@nokinc-flur/sdk 1.1.3 → 1.1.5

package/dist/index.js

@@ -1,201 +1,11 @@
 // src/client.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/contracts.ts
+import { z as z2 } from "zod";
+
+// src/me-offline/client.ts
 import { z } from "zod";
-var E164Regex = /^\+[1-9]\d{7,14}$/;
-var UuidSchema = z.string().uuid();
-var IsoDateSchema = z.string().datetime({ offset: true });
-var CurrencySchema = z.string().trim().length(3).transform((value) => value.toUpperCase());
-var HealthResponseSchema = z.object({
-  ok: z.boolean()
-});
-var WelcomeResponseSchema = z.object({
-  message: z.string()
-});
-var OnboardingStartRequestSchema = z.object({
-  phoneE164: z.string().regex(E164Regex),
-  appInstanceId: z.string().min(3),
-  platform: z.enum(["android", "ios", "web"]),
-  turnstileToken: z.string().min(20).optional(),
-  appAttestation: z.object({
-    provider: z.enum(["android", "ios", "web"]),
-    token: z.string().min(24)
-  }).optional(),
-  firstName: z.string().trim().min(1).max(80).optional(),
-  lastName: z.string().trim().min(1).max(80).optional()
-});
-var OnboardingStartResponseSchema = z.object({
-  requestId: z.string().min(1),
-  checkUrl: z.string().url().optional(),
-  expiresInSec: z.number().int().positive(),
-  fallback: z.enum(["SILENT_AUTH", "OTP"])
-});
-var OnboardingCompleteRequestSchema = z.object({
-  requestId: z.string().min(1),
-  code: z.string().min(1).max(32),
-  appInstanceId: z.string().min(3),
-  fingerprintHash: z.string().min(3).optional()
-});
-var OnboardingCompleteResponseSchema = z.object({
-  sessionToken: z.string().min(1),
-  userId: UuidSchema,
-  restricted: z.boolean(),
-  risk_reasons: z.array(
-    z.enum(["SIM_SWAP_RECENT", "ROAMING", "CARRIER_CHANGED"])
-  ),
-  stepUpRequired: z.boolean().optional(),
-  riskStatus: z.enum(["ok", "unavailable"]).optional()
-});
-var RegisterDeviceRequestSchema = z.object({
-  userId: UuidSchema,
-  appInstanceId: z.string().min(3),
-  platform: z.string().min(2),
-  model: z.string().optional(),
-  networkSignals: z.object({
-    ip: z.string().min(3),
-    asn: z.number().int().optional(),
-    country: z.string().min(2).optional(),
-    carrier: z.string().optional()
-  })
-});
-var RegisterDeviceResponseSchema = z.object({
-  deviceId: z.string().min(1),
-  fingerprintHash: z.string().min(1),
-  driftScore: z.number(),
-  trustState: z.enum(["TRUSTED_PRIMARY", "TRUSTED_SECONDARY", "UNVERIFIED"]),
-  stepUpRequired: z.boolean()
-});
-var AuthRefreshRequestSchema = z.object({
-  userId: UuidSchema,
-  refreshToken: z.string().min(8),
-  appInstanceId: z.string().min(3),
-  fingerprintHash: z.string().min(3)
-});
-var AuthRefreshResponseSchema = z.object({
-  refreshToken: z.string().min(8),
-  stepUpRequired: z.boolean()
-});
-var AuthLogoutRequestSchema = z.object({
-  userId: UuidSchema,
-  refreshToken: z.string().min(8)
-});
-var PinSetRequestSchema = z.object({
-  userId: UuidSchema,
-  pin: z.string().regex(/^\d{6}$/)
-});
-var PinVerifyRequestSchema = z.object({
-  userId: UuidSchema,
-  pin: z.string().regex(/^\d{6}$/)
-});
-var OkResponseSchema = z.object({
-  ok: z.boolean()
-});
-var RegisterSendDeviceKeyRequestSchema = z.object({
-  userId: UuidSchema,
-  deviceId: z.string().min(3),
-  publicKey: z.string().min(32)
-});
-var SEND_AUTH_PURPOSES = ["send_money", "offline_revoke"];
-var SendChallengeRequestSchema = z.object({
-  userId: UuidSchema,
-  deviceId: z.string().min(3),
-  purpose: z.enum(SEND_AUTH_PURPOSES).optional()
-});
-var SendChallengeResponseSchema = z.object({
-  challengeId: UuidSchema,
-  nonce: z.string().min(1),
-  expiresAt: IsoDateSchema
-});
-var SendVerifyRequestSchema = z.object({
-  userId: UuidSchema,
-  deviceId: z.string().min(3),
-  challengeId: UuidSchema,
-  signature: z.string().min(16)
-});
-var SendVerifyResponseSchema = z.object({
-  sendAuthToken: z.string().min(16)
-});
-var ResolveRecipientRequestSchema = z.object({
-  identifier: z.string().min(3)
-});
-var ResolveRecipientResponseSchema = z.object({
-  recipientUserId: UuidSchema,
-  displayName: z.string().min(1),
-  normalizedIdentifier: z.string().regex(E164Regex),
-  isActive: z.boolean()
-});
-var CreateTransferRequestSchema = z.object({
-  recipientIdentifier: z.string().min(3),
-  amountMinor: z.number().int().positive(),
-  currency: CurrencySchema,
-  sendAuthToken: z.string().min(16)
-});
-var TransferStatusSchema = z.enum(["SETTLED", "PENDING_REVIEW", "DECLINED"]);
-var TransferResponseSchema = z.object({
-  transactionId: z.string().min(1),
-  status: TransferStatusSchema,
-  userStatus: TransferStatusSchema,
-  recipientName: z.string().min(1),
-  timestamp: IsoDateSchema
-});
-var DirectionSchema = z.enum(["OUTGOING", "INCOMING"]);
-var AccountActivityItemSchema = z.object({
-  id: z.string().min(1),
-  type: z.string().min(1),
-  direction: DirectionSchema,
-  name: z.string().min(1),
-  identifier: z.string().min(1),
-  amountMinor: z.number().int(),
-  currency: CurrencySchema,
-  status: z.string().min(1),
-  timestamp: IsoDateSchema
-});
-var AccountSummaryResponseSchema = z.object({
-  /** Authenticated user's stable internal id. */
-  userId: UuidSchema,
-  /**
-   * 10-digit Nigeria Uniform Bank Account Number (NUBAN) allocated by the
-   * bank partner. `null` when the user has no partner-allocated account yet.
-   */
-  nuban: z.string().regex(/^[0-9]{10}$/).nullable(),
-  balance: z.number().int(),
-  currency: CurrencySchema,
-  dailySendLimit: z.number().int().nonnegative(),
-  dailySendRemaining: z.number().int().nonnegative(),
-  kycTier: z.string().min(1),
-  kycStatus: z.string().min(1),
-  recentActivity: z.array(AccountActivityItemSchema)
-});
-var TransactionsListResponseSchema = z.object({
-  items: z.array(AccountActivityItemSchema),
-  nextCursor: z.string().nullable()
-});
-var TransactionDetailResponseSchema = z.object({
-  transactionId: z.string().min(1),
-  type: z.string().min(1),
-  direction: DirectionSchema,
-  counterpartyName: z.string().min(1),
-  counterpartyIdentifier: z.string().min(1),
-  amountMinor: z.number().int(),
-  currency: CurrencySchema,
-  status: z.string().min(1),
-  timestamp: IsoDateSchema
-});
-var PushRegisterRequestSchema = z.object({
-  deviceId: z.string().min(3),
-  platform: z.enum(["ios", "android", "web"]),
-  token: z.string().min(16)
-});
-var CreatePayLinkResponseSchema = z.object({
-  token: z.string().min(1)
-});
-var ResolvePayLinkResponseSchema = z.object({
-  recipientUserId: UuidSchema,
-  displayName: z.string().min(1),
-  normalizedIdentifier: z.string().regex(E164Regex),
-  isActive: z.boolean()
-});
 
 // src/errors.ts
 var backendErrorCodeSet = /* @__PURE__ */ new Set([
@@ -299,9 +109,556 @@ async function mapToFlurError(res) {
   });
 }
 
