@catena/sdk 0.0.0-bootstrap.0 → 0.1.0

package/dist/client-CHZMO00P.mjs

@@ -0,0 +1,857 @@
+import { InvalidKeyError, p256KeypairFromPrivateKeyHex, p256PointFromCompressedHex, p256PublicKeyThumbprintFromPoint } from "./keypair.mjs";
+import { ApiKeyStamper } from "@turnkey/api-key-stamper";
+import * as v from "valibot";
+import { createHash, createPrivateKey, randomBytes, sign } from "node:crypto";
+//#region src/request-signing.ts
+const COVERED_COMPONENTS = "(\"@method\" \"@target-uri\" \"content-digest\" \"signature-agent\")";
+const ALGORITHM = "ecdsa-p256-sha256";
+const IDENTITY_URL = /^https?:\/\/[\x21\x23-\x7e]{1,255}$/;
+const NONCE = /^[\x21\x23-\x3a\x3c-\x7e]{1,128}$/;
+function agentKeyIdentityUrl(bankUrl, keyId) {
+	return `${bankUrl.replace(/\/+$/, "")}/agent-keys/${keyId}`;
+}
+function createAgentRequestSigner(options) {
+	const key = buildSignerKey(options.keypair);
+	const state = {
+		...key,
+		identityUrl: validatedIdentityUrl(options.identityUrl ?? agentKeyIdentityUrl(options.baseUrl, key.keyId))
+	};
+	return { sign: async (request) => {
+		const body = new Uint8Array(await request.clone().arrayBuffer());
+		const signatureHeaders = signRequest(state, {
+			method: request.method,
+			url: request.url,
+			body
+		}, {
+			nonce: randomBytes(16).toString("base64url"),
+			createdAt: new Date()
+		});
+		const headers = new Headers(request.headers);
+		for (const [name, value] of Object.entries(signatureHeaders)) headers.set(name, value);
+		return new Request(request, { headers });
+	} };
+}
+function buildSignerKey(keypair) {
+	const point = p256PointFromCompressedHex(keypair.publicKeyHex);
+	if (point === null) throw new Error("signer keypair has an invalid P-256 public key");
+	return {
+		signingKey: p256SigningKey(point, keypair.privateKeyHex),
+		keyId: p256PublicKeyThumbprintFromPoint(point)
+	};
+}
+function validatedIdentityUrl(identityUrl) {
+	if (!IDENTITY_URL.test(identityUrl)) throw new Error(`identity URL is outside the signature profile: "${identityUrl}"`);
+	return identityUrl;
+}
+function signRequest(state, request, params) {
+	if (!NONCE.test(params.nonce)) throw new Error("nonce is outside the signature profile");
+	const contentDigest = contentDigestHeader(request.body);
+	const signatureAgent = `"${state.identityUrl}"`;
+	const created = Math.floor(params.createdAt.getTime() / 1e3);
+	const signatureParams = `${COVERED_COMPONENTS};created=${created};keyid="${state.keyId}";nonce="${params.nonce}";alg="${ALGORITHM}"`;
+	const signatureBase = [
+		`"@method": ${request.method.toUpperCase()}`,
+		`"@target-uri": ${canonicalTargetUri(new URL(request.url))}`,
+		`"content-digest": ${contentDigest}`,
+		`"signature-agent": ${signatureAgent}`,
+		`"@signature-params": ${signatureParams}`
+	].join("\n");
+	const signature = sign("sha256", Buffer.from(signatureBase, "utf8"), {
+		key: state.signingKey,
+		dsaEncoding: "ieee-p1363"
+	});
+	return {
+		"Content-Digest": contentDigest,
+		"Signature-Agent": signatureAgent,
+		"Signature-Input": `sig=${signatureParams}`,
+		Signature: `sig=:${signature.toString("base64")}:`
+	};
+}
+function contentDigestHeader(body) {
+	return `sha-256=:${createHash("sha256").update(body ?? "").digest("base64")}:`;
+}
+function canonicalTargetUri(url) {
+	return `${url.protocol}//${stripDefaultPort(url)}${url.pathname}${url.search}`;
+}
+function stripDefaultPort(url) {
+	const host = url.host.toLowerCase();
+	if (url.protocol === "https:" && url.port === "443" || url.protocol === "http:" && url.port === "80") return url.hostname.toLowerCase();
+	return host;
+}
+function p256SigningKey(point, privateKeyHex) {
+	return createPrivateKey({
+		key: {
+			kty: "EC",
+			crv: "P-256",
+			d: Buffer.from(privateKeyHex, "hex").toString("base64url"),
+			x: point.subarray(1, 33).toString("base64url"),
+			y: point.subarray(33, 65).toString("base64url")
+		},
+		format: "jwk"
+	});
+}
+//#endregion
+//#region package.json
+var version = "0.1.0";
+//#endregion
+//#region src/user-agent.ts
