@nokinc-flur/sdk 1.1.5 → 2.1.0

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,11 +17,20 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACCOUNT_FUNDED_OAC_MAX_TTL_MS: () => ACCOUNT_FUNDED_OAC_MAX_TTL_MS,
   ACCOUNT_STATUSES: () => ACCOUNT_STATUSES,
   ACCOUNT_TYPES: () => ACCOUNT_TYPES,
   ADDITIONAL_DATA_SUBFIELD: () => ADDITIONAL_DATA_SUBFIELD,
@@ -33,6 +44,10 @@ __export(index_exports, {
   CLAIM_DOMAIN_V2: () => CLAIM_DOMAIN_V2,
   COLLECTION_INTENT_STATUSES: () => COLLECTION_INTENT_STATUSES,
   COLLECTION_PAYMENT_STATUSES: () => COLLECTION_PAYMENT_STATUSES,
+  CONSUMER_OFFLINE_CLAIM_SUBMIT_GRACE_MS: () => CONSUMER_OFFLINE_CLAIM_SUBMIT_GRACE_MS,
+  CONSUMER_PAYMENT_REQUEST_DOMAIN: () => CONSUMER_PAYMENT_REQUEST_DOMAIN,
+  CONSUMER_SETTLEMENT_DOMAIN: () => CONSUMER_SETTLEMENT_DOMAIN,
+  CONSUMER_SETTLEMENT_RECEIPT_QR_PREFIX: () => CONSUMER_SETTLEMENT_RECEIPT_QR_PREFIX,
   CUSTODIAL_MODES: () => CUSTODIAL_MODES,
   CollectionIntentSchema: () => CollectionIntentSchema,
   CollectionPaymentResultSchema: () => CollectionPaymentResultSchema,
@@ -42,6 +57,7 @@ __export(index_exports, {
   ConsumerOACRecordSchema: () => OACRecordSchema,
   ConsumerOACSchema: () => ConsumerOACSchema,
   ConsumerPaymentClaimSchema: () => ConsumerPaymentClaimSchema,
+  ConsumerPaymentRequestEnvelopeSchema: () => ConsumerPaymentRequestEnvelopeSchema,
   ConsumerSettleResultSchema: () => ConsumerSettleResultSchema,
   ConsumerSettlementSchema: () => ConsumerSettlementSchema,
   CreateCollectionIntentInputSchema: () => CreateCollectionIntentInputSchema,
@@ -51,10 +67,6 @@ __export(index_exports, {
   CreateWithdrawalResultSchema: () => CreateWithdrawalResultSchema,
   DeviceKeyAlgSchema: () => DeviceKeyAlgSchema,
   DeviceKeyRecordSchema: () => DeviceKeyRecordSchema,
-  DisableOfflineInputSchema: () => DisableOfflineInputSchema,
-  DisableOfflineResultSchema: () => DisableOfflineResultSchema,
-  EnableOfflineInputSchema: () => EnableOfflineInputSchema,
-  EnableOfflineResultSchema: () => EnableOfflineResultSchema,
   FIELD: () => FIELD,
   FLUR_ARTIFACT_URI_PREFIX: () => FLUR_ARTIFACT_URI_PREFIX,
   FLUR_ARTIFACT_URI_SCHEME: () => FLUR_ARTIFACT_URI_SCHEME,
@@ -70,7 +82,6 @@ __export(index_exports, {
   IdentityArtifactSchema: () => IdentityArtifactSchema,
   IngestFundingResultSchema: () => IngestFundingResultSchema,
   IssueAccountOacInputSchema: () => IssueAccountOacInputSchema,
-  IssueOACInputSchema: () => IssueOACInputSchema,
   LedgerJournalEntryArtifactSchema: () => LedgerJournalEntryArtifactSchema,
   ListPayoutDestinationsResultSchema: () => ListPayoutDestinationsResultSchema,
   MEMBERSHIP_ROLES: () => MEMBERSHIP_ROLES,
@@ -88,12 +99,16 @@ __export(index_exports, {
   OAC_DEFAULT_PER_TX_KOBO: () => OAC_DEFAULT_PER_TX_KOBO,
   OAC_DEFAULT_VALIDITY_MS: () => OAC_DEFAULT_VALIDITY_MS,
   OFFLINE_CLAIM_SMS_PREFIX: () => OFFLINE_CLAIM_SMS_PREFIX,
+  OFFLINE_SMS_SETTLE_DOMAIN: () => OFFLINE_SMS_SETTLE_DOMAIN,
+  OFFLINE_SMS_SETTLE_HEADER_BYTES: () => OFFLINE_SMS_SETTLE_HEADER_BYTES,
+  OFFLINE_SMS_SETTLE_PREFIX: () => OFFLINE_SMS_SETTLE_PREFIX,
+  OFFLINE_SMS_SETTLE_SIGNATURE_BYTES: () => OFFLINE_SMS_SETTLE_SIGNATURE_BYTES,
+  OFFLINE_SMS_SETTLE_TOKEN_BYTES: () => OFFLINE_SMS_SETTLE_TOKEN_BYTES,
+  OFFLINE_SMS_SETTLE_VERSION: () => OFFLINE_SMS_SETTLE_VERSION,
   OfflineClaimArtifactSchema: () => OfflineClaimArtifactSchema,
-  OfflineHoldRecordSchema: () => OfflineHoldRecordSchema,
   OfflinePaymentAuthorizationArtifactSchema: () => OfflinePaymentAuthorizationArtifactSchema,
   OfflinePaymentAuthorizationSchema: () => OfflinePaymentAuthorizationSchema,
   OfflinePaymentRequestSchema: () => OfflinePaymentRequestSchema,
-  OfflineStateResultSchema: () => OfflineStateResultSchema,
   OfflineStatusResultSchema: () => OfflineStatusResultSchema,
   OfflineTokenSchema: () => OfflineTokenSchema,
   P256EnrollmentChallengeInputSchema: () => P256EnrollmentChallengeInputSchema,
@@ -121,8 +136,6 @@ __export(index_exports, {
   PayoutEventInputSchema: () => PayoutEventInputSchema,
   ProviderEventInputSchema: () => ProviderEventInputSchema,
   ProviderEventRecordSchema: () => ProviderEventRecordSchema,
-  ProvisionOfflineAllowanceInputSchema: () => ProvisionOfflineAllowanceInputSchema,
-  ProvisionOfflineAllowanceResultSchema: () => ProvisionOfflineAllowanceResultSchema,
   PublicCollectionIntentSchema: () => PublicCollectionIntentSchema,
   RECEIPT_CHANNELS: () => RECEIPT_CHANNELS,
   RECEIPT_KINDS: () => RECEIPT_KINDS,
@@ -133,7 +146,6 @@ __export(index_exports, {
   ReconciliationReportSchema: () => ReconciliationReportSchema,
   RecordPayoutEventResultSchema: () => RecordPayoutEventResultSchema,
   RedemptionSchema: () => RedemptionSchema,
-  RegisterDeviceKeyInputSchema: () => RegisterDeviceKeyInputSchema,
   RegisterDeviceKeyP256InputSchema: () => RegisterDeviceKeyP256InputSchema,
   ReversalRecordArtifactSchema: () => ReversalRecordArtifactSchema,
   RevokeDeviceKeyInputSchema: () => RevokeDeviceKeyInputSchema,
@@ -152,18 +164,25 @@ __export(index_exports, {
   bodySha256Hex: () => bodySha256Hex,
   buildArtifactBody: () => buildArtifactBody,
   buildAuthorization: () => buildAuthorization,
+  buildConsumerPaymentRequest: () => buildConsumerPaymentRequest,
   buildOAC: () => buildOAC,
   buildPass: () => buildPass,
   buildPaymentRequest: () => buildPaymentRequest,
   buildReceipt: () => buildReceipt,
   buildRedemption: () => buildRedemption,
+  buildSmsSettleHeader: () => buildSmsSettleHeader,
+  buildSmsSettleSignedBytes: () => domainTag,
   canonicalClaimSigningBytes: () => canonicalClaimSigningBytes,
   canonicalClaimSigningPayload: () => canonicalClaimSigningPayload,
   canonicalJSONBytes: () => canonicalJSONBytes,
   canonicalJSONStringify: () => canonicalJSONStringify,
   canonicalRequestString: () => canonicalRequestString,
+  computeConsumerClaimEncounterId: () => computeConsumerClaimEncounterId,
   computeEncounterId: () => computeEncounterId,
   constantTimeEqual: () => constantTimeEqual,
+  consumerPaymentRequestSigningBytes: () => consumerPaymentRequestSigningBytes,
