@atumlabs/payment-gateway-client 1.0.2 → 2.0.0

package/dist/index.js

@@ -33,8 +33,378 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// ../contracts/evm/escrow-encoding/typescript/dist/payment-id.js
+// ../contracts/tvm/escrow-encoding/typescript/dist/chain-id.js
+var require_chain_id = __commonJS({
+  "../contracts/tvm/escrow-encoding/typescript/dist/chain-id.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.maskChainId = maskChainId2;
+    function maskChainId2(chainId) {
+      return (chainId & 4294967295) >>> 0;
+    }
+  }
+});
+
+// ../contracts/tvm/escrow-encoding/typescript/dist/tron-address.js
+var require_tron_address = __commonJS({
+  "../contracts/tvm/escrow-encoding/typescript/dist/tron-address.js"(exports2) {
+    "use strict";
+    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.base58ToHex = base58ToHex2;
+    exports2.normalizeAddress = normalizeAddress2;
+    var ethers_1 = require("ethers");
+    var bs58_1 = __importDefault(require("bs58"));
+    var TVM_MAINNET_PREFIX = "41";
+    function base58ToHex2(base58Address) {
+      if (!base58Address || !base58Address.startsWith("T")) {
+        throw new Error(`Invalid Tron base58 address: ${base58Address}`);
+      }
+      const decoded = bs58_1.default.decode(base58Address);
+      if (decoded.length !== 25) {
+        throw new Error(`Invalid Tron base58 length (expected 25 bytes): ${base58Address}`);
+      }
+      const payload = decoded.slice(0, 21);
+      const checksum = (0, ethers_1.hexlify)(decoded.slice(21)).slice(2);
+      const computed = (0, ethers_1.sha256)((0, ethers_1.sha256)(payload)).slice(2, 10);
+      if (checksum !== computed) {
+        throw new Error(`Invalid Tron base58 checksum: ${base58Address}`);
+      }
+      return (0, ethers_1.hexlify)(payload).slice(2);
+    }
+    function normalizeAddress2(address) {
+      if (!address) {
+        throw new Error("Empty address");
+      }
+      let hexAddress = address;
+      if (address.startsWith("T")) {
+        hexAddress = base58ToHex2(address);
+      }
+      hexAddress = hexAddress.replace(/^0x/, "");
+      if (hexAddress.startsWith(TVM_MAINNET_PREFIX)) {
+        hexAddress = hexAddress.substring(2);
+      }
+      if (hexAddress.length !== 40) {
+        throw new Error(`Invalid address length: expected 40 chars, got ${hexAddress.length}`);
+      }
+      if (!/^[0-9a-fA-F]{40}$/.test(hexAddress)) {
+        throw new Error("Invalid hex address format");
+      }
+      return "0x" + hexAddress.toLowerCase();
+    }
+  }
+});
+
+// ../contracts/tvm/escrow-encoding/typescript/dist/reserve-encoder.js
+var require_reserve_encoder = __commonJS({
+  "../contracts/tvm/escrow-encoding/typescript/dist/reserve-encoder.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.computeReserveDigest = computeReserveDigest;
+    var ethers_1 = require("ethers");
+    var chain_id_1 = require_chain_id();
+    var RESERVE_WITNESS_TYPES = {
+      ReserveWitness: [
+        { name: "paymentId", type: "bytes32" },
+        { name: "settler", type: "address" }
+      ]
+    };
+    function computeReserveDigest(input) {
+      const domain = {
+        name: "Escrow",
+        version: "3",
+        chainId: (0, chain_id_1.maskChainId)(input.chainId),
+        verifyingContract: input.escrowContract
+      };
+      return ethers_1.TypedDataEncoder.hash(domain, RESERVE_WITNESS_TYPES, {
+        paymentId: input.paymentId,
+        settler: input.settler
+      });
+    }
+  }
+});
+
+// ../contracts/tvm/escrow-encoding/typescript/dist/payment-id.js
 var require_payment_id = __commonJS({
+  "../contracts/tvm/escrow-encoding/typescript/dist/payment-id.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.computePaymentId = computePaymentId;
+    var ethers_1 = require("ethers");
+    var tron_address_1 = require_tron_address();
+    function computePaymentId(depositor, signature, nonce) {
+      if (!/^[0-9]+$/.test(nonce)) {
+        throw new Error(`invalid nonce (expected base-10 decimal): ${nonce}`);
+      }
+      const encoded = ethers_1.AbiCoder.defaultAbiCoder().encode(["address", "bytes", "uint256"], [(0, tron_address_1.normalizeAddress)(depositor), signature, nonce]);
+      return (0, ethers_1.keccak256)(encoded);
+    }
+  }
+});
+
+// ../contracts/tvm/escrow-encoding/typescript/dist/deposit-encoder.js
+var require_deposit_encoder = __commonJS({
+  "../contracts/tvm/escrow-encoding/typescript/dist/deposit-encoder.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createTvmPermitWitnessTransferFromPrehash = createTvmPermitWitnessTransferFromPrehash2;
+    exports2.hashTvmPermitWitnessTransferFrom = hashTvmPermitWitnessTransferFrom2;
+    var ethers_1 = require("ethers");
+    var chain_id_1 = require_chain_id();
+    var tron_address_1 = require_tron_address();
+    var PERMIT_WITNESS_TYPES_V2 = {
+      PermitWitnessTransferFrom: [
+        { name: "permitted", type: "TokenPermissions" },
+        { name: "spender", type: "address" },
+        { name: "nonce", type: "uint256" },
+        { name: "deadline", type: "uint256" },
+        { name: "witness", type: "DepositWitness" }
+      ],
+      TokenPermissions: [
+        { name: "token", type: "address" },
+        { name: "amount", type: "uint256" }
+      ],
+      DepositWitness: [
+        { name: "reserver", type: "address" },
+        { name: "releaser", type: "address" }
+      ]
+    };
+    function createTvmPermitWitnessTransferFromPrehash2(params) {
+      const maskedChainId = (0, chain_id_1.maskChainId)(params.chainId);
+      return {
+        types: PERMIT_WITNESS_TYPES_V2,
+        primaryType: "PermitWitnessTransferFrom",
+        domain: {
+          name: "Permit2",
+          chainId: `0x${maskedChainId.toString(16)}`,
+          verifyingContract: (0, tron_address_1.normalizeAddress)(params.permit2Address)
+        },
+        message: {
+          permitted: {
+            token: (0, tron_address_1.normalizeAddress)(params.tokenAddress),
+            amount: params.amount
+          },
+          spender: (0, tron_address_1.normalizeAddress)(params.spenderAddress),
+          nonce: params.nonce.toString(),
+          deadline: params.deadline.toString(),
+          witness: {
+            reserver: (0, tron_address_1.normalizeAddress)(params.reserverAddress),
+            releaser: (0, tron_address_1.normalizeAddress)(params.releaserAddress)
+          }
+        }
+      };
+    }
+    function hashTvmPermitWitnessTransferFrom2(prehash) {
+      return ethers_1.TypedDataEncoder.hash(prehash.domain, prehash.types, prehash.message);
+    }
+  }
+});
+
+// ../contracts/tvm/escrow-encoding/typescript/dist/index.js
+var require_dist = __commonJS({
+  "../contracts/tvm/escrow-encoding/typescript/dist/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.hashTvmPermitWitnessTransferFrom = exports2.createTvmPermitWitnessTransferFromPrehash = exports2.computePaymentId = exports2.computeReserveDigest = exports2.normalizeAddress = exports2.base58ToHex = exports2.maskChainId = void 0;
+    var chain_id_1 = require_chain_id();
+    Object.defineProperty(exports2, "maskChainId", { enumerable: true, get: function() {
+      return chain_id_1.maskChainId;
+    } });
+    var tron_address_1 = require_tron_address();
+    Object.defineProperty(exports2, "base58ToHex", { enumerable: true, get: function() {
+      return tron_address_1.base58ToHex;
+    } });
+    Object.defineProperty(exports2, "normalizeAddress", { enumerable: true, get: function() {
+      return tron_address_1.normalizeAddress;
+    } });
+    var reserve_encoder_1 = require_reserve_encoder();
+    Object.defineProperty(exports2, "computeReserveDigest", { enumerable: true, get: function() {
+      return reserve_encoder_1.computeReserveDigest;
+    } });
+    var payment_id_1 = require_payment_id();
+    Object.defineProperty(exports2, "computePaymentId", { enumerable: true, get: function() {
+      return payment_id_1.computePaymentId;
+    } });
+    var deposit_encoder_1 = require_deposit_encoder();
+    Object.defineProperty(exports2, "createTvmPermitWitnessTransferFromPrehash", { enumerable: true, get: function() {
+      return deposit_encoder_1.createTvmPermitWitnessTransferFromPrehash;
+    } });
+    Object.defineProperty(exports2, "hashTvmPermitWitnessTransferFrom", { enumerable: true, get: function() {
+      return deposit_encoder_1.hashTvmPermitWitnessTransferFrom;
+    } });
+  }
+});
+
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/types.js
+var require_types = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/types.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+  }
+});
+
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/utils.js
+var require_utils = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/utils.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.SOLANA_REPLAY_SLOTS = exports2.PERMIT_NONCE_DOMAIN = exports2.REPLAY_HORIZON_SECS = void 0;
+    exports2.resolvePermitDeadline = resolvePermitDeadline;
+    exports2.generatePermitNonce = generatePermitNonce;
+    exports2.resolvePermitNonce = resolvePermitNonce;
+    exports2.deterministicPermitNonce = deterministicPermitNonce2;
+    exports2.deterministicSolanaNonce = deterministicSolanaNonce2;
+    exports2.sameAddress = sameAddress;
+    exports2.assertKeyMatchesSender = assertKeyMatchesSender2;
+    exports2.assertToken = assertToken;
+    exports2.assertAmountMatches = assertAmountMatches;
+    exports2.assertFresh = assertFresh;
+    exports2.assertSpender = assertSpender;
+    exports2.assertWitnessRoles = assertWitnessRoles;
+    exports2.assertRolePairComplete = assertRolePairComplete;
+    exports2.nowSec = nowSec;
+    var ethers_1 = require("ethers");
+    exports2.REPLAY_HORIZON_SECS = 128;
+    function resolvePermitDeadline(deadline) {
+      return BigInt(deadline);
+    }
+    function generatePermitNonce() {
+      const rand = new Uint32Array(1);
+      globalThis.crypto.getRandomValues(rand);
+      return (BigInt(Date.now()) << 32n) + BigInt(rand[0]);
+    }
+    function resolvePermitNonce(nonce) {
+      return BigInt(nonce);
+    }
+    exports2.PERMIT_NONCE_DOMAIN = "atum-permit:v1:";
+    exports2.SOLANA_REPLAY_SLOTS = 235n;
+    var SOLANA_BUCKET_BITS = 17n;
+    function canonicalDepositor(depositor) {
+      const lower = depositor.toLowerCase();
+      return lower.startsWith("0x") ? lower : depositor;
+    }
+    function permitNonceSeed(requestId, depositor) {
+      if (!requestId) {
+        throw new Error("sender_auth: request_id is required to derive a deterministic permit nonce");
+      }
+      return BigInt((0, ethers_1.keccak256)((0, ethers_1.toUtf8Bytes)(`${exports2.PERMIT_NONCE_DOMAIN}${requestId}:${canonicalDepositor(depositor)}`)));
+    }
+    function deterministicPermitNonce2(params) {
+      return permitNonceSeed(params.requestId, params.depositor);
+    }
+    function deterministicSolanaNonce2(params) {
+      const seed = permitNonceSeed(params.requestId, params.depositor);
+      const slot = seed % exports2.SOLANA_REPLAY_SLOTS;
+      const bucket = (seed >> 8n) % (1n << SOLANA_BUCKET_BITS);
+      return bucket << 32n | slot;
+    }
+    function sameAddress(a, b) {
+      if (a.startsWith("0x") && b.startsWith("0x")) {
+        return a.toLowerCase() === b.toLowerCase();
+      }
+      return a === b;
+    }
+    function assertKeyMatchesSender2(matches, sender, derived) {
+      if (!matches) {
+        throw new Error(`sender_auth: private key derives ${derived}, not the expected sender ${sender}`);
+      }
+    }
+    function assertToken(token, sourceAsset, normalize) {
+      if (!sameAddress(token, normalize(sourceAsset))) {
+        throw new Error("sender_auth: permit token does not match the source asset");
+      }
+    }
+    function assertAmountMatches(amount, maxSourceAmount) {
+      if (BigInt(amount) !== BigInt(maxSourceAmount)) {
+        throw new Error("sender_auth: permit amount does not match max_source_amount");
+      }
+    }
+    function assertFresh(deadlineSec, nowSec2) {
+      if (deadlineSec <= nowSec2) {
+        throw new Error("sender_auth: permit deadline is not in the future");
+      }
+    }
+    function assertSpender(spender, escrow, normalize) {
+      if (!sameAddress(spender, normalize(escrow))) {
+        throw new Error("sender_auth: permit spender is not the source escrow");
+      }
+    }
+    function assertWitnessRoles(reserver, releaser, expectedReserver, expectedReleaser, normalize) {
+      if (!sameAddress(reserver, normalize(expectedReserver)) || !sameAddress(releaser, normalize(expectedReleaser))) {
+        throw new Error("sender_auth: deposit witness roles do not match the challenge");
+      }
+    }
+    function assertRolePairComplete(reserver, releaser) {
+      if (reserver === void 0 !== (releaser === void 0)) {
+        throw new Error("sender_auth: reserver and releaser must be supplied together");
+      }
+    }
+    function nowSec() {
+      return Math.floor(Date.now() / 1e3);
+    }
+  }
+});
+
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/chain-id.js
+var require_chain_id2 = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/chain-id.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.TRON_PERMIT2_FALLBACKS = exports2.TRON_CHAIN_IDS = void 0;
+    exports2.namespaceOf = namespaceOf;
+    exports2.evmChainId = evmChainId;
+    exports2.tronNumericChainId = tronNumericChainId;
+    exports2.resolveTronPermit2 = resolveTronPermit2;
+    exports2.clusterIdFromName = clusterIdFromName;
+    function namespaceOf(network) {
+      return network.split(":")[0];
+    }
+    function evmChainId(network) {
+      const match = /^eip155:([0-9]+)$/.exec(network);
+      if (!match) {
+        throw new Error(`sender_auth: expected an eip155 network, got ${network}`);
+      }
+      return Number(match[1]);
+    }
+    exports2.TRON_CHAIN_IDS = {
+      mainnet: 728126428,
+      shasta: 2494104990
+    };
+    function tronNumericChainId(network) {
+      const cluster = network.split(":")[1];
+      const id = exports2.TRON_CHAIN_IDS[cluster ?? ""];
+      if (id === void 0) {
+        throw new Error(`sender_auth: unsupported Tron network '${network}'`);
+      }
+      return id;
+    }
+    exports2.TRON_PERMIT2_FALLBACKS = {
+      "tron:mainnet": "TJhMXTHQHeQyMD7TcKQFqAePNgG4b31H9m",
+      "tron:shasta": "TPUqJPASUn1zLvbLBgRZ5pBYrx7WSe5ahp"
+    };
+    function resolveTronPermit2(network) {
+      const resolved = exports2.TRON_PERMIT2_FALLBACKS[network];
+      if (!resolved) {
+        throw new Error(`sender_auth: no Permit2 address known for Tron network '${network}'`);
+      }
+      return resolved;
+    }
+    function clusterIdFromName(name) {
+      const encoded = new TextEncoder().encode(name);
+      if (encoded.length > 32) {
+        throw new Error(`sender_auth: Solana cluster name too long (${encoded.length} > 32 bytes): ${name}`);
+      }
+      const out = new Uint8Array(32);
+      out.set(encoded);
+      return out;
+    }
+  }
+});
+
+// ../contracts/evm/escrow-encoding/typescript/dist/payment-id.js
+var require_payment_id2 = __commonJS({
   "../contracts/evm/escrow-encoding/typescript/dist/payment-id.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -350,7 +720,7 @@ var require_escrow_abi = __commonJS({
 });
 
