@capxul/sdk 4.1.4 → 4.2.0-rc.2

package/dist/{clock-C2AUlq1V.mjs → OAuthBearerAuthClient-BrbXrndM.mjs}

@@ -1,39 +1,275 @@
-import { Context, Data, Effect, Layer, Result } from "effect";
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, padHex, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
+import { Context, Data, Effect, Layer, Result } from "effect";
 //#region ../errors/src/secret-material.ts
-const SENSITIVE_MATERIAL_PATTERNS = [
-	/(?:^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
-	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
-	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu,
-	/\bBearer\s+[^\s,;]+/iu,
-	/https?:\/\/[^\s"']+?\/v[0-9]\/[A-Za-z0-9_-]{16,}/iu,
-	/\b(?:api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/iu
-];
-const MASKS = [
-	[/\bBearer\s+[^\s,;]+/giu, "Bearer [REDACTED]"],
+const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
+	"password",
+	"passwd",
+	"pwd",
+	"pass",
+	"passphrase",
+	"currentpassword",
+	"newpassword",
+	"confirmpassword",
+	"passwordconfirmation",
+	"passwordhash",
+	"hashedpassword",
+	"pin",
+	"privatekey",
+	"walletprivatekey",
+	"secretkey",
+	"signingkey",
+	"signingsecret",
+	"seed",
+	"seedphrase",
+	"mnemonic",
+	"recoveryphrase",
+	"recovery",
+	"recoverycode",
+	"recoverycodes",
+	"keyshare",
+	"signingmaterial",
+	"recoverymaterial",
+	"privatekeybytes",
+	"signingprivatekey",
+	"encryptionkey",
+	"decryptionkey",
+	"authtoken",
+	"apitoken",
+	"bearertoken",
+	"oauthtoken",
+	"csrftoken",
+	"clientassertion",
+	"token",
+	"accesstoken",
+	"refreshtoken",
+	"idtoken",
+	"sessiontoken",
+	"session",
+	"sessionkey",
+	"sessionsecret",
+	"authsessionid",
+	"sessioncredential",
+	"sessioncredentials",
+	"sessioncookie",
+	"auth",
+	"authentication",
+	"authorization",
+	"proxyauthorization",
+	"cookie",
+	"cookies",
+	"setcookie",
+	"apikey",
+	"xapikey",
+	"xauthtoken",
+	"clientsecret",
+	"secret",
+	"secrets",
+	"credential",
+	"credentials",
+	"signature",
+	"otp",
+	"otpcode",
+	"totpsecret",
+	"onetimecode",
+	"onetimepassword",
+	"verificationcode",
+	"authcode",
+	"authorizationcode",
+	"oauthcode",
+	"codeverifier"
+]);
+/** Match credential fields by meaning, without hiding token addresses or replay IDs. */
+function isCredentialField(name, context) {
+	const normalized = name.toLowerCase().replace(/[^a-z0-9]/gu, "");
+	return CREDENTIAL_FIELDS.has(normalized) || /(?:password(?:hash)?|passwd|passphrase|privatekey|signingkey|apikey|clientsecret|accesstoken|refreshtoken|sessiontoken)$/u.test(normalized) || context === "authentication" && (normalized === "code" || normalized === "sessionid") || context === "header" && /(?:token|secret|apikey|privatekey|signingkey|password|authorization|cookie|session)$/u.test(normalized);
+}
+function decodeUrlComponent(text) {
+	try {
+		return decodeURIComponent(text);
+	} catch {
+		return text;
+	}
+}
+/** Preserve URL diagnostics while removing credentials from their declared components. */
+function redactUrlSecrets(value, source) {
+	try {
+		const absolute = /^[a-z][a-z0-9+.-]*:/iu.test(value);
+		const protocolRelative = value.startsWith("//");
+		const url = new URL(value, "https://redaction.invalid");
+		if (url.protocol !== "https:" && url.protocol !== "http:") return maskText(value);
+		let changed = url.username.length > 0 || url.password.length > 0;
+		const maskParams = (params) => new URLSearchParams(Array.from(params, ([name, entry]) => {
+			const safeName = maskText(name);
+			const safeEntry = isCredentialField(name) || /^(?:code|draft|__posthog)$/iu.test(name) ? "[REDACTED]" : maskText(entry);
+			changed ||= safeName !== name || safeEntry !== entry;
+			return [safeName, safeEntry];
+		})).toString();
