnerResponseVerifier(settings.keySource, void 0, settings.logger);
+    this.nonceFactory = settings.nonceFactory ?? new RandomNonceFactory();
+  }
+  settings;
+  /** Configured bounded telemetry name for this client instance. */
+  get clientName() {
+    return this.settings.name;
+  }
+  requestSigner;
+  verifier;
+  nonceFactory;
+  /** Sends one API request; response data is not parsed until its signature and digest pass. */
+  async send(request) {
+    return withSafeSpan(`anis.partners ${request.route}`, async (span) => {
+      const started = performance.now();
+      const timed = operationSignal(request.signal, this.settings.timeoutMs);
+      const attributes = {
+        "anis.client": this.settings.name,
+        "anis.route": request.route,
+        "http.request.method": request.method
+      };
+      safeSpan(span, (active) => active.setAttributes(attributes));
+      const operationId = request.operationId;
+      if (operationId !== void 0) safeSpan(span, (active) => active.setAttribute("anis.operation_id", operationId));
+      try {
+        const route = PARTNER_ROUTES.find(
+          (entry) => entry.template === request.route && entry.method === request.method
+        );
+        if (route === void 0) {
+          safeSpan(span, (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: "unknown route" }));
+          throw new RequestSigningError(new Error("The route is not in the SDK route table."));
+        }
+        const routeProfile = "profile" in route ? route.profile : void 0;
+        if (request.profile !== void 0 && request.profile !== routeProfile) {
+          safeSpan(
+            span,
+            (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: "route profile mismatch" })
+          );
+          throw new RequestSigningError(new Error("The signing profile must match the published route table."));
+        }
+        const profile = routeProfile;
+        let url;
+        try {
+          url = new URL(request.path, this.settings.authority);
+        } catch (cause) {
+          throw new RequestSigningError(cause);
+        }
+        const body = request.body ?? new Uint8Array();
+        const headers = new Headers();
+        headers.set("Accept-Encoding", "identity");
+        if (this.settings.acceptLanguage) headers.set("Accept-Language", this.settings.acceptLanguage);
+        if (request.enrollmentToken !== void 0)
+          headers.set("Authorization", `Enrollment ${request.enrollmentToken}`);
+        if (body.length > 0) headers.set("Content-Type", "application/json");
+        let signedIdempotencyKey;
+        if (profile !== void 0) {
+          if (this.requestSigner === void 0 || this.settings.signer === void 0)
+            throw new RequestSigningError(new Error("A request signer is required for this route."));
+          const now = /* @__PURE__ */ new Date();
+          const nonceValue = profile === "SafeRead" ? void 0 : this.nonceFactory.create();
+          const digest = profile === "SafeRead" ? void 0 : contentDigestOf(body);
+          const sigStarted = performance.now();
+          let signed;
+          try {
+            signed = await this.requestSigner.sign(
+              profile,
+              {
+                method: request.method,
+                authority: url.host,
+                path: url.pathname,
+                canonicalQuery: url.search.slice(1),
+                anisDate: now.toISOString().replace(/\.\d{3}Z$/, "Z"),
+                ...digest === void 0 ? {} : { contentDigest: digest },
+                ...nonceValue === void 0 ? {} : { nonce: nonceValue },
+                ...request.operationId === void 0 ? {} : { idempotencyKey: request.operationId }
+              },
+              Math.floor(now.getTime() / 1e3),
+              Math.floor(now.getTime() / 1e3) + this.settings.signatureLifetimeSeconds
+            );
+            signedIdempotencyKey = signed.idempotencyKey;
+          } catch (cause) {
+            const error = cause instanceof RequestSigningError ? cause : new RequestSigningError(cause);
+            safeLog(
+              this.settings.logger,
+              "warn",
+              `Request signing failed: method=${request.method}, route=${request.route}.`,
+              {
+                eventId: 1007,
+                method: request.method,
+                route: request.route,
+                reason: "signing"
+              }
+            );
+            safeHistogram(
+              "anis.partners.request.duration",
+              performance.now() - started,
+              {
+                ...attributes,
+                "error.type": "signing"
+              },
+              { unit: "ms" }
+            );
+            safeSpan(span, (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: "signing" }));
+            safeSpan(span, (active) => active.setAttribute("error.type", "signing"));
+            throw error;
+          }
+          safeHistogram(
+            "anis.partners.signature.duration",
+            performance.now() - sigStarted,
+            {
+              "anis.signature.profile": profile
+            },
+            { unit: "ms" }
+          );
+          safeLog(
+            this.settings.logger,
+            "debug",
+            `Request signed: method=${request.method}, route=${request.route}, profile=${profile}.`,
+            {
+              eventId: 1e3,
+              method: request.method,
+              route: request.route,
+              profile,
+              keyId: this.settings.signer.keyId
+            }
+          );
+          headers.set("X-Anis-Date", signed.anisDate);
+          if (signed.contentDigest !== void 0) headers.set("Content-Digest", signed.contentDigest);
+          if (signed.nonce !== void 0) headers.set("Nonce", signed.nonce);
+          headers.set("Signature-Input", signed.signatureInput);
+          headers.set("Signature", signed.signature);
+        }
+        const signal = timed.signal;
+        if (signedIdempotencyKey !== void 0) headers.set("Idempotency-Key", signedIdempotencyKey);
+        let response;
+        try {
+          const receivedResponse = await this.settings.fetcher(url, {
+            method: request.method,
+            headers,
+            ...body.length === 0 ? {} : { body: Buffer.from(body) },
+            signal,
+            redirect: "manual"
+          });
+          response = receivedResponse;
+          const contentEncoding = receivedResponse.headers.get("content-encoding");
+          if (contentEncoding !== null && contentEncoding.toLowerCase() !== "identity") {
+            await cancelBody(receivedResponse);
+            safeCounter("anis.partners.response.verification.failures", {
+              "anis.verification.failure": "content_digest_mismatch"
+            });
+            safeLog(this.settings.logger, "error", "Response discarded: failure=content_digest_mismatch.", {
+              eventId: 1003,
+              failure: "content_digest_mismatch"
+            });
+            throw new UnverifiableResponseError(
+              "content_digest_mismatch",
+              "The response was content-encoded, so its received bytes cannot match the signed digest."