 // ../contracts/evm/escrow-encoding/typescript/dist/reserve-encoder.js
-var require_reserve_encoder = __commonJS({
+var require_reserve_encoder2 = __commonJS({
   "../contracts/evm/escrow-encoding/typescript/dist/reserve-encoder.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -368,7 +738,7 @@ var require_reserve_encoder = __commonJS({
 });
 
 // ../contracts/evm/escrow-encoding/typescript/dist/deposit-encoder.js
-var require_deposit_encoder = __commonJS({
+var require_deposit_encoder2 = __commonJS({
   "../contracts/evm/escrow-encoding/typescript/dist/deposit-encoder.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -409,12 +779,12 @@ var require_deposit_encoder = __commonJS({
 });
 
 // ../contracts/evm/escrow-encoding/typescript/dist/index.js
-var require_dist = __commonJS({
+var require_dist2 = __commonJS({
   "../contracts/evm/escrow-encoding/typescript/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.PERMIT2_CONTRACT_ADDRESS = exports2.hashPermitWitnessTransferFrom = exports2.createPermitWitnessTransferFromPrehash = exports2.computeReserveDigest = exports2.ESCROW_V3_ABI_JSON = exports2.ESCROW_V2_ABI_JSON = exports2.ESCROW_ABI_JSON = exports2.ESCROW_ABI = exports2.REFUND_WITNESS_TYPES = exports2.RELEASE_WITNESS_TYPES = exports2.RESERVE_WITNESS_TYPES = exports2.createEscrowDomain = exports2.createPermit2Domain = exports2.PERMIT_WITNESS_TYPES_V2 = exports2.PERMIT_WITNESS_TYPES = exports2.generateNonce = exports2.computePaymentIdV2 = exports2.computePaymentId = void 0;
-    var payment_id_1 = require_payment_id();
+    var payment_id_1 = require_payment_id2();
     Object.defineProperty(exports2, "computePaymentId", { enumerable: true, get: function() {
       return payment_id_1.computePaymentId;
     } });
@@ -460,11 +830,11 @@ var require_dist = __commonJS({
     Object.defineProperty(exports2, "ESCROW_V3_ABI_JSON", { enumerable: true, get: function() {
       return escrow_abi_1.ESCROW_V3_ABI_JSON;
     } });
-    var reserve_encoder_1 = require_reserve_encoder();
+    var reserve_encoder_1 = require_reserve_encoder2();
     Object.defineProperty(exports2, "computeReserveDigest", { enumerable: true, get: function() {
       return reserve_encoder_1.computeReserveDigest;
     } });
-    var deposit_encoder_1 = require_deposit_encoder();
+    var deposit_encoder_1 = require_deposit_encoder2();
     Object.defineProperty(exports2, "createPermitWitnessTransferFromPrehash", { enumerable: true, get: function() {
       return deposit_encoder_1.createPermitWitnessTransferFromPrehash;
     } });
@@ -477,212 +847,263 @@ var require_dist = __commonJS({
   }
 });
 
-// ../contracts/tvm/escrow-encoding/typescript/dist/chain-id.js
-var require_chain_id = __commonJS({
-  "../contracts/tvm/escrow-encoding/typescript/dist/chain-id.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.maskChainId = maskChainId2;
-    function maskChainId2(chainId) {
-      return (chainId & 4294967295) >>> 0;
-    }
-  }
-});
-
-// ../contracts/tvm/escrow-encoding/typescript/dist/tron-address.js
-var require_tron_address = __commonJS({
-  "../contracts/tvm/escrow-encoding/typescript/dist/tron-address.js"(exports2) {
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/errors.js
+var require_errors = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/errors.js"(exports2) {
     "use strict";
-    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.base58ToHex = base58ToHex2;
-    exports2.normalizeAddress = normalizeAddress2;
-    var ethers_1 = require("ethers");
-    var bs58_1 = __importDefault(require("bs58"));
-    var TVM_MAINNET_PREFIX = "41";
-    function base58ToHex2(base58Address) {
-      if (!base58Address || !base58Address.startsWith("T")) {
-        throw new Error(`Invalid Tron base58 address: ${base58Address}`);
-      }
-      const decoded = bs58_1.default.decode(base58Address);
-      if (decoded.length !== 25) {
-        throw new Error(`Invalid Tron base58 length (expected 25 bytes): ${base58Address}`);
-      }
-      const payload = decoded.slice(0, 21);
-      const checksum = (0, ethers_1.hexlify)(decoded.slice(21)).slice(2);
-      const computed = (0, ethers_1.sha256)((0, ethers_1.sha256)(payload)).slice(2, 10);
-      if (checksum !== computed) {
-        throw new Error(`Invalid Tron base58 checksum: ${base58Address}`);
-      }
-      return (0, ethers_1.hexlify)(payload).slice(2);
-    }
-    function normalizeAddress2(address) {
-      if (!address) {
-        throw new Error("Empty address");
-      }
-      let hexAddress = address;
-      if (address.startsWith("T")) {
-        hexAddress = base58ToHex2(address);
-      }
-      hexAddress = hexAddress.replace(/^0x/, "");
-      if (hexAddress.startsWith(TVM_MAINNET_PREFIX)) {
-        hexAddress = hexAddress.substring(2);
+    exports2.SignerMismatchError = exports2.RecoveryFailedError = exports2.MalformedPrehashError = void 0;
+    var MalformedPrehashError = class extends Error {
+      constructor(message = "sender_auth: malformed message_prehash") {
+        super(message);
+        this.name = "MalformedPrehashError";
       }
-      if (hexAddress.length !== 40) {
-        throw new Error(`Invalid address length: expected 40 chars, got ${hexAddress.length}`);
+    };
+    exports2.MalformedPrehashError = MalformedPrehashError;
+    var RecoveryFailedError = class extends Error {
+      constructor(message = "sender_auth: could not recover a signer from the signed message") {
+        super(message);
+        this.name = "RecoveryFailedError";
       }
-      if (!/^[0-9a-fA-F]{40}$/.test(hexAddress)) {
-        throw new Error("Invalid hex address format");
+    };
+    exports2.RecoveryFailedError = RecoveryFailedError;
+    var SignerMismatchError = class extends Error {
+      constructor(message = "sender_auth: recovered signer does not match source.account") {
+        super(message);
+        this.name = "SignerMismatchError";
       }
-      return "0x" + hexAddress.toLowerCase();
-    }
-  }
-});
-
-// ../contracts/tvm/escrow-encoding/typescript/dist/reserve-encoder.js
-var require_reserve_encoder2 = __commonJS({
-  "../contracts/tvm/escrow-encoding/typescript/dist/reserve-encoder.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.computeReserveDigest = computeReserveDigest;
-    var ethers_1 = require("ethers");
-    var chain_id_1 = require_chain_id();
-    var RESERVE_WITNESS_TYPES = {
-      ReserveWitness: [
-        { name: "paymentId", type: "bytes32" },
-        { name: "settler", type: "address" }
-      ]
     };
-    function computeReserveDigest(input) {
-      const domain = {
-        name: "Escrow",
-        version: "3",
-        chainId: (0, chain_id_1.maskChainId)(input.chainId),
-        verifyingContract: input.escrowContract
-      };
-      return ethers_1.TypedDataEncoder.hash(domain, RESERVE_WITNESS_TYPES, {
-        paymentId: input.paymentId,
-        settler: input.settler
-      });
-    }
+    exports2.SignerMismatchError = SignerMismatchError;
   }
 });
 