+// src/me-offline/client.ts
+var Hex64 = z.string().regex(/^[0-9a-f]{64}$/i);
+var Sha256Hex = z.string().regex(/^[0-9a-f]{64}$/i);
+var Base64Std = z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/);
+var RegisterDeviceKeyInputSchema = z.object({
+  deviceId: z.string().min(1).max(128),
+  publicKeyHex: Hex64
+});
+var AttestationSecurityLevelSchema = z.enum([
+  "STRONGBOX",
+  "TEE",
+  "SECURE_ENCLAVE",
+  "SOFTWARE"
+]);
+var DeviceKeyAlgSchema = z.literal("p256");
+var RegisterDeviceKeyP256InputSchema = z.object({
+  deviceId: z.string().min(1).max(128),
+  /** P-256 SubjectPublicKeyInfo DER, base64. */
+  publicKeySpkiB64: Base64Std.min(64).max(4096),
+  /** Base64 of the server-issued enrollment challenge string. */
+  challengeB64: Base64Std.min(8).max(1024),
+  /** iOS App Attest payload or Android X.509 Key Attestation chain. */
+  attestationChainB64: z.array(Base64Std.min(16).max(16384)).min(1).max(16),
+  securityLevel: AttestationSecurityLevelSchema
+});
+var P256EnrollmentChallengeInputSchema = z.object({
+  deviceId: z.string().min(1).max(128)
+});
+var P256EnrollmentChallengeResultSchema = z.object({
+  challenge: z.string().min(16),
+  expiresAtMs: z.number().int().positive()
+});
+var DeviceKeyRecordSchema = z.object({
+  id: z.string().uuid(),
+  userId: z.string().uuid(),
+  deviceId: z.string(),
+  /** Always 'p256' on the consumer offline rail. Field retained for forward-compat. */
+  alg: DeviceKeyAlgSchema.default("p256"),
+  /** Legacy ed25519 hex key. Always null on new records (kept for back-compat reads). */
+  publicKeyHex: Hex64.nullable().default(null),
+  /** P-256 SubjectPublicKeyInfo DER, base64. Required for new records. */
+  publicKeySpkiB64: Base64Std.nullable().default(null),
+  securityLevel: AttestationSecurityLevelSchema.nullable().default(null),
+  hardwareBacked: z.boolean().default(false),
+  attestedAtMs: z.number().int().nonnegative().nullable().default(null),
+  createdAtMs: z.number().int().nonnegative(),
+  revokedAtMs: z.number().int().nonnegative().nullable()
+});
+var ConsumerOACSchema = z.object({
+  oacId: z.string().uuid(),
+  issuerId: z.string().min(1).max(64),
+  userId: z.string().uuid(),
+  deviceId: z.string().min(1).max(128),
+  /**
+   * Always 'p256'. Required on the wire (backend always emits it).
+   * Kept as a literal so input/output infer identically and the schema
+   * can be nested inside other response shapes without Zod input/output
+   * divergence under tsup DTS bundling.
+   */
+  alg: z.literal("p256"),
+  /** P-256 SubjectPublicKeyInfo DER, base64. */
+  devicePubkeySpkiB64: Base64Std.min(64).max(4096),
+  perTxCapKobo: z.number().int().positive(),
+  cumulativeCapKobo: z.number().int().positive(),
+  currency: z.string().length(3),
+  validFromMs: z.number().int().nonnegative(),
+  validUntilMs: z.number().int().nonnegative(),
+  counterSeed: z.number().int().nonnegative(),
+  issuedAtMs: z.number().int().nonnegative()
+});
+var SignedConsumerOACSchema = z.object({
+  oac: ConsumerOACSchema,
+  /** ASN.1 DER ECDSA P-256 issuer signature, base64. */
+  issuerSig: Base64Std.min(16).max(2048),
+  /** Issuer's P-256 public key as SubjectPublicKeyInfo DER, base64. */
+  issuerPublicKeySpkiB64: Base64Std.min(64).max(4096)
+});
+var OACRecordSchema = SignedConsumerOACSchema.extend({
+  currentOfflineSpentKobo: z.number().int().nonnegative(),
+  status: z.enum([
+    "active",
+    "superseded",
+    "expired",
+    "revoked",
+    "disabling",
+    "draining",
+    "closed"
+  ]),
+  supersededAtMs: z.number().int().nonnegative().nullable(),
+  revokedAtMs: z.number().int().nonnegative().nullable(),
+  holdId: z.string().uuid().nullable().optional()
+});
+var IssueOACInputSchema = z.object({
+  deviceId: z.string().min(1).max(128),
+  perTxCapKobo: z.number().int().positive().optional(),
+  cumulativeCapKobo: z.number().int().positive().optional(),
+  ttlMs: z.number().int().min(6e4).max(1e3 * 60 * 60 * 24 * 7).optional(),
+  spendableOnlineKobo: z.number().int().nonnegative().optional()
+});
+var IssueAccountOacInputSchema = z.object({
+  deviceId: z.string().min(1).max(128),
+  perTxCapKobo: z.number().int().positive().optional(),
+  cumulativeCapKobo: z.number().int().positive().optional(),
+  ttlMs: z.number().int().min(6e4).max(1e3 * 60 * 60 * 24 * 7).optional()
+});
+var EnableOfflineInputSchema = z.object({
+  deviceId: z.string().min(1).max(128),
+  amountKobo: z.number().int().positive(),
+  perTxCapKobo: z.number().int().positive().optional(),
+  ttlMs: z.number().int().min(6e4).max(1e3 * 60 * 60 * 24 * 7).optional(),
+  installId: z.string().min(1).max(128),
+  partnerId: z.string().min(1).max(64).optional()
+});
+var ProvisionOfflineAllowanceInputSchema = EnableOfflineInputSchema;
+var DisableOfflineInputSchema = z.object({
+  deviceId: z.string().min(1).max(128),
+  installId: z.string().min(1).max(128).optional(),
+  claims: z.array(z.unknown()).max(256).optional()
+});
+var OfflineHoldRecordSchema = z.object({
+  holdId: z.string().uuid(),
+  userId: z.string().uuid(),
+  deviceId: z.string(),
+  partnerId: z.string(),
+  adapterKind: z.string(),
+  externalHoldRef: z.string().nullable(),
+  amountKobo: z.number().int().nonnegative(),
+  capturedKobo: z.number().int().nonnegative(),
+  releasedKobo: z.number().int().nonnegative(),
+  remainingKobo: z.number().int().nonnegative(),
+  currency: z.string().length(3),
+  status: z.enum([
+    "placing",
+    "active",
+    "disabling",
+    "draining",
+    "closed",
+    "revoked",
+    "failed"
+  ]),
+  installId: z.string().nullable(),
+  drainDeadlineMs: z.number().int().nonnegative(),
+  disableRequestedAtMs: z.number().int().nonnegative().nullable(),
+  createdAtMs: z.number().int().nonnegative(),
+  closedAtMs: z.number().int().nonnegative().nullable(),
+  isTrusted: z.boolean().optional()
+});
+var EnableOfflineResultSchema = z.object({
+  hold: OfflineHoldRecordSchema,
+  oac: OACRecordSchema
+});
+var ProvisionOfflineAllowanceResultSchema = EnableOfflineResultSchema;
+var DisableOfflineResultSchema = z.object({
+  hold: OfflineHoldRecordSchema,
+  trusted: z.boolean(),
+  settledClaims: z.number().int().nonnegative()
+});
+var OfflineStatusResultSchema = z.object({
+  hold: OfflineHoldRecordSchema.nullable(),
+  active: OACRecordSchema.nullable()
+});
+var OfflineStateResultSchema = z.object({
+  active: OACRecordSchema.nullable()
+});
+var ConsumerPaymentClaimSchema = z.object({
+  /** Always 'p256'. Retained for forward-compat and as an explicit domain marker. */
+  alg: z.literal("p256").default("p256"),
+  oacId: z.string().uuid(),
+  encounterId: Sha256Hex.optional(),
+  payerUserId: z.string().uuid(),
+  payeeUserId: z.string().uuid(),
+  payerDeviceId: z.string().min(1).max(128),
+  payerNonce: z.string().min(8).max(128),
+  payeeNonce: z.string().min(8).max(128),
+  amountKobo: z.number().int().positive(),
+  currency: z.string().length(3).default("NGN"),
+  occurredAtMs: z.number().int().nonnegative(),
+  completedAtMs: z.number().int().nonnegative().optional(),
+  contextId: z.string().max(128).optional(),
+  payerPubkeySpkiB64: Base64Std.min(64).max(4096),
+  payerSignatureDerB64: Base64Std.min(16).max(2048),
+  payeePubkeySpkiB64: Base64Std.min(64).max(4096).optional(),
+  payeeSignatureDerB64: Base64Std.min(16).max(2048).optional()
+});
+var ConsumerSettlementSchema = z.object({
+  settlementId: z.string().uuid(),
+  settlementKey: Sha256Hex,
+  encounterId: Sha256Hex,
+  oacId: z.string().uuid(),
+  payerUserId: z.string().uuid(),
+  payeeUserId: z.string().uuid(),
+  amountKobo: z.number().int().positive(),
+  currency: z.string().length(3),
+  status: z.enum(["SETTLED", "REVIEW"]),
+  reviewReason: z.string().nullable(),
+  ledgerRef: z.string().nullable(),
+  /** ASN.1 DER ECDSA P-256 issuer signature, base64. */
+  issuerSig: Base64Std.min(16).max(2048),
+  createdAtMs: z.number().int().nonnegative()
+});
+var ConsumerSettleResultSchema = z.object({
+  settlement: ConsumerSettlementSchema,
+  encounterId: Sha256Hex,
+  replayed: z.boolean()
+});
+var RevokeDeviceKeyInputSchema = z.object({
+  deviceId: z.string().min(1).max(128),
+  /** Step-up token from /api/v1/auth/send/verify with purpose='offline_revoke'. */
+  sendAuthToken: z.string().min(16)
+});
+function createMeOfflineClient(opts) {
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  if (!fetchImpl) {
+    throw new Error("createMeOfflineClient: no fetch implementation available");
+  }
+  const baseUrl = opts.baseUrl.replace(/\/$/, "");
+  async function call(method, path, body, parser) {
+    const init2 = {
+      method,
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json"
+      }
+    };
+    if (body !== void 0) init2.body = JSON.stringify(body);
+    const resp = await fetchImpl(`${baseUrl}${path}`, init2);
+    const text = await resp.text();
+    let raw = void 0;
+    if (text) {
+      try {
+        raw = JSON.parse(text);
+      } catch {
+      }
+    }
+    if (!resp.ok) {
+      const code = raw && typeof raw === "object" && "code" in raw && typeof raw.code === "string" ? raw.code : `http_${resp.status}`;
+      const message = raw && typeof raw === "object" && "message" in raw && typeof raw.message === "string" ? raw.message : `request failed with status ${resp.status}`;
+      throw new FlurApiError(resp.status, code, message, raw);
+    }
+    return parser(raw);
+  }
+  const deviceKeyItems = z.object({ items: z.array(DeviceKeyRecordSchema) });
+  return {
+    registerDeviceKey: (input) => call(
+      "POST",
+      "/v1/me/offline/keys",
+      RegisterDeviceKeyInputSchema.parse(input),
+      (raw) => DeviceKeyRecordSchema.parse(raw)
+    ),
+    issueP256EnrollmentChallenge: (input) => call(
+      "POST",
+      "/v1/me/offline/keys/p256/challenge",
+      P256EnrollmentChallengeInputSchema.parse(input),
+      (raw) => P256EnrollmentChallengeResultSchema.parse(raw)
+    ),
+    registerDeviceKeyP256: (input) => call(
+      "POST",
+      "/v1/me/offline/keys/p256",
+      RegisterDeviceKeyP256InputSchema.parse(input),
+      (raw) => DeviceKeyRecordSchema.parse(raw)
+    ),
+    listDeviceKeys: () => call(
+      "GET",
+      "/v1/me/offline/keys",
+      void 0,
+      (raw) => deviceKeyItems.parse(raw)
+    ),
+    revokeDeviceKey: (input) => call(
+      "POST",
+      "/v1/me/offline/keys/revoke",
+      RevokeDeviceKeyInputSchema.parse(input),
+      () => void 0
+    ),
+    issueAccountOac: (input) => call(
+      "POST",
+      "/v1/me/offline/oac",
+      IssueAccountOacInputSchema.parse(input),
+      (raw) => OACRecordSchema.parse(raw)
+    ),
+    provisionAllowance: (input) => call(
+      "POST",
+      "/v1/me/offline/allowance",
+      ProvisionOfflineAllowanceInputSchema.parse(input),
+      (raw) => ProvisionOfflineAllowanceResultSchema.parse(raw)
+    ),
+    enable: (input) => call(
+      "POST",
+      "/v1/me/offline/enable",
+      EnableOfflineInputSchema.parse(input),
+      (raw) => EnableOfflineResultSchema.parse(raw)
+    ),
+    refresh: (input) => call(
+      "POST",
+      "/v1/me/offline/refresh",
+      IssueOACInputSchema.parse(input),
+      (raw) => OACRecordSchema.parse(raw)
+    ),
+    disable: (input) => call(
+      "POST",
+      "/v1/me/offline/disable",
+      DisableOfflineInputSchema.parse(input),
+      (raw) => DisableOfflineResultSchema.parse(raw)
+    ),
+    getStatus: (deviceId) => {
+      const qs = deviceId ? `?deviceId=${encodeURIComponent(deviceId)}` : "";
+      return call(
+        "GET",
+        `/v1/me/offline/status${qs}`,
+        void 0,
+        (raw) => OfflineStatusResultSchema.parse(raw)
+      );
+    },
+    getState: (deviceId) => {
+      const qs = deviceId ? `?deviceId=${encodeURIComponent(deviceId)}` : "";
+      return call(
+        "GET",
+        `/v1/me/offline/state${qs}`,
+        void 0,
+        (raw) => OfflineStateResultSchema.parse(raw)
+      );
+    },
+    submitClaim: (claim) => call(
+      "POST",
+      "/v1/me/offline/claims",
+      ConsumerPaymentClaimSchema.parse(claim),
+      (raw) => ConsumerSettleResultSchema.parse(raw)
+    )
+  };
+}
+
+// src/contracts.ts
+var E164Regex = /^\+[1-9]\d{7,14}$/;
+var UuidSchema = z2.string().uuid();
+var IsoDateSchema = z2.string().datetime({ offset: true });
+var CurrencySchema = z2.string().trim().length(3).transform((value) => value.toUpperCase());
+var HealthResponseSchema = z2.object({
+  ok: z2.boolean()
+});
+var WelcomeResponseSchema = z2.object({
+  message: z2.string()
+});
+var OnboardingStartRequestSchema = z2.object({
+  phoneE164: z2.string().regex(E164Regex),
+  appInstanceId: z2.string().min(3),
+  platform: z2.enum(["android", "ios", "web"]),
+  turnstileToken: z2.string().min(20).optional(),
+  appAttestation: z2.object({
+    provider: z2.enum(["android", "ios", "web"]),
+    token: z2.string().min(24)
+  }).optional(),
+  firstName: z2.string().trim().min(1).max(80).optional(),
+  lastName: z2.string().trim().min(1).max(80).optional()
+});
+var OnboardingStartResponseSchema = z2.object({
+  requestId: z2.string().min(1),
+  checkUrl: z2.string().url().optional(),
+  expiresInSec: z2.number().int().positive(),
+  fallback: z2.enum(["SILENT_AUTH", "OTP"])
+});
+var OnboardingCompleteRequestSchema = z2.object({
+  requestId: z2.string().min(1),
+  code: z2.string().min(1).max(32),
+  appInstanceId: z2.string().min(3),
+  fingerprintHash: z2.string().min(3).optional()
+});
+var OnboardingCompleteResponseSchema = z2.object({
+  sessionToken: z2.string().min(1),
+  userId: UuidSchema,
+  restricted: z2.boolean(),
+  risk_reasons: z2.array(
+    z2.enum(["SIM_SWAP_RECENT", "ROAMING", "CARRIER_CHANGED"])
+  ),
+  stepUpRequired: z2.boolean().optional(),
+  riskStatus: z2.enum(["ok", "unavailable"]).optional()
+});
+var RegisterDeviceRequestSchema = z2.object({
+  userId: UuidSchema,
+  appInstanceId: z2.string().min(3),
+  platform: z2.string().min(2),
+  model: z2.string().optional(),
+  networkSignals: z2.object({
+    ip: z2.string().min(3),
+    asn: z2.number().int().optional(),
+    country: z2.string().min(2).optional(),
+    carrier: z2.string().optional()
+  })
+});
+var RegisterDeviceResponseSchema = z2.object({
+  deviceId: z2.string().min(1),
+  fingerprintHash: z2.string().min(1),
+  driftScore: z2.number(),
+  trustState: z2.enum(["TRUSTED_PRIMARY", "TRUSTED_SECONDARY", "UNVERIFIED"]),
+  stepUpRequired: z2.boolean()
+});
+var AuthRefreshRequestSchema = z2.object({
+  userId: UuidSchema,
+  refreshToken: z2.string().min(8),
+  appInstanceId: z2.string().min(3),
+  fingerprintHash: z2.string().min(3)
+});
+var AuthRefreshResponseSchema = z2.object({
+  refreshToken: z2.string().min(8),
+  stepUpRequired: z2.boolean()
+});
+var AuthLogoutRequestSchema = z2.object({
+  userId: UuidSchema,
+  refreshToken: z2.string().min(8)
+});
+var PinSetRequestSchema = z2.object({
+  userId: UuidSchema,
+  pin: z2.string().regex(/^\d{6}$/)
+});
+var PinVerifyRequestSchema = z2.object({
+  userId: UuidSchema,
+  pin: z2.string().regex(/^\d{6}$/)
+});
+var OkResponseSchema = z2.object({
+  ok: z2.boolean()
+});
+var RegisterSendDeviceKeyRequestSchema = z2.object({
+  userId: UuidSchema,
+  deviceId: z2.string().min(3),
+  publicKey: z2.string().min(32)
+});
+var SEND_AUTH_PURPOSES = ["send_money", "offline_revoke"];
+var SendChallengeRequestSchema = z2.object({
+  userId: UuidSchema,
+  deviceId: z2.string().min(3),
+  purpose: z2.enum(SEND_AUTH_PURPOSES).optional()
+});
+var SendChallengeResponseSchema = z2.object({
+  challengeId: UuidSchema,
+  nonce: z2.string().min(1),
+  expiresAt: IsoDateSchema
+});
+var SendVerifyRequestSchema = z2.object({
+  userId: UuidSchema,
+  deviceId: z2.string().min(3),
+  challengeId: UuidSchema,
+  signature: z2.string().min(16)
+});
+var SendVerifyResponseSchema = z2.object({
+  sendAuthToken: z2.string().min(16)
+});
+var ResolveRecipientRequestSchema = z2.object({
+  identifier: z2.string().min(3)
+});
+var ResolveRecipientResponseSchema = z2.object({
+  recipientUserId: UuidSchema,
+  displayName: z2.string().min(1),
+  normalizedIdentifier: z2.string().regex(E164Regex),
+  isActive: z2.boolean()
+});
+var CreateTransferRequestSchema = z2.object({
+  recipientIdentifier: z2.string().min(3),
+  amountMinor: z2.number().int().positive(),
+  currency: CurrencySchema,
+  sendAuthToken: z2.string().min(16)
+});
+var TransferStatusSchema = z2.enum(["SETTLED", "PENDING_REVIEW", "DECLINED"]);
+var TransferResponseSchema = z2.object({
+  transactionId: z2.string().min(1),
+  status: TransferStatusSchema,
+  userStatus: TransferStatusSchema,
+  recipientName: z2.string().min(1),
+  timestamp: IsoDateSchema,
+  /**
+   * Fresh issuer-signed OACs returned by the backend's post-commit
+   * rotation hook on `SETTLED` transfers.
+   *
+   * In the current backend implementation this hook rotates LEGACY
+   * hold-backed OACs only. Account-funded (no-hold) OACs introduced by
+   * the unified-pay-rails refactor are NOT rotated here — their
+   * cumulative spend counter and main-balance check are enforced at
+   * claim submission time via `createTransfer` under the per-sender
+   * advisory lock, so a stale no-hold OAC cannot authorise overspending
+   * (it can only resolve to REVIEW on submission).
+   *
+   * Optional: omitted when the sender has no registered hold-backed
+   * devices, when the refresh failed (best-effort), or on retry replays
+   * that pre-date the refresh. When present, the entries supersede any
+   * locally cached OACs for the listed devices; when absent, clients
+   * should fall back to `/v1/me/offline/refresh`.
+   *
+   * Each entry is validated against the canonical `OACRecordSchema`,
+   * so consumers can trust the runtime shape matches the static type.
+   */
+  offlineOacs: OACRecordSchema.array().optional()
+});
+var DirectionSchema = z2.enum(["OUTGOING", "INCOMING"]);
+var AccountActivityItemSchema = z2.object({
+  id: z2.string().min(1),
+  type: z2.string().min(1),
+  direction: DirectionSchema,
+  name: z2.string().min(1),
+  identifier: z2.string().min(1),
+  amountMinor: z2.number().int(),
+  currency: CurrencySchema,
+  status: z2.string().min(1),
+  timestamp: IsoDateSchema
+});
+var AccountSummaryResponseSchema = z2.object({
+  /** Authenticated user's stable internal id. */
+  userId: UuidSchema,
+  /**
+   * 10-digit Nigeria Uniform Bank Account Number (NUBAN) allocated by the
+   * bank partner. `null` when the user has no partner-allocated account yet.
+   */
+  nuban: z2.string().regex(/^[0-9]{10}$/).nullable(),
+  balance: z2.number().int(),
+  currency: CurrencySchema,
+  dailySendLimit: z2.number().int().nonnegative(),
+  dailySendRemaining: z2.number().int().nonnegative(),
+  kycTier: z2.string().min(1),
+  kycStatus: z2.string().min(1),
+  recentActivity: z2.array(AccountActivityItemSchema)
+});
+var TransactionsListResponseSchema = z2.object({
+  items: z2.array(AccountActivityItemSchema),
+  nextCursor: z2.string().nullable()
+});
+var TransactionDetailResponseSchema = z2.object({
+  transactionId: z2.string().min(1),
+  type: z2.string().min(1),
+  direction: DirectionSchema,
+  counterpartyName: z2.string().min(1),
+  counterpartyIdentifier: z2.string().min(1),
+  amountMinor: z2.number().int(),
+  currency: CurrencySchema,
+  status: z2.string().min(1),
+  timestamp: IsoDateSchema
+});
+var PushRegisterRequestSchema = z2.object({
+  deviceId: z2.string().min(3),
+  platform: z2.enum(["ios", "android", "web"]),
+  token: z2.string().min(16)
+});
+var CreatePayLinkResponseSchema = z2.object({
+  token: z2.string().min(1)
+});
+var ResolvePayLinkResponseSchema = z2.object({
+  recipientUserId: UuidSchema,
+  displayName: z2.string().min(1),
+  normalizedIdentifier: z2.string().regex(E164Regex),
+  isActive: z2.boolean()
+});
+
 // src/primitives.ts
-import { z as z2 } from "zod";
-var CurrencyCodeSchema = z2.string().trim().length(3).transform((value) => value.toUpperCase());
+import { z as z3 } from "zod";
+var CurrencyCodeSchema = z3.string().trim().length(3).transform((value) => value.toUpperCase());
 var currencyFractionDigits = {
   NGN: 2,
   USD: 2,
@@ -395,7 +752,7 @@ function moneyMinorToNumber(amountMinor) {
 }
 