+const HTTP_TOKEN_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const AGENT_CLIENT_VERSION = version;
+function assertHttpToken(value, field) {
+	if (!HTTP_TOKEN_RE.test(value)) throw new Error(`${field} must be a valid HTTP token`);
+}
+function assertUaCommentSafe(value, field) {
+	let hasUnrepresentableCharacter = false;
+	for (let i = 0; i < value.length; i += 1) {
+		const code = value.charCodeAt(i);
+		if (code < 32 || code === 127 || code > 255) {
+			hasUnrepresentableCharacter = true;
+			break;
+		}
+	}
+	if (hasUnrepresentableCharacter || /[()\\]/.test(value)) throw new Error(`${field} must not contain parentheses, backslashes, control characters, or characters outside Latin-1`);
+}
+function buildUserAgent(appInfo) {
+	const sdkProduct = `catena-agent-client/${AGENT_CLIENT_VERSION}`;
+	if (!appInfo) return sdkProduct;
+	assertHttpToken(appInfo.name, "appInfo.name");
+	if (appInfo.version !== void 0) assertHttpToken(appInfo.version, "appInfo.version");
+	if (appInfo.url !== void 0) assertUaCommentSafe(appInfo.url, "appInfo.url");
+	const product = appInfo.version === void 0 ? appInfo.name : `${appInfo.name}/${appInfo.version}`;
+	return `${appInfo.url === void 0 ? product : `${product} (${appInfo.url})`} ${sdkProduct}`;
+}
+//#endregion
+//#region src/lib/payment-credential.ts
+const paymentCredentialDataSchema = v.object({ paymentCredential: v.object({
+	protocol: v.picklist(["mpp", "x402"]),
+	value: v.string()
+}) });
+function paymentCredentialFromIntentData(data, protocol) {
+	const credential = v.safeParse(paymentCredentialDataSchema, data);
+	return credential.success && credential.output.paymentCredential.protocol === protocol ? credential.output.paymentCredential.value : void 0;
+}
+//#endregion
+//#region src/offer-receipt.ts
+const OFFER_RECEIPT_EXTENSION_KEY = "offer-receipt";
+const MAX_ARTIFACT_BYTES = 8192;
+const jwsCompactSchema = v.pipe(v.string(), v.maxLength(MAX_ARTIFACT_BYTES), v.regex(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, "Expected a JWS compact serialization"));
+const acceptIndexSchema = v.optional(v.pipe(v.number(), v.integer(), v.minValue(0)));
+const eip712SignatureSchema = v.pipe(v.string(), v.regex(/^0x[0-9a-fA-F]{130}$/, "Expected a 65-byte hex signature"));
+const x402SignedArtifactSchema = v.variant("format", [v.looseObject({
+	format: v.literal("eip712"),
+	acceptIndex: acceptIndexSchema,
+	payload: v.record(v.string(), v.unknown()),
+	signature: eip712SignatureSchema
+}), v.looseObject({
+	format: v.literal("jws"),
+	acceptIndex: acceptIndexSchema,
+	signature: jwsCompactSchema
+})]);
+const x402SignedReceiptSchema = v.variant("format", [v.looseObject({
+	format: v.literal("eip712"),
+	payload: v.record(v.string(), v.unknown()),
+	signature: eip712SignatureSchema
+}), v.looseObject({
+	format: v.literal("jws"),
+	signature: jwsCompactSchema
+})]);
+const offersEnvelopeSchema = v.object({ [OFFER_RECEIPT_EXTENSION_KEY]: v.object({ info: v.object({ offers: v.array(v.unknown()) }) }) });
+const receiptEnvelopeSchema = v.object({ [OFFER_RECEIPT_EXTENSION_KEY]: v.object({ info: v.object({ receipt: v.unknown() }) }) });
+const offerTermsSchema = v.looseObject({
+	version: v.literal(1),
+	resourceUrl: v.pipe(v.string(), v.maxLength(2048)),
+	scheme: v.pipe(v.string(), v.maxLength(64)),
+	network: v.pipe(v.string(), v.maxLength(64)),
+	asset: v.pipe(v.string(), v.maxLength(128)),
+	payTo: v.pipe(v.string(), v.maxLength(128)),
+	amount: v.pipe(v.string(), v.regex(/^\d+$/), v.maxLength(78)),
+	validUntil: v.optional(v.pipe(v.number(), v.integer(), v.minValue(0)))
+});
+function decodeBase64UrlJson(value) {
+	const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
+	const bytes = Uint8Array.from(atob(normalized), (char) => char.charCodeAt(0));
+	return JSON.parse(new TextDecoder().decode(bytes));
+}
+function artifactTerms(artifact) {
+	if (artifact.format === "eip712") {
+		const parsed = v.safeParse(offerTermsSchema, artifact.payload);
+		return parsed.success ? parsed.output : void 0;
+	}