-// ../contracts/tvm/escrow-encoding/typescript/dist/payment-id.js
-var require_payment_id2 = __commonJS({
-  "../contracts/tvm/escrow-encoding/typescript/dist/payment-id.js"(exports2) {
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/adapters/evm.js
+var require_evm = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/adapters/evm.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.computePaymentId = computePaymentId;
+    exports2.evmAdapter = void 0;
     var ethers_1 = require("ethers");
-    var tron_address_1 = require_tron_address();
-    function computePaymentId(depositor, signature, nonce) {
-      if (!/^[0-9]+$/.test(nonce)) {
-        throw new Error(`invalid nonce (expected base-10 decimal): ${nonce}`);
+    var evm_escrow_encoding_1 = require_dist2();
+    var utils_js_1 = require_utils();
+    var errors_js_1 = require_errors();
+    var chain_id_js_1 = require_chain_id2();
+    exports2.evmAdapter = {
+      async buildAuthMessage({ sourceAsset, maxSourceAmount, sourceDefaults, deadline, nonce }) {
+        if (nonce === void 0) {
+          throw new Error("sender_auth: buildAuthMessage requires an explicit nonce \u2014 derive it deterministically from a stable request id (e.g. the challenge id) so retries reproduce the same permit; pass generatePermitNonce() only for genuinely one-shot builds");
+        }
+        if (deadline === void 0) {
+          throw new Error("sender_auth: buildAuthMessage requires an explicit permit deadline (absolute Unix seconds) \u2014 the low-level builder does not default it; derive it from the payment's fulfillment/settlement deadline in the calling layer (pgc/mppx)");
+        }
+        const sourceChainId = sourceAsset.split("/")[0];
+        const chainIdNum = parseInt(sourceChainId.split(":")[1]);
+        const tokenAddress = sourceAsset.split("/")[1].split(":")[1];
+        const permitParams = {
+          chainId: chainIdNum,
+          verifyingContract: evm_escrow_encoding_1.PERMIT2_CONTRACT_ADDRESS,
+          token: tokenAddress,
+          amount: maxSourceAmount,
+          spender: sourceDefaults.escrowContract,
+          nonce: (0, utils_js_1.resolvePermitNonce)(nonce),
+          deadline: (0, utils_js_1.resolvePermitDeadline)(deadline),
+          reserver: sourceDefaults.quoteSelector,
+          releaser: sourceDefaults.fulfillmentVerifierAccount
+        };
+        const messagePrehash = (0, evm_escrow_encoding_1.createPermitWitnessTransferFromPrehash)(permitParams);
+        const messageHash = (0, evm_escrow_encoding_1.hashPermitWitnessTransferFrom)(messagePrehash);
+        return { messageScheme: "EVM_PERMIT2", messageHash, messagePrehash: JSON.stringify(messagePrehash) };
+      },
+      async sign(signedMessage, privateKey) {
+        if (!signedMessage.message_prehash) {
+          throw new Error("EVM adapter sign(): signed_messages[i].message_prehash is required");
+        }
+        const prehash = JSON.parse(signedMessage.message_prehash);
+        const wallet = new ethers_1.Wallet(privateKey);
+        return wallet.signTypedData(prehash.domain, prehash.types, prehash.message);
+      },
+      recoverSigner(signed, source) {
+        let recovered;
+        try {
+          recovered = (0, ethers_1.recoverAddress)(signed.message, signed.signature);
+        } catch (e) {
+          throw new errors_js_1.RecoveryFailedError(`sender_auth: could not recover a signer: ${e.message}`);
+        }
+        if (!(0, utils_js_1.sameAddress)(recovered, source.account)) {
+          throw new errors_js_1.SignerMismatchError(`sender_auth: recovered ${recovered}, not source.account`);
+        }
+        return source.account;
+      },
+      recoverAndVerify(signed, source, expected) {
+        let canonical;
+        let msg;
+        try {
+          msg = JSON.parse(signed.message_prehash).message;
+          canonical = (0, evm_escrow_encoding_1.createPermitWitnessTransferFromPrehash)({
+            chainId: (0, chain_id_js_1.evmChainId)(source.network),
+            verifyingContract: evm_escrow_encoding_1.PERMIT2_CONTRACT_ADDRESS,
+            token: msg.permitted.token,
+            amount: msg.permitted.amount,
+            spender: msg.spender,
+            nonce: BigInt(msg.nonce),
+            deadline: BigInt(msg.deadline),
+            reserver: msg.witness.reserver,
+            releaser: msg.witness.releaser
+          });
+        } catch {
+          throw new errors_js_1.MalformedPrehashError();
+        }
+        let recovered;
+        try {
+          recovered = (0, ethers_1.verifyTypedData)(canonical.domain, canonical.types, canonical.message, signed.signature);
+        } catch {
+          throw new Error("sender_auth: deposit signature does not recover to source.account");
+        }
+        if (!(0, utils_js_1.sameAddress)(recovered, source.account)) {
+          throw new Error("sender_auth: deposit signature does not recover to source.account");
+        }
+        const deadlineSec = Number(msg.deadline);
+        (0, utils_js_1.assertToken)(msg.permitted.token, source.asset, (a) => a);
+        (0, utils_js_1.assertAmountMatches)(msg.permitted.amount, expected.maxSourceAmount);
+        (0, utils_js_1.assertFresh)(deadlineSec, expected.nowSec ?? (0, utils_js_1.nowSec)());
+        if (expected.escrowContract !== void 0) {
+          (0, utils_js_1.assertSpender)(msg.spender, expected.escrowContract, (a) => a);
+        }
+        (0, utils_js_1.assertRolePairComplete)(expected.reserver, expected.releaser);
+        if (expected.reserver !== void 0 && expected.releaser !== void 0) {
+          (0, utils_js_1.assertWitnessRoles)(msg.witness.reserver, msg.witness.releaser, expected.reserver, expected.releaser, (a) => a);
+        }
+        return {
+          amount: msg.permitted.amount,
+          deadlineSec,
+          permit: {
+            scheme: "EVM_PERMIT2",
+            token: msg.permitted.token,
+            amount: msg.permitted.amount,
+            deadlineSec,
+            reserver: msg.witness.reserver,
+            releaser: msg.witness.releaser,
+            spender: msg.spender
+          }
+        };
       }
-      const encoded = ethers_1.AbiCoder.defaultAbiCoder().encode(["address", "bytes", "uint256"], [(0, tron_address_1.normalizeAddress)(depositor), signature, nonce]);
-      return (0, ethers_1.keccak256)(encoded);
-    }
-  }
-});
-
-// ../contracts/tvm/escrow-encoding/typescript/dist/deposit-encoder.js
-var require_deposit_encoder2 = __commonJS({
-  "../contracts/tvm/escrow-encoding/typescript/dist/deposit-encoder.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.createTvmPermitWitnessTransferFromPrehash = createTvmPermitWitnessTransferFromPrehash2;
-    exports2.hashTvmPermitWitnessTransferFrom = hashTvmPermitWitnessTransferFrom2;
-    var ethers_1 = require("ethers");
-    var chain_id_1 = require_chain_id();
-    var tron_address_1 = require_tron_address();
-    var PERMIT_WITNESS_TYPES_V2 = {
-      PermitWitnessTransferFrom: [
-        { name: "permitted", type: "TokenPermissions" },
-        { name: "spender", type: "address" },
-        { name: "nonce", type: "uint256" },
-        { name: "deadline", type: "uint256" },
-        { name: "witness", type: "DepositWitness" }
-      ],
-      TokenPermissions: [
-        { name: "token", type: "address" },
-        { name: "amount", type: "uint256" }
-      ],
-      DepositWitness: [
-        { name: "reserver", type: "address" },
-        { name: "releaser", type: "address" }
-      ]
     };
-    function createTvmPermitWitnessTransferFromPrehash2(params) {
-      const maskedChainId = (0, chain_id_1.maskChainId)(params.chainId);
-      return {
-        types: PERMIT_WITNESS_TYPES_V2,
-        primaryType: "PermitWitnessTransferFrom",
-        domain: {
-          name: "Permit2",
-          chainId: `0x${maskedChainId.toString(16)}`,
-          verifyingContract: (0, tron_address_1.normalizeAddress)(params.permit2Address)
-        },
-        message: {
-          permitted: {
-            token: (0, tron_address_1.normalizeAddress)(params.tokenAddress),
-            amount: params.amount
-          },
-          spender: (0, tron_address_1.normalizeAddress)(params.spenderAddress),
-          nonce: params.nonce.toString(),
-          deadline: params.deadline.toString(),
-          witness: {
-            reserver: (0, tron_address_1.normalizeAddress)(params.reserverAddress),
-            releaser: (0, tron_address_1.normalizeAddress)(params.releaserAddress)
-          }
-        }
-      };
-    }
-    function hashTvmPermitWitnessTransferFrom2(prehash) {
-      return ethers_1.TypedDataEncoder.hash(prehash.domain, prehash.types, prehash.message);
-    }
   }
-});
-
-// ../contracts/tvm/escrow-encoding/typescript/dist/index.js
-var require_dist2 = __commonJS({
-  "../contracts/tvm/escrow-encoding/typescript/dist/index.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.hashTvmPermitWitnessTransferFrom = exports2.createTvmPermitWitnessTransferFromPrehash = exports2.computePaymentId = exports2.computeReserveDigest = exports2.normalizeAddress = exports2.base58ToHex = exports2.maskChainId = void 0;
-    var chain_id_1 = require_chain_id();
-    Object.defineProperty(exports2, "maskChainId", { enumerable: true, get: function() {
-      return chain_id_1.maskChainId;
-    } });
-    var tron_address_1 = require_tron_address();
-    Object.defineProperty(exports2, "base58ToHex", { enumerable: true, get: function() {
-      return tron_address_1.base58ToHex;
-    } });
-    Object.defineProperty(exports2, "normalizeAddress", { enumerable: true, get: function() {
-      return tron_address_1.normalizeAddress;
-    } });
-    var reserve_encoder_1 = require_reserve_encoder2();
-    Object.defineProperty(exports2, "computeReserveDigest", { enumerable: true, get: function() {
-      return reserve_encoder_1.computeReserveDigest;
-    } });
-    var payment_id_1 = require_payment_id2();
-    Object.defineProperty(exports2, "computePaymentId", { enumerable: true, get: function() {
-      return payment_id_1.computePaymentId;
-    } });
-    var deposit_encoder_1 = require_deposit_encoder2();
-    Object.defineProperty(exports2, "createTvmPermitWitnessTransferFromPrehash", { enumerable: true, get: function() {
-      return deposit_encoder_1.createTvmPermitWitnessTransferFromPrehash;
-    } });
-    Object.defineProperty(exports2, "hashTvmPermitWitnessTransferFrom", { enumerable: true, get: function() {
-      return deposit_encoder_1.hashTvmPermitWitnessTransferFrom;
-    } });
+});
+
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/adapters/tron.js
+var require_tron = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/adapters/tron.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.tronAdapter = void 0;
+    var ethers_1 = require("ethers");
+    var tvm_escrow_encoding_1 = require_dist();
+    var utils_js_1 = require_utils();
+    var errors_js_1 = require_errors();
+    var chain_id_js_1 = require_chain_id2();
+    exports2.tronAdapter = {
+      async buildAuthMessage({ sourceAsset, maxSourceAmount, sourceDefaults, deadline, nonce }) {
+        if (nonce === void 0) {
+          throw new Error("sender_auth: buildAuthMessage requires an explicit nonce \u2014 derive it deterministically from a stable request id (e.g. the challenge id) so retries reproduce the same permit; pass generatePermitNonce() only for genuinely one-shot builds");
+        }
+        if (deadline === void 0) {
+          throw new Error("sender_auth: buildAuthMessage requires an explicit permit deadline (absolute Unix seconds) \u2014 the low-level builder does not default it; derive it from the payment's fulfillment/settlement deadline in the calling layer (pgc/mppx)");
+        }
+        const sourceChainId = sourceAsset.split("/")[0];
+        const tokenAddress = sourceAsset.split("/")[1].split(":")[1];
+        const permit2Address = sourceDefaults.permit2Contract ?? (0, chain_id_js_1.resolveTronPermit2)(sourceChainId);
+        const tvmParams = {
+          chainId: (0, chain_id_js_1.tronNumericChainId)(sourceChainId),
+          permit2Address,
+          tokenAddress,
+          amount: maxSourceAmount,
+          spenderAddress: sourceDefaults.escrowContract,
+          nonce: (0, utils_js_1.resolvePermitNonce)(nonce),
+          deadline: (0, utils_js_1.resolvePermitDeadline)(deadline),
+          reserverAddress: sourceDefaults.quoteSelector,
+          releaserAddress: sourceDefaults.fulfillmentVerifierAccount
+        };
+        const messagePrehash = (0, tvm_escrow_encoding_1.createTvmPermitWitnessTransferFromPrehash)(tvmParams);
+        const messageHash = (0, tvm_escrow_encoding_1.hashTvmPermitWitnessTransferFrom)(messagePrehash);
+        return { messageScheme: "EVM_PERMIT2", messageHash, messagePrehash: JSON.stringify(messagePrehash) };
+      },
+      async sign(signedMessage, privateKey) {
+        const wallet = new ethers_1.Wallet(privateKey.startsWith("0x") ? privateKey : "0x" + privateKey);
+        return wallet.signingKey.sign(signedMessage.message).serialized;
+      },
+      recoverSigner(signed, source) {
+        let recovered;
+        try {
+          recovered = (0, ethers_1.recoverAddress)(signed.message, signed.signature);
+        } catch (e) {
+          throw new errors_js_1.RecoveryFailedError(`sender_auth: could not recover a signer: ${e.message}`);
+        }
+        if (!(0, utils_js_1.sameAddress)(recovered, (0, tvm_escrow_encoding_1.normalizeAddress)(source.account))) {
+          throw new errors_js_1.SignerMismatchError(`sender_auth: recovered ${recovered}, not source.account`);
+        }
+        return source.account;
+      },
+      recoverAndVerify(signed, source, expected) {
+        let msg;
+        let digest;
+        try {
+          msg = JSON.parse(signed.message_prehash).message;
+          const canonical = (0, tvm_escrow_encoding_1.createTvmPermitWitnessTransferFromPrehash)({
+            chainId: (0, chain_id_js_1.tronNumericChainId)(source.network),
+            permit2Address: (0, chain_id_js_1.resolveTronPermit2)(source.network),
+            tokenAddress: msg.permitted.token,
+            amount: msg.permitted.amount,
+            spenderAddress: msg.spender,
+            nonce: BigInt(msg.nonce),
+            deadline: BigInt(msg.deadline),
+            reserverAddress: msg.witness.reserver,
+            releaserAddress: msg.witness.releaser
+          });
+          digest = (0, tvm_escrow_encoding_1.hashTvmPermitWitnessTransferFrom)(canonical);
+        } catch {
+          throw new errors_js_1.MalformedPrehashError();
+        }
+        let recovered;
+        try {
+          recovered = (0, ethers_1.recoverAddress)(digest, signed.signature);
+        } catch {
+          throw new Error("sender_auth: deposit signature does not recover to source.account");
+        }
+        if (!(0, utils_js_1.sameAddress)(recovered, (0, tvm_escrow_encoding_1.normalizeAddress)(source.account))) {
+          throw new Error("sender_auth: deposit signature does not recover to source.account");
+        }
+        const deadlineSec = Number(msg.deadline);
+        (0, utils_js_1.assertToken)(msg.permitted.token, source.asset, tvm_escrow_encoding_1.normalizeAddress);
+        (0, utils_js_1.assertAmountMatches)(msg.permitted.amount, expected.maxSourceAmount);
+        (0, utils_js_1.assertFresh)(deadlineSec, expected.nowSec ?? (0, utils_js_1.nowSec)());
+        if (expected.escrowContract !== void 0) {
+          (0, utils_js_1.assertSpender)(msg.spender, expected.escrowContract, tvm_escrow_encoding_1.normalizeAddress);
+        }
+        (0, utils_js_1.assertRolePairComplete)(expected.reserver, expected.releaser);
+        if (expected.reserver !== void 0 && expected.releaser !== void 0) {
+          (0, utils_js_1.assertWitnessRoles)(msg.witness.reserver, msg.witness.releaser, expected.reserver, expected.releaser, tvm_escrow_encoding_1.normalizeAddress);
+        }
+        return {
+          amount: msg.permitted.amount,
+          deadlineSec,
+          permit: {
+            scheme: "EVM_PERMIT2",
+            token: msg.permitted.token,
+            amount: msg.permitted.amount,
+            deadlineSec,
+            reserver: msg.witness.reserver,
+            releaser: msg.witness.releaser,
+            spender: msg.spender
+          }
+        };
+      }
+    };
   }
 });
 
 // ../contracts/svm/escrow-encoding/typescript/dist/errors.js
-var require_errors = __commonJS({
+var require_errors2 = __commonJS({
   "../contracts/svm/escrow-encoding/typescript/dist/errors.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -784,8 +1205,8 @@ var require_pubkey = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.Pubkey = void 0;
     var bs58_1 = __importDefault(require("bs58"));
-    var errors_1 = require_errors();
-    var Pubkey3 = class _Pubkey {
+    var errors_1 = require_errors2();
+    var Pubkey2 = class _Pubkey {
       constructor(data) {
         if (data.length !== 32) {
           throw new errors_1.InvalidPubkeyLengthError();
@@ -878,7 +1299,7 @@ var require_pubkey = __commonJS({
         return this.data.every((b, i) => b === other.data[i]);
       }
     };
-    exports2.Pubkey = Pubkey3;
+    exports2.Pubkey = Pubkey2;
   }
 });
 
@@ -990,7 +1411,7 @@ var require_cryptoNode = __commonJS({
 });
 
 // ../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/utils.js
-var require_utils = __commonJS({
+var require_utils2 = __commonJS({
   "../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/utils.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -1239,7 +1660,7 @@ var require_sha3 = __commonJS({
     exports2.shake256 = exports2.shake128 = exports2.keccak_512 = exports2.keccak_384 = exports2.keccak_256 = exports2.keccak_224 = exports2.sha3_512 = exports2.sha3_384 = exports2.sha3_256 = exports2.sha3_224 = exports2.Keccak = void 0;
     exports2.keccakP = keccakP;
     var _u64_ts_1 = require_u64();
-    var utils_ts_1 = require_utils();
+    var utils_ts_1 = require_utils2();
     var _0n = BigInt(0);
     var _1n = BigInt(1);
     var _2n = BigInt(2);
@@ -1504,7 +1925,7 @@ var require_deposit_encoder3 = __commonJS({
     exports2.computeDepositHash = computeDepositHash2;
     var encoding_utils_1 = require_encoding_utils();
     var escrow_domain_1 = require_escrow_domain();
-    var errors_1 = require_errors();
+    var errors_1 = require_errors2();
     function computeDepositHash2(params, domain) {
       if (params.paymentId.length !== 32 || (0, encoding_utils_1.isZeroBytes32)(params.paymentId)) {
         throw new errors_1.ZeroPaymentIdError();
@@ -1532,7 +1953,7 @@ var require_reserve_encoder3 = __commonJS({
     exports2.computeReserveHash = computeReserveHash;
     var encoding_utils_1 = require_encoding_utils();
     var escrow_domain_1 = require_escrow_domain();
-    var errors_1 = require_errors();
+    var errors_1 = require_errors2();
     function computeReserveHash(params, domain) {
       if (params.depositHash.length !== 32 || (0, encoding_utils_1.isZeroBytes32)(params.depositHash)) {
         throw new errors_1.ZeroDepositHashError();
@@ -1552,7 +1973,7 @@ var require_release_encoder = __commonJS({
     exports2.computeReleaseHash = computeReleaseHash;
     var encoding_utils_1 = require_encoding_utils();
     var escrow_domain_1 = require_escrow_domain();
-    var errors_1 = require_errors();
+    var errors_1 = require_errors2();
     function computeReleaseHash(params, domain) {
       if (params.depositHash.length !== 32 || (0, encoding_utils_1.isZeroBytes32)(params.depositHash)) {
         throw new errors_1.ZeroDepositHashError();
@@ -1570,7 +1991,7 @@ var require_refund_encoder = __commonJS({
     exports2.computeRefundHash = computeRefundHash;
     var encoding_utils_1 = require_encoding_utils();
     var escrow_domain_1 = require_escrow_domain();
-    var errors_1 = require_errors();
+    var errors_1 = require_errors2();
     function computeRefundHash(params, domain) {
       if (params.depositHash.length !== 32 || (0, encoding_utils_1.isZeroBytes32)(params.depositHash)) {
         throw new errors_1.ZeroDepositHashError();
@@ -1631,7 +2052,7 @@ var require_dist3 = __commonJS({
     Object.defineProperty(exports2, "escrowDomainPrefixBytes", { enumerable: true, get: function() {
       return escrow_domain_1.escrowDomainPrefixBytes;
     } });
-    var errors_1 = require_errors();
+    var errors_1 = require_errors2();
     Object.defineProperty(exports2, "EncodingError", { enumerable: true, get: function() {
       return errors_1.EncodingError;
     } });
@@ -1697,8 +2118,323 @@ var require_dist3 = __commonJS({
   }
 });
 