 // src/collections/client.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var MERCHANT_PROFILE_STATUSES = [
   "pending",
   "active",
@@ -425,172 +782,172 @@ var MERCHANT_PAYOUT_STATUSES = [
   "failed",
   "cancelled"
 ];
-var MoneyKoboSchema = z3.number().int().positive().max(Number.MAX_SAFE_INTEGER);
-var MetadataSchema = z3.record(
-  z3.union([z3.string(), z3.number(), z3.boolean(), z3.null()])
+var MoneyKoboSchema = z4.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var MetadataSchema = z4.record(
+  z4.union([z4.string(), z4.number(), z4.boolean(), z4.null()])
 );
-var CurrencySchema2 = z3.string().trim().length(3).transform((value) => value.toUpperCase());
-var ReferenceSchema = z3.string().trim().min(6).max(128).regex(/^[A-Za-z0-9._:-]+$/);
-var MerchantProfileSchema = z3.object({
-  accountId: z3.string().uuid(),
-  legalName: z3.string(),
-  tradingName: z3.string(),
-  merchantCategoryCode: z3.string().regex(/^\d{4}$/),
-  nqrMerchantId: z3.string(),
-  settlementBankCode: z3.string(),
-  settlementAccountNumber: z3.string(),
-  settlementAccountName: z3.string(),
-  settlementSchedule: z3.enum(SETTLEMENT_SCHEDULES),
-  status: z3.enum(MERCHANT_PROFILE_STATUSES),
-  offlineEnabled: z3.boolean(),
+var CurrencySchema2 = z4.string().trim().length(3).transform((value) => value.toUpperCase());
+var ReferenceSchema = z4.string().trim().min(6).max(128).regex(/^[A-Za-z0-9._:-]+$/);
+var MerchantProfileSchema = z4.object({
+  accountId: z4.string().uuid(),
+  legalName: z4.string(),
+  tradingName: z4.string(),
+  merchantCategoryCode: z4.string().regex(/^\d{4}$/),
+  nqrMerchantId: z4.string(),
+  settlementBankCode: z4.string(),
+  settlementAccountNumber: z4.string(),
+  settlementAccountName: z4.string(),
+  settlementSchedule: z4.enum(SETTLEMENT_SCHEDULES),
+  status: z4.enum(MERCHANT_PROFILE_STATUSES),
+  offlineEnabled: z4.boolean(),
   perTxLimitKobo: MoneyKoboSchema,
   dailyLimitKobo: MoneyKoboSchema,
   metadata: MetadataSchema,
-  createdAtMs: z3.number().int().nonnegative(),
-  updatedAtMs: z3.number().int().nonnegative()
+  createdAtMs: z4.number().int().nonnegative(),
+  updatedAtMs: z4.number().int().nonnegative()
 });
-var UpsertMerchantProfileInputSchema = z3.object({
-  legalName: z3.string().trim().min(1).max(200),
-  tradingName: z3.string().trim().min(1).max(25),
-  merchantCategoryCode: z3.string().trim().regex(/^\d{4}$/),
-  nqrMerchantId: z3.string().trim().min(3).max(64),
-  settlementBankCode: z3.string().trim().min(2).max(16),
-  settlementAccountNumber: z3.string().trim().min(5).max(32),
-  settlementAccountName: z3.string().trim().min(1).max(200),
-  settlementSchedule: z3.enum(SETTLEMENT_SCHEDULES).optional(),
-  status: z3.enum(MERCHANT_PROFILE_STATUSES).optional(),
-  offlineEnabled: z3.boolean().optional(),
+var UpsertMerchantProfileInputSchema = z4.object({
+  legalName: z4.string().trim().min(1).max(200),
+  tradingName: z4.string().trim().min(1).max(25),
+  merchantCategoryCode: z4.string().trim().regex(/^\d{4}$/),
+  nqrMerchantId: z4.string().trim().min(3).max(64),
+  settlementBankCode: z4.string().trim().min(2).max(16),
+  settlementAccountNumber: z4.string().trim().min(5).max(32),
+  settlementAccountName: z4.string().trim().min(1).max(200),
+  settlementSchedule: z4.enum(SETTLEMENT_SCHEDULES).optional(),
+  status: z4.enum(MERCHANT_PROFILE_STATUSES).optional(),
+  offlineEnabled: z4.boolean().optional(),
   perTxLimitKobo: MoneyKoboSchema.optional(),
   dailyLimitKobo: MoneyKoboSchema.optional(),
   metadata: MetadataSchema.optional()
 });
-var CollectionIntentSchema = z3.object({
-  intentId: z3.string().uuid(),
-  accountId: z3.string().uuid(),
-  terminalId: z3.string().uuid().nullable(),
-  reference: z3.string(),
-  amountKobo: z3.number().int().positive().nullable(),
-  currency: z3.string().length(3),
-  status: z3.enum(COLLECTION_INTENT_STATUSES),
-  description: z3.string().nullable(),
-  nqrPayload: z3.string(),
-  provider: z3.string(),
-  providerReference: z3.string().nullable(),
+var CollectionIntentSchema = z4.object({
+  intentId: z4.string().uuid(),
+  accountId: z4.string().uuid(),
+  terminalId: z4.string().uuid().nullable(),
+  reference: z4.string(),
+  amountKobo: z4.number().int().positive().nullable(),
+  currency: z4.string().length(3),
+  status: z4.enum(COLLECTION_INTENT_STATUSES),
+  description: z4.string().nullable(),
+  nqrPayload: z4.string(),
+  provider: z4.string(),
+  providerReference: z4.string().nullable(),
   metadata: MetadataSchema,
-  expiresAtMs: z3.number().int().nonnegative().nullable(),
-  paidAtMs: z3.number().int().nonnegative().nullable(),
-  createdAtMs: z3.number().int().nonnegative(),
-  updatedAtMs: z3.number().int().nonnegative()
+  expiresAtMs: z4.number().int().nonnegative().nullable(),
+  paidAtMs: z4.number().int().nonnegative().nullable(),
+  createdAtMs: z4.number().int().nonnegative(),
+  updatedAtMs: z4.number().int().nonnegative()
 });
-var CreateCollectionIntentInputSchema = z3.object({
+var CreateCollectionIntentInputSchema = z4.object({
   reference: ReferenceSchema.optional(),
   amountKobo: MoneyKoboSchema.optional(),
   currency: CurrencySchema2.optional(),
-  terminalId: z3.string().uuid().optional(),
-  terminalLabel: z3.string().trim().min(1).max(25).optional(),
-  merchantCity: z3.string().trim().min(1).max(15).optional(),
-  description: z3.string().trim().min(1).max(280).optional(),
-  expiresAtMs: z3.number().int().positive().optional(),
-  provider: z3.string().trim().min(1).max(40).optional(),
+  terminalId: z4.string().uuid().optional(),
+  terminalLabel: z4.string().trim().min(1).max(25).optional(),
+  merchantCity: z4.string().trim().min(1).max(15).optional(),
+  description: z4.string().trim().min(1).max(280).optional(),
+  expiresAtMs: z4.number().int().positive().optional(),
+  provider: z4.string().trim().min(1).max(40).optional(),
   metadata: MetadataSchema.optional()
 });
-var PublicCollectionIntentSchema = z3.object({
-  intentId: z3.string().uuid(),
-  reference: z3.string(),
-  amountKobo: z3.number().int().positive().nullable(),
-  currency: z3.string().length(3),
-  status: z3.enum(COLLECTION_INTENT_STATUSES),
-  merchantAccountId: z3.string().uuid(),
-  merchantName: z3.string(),
-  merchantCategoryCode: z3.string(),
-  description: z3.string().nullable(),
-  expiresAtMs: z3.number().int().nonnegative().nullable()
+var PublicCollectionIntentSchema = z4.object({
+  intentId: z4.string().uuid(),
+  reference: z4.string(),
+  amountKobo: z4.number().int().positive().nullable(),
+  currency: z4.string().length(3),
+  status: z4.enum(COLLECTION_INTENT_STATUSES),
+  merchantAccountId: z4.string().uuid(),
+  merchantName: z4.string(),
+  merchantCategoryCode: z4.string(),
+  description: z4.string().nullable(),
+  expiresAtMs: z4.number().int().nonnegative().nullable()
 });
-var PayCollectionInputSchema = z3.object({
+var PayCollectionInputSchema = z4.object({
   reference: ReferenceSchema,
   amountKobo: MoneyKoboSchema.optional(),
   currency: CurrencySchema2.optional(),
-  idempotencyKey: z3.string().trim().min(8).max(160).optional()
+  idempotencyKey: z4.string().trim().min(8).max(160).optional()
 });
-var CollectionPaymentSchema = z3.object({
-  paymentId: z3.string().uuid(),
-  intentId: z3.string().uuid(),
-  accountId: z3.string().uuid(),
-  payerUserId: z3.string().uuid().nullable(),
-  merchantOwnerUserId: z3.string().uuid(),
+var CollectionPaymentSchema = z4.object({
+  paymentId: z4.string().uuid(),
+  intentId: z4.string().uuid(),
+  accountId: z4.string().uuid(),
+  payerUserId: z4.string().uuid().nullable(),
+  merchantOwnerUserId: z4.string().uuid(),
   amountKobo: MoneyKoboSchema,
-  currency: z3.string().length(3),
-  status: z3.enum(COLLECTION_PAYMENT_STATUSES),
-  provider: z3.string(),
-  providerReference: z3.string().nullable(),
-  idempotencyKey: z3.string().nullable(),
-  ledgerRef: z3.string(),
-  failureCode: z3.string().nullable(),
-  failureMessage: z3.string().nullable(),
-  paidAtMs: z3.number().int().nonnegative().nullable(),
-  createdAtMs: z3.number().int().nonnegative(),
-  updatedAtMs: z3.number().int().nonnegative()
+  currency: z4.string().length(3),
+  status: z4.enum(COLLECTION_PAYMENT_STATUSES),
+  provider: z4.string(),
+  providerReference: z4.string().nullable(),
+  idempotencyKey: z4.string().nullable(),
+  ledgerRef: z4.string(),
+  failureCode: z4.string().nullable(),
+  failureMessage: z4.string().nullable(),
+  paidAtMs: z4.number().int().nonnegative().nullable(),
+  createdAtMs: z4.number().int().nonnegative(),
+  updatedAtMs: z4.number().int().nonnegative()
 });
-var CollectionPaymentResultSchema = z3.object({
+var CollectionPaymentResultSchema = z4.object({
   payment: CollectionPaymentSchema,
   intent: CollectionIntentSchema,
-  receipt: z3.unknown().optional(),
-  replayed: z3.boolean()
+  receipt: z4.unknown().optional(),
+  replayed: z4.boolean()
 });
-var CollectionReportSummarySchema = z3.object({
-  accountId: z3.string().uuid(),
-  fromMs: z3.number().int().nonnegative(),
-  toMs: z3.number().int().nonnegative(),
-  currency: z3.string().length(3),
-  paidCount: z3.number().int().nonnegative(),
-  paidAmountKobo: z3.number().int().nonnegative(),
-  pendingCount: z3.number().int().nonnegative(),
-  failedCount: z3.number().int().nonnegative(),
-  reversedCount: z3.number().int().nonnegative(),
-  availableBalanceKobo: z3.number().int().nonnegative()
+var CollectionReportSummarySchema = z4.object({
+  accountId: z4.string().uuid(),
+  fromMs: z4.number().int().nonnegative(),
+  toMs: z4.number().int().nonnegative(),
+  currency: z4.string().length(3),
+  paidCount: z4.number().int().nonnegative(),
+  paidAmountKobo: z4.number().int().nonnegative(),
+  pendingCount: z4.number().int().nonnegative(),
+  failedCount: z4.number().int().nonnegative(),
+  reversedCount: z4.number().int().nonnegative(),
+  availableBalanceKobo: z4.number().int().nonnegative()
 });
-var CollectionStatementSchema = z3.object({
-  accountId: z3.string().uuid(),
-  year: z3.number().int(),
-  month: z3.number().int().min(1).max(12),
-  currency: z3.string().length(3),
-  totalPaidKobo: z3.number().int().nonnegative(),
-  items: z3.array(CollectionPaymentSchema)
+var CollectionStatementSchema = z4.object({
+  accountId: z4.string().uuid(),
+  year: z4.number().int(),
+  month: z4.number().int().min(1).max(12),
+  currency: z4.string().length(3),
+  totalPaidKobo: z4.number().int().nonnegative(),
+  items: z4.array(CollectionPaymentSchema)
 });
-var CreatePayoutInputSchema = z3.object({
+var CreatePayoutInputSchema = z4.object({
   amountKobo: MoneyKoboSchema,
   currency: CurrencySchema2.optional(),
-  idempotencyKey: z3.string().trim().min(8).max(160)
+  idempotencyKey: z4.string().trim().min(8).max(160)
 });
-var MerchantPayoutSchema = z3.object({
-  payoutId: z3.string().uuid(),
-  accountId: z3.string().uuid(),
+var MerchantPayoutSchema = z4.object({
+  payoutId: z4.string().uuid(),
+  accountId: z4.string().uuid(),
   amountKobo: MoneyKoboSchema,
-  currency: z3.string().length(3),
-  status: z3.enum(MERCHANT_PAYOUT_STATUSES),
-  idempotencyKey: z3.string().nullable(),
-  ledgerRef: z3.string(),
-  providerReference: z3.string().nullable(),
-  requestedByUserId: z3.string().uuid().nullable(),
-  failureCode: z3.string().nullable(),
-  failureMessage: z3.string().nullable(),
-  createdAtMs: z3.number().int().nonnegative(),
-  updatedAtMs: z3.number().int().nonnegative()
+  currency: z4.string().length(3),
+  status: z4.enum(MERCHANT_PAYOUT_STATUSES),
+  idempotencyKey: z4.string().nullable(),
+  ledgerRef: z4.string(),
+  providerReference: z4.string().nullable(),
+  requestedByUserId: z4.string().uuid().nullable(),
+  failureCode: z4.string().nullable(),
+  failureMessage: z4.string().nullable(),
+  createdAtMs: z4.number().int().nonnegative(),
+  updatedAtMs: z4.number().int().nonnegative()
 });
-var ProviderEventInputSchema = z3.object({
-  provider: z3.string().trim().min(1).max(80),
-  eventId: z3.string().trim().min(1).max(160),
-  eventType: z3.string().trim().min(1).max(120),
-  payload: z3.record(z3.unknown()).optional()
+var ProviderEventInputSchema = z4.object({
+  provider: z4.string().trim().min(1).max(80),
+  eventId: z4.string().trim().min(1).max(160),
+  eventType: z4.string().trim().min(1).max(120),
+  payload: z4.record(z4.unknown()).optional()
 });
-var ProviderEventRecordSchema = z3.object({
-  id: z3.string().uuid(),
-  provider: z3.string(),
-  eventId: z3.string(),
-  eventType: z3.string(),
-  signatureVerified: z3.boolean(),
-  receivedAtMs: z3.number().int().nonnegative(),
-  processedAtMs: z3.number().int().nonnegative().nullable()
+var ProviderEventRecordSchema = z4.object({
+  id: z4.string().uuid(),
+  provider: z4.string(),
+  eventId: z4.string(),
+  eventType: z4.string(),
+  signatureVerified: z4.boolean(),
+  receivedAtMs: z4.number().int().nonnegative(),
+  processedAtMs: z4.number().int().nonnegative().nullable()
 });
 function createCollectionsClient(opts) {
   const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
@@ -1105,7 +1462,7 @@ var FlurClient = class {
     try {
       body = requestSchema ? JSON.stringify(requestSchema.parse(input)) : init2.body;
     } catch (err) {
-      if (err instanceof z4.ZodError) {
+      if (err instanceof z5.ZodError) {
         throw new FlurError("Invalid request payload", "INVALID_REQUEST", {
           details: err.flatten()
         });
@@ -1133,7 +1490,7 @@ var FlurClient = class {
       try {
         return responseSchema.parse(payload);
       } catch (err) {
-        if (err instanceof z4.ZodError) {
+        if (err instanceof z5.ZodError) {
           throw new FlurError(
             "SDK contract validation failed",
             "INVALID_REQUEST",
@@ -1563,64 +1920,113 @@ function constantTimeEqual(a, b) {
   return diff === 0;
 }
 