+            );
+          }
+          const responseBody = new Uint8Array(await receivedResponse.arrayBuffer());
+          const mergedHeaders = {};
+          receivedResponse.headers.forEach((value, name) => {
+            mergedHeaders[name] = value;
+          });
+          try {
+            const requestSignatureInput = headers.get("Signature-Input");
+            await this.verifier.verify(
+              {
+                status: receivedResponse.status,
+                headers: mergedHeaders,
+                body: responseBody,
+                ...requestSignatureInput === null ? {} : { requestSignatureInput }
+              },
+              { signal }
+            );
+          } catch (error) {
+            if (error instanceof UnverifiableResponseError)
+              safeCounter("anis.partners.response.verification.failures", {
+                "anis.verification.failure": error.failure
+              });
+            safeSpan(span, (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: "unverifiable" }));
+            if (error instanceof UnverifiableResponseError)
+              safeLog(this.settings.logger, "error", `Response discarded: failure=${error.failure}.`, {
+                eventId: 1003,
+                failure: error.failure
+              });
+            throw error;
+          }
+          safeSpan(span, (active) => active.setAttribute("http.response.status_code", receivedResponse.status));
+          const requestId = receivedResponse.headers.get("x-request-id");
+          if (requestId !== null) safeSpan(span, (active) => active.setAttribute("anis.request_id", requestId));
+          const elapsedMs = performance.now() - started;
+          safeLog(
+            this.settings.logger,
+            "debug",
+            `Request completed: method=${request.method}, route=${request.route}, status=${String(receivedResponse.status)}, requestId=${requestId ?? "none"}, elapsedMs=${String(elapsedMs)}.`,
+            {
+              eventId: 1001,
+              method: request.method,
+              route: request.route,
+              statusCode: receivedResponse.status,
+              elapsedMs,
+              requestId
+            }
+          );
+          if (!receivedResponse.ok) {
+            const refusal = createAnisApiError(responseBody, receivedResponse.status, receivedResponse.headers);
+            safeSpan(span, (active) => active.setAttribute("anis.error.code", refusal.rawCode ?? refusal.code));
+            safeHistogram(
+              "anis.partners.request.duration",
+              performance.now() - started,
+              {
+                ...attributes,
+                "http.response.status_code": receivedResponse.status,
+                "anis.error.code": refusal.rawCode ?? refusal.code
+              },
+              { unit: "ms" }
+            );
+            safeLog(
+              this.settings.logger,
+              "warn",
+              `Request refused: method=${request.method}, route=${request.route}, status=${String(receivedResponse.status)}, code=${refusal.rawCode ?? refusal.code}, requestId=${refusal.requestId ?? "none"}, retryable=${String(refusal.isRetryable)}, replayed=${String(refusal.isReplayed)}.`,
+              {
+                eventId: 1002,
+                method: request.method,
+                route: request.route,
+                code: refusal.rawCode ?? refusal.code,
+                statusCode: receivedResponse.status,
+                requestId: refusal.requestId,
+                retryable: refusal.isRetryable,
+                replayed: refusal.isReplayed
+              }
+            );
+            throw refusal;
+          }
+          safeHistogram(
+            "anis.partners.request.duration",
+            performance.now() - started,
+            {
+              ...attributes,
+              "http.response.status_code": receivedResponse.status
+            },
+            { unit: "ms" }
+          );
+          return { response: receivedResponse, body: responseBody };
+        } catch (error) {
+          if (response !== void 0) await cancelBody(response);
+          if (error instanceof AnisApiError) {
+            safeSpan(span, (active) => active.setAttribute("anis.error.code", error.rawCode ?? error.code));
+            safeSpan(
+              span,
+              (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: error.rawCode ?? error.code })
+            );
+            throw error;
+          }
+          const reason = error instanceof UnverifiableResponseError ? "unverifiable" : error instanceof SigningKeyDocumentUnavailableError ? "connection" : request.signal?.aborted ? "canceled" : signal.aborted ? "timeout" : error instanceof TypeError ? "connection" : "other";
+          safeSpan(span, (active) => active.setStatus({ code: SpanStatusCode.ERROR, message: reason }));
+          safeSpan(span, (active) => active.setAttribute("error.type", reason));
+          safeHistogram(
+            "anis.partners.request.duration",
+            performance.now() - started,
+            {
+              ...attributes,
+              "error.type": reason
+            },
+            { unit: "ms" }
+          );
+          safeLog(
+            this.settings.logger,
+            "warn",
+            `No usable answer: method=${request.method}, route=${request.route}, reason=${reason}.`,
+            {
+              eventId: 1007,
+              method: request.method,
+              route: request.route,
+              elapsedMs: performance.now() - started,
+              reason
+            }
+          );
+          throw error;
+        }
+      } finally {
+        timed.dispose();
+        safeSpan(span, (active) => {
+          active.end();
+        });
+      }
+    });
+  }
+  /** Sends and parses a verified non-empty JSON success. */
+  async json(request, parse) {
+    const result = await this.send(request);
+    if (result.body.length === 0)
+      throw new AnisApiError(
+        { status: result.response.status, code: "internal_error", title: "Empty body" },
+        result.response.status
+      );
+    try {
+      const decoded = JSON.parse(new TextDecoder().decode(result.body));
+      if (decoded === null) throw new MalformedResponseError("JSON object");
+      return parse(decoded);
+    } catch (error) {
+      if (error instanceof MalformedResponseError) throw error;
+      if (error instanceof AnisApiError) throw error;
+      throw new MalformedResponseError("response model");
+    }
+  }
+  /** Records the closed order outcome without attaching credential data to logs. */
+  reportOrderOutcome(operationId, outcome, reason) {
+    const message = outcome === "unknown" ? `Order outcome unknown: operationId=${operationId}, reason=${reason ?? "unspecified"}; resume the same id.` : `Order outcome ${outcome}: operationId=${operationId}.`;
+    safeLog(this.settings.logger, outcome === "unknown" ? "warn" : "info", message, {
+      eventId: outcome === "unknown" ? 1008 : 1004,
+      operationId,
+      outcome,
+      ...reason === void 0 ? {} : { reason }
+    });
+  }
+};
+function operationSignal(caller, timeoutMs) {
+  const controller = new AbortController();
+  const abortFromCaller = () => {
+    controller.abort(caller?.reason);
+  };
+  caller?.addEventListener("abort", abortFromCaller, { once: true });
+  if (caller?.aborted) abortFromCaller();
+  const timer = setTimeout(() => {
+    controller.abort(new DOMException("The operation timed out.", "TimeoutError"));
+  }, timeoutMs);
+  return {
+    signal: controller.signal,
+    dispose() {
+      clearTimeout(timer);
+      caller?.removeEventListener("abort", abortFromCaller);
+    }
+  };
+}
+async function cancelBody(response) {
+  try {
+    await response.body?.cancel();
+  } catch {
+  }
+}
+
+// src/client-options.ts
+function validateClientOptions(options) {
+  const authority = new URL(options.authority);
+  const hostname = authority.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const loopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+  if (authority.protocol !== "https:" && !(authority.protocol === "http:" && loopback))
+    throw new TypeError(
+      "Authority must use HTTPS; plain HTTP lets an on-path attacker replace the unsigned key document and read card codes. HTTP is allowed only for loopback testing."
+    );
+  if (authority.pathname !== "/" || authority.search || authority.hash)
+    throw new TypeError("Authority must not include a path, query, or fragment.");
+  const signatureLifetimeSeconds = options.signatureLifetimeSeconds ?? 60;
+  const signingKeyCacheSeconds = options.signingKeyCacheSeconds ?? 600;
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  if (!Number.isInteger(signatureLifetimeSeconds) || signatureLifetimeSeconds < 1 || signatureLifetimeSeconds > 60)
+    throw new RangeError(
+      "signatureLifetimeSeconds must be from 1 through 60 so signed order answers remain fresh enough to verify."
+    );
+  if (!Number.isFinite(signingKeyCacheSeconds) || signingKeyCacheSeconds <= 0)
+    throw new RangeError("signingKeyCacheSeconds must be a positive number.");
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