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/adapters/solana.js
+var require_solana = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/adapters/solana.js"(exports2) {
+    "use strict";
+    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.solanaAdapter = void 0;
+    var ethers_1 = require("ethers");
+    var tweetnacl_1 = __importDefault(require("tweetnacl"));
+    var bs58_1 = __importDefault(require("bs58"));
+    var solana_escrow_encoding_1 = require_dist3();
+    var utils_js_1 = require_utils();
+    var errors_js_1 = require_errors();
+    var chain_id_js_1 = require_chain_id2();
+    var idAddr = (a) => a;
+    function generateSolanaPaymentIdV3(requestId) {
+      return (0, ethers_1.keccak256)((0, ethers_1.toUtf8Bytes)(requestId));
+    }
+    function hashDeposit(prehash, domain) {
+      return (0, ethers_1.hexlify)((0, solana_escrow_encoding_1.computeDepositHash)({
+        paymentId: (0, ethers_1.getBytes)(prehash.payment_id),
+        depositor: solana_escrow_encoding_1.Pubkey.fromBase58(prehash.depositor),
+        mint: solana_escrow_encoding_1.Pubkey.fromBase58(prehash.mint),
+        amount: BigInt(prehash.amount),
+        reserver: solana_escrow_encoding_1.Pubkey.fromBase58(prehash.reserver),
+        releaser: solana_escrow_encoding_1.Pubkey.fromBase58(prehash.releaser),
+        nonce: BigInt(prehash.nonce),
+        issuedAt: BigInt(prehash.issued_at),
+        deadline: BigInt(prehash.deadline)
+      }, domain));
+    }
+    function domainFrom(defaults) {
+      if (!defaults.escrowContract) {
+        throw new Error("sender_auth: Solana source requires escrowContract (escrow program id) for the deposit-hash domain");
+      }
+      if (!defaults.svmSignatureClusterId || defaults.svmSignatureDomainVersion == null) {
+        throw new Error("sender_auth: Solana source requires svmSignatureClusterId and svmSignatureDomainVersion (V3 escrow domain separation)");
+      }
+      return {
+        clusterId: (0, chain_id_js_1.clusterIdFromName)(defaults.svmSignatureClusterId),
+        signatureDomainVersion: defaults.svmSignatureDomainVersion,
+        programId: solana_escrow_encoding_1.Pubkey.fromBase58(defaults.escrowContract)
+      };
+    }
+    exports2.solanaAdapter = {
+      async buildAuthMessage({ sourceAsset, depositor, maxSourceAmount, requestId, sourceDefaults, nonce, solanaClockReader }) {
+        if (!requestId) {
+          throw new Error("sender_auth: request_id is required");
+        }
+        const sourceChainId = sourceAsset.split("/")[0];
+        const tokenMint = sourceAsset.split("/")[1].split(":")[1];
+        const depositNonce = nonce !== void 0 ? BigInt(nonce) : (0, solana_escrow_encoding_1.generateNonce)();
+        if (nonce !== void 0) {
+          if (depositNonce < 0n || depositNonce >= 1n << 64n) {
+            throw new Error("sender_auth: Solana nonce must fit an unsigned 64-bit integer (0 <= nonce < 2^64)");
+          }
+          if ((depositNonce & 0xffn) >= utils_js_1.SOLANA_REPLAY_SLOTS) {
+            throw new Error(`sender_auth: Solana nonce low byte (replay slot = nonce & 0xFF = ${depositNonce & 0xffn}) must be < ${utils_js_1.SOLANA_REPLAY_SLOTS}; slots ${utils_js_1.SOLANA_REPLAY_SLOTS}-255 are reserved`);
+          }
+        }
+        const issuedAt = solanaClockReader ? await solanaClockReader(sourceChainId) : BigInt(Math.floor(Date.now() / 1e3));
+        const deadline = issuedAt + BigInt(utils_js_1.REPLAY_HORIZON_SECS - 8);
+        const paymentId = generateSolanaPaymentIdV3(requestId);
+        const prehash = {
+          payment_id: paymentId,
+          depositor,
+          mint: tokenMint,
+          amount: BigInt(maxSourceAmount).toString(),
+          reserver: sourceDefaults.quoteSelector,
+          releaser: sourceDefaults.fulfillmentVerifierAccount,
+          nonce: depositNonce.toString(),
+          issued_at: issuedAt.toString(),
+          deadline: deadline.toString()
+        };
+        const depositHash = hashDeposit(prehash, domainFrom(sourceDefaults));
+        return { messageScheme: "SOLANA", messageHash: depositHash, messagePrehash: JSON.stringify(prehash) };
+      },
+      async sign(signedMessage, privateKey) {
+        const messageBytes = (0, ethers_1.getBytes)(signedMessage.message);
+        const secretKey = secretKeyFromPrivate2(privateKey);
+        const sig = tweetnacl_1.default.sign.detached(messageBytes, secretKey);
+        return "0x" + Buffer.from(sig).toString("hex");
+      },
+      deriveDelegateSigner(privateKey) {
+        return bs58_1.default.encode(tweetnacl_1.default.sign.keyPair.fromSecretKey(secretKeyFromPrivate2(privateKey)).publicKey);
+      },
+      recoverSigner(signed, source) {
+        const provided = signed.payload?.delegate_signer;
+        if (provided !== void 0 && provided !== source.account) {
+          throw new errors_js_1.SignerMismatchError(`sender_auth: delegate_signer ${provided} != source.account`);
+        }
+        const signer = provided ?? source.account;
+        let pub;
+        let msg;
+        let sig;
+        try {
+          pub = bs58_1.default.decode(signer);
+          msg = (0, ethers_1.getBytes)(signed.message);
+          sig = (0, ethers_1.getBytes)(signed.signature);
+        } catch {
+          throw new errors_js_1.RecoveryFailedError("sender_auth: malformed Solana pubkey/message/signature encoding");
+        }
+        if (pub.length !== 32 || msg.length !== 32 || sig.length !== 64) {
+          throw new errors_js_1.RecoveryFailedError("sender_auth: Solana pubkey must be 32 bytes, message 32, signature 64");
+        }
+        let ok = false;
+        try {
+          ok = tweetnacl_1.default.sign.detached.verify(msg, sig, pub);
+        } catch {
+          ok = false;
+        }
+        if (!ok) {
+          throw new errors_js_1.SignerMismatchError("sender_auth: ed25519 verification failed");
+        }
+        return source.account;
+      },
+      recoverAndVerify(signed, source, expected) {
+        let prehash;
+        let canonicalHash;
+        try {
+          prehash = JSON.parse(signed.message_prehash);
+          canonicalHash = hashDeposit(prehash, domainFrom(expected));
+        } catch {
+          throw new errors_js_1.MalformedPrehashError();
+        }
+        if (canonicalHash.toLowerCase() !== signed.message.toLowerCase()) {
+          throw new Error("sender_auth: deposit hash does not match the signed message");
+        }
+        const delegateSigner = signed.payload?.delegate_signer;
+        if (!delegateSigner) {
+          throw new Error("sender_auth: Solana credential is missing delegate_signer");
+        }
+        let verified = false;
+        try {
+          verified = tweetnacl_1.default.sign.detached.verify((0, ethers_1.getBytes)(signed.message), (0, ethers_1.getBytes)(signed.signature), bs58_1.default.decode(delegateSigner));
+        } catch {
+          verified = false;
+        }
+        if (!verified || delegateSigner !== source.account || prehash.depositor !== source.account) {
+          throw new Error("sender_auth: deposit signature does not recover to source.account");
+        }
+        const deadlineSec = Number(prehash.deadline);
+        (0, utils_js_1.assertToken)(prehash.mint, source.asset, idAddr);
+        (0, utils_js_1.assertAmountMatches)(prehash.amount, expected.maxSourceAmount);
+        (0, utils_js_1.assertRolePairComplete)(expected.reserver, expected.releaser);
+        if (expected.reserver !== void 0 && expected.releaser !== void 0) {
+          (0, utils_js_1.assertWitnessRoles)(prehash.reserver, prehash.releaser, expected.reserver, expected.releaser, idAddr);
+        }
+        return {
+          amount: prehash.amount,
+          deadlineSec,
+          permit: {
+            scheme: "SOLANA",
+            token: prehash.mint,
+            amount: prehash.amount,
+            deadlineSec,
+            reserver: prehash.reserver,
+            releaser: prehash.releaser,
+            depositor: prehash.depositor
+          }
+        };
+      }
+    };
+    function secretKeyFromPrivate2(privateKey) {
+      if (/^[0-9a-fA-F]{64}$/.test(privateKey)) {
+        const seed = new Uint8Array(32);
+        for (let i = 0; i < 32; i++) {
+          seed[i] = parseInt(privateKey.substring(i * 2, i * 2 + 2), 16);
+        }
+        return tweetnacl_1.default.sign.keyPair.fromSeed(seed).secretKey;
+      }
+      const decoded = bs58_1.default.decode(privateKey);
+      if (decoded.length === 64)
+        return decoded;
+      if (decoded.length === 32)
+        return tweetnacl_1.default.sign.keyPair.fromSeed(decoded).secretKey;
+      throw new Error(`Invalid Solana private key length: expected 32 or 64 bytes, got ${decoded.length}`);
+    }
+  }
+});
+
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/adapters/index.js
+var require_adapters = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/adapters/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.getChainAdapter = getChainAdapter2;
+    var chain_id_js_1 = require_chain_id2();
+    var evm_js_1 = require_evm();
+    var tron_js_1 = require_tron();
+    var solana_js_1 = require_solana();
+    var adapters2 = {
+      eip155: evm_js_1.evmAdapter,
+      tron: tron_js_1.tronAdapter,
+      solana: solana_js_1.solanaAdapter
+    };
+    function getChainAdapter2(caip2) {
+      const adapter = adapters2[(0, chain_id_js_1.namespaceOf)(caip2)];
+      if (!adapter) {
+        throw new Error(`sender_auth: unsupported source chain '${caip2}'`);
+      }
+      return adapter;
+    }
+  }
+});
+
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/verify.js
+var require_verify = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/verify.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.verifyPaymentRequest = verifyPaymentRequest;
+    var index_js_1 = require_adapters();
+    function parseSourceAsset(assetIdentifier) {
+      const parts = assetIdentifier.split("/");
+      const nsParts = parts[1]?.split(":");
+      if (parts.length < 2 || !nsParts || nsParts.length < 2 || !nsParts[1]) {
+        throw new Error(`sender_auth: invalid source asset "${assetIdentifier}"`);
+      }
+      return { network: parts[0], asset: nsParts[1] };
+    }
+    function verifyPaymentRequest(request2, expected = {}) {
+      const senderAuth = request2.sender_auth;
+      if (!senderAuth?.signed_messages?.length) {
+        throw new Error("sender_auth: request has no signed_messages to verify");
+      }
+      if (!request2.source) {
+        throw new Error("sender_auth: request has no source");
+      }
+      const requestSource = parseSourceAsset(request2.source.asset_identifier);
+      const { sourceAsset, network: networkOverride, maxSourceAmount: amountOverride, ...scheme } = expected;
+      const network = networkOverride ?? requestSource.network;
+      const asset = sourceAsset ?? requestSource.asset;
+      const maxSourceAmount = amountOverride ?? request2.max_source_amount ?? "0";
+      const source = { network, asset, account: request2.source.account };
+      const perMessage = { ...scheme, maxSourceAmount };
+      const adapter = (0, index_js_1.getChainAdapter)(network);
+      const results = senderAuth.signed_messages.map((m) => adapter.recoverAndVerify(m, source, perMessage));
+      return { results, recoveredAccount: source.account };
+    }
+  }
+});
+
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/signer.js
+var require_signer = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/signer.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.localKeySigner = localKeySigner2;
+    var index_js_1 = require_adapters();
+    function localKeySigner2(network, privateKey) {
+      const adapter = (0, index_js_1.getChainAdapter)(network);
+      return {
+        async sign(signedMessage) {
+          const signature = await adapter.sign(signedMessage, privateKey);
+          const delegateSigner = adapter.deriveDelegateSigner?.(privateKey);
+          return delegateSigner !== void 0 ? { signature, delegateSigner } : { signature };
+        }
+      };
+    }
+  }
+});
+
+// ../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/index.js
+var require_dist4 = __commonJS({
+  "../schemas/declarations/PaymentRequest/v1/bindings/typescript/sender-auth/dist/index.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.localKeySigner = exports2.SignerMismatchError = exports2.RecoveryFailedError = exports2.MalformedPrehashError = exports2.verifyPaymentRequest = exports2.getChainAdapter = void 0;
+    __exportStar(require_types(), exports2);
+    __exportStar(require_utils(), exports2);
+    __exportStar(require_chain_id2(), exports2);
+    var index_js_1 = require_adapters();
+    Object.defineProperty(exports2, "getChainAdapter", { enumerable: true, get: function() {
+      return index_js_1.getChainAdapter;
+    } });
+    var verify_js_1 = require_verify();
+    Object.defineProperty(exports2, "verifyPaymentRequest", { enumerable: true, get: function() {
+      return verify_js_1.verifyPaymentRequest;
+    } });
+    var errors_js_1 = require_errors();
+    Object.defineProperty(exports2, "MalformedPrehashError", { enumerable: true, get: function() {
+      return errors_js_1.MalformedPrehashError;
+    } });
+    Object.defineProperty(exports2, "RecoveryFailedError", { enumerable: true, get: function() {
+      return errors_js_1.RecoveryFailedError;
+    } });
+    Object.defineProperty(exports2, "SignerMismatchError", { enumerable: true, get: function() {
+      return errors_js_1.SignerMismatchError;
+    } });
+    var signer_js_1 = require_signer();
+    Object.defineProperty(exports2, "localKeySigner", { enumerable: true, get: function() {
+      return signer_js_1.localKeySigner;
+    } });
+  }
+});
+
 // ../key-management/common/typescript/dist/errors.js
-var require_errors2 = __commonJS({
+var require_errors3 = __commonJS({
   "../key-management/common/typescript/dist/errors.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -1762,7 +2498,7 @@ var require_errors2 = __commonJS({
 });
 
