@capxul/sdk 4.2.0 → 4.20.0-beta.1

package/dist/{signer-C0hZ6Kiy.d.mts → OAuthBearerAuthClient-C-ip-z8M.d.mts}

@@ -1,5 +1,5 @@
-import { Context, Effect } from "effect";
 import { Account, Address, Hex } from "viem";
+import { Context, Effect } from "effect";
 //#region ../errors/src/chain-cause.d.ts
 /**
  * Why an operation failed — the one flat vocabulary. The first four are the
@@ -257,10 +257,6 @@ declare const Errors: {
   }) => CapxulError;
 };
 //#endregion
-//#region ../config/src/capxul-payments-v2.d.ts
-/** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
-declare const CAPXUL_PAYMENTS_V2_ADDRESS: Address;
-//#endregion
 //#region ../types/src/brand.d.ts
 /**
  * Nominal type helper. `Brand<T, B>` is structurally a `T` at runtime but
@@ -275,6 +271,13 @@ type Brand<T, B extends string> = T & {
 //#endregion
 //#region ../types/src/index.d.ts
 type Address$1 = Brand<string, "Address">;
+/** Canonical ERC-20 CAIP-19 identity. Currency is not asset identity. */
+type AssetId = Brand<string, "AssetId">;
+/** One asset quantity in major units. Registry metadata supplies precision. */
+type AssetAmount = {
+  readonly asset: AssetId;
+  readonly value: string;
+};
 type Email = Brand<string, "Email">;
 type TesterKind = "human" | "e2e" | "agent";
 type Profile$1 = {
@@ -375,6 +378,10 @@ declare function toPartyId(raw: unknown): PartyId;
 declare function toHandle(raw: unknown): Handle;
 declare function toCountryCode(raw: unknown): CountryCode;
 //#endregion
+//#region ../config/src/capxul-payments-v2.d.ts
+/** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
+declare const CAPXUL_PAYMENTS_V2_ADDRESS: Address;
+//#endregion
 //#region src/ports/auth-cache.d.ts
 /**
  * AuthCachePort stores the user session and the cached
@@ -601,4 +608,21 @@ interface Eip1193RequestProvider {
  */
 declare function injectedWalletSigner(provider: Eip1193RequestProvider): CapxulSigner;
 //#endregion
-export { PublishableKey as $, AppId as A, EVM_ADDRESS_RE as B, CachedJwt as C, RevertSummary as Ct, AllowanceKey as D, Address$1 as E, ChainId as F, OrgId as G, EpochMs as H, CountryCode as I, PayrollGroupId as J, PartyId as K, CurrencyCode as L, AuthUserId as M, BlockNumber as N, AllowedOrigin as O, BudgetId as P, Profile$1 as Q, DocumentHash as R, AuthCachePortTag as S, FailureMode as St, AccountId as T, Handle as U, Email as V, Money as W, PermissionAssignmentId as X, PayrollRunId as Y, PermissionId as Z, ClockPort as _, isCapxulError as _t, SignerStatusStore as a, WeiAmount as at, AuthCacheError as b, ChainUpstream as bt, AccountProviderSource as c, toHandle as ct, eip1193AccountProvider as d, CAPXUL_ERROR_CODES as dt, RoleKey as et, localPrivateKeyAccountProvider as f, CapxulError as ft, SmartAccount as g, Failure as gt, Session as h, Errors as ht, SignerStatus as i, TxHash as it, AuthSession as j, AnonymousDistinctId as k, AccountRequirement as l, toPartyId as lt, Profile as m, CapxulErrorDetails as mt, CapxulSigner as n, SmartAccount$1 as nt, injectedWalletSigner as o, toAddress as ot, CapxulResult as p, CapxulErrorCode as pt, PaymentCommandId as q, Eip1193RequestProvider as r, TesterKind as rt, AccountProvider as s, toCountryCode as st, CapxulDigestSigner as t, SessionToken as tt, Eip1193Provider as u, CAPXUL_PAYMENTS_V2_ADDRESS as ut, AuthClientPort as v, CHAIN_UPSTREAMS as vt, Account$1 as w, AuthCachePort as x, FAILURE_MODES as xt, CanSendOtpStatus as y, ChainCause as yt, DurationMs as z };
+//#region src/adapters/auth-client/OAuthBearerAuthClient.d.ts
+interface OAuthBearerAuthClientInput {
+  /** The exchange endpoint: `{authBaseUrl}/api/auth/agent/exchange`. */
+  readonly exchangeUrl: string;
+  /** The shared secret the exchange endpoint checks. The caller holds it. */
+  readonly exchangeSecret: string;
+  /** The agent's OAuth access token. */
+  readonly accessToken: string;
+  readonly fetch?: typeof fetch;
+  readonly clock?: ClockPort;
+}
+/**
+ * `AuthClientPort` over the backend agent-token exchange. Build one per OAuth
+ * access token and hand it to `createCapxulClient({ authClient })`.