+    throw new RangeError("timeoutMs must be an integer from 1 through 2147483647.");
+  const acceptLanguage = options.acceptLanguage;
+  if (acceptLanguage !== void 0 && acceptLanguage !== "ar" && acceptLanguage !== "en")
+    throw new TypeError("acceptLanguage must be either 'ar' or 'en'.");
+  return {
+    authority,
+    signatureLifetimeSeconds,
+    signingKeyCacheSeconds,
+    timeoutMs,
+    name: options.name ?? "default",
+    ...acceptLanguage === void 0 ? {} : { acceptLanguage }
+  };
+}
+
+// src/verification/http-signing-key-source.ts
+import { createHash as createHash5 } from "crypto";
+
+// src/verification/partner-jwk.ts
+function parseSigningKeySet(json) {
+  const value = JSON.parse(json);
+  if (typeof value !== "object" || value === null || !("keys" in value) || !Array.isArray(value.keys))
+    throw new TypeError("The signing-key document must contain a keys array.");
+  return { keys: value.keys.map(parsePartnerJwk) };
+}
+var jwkStringMembers = ["kty", "crv", "x", "y", "kid", "use", "alg", "d"];
+function parsePartnerJwk(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    throw new TypeError("Every signing key must be a JSON object.");
+  const source = value;
+  const result = {};
+  for (const member of jwkStringMembers) {
+    const entry = source[member];
+    if (member === "d" && entry === null) continue;
+    if (entry === void 0) continue;
+    if (typeof entry !== "string") throw new TypeError(`The signing-key member "${member}" must be a string.`);
+    result[member] = entry;
+  }
+  return result;
+}
+
+// src/verification/http-signing-key-source.ts
+var HttpSigningKeySource = class {
+  authority;
+  cacheSeconds;
+  fetcher;
+  cache;
+  logger;
+  cached;
+  inFlight;
+  /** Creates an authority-scoped source; caching avoids a key-document request for every Partner response. */
+  constructor(options) {
+    this.authority = new URL(options.authority);
+    this.cacheSeconds = options.cacheSeconds ?? 600;
+    if (!Number.isFinite(this.cacheSeconds) || this.cacheSeconds < 0)
+      throw new RangeError("Cache seconds must be non-negative.");
+    this.fetcher = options.fetch ?? globalThis.fetch;
+    if (options.documentCache !== void 0) this.cache = options.documentCache;
+    if (options.logger !== void 0) this.logger = options.logger;
+  }
+  /** Returns an unexpired document and shares one first-use fetch among concurrent callers. */
+  async get(options) {
+    throwIfAborted(options?.signal);
+    if (this.cached && this.cached.until > performance.now()) return this.cached.document;
+    if (this.inFlight) return this.waitForFlight(this.inFlight, options?.signal);
+    const reason = this.cached ? "expired" : "first-use";
+    return this.fetchAndCache(reason, options?.signal);
+  }
+  /** Forces a fetch after rotation or an explicit caller refresh, even when the cache is still fresh. */
+  async refresh(options) {
+    throwIfAborted(options?.signal);
+    return this.fetchAndCache("refresh", options?.signal);
+  }
+  fetchAndCache(reason, signal) {
+    if (this.inFlight) return this.waitForFlight(this.inFlight, signal);
+    const controller = new AbortController();
+    const promise = this.fetchDocument(reason, controller.signal).finally(() => {
+      if (this.inFlight?.controller === controller) this.inFlight = void 0;
+    });
+    const flight = { controller, waiters: 0, promise };
+    this.inFlight = flight;
+    return this.waitForFlight(flight, signal);
+  }
+  waitForFlight(flight, signal) {
+    flight.waiters += 1;
+    return new Promise((resolve2, reject) => {
+      let finished = false;
+      const release = () => {
+        if (finished) return;
+        finished = true;
+        signal?.removeEventListener("abort", abort);
+        flight.waiters -= 1;
+      };
+      const abort = () => {
+        release();
+        if (flight.waiters === 0) {
+          if (this.inFlight?.controller === flight.controller) this.inFlight = void 0;
+          flight.controller.abort(signal?.reason);
+        }
+        reject(abortReason(signal));
+      };
+      if (signal?.aborted) {
+        abort();
+        return;
+      }
+      signal?.addEventListener("abort", abort, { once: true });
+      flight.promise.then(
+        (document) => {
+          release();
+          resolve2(document);
+        },
+        (error) => {
+          release();
+          reject(error instanceof Error ? error : new Error("The signing-key request failed.", { cause: error }));
+        }
+      );
+    });
+  }
+  async fetchDocument(reason, signal) {
+    const normalizedAuthority = this.authority.toString().toLowerCase().replace(/\/+$/, "");
+    const cacheKey = `anis_partners_keys_${createHash5("sha256").update(normalizedAuthority).digest("hex").slice(0, 32)}`;
+    if (reason === "first-use" && this.cache) {
+      const cached = await settleCache(() => this.cache?.get(cacheKey) ?? Promise.resolve(void 0), signal);
+      throwIfAborted(signal);
+      const stored = cached.ok ? cached.value : void 0;
+      if (stored !== void 0) {
+        try {
+          const envelope = JSON.parse(stored);
+          if (isCacheEnvelope(envelope)) {
+            const nowSeconds = Date.now() / 1e3;
+            const remainingMs = (envelope.fetchedAt + this.cacheSeconds - nowSeconds) * 1e3;
+            if (remainingMs > 0 && envelope.fetchedAt <= nowSeconds + 60) {
+              const document2 = parseSigningKeySet(envelope.document);
+              this.cached = { document: document2, until: performance.now() + remainingMs };
+              safeLog(this.logger, "debug", "signing keys read from the shared cache", {});
+              return document2;
+            }
+          }
+        } catch {
+        }
+      }
+    }
+    const url = new URL("/.well-known/partner-signing-keys.json", this.authority);
+    let response;
+    try {
+      response = await this.fetcher(url, {
+        headers: { "Accept-Encoding": "identity" },
+        redirect: "manual",
+        signal
+      });
+    } catch {
+      if (signal.aborted) throw abortReason(signal);
+      throw new SigningKeyDocumentUnavailableError();
+    }
+    if (!response.ok) {
+      await cancelBody2(response);
+      throw new SigningKeyDocumentUnavailableError();
+    }
+    const contentEncoding = response.headers.get("content-encoding");
+    if (contentEncoding !== null && contentEncoding.toLowerCase() !== "identity") {
+      await cancelBody2(response);
+      throw new SigningKeyDocumentUnavailableError();
+    }
+    let text;
+    let document;
+    try {
+      text = await response.text();
+      document = parseSigningKeySet(text);
+    } catch {
+      if (signal.aborted) throw abortReason(signal);
+      throw new SigningKeyDocumentUnavailableError();
+    }
+    const fetchedAt = Math.floor(Date.now() / 1e3);
+    this.cached = { document, until: performance.now() + this.cacheSeconds * 1e3 };
+    if (this.cache !== void 0) {
+      const value = JSON.stringify({ fetchedAt, document: text });
+      const written = await settleCache(
+        () => this.cache?.set(cacheKey, value, this.cacheSeconds) ?? Promise.resolve(),
+        signal
+      );
+      if (!written.ok) safeLog(this.logger, "warn", "shared signing-key cache write failed", {});
+    }
+    safeLog(this.logger, "info", `Signing keys fetched: reason=${reason}, keyCount=${String(document.keys.length)}.`, {
+      reason,
+      keyCount: document.keys.length
+    });
+    safeCounter("anis.partners.signing_keys.fetches", { "anis.fetch.reason": reason });
+    return document;
+  }
+};
+function isCacheEnvelope(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  return typeof record.fetchedAt === "number" && Number.isSafeInteger(record.fetchedAt) && typeof record.document === "string";
+}
+function settleCache(operation, signal) {
+  return new Promise((resolve2) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      resolve2(result);
+    };
+    const onAbort = () => {
+      finish({ ok: false });
+    };
+    const timer = setTimeout(() => {
+      finish({ ok: false });
+    }, 2e3);
+    signal.addEventListener("abort", onAbort, { once: true });
+    Promise.resolve().then(operation).then(
+      (value) => {
+        finish({ ok: true, value });
+      },
+      () => {
+        finish({ ok: false });
+      }
+    );
+  });
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortReason(signal);
+}
+async function cancelBody2(response) {
+  try {
+    await response.body?.cancel();
+  } catch {
+  }
+}
+function abortReason(signal) {
+  return signal?.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted.", "AbortError");
+}
+
+// src/enrollment/enrollment-client.ts
+var EnrollmentKeyMismatchError = class extends AnisPartnersError {
+  /** Thumbprint calculated from the public key submitted by this caller. */
+  localThumbprint;
+  /** Thumbprint returned by Anis, when present. */
+  serverThumbprint;
+  /** Stops a proof from being made with a challenge bound to another key. */
+  constructor(localThumbprint, serverThumbprint) {
+    super(
+      "The key Anis holds differs from the one submitted. Do not prove possession; ask Anis to restart enrollment."