 // ../key-management/common/typescript/dist/types.js
-var require_types = __commonJS({
+var require_types2 = __commonJS({
   "../key-management/common/typescript/dist/types.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -1794,7 +2530,7 @@ var require_policy = __commonJS({
 });
 
 // ../key-management/common/typescript/dist/index.js
-var require_dist4 = __commonJS({
+var require_dist5 = __commonJS({
   "../key-management/common/typescript/dist/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
@@ -1814,8 +2550,8 @@ var require_dist4 = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    __exportStar(require_errors2(), exports2);
-    __exportStar(require_types(), exports2);
+    __exportStar(require_errors3(), exports2);
+    __exportStar(require_types2(), exports2);
     __exportStar(require_policy(), exports2);
   }
 });
@@ -1936,7 +2672,7 @@ var require_client = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.TurnkeyClient = void 0;
     var promises_1 = require("timers/promises");
-    var km_core_1 = require_dist4();
+    var km_core_1 = require_dist5();
     var constants_1 = require_constants();
     var logger_1 = require_logger();
     var meter_1 = require_meter();
@@ -2297,7 +3033,7 @@ var require_signer_base = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.resolveTurnkeyAccountAddress = resolveTurnkeyAccountAddress;
     var promises_1 = require("timers/promises");
-    var km_core_1 = require_dist4();
+    var km_core_1 = require_dist5();
     var constants_1 = require_constants();
     var DISCOVERY_BACKOFF_MS = constants_1.TURNKEY_RETRY_BACKOFF_MS;
     async function resolveTurnkeyAccountAddress(deps, addressFormat) {
@@ -2355,7 +3091,7 @@ var require_secp256k1_helpers = __commonJS({
     exports2.signSecp256k1PreimageAndVerify = signSecp256k1PreimageAndVerify;
     exports2.bytesFromHexOrBytes = bytesFromHexOrBytes;
     var ethers_1 = require("ethers");
-    var km_core_1 = require_dist4();
+    var km_core_1 = require_dist5();
     async function signSecp256k1PreimageAndVerify(client, signWith, preimage, expectedEvmAddrLower) {
       const preimageHex = (0, ethers_1.hexlify)(preimage).slice(2);
       const { r, s, v } = await client.signRawPayload({
@@ -2388,13 +3124,13 @@ var require_secp256k1_helpers = __commonJS({
 });
 
 // ../key-management/providers/turnkey/typescript/dist/chains/evm.js
-var require_evm = __commonJS({
+var require_evm2 = __commonJS({
   "../key-management/providers/turnkey/typescript/dist/chains/evm.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.TurnkeyEvmSigner = void 0;
     var ethers_1 = require("ethers");
-    var km_core_1 = require_dist4();
+    var km_core_1 = require_dist5();
     var signer_base_1 = require_signer_base();
     var secp256k1_helpers_1 = require_secp256k1_helpers();
     var ADDRESS_FORMAT = "ADDRESS_FORMAT_ETHEREUM";
@@ -2511,7 +3247,7 @@ ${msgBytes.length}`);
 });
 
 // ../key-management/providers/turnkey/typescript/dist/chains/solana.js
-var require_solana = __commonJS({
+var require_solana2 = __commonJS({
   "../key-management/providers/turnkey/typescript/dist/chains/solana.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
@@ -2558,7 +3294,7 @@ var require_solana = __commonJS({
     exports2.TurnkeySolanaSigner = void 0;
     var web3_js_1 = require("@solana/web3.js");
     var bs58_1 = __importDefault(require("bs58"));
-    var km_core_1 = require_dist4();
+    var km_core_1 = require_dist5();
     var signer_base_1 = require_signer_base();
     var ADDRESS_FORMAT = "ADDRESS_FORMAT_SOLANA";
     var TurnkeySolanaSigner2 = class {
@@ -2643,7 +3379,7 @@ var require_solana = __commonJS({
 });
 
 // ../key-management/providers/turnkey/typescript/dist/chains/tron.js
-var require_tron = __commonJS({
+var require_tron2 = __commonJS({
   "../key-management/providers/turnkey/typescript/dist/chains/tron.js"(exports2) {
     "use strict";
     var __importDefault = exports2 && exports2.__importDefault || function(mod) {
@@ -2655,7 +3391,7 @@ var require_tron = __commonJS({
     var bs58_1 = __importDefault(require("bs58"));
     var ethers_1 = require("ethers");
     var node_crypto_1 = require("crypto");
-    var km_core_1 = require_dist4();
+    var km_core_1 = require_dist5();
     var signer_base_1 = require_signer_base();
     var secp256k1_helpers_1 = require_secp256k1_helpers();
     var ADDRESS_FORMAT = "ADDRESS_FORMAT_TRON";
@@ -2795,9 +3531,20 @@ var require_sub_organizations = __commonJS({
     exports2.listSubOrganizations = listSubOrganizations;
     exports2.deleteSubOrganization = deleteSubOrganization;
     async function createSubOrganization(client, input) {
+      const rootUsers = input.rootUsers.map((u) => ({
+        userName: u.userName,
+        ...u.userEmail ? { userEmail: u.userEmail } : {},
+        apiKeys: (u.apiKeys ?? []).map((k) => ({
+          apiKeyName: k.apiKeyName,
+          publicKey: k.publicKey,
+          curveType: k.curveType ?? "API_KEY_CURVE_P256"
+        })),
+        authenticators: u.authenticators ?? [],
+        oauthProviders: []
+      }));
       const params = {
         subOrganizationName: input.subOrganizationName,
-        rootUsers: input.rootUsers,
+        rootUsers,
         rootQuorumThreshold: input.rootQuorumThreshold,
         wallet: input.wallet ? {
           walletName: input.wallet.walletName,
@@ -2818,8 +3565,8 @@ var require_sub_organizations = __commonJS({
       const out = await client.query("/public/v1/query/list_suborgs");
       return (out.organizationIds ?? []).map((id) => ({ subOrganizationId: id }));
     }
-    async function deleteSubOrganization(client, subOrganizationId) {
-      await client.executeActivity("ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION", "delete_sub_organization", { subOrganizationId, deleteWithoutExport: true });
+    async function deleteSubOrganization(client, opts = {}) {
+      await client.executeActivity("ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION", "delete_sub_organization", { deleteWithoutExport: opts.deleteWithoutExport ?? false });
     }
   }
 });
@@ -3299,6 +4046,19 @@ var require_sender_policies = __commonJS({
             condition: `activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2' && solana.tx.instructions.all(i, i.program_key in [${list}])`,
             notes: "Sender Solana deposit txs invoke ComputeBudget + Ed25519Program + Atum escrow only."
           });
+          const solCap = extras.solanaMaxNativeValue ?? "10000000";
+          policies.push({
+            policyName: `maxNativeValue (${chain.chainId})`,
+            effect: "EFFECT_DENY",
+            condition: `activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2' && solana.tx.transfers.any(t, t.amount > ${solCap})`,
+            notes: "Caps native SOL (lamports); default 10,000,000 (0.01 SOL) ATA-rent headroom."
+          });
+          policies.push({
+            policyName: `denySplTransfers (${chain.chainId})`,
+            effect: "EFFECT_DENY",
+            condition: `activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2' && solana.tx.spl_transfers.any(t, !(t.to in []))`,
+            notes: "Denies all top-level SPL transfers; the sender moves tokens only via escrow CPI."
+          });
         }
       }
       policies.push({
@@ -3419,7 +4179,7 @@ var require_extras_policies = __commonJS({
         validateAddressMap(obj.allowedTrc20Recipients, "allowedTrc20Recipients", TRON_ADDRESS, source);
       }
       if (obj.allowedSplRecipients != null) {
-        validateAddressMap(obj.allowedSplRecipients, "allowedSplRecipients", /^[1-9A-HJ-NP-Za-km-z]{32,44}$/, source);
+        validateAddressMap(obj.allowedSplRecipients, "allowedSplRecipients", /^[1-9A-HJ-NP-Za-km-z]{32,44}$/, source, true);
       }
       if (obj.evmCaps != null) {
         validateCapMap(obj.evmCaps, "evmCaps", ["maxGasLimit", "maxFeePerGasWei"], source);
@@ -3450,12 +4210,12 @@ var require_extras_policies = __commonJS({
         }
       }
     }
-    function validateAddressMap(map, field, pattern, source) {
+    function validateAddressMap(map, field, pattern, source, allowEmpty = false) {
       if (typeof map !== "object" || map == null || Array.isArray(map)) {
         throw new Error(`${source}: ${field} must be a map keyed by chain name.`);
       }
       for (const [chainKey, list] of Object.entries(map)) {
-        if (!Array.isArray(list) || list.length === 0) {
+        if (!Array.isArray(list) || !allowEmpty && list.length === 0) {
           throw new Error(`${source}: ${field}.${chainKey} must be a non-empty list of addresses.`);
         }
         for (const addr of list) {
@@ -3530,6 +4290,10 @@ var require_extras_policies = __commonJS({
         const jobs = [];
         for (const [chainKey, recipients] of Object.entries(extras.allowedSplRecipients)) {
           const chainId = resolveChainId("allowedSplRecipients", chainKey, "solana:");
+          if (recipients.length === 0) {
+            out.push(buildSplRecipientPolicy(chainId, []));
+            continue;
+          }
           const mints = ctx.solanaMintsByChainKey[chainKey] ?? [];
           if (mints.length === 0) {
             throw new Error(`allowedSplRecipients.${chainKey} requires the Solana chain "${chainKey}" to expose at least one asset mint; got 0.`);
@@ -3597,7 +4361,7 @@ var require_extras_policies = __commonJS({
         policyName: `allowedSplRecipients (${chainId})`,
         effect: "EFFECT_DENY",
         condition: `activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2' && solana.tx.spl_transfers.any(t, !(t.to in [${list}]))`,
-        notes: "Denies any top-level SPL transfer to a destination ATA outside the allowlist."
+        notes: allowedAtas.length === 0 ? "Denies ALL top-level SPL transfers (empty allowlist \u2014 no destination is permitted)." : "Denies any top-level SPL transfer to a destination ATA outside the allowlist."
       };
     }
   }
@@ -3675,7 +4439,7 @@ var require_admin = __commonJS({
 });
 
 // ../key-management/providers/turnkey/typescript/dist/index.js
-var require_dist5 = __commonJS({
+var require_dist6 = __commonJS({
   "../key-management/providers/turnkey/typescript/dist/index.js"(exports2) {
     "use strict";
     var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
@@ -3730,15 +4494,15 @@ var require_dist5 = __commonJS({
     Object.defineProperty(exports2, "noopMeter", { enumerable: true, get: function() {
       return meter_1.noopMeter;
     } });
-    var evm_1 = require_evm();
+    var evm_1 = require_evm2();
     Object.defineProperty(exports2, "TurnkeyEvmSigner", { enumerable: true, get: function() {
       return evm_1.TurnkeyEvmSigner;
     } });
-    var solana_1 = require_solana();
+    var solana_1 = require_solana2();
     Object.defineProperty(exports2, "TurnkeySolanaSigner", { enumerable: true, get: function() {
       return solana_1.TurnkeySolanaSigner;
     } });
-    var tron_1 = require_tron();
+    var tron_1 = require_tron2();
     Object.defineProperty(exports2, "TurnkeyTronSigner", { enumerable: true, get: function() {
       return tron_1.TurnkeyTronSigner;
     } });
@@ -3853,7 +4617,7 @@ var import_turnkey_signer, TURNKEY_API_URL, DEFAULTS;
 var init_turnkey_impl = __esm({
   "src/signers/turnkey-impl.ts"() {
     "use strict";
-    import_turnkey_signer = __toESM(require_dist5());
+    import_turnkey_signer = __toESM(require_dist6());
     TURNKEY_API_URL = "https://api.turnkey.com";
     DEFAULTS = {
       concurrencyLimit: 10,
@@ -3917,7 +4681,6 @@ __export(index_exports, {
   PaymentsService: () => PaymentsService,
   QuoteRequestsService: () => QuoteRequestsService,
   REPLAY_HORIZON_SECS: () => REPLAY_HORIZON_SECS,
-  RawSenderSigner: () => RawSenderSigner,
   TOTAL_BUCKETS: () => TOTAL_BUCKETS,
   TurnkeySenderSigner: () => TurnkeySenderSigner,
   base58ToBytes: () => base58ToBytes,
@@ -4391,7 +5154,11 @@ var PaymentsService = class {
       mediaType: "application/json",
       errors: {
         400: "Invalid request",
-        500: "Internal server error"
+        401: "Signature or sender authorization could not be verified",
+        403: "Payment declined during counterparty authorization",
+        413: "Payment request too large to process",
+        500: "Internal server error",
+        503: "A dependency is temporarily unavailable"
       }
     });
   }
@@ -4524,6 +5291,7 @@ var AuthorizationsService = class {
       errors: {
         400: "Invalid payment request",
         404: "Counterparty not found (no registration for the resolved DID)",
+        500: "Internal server error",
         502: "Counterparty webhook error (HTTP error or connection failure)",
         504: "Authorization timed out (counterparty did not respond)"
       }
@@ -4699,60 +5467,18 @@ var PaymentGatewayClient = class {
 };
 
 // src/chain-adapters/evm.ts
-var import_ethers2 = require("ethers");
+var import_ethers = require("ethers");
 
 // src/chain-adapters/types.ts
-var PERMIT_DEADLINE = BigInt(1924991999);
-function resolvePermitDeadline(deadlineSeconds) {
-  if (deadlineSeconds !== void 0) {
-    return BigInt(Math.floor(Date.now() / 1e3) + deadlineSeconds);
-  }
-  return PERMIT_DEADLINE;
-}
-function generatePermitNonce() {
-  const rand = new Uint32Array(1);
-  globalThis.crypto.getRandomValues(rand);
-  return (BigInt(Date.now()) << 32n) + BigInt(rand[0]);
-}
 function assertKeyMatchesSender(matches, sender, derived) {
   if (!matches) {
     throw new Error(`The private key derives ${derived}, which does not match the sender address ${sender}`);
   }
 }
 