+		const provider = source !== void 0 || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
+		const segments = (absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "").split("/");
+		const path = segments.map((segment, index) => {
+			const decoded = decodeUrlComponent(segment);
+			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
+			changed ||= masked !== decoded;
+			return masked === decoded ? segment : encodeURIComponent(masked);
+		}).join("/");
+		const query = maskParams(url.searchParams);
+		const fragment = url.hash.slice(1);
+		const decodedFragment = decodeUrlComponent(fragment);
+		const maskedFragment = maskText(decodedFragment);
+		changed ||= maskedFragment !== decodedFragment;
+		const fragmentQuery = fragment.indexOf("?");
+		const fragmentPath = fragment.slice(0, fragmentQuery);
+		const maskedFragmentPath = maskText(decodeUrlComponent(fragmentPath));
+		changed ||= maskedFragmentPath !== decodeUrlComponent(fragmentPath);
+		const hash = fragmentQuery >= 0 ? `${maskedFragmentPath === decodeUrlComponent(fragmentPath) ? fragmentPath : encodeURIComponent(maskedFragmentPath)}?${maskParams(new URLSearchParams(fragment.slice(fragmentQuery + 1)))}` : fragment.includes("=") ? maskParams(new URLSearchParams(fragment)) : maskedFragment === decodedFragment ? fragment : encodeURIComponent(maskedFragment);
+		const origin = absolute ? url.origin : protocolRelative ? `//${url.host}` : "";
+		if (!changed) return value;
+		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
+	} catch {
+		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
+	}
+}
+const JSON_FIELD = /("(?:[^"\\]|\\.)*")(\s*:\s*)("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/gu;
+const PROSE_FIELD = /(?=(\b([A-Za-z][A-Za-z0-9_-]*(?:[ \t]+[A-Za-z][A-Za-z0-9_-]*){0,3})\s*[:=]\s*((?:Bearer|Basic)[ \t]+[^\s,;"']+|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&"']+)))/gu;
+const EMBEDDED_URL = /(https?:\/\/[^\s"<>]*)/giu;
+function isSecretLabel(name) {
+	return isCredentialField(name) || /^request[ _-]?body$/iu.test(name);
+}
+const JSON_ENCODING_MAX = 8;
+const JSON_NESTING_MAX = 64;
+const JSON_KEY = /("(?:[^"\\]|\\.)*")\s*:/gu;
+const JSON_CONTAINER_START = /(?:\{\s*["}]|\[\s*[[\]{}"0-9tfn-])/uy;
+function hasSecretJsonKey(value) {
+	for (const match of value.matchAll(JSON_KEY)) try {
+		if (match[1] !== void 0 && isSecretLabel(JSON.parse(match[1]))) return true;
+	} catch {}
+	return false;
+}
+/** Project a complete fragment once. Never retry all of its nested substrings. */
+function projectJsonFragment(value, encodingDepth, overDepth) {
+	if (overDepth || encodingDepth >= JSON_ENCODING_MAX) return "[REDACTED]";
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return hasSecretJsonKey(value) ? "[REDACTED]" : value;
+	}
+	try {
+		let changed = false;
+		const masked = JSON.stringify(parsed, (name, nested) => {
+			if (isSecretLabel(name)) {
+				changed ||= nested !== "[REDACTED]";
+				return "[REDACTED]";
+			}
+			if (typeof nested === "string") {
+				const projected = maskJsonFragments(nested, encodingDepth + 1);
+				changed ||= projected !== nested;
+				return projected;
+			}
+			return nested;
+		});
+		return changed ? masked : value;
+	} catch {
+		return "[REDACTED]";
+	}
+}
+/** Scan balanced object/array fragments once, respecting JSON quotes and escapes. */
+function maskJsonFragments(value, encodingDepth = 0) {
+	if (value.trimStart().startsWith("\"")) try {
+		const decoded = JSON.parse(value);
+		if (typeof decoded === "string") {
+			if (encodingDepth >= JSON_ENCODING_MAX) return "\"[REDACTED]\"";
+			const masked = maskJsonFragments(decoded, encodingDepth + 1);
+			return masked === decoded ? value : JSON.stringify(masked);
+		}
+	} catch {}
+	let output = "";