+    );
+    this.localThumbprint = localThumbprint;
+    if (serverThumbprint !== void 0) this.serverThumbprint = serverThumbprint;
+  }
+};
+var AnisEnrollmentClient = class _AnisEnrollmentClient {
+  transport;
+  invitation;
+  #token;
+  constructor(transport, invitationId, token) {
+    this.transport = transport;
+    this.invitation = canonicalUuid(invitationId, "invitationId");
+    this.#token = token;
+  }
+  /** Creates an enrollment client over the same mandatory response-verification pipeline. */
+  static create(input) {
+    if (input.enrollmentToken.trim().length === 0 || hasControlCharacters(input.enrollmentToken))
+      throw new TypeError("The enrollment token must be non-blank and contain no control characters.");
+    const options = validateClientOptions({
+      authority: input.authority,
+      ...input.signingKeyCacheSeconds === void 0 ? {} : { signingKeyCacheSeconds: input.signingKeyCacheSeconds },
+      ...input.timeoutMs === void 0 ? {} : { timeoutMs: input.timeoutMs }
+    });
+    const fetcher = input.fetch ?? globalThis.fetch;
+    const keySource = new HttpSigningKeySource({
+      authority: options.authority,
+      cacheSeconds: options.signingKeyCacheSeconds,
+      fetch: fetcher,
+      ...input.keyCache === void 0 ? {} : { documentCache: input.keyCache },
+      ...input.logger === void 0 ? {} : {
+        logger: {
+          debug(message, fields) {
+            safeLog(input.logger, "debug", message, fields);
+          },
+          info(message, fields) {
+            safeLog(input.logger, "info", message, { ...fields, eventId: 1005 });
+          },
+          warn(message, fields) {
+            safeLog(input.logger, "warn", message, fields);
+          }
+        }
+      }
+    });
+    const transportOptions = {
+      ...options,
+      fetcher,
+      keySource,
+      ...input.logger === void 0 ? {} : { logger: input.logger }
+    };
+    return new _AnisEnrollmentClient(new PartnerTransport(transportOptions), input.invitationId, input.enrollmentToken);
+  }
+  /** Reads invitation state. */
+  async get(options) {
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/enrollments/{invitationId}",
+        path: `/v1/enrollments/${this.invitation}`,
+        enrollmentToken: this.#token,
+        ...options?.signal === void 0 ? {} : { signal: options.signal }
+      },
+      parseEnrollmentState
+    );
+  }
+  /** Reads approval and key-expiry state. */
+  async getStatus(options) {
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/enrollments/{invitationId}/status",
+        path: `/v1/enrollments/${this.invitation}/status`,
+        enrollmentToken: this.#token,
+        ...options?.signal === void 0 ? {} : { signal: options.signal }
+      },
+      parseEnrollmentStatus
+    );
+  }
+  /** Submits a public key, then checks the verified answer against its local RFC 7638 thumbprint. */
+  async submitKey(request, options) {
+    rejectPrivateMembers(request.publicJwk);
+    const local = keyThumbprint(request.publicJwk);
+    const bytes = new TextEncoder().encode(
+      JSON.stringify({
+        publicJwk: {
+          kty: request.publicJwk.kty,
+          crv: request.publicJwk.crv,
+          x: request.publicJwk.x,
+          y: request.publicJwk.y
+        },
+        notBefore: request.notBefore,
+        expiresAt: request.expiresAt
+      })
+    );
+    const answer = await this.transport.json(
+      {
+        method: "POST",
+        route: "/v1/enrollments/{invitationId}/keys",
+        path: `/v1/enrollments/${this.invitation}/keys`,
+        body: bytes,
+        enrollmentToken: this.#token,
+        ...options?.signal === void 0 ? {} : { signal: options.signal }
+      },
+      parseEnrollmentKeyResult
+    );
+    if (answer.thumbprint === void 0 || !fixedTimeEqual(new TextEncoder().encode(local), new TextEncoder().encode(answer.thumbprint)))
+      throw new EnrollmentKeyMismatchError(local, answer.thumbprint);
+    return { ...answer, safetyCode: safetyCodeFromThumbprint(local) };
+  }
+  /** Builds the possession message, obtains its P-256 signature, and submits the proof. */
+  async prove(submitted, signer, options) {
+    const message = proofMessage(
+      submitted.keyId,
+      submitted.challengeGeneration ?? missing("challengeGeneration"),
+      submitted.challenge ?? missing("challenge"),
+      submitted.thumbprint ?? missing("thumbprint")
+    );
+    const signature = await proofSignature(message, signer);
+    return this.submitProof(
+      {
+        keyId: submitted.keyId,
+        challengeGeneration: submitted.challengeGeneration ?? missing("challengeGeneration"),
+        signature
+      },
+      options
+    );
+  }
+  /** Submits a previously prepared proof for the current challenge generation. */
+  async submitProof(request, options) {
+    return this.transport.json(
+      {
+        method: "POST",
+        route: "/v1/enrollments/{invitationId}/proof",
+        path: `/v1/enrollments/${this.invitation}/proof`,
+        body: new TextEncoder().encode(
+          JSON.stringify({
+            keyId: request.keyId,
+            challengeGeneration: request.challengeGeneration,
+            signature: request.signature
+          })
+        ),
+        enrollmentToken: this.#token,
+        ...options?.signal === void 0 ? {} : { signal: options.signal }
+      },
+      parseEnrollmentStatus
+    );
+  }
+};
+var privateJwkMembers = ["d", "p", "q", "dp", "dq", "qi", "oth", "k"];
+function rejectPrivateMembers(jwk) {
+  for (const member of privateJwkMembers) {
+    if (Object.hasOwn(jwk, member)) throw new TypeError("Enrollment accepts a public JWK only.");
+  }
+}
+function missing(member) {
+  throw new TypeError(`Enrollment key answer has no ${member}.`);
+}
+function hasControlCharacters(value) {
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
+
+// src/models/money.ts
+import { inspect as inspect3 } from "util";
+var moneyBrand = /* @__PURE__ */ Symbol.for("@anis-ly/partners.Money");
+var Money = class _Money {
+  constructor(thousandths, currency, asOf) {
+    this.currency = currency;
+    this.asOf = asOf;
+    this.#thousandths = thousandths;
+    Object.defineProperty(this, moneyBrand, { value: true });
+  }
+  currency;
+  asOf;
+  #thousandths;
+  static [Symbol.hasInstance](value) {
+    return typeof value === "object" && value !== null && value[moneyBrand] === true;
+  }
+  /**
+   * Builds an amount from its decimal wire spelling.
+   *
+   * @remarks A number has already passed through floating-point arithmetic, so accepting one could make an order
+   * total differ from the exact unit price the API checks.
+   */
+  static of(amount, currency, asOf) {
+    if (typeof amount !== "string") {
+      throw new TypeError("Money amounts must be decimal strings.");
+    }
+    if (typeof currency !== "string" || currency.length === 0) {
+      throw new TypeError("A currency code is required.");
+    }
+    const match = /^(-?)(0|[1-9]\d*)(?:\.(\d+))?$/.exec(amount);
+    if (match === null) {
+      throw new TypeError("A money amount must be a decimal string.");
+    }
+    const sign = match[1] === "-" ? -1n : 1n;
+    const whole = BigInt(match[2] ?? "0");
+    const fraction = match[3] ?? "";
+    if (fraction.length > 3) {
+      throw new TypeError("Anis amounts have at most three decimal places");
+    }
+    const thousandths = whole * 1000n + BigInt((fraction + "000").slice(0, 3));
+    return new _Money(sign * thousandths, currency, asOf);
+  }
+  /** The amount rendered with exactly three decimal places so Anis receives the contract's decimal-string form. */
+  get amount() {
+    const negative = this.#thousandths < 0n;
+    const absolute = negative ? -this.#thousandths : this.#thousandths;
+    const whole = absolute / 1000n;
+    const fraction = String(absolute % 1000n).padStart(3, "0");
+    return `${negative ? "-" : ""}${String(whole)}.${fraction}`;
+  }
+  /**
+   * Multiplies by a whole quantity without losing fractional currency units.
+   *
+   * @remarks The source instant describes the unit quote, not the computed order total, so it is cleared on the result.