-// src/sender_auth_schemes/evm_permit2.ts
-var import_ethers = require("ethers");
-var import_evm_escrow_encoding = __toESM(require_dist());
-function hashRequestId(requestId) {
-  return (0, import_ethers.keccak256)((0, import_ethers.toUtf8Bytes)(requestId));
-}
-
 // src/chain-adapters/evm.ts
 var evmAdapter = {
   turnkeyAddressFormat: "ADDRESS_FORMAT_ETHEREUM",
-  async buildAuthMessage({ sourceAsset, fulfillmentAmount, sourceDefaults, deadlineSeconds }) {
-    const sourceChainId = sourceAsset.split("/")[0];
-    const chainIdNum = parseInt(sourceChainId.split(":")[1]);
-    const tokenAddress = sourceAsset.split("/")[1].split(":")[1];
-    const permitParams = {
-      chainId: chainIdNum,
-      verifyingContract: import_evm_escrow_encoding.PERMIT2_CONTRACT_ADDRESS,
-      token: tokenAddress,
-      amount: fulfillmentAmount,
-      spender: sourceDefaults.escrowContract,
-      nonce: generatePermitNonce(),
-      deadline: resolvePermitDeadline(deadlineSeconds),
-      reserver: sourceDefaults.quoteSelector,
-      releaser: sourceDefaults.fulfillmentVerifierAccount
-    };
-    const messagePrehash = (0, import_evm_escrow_encoding.createPermitWitnessTransferFromPrehash)(permitParams);
-    const messageHash = (0, import_evm_escrow_encoding.hashPermitWitnessTransferFrom)(messagePrehash);
-    return {
-      messageScheme: "EVM_PERMIT2",
-      messageHash,
-      messagePrehash: JSON.stringify(messagePrehash)
-    };
-  },
   formatPrivateKey(key) {
     return key.startsWith("0x") ? key : "0x" + key;
   },
@@ -4763,78 +5489,22 @@ var evmAdapter = {
       throw new Error("Invalid private key");
     }
   },
-  /**
-   * Sign the Permit2 PermitWitnessTransferFrom typed data via standard
-   * EIP-712 signing. The prehash is already shaped for direct consumption
-   * by ethers' signTypedData (Permit2 domain has no version/salt; types
-   * omits EIP712Domain since ethers generates that from the domain object).
-   */
-  async sign(signedMessage, privateKey) {
-    if (!signedMessage.message_prehash) {
-      throw new Error("EVM adapter sign(): signed_messages[i].message_prehash is required");
-    }
-    const prehash = JSON.parse(signedMessage.message_prehash);
-    const wallet = new import_ethers2.ethers.Wallet(privateKey);
-    return wallet.signTypedData(prehash.domain, prehash.types, prehash.message);
-  },
   // Called after validatePrivateKey, so ethers.Wallet won't echo a malformed key.
   verifyAddressMatchesKey(privateKey, address) {
-    const derived = new import_ethers2.ethers.Wallet(privateKey).address;
+    const derived = new import_ethers.ethers.Wallet(privateKey).address;
     assertKeyMatchesSender(derived.toLowerCase() === address.toLowerCase(), address, derived);
   }
 };
 
 // src/chain-adapters/tron.ts
-var import_ethers3 = require("ethers");
+var import_ethers2 = require("ethers");
 
 // src/sender_auth_schemes/tron.ts
-var import_tvm_escrow_encoding = __toESM(require_dist2());
+var import_tvm_escrow_encoding = __toESM(require_dist());
 
 // src/chain-adapters/tron.ts
-var CHAIN_ID_MAP = {
-  "shasta": 2494104990,
-  "mainnet": 728126428
-};
-var PERMIT2_FALLBACKS = {
-  "tron:shasta": "TPUqJPASUn1zLvbLBgRZ5pBYrx7WSe5ahp",
-  "tron:mainnet": "TJhMXTHQHeQyMD7TcKQFqAePNgG4b31H9m"
-};
 var tronAdapter = {
   turnkeyAddressFormat: "ADDRESS_FORMAT_TRON",
-  async buildAuthMessage({ sourceAsset, fulfillmentAmount, sourceDefaults, deadlineSeconds }) {
-    const sourceChainId = sourceAsset.split("/")[0];
-    const chainName = sourceChainId.split(":")[1];
-    const chainIdNum = CHAIN_ID_MAP[chainName];
-    if (!chainIdNum) {
-      throw new Error(`Unsupported Tron chain: ${chainName}`);
-    }
-    const tokenAddress = sourceAsset.split("/")[1].split(":")[1];
-    let permit2Address = sourceDefaults.permit2Contract;
-    if (permit2Address === void 0) {
-      permit2Address = PERMIT2_FALLBACKS[sourceChainId];
-      if (!permit2Address) {
-        throw new Error(`don't know Permit2 address for chain ${sourceChainId}`);
-      }
-    }
-    const tvmParams = {
-      chainId: chainIdNum,
-      permit2Address,
-      tokenAddress,
-      amount: fulfillmentAmount,
-      spenderAddress: sourceDefaults.escrowContract,
-      nonce: generatePermitNonce(),
-      deadline: resolvePermitDeadline(deadlineSeconds),
-      reserverAddress: sourceDefaults.quoteSelector,
-      releaserAddress: sourceDefaults.fulfillmentVerifierAccount
-    };
-    const messagePrehash = (0, import_tvm_escrow_encoding.createTvmPermitWitnessTransferFromPrehash)(tvmParams);
-    const messageHash = (0, import_tvm_escrow_encoding.hashTvmPermitWitnessTransferFrom)(messagePrehash);
-    return {
-      messageScheme: "EVM_PERMIT2",
-      messageHash,
-      messagePrehash: JSON.stringify(messagePrehash)
-    };
-  },
   resolveContractOverrides(sourceDefaults) {
     return {
       quote_selector: (0, import_tvm_escrow_encoding.normalizeAddress)(sourceDefaults.quoteSelector),
@@ -4854,133 +5524,68 @@ var tronAdapter = {
       throw new Error("Invalid private key");
     }
   },
-  /**
-   * Tron uses TIP-712 typed-data — same wire format as EIP-712. The prehash
-   * built by createTvmPermitWitnessTransferFromPrehash is now directly
-   * consumable by `wallet.signTypedData(prehash.domain, prehash.types,
-   * prehash.message)`, but this adapter (an internal SDK helper) stays on the
-   * raw-hash sign for parity with the EVM adapter — e2e tests use ethers
-   * directly when they need the typed-data path.
-   */
-  async sign(signedMessage, privateKey) {
-    const wallet = new import_ethers3.ethers.Wallet(privateKey.startsWith("0x") ? privateKey : "0x" + privateKey);
-    return wallet.signingKey.sign(signedMessage.message).serialized;
-  },
   // Tron addresses are the same secp256k1-derived 20 bytes as EVM. Compare the
   // derived hex directly against the canonical sender; do NOT run normalizeAddress
   // on the derived side — it strips a leading 41, which would corrupt an address
   // whose first byte is 0x41.
   verifyAddressMatchesKey(privateKey, address) {
     const key = privateKey.startsWith("0x") ? privateKey : "0x" + privateKey;
-    const derived = new import_ethers3.ethers.Wallet(key).address;
+    const derived = new import_ethers2.ethers.Wallet(key).address;
     assertKeyMatchesSender(derived.toLowerCase() === (0, import_tvm_escrow_encoding.normalizeAddress)(address), address, derived);
   }
 };
 
-// src/chain-adapters/solana.ts
-var import_tweetnacl = __toESM(require("tweetnacl"));
-var import_bs582 = __toESM(require("bs58"));
-var import_solana_escrow_encoding2 = __toESM(require_dist3());
-
-// src/sender_auth_schemes/solana.ts
-var import_ethers4 = require("ethers");
-var import_bs58 = __toESM(require("bs58"));
-var import_solana_escrow_encoding = __toESM(require_dist3());
-var REPLAY_HORIZON_SECS = 128;
-var TOTAL_BUCKETS = 131072;
-var DEPOSIT_MESSAGE_SIZE = 199;
-function base58ToBytes(address) {
-  const bytes = import_bs58.default.decode(address);
-  if (bytes.length !== 32) {
-    throw new Error(`Invalid Solana public key length: expected 32 bytes, got ${bytes.length}`);
-  }
-  return bytes;
-}
-function bytesToHex(bytes) {
-  return (0, import_ethers4.hexlify)(bytes);
-}
-function hexToBytes(hex) {
-  return (0, import_ethers4.getBytes)(hex.startsWith("0x") ? hex : "0x" + hex);
-}
-function generateSolanaPaymentId(requestId, params) {
-  const depositorBytes = base58ToBytes(params.depositor);
-  const reserverBytes = base58ToBytes(params.reserver);
-  const releaserBytes = base58ToBytes(params.releaser);
-  return (0, import_ethers4.keccak256)((0, import_ethers4.concat)([
-    (0, import_ethers4.toUtf8Bytes)(requestId),
-    (0, import_ethers4.toUtf8Bytes)("deposit"),
-    depositorBytes,
-    (0, import_solana_escrow_encoding.encodeU64LE)(params.amount),
-    reserverBytes,
-    releaserBytes,
-    (0, import_solana_escrow_encoding.encodeU64LE)(params.nonce),
-    (0, import_solana_escrow_encoding.encodeU64LE)(params.issuedAt),
-    (0, import_solana_escrow_encoding.encodeU64LE)(params.deadline)
-  ]));
-}
-function createSolanaDepositPrehash(paymentId, params) {
-  return {
-    payment_id: paymentId,
-    depositor: params.depositor,
-    mint: params.mint,
-    amount: params.amount.toString(),
-    reserver: params.reserver,
-    releaser: params.releaser,
-    nonce: params.nonce.toString(),
-    issued_at: params.issuedAt.toString(),
-    deadline: params.deadline.toString()
-  };
-}
-function hashSolanaDeposit(prehash) {
-  const paymentIdBytes = hexToBytes(prehash.payment_id);
-  const depositorBytes = base58ToBytes(prehash.depositor);
-  const mintBytes = base58ToBytes(prehash.mint);
-  const reserverBytes = base58ToBytes(prehash.reserver);
-  const releaserBytes = base58ToBytes(prehash.releaser);
-  return (0, import_ethers4.keccak256)((0, import_ethers4.concat)([
-    (0, import_ethers4.toUtf8Bytes)("deposit"),
-    paymentIdBytes,
-    depositorBytes,
-    mintBytes,
-    (0, import_solana_escrow_encoding.encodeU64LE)(BigInt(prehash.amount)),
-    reserverBytes,
-    releaserBytes,
-    (0, import_solana_escrow_encoding.encodeU64LE)(BigInt(prehash.nonce)),
-    (0, import_solana_escrow_encoding.encodeU64LE)(BigInt(prehash.issued_at)),
-    (0, import_solana_escrow_encoding.encodeU64LE)(BigInt(prehash.deadline))
-  ]));
-}
-function generateSolanaNonce() {
-  return (0, import_solana_escrow_encoding.generateNonce)();
+// src/chain-adapters/solana.ts
+var import_tweetnacl = __toESM(require("tweetnacl"));
+var import_bs58 = __toESM(require("bs58"));
+var solanaAdapter = {
+  turnkeyAddressFormat: "ADDRESS_FORMAT_SOLANA",
+  formatPrivateKey(key) {
+    return key.startsWith("0x") ? key.slice(2) : key;
+  },
+  verifyAddressMatchesKey(privateKey, address) {
+    const derived = deriveSolanaAddress(privateKey);
+    assertKeyMatchesSender(derived === address, address, derived);
+  }
+};
+function deriveSolanaAddress(privateKey) {
+  return import_bs58.default.encode(import_tweetnacl.default.sign.keyPair.fromSecretKey(secretKeyFromPrivate(privateKey)).publicKey);
 }
-function clusterIdFromName(name) {
-  const encoded = new TextEncoder().encode(name);
-  if (encoded.length > 32) {
-    throw new Error(`cluster name too long for cluster_id: ${name} (${encoded.length} > 32 bytes)`);
-  }
-  const out = new Uint8Array(32);
-  out.set(encoded);
-  return out;
+function secretKeyFromPrivate(privateKey) {
+  if (/^[0-9a-fA-F]{64}$/.test(privateKey)) {
+    const seed = new Uint8Array(32);
+    for (let i = 0; i < 32; i++) {
+      seed[i] = parseInt(privateKey.substring(i * 2, i * 2 + 2), 16);
+    }
+    return import_tweetnacl.default.sign.keyPair.fromSeed(seed).secretKey;
+  }
+  const decoded = import_bs58.default.decode(privateKey);
+  if (decoded.length === 64) {
+    return decoded;
+  }
+  if (decoded.length === 32) {
+    return import_tweetnacl.default.sign.keyPair.fromSeed(decoded).secretKey;
+  }
+  throw new Error(`Invalid Solana private key length: expected 32 or 64 bytes, got ${decoded.length}`);
 }
-function generateSolanaPaymentIdV3(requestId) {
-  return (0, import_ethers4.keccak256)((0, import_ethers4.toUtf8Bytes)(requestId));
+
+// src/chain-adapters/index.ts
+var adapters = {
+  "eip155": evmAdapter,
+  "tron": tronAdapter,
+  "solana": solanaAdapter
+};
+function getChainAdapter(sourceChainId) {
+  const prefix = sourceChainId.split(":")[0];
+  const adapter = adapters[prefix];
+  if (!adapter) throw new Error(`Unsupported source chain: ${sourceChainId}`);
+  return adapter;
 }
-function hashSolanaDepositV3(prehash, domain) {
-  const hash = (0, import_solana_escrow_encoding.computeDepositHash)(
-    {
-      paymentId: hexToBytes(prehash.payment_id),
-      depositor: import_solana_escrow_encoding.Pubkey.fromBase58(prehash.depositor),
-      mint: import_solana_escrow_encoding.Pubkey.fromBase58(prehash.mint),
-      amount: BigInt(prehash.amount),
-      reserver: import_solana_escrow_encoding.Pubkey.fromBase58(prehash.reserver),
-      releaser: import_solana_escrow_encoding.Pubkey.fromBase58(prehash.releaser),
-      nonce: BigInt(prehash.nonce),
-      issuedAt: BigInt(prehash.issued_at),
-      deadline: BigInt(prehash.deadline)
-    },
-    domain
-  );
-  return bytesToHex(hash);
+function namespaceForTurnkeyAddressFormat(addressFormat) {
+  for (const [namespace, adapter] of Object.entries(adapters)) {
+    if (adapter.turnkeyAddressFormat === addressFormat) return namespace;
+  }
+  return void 0;
 }
 