+	const payloadSegment = artifact.signature.split(".")[1];
+	try {
+		const parsed = v.safeParse(offerTermsSchema, decodeBase64UrlJson(payloadSegment));
+		return parsed.success ? parsed.output : void 0;
+	} catch {
+		return;
+	}
+}
+function sameAddress(a, b) {
+	return a.toLowerCase() === b.toLowerCase();
+}
+function termsMatch(terms, requirement) {
+	return terms.scheme === requirement.scheme && terms.network === requirement.network && sameAddress(terms.asset, requirement.asset) && sameAddress(terms.payTo, requirement.payTo) && terms.amount === requirement.amount;
+}
+function fitsRelayCap(artifact) {
+	return new TextEncoder().encode(JSON.stringify(artifact)).length <= MAX_ARTIFACT_BYTES;
+}
+function extractRelayableOffer(extensions, requirement) {
+	const envelope = v.safeParse(offersEnvelopeSchema, extensions);
+	if (!envelope.success) return;
+	for (const entry of envelope.output[OFFER_RECEIPT_EXTENSION_KEY].info.offers) {
+		const artifact = v.safeParse(x402SignedArtifactSchema, entry);
+		if (!artifact.success) continue;
+		const terms = artifactTerms(artifact.output);
+		if (terms !== void 0 && termsMatch(terms, requirement) && fitsRelayCap(artifact.output)) return artifact.output;
+	}
+}
+function extractRelayableReceipt(extensions) {
+	const envelope = v.safeParse(receiptEnvelopeSchema, extensions);
+	if (!envelope.success) return;
+	const artifact = v.safeParse(x402SignedReceiptSchema, envelope.output[OFFER_RECEIPT_EXTENSION_KEY].info.receipt);
+	if (!artifact.success || !fitsRelayCap(artifact.output)) return;
+	return artifact.output;
+}
+//#endregion
+//#region src/schemas.ts
+const nonBlankResponseEnumSchema = v.pipe(v.string(), v.regex(/\S/, "Response enum values must not be blank"));
+function extensibleStringSchema(_known) {
+	return nonBlankResponseEnumSchema;
+}
+const moneyJsonSchema = v.object({
+	amount: v.string(),
+	asset_id: v.string()
+});
+const isoTimestampSchema = v.pipe(v.string(), v.isoTimestamp());
+const okSuccessResponseSchema = v.object({ success: v.literal(true) });
+const agentSchema = v.object({
+	id: v.string(),
+	name: v.string(),
+	status: v.string(),
+	organizationId: v.string()
+});
+const whoamiResponseSchema = v.object({ agent: agentSchema });
+const POLICY_RULE_TYPES = [
+	"per_transaction_amount",
+	"daily_amount",
+	"weekly_amount",
+	"monthly_amount",
+	"hourly_count",
+	"daily_count"
+];
+const POLICY_RULE_ACTIONS = ["block", "require_approval"];
+const ACCOUNT_AGGREGATION_SCOPES = ["per_account", "across_accounts"];
+const ACTOR_AGGREGATION_SCOPES = ["per_agent", "per_policy"];
+const policyRuleSchema = v.object({
+	id: v.string(),
+	ruleType: extensibleStringSchema(POLICY_RULE_TYPES),
+	thresholdAmount: v.optional(moneyJsonSchema),
+	thresholdCount: v.optional(v.number()),
+	action: extensibleStringSchema(POLICY_RULE_ACTIONS),
+	requiredApprovals: v.number(),
+	accountAggregationScope: extensibleStringSchema(ACCOUNT_AGGREGATION_SCOPES),
+	actorAggregationScope: extensibleStringSchema(ACTOR_AGGREGATION_SCOPES),
+	displayOrder: v.number()
+});
+const POLICY_CAPABILITIES = [
+	"query_balance",
+	"read",
+	"send",
+	"transfer"
+];
+const policyCapabilitySchema = v.object({
+	id: v.string(),
+	organizationId: v.string(),
+	policyId: v.string(),
+	capability: extensibleStringSchema(POLICY_CAPABILITIES),
+	accountId: v.string(),
+	rules: v.array(policyRuleSchema),
+	createdAt: isoTimestampSchema,
+	updatedAt: isoTimestampSchema
+});
+const COUNTERPARTY_ACTIONS = [
+	"allow",
+	"block",
+	"require_approval"
+];
+const COUNTERPARTY_RULE_MODES = ["open", "restricted"];
+const counterpartyActionSchema = extensibleStringSchema(COUNTERPARTY_ACTIONS);
+const counterpartyRulesSchema = v.object({
+	mode: extensibleStringSchema(COUNTERPARTY_RULE_MODES),
+	allowedCounterparties: v.optional(v.array(v.string())),
+	createAction: v.optional(counterpartyActionSchema),
+	requestPaymentDetailsAction: v.optional(counterpartyActionSchema),
+	allowCreate: v.optional(v.boolean())
+});
+const policySchema = v.object({
+	id: v.optional(v.string()),