+	let cursor = 0;
+	let start = -1;
+	let depth = 0;
+	let overDepth = false;
+	let quoted = false;
+	let escaped = false;
+	for (let index = 0; index < value.length; index++) {
+		const character = value[index];
+		if (start < 0) {
+			JSON_CONTAINER_START.lastIndex = index;
+			if (!JSON_CONTAINER_START.test(value)) continue;
+			start = index;
+			depth = 1;
+			overDepth = false;
+			continue;
+		}
+		if (quoted) {
+			if (escaped) escaped = false;
+			else if (character === "\\") escaped = true;
+			else if (character === "\"") quoted = false;
+			continue;
+		}
+		if (character === "\"") quoted = true;
+		else if (character === "{" || character === "[") {
+			depth++;
+			overDepth ||= depth > JSON_NESTING_MAX;
+		} else if (character === "}" || character === "]") {
+			depth--;
+			if (depth !== 0) continue;
+			output += value.slice(cursor, start) + projectJsonFragment(value.slice(start, index + 1), encodingDepth, overDepth);
+			cursor = index + 1;
+			start = -1;
+		}
+	}
+	if (start >= 0) {
+		const fragment = value.slice(start);
+		output += value.slice(cursor, start) + (overDepth || hasSecretJsonKey(fragment) ? "[REDACTED]" : fragment);
+		cursor = value.length;
+	}
+	return output + value.slice(cursor);
+}
+function maskLabelledText(value) {
+	const jsonMasked = maskJsonFragments(value).replace(JSON_FIELD, (whole, quotedName, separator) => {
+		try {
+			return isSecretLabel(JSON.parse(quotedName)) ? `${quotedName}${separator}"[REDACTED]"` : whole;
+		} catch {
+			return whole;
+		}
+	});
+	let output = "";
+	let cursor = 0;
+	for (const match of jsonMasked.matchAll(PROSE_FIELD)) {
+		const [, whole, label, entry] = match;
+		if (whole === void 0 || label === void 0 || entry === void 0 || match.index < cursor || /^Bearer[ \t]+/iu.test(entry)) continue;
+		const words = label.split(/[ \t]+/u);
+		for (let index = 0; index < words.length; index++) {
+			const name = words.slice(index).join(" ");
+			if (isSecretLabel(name)) {
+				const prefix = words.slice(0, index).join(" ");
+				output += jsonMasked.slice(cursor, match.index) + `${prefix ? `${prefix} ` : ""}${name}=[REDACTED]`;
+				cursor = match.index + whole.length;
+				break;
+			}
+		}
+	}
+	return output + jsonMasked.slice(cursor);
+}
+const TOKEN_MASKS = [
+	[/\bBearer\s+(?!(?:realm|error|error_description|scope|authorization_uri|resource|claims)\s*=)[^\s,;"']+/giu, "Bearer [REDACTED]"],
 	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
 	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
-	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"],
-	[/(https?:\/\/[^\s"']+?\/v[0-9]\/)[A-Za-z0-9_-]{16,}/giu, "$1[REDACTED]"],
-	[/\b(api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/giu, "$1=[REDACTED]"]
+	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"]
 ];
-/**
-* Reject: does the value carry any known secret material? Best effort — callers
-* drop the whole value on a match; a false negative is a leak, a false positive
-* merely omits an observation field.
-*/
+/** URL components and malformed URLs use this non-recursive masking layer. */
+function maskText(value) {
+	let text = maskLabelledText(value);
+	for (const [pattern, replacement] of TOKEN_MASKS) text = text.replace(pattern, replacement);
+	return text;
+}
+/** Reject only when the same semantic sanitizer removes credential material. */
 function containsSensitiveMaterial(value) {
-	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+	return redactSecrets(value) !== value;
 }
-/**
-* Mask: return the value with every known secret rewritten to `[REDACTED]`,
-* preserving surrounding text. Used where a value must still be shown (log
-* lines, provider messages, PostHog rows) but must not carry live credentials.