+  consumerPaymentRequestSigningPayload: () => consumerPaymentRequestSigningPayload,
+  consumerSettlementSigningPayload: () => consumerSettlementSigningPayload,
   crc16ccitt: () => crc16ccitt,
   crc16ccittHex: () => crc16ccittHex,
   createAccountsClient: () => createAccountsClient,
@@ -187,19 +206,27 @@ __export(index_exports, {
   decodeArtifactUri: () => decodeArtifactUri,
   decodeAuthorizationQR: () => decodeAuthorizationQR,
   decodeBase45: () => decodeBase45,
+  decodeConsumerSettlementReceiptQR: () => decodeConsumerSettlementReceiptQR,
   decodeOfflineClaimSmsMessage: () => decodeOfflineClaimSmsMessage,
+  decodeOfflineSmsSettleToken: () => decodeOfflineSmsSettleToken,
   decodePaymentRequestQR: () => decodePaymentRequestQR,
+  decodeUnverifiedConsumerSettlementReceiptQR: () => decodeUnverifiedConsumerSettlementReceiptQR,
+  derToRawP256Signature: () => derToRawP256Signature,
   encodeArtifactUri: () => encodeArtifactUri,
   encodeAuthorizationQR: () => encodeAuthorizationQR,
   encodeBase45: () => encodeBase45,
+  encodeConsumerSettlementReceiptQR: () => encodeConsumerSettlementReceiptQR,
   encodeNQR: () => encodeNQR,
   encodeOfflineClaimSmsMessage: () => encodeOfflineClaimSmsMessage,
+  encodeOfflineSmsSettleToken: () => encodeOfflineSmsSettleToken,
   encodePaymentRequestQR: () => encodePaymentRequestQR,
   extractOfflineClaimSmsToken: () => extractOfflineClaimSmsToken,
+  extractOfflineSmsSettleToken: () => extractOfflineSmsSettleToken,
   formatAmount: () => formatAmount,
   generateDynamicQR: () => generateDynamicQR,
   generateStaticQR: () => generateStaticQR,
   init: () => init,
+  isConsumerPaymentRequestExpired: () => isConsumerPaymentRequestExpired,
   isHardenedArtifactType: () => isHardenedArtifactType,
   isKnownArtifactType: () => isKnownArtifactType,
   isPassWithinValidity: () => isPassWithinValidity,
@@ -212,6 +239,7 @@ __export(index_exports, {
   routingHint: () => routingHint,
   signArtifact: () => signArtifact,
   signAuthorization: () => signAuthorization,
+  signConsumerPaymentRequest: () => signConsumerPaymentRequest,
   signOAC: () => signOAC,
   signPartnerRequest: () => signPartnerRequest,
   signPass: () => signPass,
@@ -223,7 +251,11 @@ __export(index_exports, {
   verifyArtifactUri: () => verifyArtifactUri,
   verifyAuthorization: () => verifyAuthorization,
   verifyClaimSignature: () => verifyClaimSignature,
+  verifyConsumerPaymentRequest: () => verifyConsumerPaymentRequest,
+  verifyConsumerSettlement: () => verifyConsumerSettlement,
+  verifyConsumerSettlementReceiptQR: () => verifyConsumerSettlementReceiptQR,
   verifyOAC: () => verifyOAC,
+  verifyOfflineSmsSettleToken: () => verifyOfflineSmsSettleToken,
   verifyPass: () => verifyPass,
   verifyPaymentRequest: () => verifyPaymentRequest,
   verifyReceipt: () => verifyReceipt,
@@ -234,13 +266,203 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/client.ts
-var import_zod5 = require("zod");
+var import_zod4 = require("zod");
 
 // src/contracts.ts
-var import_zod2 = require("zod");
-
-// src/me-offline/client.ts
 var import_zod = require("zod");
+var E164Regex = /^\+[1-9]\d{7,14}$/;
+var UuidSchema = import_zod.z.string().uuid();
+var IsoDateSchema = import_zod.z.string().datetime({ offset: true });
+var CurrencySchema = import_zod.z.string().trim().length(3).transform((value) => value.toUpperCase());
+var HealthResponseSchema = import_zod.z.object({
+  ok: import_zod.z.boolean()
+});
+var WelcomeResponseSchema = import_zod.z.object({
+  message: import_zod.z.string()
+});
+var OnboardingStartRequestSchema = import_zod.z.object({
+  phoneE164: import_zod.z.string().regex(E164Regex),
+  appInstanceId: import_zod.z.string().min(3),
+  platform: import_zod.z.enum(["android", "ios", "web"]),
+  turnstileToken: import_zod.z.string().min(20).optional(),
+  appAttestation: import_zod.z.object({
+    provider: import_zod.z.enum(["android", "ios", "web"]),
+    token: import_zod.z.string().min(24)
+  }).optional(),
+  firstName: import_zod.z.string().trim().min(1).max(80).optional(),
+  lastName: import_zod.z.string().trim().min(1).max(80).optional()
+});
+var OnboardingStartResponseSchema = import_zod.z.object({
+  requestId: import_zod.z.string().min(1),
+  checkUrl: import_zod.z.string().url().optional(),
+  expiresInSec: import_zod.z.number().int().positive(),
+  fallback: import_zod.z.enum(["SILENT_AUTH", "OTP"])
+});
+var OnboardingCompleteRequestSchema = import_zod.z.object({
+  requestId: import_zod.z.string().min(1),
+  code: import_zod.z.string().min(1).max(32),
+  appInstanceId: import_zod.z.string().min(3),
+  fingerprintHash: import_zod.z.string().min(3).optional()
+});
+var OnboardingCompleteResponseSchema = import_zod.z.object({
+  sessionToken: import_zod.z.string().min(1),
+  userId: UuidSchema,
+  restricted: import_zod.z.boolean(),
+  risk_reasons: import_zod.z.array(
+    import_zod.z.enum(["SIM_SWAP_RECENT", "ROAMING", "CARRIER_CHANGED"])
+  ),
+  stepUpRequired: import_zod.z.boolean().optional(),
+  riskStatus: import_zod.z.enum(["ok", "unavailable"]).optional()
+});
+var RegisterDeviceRequestSchema = import_zod.z.object({
+  userId: UuidSchema,
+  appInstanceId: import_zod.z.string().min(3),
+  platform: import_zod.z.string().min(2),
+  model: import_zod.z.string().optional(),
+  networkSignals: import_zod.z.object({
+    ip: import_zod.z.string().min(3),
+    asn: import_zod.z.number().int().optional(),
+    country: import_zod.z.string().min(2).optional(),
+    carrier: import_zod.z.string().optional()
+  })
+});
+var RegisterDeviceResponseSchema = import_zod.z.object({
+  deviceId: import_zod.z.string().min(1),
+  fingerprintHash: import_zod.z.string().min(1),
+  driftScore: import_zod.z.number(),
+  trustState: import_zod.z.enum(["TRUSTED_PRIMARY", "TRUSTED_SECONDARY", "UNVERIFIED"]),
+  stepUpRequired: import_zod.z.boolean()
+});
+var AuthRefreshRequestSchema = import_zod.z.object({
+  userId: UuidSchema,
+  refreshToken: import_zod.z.string().min(8),