+   */
+  multiply(quantity) {
+    if (!Number.isSafeInteger(quantity)) {
+      throw new TypeError("Money can only be multiplied by a safe whole number.");
+    }
+    return new _Money(this.#thousandths * BigInt(quantity), this.currency);
+  }
+  /** Uses the familiar decimal and currency spelling when a balance is interpolated into application text. */
+  toString() {
+    return `${this.amount} ${this.currency}`;
+  }
+  [inspect3.custom]() {
+    return this.toString();
+  }
+  /** Converts to the contract object while retaining its decimal-string amount. */
+  toJSON() {
+    return {
+      amount: this.amount,
+      currency: this.currency,
+      ...this.asOf === void 0 ? {} : { asOf: timestampToWire(this.asOf) }
+    };
+  }
+};
+function parseMoney(json) {
+  const object = asObject(json, "Money");
+  const amount = requiredString(object, "amount", "Money");
+  const currency = requiredString(object, "currency", "Money");
+  const asOf = optionalTimestamp(object, "asOf", "Money");
+  return Money.of(amount, currency, asOf);
+}
+function timestampToWire(value) {
+  if (Number.isNaN(value.getTime())) {
+    throw new TypeError("Money.asOf must be a valid date.");
+  }
+  return value.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+
+// src/models/catalogue.ts
+function parseLocalizedText(json) {
+  const object = asObject(json, "LocalizedText");
+  const ar = optionalString(object, "ar", "LocalizedText");
+  const en = optionalString(object, "en", "LocalizedText");
+  return { ...ar === void 0 ? {} : { ar }, ...en === void 0 ? {} : { en } };
+}
+function parseCatalogueCategoryType(value) {
+  if (typeof value !== "string") {
+    return "unknown";
+  }
+  switch (value.toLowerCase()) {
+    case "local":
+      return "local";
+    case "international":
+      return "international";
+    default:
+      return "unknown";
+  }
+}
+function parseCatalogueCategory(json) {
+  const object = asObject(json, "CatalogueCategory");
+  const name = parseOptionalLocalized(object, "name", "CatalogueCategory");
+  const description = parseOptionalLocalized(object, "description", "CatalogueCategory");
+  const logo = optionalString(object, "logo", "CatalogueCategory");
+  return {
+    id: requiredUuid(object, "id", "CatalogueCategory"),
+    type: parseCatalogueCategoryType(object.type),
+    inStock: optionalBoolean(object, "inStock", "CatalogueCategory") ?? false,
+    displayOrder: optionalInteger(object, "displayOrder", "CatalogueCategory") ?? 0,
+    ...name === void 0 ? {} : { name },
+    ...description === void 0 ? {} : { description },
+    ...logo === void 0 ? {} : { logo }
+  };
+}
+function parseCatalogueSubcategory(json) {
+  const object = asObject(json, "CatalogueSubcategory");
+  const name = parseOptionalLocalized(object, "name", "CatalogueSubcategory");
+  const description = parseOptionalLocalized(object, "description", "CatalogueSubcategory");
+  const logo = optionalString(object, "logo", "CatalogueSubcategory");
+  const disclaimer = parseOptionalLocalized(object, "disclaimer", "CatalogueSubcategory");
+  return {
+    id: requiredUuid(object, "id", "CatalogueSubcategory"),
+    categoryId: optionalUuid(object, "categoryId", "CatalogueSubcategory") ?? "00000000-0000-0000-0000-000000000000",
+    isBestSelling: optionalBoolean(object, "isBestSelling", "CatalogueSubcategory") ?? false,
+    displayOrder: optionalInteger(object, "displayOrder", "CatalogueSubcategory") ?? 0,
+    available: optionalBoolean(object, "available", "CatalogueSubcategory") ?? false,
+    ...name === void 0 ? {} : { name },
+    ...description === void 0 ? {} : { description },
+    ...logo === void 0 ? {} : { logo },
+    ...disclaimer === void 0 ? {} : { disclaimer }
+  };
+}
+function parseCatalogueCard(json) {
+  const object = asObject(json, "CatalogueCard");
+  const name = parseOptionalLocalized(object, "name", "CatalogueCard");
+  const faceValue = optionalString(object, "faceValue", "CatalogueCard");
+  const unitPrice = parseOptionalMoney(object, "unitPrice");
+  const businessPrice = parseOptionalMoney(object, "businessPrice");
+  const personalPrice = parseOptionalMoney(object, "personalPrice");
+  const specialOfferPrice = parseOptionalMoney(object, "specialOfferPrice");
+  const minimumQuantity = optionalInteger(object, "minimumQuantity", "CatalogueCard");
+  const maximumQuantity = optionalInteger(object, "maximumQuantity", "CatalogueCard");
+  return {
+    id: requiredUuid(object, "id", "CatalogueCard"),
+    subcategoryId: optionalUuid(object, "subcategoryId", "CatalogueCard") ?? "00000000-0000-0000-0000-000000000000",
+    hasSpecialOffer: optionalBoolean(object, "hasSpecialOffer", "CatalogueCard") ?? false,
+    available: optionalBoolean(object, "available", "CatalogueCard") ?? false,
+    ...name === void 0 ? {} : { name },
+    ...faceValue === void 0 ? {} : { faceValue },
+    ...unitPrice === void 0 ? {} : { unitPrice },
+    ...businessPrice === void 0 ? {} : { businessPrice },
+    ...personalPrice === void 0 ? {} : { personalPrice },
+    ...specialOfferPrice === void 0 ? {} : { specialOfferPrice },
+    ...minimumQuantity === void 0 ? {} : { minimumQuantity },
+    ...maximumQuantity === void 0 ? {} : { maximumQuantity }
+  };
+}
+function parsePage(json, parseItem) {
+  const object = asObject(json, "Page");
+  const items = object.items ?? [];
+  if (!Array.isArray(items)) {
+    throw new TypeError("Page.items must be an array.");
+  }
+  const nextCursor = optionalString(object, "nextCursor", "Page");
+  return {
+    items: items.map(parseItem),
+    ...nextCursor === void 0 ? {} : { nextCursor }
+  };
+}
+function parseOptionalLocalized(object, field, label) {
+  const value = object[field];
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  try {
+    return parseLocalizedText(value);
+  } catch (cause) {
+    throw new TypeError(`${label}.${field} must contain Arabic or English text.`, { cause });
+  }
+}
+function parseOptionalMoney(object, field) {
+  const value = object[field];
+  return value === void 0 || value === null ? void 0 : parseMoney(value);
+}
+
+// src/models/cards.ts
+import { inspect as inspect4 } from "util";
+function parseMaskedCard(json) {
+  const object = asObject(json, "MaskedCard");
+  const orderOperationId = optionalUuid(object, "orderOperationId", "MaskedCard");
+  const invoiceId = optionalUuid(object, "invoiceId", "MaskedCard");
+  const card = parseOptionalProduct(object, "card");
+  const serialNumberMasked = optionalString(object, "serialNumberMasked", "MaskedCard");
+  const purchasedAt = optionalTimestamp(object, "purchasedAt", "MaskedCard");
+  const unitPrice = object.unitPrice === void 0 || object.unitPrice === null ? void 0 : parseMoney(object.unitPrice);
+  const expiryDate = optionalDateOnly(object, "expiryDate", "MaskedCard");
+  const invoiceNumber = optionalInteger(object, "invoiceNumber", "MaskedCard");
+  const faceValue = optionalString(object, "faceValue", "MaskedCard");
+  const subcategory = parseOptionalSubcategory(object);
+  return {
+    id: requiredUuid(object, "id", "MaskedCard"),
+    credentialAvailable: optionalBoolean(object, "credentialAvailable", "MaskedCard") ?? false,
+    ...orderOperationId === void 0 ? {} : { orderOperationId },
+    ...invoiceId === void 0 ? {} : { invoiceId },
+    ...card === void 0 ? {} : { card },
+    ...serialNumberMasked === void 0 ? {} : { serialNumberMasked },
+    ...purchasedAt === void 0 ? {} : { purchasedAt },
+    ...unitPrice === void 0 ? {} : { unitPrice },
+    ...expiryDate === void 0 ? {} : { expiryDate },
+    ...invoiceNumber === void 0 ? {} : { invoiceNumber },
+    ...faceValue === void 0 ? {} : { faceValue },
+    ...subcategory === void 0 ? {} : { subcategory }
+  };
+}
+function parseRevealedCredential(json) {
+  const object = asObject(json, "RevealedCredential");
+  const serialNumber = optionalString(object, "serialNumber", "RevealedCredential");
+  const voucher = optionalString(object, "voucher", "RevealedCredential");
+  const revealedAt = optionalTimestamp(object, "revealedAt", "RevealedCredential");
+  const expiryDate = optionalDateOnly(object, "expiryDate", "RevealedCredential");
+  const invoiceId = optionalUuid(object, "invoiceId", "RevealedCredential");
+  const card = parseOptionalProduct(object, "card");
+  const purchasedAt = optionalTimestamp(object, "purchasedAt", "RevealedCredential");
+  const credential = {
+    soldCardId: optionalUuid(object, "soldCardId", "RevealedCredential") ?? "00000000-0000-0000-0000-000000000000",
+    ...serialNumber === void 0 ? {} : { serialNumber },
+    ...voucher === void 0 ? {} : { voucher },
+    ...revealedAt === void 0 ? {} : { revealedAt },
+    ...expiryDate === void 0 ? {} : { expiryDate },
+    ...invoiceId === void 0 ? {} : { invoiceId },