-// src/crypto/ed25519.ts
-import { ed25519 } from "@noble/curves/ed25519";
-function generateKeyPair() {
-  const privateKey = ed25519.utils.randomPrivateKey();
-  const publicKey = ed25519.getPublicKey(privateKey);
-  return { privateKey, publicKey };
+// src/offline/oac.ts
+import { z as z6 } from "zod";
+
+// src/crypto/p256-issuer.ts
+import { p256 } from "@noble/curves/nist";
+function bytesToBase64(bytes) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(bytes).toString("base64");
+  }
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
 }
-function publicKeyFromPrivate(privateKey) {
-  return ed25519.getPublicKey(privateKey);
+function base64ToBytes(b64) {
+  if (typeof Buffer !== "undefined") {
+    return new Uint8Array(Buffer.from(b64, "base64"));
+  }
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
 }
-function sign(message, privateKey) {
-  return ed25519.sign(message, privateKey);
+var P256_SPKI_HEADER = new Uint8Array([
+  48,
+  89,
+  48,
+  19,
+  6,
+  7,
+  42,
+  134,
+  72,
+  206,
+  61,
+  2,
+  1,
+  6,
+  8,
+  42,
+  134,
+  72,
+  206,
+  61,
+  3,
+  1,
+  7,
+  3,
+  66,
+  0
+]);
+function p256SpkiB64ToRaw(spkiB64) {
+  const spki = base64ToBytes(spkiB64);
+  if (spki.length !== P256_SPKI_HEADER.length + 65) {
+    throw new Error("p256: invalid SPKI length");
+  }
+  for (let i = 0; i < P256_SPKI_HEADER.length; i++) {
+    if (spki[i] !== P256_SPKI_HEADER[i]) {
+      throw new Error("p256: invalid SPKI header");
+    }
+  }
+  return spki.slice(P256_SPKI_HEADER.length);
+}
+function signIssuerP256(bytes, issuerPrivateKey) {
+  const sig = p256.sign(bytes, issuerPrivateKey, { prehash: true });
+  return bytesToBase64(sig.toBytes("der"));
 }
-function verify(message, signature, publicKey) {
+function verifyIssuerP256(bytes, signatureB64, issuerPublicKeySpkiB64) {
   try {
-    return ed25519.verify(signature, message, publicKey);
+    const pubRaw = p256SpkiB64ToRaw(issuerPublicKeySpkiB64);
+    const sigBytes = base64ToBytes(signatureB64);
+    return p256.verify(sigBytes, bytes, pubRaw, {
+      prehash: true,
+      format: "der"
+    });
   } catch {
     return false;
   }
 }
-function signCanonical(value, privateKey) {
-  return sign(canonicalJSONBytes(value), privateKey);
-}
-function verifyCanonical(value, signature, publicKey) {
-  return verify(canonicalJSONBytes(value), signature, publicKey);
-}
 
 // src/offline/oac.ts
-import { z as z5 } from "zod";
 var OAC_DEFAULT_PER_TX_KOBO = 5e5;
 var OAC_DEFAULT_CUMULATIVE_KOBO = 2e6;
 var OAC_DEFAULT_VALIDITY_MS = 24 * 60 * 60 * 1e3;
-var HexString = (length) => z5.string().regex(
-  new RegExp(`^[0-9a-fA-F]{${length * 2}}$`),
-  `expected ${length}-byte hex string`
-);
-var OACSchema = z5.object({
-  userId: z5.string().min(1),
-  deviceId: z5.string().min(1),
-  devicePublicKey: HexString(32),
-  perTxCapKobo: z5.number().int().nonnegative(),
-  cumulativeCapKobo: z5.number().int().nonnegative(),
-  validFromMs: z5.number().int().nonnegative(),
-  validUntilMs: z5.number().int().positive(),
-  counterSeed: z5.number().int().nonnegative(),
-  nonce: z5.string().min(1),
-  issuerSig: HexString(64)
+var Base64Std2 = z6.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64 (standard) string");
+var OACSchema = z6.object({
+  userId: z6.string().min(1),
+  deviceId: z6.string().min(1),
+  /** SubjectPublicKeyInfo DER, base64 (P-256). */
+  devicePublicKey: Base64Std2,
+  perTxCapKobo: z6.number().int().nonnegative(),
+  cumulativeCapKobo: z6.number().int().nonnegative(),
+  validFromMs: z6.number().int().nonnegative(),
+  validUntilMs: z6.number().int().positive(),
+  counterSeed: z6.number().int().nonnegative(),
+  nonce: z6.string().min(1),
+  /** ASN.1 DER ECDSA(SHA-256) signature, base64. */
+  issuerSig: Base64Std2
 }).refine((v) => v.validUntilMs > v.validFromMs, {
   message: "validUntilMs must be greater than validFromMs"
 }).refine((v) => v.perTxCapKobo <= v.cumulativeCapKobo, {
   message: "perTxCapKobo must not exceed cumulativeCapKobo"
 });
 function buildOAC(input) {
-  const devicePublicKey = typeof input.devicePublicKey === "string" ? input.devicePublicKey : bytesToHex(input.devicePublicKey);
   return {
     userId: input.userId,
     deviceId: input.deviceId,
-    devicePublicKey,
+    devicePublicKey: input.devicePublicKey,
     perTxCapKobo: input.perTxCapKobo ?? OAC_DEFAULT_PER_TX_KOBO,
     cumulativeCapKobo: input.cumulativeCapKobo ?? OAC_DEFAULT_CUMULATIVE_KOBO,
     validFromMs: input.validFromMs,
@@ -1630,36 +2036,25 @@ function buildOAC(input) {
   };
 }
 function signOAC(unsigned, issuerPrivateKey) {
-  const issuerSig = bytesToHex(
-    sign(canonicalJSONBytes(unsigned), issuerPrivateKey)
+  const issuerSig = signIssuerP256(
+    canonicalJSONBytes(unsigned),
+    issuerPrivateKey
   );
   return { ...unsigned, issuerSig };
 }
-function verifyOAC(oac, issuerPublicKey) {
+function verifyOAC(oac, issuerPublicKeySpkiB64) {
   try {
     const parsed = OACSchema.parse(oac);
     const { issuerSig, ...unsigned } = parsed;
-    return verify(
+    return verifyIssuerP256(
       canonicalJSONBytes(unsigned),
-      hexToBytes(issuerSig),
-      issuerPublicKey
+      issuerSig,
+      issuerPublicKeySpkiB64
     );
   } catch {
     return false;
   }
 }
-function bytesToHex(b) {
-  let s = "";
-  for (let i = 0; i < b.length; i++) s += b[i].toString(16).padStart(2, "0");
-  return s;
-}
-function hexToBytes(s) {
-  if (s.length % 2 !== 0) throw new Error("hex: odd length");
-  const out = new Uint8Array(s.length / 2);
-  for (let i = 0; i < out.length; i++)
-    out[i] = parseInt(s.slice(i * 2, i * 2 + 2), 16);
-  return out;
-}
 
 // src/offline/codec.ts
 var ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+-./:";
@@ -1715,20 +2110,20 @@ function decodeBase45(s) {
 }
 