+  appInstanceId: import_zod.z.string().min(3),
+  fingerprintHash: import_zod.z.string().min(3)
+});
+var AuthRefreshResponseSchema = import_zod.z.object({
+  refreshToken: import_zod.z.string().min(8),
+  stepUpRequired: import_zod.z.boolean()
+});
+var AuthLogoutRequestSchema = import_zod.z.object({
+  userId: UuidSchema,
+  refreshToken: import_zod.z.string().min(8)
+});
+var PinSetRequestSchema = import_zod.z.object({
+  userId: UuidSchema,
+  pin: import_zod.z.string().regex(/^\d{6}$/)
+});
+var PinVerifyRequestSchema = import_zod.z.object({
+  userId: UuidSchema,
+  pin: import_zod.z.string().regex(/^\d{6}$/)
+});
+var OkResponseSchema = import_zod.z.object({
+  ok: import_zod.z.boolean()
+});
+var RegisterSendDeviceKeyRequestSchema = import_zod.z.object({
+  userId: UuidSchema,
+  deviceId: import_zod.z.string().min(3),
+  publicKey: import_zod.z.string().min(32)
+});
+var SEND_AUTH_PURPOSES = ["send_money", "offline_revoke"];
+var SendChallengeRequestSchema = import_zod.z.object({
+  userId: UuidSchema,
+  deviceId: import_zod.z.string().min(3),
+  purpose: import_zod.z.enum(SEND_AUTH_PURPOSES).optional()
+});
+var SendChallengeResponseSchema = import_zod.z.object({
+  challengeId: UuidSchema,
+  nonce: import_zod.z.string().min(1),
+  expiresAt: IsoDateSchema
+});
+var SendVerifyRequestSchema = import_zod.z.object({
+  userId: UuidSchema,
+  deviceId: import_zod.z.string().min(3),
+  challengeId: UuidSchema,
+  signature: import_zod.z.string().min(16)
+});
+var SendVerifyResponseSchema = import_zod.z.object({
+  sendAuthToken: import_zod.z.string().min(16)
+});
+var ResolveRecipientRequestSchema = import_zod.z.object({
+  identifier: import_zod.z.string().min(3)
+});
+var ResolveRecipientResponseSchema = import_zod.z.object({
+  recipientUserId: UuidSchema,
+  displayName: import_zod.z.string().min(1),
+  normalizedIdentifier: import_zod.z.string().regex(E164Regex),
+  isActive: import_zod.z.boolean()
+});
+var CreateTransferRequestSchema = import_zod.z.object({
+  recipientIdentifier: import_zod.z.string().min(3),
+  amountMinor: import_zod.z.number().int().positive(),
+  currency: CurrencySchema,
+  sendAuthToken: import_zod.z.string().min(16)
+});
+var TransferStatusSchema = import_zod.z.enum(["SETTLED", "PENDING_REVIEW", "DECLINED"]);
+var TransferResponseSchema = import_zod.z.object({
+  transactionId: import_zod.z.string().min(1),
+  status: TransferStatusSchema,
+  userStatus: TransferStatusSchema,
+  recipientName: import_zod.z.string().min(1),
+  timestamp: IsoDateSchema
+});
+var DirectionSchema = import_zod.z.enum(["OUTGOING", "INCOMING"]);
+var AccountActivityItemSchema = import_zod.z.object({
+  id: import_zod.z.string().min(1),
+  type: import_zod.z.string().min(1),
+  direction: DirectionSchema,
+  name: import_zod.z.string().min(1),
+  identifier: import_zod.z.string().min(1),
+  amountMinor: import_zod.z.number().int(),
+  currency: CurrencySchema,
+  status: import_zod.z.string().min(1),
+  timestamp: IsoDateSchema
+});
+var AccountSummaryResponseSchema = import_zod.z.object({
+  /** Authenticated user's stable internal id. */
+  userId: UuidSchema,
+  /**
+   * 10-digit Nigeria Uniform Bank Account Number (NUBAN) allocated by the
+   * bank partner. `null` when the user has no partner-allocated account yet.
+   */
+  nuban: import_zod.z.string().regex(/^[0-9]{10}$/).nullable(),
+  balance: import_zod.z.number().int(),
+  currency: CurrencySchema,
+  dailySendLimit: import_zod.z.number().int().nonnegative(),
+  dailySendRemaining: import_zod.z.number().int().nonnegative(),
+  kycTier: import_zod.z.string().min(1),
+  kycStatus: import_zod.z.string().min(1),
+  recentActivity: import_zod.z.array(AccountActivityItemSchema)
+});
+var TransactionsListResponseSchema = import_zod.z.object({
+  items: import_zod.z.array(AccountActivityItemSchema),
+  nextCursor: import_zod.z.string().nullable()
+});
+var TransactionDetailResponseSchema = import_zod.z.object({
+  transactionId: import_zod.z.string().min(1),
+  type: import_zod.z.string().min(1),
+  direction: DirectionSchema,
+  counterpartyName: import_zod.z.string().min(1),
+  counterpartyIdentifier: import_zod.z.string().min(1),
+  amountMinor: import_zod.z.number().int(),
+  currency: CurrencySchema,
+  status: import_zod.z.string().min(1),
+  timestamp: IsoDateSchema
+});
+var PushRegisterRequestSchema = import_zod.z.object({
+  deviceId: import_zod.z.string().min(3),
+  platform: import_zod.z.enum(["ios", "android", "web"]),
+  token: import_zod.z.string().min(16)
+});
+var CreatePayLinkResponseSchema = import_zod.z.object({
+  token: import_zod.z.string().min(1)
+});
+var ResolvePayLinkResponseSchema = import_zod.z.object({
+  recipientUserId: UuidSchema,
+  displayName: import_zod.z.string().min(1),
+  normalizedIdentifier: import_zod.z.string().regex(E164Regex),
+  isActive: import_zod.z.boolean()
+});
 
 // src/errors.ts
 var backendErrorCodeSet = /* @__PURE__ */ new Set([
@@ -344,556 +566,9 @@ async function mapToFlurError(res) {
   });
 }
 
-// src/me-offline/client.ts
-var Hex64 = import_zod.z.string().regex(/^[0-9a-f]{64}$/i);
-var Sha256Hex = import_zod.z.string().regex(/^[0-9a-f]{64}$/i);
-var Base64Std = import_zod.z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/);
-var RegisterDeviceKeyInputSchema = import_zod.z.object({
-  deviceId: import_zod.z.string().min(1).max(128),
-  publicKeyHex: Hex64
-});
-var AttestationSecurityLevelSchema = import_zod.z.enum([
-  "STRONGBOX",
-  "TEE",
-  "SECURE_ENCLAVE",
-  "SOFTWARE"
-]);
-var DeviceKeyAlgSchema = import_zod.z.literal("p256");
-var RegisterDeviceKeyP256InputSchema = import_zod.z.object({
-  deviceId: import_zod.z.string().min(1).max(128),
-  /** P-256 SubjectPublicKeyInfo DER, base64. */
-  publicKeySpkiB64: Base64Std.min(64).max(4096),
-  /** Base64 of the server-issued enrollment challenge string. */
-  challengeB64: Base64Std.min(8).max(1024),
-  /** iOS App Attest payload or Android X.509 Key Attestation chain. */
-  attestationChainB64: import_zod.z.array(Base64Std.min(16).max(16384)).min(1).max(16),