+	description: v.optional(v.string()),
+	version: v.optional(v.number()),
+	name: v.string(),
+	capabilities: v.array(v.string()),
+	counterpartyRules: v.optional(counterpartyRulesSchema),
+	policyCapabilities: v.array(policyCapabilitySchema),
+	kind: v.optional(v.picklist(["base", "override"])),
+	expiresAt: v.optional(v.string())
+});
+const policyResponseSchema = v.object({ policy: policySchema });
+const accountsResponseSchema = v.object({ accounts: v.array(v.object({
+	id: v.string(),
+	name: v.string(),
+	type: v.string(),
+	currency: v.string()
+})) });
+const accountBalanceResponseSchema = v.object({
+	accountId: v.string(),
+	balance: moneyJsonSchema,
+	balances: v.optional(v.object({
+		total: moneyJsonSchema,
+		available: moneyJsonSchema
+	}))
+});
+const ACCOUNT_TRANSACTION_TYPES = [
+	"operator-send",
+	"operator-transfer",
+	"operator-deposit",
+	"operator-refund",
+	"microdeposit"
+];
+const ACCOUNT_TRANSACTION_STATUSES = [
+	"pending",
+	"processing",
+	"completed",
+	"failed",
+	"reversed"
+];
+const ACCOUNT_TRANSACTION_MOVEMENT_STATUSES = [
+	"initiated",
+	"provider_pending",
+	"processing",
+	"completed",
+	"failed",
+	"reversed",
+	"manual_review"
+];
+const SEND_METHODS = [
+	"ach",
+	"wire",
+	"on-chain"
+];
+const ACCOUNT_TRANSACTION_METHODS = [
+	"ach",
+	"wire",
+	"on-chain"
+];
+const accountTransactionSchema = v.object({
+	id: v.string(),
+	type: extensibleStringSchema(ACCOUNT_TRANSACTION_TYPES),
+	action: v.optional(v.string()),
+	status: extensibleStringSchema(ACCOUNT_TRANSACTION_STATUSES),
+	movementStatus: extensibleStringSchema(ACCOUNT_TRANSACTION_MOVEMENT_STATUSES),
+	direction: v.picklist(["incoming", "outgoing"]),
+	amount: moneyJsonSchema,
+	fee: moneyJsonSchema,
+	currency: v.string(),
+	counterpartyName: v.optional(v.string()),
+	method: v.optional(extensibleStringSchema(ACCOUNT_TRANSACTION_METHODS)),
+	memo: v.optional(v.string()),
+	description: v.optional(v.string()),
+	txHash: v.optional(v.string()),
+	createdAt: isoTimestampSchema,
+	completedAt: v.optional(isoTimestampSchema)
+});
+const accountTransactionsResponseSchema = v.object({
+	accountId: v.string(),
+	transactions: v.array(accountTransactionSchema),
+	total: v.number()
+});
+const ACCOUNT_DEPOSIT_ADDRESS_SOURCES = ["wallet", "liquidation"];
+const accountDepositAddressResponseSchema = v.object({
+	accountId: v.string(),
+	address: v.string(),
+	liquidationAddressId: v.optional(v.string()),
+	source: extensibleStringSchema(ACCOUNT_DEPOSIT_ADDRESS_SOURCES)
+});
+const counterpartySchema = v.object({
+	id: v.string(),
+	name: v.string(),
+	status: v.optional(v.string()),
+	rails: v.array(v.object({
+		id: v.string(),
+		type: v.string(),
+		walletAddress: v.optional(v.string()),
+		network: v.optional(v.string()),
+		bankName: v.optional(v.string()),
+		accountNumber: v.optional(v.string())
+	}))
+});
+const counterpartiesResponseSchema = v.object({ counterparties: v.array(counterpartySchema) });
+const intentStatusSchema = v.picklist([
+	"pending",
+	"processing",
+	"completed",
+	"blocked",
+	"failed"
+]);
+const intentNextActionSchema = v.object({
+	type: v.literal("submit_stamp"),
+	signingRequestId: v.string(),
+	signer: v.object({
+		algorithm: v.literal("p256"),
+		publicKeyHex: v.string()
+	}),
+	preparedBody: v.object({
+		body: v.string(),
+		bodyHash: v.string(),
+		expiresAt: isoTimestampSchema,
+		prepareToken: v.string()
+	})
+});
+const INTENT_ACTION_TYPES = [
+	"send",
+	"transfer",
+	"create_counterparty",
+	"request_counterparty_details",
+	"x402",
+	"mpp",
+	"policy_override"
+];
+const wireIntentResultSchema = v.object({
+	id: v.string(),
+	accountId: v.optional(v.string()),
+	type: extensibleStringSchema(INTENT_ACTION_TYPES),
+	status: intentStatusSchema,
+	reasons: v.array(v.string()),
+	expiresAt: v.optional(v.nullable(isoTimestampSchema), null),
+	replayed: v.optional(v.boolean(), false),
+	data: v.optional(v.nullable(v.record(v.string(), v.unknown())), null),
+	metadata: v.optional(v.object({ dataUrl: v.nullable(v.string()) })),