 // src/offline/messages.ts
-import { z as z6 } from "zod";
-var HexSig = z6.string().regex(/^[0-9a-fA-F]{128}$/, "expected 64-byte hex signature");
-var OfflinePaymentRequestSchema = z6.object({
-  reference: z6.string().min(1),
-  amountKobo: z6.number().int().positive(),
+import { z as z7 } from "zod";
+var Base64Sig = z7.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64 (standard) signature");
+var OfflinePaymentRequestSchema = z7.object({
+  reference: z7.string().min(1),
+  amountKobo: z7.number().int().positive(),
   merchantOAC: OACSchema,
-  expiresAtMs: z6.number().int().positive(),
-  merchantSig: HexSig
+  expiresAtMs: z7.number().int().positive(),
+  merchantSig: Base64Sig
 });
-var OfflinePaymentAuthorizationSchema = z6.object({
+var OfflinePaymentAuthorizationSchema = z7.object({
   request: OfflinePaymentRequestSchema,
   payerOAC: OACSchema,
-  payerCounter: z6.number().int().positive(),
-  payerSig: HexSig
+  payerCounter: z7.number().int().positive(),
+  payerSig: Base64Sig
 });
 function buildPaymentRequest(input) {
   if (!Number.isInteger(input.amountKobo) || input.amountKobo <= 0) {
@@ -1745,27 +2140,28 @@ function buildPaymentRequest(input) {
   };
 }
 function signPaymentRequest(unsigned, merchantDevicePrivateKey) {
-  const merchantSig = bytesToHex(
-    sign(canonicalJSONBytes(unsigned), merchantDevicePrivateKey)
+  const merchantSig = signIssuerP256(
+    canonicalJSONBytes(unsigned),
+    merchantDevicePrivateKey
   );
   return { ...unsigned, merchantSig };
 }
-function verifyPaymentRequest(req, issuerPublicKey) {
+function verifyPaymentRequest(req, issuerPublicKeySpkiB64) {
   try {
     const parsed = OfflinePaymentRequestSchema.parse(req);
     const { issuerSig: merchantOacSig, ...merchantOacUnsigned } = parsed.merchantOAC;
-    if (!verify(
+    if (!verifyIssuerP256(
       canonicalJSONBytes(merchantOacUnsigned),
-      hexToBytes(merchantOacSig),
-      issuerPublicKey
+      merchantOacSig,
+      issuerPublicKeySpkiB64
     )) {
       return false;
     }
     const { merchantSig, ...unsigned } = parsed;
-    return verify(
+    return verifyIssuerP256(
       canonicalJSONBytes(unsigned),
-      hexToBytes(merchantSig),
-      hexToBytes(parsed.merchantOAC.devicePublicKey)
+      merchantSig,
+      parsed.merchantOAC.devicePublicKey
     );
   } catch {
     return false;
@@ -1785,28 +2181,30 @@ function buildAuthorization(input) {
   };
 }
 function signAuthorization(unsigned, payerDevicePrivateKey) {
-  const payerSig = bytesToHex(
-    sign(canonicalJSONBytes(unsigned), payerDevicePrivateKey)
+  const payerSig = signIssuerP256(
+    canonicalJSONBytes(unsigned),
+    payerDevicePrivateKey
   );
   return { ...unsigned, payerSig };
 }
-function verifyAuthorization(auth, issuerPublicKey) {
+function verifyAuthorization(auth, issuerPublicKeySpkiB64) {
   try {
     const parsed = OfflinePaymentAuthorizationSchema.parse(auth);
-    if (!verifyPaymentRequest(parsed.request, issuerPublicKey)) return false;
+    if (!verifyPaymentRequest(parsed.request, issuerPublicKeySpkiB64))
+      return false;
     const { issuerSig: payerOacSig, ...payerOacUnsigned } = parsed.payerOAC;
-    if (!verify(
+    if (!verifyIssuerP256(
       canonicalJSONBytes(payerOacUnsigned),
-      hexToBytes(payerOacSig),
-      issuerPublicKey
+      payerOacSig,
+      issuerPublicKeySpkiB64
     )) {
       return false;
     }
     const { payerSig, ...unsigned } = parsed;
-    return verify(
+    return verifyIssuerP256(
       canonicalJSONBytes(unsigned),
-      hexToBytes(payerSig),
-      hexToBytes(parsed.payerOAC.devicePublicKey)
+      payerSig,
+      parsed.payerOAC.devicePublicKey
     );
   } catch {
     return false;
@@ -1836,60 +2234,64 @@ function decodeAuthorizationQR(s) {
 }
 
 // src/offline/settlements.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 import { sha256 } from "@noble/hashes/sha256";
-import { bytesToHex as bytesToHex2 } from "@noble/hashes/utils";
-var OfflineTokenSchema = z7.object({
-  tokenId: z7.string().uuid(),
-  tokenSerial: z7.string(),
-  issuerAccountId: z7.string().uuid(),
-  payerUserId: z7.string().uuid(),
-  maxAmountKobo: z7.number().int().positive(),
-  currency: z7.string().length(3),
-  issuedAtMs: z7.number().int().nonnegative(),
-  expiresAtMs: z7.number().int().nonnegative(),
-  issuerSig: z7.string()
+import { bytesToHex } from "@noble/hashes/utils";
+var OfflineTokenSchema = z8.object({
+  tokenId: z8.string().uuid(),
+  tokenSerial: z8.string(),
+  issuerAccountId: z8.string().uuid(),
+  payerUserId: z8.string().uuid(),
+  maxAmountKobo: z8.number().int().positive(),
+  currency: z8.string().length(3),
+  issuedAtMs: z8.number().int().nonnegative(),
+  expiresAtMs: z8.number().int().nonnegative(),
+  issuerSig: z8.string()
 });
-var PaymentClaimSchema = z7.object({
-  encounterId: z7.string().regex(/^[0-9a-f]{64}$/i).optional(),
-  tokenSerial: z7.string(),
-  payerUserId: z7.string().uuid(),
-  payeeUserId: z7.string().uuid(),
-  payerNonce: z7.string(),
-  payeeNonce: z7.string(),
-  amountKobo: z7.number().int().positive(),
-  currency: z7.string().length(3).default("NGN"),
-  occurredAtMs: z7.number().int().nonnegative(),
-  completedAtMs: z7.number().int().nonnegative().optional(),
-  contextId: z7.string().optional(),
-  payerPubkey: z7.string().regex(/^[0-9a-f]{64}$/i),
-  payerSignature: z7.string().regex(/^[0-9a-f]+$/i),
-  payeePubkey: z7.string().regex(/^[0-9a-f]{64}$/i).optional(),
-  payeeSignature: z7.string().regex(/^[0-9a-f]+$/i).optional()
+var PaymentClaimSchema = z8.object({
+  encounterId: z8.string().regex(/^[0-9a-f]{64}$/i).optional(),
+  tokenSerial: z8.string(),
+  payerUserId: z8.string().uuid(),
+  payeeUserId: z8.string().uuid(),
+  payerNonce: z8.string(),
+  payeeNonce: z8.string(),
+  amountKobo: z8.number().int().positive(),
+  currency: z8.string().length(3).default("NGN"),
+  occurredAtMs: z8.number().int().nonnegative(),
+  completedAtMs: z8.number().int().nonnegative().optional(),
+  contextId: z8.string().optional(),
+  // Stage 2c: P-256 device keys are now SubjectPublicKeyInfo DER, base64.
+  // Signatures are ASN.1 DER ECDSA(SHA-256), base64. Backwards-incompatible
+  // wire change; the backend has the matching widening in offline-settlements
+  // service + zod schema.
+  payerPubkey: z8.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/),
+  payerSignature: z8.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/),
+  payeePubkey: z8.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/).optional(),
+  payeeSignature: z8.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/).optional()
 });
-var SettlementSchema = z7.object({
-  settlementId: z7.string().uuid(),
-  settlementKey: z7.string().regex(/^[0-9a-f]{64}$/i),
-  encounterId: z7.string().regex(/^[0-9a-f]{64}$/i),
-  issuerAccountId: z7.string().uuid(),
-  tokenSerial: z7.string(),
-  payerUserId: z7.string().uuid(),
-  payeeUserId: z7.string().uuid(),
-  amountKobo: z7.number().int().nonnegative(),
-  currency: z7.string().length(3),
-  receiptId: z7.string().nullable(),
-  status: z7.enum(["SETTLED", "REVIEW", "REJECTED"]),
-  issuerSig: z7.string(),
-  createdAtMs: z7.number().int().nonnegative()
+var SettlementSchema = z8.object({
+  settlementId: z8.string().uuid(),
+  settlementKey: z8.string().regex(/^[0-9a-f]{64}$/i),
+  encounterId: z8.string().regex(/^[0-9a-f]{64}$/i),
+  issuerAccountId: z8.string().uuid(),
+  tokenSerial: z8.string(),
+  payerUserId: z8.string().uuid(),
+  payeeUserId: z8.string().uuid(),
+  amountKobo: z8.number().int().nonnegative(),
+  currency: z8.string().length(3),
+  receiptId: z8.string().nullable(),
+  status: z8.enum(["SETTLED", "REVIEW", "REJECTED"]),
+  issuerSig: z8.string(),
+  createdAtMs: z8.number().int().nonnegative()
 });
-var SettleResponseSchema = z7.object({
+var SettleResponseSchema = z8.object({
   settlement: SettlementSchema,
-  encounterId: z7.string().regex(/^[0-9a-f]{64}$/i),
-  replayed: z7.boolean()
+  encounterId: z8.string().regex(/^[0-9a-f]{64}$/i),
+  replayed: z8.boolean()
 });
 var ENCOUNTER_DOMAIN = "offline:v1:encounter";
 async function sha256Hex(input) {
-  return bytesToHex2(sha256(new TextEncoder().encode(input)));
+  return bytesToHex(sha256(new TextEncoder().encode(input)));
 }
 async function computeEncounterId(input) {
   return sha256Hex(
@@ -2059,7 +2461,7 @@ function createHmacFetch(opts) {
 }
 
 // src/partner/client.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 import { sha256 as sha2563 } from "@noble/hashes/sha256";
 import { hmac as hmac2 } from "@noble/hashes/hmac";
 import { bytesToHex as bytesToHex4 } from "@noble/hashes/utils";
@@ -2083,18 +2485,18 @@ var PARTNER_SCOPES = [
   "partner:payout:write",
   "partner:reconciliation:read"
 ];
-var ApiCredentialPublicSchema = z8.object({
-  id: z8.string().uuid(),
-  accountId: z8.string().uuid(),
-  keyId: z8.string(),
-  scopes: z8.array(z8.enum(PARTNER_SCOPES)),
-  label: z8.string().nullable(),
-  createdAtMs: z8.number().int().nonnegative(),
-  lastUsedAtMs: z8.number().int().nonnegative().nullable(),
-  revokedAtMs: z8.number().int().nonnegative().nullable()
+var ApiCredentialPublicSchema = z9.object({
+  id: z9.string().uuid(),
+  accountId: z9.string().uuid(),
+  keyId: z9.string(),
+  scopes: z9.array(z9.enum(PARTNER_SCOPES)),
+  label: z9.string().nullable(),
+  createdAtMs: z9.number().int().nonnegative(),
+  lastUsedAtMs: z9.number().int().nonnegative().nullable(),
+  revokedAtMs: z9.number().int().nonnegative().nullable()
 });
 var MintedApiCredentialSchema = ApiCredentialPublicSchema.extend({
-  secret: z8.string().min(1)
+  secret: z9.string().min(1)
 });
 var enc = new TextEncoder();
 async function sha256Hex2(input) {
@@ -2251,8 +2653,8 @@ function createApiCredentialsAdminClient(opts) {
     }
     return parser(raw);
   }
-  const listSchema = z8.object({
-    items: z8.array(ApiCredentialPublicSchema)
+  const listSchema = z9.object({
+    items: z9.array(ApiCredentialPublicSchema)
   });
   return {
     list: (accountId) => call(
@@ -2277,7 +2679,7 @@ function createApiCredentialsAdminClient(opts) {
 }
 