-*/
-function redactSecrets(value) {
-	let text = value;
-	for (const [pattern, replacement] of MASKS) text = text.replace(pattern, replacement);
-	return text;
+/** Mask credential fields and embedded URLs while preserving surrounding evidence. */
+function redactSecrets(value, source) {
+	return maskLabelledText(value).split(EMBEDDED_URL).map((part, index) => index % 2 === 1 ? redactUrlSecrets(part, source).replaceAll("%5BREDACTED%5D", "[REDACTED]") : maskText(part)).join("");
 }
 //#endregion
 //#region ../errors/src/chain-cause.ts
@@ -605,7 +841,29 @@ function decodeConvexError(err) {
 /** Canonical handle syntax shared by validation and branded constructors. */
 const HANDLE_RE = /^[a-z0-9_-]{3,30}$/;
 //#endregion
+//#region ../config/src/handle.ts
+const RESERVED_HANDLES = /* @__PURE__ */ new Set([
+	"admin",
+	"api",
+	"capxul",
+	"help",
+	"root",
+	"support",
+	"system",
+	"www"
+]);
+function normalizeHandle(raw) {
+	return raw.trim().toLowerCase().replace(/^@/, "");
+}
+function validateHandle(raw) {
+	const handle = normalizeHandle(raw);
+	if (!HANDLE_RE.test(handle)) throw Errors.invalidInput("handle", "must be 3-30 characters of a-z, 0-9, underscore, or hyphen");
+	if (RESERVED_HANDLES.has(handle)) throw Errors.invalidInput("handle", "handle is reserved");
+	return handle;
+}
+//#endregion
 //#region ../types/src/index.ts
+const ASSET_ID_RE = /^eip155:([1-9][0-9]*)\/erc20:(0x[0-9a-f]{40})$/;
 const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;
 const BYTES32_RE = /^0x[0-9a-f]{64}$/i;
 const ZERO_BYTES32 = `0x${"0".repeat(64)}`;
@@ -707,6 +965,17 @@ function toEpochSeconds(raw) {
 	assertSafeNonNegativeInteger(raw, "epochSeconds");
 	return raw;
 }
+/** Validate an already canonical identity without changing signed input. */
+function toAssetId(raw) {
+	const match = typeof raw === "string" ? ASSET_ID_RE.exec(raw) : null;
+	if (match === null || match[0] !== raw || !Number.isSafeInteger(Number(match[1]))) throw Errors.invalidInput("assetId", "must be a canonical ERC-20 CAIP-19 identifier");
+	if (match[2] === "0x0000000000000000000000000000000000000000") throw Errors.invalidInput("assetId", "must identify a nonzero token contract");
+	return raw;
+}
+/** Build an identity from verified chain facts. Normalize the token address. */
+function assetIdFor(chainId, tokenAddress) {
+	return toAssetId(`eip155:${toChainId(chainId)}/erc20:${toAddress(tokenAddress)}`);
+}
 function toChainId(raw) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
 	return raw;
@@ -769,31 +1038,27 @@ function invalidValueReason(prefix, raw) {
 	return `${prefix}: ${String(raw)}`;
 }
 //#endregion
-//#region ../config/src/handle.ts
-const RESERVED_HANDLES = /* @__PURE__ */ new Set([
-	"admin",
-	"api",
-	"capxul",
-	"help",
-	"root",
-	"support",
-	"system",
-	"www"
-]);
-function normalizeHandle(raw) {
-	return raw.trim().toLowerCase().replace(/^@/, "");
-}
-function validateHandle(raw) {
-	const handle = normalizeHandle(raw);
-	if (!HANDLE_RE.test(handle)) throw Errors.invalidInput("handle", "must be 3-30 characters of a-z, 0-9, underscore, or hyphen");
-	if (RESERVED_HANDLES.has(handle)) throw Errors.invalidInput("handle", "handle is reserved");
-	return handle;
-}
-//#endregion
 //#region ../config/src/tokens.ts
 /** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
 const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
+const USDX_ASSET = {
+	assetId: assetIdFor(84532, USDX_ADDRESS_BASE_SEPOLIA),
+	chainId: toChainId(84532),