+	nextAction: v.optional(intentNextActionSchema)
+});
+function toIntentResult(wire) {
+	const { nextAction: _nextAction, ...intent } = wire;
+	return intent;
+}
+const legacyX402IntentDataSchema = v.object({ x402: v.object({ paymentSignature: v.string() }) });
+function x402CredentialFromIntentData(data) {
+	const credential = paymentCredentialFromIntentData(data, "x402");
+	if (credential !== void 0) return credential;
+	const legacy = v.safeParse(legacyX402IntentDataSchema, data);
+	return legacy.success ? legacy.output.x402.paymentSignature : void 0;
+}
+const sendMethodSchema = v.picklist(SEND_METHODS);
+const sendActionSchema = v.object({
+	type: v.literal("send"),
+	accountId: v.optional(v.pipe(v.string(), v.minLength(1))),
+	counterpartyRailId: v.string(),
+	amount: v.string(),
+	method: sendMethodSchema,
+	memo: v.optional(v.string()),
+	description: v.optional(v.string())
+});
+const transferActionSchema = v.object({
+	type: v.literal("transfer"),
+	accountId: v.string(),
+	toAccountId: v.string(),
+	amount: v.string(),
+	memo: v.optional(v.string()),
+	description: v.optional(v.string())
+});
+const createCounterpartyBaseFields = {
+	type: v.literal("create_counterparty"),
+	name: v.string()
+};
+const createCounterpartyActionSchema = v.union([v.object({
+	...createCounterpartyBaseFields,
+	email: v.optional(v.string()),
+	rail: v.nonOptional(v.unknown())
+}), v.object({
+	...createCounterpartyBaseFields,
+	email: v.string()
+})]);
+const requestCounterpartyDetailsActionSchema = v.object({
+	type: v.literal("request_counterparty_details"),
+	counterpartyId: v.string(),
+	methods: v.pipe(v.object({
+		bank: v.boolean(),
+		wallet: v.boolean()
+	}), v.check(({ bank, wallet }) => bank || wallet, "Select at least one payment method to request"))
+});
+const x402PaymentRequirementsSchema = v.looseObject({
+	scheme: v.string(),
+	network: v.string(),
+	asset: v.string(),
+	amount: v.string(),
+	payTo: v.string(),
+	maxTimeoutSeconds: v.number()
+});
+const x402ResourceSchema = v.looseObject({
+	url: v.string(),
+	serviceName: v.fallback(v.optional(v.pipe(v.string(), v.maxLength(255))), void 0)
+});
+const x402AddressSchema = v.pipe(v.string(), v.regex(/^0x[0-9a-fA-F]{40}$/, "Expected a 20-byte hex address"));
+const x402Uint256StringSchema = v.pipe(v.string(), v.maxLength(78), v.regex(/^(0|[1-9]\d*)$/, "Expected a canonical decimal integer string"));
+const x402AuthorizationSchema = v.object({
+	from: x402AddressSchema,
+	to: x402AddressSchema,
+	value: x402Uint256StringSchema,
+	validAfter: x402Uint256StringSchema,
+	validBefore: x402Uint256StringSchema,
+	nonce: v.pipe(v.string(), v.regex(/^0x[0-9a-fA-F]{64}$/, "Expected a 32-byte hex nonce"))
+});
+const x402ActionSchema = v.object({
+	type: v.literal("x402"),
+	accountId: v.string(),
+	paymentRequirements: x402PaymentRequirementsSchema,
+	resource: v.optional(x402ResourceSchema),
+	authorization: v.optional(x402AuthorizationSchema),
+	signedOffer: v.optional(x402SignedArtifactSchema)
+});
+const mppChallengeSchema = v.object({
+	id: v.string(),
+	realm: v.string(),
+	method: v.picklist(["evm", "usdc"]),
+	intent: v.literal("charge"),
+	request: v.string(),
+	description: v.optional(v.string()),
+	digest: v.optional(v.string()),
+	expires: v.string(),
+	header: v.optional(v.literal("Payment-Authorization")),
+	opaque: v.optional(v.string())
+});
+const mppResourceSchema = v.object({
+	url: v.string(),
+	serviceName: v.optional(v.string())
+});
+const mppActionSchema = v.object({
+	type: v.literal("mpp"),
+	accountId: v.string(),
+	challenge: mppChallengeSchema,
+	resource: v.optional(mppResourceSchema)
+});
+const POLICY_OVERRIDE_CAPABILITIES = ["send", "transfer"];
+const policyOverrideAmountOperationSchema = v.strictObject({
+	type: v.literal("increase_limit"),
+	accountId: v.pipe(v.string(), v.minLength(1)),
+	capability: v.picklist(POLICY_OVERRIDE_CAPABILITIES),
+	limitType: v.picklist([
+		"per_transaction_amount",
+		"daily_amount",
+		"weekly_amount",
+		"monthly_amount"
+	]),
+	newLimit: v.strictObject({