+    ...card === void 0 ? {} : { card },
+    ...purchasedAt === void 0 ? {} : { purchasedAt },
+    toString() {
+      return `RevealedCredential { SoldCardId = ${this.soldCardId}, Secret = <redacted> }`;
+    },
+    [inspect4.custom]() {
+      return `RevealedCredential { SoldCardId = ${this.soldCardId}, Secret = <redacted> }`;
+    }
+  };
+  Object.defineProperty(credential, "toString", { enumerable: false });
+  Object.defineProperty(credential, inspect4.custom, { enumerable: false });
+  return credential;
+}
+function parseRevealedCredentialCollection(json) {
+  const object = asObject(json, "RevealedCredentialCollection");
+  const items = object.items ?? [];
+  if (!Array.isArray(items)) {
+    throw new TypeError("RevealedCredentialCollection.items must be an array.");
+  }
+  return { items: items.map(parseRevealedCredential) };
+}
+function parseOptionalProduct(object, field) {
+  const value = object[field];
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  const nested = asObject(value, `MaskedCard.${field}`);
+  const name = nested.name === void 0 || nested.name === null ? void 0 : parseLocalizedText(nested.name);
+  return {
+    id: requiredUuid(nested, "id", `MaskedCard.${field}`),
+    ...name === void 0 ? {} : { name }
+  };
+}
+function parseOptionalSubcategory(object) {
+  const value = object.subcategory;
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  const nested = asObject(value, "MaskedCard.subcategory");
+  const name = nested.name === void 0 || nested.name === null ? void 0 : parseLocalizedText(nested.name);
+  return {
+    id: requiredUuid(nested, "id", "MaskedCard.subcategory"),
+    ...name === void 0 ? {} : { name }
+  };
+}
+function optionalDateOnly(object, field, label) {
+  const value = optionalString(object, field, label);
+  if (value === void 0) {
+    return void 0;
+  }
+  const parsed = /* @__PURE__ */ new Date(`${value}T00:00:00Z`);
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value) || Number.isNaN(parsed.getTime()) || parsed.toISOString().slice(0, 10) !== value) {
+    throw new TypeError(`${label}.${field} must be a calendar date.`);
+  }
+  return value;
+}
+
+// src/models/orders.ts
+function parseOrder(json) {
+  const object = asObject(json, "Order");
+  const invoiceId = optionalUuid(object, "invoiceId", "Order");
+  const walletId = optionalUuid(object, "walletId", "Order");
+  const cardId = optionalUuid(object, "cardId", "Order");
+  const quantity = optionalInteger(object, "quantity", "Order");
+  const total = object.total === void 0 || object.total === null ? void 0 : parseMoney(object.total);
+  const soldCards = parseOptionalCredentials(object.soldCards);
+  const completedAt = optionalTimestamp(object, "completedAt", "Order");
+  const externalReference = optionalString(object, "externalReference", "Order");
+  const failureCode = optionalString(object, "failureCode", "Order");
+  const codesWithheld = optionalBoolean(object, "codesWithheld", "Order");
+  return {
+    operationId: requiredUuid(object, "operationId", "Order"),
+    status: parseOrderStatus(object.status),
+    ...invoiceId === void 0 ? {} : { invoiceId },
+    ...walletId === void 0 ? {} : { walletId },
+    ...cardId === void 0 ? {} : { cardId },
+    ...quantity === void 0 ? {} : { quantity },
+    ...total === void 0 ? {} : { total },
+    ...soldCards === void 0 ? {} : { soldCards },
+    ...completedAt === void 0 ? {} : { completedAt },
+    ...externalReference === void 0 ? {} : { externalReference },
+    ...failureCode === void 0 ? {} : { failureCode },
+    ...codesWithheld === void 0 ? {} : { codesWithheld }
+  };
+}
+function parseOrderStatus(value) {
+  if (typeof value !== "string") {
+    return "unknown";
+  }
+  switch (value.toLowerCase()) {
+    case "processing":
+      return "processing";
+    case "recoveryexhausted":
+      return "recoveryExhausted";
+    case "completed":
+      return "completed";
+    case "failed":
+      return "failed";
+    default:
+      return "unknown";
+  }
+}
+function parseOptionalCredentials(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (!Array.isArray(value)) {
+    throw new TypeError("Order.soldCards must be an array when present.");
+  }
+  return value.map(parseRevealedCredential);
+}
+
+// src/models/wallets.ts
+function parseWallet(json) {
+  const object = asObject(json, "Wallet");
+  const name = optionalString(object, "name", "Wallet");
+  const currency = optionalString(object, "currency", "Wallet");
+  return {
+    id: requiredUuid(object, "id", "Wallet"),
+    balance: parseMoney(object.balance),
+    ...name === void 0 ? {} : { name },
+    ...currency === void 0 ? {} : { currency }
+  };
+}
+function parsePartnerProfile(json) {
+  const object = asObject(json, "PartnerProfile");
+  const partner = object.partner === void 0 || object.partner === null ? void 0 : parsePartnerIdentity(object.partner);
+  const application = object.application === void 0 || object.application === null ? void 0 : parseApplicationIdentity(object.application);
+  const ownerAccount = object.ownerAccount === void 0 || object.ownerAccount === null ? void 0 : parseOwnerAccount(object.ownerAccount);
+  const documentationVersion = optionalString(object, "documentationVersion", "PartnerProfile");
+  return {
+    ...partner === void 0 ? {} : { partner },
+    ...application === void 0 ? {} : { application },
+    ...ownerAccount === void 0 ? {} : { ownerAccount },
+    ...documentationVersion === void 0 ? {} : { documentationVersion }
+  };
+}
+function parsePartnerIdentity(json) {
+  const object = asObject(json, "PartnerIdentity");
+  return { id: requiredUuid(object, "id", "PartnerIdentity") };
+}
+function parseApplicationIdentity(json) {
+  const object = asObject(json, "ApplicationIdentity");
+  const scopes = object.scopes ?? [];
+  if (!Array.isArray(scopes) || !scopes.every((scope) => typeof scope === "string")) {
+    throw new TypeError("ApplicationIdentity.scopes must be an array of strings.");
+  }
+  return { id: requiredUuid(object, "id", "ApplicationIdentity"), scopes };
+}
+function parseOwnerAccount(json) {
+  const object = asObject(json, "OwnerAccount");
+  const displayName = optionalString(object, "displayName", "OwnerAccount");
+  return {
+    id: requiredUuid(object, "id", "OwnerAccount"),
+    ...displayName === void 0 ? {} : { displayName }
+  };
+}
+
+// src/operations/operations.ts
+var ProfileOperations = class {
+  /** Shares the verified transport so profile reads follow the client's authority and signing policy. */
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Reads identity and effective scopes from the live policy. */
+  async get(options) {
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/profile",
+        path: "/v1/profile",
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      parsePartnerProfile
+    );
+  }
+};
+var WalletOperations = class {
+  /** Shares the verified transport so wallet reads follow the client's authority and signing policy. */
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Walks wallet pages so callers need not manage continuation cursors. */
+  async *list(options) {
+    yield* pages((cursor) => this.listPage(pageOptions(cursor, options)));
+  }
+  /** Reads one page when the caller manages the cursor. */
+  async listPage(options) {
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/wallets",
+        path: pagePath("/v1/wallets", options?.cursor),
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      (json) => parsePage(json, parseWallet)
+    );
+  }
+  /** Reads one granted wallet by canonical UUID. */
+  async get(walletId, options) {
+    const id = canonicalUuid(walletId, "walletId");
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/wallets/{walletId}",
+        path: `/v1/wallets/${id}`,
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      parseWallet
+    );
+  }
+};
+var CatalogueOperations = class {
+  /** Shares the verified transport so catalogue reads use the client's price and signing policy. */
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Walks category pages for a wallet. */
+  async *listCategories(walletId, options) {
+    yield* pages((cursor) => this.listCategoriesPage(walletId, pageOptions(cursor, options)));
+  }
+  /** Reads one category page. */
+  async listCategoriesPage(walletId, options) {
+    const id = canonicalUuid(walletId, "walletId");
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/wallets/{walletId}/catalog/categories",
+        path: pagePath(`/v1/wallets/${id}/catalog/categories`, options?.cursor),
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      (json) => parsePage(json, parseCatalogueCategory)
+    );
+  }
+  /** Walks subcategory pages. */
+  async *listSubcategories(walletId, categoryId, options) {