+ */
+declare function oauthBearerAuthClient(input: OAuthBearerAuthClientInput): AuthClientPort;
+//#endregion
+export { PayrollGroupId as $, AllowanceKey as A, ChainId as B, AuthCachePort as C, ChainCause as Ct, Account$1 as D, RevertSummary as Dt, CAPXUL_PAYMENTS_V2_ADDRESS as E, FailureMode as Et, AssetId as F, EVM_ADDRESS_RE as G, CurrencyCode as H, AuthSession as I, Handle as J, Email as K, AuthUserId as L, AnonymousDistinctId as M, AppId as N, AccountId as O, AssetAmount as P, PaymentCommandId as Q, BlockNumber as R, AuthCacheError as S, CHAIN_UPSTREAMS as St, CachedJwt as T, FAILURE_MODES as Tt, DocumentHash as U, CountryCode as V, DurationMs as W, OrgId as X, Money as Y, PartyId as Z, Session as _, CapxulErrorCode as _t, Eip1193RequestProvider as a, RoleKey as at, AuthClientPort as b, Failure as bt, injectedWalletSigner as c, TesterKind as ct, AccountRequirement as d, toAddress as dt, PayrollRunId as et, Eip1193Provider as f, toCountryCode as ft, Profile as g, CapxulError as gt, CapxulResult as h, CAPXUL_ERROR_CODES as ht, CapxulSigner as i, PublishableKey as it, AllowedOrigin as j, Address$1 as k, AccountProvider as l, TxHash as lt, localPrivateKeyAccountProvider as m, toPartyId as mt, oauthBearerAuthClient as n, PermissionId as nt, SignerStatus as o, SessionToken as ot, eip1193AccountProvider as p, toHandle as pt, EpochMs as q, CapxulDigestSigner as r, Profile$1 as rt, SignerStatusStore as s, SmartAccount$1 as st, OAuthBearerAuthClientInput as t, PermissionAssignmentId as tt, AccountProviderSource as u, WeiAmount as ut, SmartAccount as v, CapxulErrorDetails as vt, AuthCachePortTag as w, ChainUpstream as wt, CanSendOtpStatus as x, isCapxulError as xt, ClockPort as y, Errors as yt, BudgetId as z };

package/dist/{clock-DIfTX44d.mjs → OAuthBearerAuthClient-DDD0JlaI.mjs}

@@ -1,5 +1,5 @@
-import { Context, Data, Effect, Layer, Result } from "effect";
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, padHex, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
+import { Context, Data, Effect, Layer, Result } from "effect";
 //#region ../errors/src/secret-material.ts
 const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
 	"password",
@@ -104,14 +104,19 @@ function redactUrlSecrets(value, source) {
 			changed ||= safeName !== name || safeEntry !== entry;
 			return [safeName, safeEntry];
 		})).toString();
-		const provider = source !== void 0 || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
-		const segments = (absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "").split("/");
-		const path = segments.map((segment, index) => {
+		const provider = source === "alchemy" || source === "infura" || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
+		const rawPath = absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "";
+		const segments = rawPath.split("/");
+		let path = segments.map((segment, index) => {
 			const decoded = decodeUrlComponent(segment);
 			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
 			changed ||= masked !== decoded;
 			return masked === decoded ? segment : encodeURIComponent(masked);
 		}).join("/");
+		if (source === "gateway" && rawPath.length > 0) {
+			path = `${rawPath.startsWith("/") ? "/" : ""}${encodeURIComponent("[REDACTED]")}`;