+		amount: v.pipe(v.string(), v.regex(/^\d+(\.\d{1,6})?$/), v.check((value) => Number(value) > 0, "The amount must be greater than zero")),
+		assetId: v.literal("USD")
+	})
+});
+const policyOverrideCountOperationSchema = v.strictObject({
+	type: v.literal("increase_limit"),
+	accountId: v.pipe(v.string(), v.minLength(1)),
+	capability: v.picklist(POLICY_OVERRIDE_CAPABILITIES),
+	limitType: v.picklist(["hourly_count", "daily_count"]),
+	newLimit: v.strictObject({ count: v.pipe(v.number(), v.integer(), v.minValue(1)) })
+});
+const policyOverrideOperationsSchema = v.pipe(v.array(v.union([policyOverrideAmountOperationSchema, policyOverrideCountOperationSchema])), v.minLength(1), v.maxLength(10), v.check((operations) => new Set(operations.map((operation) => `${operation.accountId}|${operation.capability}|${operation.limitType}`)).size === operations.length, "Each account, capability, and limit type may appear only once"));
+const policyOverrideActionSchema = v.object({
+	type: v.literal("policy_override"),
+	operations: policyOverrideOperationsSchema,
+	durationSeconds: v.pipe(v.number(), v.integer(), v.minValue(60), v.maxValue(604800)),
+	reason: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(280))
+});
+const intentActionSchema = v.union([
+	sendActionSchema,
+	transferActionSchema,
+	createCounterpartyActionSchema,
+	requestCounterpartyDetailsActionSchema,
+	x402ActionSchema,
+	mppActionSchema,
+	policyOverrideActionSchema
+]);
+function toWireAction(action) {
+	const parsedAction = v.parse(intentActionSchema, action);
+	if (parsedAction.type === "send" || parsedAction.type === "transfer") return {
+		...parsedAction,
+		amount: {
+			amount: parsedAction.amount,
+			asset_id: "USD"
+		}
+	};
+	if (parsedAction.type === "policy_override") return {
+		...parsedAction,
+		schemaVersion: 1
+	};
+	return parsedAction;
+}
+const submitStampResponseSchema = v.object({ intent: wireIntentResultSchema });
+//#endregion
+//#region src/client.ts
+var ApiError = class extends Error {
+	status;
+	code;
+	details;
+	constructor(status, message, code, details) {
+		super(code ? `API error ${status} [${code}]: ${message}` : `API error ${status}: ${message}`);
+		this.name = "ApiError";
+		this.status = status;
+		this.code = code;
+		this.details = details;
+	}
+};
+var TimeoutError = class extends Error {
+	timeoutMs;
+	constructor(timeoutMs) {
+		super(`Request timed out after ${timeoutMs}ms. The server may still have processed a state-changing request; follow that operation's documented recovery procedure before retrying.`);
+		this.name = "TimeoutError";
+		this.timeoutMs = timeoutMs;
+	}
+};
+const errorBodySchema = v.object({
+	error: v.nullish(v.string()),
+	message: v.nullish(v.string()),
+	code: v.nullish(v.string()),
+	details: v.nullish(v.record(v.string(), v.unknown()))
+});
+async function apiErrorFromResponse(res) {
+	const parsed = v.safeParse(errorBodySchema, await res.json().catch(() => void 0));
+	const body = parsed.success ? parsed.output : {};
+	if (body.error != null && body.message != null) return new ApiError(res.status, body.message, body.code ?? body.error, body.details ?? void 0);
+	return new ApiError(res.status, body.error ?? body.message ?? res.statusText, body.code ?? void 0, body.details ?? void 0);
+}
+async function parseApiResponse(res, schema) {
+	if (!res.ok) throw await apiErrorFromResponse(res);
+	return v.parse(schema, await res.json());
+}
+var IntentSubmitError = class extends Error {
+	intentId;
+	outcome;
+	constructor(params) {
+		const detail = params.cause instanceof Error ? params.cause.message : String(params.cause);
+		super(params.outcome === "not-submitted" ? `Intent ${params.intentId} was created but never submitted; no money moved: ${detail}` : `Intent ${params.intentId} submission could not be confirmed: ${detail}; poll getIntent("${params.intentId}") to a terminal status and resubmit only after blocked or failed`, { cause: params.cause });
+		this.name = "IntentSubmitError";
+		this.intentId = params.intentId;