+    yield* pages((cursor) => this.listSubcategoriesPage(walletId, categoryId, pageOptions(cursor, options)));
+  }
+  /** Reads one subcategory page. */
+  async listSubcategoriesPage(walletId, categoryId, options) {
+    const wallet = canonicalUuid(walletId, "walletId");
+    const category = canonicalUuid(categoryId, "categoryId");
+    const route = "/v1/wallets/{walletId}/catalog/categories/{categoryId}/subcategories";
+    return this.transport.json(
+      {
+        method: "GET",
+        route,
+        path: pagePath(`/v1/wallets/${wallet}/catalog/categories/${category}/subcategories`, options?.cursor),
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      (json) => parsePage(json, parseCatalogueSubcategory)
+    );
+  }
+  /** Reads one subcategory. */
+  async getSubcategory(walletId, subcategoryId, options) {
+    const wallet = canonicalUuid(walletId, "walletId");
+    const subcategory = canonicalUuid(subcategoryId, "subcategoryId");
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/wallets/{walletId}/catalog/subcategories/{subcategoryId}",
+        path: `/v1/wallets/${wallet}/catalog/subcategories/${subcategory}`,
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      parseCatalogueSubcategory
+    );
+  }
+  /** Walks card pages for the given wallet and subcategory. */
+  async *listCards(walletId, subcategoryId, options) {
+    yield* pages((cursor) => this.listCardsPage(walletId, subcategoryId, pageOptions(cursor, options)));
+  }
+  /** Reads one catalogue card page. */
+  async listCardsPage(walletId, subcategoryId, options) {
+    const wallet = canonicalUuid(walletId, "walletId");
+    const subcategory = canonicalUuid(subcategoryId, "subcategoryId");
+    const route = "/v1/wallets/{walletId}/catalog/subcategories/{subcategoryId}/cards";
+    return this.transport.json(
+      {
+        method: "GET",
+        route,
+        path: pagePath(`/v1/wallets/${wallet}/catalog/subcategories/${subcategory}/cards`, options?.cursor),
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      (json) => parsePage(json, parseCatalogueCard)
+    );
+  }
+};
+var OrderOperations = class {
+  /** Shares the verified transport so order recovery uses the same signer and idempotency rules. */
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Creates an order under an id the caller has persisted, preventing a dropped answer from causing duplicate purchases. */
+  create(walletId, operationId, order, options) {
+    return this.send(walletId, operationId, order, false, options);
+  }
+  /** Repeats the same request and operation id to recover an unknown result. */
+  resume(walletId, operationId, order, options) {
+    return this.send(walletId, operationId, order, true, options);
+  }
+  /** Reads order state without dispatching a new order or returning credentials. */
+  async get(operationId, options) {
+    const id = canonicalUuid(operationId, "operationId");
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/orders/{operationId}",
+        path: `/v1/orders/${id}`,
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      parseOrder
+    );
+  }
+  async send(walletId, operationId, order, resuming, options) {
+    guardOrder(order);
+    const wallet = canonicalUuid(walletId, "walletId");
+    const operation = canonicalUuid(operationId, "operationId");
+    const card = canonicalUuid(order.cardId, "cardId");
+    let bytes;
+    try {
+      bytes = new TextEncoder().encode(
+        JSON.stringify({
+          cardId: card,
+          quantity: order.quantity,
+          expectedUnitPrice: order.expectedUnitPrice.toJSON(),
+          expectedTotal: order.expectedTotal.toJSON(),
+          ...order.externalReference === void 0 ? {} : { externalReference: order.externalReference },
+          useAllowedDebt: order.useAllowedDebt ?? false
+        })
+      );
+    } catch (cause) {
+      throw new RequestSigningError(cause);
+    }
+    let result;
+    let report = true;
+    let rethrow = false;
+    let cancellation;
+    let outcomeReason;
+    try {
+      const { response, body } = await this.transport.send({
+        method: "POST",
+        route: "/v1/wallets/{walletId}/orders",
+        path: `/v1/wallets/${wallet}/orders`,
+        profile: "OrderMutation",
+        operationId: operation,
+        body: bytes,
+        signal: options?.signal
+      });
+      if (body.length === 0) {
+        outcomeReason = "empty_body";
+        result = {
+          kind: "unknown",
+          operationId: operation,
+          suggestedDelayMs: 5e3,
+          cause: emptyBodyError(response.status)
+        };
+      } else {
+        let decoded;
+        try {
+          decoded = parseBody(body);
+        } catch {
+          throw new MalformedResponseError("order response");
+        }
+        if (decoded === null) {
+          outcomeReason = "empty_body";
+          result = {
+            kind: "unknown",
+            operationId: operation,
+            suggestedDelayMs: 5e3,
+            cause: emptyBodyError(response.status)
+          };
+        } else if (response.status === 202) {
+          const orderValue = parseOrderSafely(decoded);
+          result = {
+            kind: "processing",
+            operationId: operation,
+            order: orderValue,
+            suggestedDelayMs: retryAfterSeconds(response.headers.get("retry-after")) === void 0 ? 5e3 : (retryAfterSeconds(response.headers.get("retry-after")) ?? 0) * 1e3,
+            ...response.headers.get("location") === null ? {} : { location: response.headers.get("location") ?? "" }
+          };
+        } else {
+          const orderValue = parseOrderSafely(decoded);
+          const credentials = orderValue.soldCards ?? [];
+          if (credentials.length > 0) {
+            result = {
+              kind: "completed",
+              operationId: operation,
+              order: orderValue,
+              credentials,
+              codesWithheld: orderValue.codesWithheld === true || credentials.length === 0
+            };
+          } else if (headerValues2(response.headers.get("idempotency-replayed")).some((value) => value.toLowerCase() === "true")) {
+            result = { kind: "replayed", operationId: operation, order: orderValue };
+          } else {
+            result = {
+              kind: "completed",
+              operationId: operation,
+              order: orderValue,
+              credentials,
+              codesWithheld: orderValue.codesWithheld === true || credentials.length === 0
+            };
+          }
+        }
+      }
+    } catch (error) {
+      if (error instanceof AnisApiError) {
+        if (error.orderOutcome === "notPlaced" && (error.isReplayed || !resuming)) {
+          result = { kind: "notPlaced", operationId: operation, refusal: error };
+          report = false;
+        } else {
+          outcomeReason = error.rawCode ?? "refused";
+          const delay = error.retryAfter === void 0 ? refusedAtTheDoor(error.code) ? 6e4 : 5e3 : error.retryAfter * 1e3;
+          result = { kind: "unknown", operationId: operation, suggestedDelayMs: delay, cause: error };
+        }
+      } else if (error instanceof RequestSigningError) {
+        throw error;
+      } else {
+        outcomeReason = options?.signal?.aborted ? "canceled" : errorType(error);
+        result = { kind: "unknown", operationId: operation, suggestedDelayMs: 5e3, cause: error };
+        rethrow = options?.signal?.aborted ?? false;
+        cancellation = error;
+      }
+    }
+    if (report) {
+      if (result.kind === "unknown") {
+        result = reportUnknown(
+          this.transport,
+          operation,
+          outcomeReason ?? errorType(result.cause),
+          result.cause,
+          result.suggestedDelayMs
+        );
+      } else {
+        result = reportOutcome(this.transport, operation, result);
+      }
+    }
+    if (rethrow) throw cancellation;
+    return result;
+  }
+};
+var OwnedCardOperations = class {
+  /** Shares the verified transport so card reads and reveals keep the client's response checks. */
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Walks owned-card pages. */
+  async *list(walletId, options) {
+    yield* pages((cursor) => this.listPage(walletId, pageOptions(cursor, options)));
+  }
+  /** Reads one owned-card page. */
+  async listPage(walletId, options) {
+    const wallet = canonicalUuid(walletId, "walletId");
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/wallets/{walletId}/cards",
+        path: pagePath(`/v1/wallets/${wallet}/cards`, options?.cursor),
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      (json) => parsePage(json, parseMaskedCard)
+    );
+  }
+  /** Reads a masked owned card. */
+  async get(walletId, soldCardId, options) {