+			changed = true;
+		}
 		const query = maskParams(url.searchParams);
 		const fragment = url.hash.slice(1);
 		const decodedFragment = decodeUrlComponent(fragment);
@@ -126,6 +131,7 @@ function redactUrlSecrets(value, source) {
 		if (!changed) return value;
 		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
 	} catch {
+		if (source === "gateway") return "[REDACTED]";
 		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
 	}
 }
@@ -841,7 +847,29 @@ function decodeConvexError(err) {
 /** Canonical handle syntax shared by validation and branded constructors. */
 const HANDLE_RE = /^[a-z0-9_-]{3,30}$/;
 //#endregion
+//#region ../config/src/handle.ts
+const RESERVED_HANDLES = /* @__PURE__ */ new Set([
+	"admin",
+	"api",
+	"capxul",
+	"help",
+	"root",
+	"support",
+	"system",
+	"www"
+]);
+function normalizeHandle(raw) {
+	return raw.trim().toLowerCase().replace(/^@/, "");
+}
+function validateHandle(raw) {
+	const handle = normalizeHandle(raw);
+	if (!HANDLE_RE.test(handle)) throw Errors.invalidInput("handle", "must be 3-30 characters of a-z, 0-9, underscore, or hyphen");
+	if (RESERVED_HANDLES.has(handle)) throw Errors.invalidInput("handle", "handle is reserved");
+	return handle;
+}
+//#endregion
 //#region ../types/src/index.ts
+const ASSET_ID_RE = /^eip155:([1-9][0-9]*)\/erc20:(0x[0-9a-f]{40})$/;
 const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;
 const BYTES32_RE = /^0x[0-9a-f]{64}$/i;
 const ZERO_BYTES32 = `0x${"0".repeat(64)}`;
@@ -880,6 +908,7 @@ const COUNTRY_CODE_RE = /^[A-Z]{2}$/;
 const ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;
 const PARTY_ID_RE = /^party_[0-9A-Za-z]+$/;
 const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const TX_HASH_RE = /^0x[0-9a-f]{64}$/i;
 const WEI_RE = /^[0-9]+$/;
 Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
 function toAddress(raw) {
@@ -935,6 +964,10 @@ function toPublishableKey(raw) {
 	if (typeof raw !== "string" || !PUBLISHABLE_KEY_PATTERN.test(raw)) throw Errors.invalidInput("publishableKey", invalidValueReason("must match cap_pk_(test|live) plus 32 Crockford base32 chars", raw));
 	return raw;
 }
+function toTxHash(raw) {
+	if (typeof raw !== "string" || !TX_HASH_RE.test(raw)) throw Errors.invalidInput("txHash", invalidValueReason("must be 0x + 64 hex chars", raw));
+	return raw.toLowerCase();
+}
 function toEpochMs(raw) {
 	assertSafeNonNegativeInteger(raw, "epochMs");
 	return raw;
@@ -943,10 +976,25 @@ function toEpochSeconds(raw) {
 	assertSafeNonNegativeInteger(raw, "epochSeconds");
 	return raw;
 }
+/** Validate an already canonical identity without changing signed input. */
+function toAssetId(raw) {
+	const match = typeof raw === "string" ? ASSET_ID_RE.exec(raw) : null;
+	if (match === null || match[0] !== raw || !Number.isSafeInteger(Number(match[1]))) throw Errors.invalidInput("assetId", "must be a canonical ERC-20 CAIP-19 identifier");
+	if (match[2] === "0x0000000000000000000000000000000000000000") throw Errors.invalidInput("assetId", "must identify a nonzero token contract");
+	return raw;
+}
+/** Build an identity from verified chain facts. Normalize the token address. */
+function assetIdFor(chainId, tokenAddress) {