 // src/chain-adapters/solana-clock.ts
@@ -5050,120 +5655,8 @@ async function resolveSolanaIssuedAt(opts) {
   return BigInt(Math.floor(Date.now() / 1e3)) - SOLANA_ISSUED_AT_FALLBACK_SKEW_SECS;
 }
 
-// src/chain-adapters/solana.ts
-var solanaAdapter = {
-  turnkeyAddressFormat: "ADDRESS_FORMAT_SOLANA",
-  async buildAuthMessage({ sourceAsset, depositor, fulfillmentAmount, requestId, sourceDefaults, solanaRpcUrl, solanaClockReader, solanaLogger }) {
-    const sourceChainId = sourceAsset.split("/")[0];
-    const tokenMint = sourceAsset.split("/")[1].split(":")[1];
-    const nonce = generateSolanaNonce();
-    const issuedAt = await resolveSolanaIssuedAt({
-      sourceChainId,
-      rpcUrlOverride: solanaRpcUrl,
-      reader: solanaClockReader,
-      logger: solanaLogger
-    });
-    const deadline = issuedAt + BigInt(REPLAY_HORIZON_SECS - 8);
-    const solanaParams = {
-      depositor,
-      mint: tokenMint,
-      amount: BigInt(fulfillmentAmount),
-      reserver: sourceDefaults.quoteSelector,
-      releaser: sourceDefaults.fulfillmentVerifierAccount,
-      nonce,
-      issuedAt,
-      deadline,
-      requestId
-    };
-    const paymentId = generateSolanaPaymentIdV3(requestId);
-    const prehash = createSolanaDepositPrehash(paymentId, solanaParams);
-    if (!sourceDefaults.svmSignatureClusterId || sourceDefaults.svmSignatureDomainVersion == null) {
-      throw new Error(
-        "Solana source requires svm_signature_cluster_id and svm_signature_domain_version from payment-gw /defaults (V3 escrow domain separation). Is the gateway on V3?"
-      );
-    }
-    const domain = {
-      clusterId: clusterIdFromName(sourceDefaults.svmSignatureClusterId),
-      signatureDomainVersion: sourceDefaults.svmSignatureDomainVersion,
-      programId: import_solana_escrow_encoding2.Pubkey.fromBase58(sourceDefaults.escrowContract)
-    };
-    const depositHash = hashSolanaDepositV3(prehash, domain);
-    return {
-      messageScheme: "SOLANA",
-      messageHash: depositHash,
-      messagePrehash: JSON.stringify(prehash)
-    };
-  },
-  formatPrivateKey(key) {
-    return key.startsWith("0x") ? key.slice(2) : key;
-  },
-  /**
-   * Solana has no EIP-712-style typed-data standard. The prehash structure
-   * still describes what was hashed (for debugging / wallet UX), but the
-   * canonical signing input is the chain-specific digest already in
-   * signedMessage.message. We sign that with ed25519.
-   */
-  async sign(signedMessage, privateKey) {
-    const messageBytes = new Uint8Array(Buffer.from(signedMessage.message.replace("0x", ""), "hex"));
-    const secretKey = secretKeyFromPrivate(privateKey);
-    const sig = import_tweetnacl.default.sign.detached(messageBytes, secretKey);
-    return "0x" + Buffer.from(sig).toString("hex");
-  },
-  /**
-   * Solana Ed25519 signatures are not public-key-recoverable (unlike EVM
-   * secp256k1, where ecrecover derives the signer from the signature). The
-   * on-chain Ed25519 verify instruction must therefore be given the signer's
-   * public key explicitly, so we ship it as signed_messages[0].payload.delegate_signer.
-   * In the self-custody CLI flow the signer is the depositor itself, so this
-   * equals source.account.
-   */
-  deriveDelegateSigner(privateKey) {
-    return deriveSolanaAddress(privateKey);
-  },
-  verifyAddressMatchesKey(privateKey, address) {
-    const derived = deriveSolanaAddress(privateKey);
-    assertKeyMatchesSender(derived === address, address, derived);
-  }
-};
-function deriveSolanaAddress(privateKey) {
-  return import_bs582.default.encode(import_tweetnacl.default.sign.keyPair.fromSecretKey(secretKeyFromPrivate(privateKey)).publicKey);
-}
-function secretKeyFromPrivate(privateKey) {
-  if (/^[0-9a-fA-F]{64}$/.test(privateKey)) {
-    const seed = new Uint8Array(32);
-    for (let i = 0; i < 32; i++) {
-      seed[i] = parseInt(privateKey.substring(i * 2, i * 2 + 2), 16);
-    }
-    return import_tweetnacl.default.sign.keyPair.fromSeed(seed).secretKey;
-  }
-  const decoded = import_bs582.default.decode(privateKey);
-  if (decoded.length === 64) {
-    return decoded;
-  }
-  if (decoded.length === 32) {
-    return import_tweetnacl.default.sign.keyPair.fromSeed(decoded).secretKey;
-  }
-  throw new Error(`Invalid Solana private key length: expected 32 or 64 bytes, got ${decoded.length}`);
-}
-
-// src/chain-adapters/index.ts
-var adapters = {
-  "eip155": evmAdapter,
-  "tron": tronAdapter,
-  "solana": solanaAdapter
-};
-function getChainAdapter(sourceChainId) {
-  const prefix = sourceChainId.split(":")[0];
-  const adapter = adapters[prefix];
-  if (!adapter) throw new Error(`Unsupported source chain: ${sourceChainId}`);
-  return adapter;
-}
-function namespaceForTurnkeyAddressFormat(addressFormat) {
-  for (const [namespace, adapter] of Object.entries(adapters)) {
-    if (adapter.turnkeyAddressFormat === addressFormat) return namespace;
-  }
-  return void 0;
-}
+// src/index.ts
+var import_payment_request_sender_auth2 = __toESM(require_dist4());
 
 // src/generated/schemas.gen.ts
 var $AuthorizationResult = {
@@ -5200,15 +5693,33 @@ an error indicating why authorization could not be completed.
     error_code: {
       type: "string",
       description: `Machine-readable error code (present when status is error or timeout).
-The counterparty and webhook codes (COUNTERPARTY_NOT_FOUND, COUNTERPARTY_TIMEOUT,
-WEBHOOK_ERROR, WEBHOOK_CONNECTION_ERROR, INTERNAL_ERROR) mirror the AuthorizationErrorCode
-protobuf enum. GATEWAY_TIMEOUT, PROOF_INVALID, and PROOF_STALE are produced by payment-gw
-itself and have no protobuf equivalent.
+Counterparty-sourced codes are derived from the error code the
+Counterparty Gateway publishes. GATEWAY_TIMEOUT, PROOF_INVALID, and
+PROOF_STALE are payment-gw-specific (no counterparty envelope corresponds).
 `,
       enum: ["COUNTERPARTY_NOT_FOUND", "COUNTERPARTY_TIMEOUT", "WEBHOOK_ERROR", "WEBHOOK_CONNECTION_ERROR", "INTERNAL_ERROR", "GATEWAY_TIMEOUT", "PROOF_INVALID", "PROOF_STALE"],
-      "x-enum-description": `The counterparty and webhook codes mirror the AuthorizationErrorCode protobuf enum
-(without the AUTHORIZATION_ERROR_CODE_ prefix for readability in HTTP responses).
-GATEWAY_TIMEOUT, PROOF_INVALID, and PROOF_STALE are payment-gw-local codes with no protobuf equivalent.
+      "x-enum-description": `COUNTERPARTY_NOT_FOUND, COUNTERPARTY_TIMEOUT, WEBHOOK_ERROR,
+WEBHOOK_CONNECTION_ERROR, and INTERNAL_ERROR are derived from the
+error code the Counterparty Gateway publishes.
+GATEWAY_TIMEOUT is emitted by payment-gw when no authorization
+response is received within the system-wide timeout \u2014 source unknown
+(counterparty delay, transport failure, or gateway unavailability).
+Originator should retry; counterparty-side idempotency prevents PSP re-charge
+if the original was already processed.
+
+PROOF_INVALID is emitted when the W3C Data Integrity proof on the
+beneficiary PSP's AuthorizationResponse fails verification: signature
+recovery failed, recovered DID does not match the destination DID,
+response shape is malformed (missing @context / payment_id /
+counterparty_did / proof), or the suite type is unsupported. The
+underlying reason cardinality is collapsed so originators see one
+actionable category.
+
+PROOF_STALE is emitted when proof.created falls outside the
+configured freshness window. Originators should retry with a fresh
+request \u2014 the freshness window closes a replay attack vector where a
+captured-but-cryptographically-valid proof could otherwise be replayed
+indefinitely.
 `
     },
     error_message: {
@@ -5695,14 +6206,13 @@ code for programmatic handling and a human-readable message for debugging.
   properties: {
     code: {
       type: "string",
-      description: `Machine-readable error code in SCREAMING_SNAKE_CASE.
+      description: `Public error category in SCREAMING_SNAKE_CASE.
 Common codes:
-- \`QUOTE_DEADLINE_EXPIRED\`: No settlement quotes received in time
-- \`QUOTE_SELECTION_FAILED\`: Quotes received but none met requirements
-- \`INSUFFICIENT_FUNDS\`: Sender wallet has insufficient balance
-- \`FULFILLMENT_TIMEOUT\`: Settlement agent didn't complete in time
+- \`SETTLEMENT_FAILED\`: The settlement could not be completed
+- \`NO_ROUTE_AVAILABLE\`: No settlement route was available
+- \`INTERNAL_ERROR\`: An unexpected error occurred
 `,
-      example: "QUOTE_DEADLINE_EXPIRED"
+      example: "SETTLEMENT_FAILED"
     },
     message: {
       type: "string",
@@ -6014,7 +6524,7 @@ var $TimelineStep = {
   properties: {
     name: {
       type: "string",
-      description: "Name of the step",
+      description: "Internal name of the step (matches settlement event type)",
       example: "BID_AWARDED"
     },
     label: {
@@ -6061,11 +6571,35 @@ var $TimelineStep = {
 };
 var $ErrorResponse = {
   type: "object",
+  description: "Safe, outward-facing error. Derived from an internal error through the shared error catalog. The public code identifies the category and the message is a curated, safe description.",
+  required: ["code", "message"],
   properties: {
-    error: {
+    code: {
+      type: "string",
+      description: "Public, machine-readable error category in SCREAMING_SNAKE_CASE.",
+      pattern: "^[A-Z][A-Z0-9_]*$",
+      example: "INVALID_SOURCE_ASSET"
+    },
+    message: {
+      type: "string",
+      description: "Curated, safe, human-readable message.",
+      maxLength: 500,
+      example: "The source asset identifier is not a valid CAIP-19 asset."
+    },
+    request_id: {
+      type: "string",
+      description: "Correlation id to quote to support to locate the internal error record.",
+      example: "req_123456789"
+    },
+    docs_url: {
       type: "string",
-      description: "Error message",
-      example: "Invalid request: missing required field"
+      format: "uri",
+      description: "Link to the documentation page for this public code."
+    },
+    domain: {
+      type: "string",
+      description: "Originating service domain.",
+      example: "PAYMENT_GATEWAY"
     }
   }
 };
@@ -6472,7 +7006,9 @@ the quote-request batch lifecycle and is disjoint from the payment-status enum.
       enum: ["collecting", "ready", "awarded", "expired"],
       description: `Derived batch lifecycle, computed at read time (not a stored state machine). Disjoint
 from the payment-status enum returned by the award and payment-status endpoints.
-- \`collecting\` \u2014 collection window in progress; \`quotes\` absent.
+- \`collecting\` \u2014 collection window still open; \`quotes\` lists those collected so far
+  (a quote is awardable from arrival, by its own \`award_deadline\`; more may arrive until
+  \`collection_close\`).
 - \`ready\` \u2014 collection complete; none awarded yet; either at least one quote is still
   within its \`award_deadline\`, or no settler bid (empty \`quotes\` array \u2014 the successful
   "no quotes available" result).
@@ -6485,7 +7021,7 @@ from the payment-status enum returned by the award and payment-status endpoints.
     },
     quotes: {
       type: "array",
-      description: "Collected quotes with award linkage. Absent while status is `collecting`.",
+      description: "Collected quotes with award linkage \u2014 those collected so far while `collecting`, the full set once the window closes.",
       items: {
         "$ref": "#/components/schemas/AwardedQuote"
       }
@@ -6624,17 +7160,95 @@ var $AwardAccepted = {
   }
 };
 