 // src/passes/pass.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var PASS_KINDS = [
   "ride-ticket",
   "transit-pass",
@@ -2293,42 +2695,39 @@ var PASS_STATES = [
   "expired",
   "revoked"
 ];
-var HexString2 = (length) => z9.string().regex(
-  new RegExp(`^[0-9a-fA-F]{${length * 2}}$`),
-  `expected ${length}-byte hex string`
-);
-var PassMetadataSchema = z9.record(
-  z9.union([z9.string(), z9.number(), z9.boolean(), z9.null()])
+var PassMetadataSchema = z10.record(
+  z10.union([z10.string(), z10.number(), z10.boolean(), z10.null()])
 );
-var PassSchema = z9.object({
-  passId: z9.string().min(1),
+var PassSchema = z10.object({
+  passId: z10.string().min(1),
   /** Optional client/template grouping id (server may omit). */
-  templateId: z9.string().min(1).optional(),
+  templateId: z10.string().min(1).optional(),
   /** Optional human-facing holder identity (server may omit). The cryptographic binding
    *  is `holderDevicePubkey` below. */
-  holderUserId: z9.string().min(1).optional(),
-  kind: z9.enum(PASS_KINDS),
-  issuerId: z9.string().min(1),
-  issuedAtMs: z9.number().int().nonnegative(),
-  validFromMs: z9.number().int().nonnegative(),
-  validUntilMs: z9.number().int().positive(),
-  state: z9.enum(PASS_STATES),
+  holderUserId: z10.string().min(1).optional(),
+  kind: z10.enum(PASS_KINDS),
+  issuerId: z10.string().min(1),
+  issuedAtMs: z10.number().int().nonnegative(),
+  validFromMs: z10.number().int().nonnegative(),
+  validUntilMs: z10.number().int().positive(),
+  state: z10.enum(PASS_STATES),
   metadata: PassMetadataSchema,
-  nonce: z9.string().min(1),
+  nonce: z10.string().min(1),
   /** Device id this pass is bound to (FK to backend `device_keys`). */
-  holderDeviceId: z9.string().min(1),
-  /** 32-byte hex Ed25519 public key of the bound device. The redemption signature
-   *  is verified against this key — it is the security-critical binding. */
-  holderDevicePubkey: HexString2(32),
+  holderDeviceId: z10.string().min(1),
+  /** SubjectPublicKeyInfo DER (P-256) of the bound device, base64. The redemption
+   *  signature is verified against this key — it is the security-critical binding. */
+  holderDevicePubkey: z10.string().min(64).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/),
   /** Optional fixed amount for monetary passes (vouchers, gift cards) in kobo. */
-  amountKobo: z9.number().int().nonnegative().optional(),
+  amountKobo: z10.number().int().nonnegative().optional(),
   /** ISO-4217-ish currency code; required on the wire. SDK builders default to NGN. */
-  currency: z9.string().min(3).max(8),
+  currency: z10.string().min(3).max(8),
   /** Monotonic redemption counter floor. Redemption.counter MUST be > counterSeed. */
-  counterSeed: z9.number().int().nonnegative(),
+  counterSeed: z10.number().int().nonnegative(),
   /** Optional cumulative spend cap in kobo across all redemptions of this pass. */
-  cumulativeCapKobo: z9.number().int().nonnegative().optional(),
-  issuerSig: HexString2(64)
+  cumulativeCapKobo: z10.number().int().nonnegative().optional(),
+  /** ASN.1 DER ECDSA P-256 signature, base64. */
+  issuerSig: z10.string().min(64).max(2048).regex(/^[A-Za-z0-9+/]+={0,2}$/)
 }).refine((v) => v.validUntilMs > v.validFromMs, {
   message: "validUntilMs must be greater than validFromMs"
 });
@@ -2361,19 +2760,20 @@ function buildPass(input) {
   return out;
 }
 function signPass(unsigned, issuerPrivateKey) {
-  const issuerSig = bytesToHex(
-    sign(canonicalJSONBytes(unsigned), issuerPrivateKey)
+  const issuerSig = signIssuerP256(
+    canonicalJSONBytes(unsigned),
+    issuerPrivateKey
   );
   return { ...unsigned, issuerSig };
 }
-function verifyPass(pass, issuerPublicKey) {
+function verifyPass(pass, issuerPublicKeySpkiB64) {
   try {
     const parsed = PassSchema.parse(pass);
     const { issuerSig, ...unsigned } = parsed;
-    return verify(
+    return verifyIssuerP256(
       canonicalJSONBytes(unsigned),
-      hexToBytes(issuerSig),
-      issuerPublicKey
+      issuerSig,
+      issuerPublicKeySpkiB64
     );
   } catch {
     return false;
@@ -2384,19 +2784,20 @@ function isPassWithinValidity(pass, nowMs) {
 }
 
 // src/passes/redemption.ts
-import { z as z10 } from "zod";
-var HexSig2 = z10.string().regex(/^[0-9a-fA-F]{128}$/, "expected 64-byte hex signature");
-var RedemptionSchema = z10.object({
+import { z as z11 } from "zod";
+var Base64Std3 = z11.string().min(16).max(2048).regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64 (std)");
+var RedemptionSchema = z11.object({
   pass: PassSchema,
-  redeemerId: z10.string().min(1),
-  redeemedAtMs: z10.number().int().nonnegative(),
+  redeemerId: z11.string().min(1),
+  redeemedAtMs: z11.number().int().nonnegative(),
   /** Strictly monotonic counter scoped to a single pass. Must be > pass.counterSeed
    *  and > the redeemer's lastSeenCounter for this pass. */
-  counter: z10.number().int().positive(),
+  counter: z11.number().int().positive(),
   /** Amount being redeemed in kobo (0 for non-monetary passes like ride tickets). */
-  amountKobo: z10.number().int().nonnegative(),
-  nonce: z10.string().min(1),
-  holderSig: HexSig2
+  amountKobo: z11.number().int().nonnegative(),
+  nonce: z11.string().min(1),
+  /** ASN.1 DER ECDSA P-256 signature over canonicalJSONBytes(unsigned), base64. */
+  holderSig: Base64Std3
 });
 var REDEEMABLE_STATES = /* @__PURE__ */ new Set(["issued", "active"]);
 function buildRedemption(input) {
@@ -2450,74 +2851,68 @@ function buildRedemption(input) {
   };
 }
 function signRedemption(unsigned, holderDevicePrivateKey) {
-  const holderSig = bytesToHex(
-    sign(canonicalJSONBytes(unsigned), holderDevicePrivateKey)
+  const holderSig = signIssuerP256(
+    canonicalJSONBytes(unsigned),
+    holderDevicePrivateKey
   );
   return { ...unsigned, holderSig };
 }
-function verifyRedemption(r, issuerPublicKey) {
+function verifyRedemption(r, issuerPublicKeySpkiB64) {
   try {
     const parsed = RedemptionSchema.parse(r);
     if (parsed.counter <= parsed.pass.counterSeed) return false;
     const { issuerSig, ...passUnsigned } = parsed.pass;
-    if (!verify(
+    if (!verifyIssuerP256(
       canonicalJSONBytes(passUnsigned),
-      hexToBytes(issuerSig),
-      issuerPublicKey
+      issuerSig,
+      issuerPublicKeySpkiB64
     )) {
       return false;
     }
-    const holderHex = parsed.pass.holderDevicePubkey;
-    if (typeof holderHex !== "string") return false;
+    const holderPub = parsed.pass.holderDevicePubkey;
+    if (typeof holderPub !== "string") return false;
     const { holderSig, ...unsigned } = parsed;
-    return verify(
-      canonicalJSONBytes(unsigned),
-      hexToBytes(holderSig),
-      hexToBytes(holderHex)
-    );
+    return verifyIssuerP256(canonicalJSONBytes(unsigned), holderSig, holderPub);
   } catch {
     return false;
   }
 }
 
 // src/receipts/receipt.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var RECEIPT_CHANNELS = ["cash", "pass"];
 var RECEIPT_KINDS = RECEIPT_CHANNELS;
-var HexString3 = (length) => z11.string().regex(
-  new RegExp(`^[0-9a-fA-F]{${length * 2}}$`),
-  `expected ${length}-byte hex string`
-);
-var ReceiptPayloadSchema = z11.record(
-  z11.union([z11.string(), z11.number(), z11.boolean(), z11.null()])
+var ReceiptPayloadSchema = z12.record(
+  z12.union([z12.string(), z12.number(), z12.boolean(), z12.null()])
 );
-var ReceiptSchema = z11.object({
-  receiptId: z11.string().min(1),
-  channel: z11.enum(RECEIPT_CHANNELS),
+var ReceiptSchema = z12.object({
+  receiptId: z12.string().min(1),
+  channel: z12.enum(RECEIPT_CHANNELS),
   /** Cash-channel: send_intents.id. Required when channel === 'cash'. */
-  intentId: z11.string().min(1).optional(),
+  intentId: z12.string().min(1).optional(),
   /** Pass-channel: pass_redemptions.id. Required when channel === 'pass'. */
-  passRedemptionId: z11.string().min(1).optional(),
-  payerUserId: z11.string().min(1),
-  payeeUserId: z11.string().min(1),
-  amountKobo: z11.number().int().nonnegative(),
-  currency: z11.string().min(3).max(8),
-  issuedAtMs: z11.number().int().nonnegative(),
-  issuerId: z11.string().min(1),
+  passRedemptionId: z12.string().min(1).optional(),
+  payerUserId: z12.string().min(1),
+  payeeUserId: z12.string().min(1),
+  amountKobo: z12.number().int().nonnegative(),
+  currency: z12.string().min(3).max(8),
+  issuedAtMs: z12.number().int().nonnegative(),
+  issuerId: z12.string().min(1),
   payload: ReceiptPayloadSchema,
-  issuerSig: HexString3(64)
+  /** ASN.1 DER ECDSA P-256 signature, base64. */
+  issuerSig: z12.string().min(64).max(2048).regex(/^[A-Za-z0-9+/]+={0,2}$/)
 }).superRefine((v, ctx) => {
   if (v.channel === "cash") {
     if (!v.intentId) {
       ctx.addIssue({
-        code: z11.ZodIssueCode.custom,
+        code: z12.ZodIssueCode.custom,
         message: "cash receipts require intentId",
         path: ["intentId"]
       });
     }
     if (v.passRedemptionId) {
       ctx.addIssue({
-        code: z11.ZodIssueCode.custom,
+        code: z12.ZodIssueCode.custom,
         message: "cash receipts must not carry passRedemptionId",
         path: ["passRedemptionId"]
       });
@@ -2525,14 +2920,14 @@ var ReceiptSchema = z11.object({
   } else if (v.channel === "pass") {
     if (!v.passRedemptionId) {
       ctx.addIssue({
-        code: z11.ZodIssueCode.custom,
+        code: z12.ZodIssueCode.custom,
         message: "pass receipts require passRedemptionId",
         path: ["passRedemptionId"]
       });
     }
     if (v.intentId) {
       ctx.addIssue({
-        code: z11.ZodIssueCode.custom,
+        code: z12.ZodIssueCode.custom,
         message: "pass receipts must not carry intentId",
         path: ["intentId"]
       });
@@ -2571,19 +2966,20 @@ function buildReceipt(input) {
   return out;
 }
 function signReceipt(unsigned, issuerPrivateKey) {
-  const issuerSig = bytesToHex(
-    sign(canonicalJSONBytes(unsigned), issuerPrivateKey)
+  const issuerSig = signIssuerP256(
+    canonicalJSONBytes(unsigned),
+    issuerPrivateKey
   );
   return { ...unsigned, issuerSig };
 }
-function verifyReceipt(r, issuerPublicKey) {
+function verifyReceipt(r, issuerPublicKeySpkiB64) {
   try {
     const parsed = ReceiptSchema.parse(r);
     const { issuerSig, ...unsigned } = parsed;
-    return verify(
+    return verifyIssuerP256(
       canonicalJSONBytes(unsigned),
-      hexToBytes(issuerSig),
-      issuerPublicKey
+      issuerSig,
+      issuerPublicKeySpkiB64
     );
   } catch {
     return false;
@@ -2833,23 +3229,23 @@ function init(opts) {
 }
 
 // src/accounts/client.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var ACCOUNT_TYPES = ["personal", "business", "partner"];
 var ACCOUNT_STATUSES = ["active", "suspended", "closed"];
 var MEMBERSHIP_ROLES = ["owner", "admin", "driver", "staff"];
-var AccountSchema = z12.object({
-  accountId: z12.string().uuid(),
-  type: z12.enum(ACCOUNT_TYPES),
-  displayName: z12.string().min(1),
-  status: z12.enum(ACCOUNT_STATUSES),
-  ownerUserId: z12.string().uuid().nullable(),
-  createdAtMs: z12.number().int().nonnegative()
+var AccountSchema = z13.object({
+  accountId: z13.string().uuid(),
+  type: z13.enum(ACCOUNT_TYPES),
+  displayName: z13.string().min(1),
+  status: z13.enum(ACCOUNT_STATUSES),
+  ownerUserId: z13.string().uuid().nullable(),
+  createdAtMs: z13.number().int().nonnegative()
 });
-var AccountMembershipSchema = z12.object({
-  accountId: z12.string().uuid(),
-  userId: z12.string().uuid(),
-  role: z12.enum(MEMBERSHIP_ROLES),
-  createdAtMs: z12.number().int().nonnegative()
+var AccountMembershipSchema = z13.object({
+  accountId: z13.string().uuid(),
+  userId: z13.string().uuid(),
+  role: z13.enum(MEMBERSHIP_ROLES),
+  createdAtMs: z13.number().int().nonnegative()
 });
 function createAccountsClient(opts) {
   const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
@@ -2882,9 +3278,9 @@ function createAccountsClient(opts) {
     }
     return parser(raw);
   }
-  const itemsSchema = z12.object({ items: z12.array(AccountSchema) });
-  const memberItemsSchema = z12.object({
-    items: z12.array(AccountMembershipSchema)
+  const itemsSchema = z13.object({ items: z13.array(AccountSchema) });
+  const memberItemsSchema = z13.object({
+    items: z13.array(AccountMembershipSchema)
   });
   return {
     listMyAccounts: () => call(
@@ -2915,345 +3311,8 @@ function createAccountsClient(opts) {
   };
 }
 