-  securityLevel: AttestationSecurityLevelSchema
-});
-var P256EnrollmentChallengeInputSchema = import_zod.z.object({
-  deviceId: import_zod.z.string().min(1).max(128)
-});
-var P256EnrollmentChallengeResultSchema = import_zod.z.object({
-  challenge: import_zod.z.string().min(16),
-  expiresAtMs: import_zod.z.number().int().positive()
-});
-var DeviceKeyRecordSchema = import_zod.z.object({
-  id: import_zod.z.string().uuid(),
-  userId: import_zod.z.string().uuid(),
-  deviceId: import_zod.z.string(),
-  /** Always 'p256' on the consumer offline rail. Field retained for forward-compat. */
-  alg: DeviceKeyAlgSchema.default("p256"),
-  /** Legacy ed25519 hex key. Always null on new records (kept for back-compat reads). */
-  publicKeyHex: Hex64.nullable().default(null),
-  /** P-256 SubjectPublicKeyInfo DER, base64. Required for new records. */
-  publicKeySpkiB64: Base64Std.nullable().default(null),
-  securityLevel: AttestationSecurityLevelSchema.nullable().default(null),
-  hardwareBacked: import_zod.z.boolean().default(false),
-  attestedAtMs: import_zod.z.number().int().nonnegative().nullable().default(null),
-  createdAtMs: import_zod.z.number().int().nonnegative(),
-  revokedAtMs: import_zod.z.number().int().nonnegative().nullable()
-});
-var ConsumerOACSchema = import_zod.z.object({
-  oacId: import_zod.z.string().uuid(),
-  issuerId: import_zod.z.string().min(1).max(64),
-  userId: import_zod.z.string().uuid(),
-  deviceId: import_zod.z.string().min(1).max(128),
-  /**
-   * Always 'p256'. Required on the wire (backend always emits it).
-   * Kept as a literal so input/output infer identically and the schema
-   * can be nested inside other response shapes without Zod input/output
-   * divergence under tsup DTS bundling.
-   */
-  alg: import_zod.z.literal("p256"),
-  /** P-256 SubjectPublicKeyInfo DER, base64. */
-  devicePubkeySpkiB64: Base64Std.min(64).max(4096),
-  perTxCapKobo: import_zod.z.number().int().positive(),
-  cumulativeCapKobo: import_zod.z.number().int().positive(),
-  currency: import_zod.z.string().length(3),
-  validFromMs: import_zod.z.number().int().nonnegative(),
-  validUntilMs: import_zod.z.number().int().nonnegative(),
-  counterSeed: import_zod.z.number().int().nonnegative(),
-  issuedAtMs: import_zod.z.number().int().nonnegative()
-});
-var SignedConsumerOACSchema = import_zod.z.object({
-  oac: ConsumerOACSchema,
-  /** ASN.1 DER ECDSA P-256 issuer signature, base64. */
-  issuerSig: Base64Std.min(16).max(2048),
-  /** Issuer's P-256 public key as SubjectPublicKeyInfo DER, base64. */
-  issuerPublicKeySpkiB64: Base64Std.min(64).max(4096)
-});
-var OACRecordSchema = SignedConsumerOACSchema.extend({
-  currentOfflineSpentKobo: import_zod.z.number().int().nonnegative(),
-  status: import_zod.z.enum([
-    "active",
-    "superseded",
-    "expired",
-    "revoked",
-    "disabling",
-    "draining",
-    "closed"
-  ]),
-  supersededAtMs: import_zod.z.number().int().nonnegative().nullable(),
-  revokedAtMs: import_zod.z.number().int().nonnegative().nullable(),
-  holdId: import_zod.z.string().uuid().nullable().optional()
-});
-var IssueOACInputSchema = import_zod.z.object({
-  deviceId: import_zod.z.string().min(1).max(128),
-  perTxCapKobo: import_zod.z.number().int().positive().optional(),
-  cumulativeCapKobo: import_zod.z.number().int().positive().optional(),
-  ttlMs: import_zod.z.number().int().min(6e4).max(1e3 * 60 * 60 * 24 * 7).optional(),
-  spendableOnlineKobo: import_zod.z.number().int().nonnegative().optional()
-});
-var IssueAccountOacInputSchema = import_zod.z.object({
-  deviceId: import_zod.z.string().min(1).max(128),
-  perTxCapKobo: import_zod.z.number().int().positive().optional(),
-  cumulativeCapKobo: import_zod.z.number().int().positive().optional(),
-  ttlMs: import_zod.z.number().int().min(6e4).max(1e3 * 60 * 60 * 24 * 7).optional()
-});
-var EnableOfflineInputSchema = import_zod.z.object({
-  deviceId: import_zod.z.string().min(1).max(128),
-  amountKobo: import_zod.z.number().int().positive(),
-  perTxCapKobo: import_zod.z.number().int().positive().optional(),
-  ttlMs: import_zod.z.number().int().min(6e4).max(1e3 * 60 * 60 * 24 * 7).optional(),
-  installId: import_zod.z.string().min(1).max(128),
-  partnerId: import_zod.z.string().min(1).max(64).optional()
-});
-var ProvisionOfflineAllowanceInputSchema = EnableOfflineInputSchema;
-var DisableOfflineInputSchema = import_zod.z.object({
-  deviceId: import_zod.z.string().min(1).max(128),
-  installId: import_zod.z.string().min(1).max(128).optional(),
-  claims: import_zod.z.array(import_zod.z.unknown()).max(256).optional()
-});
-var OfflineHoldRecordSchema = import_zod.z.object({
-  holdId: import_zod.z.string().uuid(),
-  userId: import_zod.z.string().uuid(),
-  deviceId: import_zod.z.string(),
-  partnerId: import_zod.z.string(),
-  adapterKind: import_zod.z.string(),
-  externalHoldRef: import_zod.z.string().nullable(),
-  amountKobo: import_zod.z.number().int().nonnegative(),
-  capturedKobo: import_zod.z.number().int().nonnegative(),
-  releasedKobo: import_zod.z.number().int().nonnegative(),
-  remainingKobo: import_zod.z.number().int().nonnegative(),
-  currency: import_zod.z.string().length(3),
-  status: import_zod.z.enum([
-    "placing",
-    "active",
-    "disabling",
-    "draining",
-    "closed",
-    "revoked",
-    "failed"
-  ]),
-  installId: import_zod.z.string().nullable(),
-  drainDeadlineMs: import_zod.z.number().int().nonnegative(),
-  disableRequestedAtMs: import_zod.z.number().int().nonnegative().nullable(),
-  createdAtMs: import_zod.z.number().int().nonnegative(),
-  closedAtMs: import_zod.z.number().int().nonnegative().nullable(),
-  isTrusted: import_zod.z.boolean().optional()
-});
-var EnableOfflineResultSchema = import_zod.z.object({
-  hold: OfflineHoldRecordSchema,
-  oac: OACRecordSchema
-});
-var ProvisionOfflineAllowanceResultSchema = EnableOfflineResultSchema;
-var DisableOfflineResultSchema = import_zod.z.object({
-  hold: OfflineHoldRecordSchema,
-  trusted: import_zod.z.boolean(),