+		this.outcome = params.outcome;
+	}
+};
+const DEFAULT_BASE_URL = "https://api.catena.com";
+const DEFAULT_TIMEOUT_MS = 8e4;
+const MAX_TIMEOUT_MS = 2147483647;
+var CatenaClient = class {
+	#baseUrl;
+	#userAgent;
+	#defaultHeaders;
+	#keypair;
+	#signer;
+	#fetch;
+	#timeoutMs;
+	constructor(opts) {
+		const timeoutMs = opts.timeout === void 0 ? DEFAULT_TIMEOUT_MS : opts.timeout;
+		if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMEOUT_MS) throw new TypeError(`timeout must be a positive integer no greater than ${MAX_TIMEOUT_MS}`);
+		this.#baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
+		this.#userAgent = buildUserAgent(opts.appInfo);
+		this.#defaultHeaders = opts.defaultHeaders ?? {};
+		this.#keypair = p256KeypairFromPrivateKeyHex(opts.privateKeyHex);
+		this.#fetch = (opts.fetch ?? globalThis.fetch).bind(globalThis);
+		this.#timeoutMs = timeoutMs;
+		this.#signer = createAgentRequestSigner({
+			keypair: this.#keypair,
+			baseUrl: this.#baseUrl,
+			identityUrl: opts.identityUrl
+		});
+	}
+	#buildRequestHeaders(requestHeaders) {
+		const headers = new Headers({ "Content-Type": "application/json" });
+		for (const [name, value] of Object.entries(this.#defaultHeaders)) headers.set(name, value);
+		for (const [name, value] of Object.entries(requestHeaders ?? {})) headers.set(name, value);
+		headers.set("User-Agent", this.#userAgent);
+		headers.delete("Authorization");
+		return headers;
+	}
+	async #signedRequest(options) {
+		const url = new URL(`${this.#baseUrl}/v1/agent-api${options.path}`);
+		for (const [key, value] of Object.entries(options.query ?? {})) if (value !== void 0) url.searchParams.set(key, value);
+		const request = new Request(url, {
+			method: options.method,
+			headers: this.#buildRequestHeaders(options.headers),
+			body: options.body !== void 0 ? JSON.stringify(options.body) : null
+		});
+		return this.#signer.sign(request);
+	}
+	async #request(options, schema) {
+		return this.#dispatch(await this.#signedRequest(options), schema);
+	}
+	async #dispatch(request, schema) {
+		const controller = new AbortController();
+		const timedRequest = new Request(request, { signal: controller.signal });
+		let timeoutId;
+		try {
+			const timeout = new Promise((_resolve, reject) => {
+				timeoutId = setTimeout(() => {
+					const timeoutError = new TimeoutError(this.#timeoutMs);
+					reject(timeoutError);
+					controller.abort(timeoutError);
+				}, this.#timeoutMs);
+			});
+			const exchange = this.#fetch(timedRequest).then((response) => parseApiResponse(response, schema));
+			return await Promise.race([exchange, timeout]);
+		} finally {
+			if (timeoutId !== void 0) clearTimeout(timeoutId);
+		}
+	}
+	async whoami() {
+		return (await this.#request({
+			method: "GET",
+			path: "/me"
+		}, whoamiResponseSchema)).agent;
+	}
+	async submitFeedback(body) {
+		await this.#request({
+			method: "POST",
+			path: "/feedback",
+			body: { body }
+		}, okSuccessResponseSchema);
+	}
+	async getPolicy() {
+		return (await this.#request({
+			method: "GET",
+			path: "/policy"
+		}, policyResponseSchema)).policy;
+	}
+	async listAccounts() {
+		return this.#request({
+			method: "GET",
+			path: "/accounts"
+		}, accountsResponseSchema);
+	}
+	async getAccountBalance(accountId) {
+		return this.#request({
+			method: "GET",
+			path: `/accounts/${encodeURIComponent(accountId)}/balance`
+		}, accountBalanceResponseSchema);
+	}
+	async listAccountTransactions(accountId, params = {}) {
+		return this.#request({
+			method: "GET",
+			path: `/accounts/${encodeURIComponent(accountId)}/transactions`,
+			query: {
+				start: params.start,
+				end: params.end,
+				limit: params.limit?.toString(),
+				offset: params.offset?.toString()
+			}
+		}, accountTransactionsResponseSchema);
+	}
+	async getAccountDepositAddress(accountId, params) {
+		return this.#request({
+			method: "GET",
+			path: `/accounts/${encodeURIComponent(accountId)}/deposit-address`,
+			query: {
+				network: params.network,
+				asset: params.asset
+			}