-// src/me-offline/client.ts
-import { z as z13 } from "zod";
-var Hex64 = z13.string().regex(/^[0-9a-f]{64}$/i);
-var HexAny = z13.string().regex(/^[0-9a-f]+$/i);
-var Sha256Hex = z13.string().regex(/^[0-9a-f]{64}$/i);
-var Base64Std = z13.string().regex(/^[A-Za-z0-9+/]+={0,2}$/);
-var RegisterDeviceKeyInputSchema = z13.object({
-  deviceId: z13.string().min(1).max(128),
-  publicKeyHex: Hex64
-});
-var AttestationSecurityLevelSchema = z13.enum([
-  "STRONGBOX",
-  "TEE",
-  "SECURE_ENCLAVE",
-  "SOFTWARE"
-]);
-var DeviceKeyAlgSchema = z13.enum(["ed25519", "p256"]);
-var RegisterDeviceKeyP256InputSchema = z13.object({
-  deviceId: z13.string().min(1).max(128),
-  /** P-256 SubjectPublicKeyInfo DER, base64. */
-  publicKeySpkiB64: Base64Std.min(64).max(4096),
-  /** Base64 of the server-issued enrollment challenge string. */
-  challengeB64: Base64Std.min(8).max(1024),
-  /** iOS App Attest payload or Android X.509 Key Attestation chain. */
-  attestationChainB64: z13.array(Base64Std.min(16).max(16384)).min(1).max(16),
-  securityLevel: AttestationSecurityLevelSchema
-});
-var P256EnrollmentChallengeInputSchema = z13.object({
-  deviceId: z13.string().min(1).max(128)
-});
-var P256EnrollmentChallengeResultSchema = z13.object({
-  challenge: z13.string().min(16),
-  expiresAtMs: z13.number().int().positive()
-});
-var DeviceKeyRecordSchema = z13.object({
-  id: z13.string().uuid(),
-  userId: z13.string().uuid(),
-  deviceId: z13.string(),
-  alg: DeviceKeyAlgSchema.default("ed25519"),
-  publicKeyHex: Hex64.nullable().default(null),
-  publicKeySpkiB64: Base64Std.nullable().default(null),
-  securityLevel: AttestationSecurityLevelSchema.nullable().default(null),
-  hardwareBacked: z13.boolean().default(false),
-  attestedAtMs: z13.number().int().nonnegative().nullable().default(null),
-  createdAtMs: z13.number().int().nonnegative(),
-  revokedAtMs: z13.number().int().nonnegative().nullable()
-});
-var ConsumerOACSchema = z13.object({
-  oacId: z13.string().uuid(),
-  issuerId: z13.string().min(1).max(64),
-  userId: z13.string().uuid(),
-  deviceId: z13.string().min(1).max(128),
-  alg: z13.enum(["ed25519", "p256"]).optional(),
-  devicePubkeyHex: Hex64.optional(),
-  devicePubkeySpkiB64: Base64Std.min(64).max(4096).optional(),
-  perTxCapKobo: z13.number().int().positive(),
-  cumulativeCapKobo: z13.number().int().positive(),
-  currency: z13.string().length(3),
-  validFromMs: z13.number().int().nonnegative(),
-  validUntilMs: z13.number().int().nonnegative(),
-  counterSeed: z13.number().int().nonnegative(),
-  issuedAtMs: z13.number().int().nonnegative()
-}).refine(
-  (o) => {
-    const alg = o.alg ?? "ed25519";
-    if (alg === "ed25519") {
-      return Boolean(o.devicePubkeyHex) && !o.devicePubkeySpkiB64;
-    }
-    return Boolean(o.devicePubkeySpkiB64) && !o.devicePubkeyHex;
-  },
-  { message: "OAC device pubkey shape must match alg" }
-);
-var SignedConsumerOACSchema = z13.object({
-  oac: ConsumerOACSchema,
-  issuerSig: HexAny,
-  issuerPublicKeyHex: Hex64
-});
-var OACRecordSchema = SignedConsumerOACSchema.extend({
-  currentOfflineSpentKobo: z13.number().int().nonnegative(),
-  status: z13.enum([
-    "active",
-    "superseded",
-    "expired",
-    "revoked",
-    "disabling",
-    "draining",
-    "closed"
-  ]),
-  supersededAtMs: z13.number().int().nonnegative().nullable(),
-  revokedAtMs: z13.number().int().nonnegative().nullable(),
-  holdId: z13.string().uuid().nullable().optional()
-});
-var IssueOACInputSchema = z13.object({
-  deviceId: z13.string().min(1).max(128),
-  perTxCapKobo: z13.number().int().positive().optional(),
-  cumulativeCapKobo: z13.number().int().positive().optional(),
-  ttlMs: z13.number().int().min(6e4).max(1e3 * 60 * 60 * 24 * 7).optional(),
-  spendableOnlineKobo: z13.number().int().nonnegative().optional()
-});
-var EnableOfflineInputSchema = z13.object({
-  deviceId: z13.string().min(1).max(128),
-  amountKobo: z13.number().int().positive(),
-  perTxCapKobo: z13.number().int().positive().optional(),
-  ttlMs: z13.number().int().min(6e4).max(1e3 * 60 * 60 * 24 * 7).optional(),
-  installId: z13.string().min(1).max(128),
-  partnerId: z13.string().min(1).max(64).optional()
-});
-var ProvisionOfflineAllowanceInputSchema = EnableOfflineInputSchema;
-var DisableOfflineInputSchema = z13.object({
-  deviceId: z13.string().min(1).max(128),
-  installId: z13.string().min(1).max(128).optional(),
-  claims: z13.array(z13.unknown()).max(256).optional()
-});
-var OfflineHoldRecordSchema = z13.object({
-  holdId: z13.string().uuid(),
-  userId: z13.string().uuid(),
-  deviceId: z13.string(),
-  partnerId: z13.string(),
-  adapterKind: z13.string(),
-  externalHoldRef: z13.string().nullable(),
-  amountKobo: z13.number().int().nonnegative(),
-  capturedKobo: z13.number().int().nonnegative(),
-  releasedKobo: z13.number().int().nonnegative(),
-  remainingKobo: z13.number().int().nonnegative(),
-  currency: z13.string().length(3),
-  status: z13.enum([
-    "placing",
-    "active",
-    "disabling",
-    "draining",
-    "closed",
-    "revoked",
-    "failed"
-  ]),
-  installId: z13.string().nullable(),
-  drainDeadlineMs: z13.number().int().nonnegative(),
-  disableRequestedAtMs: z13.number().int().nonnegative().nullable(),
-  createdAtMs: z13.number().int().nonnegative(),
-  closedAtMs: z13.number().int().nonnegative().nullable(),
-  isTrusted: z13.boolean().optional()
-});
-var EnableOfflineResultSchema = z13.object({
-  hold: OfflineHoldRecordSchema,
-  oac: OACRecordSchema
-});
-var ProvisionOfflineAllowanceResultSchema = EnableOfflineResultSchema;
-var DisableOfflineResultSchema = z13.object({
-  hold: OfflineHoldRecordSchema,
-  trusted: z13.boolean(),
-  settledClaims: z13.number().int().nonnegative()
-});
-var OfflineStatusResultSchema = z13.object({
-  hold: OfflineHoldRecordSchema.nullable(),
-  active: OACRecordSchema.nullable()
-});
-var OfflineStateResultSchema = z13.object({
-  active: OACRecordSchema.nullable()
-});
-var ClaimAlgSchema = z13.enum(["ed25519", "p256"]);
-var ConsumerPaymentClaimSchema = z13.object({
-  /** Algorithm discriminator. Omit / 'ed25519' for V1 clients. */
-  alg: ClaimAlgSchema.optional(),
-  oacId: z13.string().uuid(),
-  encounterId: Sha256Hex.optional(),
-  payerUserId: z13.string().uuid(),
-  payeeUserId: z13.string().uuid(),
-  payerDeviceId: z13.string().min(1).max(128),
-  payerNonce: z13.string().min(8).max(128),
-  payeeNonce: z13.string().min(8).max(128),
-  amountKobo: z13.number().int().positive(),
-  currency: z13.string().length(3).default("NGN"),
-  occurredAtMs: z13.number().int().nonnegative(),
-  completedAtMs: z13.number().int().nonnegative().optional(),
-  contextId: z13.string().max(128).optional(),
-  // ed25519 path
-  payerPubkeyHex: Hex64.optional(),
-  payerSignature: HexAny.optional(),
-  payeePubkeyHex: Hex64.optional(),
-  payeeSignature: HexAny.optional(),
-  // p256 path
-  payerPubkeySpkiB64: z13.string().min(64).max(4096).optional(),
-  payerSignatureDerB64: z13.string().min(16).max(2048).optional(),
-  payeePubkeySpkiB64: z13.string().min(64).max(4096).optional(),
-  payeeSignatureDerB64: z13.string().min(16).max(2048).optional()
-}).refine(
-  (c) => {
-    const alg = c.alg ?? "ed25519";
-    if (alg === "ed25519") {
-      return Boolean(c.payerPubkeyHex) && Boolean(c.payerSignature);
-    }
-    return Boolean(c.payerPubkeySpkiB64) && Boolean(c.payerSignatureDerB64);
-  },
-  {
-    message: "payer key/signature fields must match alg (ed25519: hex; p256: SPKI+DER b64)"
-  }
-);
-var ConsumerSettlementSchema = z13.object({
-  settlementId: z13.string().uuid(),
-  settlementKey: Sha256Hex,
-  encounterId: Sha256Hex,
-  oacId: z13.string().uuid(),
-  payerUserId: z13.string().uuid(),
-  payeeUserId: z13.string().uuid(),
-  amountKobo: z13.number().int().positive(),
-  currency: z13.string().length(3),
-  status: z13.enum(["SETTLED", "REVIEW"]),
-  reviewReason: z13.string().nullable(),
-  ledgerRef: z13.string().nullable(),
-  issuerSig: HexAny,
-  createdAtMs: z13.number().int().nonnegative()
-});
-var ConsumerSettleResultSchema = z13.object({
-  settlement: ConsumerSettlementSchema,
-  encounterId: Sha256Hex,
-  replayed: z13.boolean()
-});
-var RevokeDeviceKeyInputSchema = z13.object({
-  deviceId: z13.string().min(1).max(128),
-  /** Step-up token from /api/v1/auth/send/verify with purpose='offline_revoke'. */
-  sendAuthToken: z13.string().min(16)
-});
-function createMeOfflineClient(opts) {
-  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
-  if (!fetchImpl) {
-    throw new Error("createMeOfflineClient: no fetch implementation available");
-  }
-  const baseUrl = opts.baseUrl.replace(/\/$/, "");
-  async function call(method, path, body, parser) {
-    const init2 = {
-      method,
-      headers: {
-        "content-type": "application/json",
-        accept: "application/json"
-      }
-    };
-    if (body !== void 0) init2.body = JSON.stringify(body);
-    const resp = await fetchImpl(`${baseUrl}${path}`, init2);
-    const text = await resp.text();
-    let raw = void 0;
-    if (text) {
-      try {
-        raw = JSON.parse(text);
-      } catch {
-      }
-    }
-    if (!resp.ok) {
-      const code = raw && typeof raw === "object" && "code" in raw && typeof raw.code === "string" ? raw.code : `http_${resp.status}`;
-      const message = raw && typeof raw === "object" && "message" in raw && typeof raw.message === "string" ? raw.message : `request failed with status ${resp.status}`;
-      throw new FlurApiError(resp.status, code, message, raw);
-    }
-    return parser(raw);
-  }
-  const deviceKeyItems = z13.object({ items: z13.array(DeviceKeyRecordSchema) });
-  return {
-    registerDeviceKey: (input) => call(
-      "POST",
-      "/v1/me/offline/keys",
-      RegisterDeviceKeyInputSchema.parse(input),
-      (raw) => DeviceKeyRecordSchema.parse(raw)
-    ),
-    issueP256EnrollmentChallenge: (input) => call(
-      "POST",
-      "/v1/me/offline/keys/p256/challenge",
-      P256EnrollmentChallengeInputSchema.parse(input),
-      (raw) => P256EnrollmentChallengeResultSchema.parse(raw)
-    ),
-    registerDeviceKeyP256: (input) => call(
-      "POST",
-      "/v1/me/offline/keys/p256",
-      RegisterDeviceKeyP256InputSchema.parse(input),
-      (raw) => DeviceKeyRecordSchema.parse(raw)
-    ),
-    listDeviceKeys: () => call(
-      "GET",
-      "/v1/me/offline/keys",
-      void 0,
-      (raw) => deviceKeyItems.parse(raw)
-    ),
-    revokeDeviceKey: (input) => call(
-      "POST",
-      "/v1/me/offline/keys/revoke",
-      RevokeDeviceKeyInputSchema.parse(input),
-      () => void 0
-    ),
-    provisionAllowance: (input) => call(
-      "POST",
-      "/v1/me/offline/allowance",
-      ProvisionOfflineAllowanceInputSchema.parse(input),
-      (raw) => ProvisionOfflineAllowanceResultSchema.parse(raw)
-    ),
-    enable: (input) => call(
-      "POST",
-      "/v1/me/offline/enable",
-      EnableOfflineInputSchema.parse(input),
-      (raw) => EnableOfflineResultSchema.parse(raw)
-    ),
-    refresh: (input) => call(
-      "POST",
-      "/v1/me/offline/refresh",
-      IssueOACInputSchema.parse(input),
-      (raw) => OACRecordSchema.parse(raw)
-    ),
-    disable: (input) => call(
-      "POST",
-      "/v1/me/offline/disable",
-      DisableOfflineInputSchema.parse(input),
-      (raw) => DisableOfflineResultSchema.parse(raw)
-    ),
-    getStatus: (deviceId) => {
-      const qs = deviceId ? `?deviceId=${encodeURIComponent(deviceId)}` : "";
-      return call(
-        "GET",
-        `/v1/me/offline/status${qs}`,
-        void 0,
-        (raw) => OfflineStatusResultSchema.parse(raw)
-      );
-    },
-    getState: (deviceId) => {
-      const qs = deviceId ? `?deviceId=${encodeURIComponent(deviceId)}` : "";
-      return call(
-        "GET",
-        `/v1/me/offline/state${qs}`,
-        void 0,
-        (raw) => OfflineStateResultSchema.parse(raw)
-      );
-    },
-    submitClaim: (claim) => call(
-      "POST",
-      "/v1/me/offline/claims",
-      ConsumerPaymentClaimSchema.parse(claim),
-      (raw) => ConsumerSettleResultSchema.parse(raw)
-    )
-  };
-}
-
 // src/me-offline/signer.ts
-import { ed25519 as ed255192 } from "@noble/curves/ed25519";
-import { p256 } from "@noble/curves/nist";
-import { bytesToHex as bytesToHex5, hexToBytes as hexToBytes2 } from "@noble/hashes/utils";
+import { p256 as p2562 } from "@noble/curves/nist";
 var CLAIM_DOMAIN_V2 = "flur:consumer-offline:v2:claim";
 function canonicalClaimSigningPayload(claim) {
   return {
@@ -3275,7 +3334,7 @@ function canonicalClaimSigningPayload(claim) {
 function canonicalClaimSigningBytes(claim) {
   return canonicalJSONBytes(canonicalClaimSigningPayload(claim));
 }
-function bytesToBase64(bytes) {
+function bytesToBase642(bytes) {
   if (typeof Buffer !== "undefined") {
     return Buffer.from(bytes).toString("base64");
   }
@@ -3283,7 +3342,7 @@ function bytesToBase64(bytes) {
   for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
   return btoa(bin);
 }
-function base64ToBytes(b64) {
+function base64ToBytes2(b64) {
   if (typeof Buffer !== "undefined") {
     return new Uint8Array(Buffer.from(b64, "base64"));
   }
@@ -3292,7 +3351,7 @@ function base64ToBytes(b64) {
   for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
   return out;
 }
-var P256_SPKI_HEADER = new Uint8Array([
+var P256_SPKI_HEADER2 = new Uint8Array([
   48,
   89,
   48,
@@ -3324,38 +3383,25 @@ function p256PublicKeyToSpkiB64(rawUncompressed) {
   if (rawUncompressed.length !== 65 || rawUncompressed[0] !== 4) {
     throw new Error("p256: expected 65-byte uncompressed point");
   }
-  const out = new Uint8Array(P256_SPKI_HEADER.length + rawUncompressed.length);
-  out.set(P256_SPKI_HEADER, 0);
-  out.set(rawUncompressed, P256_SPKI_HEADER.length);
-  return bytesToBase64(out);
+  const out = new Uint8Array(P256_SPKI_HEADER2.length + rawUncompressed.length);
+  out.set(P256_SPKI_HEADER2, 0);
+  out.set(rawUncompressed, P256_SPKI_HEADER2.length);
+  return bytesToBase642(out);
 }
 function p256SpkiB64ToPublicKey(spkiB64) {
-  const spki = base64ToBytes(spkiB64);
-  if (spki.length !== P256_SPKI_HEADER.length + 65) {
+  const spki = base64ToBytes2(spkiB64);
+  if (spki.length !== P256_SPKI_HEADER2.length + 65) {
     throw new Error("p256: invalid SPKI length");
   }
-  for (let i = 0; i < P256_SPKI_HEADER.length; i++) {
-    if (spki[i] !== P256_SPKI_HEADER[i]) {
+  for (let i = 0; i < P256_SPKI_HEADER2.length; i++) {
+    if (spki[i] !== P256_SPKI_HEADER2[i]) {
       throw new Error("p256: invalid SPKI header");
     }
   }
-  return spki.slice(P256_SPKI_HEADER.length);
-}
-function createSoftwareEd25519Signer(privateKey) {
-  const pub = ed255192.getPublicKey(privateKey);
-  return {
-    alg: "ed25519",
-    async getPublicKey() {
-      return { alg: "ed25519", publicKey: bytesToHex5(pub) };
-    },
-    async sign(bytes) {
-      const sig = ed255192.sign(bytes, privateKey);
-      return { alg: "ed25519", signature: bytesToHex5(sig) };
-    }
-  };
+  return spki.slice(P256_SPKI_HEADER2.length);
 }
 function createSoftwareP256Signer(privateKey) {
-  const raw = p256.getPublicKey(privateKey, false);
+  const raw = p2562.getPublicKey(privateKey, false);
   const spkiB64 = p256PublicKeyToSpkiB64(raw);
   return {
     alg: "p256",
@@ -3363,35 +3409,87 @@ function createSoftwareP256Signer(privateKey) {
       return { alg: "p256", publicKey: spkiB64 };
     },
     async sign(bytes) {
-      const sig = p256.sign(bytes, privateKey, { prehash: true });
+      const sig = p2562.sign(bytes, privateKey, { prehash: true });
       const der = sig.toBytes("der");
-      return { alg: "p256", signature: bytesToBase64(der) };
+      return { alg: "p256", signature: bytesToBase642(der) };
     }
   };
 }
 function verifyClaimSignature(input) {
   try {
-    if (input.alg === "ed25519") {
-      return ed255192.verify(
-        hexToBytes2(input.signature),
-        input.bytes,
-        hexToBytes2(input.publicKey)
-      );
-    }
-    if (input.alg === "p256") {
-      const sigDer = base64ToBytes(input.signature);
-      const pub = p256SpkiB64ToPublicKey(input.publicKey);
-      return p256.verify(sigDer, input.bytes, pub, {
-        prehash: true,
-        format: "der"
-      });
-    }
-    return false;
+    if (input.alg !== "p256") return false;
+    const sigDer = base64ToBytes2(input.signature);
+    const pub = p256SpkiB64ToPublicKey(input.publicKey);
+    return p2562.verify(sigDer, input.bytes, pub, {
+      prehash: true,
+      format: "der"
+    });
   } catch {
     return false;
   }
 }
 