-  settledClaims: import_zod.z.number().int().nonnegative()
-});
-var OfflineStatusResultSchema = import_zod.z.object({
-  hold: OfflineHoldRecordSchema.nullable(),
-  active: OACRecordSchema.nullable()
-});
-var OfflineStateResultSchema = import_zod.z.object({
-  active: OACRecordSchema.nullable()
-});
-var ConsumerPaymentClaimSchema = import_zod.z.object({
-  /** Always 'p256'. Retained for forward-compat and as an explicit domain marker. */
-  alg: import_zod.z.literal("p256").default("p256"),
-  oacId: import_zod.z.string().uuid(),
-  encounterId: Sha256Hex.optional(),
-  payerUserId: import_zod.z.string().uuid(),
-  payeeUserId: import_zod.z.string().uuid(),
-  payerDeviceId: import_zod.z.string().min(1).max(128),
-  payerNonce: import_zod.z.string().min(8).max(128),
-  payeeNonce: import_zod.z.string().min(8).max(128),
-  amountKobo: import_zod.z.number().int().positive(),
-  currency: import_zod.z.string().length(3).default("NGN"),
-  occurredAtMs: import_zod.z.number().int().nonnegative(),
-  completedAtMs: import_zod.z.number().int().nonnegative().optional(),
-  contextId: import_zod.z.string().max(128).optional(),
-  payerPubkeySpkiB64: Base64Std.min(64).max(4096),
-  payerSignatureDerB64: Base64Std.min(16).max(2048),
-  payeePubkeySpkiB64: Base64Std.min(64).max(4096).optional(),
-  payeeSignatureDerB64: Base64Std.min(16).max(2048).optional()
-});
-var ConsumerSettlementSchema = import_zod.z.object({
-  settlementId: import_zod.z.string().uuid(),
-  settlementKey: Sha256Hex,
-  encounterId: Sha256Hex,
-  oacId: import_zod.z.string().uuid(),
-  payerUserId: import_zod.z.string().uuid(),
-  payeeUserId: import_zod.z.string().uuid(),
-  amountKobo: import_zod.z.number().int().positive(),
-  currency: import_zod.z.string().length(3),
-  status: import_zod.z.enum(["SETTLED", "REVIEW"]),
-  reviewReason: import_zod.z.string().nullable(),
-  ledgerRef: import_zod.z.string().nullable(),
-  /** ASN.1 DER ECDSA P-256 issuer signature, base64. */
-  issuerSig: Base64Std.min(16).max(2048),
-  createdAtMs: import_zod.z.number().int().nonnegative()
-});
-var ConsumerSettleResultSchema = import_zod.z.object({
-  settlement: ConsumerSettlementSchema,
-  encounterId: Sha256Hex,
-  replayed: import_zod.z.boolean()
-});
-var RevokeDeviceKeyInputSchema = import_zod.z.object({
-  deviceId: import_zod.z.string().min(1).max(128),
-  /** Step-up token from /api/v1/auth/send/verify with purpose='offline_revoke'. */
-  sendAuthToken: import_zod.z.string().min(16)
-});
-function createMeOfflineClient(opts) {
-  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
-  if (!fetchImpl) {
-    throw new Error("createMeOfflineClient: no fetch implementation available");
-  }
-  const baseUrl = opts.baseUrl.replace(/\/$/, "");
-  async function call(method, path, body, parser) {
-    const init2 = {
-      method,
-      headers: {
-        "content-type": "application/json",
-        accept: "application/json"
-      }
-    };
-    if (body !== void 0) init2.body = JSON.stringify(body);
-    const resp = await fetchImpl(`${baseUrl}${path}`, init2);
-    const text = await resp.text();
-    let raw = void 0;
-    if (text) {
-      try {
-        raw = JSON.parse(text);
-      } catch {
-      }
-    }
-    if (!resp.ok) {
-      const code = raw && typeof raw === "object" && "code" in raw && typeof raw.code === "string" ? raw.code : `http_${resp.status}`;
-      const message = raw && typeof raw === "object" && "message" in raw && typeof raw.message === "string" ? raw.message : `request failed with status ${resp.status}`;
-      throw new FlurApiError(resp.status, code, message, raw);
-    }
-    return parser(raw);
-  }
-  const deviceKeyItems = import_zod.z.object({ items: import_zod.z.array(DeviceKeyRecordSchema) });
-  return {
-    registerDeviceKey: (input) => call(
-      "POST",
-      "/v1/me/offline/keys",
-      RegisterDeviceKeyInputSchema.parse(input),
-      (raw) => DeviceKeyRecordSchema.parse(raw)
-    ),
-    issueP256EnrollmentChallenge: (input) => call(
-      "POST",
-      "/v1/me/offline/keys/p256/challenge",
-      P256EnrollmentChallengeInputSchema.parse(input),
-      (raw) => P256EnrollmentChallengeResultSchema.parse(raw)
-    ),
-    registerDeviceKeyP256: (input) => call(
-      "POST",
-      "/v1/me/offline/keys/p256",
-      RegisterDeviceKeyP256InputSchema.parse(input),
-      (raw) => DeviceKeyRecordSchema.parse(raw)
-    ),
-    listDeviceKeys: () => call(
-      "GET",
-      "/v1/me/offline/keys",
-      void 0,
-      (raw) => deviceKeyItems.parse(raw)
-    ),
-    revokeDeviceKey: (input) => call(
-      "POST",
-      "/v1/me/offline/keys/revoke",
-      RevokeDeviceKeyInputSchema.parse(input),
-      () => void 0
-    ),
-    issueAccountOac: (input) => call(
-      "POST",
-      "/v1/me/offline/oac",
-      IssueAccountOacInputSchema.parse(input),
-      (raw) => OACRecordSchema.parse(raw)
-    ),
-    provisionAllowance: (input) => call(
-      "POST",
-      "/v1/me/offline/allowance",
-      ProvisionOfflineAllowanceInputSchema.parse(input),
-      (raw) => ProvisionOfflineAllowanceResultSchema.parse(raw)
-    ),
-    enable: (input) => call(
-      "POST",
-      "/v1/me/offline/enable",
-      EnableOfflineInputSchema.parse(input),
-      (raw) => EnableOfflineResultSchema.parse(raw)
-    ),
-    refresh: (input) => call(
-      "POST",
-      "/v1/me/offline/refresh",
-      IssueOACInputSchema.parse(input),
-      (raw) => OACRecordSchema.parse(raw)
-    ),
-    disable: (input) => call(
-      "POST",
-      "/v1/me/offline/disable",
-      DisableOfflineInputSchema.parse(input),
-      (raw) => DisableOfflineResultSchema.parse(raw)
-    ),
-    getStatus: (deviceId) => {
-      const qs = deviceId ? `?deviceId=${encodeURIComponent(deviceId)}` : "";
-      return call(
-        "GET",
-        `/v1/me/offline/status${qs}`,
-        void 0,
-        (raw) => OfflineStatusResultSchema.parse(raw)
-      );
-    },
-    getState: (deviceId) => {
-      const qs = deviceId ? `?deviceId=${encodeURIComponent(deviceId)}` : "";