+		}, accountDepositAddressResponseSchema);
+	}
+	async listCounterparties(params = {}) {
+		return this.#request({
+			method: "GET",
+			path: "/counterparties",
+			query: {
+				address: params.address,
+				network: params.network
+			}
+		}, counterpartiesResponseSchema);
+	}
+	async submitIntent(params) {
+		const created = await this.#createIntentRaw({
+			...params,
+			idempotencyKey: params.idempotencyKey ?? crypto.randomUUID()
+		});
+		const nextAction = created.nextAction;
+		if (!nextAction) return toIntentResult(created);
+		let submitRequest;
+		try {
+			const stamp = await this.#stampNextAction(nextAction);
+			submitRequest = await this.#signedRequest({
+				method: "POST",
+				path: `/intents/${encodeURIComponent(created.id)}/submit-stamp`,
+				body: {
+					preparedBody: nextAction.preparedBody,
+					stamp
+				}
+			});
+		} catch (cause) {
+			throw new IntentSubmitError({
+				intentId: created.id,
+				outcome: "not-submitted",
+				cause
+			});
+		}
+		try {
+			return await this.#submitStamp(submitRequest, created.replayed);
+		} catch (cause) {
+			throw new IntentSubmitError({
+				intentId: created.id,
+				outcome: "unknown",
+				cause
+			});
+		}
+	}
+	async #createIntentRaw(params) {
+		return this.#request({
+			method: "POST",
+			path: "/intents",
+			body: { action: toWireAction(params.action) },
+			headers: { "Idempotency-Key": params.idempotencyKey }
+		}, wireIntentResultSchema);
+	}
+	async #stampNextAction(nextAction) {
+		if (nextAction.signer.publicKeyHex.toLowerCase() !== this.#keypair.publicKeyHex.toLowerCase()) throw new Error(`Local signer public key does not match requested signer ${nextAction.signer.publicKeyHex}; linked credential has ${this.#keypair.publicKeyHex}`);
+		const stamp = await new ApiKeyStamper({
+			apiPublicKey: this.#keypair.publicKeyHex,
+			apiPrivateKey: this.#keypair.privateKeyHex
+		}).stamp(nextAction.preparedBody.body);
+		return {
+			publicKeyHex: this.#keypair.publicKeyHex,
+			stampHeaderName: stamp.stampHeaderName,
+			stampHeaderValue: stamp.stampHeaderValue
+		};
+	}
+	async #submitStamp(request, replayed) {
+		const intent = toIntentResult((await this.#dispatch(request, submitStampResponseSchema)).intent);
+		return replayed ? {
+			...intent,
+			replayed: true
+		} : intent;
+	}
+	async getIntent(id) {
+		return toIntentResult(await this.#request({
+			method: "GET",
+			path: `/intents/${encodeURIComponent(id)}`
+		}, wireIntentResultSchema));
+	}
+	async unlinkAgent() {
+		await this.#request({
+			method: "POST",
+			path: "/unlink"
+		}, okSuccessResponseSchema);
+	}
+	async reportSettlement(params) {
+		await this.#request({
+			method: "POST",
+			path: `/intents/${encodeURIComponent(params.intentId)}/settlement-report`,
+			body: {
+				txHash: params.txHash,
+				...params.receipt !== void 0 && { receipt: params.receipt }
+			}
+		}, okSuccessResponseSchema);
+	}
+};
+function createCatenaClient(options = {}) {
+	const privateKeyHex = options.privateKeyHex === void 0 ? process.env.CATENA_SECRET_KEY : options.privateKeyHex;
+	if (privateKeyHex === void 0) throw new InvalidKeyError("privateKeyHex is required; pass it explicitly or set CATENA_SECRET_KEY");
+	return new CatenaClient({
+		...options,
+		privateKeyHex
+	});
+}
+//#endregion
+export { extractRelayableOffer as C, x402ResourceSchema as S, paymentCredentialFromIntentData as T, POLICY_RULE_ACTIONS as _, ACCOUNT_AGGREGATION_SCOPES as a, x402CredentialFromIntentData as b, ACCOUNT_TRANSACTION_MOVEMENT_STATUSES as c, ACTOR_AGGREGATION_SCOPES as d, COUNTERPARTY_ACTIONS as f, POLICY_OVERRIDE_CAPABILITIES as g, POLICY_CAPABILITIES as h, createCatenaClient as i, ACCOUNT_TRANSACTION_STATUSES as l, INTENT_ACTION_TYPES as m, IntentSubmitError as n, ACCOUNT_DEPOSIT_ADDRESS_SOURCES as o, COUNTERPARTY_RULE_MODES as p, TimeoutError as r, ACCOUNT_TRANSACTION_METHODS as s, ApiError as t, ACCOUNT_TRANSACTION_TYPES as u, POLICY_RULE_TYPES as v, extractRelayableReceipt as w, x402PaymentRequirementsSchema as x, SEND_METHODS as y };