+// src/me-offline/sms.ts
+var OFFLINE_CLAIM_SMS_PREFIX = "FLURC1.";
+var TOKEN_RE = /(?:^|\s)(FLURC1\.[A-Za-z0-9_-]+={0,2})(?:\s|$)/;
+function encodeOfflineClaimSmsMessage(claim) {
+  const parsed = ConsumerPaymentClaimSchema.parse(claim);
+  const json = JSON.stringify(parsed);
+  return `${OFFLINE_CLAIM_SMS_PREFIX}${base64UrlEncodeUtf8(json)}`;
+}
+function decodeOfflineClaimSmsMessage(message) {
+  const token = extractOfflineClaimSmsToken(message);
+  if (!token) {
+    throw new Error("offline claim SMS token not found");
+  }
+  const encoded = token.slice(OFFLINE_CLAIM_SMS_PREFIX.length);
+  let raw;
+  try {
+    raw = JSON.parse(base64UrlDecodeUtf8(encoded));
+  } catch {
+    throw new Error("offline claim SMS token is malformed");
+  }
+  const parsed = ConsumerPaymentClaimSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error("offline claim SMS token is invalid");
+  }
+  return parsed.data;
+}
+function extractOfflineClaimSmsToken(message) {
+  const trimmed = message.trim();
+  if (trimmed.startsWith(OFFLINE_CLAIM_SMS_PREFIX)) {
+    return trimmed.split(/\s+/, 1)[0] ?? null;
+  }
+  return TOKEN_RE.exec(message)?.[1] ?? null;
+}
+function base64UrlEncodeUtf8(input) {
+  const bytes = new TextEncoder().encode(input);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  const base64 = typeof btoa === "function" ? btoa(binary) : typeof Buffer !== "undefined" ? Buffer.from(bytes).toString("base64") : void 0;
+  if (!base64) throw new Error("base64 encoder unavailable");
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlDecodeUtf8(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(
+    base64.length + (4 - base64.length % 4) % 4,
+    "="
+  );
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index++) {
+      bytes[index] = binary.charCodeAt(index);
+    }
+    return new TextDecoder().decode(bytes);
+  }
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(padded, "base64").toString("utf8");
+  }
+  throw new Error("base64 decoder unavailable");
+}
+
 // src/partner-funding/client.ts
 import { z as z14 } from "zod";
 var MinorString = z14.string().regex(/^-?\d+$/);
@@ -3767,14 +3865,15 @@ function buildArtifactBody(input) {
   return { ...header, data: input.data };
 }
 function signArtifact(body, privateKey) {
-  const sig = bytesToHex(sign(canonicalJSONBytes(body), privateKey));
+  const sig = signIssuerP256(canonicalJSONBytes(body), privateKey);
   return { body, sig };
 }
 function encodeArtifactUri(signed) {
   const bodyBytes = canonicalJSONBytes(signed.body);
   const bodyB64 = base64UrlEncode(bodyBytes);
-  const sigB64 = base64UrlEncode(hexToBytes(signed.sig));
-  return `${FLUR_ARTIFACT_URI_PREFIX}${signed.body.t}/${bodyB64}.${sigB64}`;
+  const sigBytes = base64UrlDecode(signed.sig);
+  const sigB64Url = base64UrlEncode(sigBytes);
+  return `${FLUR_ARTIFACT_URI_PREFIX}${signed.body.t}/${bodyB64}.${sigB64Url}`;
 }
 function decodeArtifactUri(uri) {
   if (!uri.startsWith(FLUR_ARTIFACT_URI_PREFIX)) {
@@ -3805,9 +3904,9 @@ function decodeArtifactUri(uri) {
   }
   const bodyBytes = base64UrlDecode(payload.slice(0, dot));
   const sigBytes = base64UrlDecode(payload.slice(dot + 1));
-  if (sigBytes.length !== 64) {
+  if (sigBytes.length < 64 || sigBytes.length > 80) {
     throw new FlurArtifactError(
-      `Signature must be 64 bytes, got ${sigBytes.length}`,
+      `Signature length out of range: ${sigBytes.length}`,
       "INVALID_SIGNATURE"
     );
   }
@@ -3834,17 +3933,26 @@ function decodeArtifactUri(uri) {
     type,
     bodyBytes,
     body: bodyJson,
-    sig: bytesToHex(sigBytes)
+    // Encode as standard base64 (not url-safe) for sig field consistency.
+    sig: encodeStdBase64(sigBytes)
   };
 }
-function verifyArtifactSignature(decoded, publicKey, options = {}) {
+function encodeStdBase64(bytes) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(bytes).toString("base64");
+  }
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return typeof btoa === "function" ? btoa(bin) : "";
+}
+function verifyArtifactSignature(decoded, publicKeySpkiB64, options = {}) {
   if (options.enforceExpiry !== false && decoded.body.exp !== void 0) {
     const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
     if (decoded.body.exp < now) {
       throw new FlurArtifactError("Artifact has expired", "EXPIRED");
     }
   }
-  return verify(decoded.bodyBytes, hexToBytes(decoded.sig), publicKey);
+  return verifyIssuerP256(decoded.bodyBytes, decoded.sig, publicKeySpkiB64);
 }
 
 // src/artifacts/types.ts
@@ -3863,7 +3971,7 @@ var ARTIFACT_TYPES = {
   PASS: "pass",
   IDENTITY: "identity"
 };
-var HexString4 = (length) => z16.string().regex(
+var HexString = (length) => z16.string().regex(
   new RegExp(`^[0-9a-fA-F]{${length * 2}}$`),
   `expected ${length}-byte hex string`
 );
@@ -3881,7 +3989,7 @@ var ReceiptArtifactSchema = z16.object({
   settledAtMs: z16.number().int().positive(),
   ledgerTxnId: z16.string().min(1).max(64).optional(),
   memo: z16.string().max(140).optional(),
-  hashChainPrev: HexString4(32).optional()
+  hashChainPrev: HexString(32).optional()
 });
 var ShortId = z16.string().min(1).max(64);
 var PositiveInt = z16.number().int().positive();
@@ -3963,7 +4071,7 @@ var StatementArtifactSchema = z16.object({
   closingBalanceKobo: z16.number().int(),
   transactionCount: NonNegativeInt,
   currency: Currency2,
-  hashChainPrev: HexString4(32).optional()
+  hashChainPrev: HexString(32).optional()
 }).refine((v) => v.periodEndMs > v.periodStartMs, {
   message: "periodEndMs must be greater than periodStartMs",
   path: ["periodEndMs"]
@@ -3996,7 +4104,7 @@ var IdentityArtifactSchema = z16.object({
     "kyc_tier",
     "age_band"
   ]),
-  claimValueHash: HexString4(32),
+  claimValueHash: HexString(32),
   attestedAtMs: PositiveInt
 });
 var ARTIFACT_BODY_SCHEMAS = {
@@ -4060,7 +4168,7 @@ function createArtifactUri(input) {
   const signed = signArtifact(body, input.privateKey);
   return { uri: encodeArtifactUri(signed), signed };
 }
-function verifyArtifactUri(uri, publicKey, options = {}) {
+function verifyArtifactUri(uri, publicKeySpkiB64, options = {}) {
   const decoded = decodeArtifactUri(uri);
   if (!isKnownArtifactType(decoded.type)) {
     throw new FlurArtifactError(
@@ -4082,7 +4190,7 @@ function verifyArtifactUri(uri, publicKey, options = {}) {
       "INVALID_BODY"
     );
   }
-  const ok = verifyArtifactSignature(decoded, publicKey, options);
+  const ok = verifyArtifactSignature(decoded, publicKeySpkiB64, options);
   if (!ok) {
     throw new FlurArtifactError(
       "Artifact signature verification failed",
@@ -4158,6 +4266,7 @@ export {
   HARDENED_ARTIFACT_TYPES,
   IdentityArtifactSchema,
   IngestFundingResultSchema,
+  IssueAccountOacInputSchema,
   IssueOACInputSchema,
   LedgerJournalEntryArtifactSchema,
   ListPayoutDestinationsResultSchema,
@@ -4175,6 +4284,7 @@ export {
   OAC_DEFAULT_CUMULATIVE_KOBO,
   OAC_DEFAULT_PER_TX_KOBO,
   OAC_DEFAULT_VALIDITY_MS,
+  OFFLINE_CLAIM_SMS_PREFIX,
   OfflineClaimArtifactSchema,
   OfflineHoldRecordSchema,
   OfflinePaymentAuthorizationArtifactSchema,
@@ -4270,20 +4380,21 @@ export {
   createPassesClient,
   createReceiptArtifactUri,
   createReceiptsClient,
-  createSoftwareEd25519Signer,
   createSoftwareP256Signer,
   decodeArtifactUri,
   decodeAuthorizationQR,
   decodeBase45,
+  decodeOfflineClaimSmsMessage,
   decodePaymentRequestQR,
   encodeArtifactUri,
   encodeAuthorizationQR,
   encodeBase45,
   encodeNQR,
+  encodeOfflineClaimSmsMessage,
   encodePaymentRequestQR,
+  extractOfflineClaimSmsToken,
   formatAmount,
   generateDynamicQR,
-  generateKeyPair,
   generateStaticQR,
   init,
   isHardenedArtifactType,
@@ -4294,13 +4405,10 @@ export {
   parseAmountInput,
   parseNQR,
   parseQR,
-  publicKeyFromPrivate,
   readTLV,
   routingHint,
-  sign,
   signArtifact,
   signAuthorization,
-  signCanonical,
   signOAC,
   signPartnerRequest,
   signPass,
@@ -4308,11 +4416,9 @@ export {
   signReceipt,
   signRedemption,
   signRequestHMAC,
-  verify,
   verifyArtifactSignature,
   verifyArtifactUri,
   verifyAuthorization,
-  verifyCanonical,
   verifyClaimSignature,
   verifyOAC,
   verifyPass,