-      return call(
-        "GET",
-        `/v1/me/offline/state${qs}`,
-        void 0,
-        (raw) => OfflineStateResultSchema.parse(raw)
-      );
-    },
-    submitClaim: (claim) => call(
-      "POST",
-      "/v1/me/offline/claims",
-      ConsumerPaymentClaimSchema.parse(claim),
-      (raw) => ConsumerSettleResultSchema.parse(raw)
-    )
-  };
-}
-
-// src/contracts.ts
-var E164Regex = /^\+[1-9]\d{7,14}$/;
-var UuidSchema = import_zod2.z.string().uuid();
-var IsoDateSchema = import_zod2.z.string().datetime({ offset: true });
-var CurrencySchema = import_zod2.z.string().trim().length(3).transform((value) => value.toUpperCase());
-var HealthResponseSchema = import_zod2.z.object({
-  ok: import_zod2.z.boolean()
-});
-var WelcomeResponseSchema = import_zod2.z.object({
-  message: import_zod2.z.string()
-});
-var OnboardingStartRequestSchema = import_zod2.z.object({
-  phoneE164: import_zod2.z.string().regex(E164Regex),
-  appInstanceId: import_zod2.z.string().min(3),
-  platform: import_zod2.z.enum(["android", "ios", "web"]),
-  turnstileToken: import_zod2.z.string().min(20).optional(),
-  appAttestation: import_zod2.z.object({
-    provider: import_zod2.z.enum(["android", "ios", "web"]),
-    token: import_zod2.z.string().min(24)
-  }).optional(),
-  firstName: import_zod2.z.string().trim().min(1).max(80).optional(),
-  lastName: import_zod2.z.string().trim().min(1).max(80).optional()
-});
-var OnboardingStartResponseSchema = import_zod2.z.object({
-  requestId: import_zod2.z.string().min(1),
-  checkUrl: import_zod2.z.string().url().optional(),
-  expiresInSec: import_zod2.z.number().int().positive(),
-  fallback: import_zod2.z.enum(["SILENT_AUTH", "OTP"])
-});
-var OnboardingCompleteRequestSchema = import_zod2.z.object({
-  requestId: import_zod2.z.string().min(1),
-  code: import_zod2.z.string().min(1).max(32),
-  appInstanceId: import_zod2.z.string().min(3),
-  fingerprintHash: import_zod2.z.string().min(3).optional()
-});
-var OnboardingCompleteResponseSchema = import_zod2.z.object({
-  sessionToken: import_zod2.z.string().min(1),
-  userId: UuidSchema,
-  restricted: import_zod2.z.boolean(),
-  risk_reasons: import_zod2.z.array(
-    import_zod2.z.enum(["SIM_SWAP_RECENT", "ROAMING", "CARRIER_CHANGED"])
-  ),
-  stepUpRequired: import_zod2.z.boolean().optional(),
-  riskStatus: import_zod2.z.enum(["ok", "unavailable"]).optional()
-});
-var RegisterDeviceRequestSchema = import_zod2.z.object({
-  userId: UuidSchema,
-  appInstanceId: import_zod2.z.string().min(3),
-  platform: import_zod2.z.string().min(2),
-  model: import_zod2.z.string().optional(),
-  networkSignals: import_zod2.z.object({
-    ip: import_zod2.z.string().min(3),
-    asn: import_zod2.z.number().int().optional(),
-    country: import_zod2.z.string().min(2).optional(),
-    carrier: import_zod2.z.string().optional()
-  })
-});
-var RegisterDeviceResponseSchema = import_zod2.z.object({
-  deviceId: import_zod2.z.string().min(1),
-  fingerprintHash: import_zod2.z.string().min(1),
-  driftScore: import_zod2.z.number(),
-  trustState: import_zod2.z.enum(["TRUSTED_PRIMARY", "TRUSTED_SECONDARY", "UNVERIFIED"]),
-  stepUpRequired: import_zod2.z.boolean()
-});
-var AuthRefreshRequestSchema = import_zod2.z.object({
-  userId: UuidSchema,
-  refreshToken: import_zod2.z.string().min(8),
-  appInstanceId: import_zod2.z.string().min(3),
-  fingerprintHash: import_zod2.z.string().min(3)
-});
-var AuthRefreshResponseSchema = import_zod2.z.object({
-  refreshToken: import_zod2.z.string().min(8),
-  stepUpRequired: import_zod2.z.boolean()
-});
-var AuthLogoutRequestSchema = import_zod2.z.object({
-  userId: UuidSchema,
-  refreshToken: import_zod2.z.string().min(8)
-});
-var PinSetRequestSchema = import_zod2.z.object({
-  userId: UuidSchema,
-  pin: import_zod2.z.string().regex(/^\d{6}$/)
-});
-var PinVerifyRequestSchema = import_zod2.z.object({
-  userId: UuidSchema,
-  pin: import_zod2.z.string().regex(/^\d{6}$/)
-});
-var OkResponseSchema = import_zod2.z.object({
-  ok: import_zod2.z.boolean()
-});
-var RegisterSendDeviceKeyRequestSchema = import_zod2.z.object({
-  userId: UuidSchema,
-  deviceId: import_zod2.z.string().min(3),
-  publicKey: import_zod2.z.string().min(32)
-});
-var SEND_AUTH_PURPOSES = ["send_money", "offline_revoke"];
-var SendChallengeRequestSchema = import_zod2.z.object({
-  userId: UuidSchema,
-  deviceId: import_zod2.z.string().min(3),
-  purpose: import_zod2.z.enum(SEND_AUTH_PURPOSES).optional()
-});
-var SendChallengeResponseSchema = import_zod2.z.object({
-  challengeId: UuidSchema,
-  nonce: import_zod2.z.string().min(1),
-  expiresAt: IsoDateSchema
-});
-var SendVerifyRequestSchema = import_zod2.z.object({
-  userId: UuidSchema,
-  deviceId: import_zod2.z.string().min(3),
-  challengeId: UuidSchema,
-  signature: import_zod2.z.string().min(16)
-});
-var SendVerifyResponseSchema = import_zod2.z.object({
-  sendAuthToken: import_zod2.z.string().min(16)
-});
-var ResolveRecipientRequestSchema = import_zod2.z.object({
-  identifier: import_zod2.z.string().min(3)
-});
-var ResolveRecipientResponseSchema = import_zod2.z.object({
-  recipientUserId: UuidSchema,
-  displayName: import_zod2.z.string().min(1),
-  normalizedIdentifier: import_zod2.z.string().regex(E164Regex),
-  isActive: import_zod2.z.boolean()
-});
-var CreateTransferRequestSchema = import_zod2.z.object({
-  recipientIdentifier: import_zod2.z.string().min(3),
-  amountMinor: import_zod2.z.number().int().positive(),
-  currency: CurrencySchema,
-  sendAuthToken: import_zod2.z.string().min(16)
-});
-var TransferStatusSchema = import_zod2.z.enum(["SETTLED", "PENDING_REVIEW", "DECLINED"]);
-var TransferResponseSchema = import_zod2.z.object({
-  transactionId: import_zod2.z.string().min(1),
-  status: TransferStatusSchema,
-  userStatus: TransferStatusSchema,
-  recipientName: import_zod2.z.string().min(1),
-  timestamp: IsoDateSchema,
-  /**
-   * Fresh issuer-signed OACs returned by the backend's post-commit
-   * rotation hook on `SETTLED` transfers.