+	symbol: "USDX",
+	peg: toCurrencyCode("USD"),
+	tokenAddress: USDX_ADDRESS_BASE_SEPOLIA,
+	deploymentStartBlock: 39860173,
+	decimals: 6
+};
+const CONFIGURED_MONEY_ASSETS = [{
+	...USDX_ASSET,
+	currency: USDX_ASSET.peg
+}];
+CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
+function configuredMoneyAssetById(assetId) {
+	const canonical = toAssetId(assetId);
+	return CONFIGURED_MONEY_ASSETS.find((asset) => asset.assetId === canonical) ?? null;
+}
 //#endregion
 //#region ../config/src/org-payments.ts
 /** Zodiac MultiSendCallOnly module on Base Sepolia. */
@@ -1762,6 +2027,26 @@ function errorKind(error) {
 var ClockError = class extends Data.TaggedError("ClockError") {};
 var ClockPortTag = class extends Context.Service()("@capxul/sdk/ports/ClockPort") {};
 //#endregion
+//#region src/adapters/clock/SystemClockAdapter.ts
+var SystemClockAdapter = class {
+	now = Effect.try({
+		try: () => toEpochMs(Date.now()),
+		catch: (cause) => new ClockError({
+			operation: "now",
+			cause
+		})
+	});
+	sleep(duration) {
+		return Effect.callback((resume) => {
+			const timeout = setTimeout(() => resume(Effect.void), duration);
+			return Effect.sync(() => clearTimeout(timeout));
+		});
+	}
+};
+function SystemClockLayer() {
+	return Layer.succeed(ClockPortTag, new SystemClockAdapter());
+}
+//#endregion
 //#region src/ports/auth-cache.ts
 var AuthCacheError = class extends Data.TaggedError("AuthCacheError") {};
 var AuthCachePortTag = class extends Context.Service()("@capxul/sdk/ports/AuthCachePort") {};
@@ -1890,4 +2175,192 @@ async function readClockNow(clock) {
 	}
 }
 //#endregion
-export { CapxulError as $, toAuthUserId as A, toJwtToken as B, WEI_RE as C, toAddress as D, toAccountId as E, toDurationMs as F, toPayrollRunId as G, toOrgId as H, toEmail as I, toSessionToken as J, toPublishableKey as K, toEpochMs as L, toChainId as M, toCountryCode as N, toAllowedOrigin as O, toCurrencyCode as P, CAPXUL_ERROR_CODES as Q, toEpochSeconds as R, SUPPORTED_CURRENCY_CODES as S, currencySymbolFor as T, toPartyId as U, toKycTier as V, toPayrollGroupId as W, HANDLE_RE as X, toTesterKind as Y, decodeConvexError as Z, deriveCapxulSafeAddress as _, parseCachedJwt as a, boundedResponseHeaders as at, BYTES32_RE as b, ClockError as c, decodeChainCause as ct, AuthClientError as d, isFailureMode as dt, EXPECTED_OPERATION_OUTCOMES as et, AuthClientPortTag as f, revertSummaryText as ft, BASE_SEPOLIA_CHAIN_ID as g, normalizeBindingEmail as h, parseAuthSession as i, FAILURE_MODES as it, toBudgetId as j, toAppId as k, ClockPortTag as l, failureFingerprint as lt, CAPXUL_PAYMENTS_V2_ADDRESS as m, redactSecrets as mt, InMemoryAuthCacheAdapter as n, isCapxulError as nt, AuthCacheError as o, chainCauseProperties as ot, orgRoleKeyForLabel as p, containsSensitiveMaterial as pt, toRoleKey as q, BrowserAuthCacheAdapter as r, CHAIN_UPSTREAMS as rt, AuthCachePortTag as s, chainEvidenceLabel as st, readClockNow as t, Errors as tt, authClientPortFromPromiseAdapter as u, isChainUpstream as ut, validateHandle as v, ZERO_BYTES32 as w, EVM_ADDRESS_RE as x, APP_ID_RE as y, toHandle as z };
+//#region src/adapters/auth-client/OAuthBearerAuthClient.ts
+const PROVIDER = "agent-exchange";
+/** Re-exchange this far ahead of expiry, matching the JWT cache eviction margin. */
+const REFRESH_MARGIN_MS = 3e4;
+/**
+* `AuthSession.token` is a Better Auth session handle. This flow has none, and
+* the access token must never be copied into it, so the slot holds a placeholder.