+	return toAssetId(`eip155:${toChainId(chainId)}/erc20:${toAddress(tokenAddress)}`);
+}
 function toChainId(raw) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
 	return raw;
 }
+function toWeiAmount(raw) {
+	if (typeof raw !== "string" || !WEI_RE.test(raw)) throw Errors.invalidInput("weiAmount", invalidValueReason("must be a non-negative integer string", raw));
+	return raw;
+}
 function toCountryCode(raw) {
 	if (typeof raw !== "string") throw Errors.invalidInput("countryCode", "must be a string");
 	const upper = raw.toUpperCase();
@@ -1005,31 +1053,121 @@ function invalidValueReason(prefix, raw) {
 	return `${prefix}: ${String(raw)}`;
 }
 //#endregion
-//#region ../config/src/handle.ts
-const RESERVED_HANDLES = /* @__PURE__ */ new Set([
-	"admin",
-	"api",
-	"capxul",
-	"help",
-	"root",
-	"support",
-	"system",
-	"www"
-]);
-function normalizeHandle(raw) {
-	return raw.trim().toLowerCase().replace(/^@/, "");
-}
-function validateHandle(raw) {
-	const handle = normalizeHandle(raw);
-	if (!HANDLE_RE.test(handle)) throw Errors.invalidInput("handle", "must be 3-30 characters of a-z, 0-9, underscore, or hyphen");
-	if (RESERVED_HANDLES.has(handle)) throw Errors.invalidInput("handle", "handle is reserved");
-	return handle;
-}
-//#endregion
 //#region ../config/src/tokens.ts
 /** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
 const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
+const USDX_DEPLOYMENT_START_BLOCK = 39860173;
+/**
+* The ERC-20 `symbol()` the deployed `TestUSDC` contract returns
+* (`packages/contracts/src/TestUSDC.sol:10`). It travels with the address and
+* the decimals so a holdings row can never carry one token's address with
+* another token's display symbol. This is the display symbol, not the
+* currency: see `USDX_CURRENCY` below.
+*/
+const USDX_SYMBOL = "USDX";
+const SYNTHETIC_TEST_ASSET_SOURCE = "synthetic-test-liquidity";
+const USDX_ASSET = {
+	assetId: assetIdFor(84532, USDX_ADDRESS_BASE_SEPOLIA),
+	chainId: toChainId(84532),
+	symbol: USDX_SYMBOL,
+	peg: toCurrencyCode("USD"),
+	tokenAddress: USDX_ADDRESS_BASE_SEPOLIA,
+	deploymentStartBlock: USDX_DEPLOYMENT_START_BLOCK,
+	decimals: 6,
+	source: "settlement"
+};
+/**
+* The settlement tier: rows the exact-transfer path and the Movement scanner
+* admit, each carrying the legacy `currency` projection those readers expect.
+* Adding an owned test asset here would put candidate liquidity on the
+* money-write path, so M03's rows go to the candidate tier below instead.
+*/
+const CONFIGURED_MONEY_ASSETS = [{
+	...USDX_ASSET,
+	currency: USDX_ASSET.peg
+}];
+/**
+* The candidate tier: five owned test assets, every field read back from Base
+* Sepolia after the deployment that created it (chain 84532, blocks
+* 46,465,978–46,465,982). Real contracts, authored liquidity, no settlement
+* admission — so rollback is removing consumers, never relabelling a
+* deployed address or deleting its history.
+*
+* `symbol` is the display string the owned contract returns. A
+* provider-supported USDC would be a different contract at a different
+* address returning the same symbol, which is why the resolvers below key on
+* `assetId`, or on chain plus address, and never on a symbol.