-   *
-   * In the current backend implementation this hook rotates LEGACY
-   * hold-backed OACs only. Account-funded (no-hold) OACs introduced by
-   * the unified-pay-rails refactor are NOT rotated here — their
-   * cumulative spend counter and main-balance check are enforced at
-   * claim submission time via `createTransfer` under the per-sender
-   * advisory lock, so a stale no-hold OAC cannot authorise overspending
-   * (it can only resolve to REVIEW on submission).
-   *
-   * Optional: omitted when the sender has no registered hold-backed
-   * devices, when the refresh failed (best-effort), or on retry replays
-   * that pre-date the refresh. When present, the entries supersede any
-   * locally cached OACs for the listed devices; when absent, clients
-   * should fall back to `/v1/me/offline/refresh`.
-   *
-   * Each entry is validated against the canonical `OACRecordSchema`,
-   * so consumers can trust the runtime shape matches the static type.
-   */
-  offlineOacs: OACRecordSchema.array().optional()
-});
-var DirectionSchema = import_zod2.z.enum(["OUTGOING", "INCOMING"]);
-var AccountActivityItemSchema = import_zod2.z.object({
-  id: import_zod2.z.string().min(1),
-  type: import_zod2.z.string().min(1),
-  direction: DirectionSchema,
-  name: import_zod2.z.string().min(1),
-  identifier: import_zod2.z.string().min(1),
-  amountMinor: import_zod2.z.number().int(),
-  currency: CurrencySchema,
-  status: import_zod2.z.string().min(1),
-  timestamp: IsoDateSchema
-});
-var AccountSummaryResponseSchema = import_zod2.z.object({
-  /** Authenticated user's stable internal id. */
-  userId: UuidSchema,
-  /**
-   * 10-digit Nigeria Uniform Bank Account Number (NUBAN) allocated by the
-   * bank partner. `null` when the user has no partner-allocated account yet.
-   */
-  nuban: import_zod2.z.string().regex(/^[0-9]{10}$/).nullable(),
-  balance: import_zod2.z.number().int(),
-  currency: CurrencySchema,
-  dailySendLimit: import_zod2.z.number().int().nonnegative(),
-  dailySendRemaining: import_zod2.z.number().int().nonnegative(),
-  kycTier: import_zod2.z.string().min(1),
-  kycStatus: import_zod2.z.string().min(1),
-  recentActivity: import_zod2.z.array(AccountActivityItemSchema)
-});
-var TransactionsListResponseSchema = import_zod2.z.object({
-  items: import_zod2.z.array(AccountActivityItemSchema),
-  nextCursor: import_zod2.z.string().nullable()
-});
-var TransactionDetailResponseSchema = import_zod2.z.object({
-  transactionId: import_zod2.z.string().min(1),
-  type: import_zod2.z.string().min(1),
-  direction: DirectionSchema,
-  counterpartyName: import_zod2.z.string().min(1),
-  counterpartyIdentifier: import_zod2.z.string().min(1),
-  amountMinor: import_zod2.z.number().int(),
-  currency: CurrencySchema,
-  status: import_zod2.z.string().min(1),
-  timestamp: IsoDateSchema
-});
-var PushRegisterRequestSchema = import_zod2.z.object({
-  deviceId: import_zod2.z.string().min(3),
-  platform: import_zod2.z.enum(["ios", "android", "web"]),
-  token: import_zod2.z.string().min(16)
-});
-var CreatePayLinkResponseSchema = import_zod2.z.object({
-  token: import_zod2.z.string().min(1)
-});
-var ResolvePayLinkResponseSchema = import_zod2.z.object({
-  recipientUserId: UuidSchema,
-  displayName: import_zod2.z.string().min(1),
-  normalizedIdentifier: import_zod2.z.string().regex(E164Regex),
-  isActive: import_zod2.z.boolean()
-});
-
 // src/primitives.ts
-var import_zod3 = require("zod");
-var CurrencyCodeSchema = import_zod3.z.string().trim().length(3).transform((value) => value.toUpperCase());
+var import_zod2 = require("zod");
+var CurrencyCodeSchema = import_zod2.z.string().trim().length(3).transform((value) => value.toUpperCase());
 var currencyFractionDigits = {
   NGN: 2,
   USD: 2,
@@ -987,7 +662,7 @@ function moneyMinorToNumber(amountMinor) {
 }
 
 // src/collections/client.ts
-var import_zod4 = require("zod");
+var import_zod3 = require("zod");
 var MERCHANT_PROFILE_STATUSES = [
   "pending",
   "active",
@@ -1017,172 +692,172 @@ var MERCHANT_PAYOUT_STATUSES = [
   "failed",
   "cancelled"
 ];
-var MoneyKoboSchema = import_zod4.z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
-var MetadataSchema = import_zod4.z.record(
-  import_zod4.z.union([import_zod4.z.string(), import_zod4.z.number(), import_zod4.z.boolean(), import_zod4.z.null()])
+var MoneyKoboSchema = import_zod3.z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var MetadataSchema = import_zod3.z.record(
+  import_zod3.z.union([import_zod3.z.string(), import_zod3.z.number(), import_zod3.z.boolean(), import_zod3.z.null()])
 );
-var CurrencySchema2 = import_zod4.z.string().trim().length(3).transform((value) => value.toUpperCase());
-var ReferenceSchema = import_zod4.z.string().trim().min(6).max(128).regex(/^[A-Za-z0-9._:-]+$/);
-var MerchantProfileSchema = import_zod4.z.object({
-  accountId: import_zod4.z.string().uuid(),
-  legalName: import_zod4.z.string(),
-  tradingName: import_zod4.z.string(),
-  merchantCategoryCode: import_zod4.z.string().regex(/^\d{4}$/),
-  nqrMerchantId: import_zod4.z.string(),
-  settlementBankCode: import_zod4.z.string(),
-  settlementAccountNumber: import_zod4.z.string(),
-  settlementAccountName: import_zod4.z.string(),
-  settlementSchedule: import_zod4.z.enum(SETTLEMENT_SCHEDULES),
-  status: import_zod4.z.enum(MERCHANT_PROFILE_STATUSES),
-  offlineEnabled: import_zod4.z.boolean(),
+var CurrencySchema2 = import_zod3.z.string().trim().length(3).transform((value) => value.toUpperCase());
+var ReferenceSchema = import_zod3.z.string().trim().min(6).max(128).regex(/^[A-Za-z0-9._:-]+$/);
+var MerchantProfileSchema = import_zod3.z.object({
+  accountId: import_zod3.z.string().uuid(),
+  legalName: import_zod3.z.string(),
+  tradingName: import_zod3.z.string(),
+  merchantCategoryCode: import_zod3.z.string().regex(/^\d{4}$/),
+  nqrMerchantId: import_zod3.z.string(),
+  settlementBankCode: import_zod3.z.string(),
+  settlementAccountNumber: import_zod3.z.string(),
+  settlementAccountName: import_zod3.z.string(),
+  settlementSchedule: import_zod3.z.enum(SETTLEMENT_SCHEDULES),