+*/
+const OAUTH_SESSION_TOKEN = toSessionToken("oauth-bearer");
+var OAuthBearerAuthClient = class {
+	#exchangeUrl;
+	#exchangeSecret;
+	#accessToken;
+	#fetchImpl;
+	#clock;
+	#cached = null;
+	constructor(input) {
+		this.#exchangeUrl = input.exchangeUrl;
+		this.#exchangeSecret = input.exchangeSecret;
+		this.#accessToken = input.accessToken;
+		this.#fetchImpl = input.fetch ?? fetch;
+		this.#clock = input.clock ?? new SystemClockAdapter();
+	}
+	async canSendOtp() {
+		return refuse("canSendOtp");
+	}
+	async sendOtp() {
+		return refuse("sendOtp");
+	}
+	async verifyOtp() {
+		return refuse("verifyOtp");
+	}
+	/**
+	* The authorization server owns the token's lifetime, so revoking it there is
+	* the sign-out. Reporting success here would claim a token was dropped.
+	*/
+	async signOut() {
+		return refuse("signOut");
+	}
+	/**
+	* The exchanged identity. Unlike the Better Auth adapters this never answers
+	* `null`: the consumer holds a usable access token or a refused one, and a
+	* refused one is a NOT_AUTHENTICATED failure, not the absence of a session.
+	*/
+	async getSession(options) {
+		const exchange = await this.#exchange("getSession", options);
+		if (!exchange.ok) return exchange;
+		return {
+			ok: true,
+			value: {
+				authUserId: toAuthUserId(exchange.value.authUserId),
+				email: toEmail(exchange.value.email),
+				token: OAUTH_SESSION_TOKEN,
+				expiresAt: toEpochMs(exchange.value.expiresAt)
+			}
+		};
+	}
+	async getConvexJwt(options) {
+		const exchange = await this.#exchange("getConvexJwt", options);
+		if (!exchange.ok) return exchange;
+		return {
+			ok: true,
+			value: {
+				token: toJwtToken(exchange.value.token),
+				expEpochSeconds: toEpochSeconds(Math.floor(exchange.value.expiresAt / 1e3))
+			}
+		};
+	}
+	/**
+	* The cached exchange while it is fresh, otherwise a new one. A failed
+	* exchange never replaces the cache, so a stale token is never served.
+	*
+	* lazy: no in-flight de-duplication — two concurrent reads past the margin
+	* each mint a JWT. Minting is idempotent, so the cost is one extra request.
+	*/
+	async #exchange(operation, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation })
+		};
+		const cached = this.#cached;
+		if (cached !== null && options?.forceRefresh !== true) {
+			const now = await readClockNow(this.#clock);
+			if (!now.ok) return now;
+			if (now.value < cached.expiresAt - REFRESH_MARGIN_MS) return {
+				ok: true,
+				value: cached
+			};
+		}
+		return this.#postExchange(operation, options?.signal);
+	}
+	async #postExchange(operation, signal) {
+		let res;
+		try {
+			res = await this.#fetchImpl(this.#exchangeUrl, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${this.#exchangeSecret}`
+				},
+				body: JSON.stringify({ accessToken: this.#accessToken }),
+				...signal === void 0 ? {} : { signal }
+			});
+		} catch (cause) {
+			return {
+				ok: false,
+				error: signal?.aborted === true || isAbortError(cause) ? Errors.cancelled({ operation }) : Errors.networkError(operation, cause)
+			};
+		}
+		if (signal?.aborted === true) return {
+			ok: false,
+			error: Errors.cancelled({ operation })
+		};
+		const body = await res.json().catch(() => null);
+		if (!res.ok) return {
+			ok: false,
+			error: exchangeRefused(operation, res.status, readErrorCode(body))
+		};
+		const exchange = readExchange(body);
+		if (exchange === null) return {
+			ok: false,
+			error: Errors.providerError(PROVIDER, operation, /* @__PURE__ */ new Error("unexpected body"), { httpStatus: res.status })
+		};
+		this.#cached = exchange;
+		return {
+			ok: true,
+			value: exchange
+		};
+	}
+};
+/**
+* `AuthClientPort` over the backend agent-token exchange. Build one per OAuth
+* access token and hand it to `createCapxulClient({ authClient })`.