+*/
+const SYNTHETIC_TEST_ASSETS = [
+	{
+		assetId: assetIdFor(84532, "0xb3d8566fb90f7df939f4bc08a09b19047117f549"),
+		chainId: toChainId(84532),
+		tokenAddress: "0xb3d8566fb90f7df939f4bc08a09b19047117f549",
+		symbol: "USDC",
+		decimals: 6,
+		peg: toCurrencyCode("USD"),
+		deploymentStartBlock: 46465978,
+		deploymentTransaction: "0xa7fb8bb9d1fd1cc5fe2fc42fa4cdccace7742efae8ea99f091a283e5709343de",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01",
+		symbol: "USDT",
+		decimals: 6,
+		peg: toCurrencyCode("USD"),
+		deploymentStartBlock: 46465979,
+		deploymentTransaction: "0xa17ad76fe8b24cdf1fbcff245c3eb022444710cf9fa7b5ee59818be654f4ae10",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x1d93d525f73453fe18eebf044e8a3954bfe3721e"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x1d93d525f73453fe18eebf044e8a3954bfe3721e",
+		symbol: "WETH",
+		decimals: 18,
+		peg: null,
+		deploymentStartBlock: 46465980,
+		deploymentTransaction: "0xcb9b2d024686fac93ec1243ccf02d3567fd531da46176115660cba2ba644b09d",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624",
+		symbol: "WBTC",
+		decimals: 8,
+		peg: null,
+		deploymentStartBlock: 46465981,
+		deploymentTransaction: "0x728ba7b430ffd141f83d0ed5ce429d050049d7b097c936fd11e9c572d1243854",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x5865fe9787ac214feb5facaebaec06969ac0a9a3"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x5865fe9787ac214feb5facaebaec06969ac0a9a3",
+		symbol: "cNGN",
+		decimals: 6,
+		peg: toCurrencyCode("NGN"),
+		deploymentStartBlock: 46465982,
+		deploymentTransaction: "0xcedf254bcef57fc64189261a5ab1161bc4fde370e470933f627c4d8ddb5a2e26",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	}
+];
+toChainId(84532);
+/**
+* Every known asset in ONE identity space. The tiers above declare admission;
+* this is the only list an identity resolves against, so an asset is never
+* two different things depending on which list a caller happened to read.
+*/
+const MONEY_ASSET_REGISTRY = [...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
+CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
+/** The registry row for `assetId` across every tier, or `null`. */
+function configuredMoneyAssetById(assetId) {
+	const canonical = toAssetId(assetId);
+	return MONEY_ASSET_REGISTRY.find((asset) => asset.assetId === canonical) ?? null;
+}
 //#endregion
 //#region ../config/src/org-payments.ts
 /** Zodiac MultiSendCallOnly module on Base Sepolia. */
@@ -1918,6 +2056,12 @@ const USDX_BASE_SEPOLIA_TOKEN = {
 USDX_BASE_SEPOLIA_TOKEN.chainId;
 USDX_BASE_SEPOLIA_TOKEN.chainId;
 10n ** BigInt(6);
+/**
+* The bootstrap manage role. It administers people and roles, cannot spend,
+* and is not a signer of the Organization Safe; "Owner" implied the latter,
+* so the label is Admin (ruled 2026-09-06).