+// src/sender_auth_schemes/evm_permit2.ts
+var import_ethers3 = require("ethers");
+var import_evm_escrow_encoding = __toESM(require_dist2());
+function hashRequestId(requestId) {
+  return (0, import_ethers3.keccak256)((0, import_ethers3.toUtf8Bytes)(requestId));
+}
+
+// src/sender_auth_schemes/solana.ts
+var import_ethers4 = require("ethers");
+var import_bs582 = __toESM(require("bs58"));
+var import_solana_escrow_encoding = __toESM(require_dist3());
+var REPLAY_HORIZON_SECS = 128;
+var TOTAL_BUCKETS = 131072;
+var DEPOSIT_MESSAGE_SIZE = 199;
+function base58ToBytes(address) {
+  const bytes = import_bs582.default.decode(address);
+  if (bytes.length !== 32) {
+    throw new Error(`Invalid Solana public key length: expected 32 bytes, got ${bytes.length}`);
+  }
+  return bytes;
+}
+function bytesToHex(bytes) {
+  return (0, import_ethers4.hexlify)(bytes);
+}
+function hexToBytes(hex) {
+  return (0, import_ethers4.getBytes)(hex.startsWith("0x") ? hex : "0x" + hex);
+}
+function generateSolanaPaymentId(requestId, params) {
+  const depositorBytes = base58ToBytes(params.depositor);
+  const reserverBytes = base58ToBytes(params.reserver);
+  const releaserBytes = base58ToBytes(params.releaser);
+  return (0, import_ethers4.keccak256)((0, import_ethers4.concat)([
+    (0, import_ethers4.toUtf8Bytes)(requestId),
+    (0, import_ethers4.toUtf8Bytes)("deposit"),
+    depositorBytes,
+    (0, import_solana_escrow_encoding.encodeU64LE)(params.amount),
+    reserverBytes,
+    releaserBytes,
+    (0, import_solana_escrow_encoding.encodeU64LE)(params.nonce),
+    (0, import_solana_escrow_encoding.encodeU64LE)(params.issuedAt),
+    (0, import_solana_escrow_encoding.encodeU64LE)(params.deadline)
+  ]));
+}
+function createSolanaDepositPrehash(paymentId, params) {
+  return {
+    payment_id: paymentId,
+    depositor: params.depositor,
+    mint: params.mint,
+    amount: params.amount.toString(),
+    reserver: params.reserver,
+    releaser: params.releaser,
+    nonce: params.nonce.toString(),
+    issued_at: params.issuedAt.toString(),
+    deadline: params.deadline.toString()
+  };
+}
+function hashSolanaDeposit(prehash) {
+  const paymentIdBytes = hexToBytes(prehash.payment_id);
+  const depositorBytes = base58ToBytes(prehash.depositor);
+  const mintBytes = base58ToBytes(prehash.mint);
+  const reserverBytes = base58ToBytes(prehash.reserver);
+  const releaserBytes = base58ToBytes(prehash.releaser);
+  return (0, import_ethers4.keccak256)((0, import_ethers4.concat)([
+    (0, import_ethers4.toUtf8Bytes)("deposit"),
+    paymentIdBytes,
+    depositorBytes,
+    mintBytes,
+    (0, import_solana_escrow_encoding.encodeU64LE)(BigInt(prehash.amount)),
+    reserverBytes,
+    releaserBytes,
+    (0, import_solana_escrow_encoding.encodeU64LE)(BigInt(prehash.nonce)),
+    (0, import_solana_escrow_encoding.encodeU64LE)(BigInt(prehash.issued_at)),
+    (0, import_solana_escrow_encoding.encodeU64LE)(BigInt(prehash.deadline))
+  ]));
+}
+function generateSolanaNonce() {
+  return (0, import_solana_escrow_encoding.generateNonce)();
+}
+
 // src/signers/raw.ts
+var import_payment_request_sender_auth = __toESM(require_dist4());
 var RawSenderSigner = class {
-  constructor(adapter, privateKey) {
-    this.adapter = adapter;
-    this.privateKey = privateKey;
+  constructor(network, privateKey) {
+    const adapter = getChainAdapter(network);
     adapter.validatePrivateKey?.(privateKey);
+    this.inner = (0, import_payment_request_sender_auth.localKeySigner)(network, adapter.formatPrivateKey(privateKey));
   }
-  async sign(signedMessage) {
-    const signature = await this.adapter.sign(signedMessage, this.privateKey);
-    const delegateSigner = this.adapter.deriveDelegateSigner?.(this.privateKey);
-    return { signature, ...delegateSigner ? { delegateSigner } : {} };
+  sign(signedMessage) {
+    return this.inner.sign(signedMessage);
   }
 };
 
@@ -6675,14 +7289,14 @@ function createSenderSigner(sourceChainId, opts) {
   }
   const adapter = getChainAdapter(sourceChainId);
   const privateKey = adapter.formatPrivateKey(opts.privateKey);
-  const signer = new RawSenderSigner(adapter, privateKey);
+  adapter.validatePrivateKey?.(opts.privateKey);
   if (opts.pinnedAddress) {
     if (!adapter.verifyAddressMatchesKey) {
       throw new Error(`pinnedAddress was provided but the ${sourceChainId} adapter cannot verify the key derives it`);
     }
     adapter.verifyAddressMatchesKey(privateKey, opts.pinnedAddress);
   }
-  return signer;
+  return new RawSenderSigner(sourceChainId, opts.privateKey);
 }
 async function resolveTurnkeyAddresses(cfg) {
   const impl = await Promise.resolve().then(() => (init_turnkey_impl(), turnkey_impl_exports));
@@ -6744,12 +7358,68 @@ function resolveDeadlines(params, defaultQuoteSeconds) {
       `quoteDeadlineSeconds (${quoteDeadlineSeconds}) must be strictly less than fulfillmentDeadlineSeconds (${fulfillmentDeadlineSeconds}). The gateway rejects a quote_deadline that is not before fulfillment_deadline.`
     );
   }
-  const now = Date.now();
+  const now = (params.now ?? Date.now)();
   return {
     quote_deadline: new Date(now + quoteDeadlineSeconds * 1e3).toISOString(),
     fulfillment_deadline: new Date(now + fulfillmentDeadlineSeconds * 1e3).toISOString()
   };
 }
+async function assemblePaymentRequest(params) {
+  const sourceChainId = params.sourceAsset.split("/")[0];
+  const namespace = sourceChainId.split(":")[0];
+  const adapter = getChainAdapter(sourceChainId);
+  const nonce = params.nonce ?? (namespace === "solana" ? (0, import_payment_request_sender_auth2.deterministicSolanaNonce)({ requestId: params.requestId, depositor: params.depositor }) : (0, import_payment_request_sender_auth2.deterministicPermitNonce)({ requestId: params.requestId, depositor: params.depositor }));
+  const auth = await (0, import_payment_request_sender_auth2.getChainAdapter)(sourceChainId).buildAuthMessage({
+    sourceAsset: params.sourceAsset,
+    depositor: params.depositor,
+    // The gateway pins the signed deposit amount to max_source_amount (the cap).
+    maxSourceAmount: params.maxSourceAmount,
+    requestId: params.requestId,
+    sourceDefaults: params.sourceDefaults,
+    deadline: params.deadline,
+    nonce,
+    ...namespace === "solana" ? {
+      solanaClockReader: (chainId) => resolveSolanaIssuedAt({
+        sourceChainId: chainId,
+        rpcUrlOverride: params.solanaRpcUrl,
+        reader: params.solanaClockReader
+      })
+    } : {}
+  });
+  const contractOverrides = adapter.resolveContractOverrides?.(params.sourceDefaults);
+  return {
+    version: params.version ?? PAYMENT_REQUEST_VERSION,
+    request_id: params.requestId,
+    source: {
+      asset_identifier: params.sourceAsset,
+      account: params.depositor
+    },
+    destination: [{
+      asset_identifier: params.destinationAsset,
+      account: params.destinationAccount
+    }],
+    fulfillment_amount: params.fulfillmentAmount,
+    max_source_amount: params.maxSourceAmount,
+    quote_deadline: params.quoteDeadline,
+    fulfillment_deadline: params.fulfillmentDeadline,
+    escrow_contract_address: params.sourceDefaults.escrowContract,
+    quote_selector: contractOverrides?.quote_selector ?? params.sourceDefaults.quoteSelector,
+    fulfillment_verifier: contractOverrides?.fulfillment_verifier ?? {
+      account: params.sourceDefaults.fulfillmentVerifierAccount,
+      endpoint: params.sourceDefaults.fulfillmentVerifierEndpoint
+    },
+    fulfillment_proxy: params.fulfillmentProxy,
+    ...params.settlerRequirements ? { settler_requirements: params.settlerRequirements } : {},
+    sender_auth: {
+      message_scheme: auth.messageScheme,
+      signed_messages: [{
+        message: auth.messageHash,
+        message_prehash: auth.messagePrehash,
+        signature: ""
+      }]
+    }
+  };
+}
 var PaymentGatewayClient2 = class extends PaymentGatewayClient {
   constructor(config, HttpRequest = AxiosHttpRequest) {
     super(config, HttpRequest);
@@ -6810,64 +7480,84 @@ var PaymentGatewayClient2 = class extends PaymentGatewayClient {
   }
   /**
    * Prepares a payment request with defaults, ready for signing.
-   * 
+   *
+   * By default this resolves the corridor addresses from the gateway `/defaults`
+   * endpoint. It reaches the gateway only for what the caller has NOT already
+   * supplied via `resolvedDefaults`: supply `resolvedDefaults.source` to skip the
+   * source-chain fetch and `resolvedDefaults.destination` to skip the destination
+   * fetch. Supplying both builds the request **entirely offline** (no network) —
+   * how a caller that already holds the corridor addresses (e.g. from a signed
+   * challenge) constructs and signs a request without gateway access. Such a
+   * caller typically also injects `now` so the deadlines are deterministic.
+   *
+   * @example Minimal — fetch corridor addresses from the gateway, then sign
+   * ```ts
+   * const client = new PaymentGatewayClient({ BASE: "https://gateway.example.com" });
+   *
+   * const request = await client.preparePaymentRequest({
+   *   depositor: "0xPayerAddress",
+   *   sourceAsset: "eip155:8453/erc20:0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",       // USDC on Base
+   *   destinationAccount: "0xMerchantAddress",
+   *   destinationAsset: "eip155:42161/erc20:0xaf88d065e77c8cC2239327C5EDb3A432268e5831", // USDC on Arbitrum
+   *   fulfillmentAmount: "10000000", // 10 USDC (6 decimals)
+   * });
+   * // max_source_amount, deadlines, request id, and nonce are all defaulted.
+   *
+   * const signer = createSenderSigner("eip155:8453", { provider: "raw", privateKey });
+   * await signPaymentRequest(request, signer); // fills sender_auth, ready to submit
+   * ```
+   *
    * @param params Payment parameters
    * @returns A complete PaymentRequest object without the signature
    */
   async preparePaymentRequest(params) {
-    const { quote_deadline, fulfillment_deadline } = resolveDeadlines(params, DEFAULT_PAYMENT_QUOTE_DEADLINE_SECONDS);
+    const now = (params.now ?? Date.now)();
+    const { quote_deadline, fulfillment_deadline } = resolveDeadlines({ ...params, now: () => now }, DEFAULT_PAYMENT_QUOTE_DEADLINE_SECONDS);
     const sourceChainId = params.sourceAsset.split("/")[0];
     const destChainId = params.destinationAsset.split("/")[0];
-    const [sourceDefaults, destDefaults] = await Promise.all([
-      this.fetchChainDefaults(sourceChainId),
-      this.fetchChainDefaults(destChainId)
+    const [sourceDefaults, fulfillmentProxy] = await Promise.all([
+      params.resolvedDefaults?.source ?? this.fetchChainDefaults(sourceChainId),
+      params.resolvedDefaults?.destination?.fulfillmentProxy ?? this.fetchChainDefaults(destChainId).then((d) => d.fulfillmentProxy)
     ]);
-    const requestId = params.requestId || `${params.requestIdPrefix || "pmt-gw-sdk"}-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
-    const adapter = getChainAdapter(sourceChainId);
-    const auth = await adapter.buildAuthMessage({
-      sourceAsset: params.sourceAsset,
+    if (!params.requestId) {
+      throw new Error(
+        "payment-gateway-client: requestId is required \u2014 it is the idempotency key that seeds the deterministic deposit nonce; supply a stable id per logical payment and reuse it on retry"
+      );
+    }
+    const requestId = params.requestId;
+    const sourceNamespace = sourceChainId.split(":")[0];
+    let permitDeadline;
+    if (sourceNamespace !== "solana") {
+      const fulfillmentMs = Date.parse(fulfillment_deadline);
+      if (params.deadlineSeconds !== void 0) {
+        permitDeadline = Math.ceil(now / 1e3) + Math.ceil(params.deadlineSeconds);
+        if (permitDeadline * 1e3 < fulfillmentMs) {
+          throw new Error(
+            `payment-gateway-client: deadlineSeconds (${params.deadlineSeconds}) expires the deposit permit before settlement (fulfillmentDeadlineSeconds). The permit must stay valid until settlement \u2014 pass a deadlineSeconds at least as long as fulfillmentDeadlineSeconds, or omit it to derive it from fulfillment_deadline automatically.`
+          );
+        }
+      } else {
+        permitDeadline = Math.floor(fulfillmentMs / 1e3) + 1;
+      }
+    }
+    return assemblePaymentRequest({
       depositor: params.depositor,
       fulfillmentAmount: params.fulfillmentAmount,
+      sourceAsset: params.sourceAsset,
+      destinationAccount: params.destinationAccount,
+      destinationAsset: params.destinationAsset,
+      maxSourceAmount: params.maxSourceAmount ?? defaultMaxSourceAmount(params.fulfillmentAmount),
       requestId,
+      quoteDeadline: quote_deadline,
+      fulfillmentDeadline: fulfillment_deadline,
       sourceDefaults,
-      deadlineSeconds: params.deadlineSeconds,
-      solanaRpcUrl: params.solanaRpcUrl
+      fulfillmentProxy,
+      nonce: params.nonce,
+      deadline: permitDeadline,
+      solanaRpcUrl: params.solanaRpcUrl,
+      solanaClockReader: params.solanaClockReader,
+      settlerRequirements: params.settlerRequirements
     });
-    const contractOverrides = adapter.resolveContractOverrides?.(sourceDefaults);
-    return {
-      version: PAYMENT_REQUEST_VERSION,
-      request_id: requestId,
-      source: {
-        asset_identifier: params.sourceAsset,
-        account: params.depositor
-      },
-      destination: [{
-        asset_identifier: params.destinationAsset,
-        account: params.destinationAccount
-      }],
-      fulfillment_amount: params.fulfillmentAmount,
-      max_source_amount: params.maxSourceAmount ?? defaultMaxSourceAmount(params.fulfillmentAmount),
-      // REQUIRED (the gateway injects no defaults). Callers can widen the window via
-      // quoteDeadlineSeconds / fulfillmentDeadlineSeconds, e.g. for slow Turnkey signing.
-      quote_deadline,
-      fulfillment_deadline,
-      escrow_contract_address: sourceDefaults.escrowContract,
-      quote_selector: contractOverrides?.quote_selector ?? sourceDefaults.quoteSelector,
-      fulfillment_verifier: contractOverrides?.fulfillment_verifier ?? {
-        account: sourceDefaults.fulfillmentVerifierAccount,
-        endpoint: sourceDefaults.fulfillmentVerifierEndpoint
-      },
-      fulfillment_proxy: destDefaults.fulfillmentProxy,
-      ...params.settlerRequirements ? { settler_requirements: params.settlerRequirements } : {},
-      sender_auth: {
-        message_scheme: auth.messageScheme,
-        signed_messages: [{
-          message: auth.messageHash,
-          message_prehash: auth.messagePrehash,
-          signature: ""
-        }]
-      }
-    };
   }
   /**
    * Prepares a quote-request body (`CreateQuoteRequest`), ready to POST to
@@ -7000,7 +7690,6 @@ var PaymentGatewayClient2 = class extends PaymentGatewayClient {
   PaymentsService,
   QuoteRequestsService,
   REPLAY_HORIZON_SECS,
-  RawSenderSigner,
   TOTAL_BUCKETS,
   TurnkeySenderSigner,
   base58ToBytes,