+*/
+function oauthBearerAuthClient(input) {
+	return authClientPortFromPromiseAdapter(new OAuthBearerAuthClient(input));
+}
+/** The OTP verbs belong to the email flow; `validStates` names it for the caller. */
+function refuse(method) {
+	return {
+		ok: false,
+		error: Errors.wrongState({
+			method,
+			currentState: "oauth-bearer",
+			validStates: ["email-otp"]
+		})
+	};
+}
+/**
+* The error catalog has no FORBIDDEN code, so 403 (`insufficient_scope`) and
+* 503 (`exchange_unconfigured`) both land on PROVIDER_ERROR. `httpStatus` and
+* `details.reason` carry which one the backend reported. Only 401 becomes
+* NOT_AUTHENTICATED, because only 401 is answered by a new access token.
+*/
+function exchangeRefused(operation, status, reason) {
+	if (status === 401) return Errors.notAuthenticated("The exchange refused this OAuth access token");
+	return Errors.providerError(PROVIDER, operation, /* @__PURE__ */ new Error(`HTTP ${status}`), {
+		httpStatus: status,
+		...reason === void 0 ? {} : { details: { reason } }
+	});
+}
+/** An abort raised by something other than the caller's own signal. */
+function isAbortError(cause) {
+	return readField(cause, "name") === "AbortError";
+}
+function readErrorCode(body) {
+	const error = readField(body, "error");
+	return typeof error === "string" ? error : void 0;
+}
+function readField(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	return value[key];
+}
+function readExchange(body) {
+	if (typeof body !== "object" || body === null) return null;
+	const { token, expiresAt, authUserId, email } = body;
+	if (typeof token !== "string" || token.length === 0) return null;
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
+	if (typeof authUserId !== "string" || authUserId.length === 0) return null;
+	if (typeof email !== "string" || email.length === 0) return null;
+	return {
+		token,
+		expiresAt,
+		authUserId,
+		email
+	};
+}
+//#endregion
+export { toTesterKind as $, toAccountId as A, toEmail as B, BYTES32_RE as C, ZERO_BYTES32 as D, WEI_RE as E, toBudgetId as F, toKycTier as G, toEpochSeconds as H, toChainId as I, toPayrollGroupId as J, toOrgId as K, toCountryCode as L, toAllowedOrigin as M, toAppId as N, assetIdFor as O, toAuthUserId as P, toSessionToken as Q, toCurrencyCode as R, ASSET_ID_RE as S, SUPPORTED_CURRENCY_CODES as T, toHandle as U, toEpochMs as V, toJwtToken as W, toPublishableKey as X, toPayrollRunId as Y, toRoleKey as Z, BASE_SEPOLIA_CHAIN_ID as _, revertSummaryText as _t, parseAuthSession as a, EXPECTED_OPERATION_OUTCOMES as at, ACCOUNT_ID_RE as b, redactSecrets as bt, AuthCachePortTag as c, CHAIN_UPSTREAMS as ct, authClientPortFromPromiseAdapter as d, chainCauseProperties as dt, validateHandle as et, AuthClientError as f, chainEvidenceLabel as ft, normalizeBindingEmail as g, isFailureMode as gt, CAPXUL_PAYMENTS_V2_ADDRESS as h, isChainUpstream as ht, BrowserAuthCacheAdapter as i, CapxulError as it, toAddress as j, currencySymbolFor as k, SystemClockLayer as l, FAILURE_MODES as lt, orgRoleKeyForLabel as m, failureFingerprint as mt, readClockNow as n, decodeConvexError as nt, parseCachedJwt as o, Errors as ot, AuthClientPortTag as p, decodeChainCause as pt, toPartyId as q, InMemoryAuthCacheAdapter as r, CAPXUL_ERROR_CODES as rt, AuthCacheError as s, isCapxulError as st, oauthBearerAuthClient as t, HANDLE_RE as tt, ClockPortTag as u, boundedResponseHeaders as ut, deriveCapxulSafeAddress as v, containsSensitiveMaterial as vt, EVM_ADDRESS_RE as w, APP_ID_RE as x, redactUrlSecrets as xt, configuredMoneyAssetById as y, isCredentialField as yt, toDurationMs as z };