+    const wallet = canonicalUuid(walletId, "walletId");
+    const card = canonicalUuid(soldCardId, "soldCardId");
+    return this.transport.json(
+      {
+        method: "GET",
+        route: "/v1/wallets/{walletId}/cards/{soldCardId}",
+        path: `/v1/wallets/${wallet}/cards/${card}`,
+        profile: "SafeRead",
+        signal: options?.signal
+      },
+      parseMaskedCard
+    );
+  }
+  /** Reveals one credential using a signed mutation with no body bytes. */
+  async reveal(walletId, soldCardId, options) {
+    const wallet = canonicalUuid(walletId, "walletId");
+    const card = canonicalUuid(soldCardId, "soldCardId");
+    return this.transport.json(
+      {
+        method: "POST",
+        route: "/v1/wallets/{walletId}/cards/{soldCardId}/reveal",
+        path: `/v1/wallets/${wallet}/cards/${card}/reveal`,
+        profile: "BodylessNonceMutation",
+        signal: options?.signal
+      },
+      parseRevealedCredential
+    );
+  }
+  /** Reveals every credential on an invoice atomically. */
+  async revealInvoice(walletId, invoiceId, options) {
+    const wallet = canonicalUuid(walletId, "walletId");
+    const invoice = canonicalUuid(invoiceId, "invoiceId");
+    const route = "/v1/wallets/{walletId}/invoices/{invoiceId}/cards/reveal";
+    return this.transport.json(
+      {
+        method: "POST",
+        route,
+        path: `/v1/wallets/${wallet}/invoices/${invoice}/cards/reveal`,
+        profile: "BodylessNonceMutation",
+        signal: options?.signal
+      },
+      parseRevealedCredentialCollection
+    );
+  }
+};
+var DiagnosticsOperations = class {
+  /** Shares the verified transport so the self-check uses the same request as the partner API. */
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Sends the exact empty JSON object expected by the self-check route. */
+  async checkSignature(options) {
+    return this.transport.json(
+      {
+        method: "POST",
+        route: "/v1/diagnostics/signature",
+        path: "/v1/diagnostics/signature",
+        profile: "BodylessNonceMutation",
+        body: EMPTY_OBJECT_BODY,
+        signal: options?.signal
+      },
+      parseSignatureDiagnostic
+    );
+  }
+};
+async function* pages(load) {
+  let cursor;
+  const seenCursors = /* @__PURE__ */ new Set();
+  do {
+    const page = await load(cursor);
+    for (const item of page.items) yield item;
+    cursor = page.nextCursor;
+    if (cursor !== void 0 && cursor.length > 0) {
+      if (seenCursors.has(cursor)) throw new MalformedResponseError("page continuation cursor");
+      seenCursors.add(cursor);
+    }
+  } while (cursor !== void 0 && cursor.length > 0);
+}
+function pagePath(path, cursor) {
+  return cursor === void 0 || cursor.length === 0 ? path : `${path}?cursor=${encodeURIComponent(cursor)}`;
+}
+function pageOptions(cursor, options) {
+  return {
+    ...cursor === void 0 ? {} : { cursor },
+    signal: options?.signal
+  };
+}
+function parseBody(body) {
+  return JSON.parse(new TextDecoder().decode(body));
+}
+function parseOrderSafely(value) {
+  try {
+    return parseOrder(value);
+  } catch {
+    throw new MalformedResponseError("order response");
+  }
+}
+function headerValues2(value) {
+  return value === null ? [] : value.split(",").map((part) => part.trim());
+}
+function guardOrder(order) {
+  if (!Number.isInteger(order.quantity) || order.quantity < 1)
+    throw new RangeError("An order must be for at least one card.");
+  canonicalUuid(order.cardId, "cardId");
+  if (!(order.expectedUnitPrice instanceof Money) || !(order.expectedTotal instanceof Money))
+    throw new TypeError("Order prices must be Money values.");
+  if (BigInt(order.expectedUnitPrice.amount.replace(".", "")) <= 0n)
+    throw new RangeError("ExpectedUnitPrice must be greater than zero.");
+  if (order.expectedUnitPrice.multiply(order.quantity).amount !== order.expectedTotal.amount)
+    throw new TypeError("ExpectedTotal must equal unit price multiplied by quantity.");
+  if (order.expectedUnitPrice.currency !== order.expectedTotal.currency)
+    throw new TypeError("Order prices must use the same currency.");
+}
+function reportOutcome(transport, operationId, result) {
+  safeCounter("anis.partners.order.outcomes", {
+    "anis.client": transport.clientName,
+    "anis.order.outcome": result.kind
+  });
+  transport.reportOrderOutcome(operationId, result.kind);
+  return result;
+}
+function reportUnknown(transport, operationId, reason, cause, suggestedDelayMs = 5e3) {
+  safeCounter("anis.partners.order.outcomes", {
+    "anis.client": transport.clientName,
+    "anis.order.outcome": "unknown",
+    "error.type": reason
+  });
+  transport.reportOrderOutcome(operationId, "unknown", reason);
+  return { kind: "unknown", operationId, suggestedDelayMs, cause };
+}
+function errorType(error) {
+  if (error instanceof MalformedResponseError) return "other";
+  if (error instanceof SigningKeyDocumentUnavailableError) return "connection";
+  if (error instanceof UnverifiableResponseError) return "unverifiable";
+  if (error instanceof DOMException && error.name === "TimeoutError") return "timeout";
+  if (error instanceof TypeError) return "connection";
+  if (error instanceof SyntaxError) return "invalid_json";
+  return error instanceof Error ? error.name : "other";
+}
+function emptyBodyError(status) {
+  return new AnisApiError({ status, code: "internal_error", title: "Empty body" }, status);
+}
+
+// src/client.ts
+var AnisPartnersClient = class _AnisPartnersClient {
+  /** Reads identity and live scopes. */
+  profile;
+  /** Lists wallets available to this application. */
+  wallets;
+  /** Reads wallet-priced catalogue entries. */
+  catalogue;
+  /** Creates and resumes caller-keyed orders. */
+  orders;
+  /** Reads owned cards and reveals credentials. */
+  ownedCards;
+  /** Runs the side-effect-free signature check. */
+  diagnostics;
+  constructor(transport) {
+    this.profile = new ProfileOperations(transport);
+    this.wallets = new WalletOperations(transport);
+    this.catalogue = new CatalogueOperations(transport);
+    this.orders = new OrderOperations(transport);
+    this.ownedCards = new OwnedCardOperations(transport);
+    this.diagnostics = new DiagnosticsOperations(transport);
+  }
+  /** Builds the grouped API client and its unsigned public key-document source. */
+  static create(input) {
+    const options = validateClientOptions(input.options);
+    const signer = input.signer;
+    if (typeof signer !== "object" || signer === null || !("sign" in signer) || typeof signer.sign !== "function")
+      throw new TypeError("A request signer with a sign method is required.");
+    if (!("keyId" in signer) || typeof signer.keyId !== "string")
+      throw new TypeError("The request signer needs a key id.");
+    canonicalUuid(signer.keyId, "signer.keyId");
+    const fetcher = input.fetch ?? globalThis.fetch;
+    const logger = input.logger;
+    const keyLogger = logger === void 0 ? void 0 : {
+      debug(message, fields) {
+        safeLog(logger, "debug", message, fields);
+      },
+      info(message, fields) {
+        safeLog(logger, "info", message, { ...fields, eventId: 1005 });
+      },
+      warn(message, fields) {
+        safeLog(logger, "warn", message, fields);
+      }
+    };
+    const keySource = new HttpSigningKeySource({
+      authority: options.authority,
+      cacheSeconds: options.signingKeyCacheSeconds,
+      fetch: fetcher,
+      ...input.keyCache === void 0 ? {} : { documentCache: input.keyCache },
+      ...keyLogger === void 0 ? {} : { logger: keyLogger }
+    });
+    const transport = new PartnerTransport({
+      ...options,
+      signer: input.signer,
+      fetcher,
+      keySource,
+      ...logger === void 0 ? {} : { logger }
+    });
+    return new _AnisPartnersClient(transport);
+  }
+};
+export {
+  AnisApiError,
+  AnisEnrollmentClient,
+  AnisPartnersClient,
+  AnisPartnersError,
+  AnisPartnersTelemetry,
+  AuthorizationError,
+  CatalogueOperations,
+  DOMAIN_SEPARATOR,
+  DependencyUnavailableError,
+  DiagnosticsOperations,
+  ERROR_CODES,
+  EnrollmentKeyMismatchError,
+  EnrollmentRefusedError,
+  IdempotencyConflictError,
+  InsufficientBalanceError,
+  InvalidCredentialsError,
+  KeyedSigner,
+  LimitExceededError,
+  MalformedResponseError,
+  Money,
+  OrderOperations,
+  OutOfStockError,
+  OwnedCardOperations,
+  PemP256Signer,
+  PriceChangedError,
+  PrivateKeyError,
+  ProfileOperations,
+  RateLimitedError,
+  ReplayDetectedError,
+  RequestSigningError,
+  ResourceNotFoundError,
+  SigningKeyDocumentUnavailableError,
+  UnverifiableResponseError,
+  ValidationFailedError,
+  WalletOperations,
+  keyThumbprint,
+  proofMessage,
+  proofSignature,
+  safetyCodeFromThumbprint,
+  validateClientOptions
+};
+//# sourceMappingURL=index.js.map