+*/
+const ADMIN_ROLE_LABEL = "Admin";
 function normalizeOrgRoleLabel(label) {
 	const normalized = label.trim().replace(/\s+/g, " ");
 	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
@@ -1998,6 +2142,26 @@ function errorKind(error) {
 var ClockError = class extends Data.TaggedError("ClockError") {};
 var ClockPortTag = class extends Context.Service()("@capxul/sdk/ports/ClockPort") {};
 //#endregion
+//#region src/adapters/clock/SystemClockAdapter.ts
+var SystemClockAdapter = class {
+	now = Effect.try({
+		try: () => toEpochMs(Date.now()),
+		catch: (cause) => new ClockError({
+			operation: "now",
+			cause
+		})
+	});
+	sleep(duration) {
+		return Effect.callback((resume) => {
+			const timeout = setTimeout(() => resume(Effect.void), duration);
+			return Effect.sync(() => clearTimeout(timeout));
+		});
+	}
+};
+function SystemClockLayer() {
+	return Layer.succeed(ClockPortTag, new SystemClockAdapter());
+}
+//#endregion
 //#region src/ports/auth-cache.ts
 var AuthCacheError = class extends Data.TaggedError("AuthCacheError") {};
 var AuthCachePortTag = class extends Context.Service()("@capxul/sdk/ports/AuthCachePort") {};
@@ -2126,4 +2290,192 @@ async function readClockNow(clock) {
 	}
 }
 //#endregion
-export { CapxulError as $, toAuthUserId as A, toJwtToken as B, WEI_RE as C, toAddress as D, toAccountId as E, toDurationMs as F, toPayrollRunId as G, toOrgId as H, toEmail as I, toSessionToken as J, toPublishableKey as K, toEpochMs as L, toChainId as M, toCountryCode as N, toAllowedOrigin as O, toCurrencyCode as P, CAPXUL_ERROR_CODES as Q, toEpochSeconds as R, SUPPORTED_CURRENCY_CODES as S, currencySymbolFor as T, toPartyId as U, toKycTier as V, toPayrollGroupId as W, HANDLE_RE as X, toTesterKind as Y, decodeConvexError as Z, deriveCapxulSafeAddress as _, parseCachedJwt as a, boundedResponseHeaders as at, BYTES32_RE as b, ClockError as c, decodeChainCause as ct, AuthClientError as d, isFailureMode as dt, EXPECTED_OPERATION_OUTCOMES as et, AuthClientPortTag as f, revertSummaryText as ft, BASE_SEPOLIA_CHAIN_ID as g, redactUrlSecrets as gt, normalizeBindingEmail as h, redactSecrets as ht, parseAuthSession as i, FAILURE_MODES as it, toBudgetId as j, toAppId as k, ClockPortTag as l, failureFingerprint as lt, CAPXUL_PAYMENTS_V2_ADDRESS as m, isCredentialField as mt, InMemoryAuthCacheAdapter as n, isCapxulError as nt, AuthCacheError as o, chainCauseProperties as ot, orgRoleKeyForLabel as p, containsSensitiveMaterial as pt, toRoleKey as q, BrowserAuthCacheAdapter as r, CHAIN_UPSTREAMS as rt, AuthCachePortTag as s, chainEvidenceLabel as st, readClockNow as t, Errors as tt, authClientPortFromPromiseAdapter as u, isChainUpstream as ut, validateHandle as v, ZERO_BYTES32 as w, EVM_ADDRESS_RE as x, APP_ID_RE as y, toHandle as z };
+//#region src/adapters/auth-client/OAuthBearerAuthClient.ts
+const PROVIDER = "agent-exchange";
+/** Re-exchange this far ahead of expiry, matching the JWT cache eviction margin. */
+const REFRESH_MARGIN_MS = 3e4;
+/**
+* `AuthSession.token` is a Better Auth session handle. This flow has none, and
+* the access token must never be copied into it, so the slot holds a placeholder.
+*/
+const OAUTH_SESSION_TOKEN = toSessionToken("oauth-bearer");
+var OAuthBearerAuthClient = class {
+	#exchangeUrl;
+	#exchangeSecret;
+	#accessToken;
+	#fetchImpl;
+	#clock;
+	#cached = null;
+	constructor(input) {
+		this.#exchangeUrl = input.exchangeUrl;
+		this.#exchangeSecret = input.exchangeSecret;
+		this.#accessToken = input.accessToken;
+		this.#fetchImpl = input.fetch ?? fetch;
+		this.#clock = input.clock ?? new SystemClockAdapter();
+	}
+	async canSendOtp() {
+		return refuse("canSendOtp");
+	}
+	async sendOtp() {
+		return refuse("sendOtp");
+	}
+	async verifyOtp() {
+		return refuse("verifyOtp");
+	}
+	/**
+	* The authorization server owns the token's lifetime, so revoking it there is
+	* the sign-out. Reporting success here would claim a token was dropped.
+	*/
+	async signOut() {
+		return refuse("signOut");
+	}
+	/**
+	* The exchanged identity. Unlike the Better Auth adapters this never answers
+	* `null`: the consumer holds a usable access token or a refused one, and a
+	* refused one is a NOT_AUTHENTICATED failure, not the absence of a session.
+	*/
+	async getSession(options) {
+		const exchange = await this.#exchange("getSession", options);
+		if (!exchange.ok) return exchange;
+		return {
+			ok: true,
+			value: {
+				authUserId: toAuthUserId(exchange.value.authUserId),
+				email: toEmail(exchange.value.email),
+				token: OAUTH_SESSION_TOKEN,
+				expiresAt: toEpochMs(exchange.value.expiresAt)
+			}
+		};
+	}
+	async getConvexJwt(options) {
+		const exchange = await this.#exchange("getConvexJwt", options);
+		if (!exchange.ok) return exchange;
+		return {
+			ok: true,
+			value: {
+				token: toJwtToken(exchange.value.token),
+				expEpochSeconds: toEpochSeconds(Math.floor(exchange.value.expiresAt / 1e3))
+			}
+		};
+	}
+	/**
+	* The cached exchange while it is fresh, otherwise a new one. A failed
+	* exchange never replaces the cache, so a stale token is never served.
+	*
+	* lazy: no in-flight de-duplication — two concurrent reads past the margin
+	* each mint a JWT. Minting is idempotent, so the cost is one extra request.
+	*/
+	async #exchange(operation, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation })
+		};
+		const cached = this.#cached;
+		if (cached !== null && options?.forceRefresh !== true) {
+			const now = await readClockNow(this.#clock);
+			if (!now.ok) return now;
+			if (now.value < cached.expiresAt - REFRESH_MARGIN_MS) return {
+				ok: true,
+				value: cached
+			};
+		}
+		return this.#postExchange(operation, options?.signal);
+	}
+	async #postExchange(operation, signal) {
+		let res;
+		try {
+			res = await this.#fetchImpl(this.#exchangeUrl, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${this.#exchangeSecret}`
+				},
+				body: JSON.stringify({ accessToken: this.#accessToken }),
+				...signal === void 0 ? {} : { signal }
+			});
+		} catch (cause) {
+			return {
+				ok: false,
+				error: signal?.aborted === true || isAbortError(cause) ? Errors.cancelled({ operation }) : Errors.networkError(operation, cause)
+			};
+		}
+		if (signal?.aborted === true) return {
+			ok: false,
+			error: Errors.cancelled({ operation })
+		};
+		const body = await res.json().catch(() => null);
+		if (!res.ok) return {
+			ok: false,
+			error: exchangeRefused(operation, res.status, readErrorCode(body))
+		};
+		const exchange = readExchange(body);
+		if (exchange === null) return {
+			ok: false,
+			error: Errors.providerError(PROVIDER, operation, /* @__PURE__ */ new Error("unexpected body"), { httpStatus: res.status })
+		};
+		this.#cached = exchange;
+		return {
+			ok: true,
+			value: exchange
+		};
+	}
+};
+/**
+* `AuthClientPort` over the backend agent-token exchange. Build one per OAuth
+* access token and hand it to `createCapxulClient({ authClient })`.
+*/
+function oauthBearerAuthClient(input) {
+	return authClientPortFromPromiseAdapter(new OAuthBearerAuthClient(input));
+}
+/** The OTP verbs belong to the email flow; `validStates` names it for the caller. */
+function refuse(method) {
+	return {
+		ok: false,
+		error: Errors.wrongState({
+			method,
+			currentState: "oauth-bearer",
+			validStates: ["email-otp"]
+		})
+	};
+}
+/**
+* The error catalog has no FORBIDDEN code, so 403 (`insufficient_scope`) and
+* 503 (`exchange_unconfigured`) both land on PROVIDER_ERROR. `httpStatus` and
+* `details.reason` carry which one the backend reported. Only 401 becomes
+* NOT_AUTHENTICATED, because only 401 is answered by a new access token.
+*/
+function exchangeRefused(operation, status, reason) {
+	if (status === 401) return Errors.notAuthenticated("The exchange refused this OAuth access token");
+	return Errors.providerError(PROVIDER, operation, /* @__PURE__ */ new Error(`HTTP ${status}`), {
+		httpStatus: status,
+		...reason === void 0 ? {} : { details: { reason } }
+	});
+}
+/** An abort raised by something other than the caller's own signal. */
+function isAbortError(cause) {
+	return readField(cause, "name") === "AbortError";
+}
+function readErrorCode(body) {
+	const error = readField(body, "error");
+	return typeof error === "string" ? error : void 0;
+}
+function readField(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	return value[key];
+}
+function readExchange(body) {
+	if (typeof body !== "object" || body === null) return null;
+	const { token, expiresAt, authUserId, email } = body;
+	if (typeof token !== "string" || token.length === 0) return null;
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
+	if (typeof authUserId !== "string" || authUserId.length === 0) return null;
+	if (typeof email !== "string" || email.length === 0) return null;
+	return {
+		token,
+		expiresAt,
+		authUserId,
+		email
+	};
+}
+//#endregion
+export { toRoleKey as $, currencySymbolFor as A, toCurrencyCode as B, ASSET_ID_RE as C, isCredentialField as Ct, WEI_RE as D, SUPPORTED_CURRENCY_CODES as E, toAssetId as F, toHandle as G, toEmail as H, toAuthUserId as I, toOrgId as J, toJwtToken as K, toBudgetId as L, toAddress as M, toAllowedOrigin as N, ZERO_BYTES32 as O, toAppId as P, toPublishableKey as Q, toChainId as R, APP_ID_RE as S, containsSensitiveMaterial as St, EVM_ADDRESS_RE as T, redactUrlSecrets as Tt, toEpochMs as U, toDurationMs as V, toEpochSeconds as W, toPayrollGroupId as X, toPartyId as Y, toPayrollRunId as Z, normalizeBindingEmail as _, decodeChainCause as _t, parseAuthSession as a, HANDLE_RE as at, configuredMoneyAssetById as b, isFailureMode as bt, AuthCachePortTag as c, CapxulError as ct, authClientPortFromPromiseAdapter as d, isCapxulError as dt, toSessionToken as et, AuthClientError as f, CHAIN_UPSTREAMS as ft, CAPXUL_PAYMENTS_V2_ADDRESS as g, chainEvidenceLabel as gt, orgRoleKeyForLabel as h, chainCauseProperties as ht, BrowserAuthCacheAdapter as i, validateHandle as it, toAccountId as j, assetIdFor as k, SystemClockLayer as l, EXPECTED_OPERATION_OUTCOMES as lt, ADMIN_ROLE_LABEL as m, boundedResponseHeaders as mt, readClockNow as n, toTxHash as nt, parseCachedJwt as o, decodeConvexError as ot, AuthClientPortTag as p, FAILURE_MODES as pt, toKycTier as q, InMemoryAuthCacheAdapter as r, toWeiAmount as rt, AuthCacheError as s, CAPXUL_ERROR_CODES as st, oauthBearerAuthClient as t, toTesterKind as tt, ClockPortTag as u, Errors as ut, BASE_SEPOLIA_CHAIN_ID as v, failureFingerprint as vt, BYTES32_RE as w, redactSecrets as wt, ACCOUNT_ID_RE as x, revertSummaryText as xt, deriveCapxulSafeAddress as y, isChainUpstream as yt, toCountryCode as z };