+  status: import_zod3.z.enum(MERCHANT_PROFILE_STATUSES),
+  offlineEnabled: import_zod3.z.boolean(),
   perTxLimitKobo: MoneyKoboSchema,
   dailyLimitKobo: MoneyKoboSchema,
   metadata: MetadataSchema,
-  createdAtMs: import_zod4.z.number().int().nonnegative(),
-  updatedAtMs: import_zod4.z.number().int().nonnegative()
+  createdAtMs: import_zod3.z.number().int().nonnegative(),
+  updatedAtMs: import_zod3.z.number().int().nonnegative()
 });
-var UpsertMerchantProfileInputSchema = import_zod4.z.object({
-  legalName: import_zod4.z.string().trim().min(1).max(200),
-  tradingName: import_zod4.z.string().trim().min(1).max(25),
-  merchantCategoryCode: import_zod4.z.string().trim().regex(/^\d{4}$/),
-  nqrMerchantId: import_zod4.z.string().trim().min(3).max(64),
-  settlementBankCode: import_zod4.z.string().trim().min(2).max(16),
-  settlementAccountNumber: import_zod4.z.string().trim().min(5).max(32),
-  settlementAccountName: import_zod4.z.string().trim().min(1).max(200),
-  settlementSchedule: import_zod4.z.enum(SETTLEMENT_SCHEDULES).optional(),
-  status: import_zod4.z.enum(MERCHANT_PROFILE_STATUSES).optional(),
-  offlineEnabled: import_zod4.z.boolean().optional(),
+var UpsertMerchantProfileInputSchema = import_zod3.z.object({
+  legalName: import_zod3.z.string().trim().min(1).max(200),
+  tradingName: import_zod3.z.string().trim().min(1).max(25),
+  merchantCategoryCode: import_zod3.z.string().trim().regex(/^\d{4}$/),
+  nqrMerchantId: import_zod3.z.string().trim().min(3).max(64),
+  settlementBankCode: import_zod3.z.string().trim().min(2).max(16),
+  settlementAccountNumber: import_zod3.z.string().trim().min(5).max(32),
+  settlementAccountName: import_zod3.z.string().trim().min(1).max(200),
+  settlementSchedule: import_zod3.z.enum(SETTLEMENT_SCHEDULES).optional(),
+  status: import_zod3.z.enum(MERCHANT_PROFILE_STATUSES).optional(),
+  offlineEnabled: import_zod3.z.boolean().optional(),
   perTxLimitKobo: MoneyKoboSchema.optional(),
   dailyLimitKobo: MoneyKoboSchema.optional(),
   metadata: MetadataSchema.optional()
 });
-var CollectionIntentSchema = import_zod4.z.object({
-  intentId: import_zod4.z.string().uuid(),
-  accountId: import_zod4.z.string().uuid(),
-  terminalId: import_zod4.z.string().uuid().nullable(),
-  reference: import_zod4.z.string(),
-  amountKobo: import_zod4.z.number().int().positive().nullable(),
-  currency: import_zod4.z.string().length(3),
-  status: import_zod4.z.enum(COLLECTION_INTENT_STATUSES),
-  description: import_zod4.z.string().nullable(),
-  nqrPayload: import_zod4.z.string(),
-  provider: import_zod4.z.string(),
-  providerReference: import_zod4.z.string().nullable(),
+var CollectionIntentSchema = import_zod3.z.object({
+  intentId: import_zod3.z.string().uuid(),
+  accountId: import_zod3.z.string().uuid(),
+  terminalId: import_zod3.z.string().uuid().nullable(),
+  reference: import_zod3.z.string(),
+  amountKobo: import_zod3.z.number().int().positive().nullable(),
+  currency: import_zod3.z.string().length(3),
+  status: import_zod3.z.enum(COLLECTION_INTENT_STATUSES),
+  description: import_zod3.z.string().nullable(),
+  nqrPayload: import_zod3.z.string(),
+  provider: import_zod3.z.string(),
+  providerReference: import_zod3.z.string().nullable(),
   metadata: MetadataSchema,
-  expiresAtMs: import_zod4.z.number().int().nonnegative().nullable(),
-  paidAtMs: import_zod4.z.number().int().nonnegative().nullable(),
-  createdAtMs: import_zod4.z.number().int().nonnegative(),
-  updatedAtMs: import_zod4.z.number().int().nonnegative()
+  expiresAtMs: import_zod3.z.number().int().nonnegative().nullable(),
+  paidAtMs: import_zod3.z.number().int().nonnegative().nullable(),
+  createdAtMs: import_zod3.z.number().int().nonnegative(),
+  updatedAtMs: import_zod3.z.number().int().nonnegative()
 });
-var CreateCollectionIntentInputSchema = import_zod4.z.object({
+var CreateCollectionIntentInputSchema = import_zod3.z.object({
   reference: ReferenceSchema.optional(),
   amountKobo: MoneyKoboSchema.optional(),
   currency: CurrencySchema2.optional(),
-  terminalId: import_zod4.z.string().uuid().optional(),
-  terminalLabel: import_zod4.z.string().trim().min(1).max(25).optional(),
-  merchantCity: import_zod4.z.string().trim().min(1).max(15).optional(),
-  description: import_zod4.z.string().trim().min(1).max(280).optional(),
-  expiresAtMs: import_zod4.z.number().int().positive().optional(),
-  provider: import_zod4.z.string().trim().min(1).max(40).optional(),
+  terminalId: import_zod3.z.string().uuid().optional(),
+  terminalLabel: import_zod3.z.string().trim().min(1).max(25).optional(),
+  merchantCity: import_zod3.z.string().trim().min(1).max(15).optional(),
+  description: import_zod3.z.string().trim().min(1).max(280).optional(),
+  expiresAtMs: import_zod3.z.number().int().positive().optional(),
+  provider: import_zod3.z.string().trim().min(1).max(40).optional(),
   metadata: MetadataSchema.optional()
 });
-var PublicCollectionIntentSchema = import_zod4.z.object({
-  intentId: import_zod4.z.string().uuid(),
-  reference: import_zod4.z.string(),
-  amountKobo: import_zod4.z.number().int().positive().nullable(),
-  currency: import_zod4.z.string().length(3),
-  status: import_zod4.z.enum(COLLECTION_INTENT_STATUSES),
-  merchantAccountId: import_zod4.z.string().uuid(),
-  merchantName: import_zod4.z.string(),
-  merchantCategoryCode: import_zod4.z.string(),
-  description: import_zod4.z.string().nullable(),
-  expiresAtMs: import_zod4.z.number().int().nonnegative().nullable()
+var PublicCollectionIntentSchema = import_zod3.z.object({
+  intentId: import_zod3.z.string().uuid(),
+  reference: import_zod3.z.string(),
+  amountKobo: import_zod3.z.number().int().positive().nullable(),
+  currency: import_zod3.z.string().length(3),
+  status: import_zod3.z.enum(COLLECTION_INTENT_STATUSES),
+  merchantAccountId: import_zod3.z.string().uuid(),
+  merchantName: import_zod3.z.string(),
+  merchantCategoryCode: import_zod3.z.string(),
+  description: import_zod3.z.string().nullable(),
+  expiresAtMs: import_zod3.z.number().int().nonnegative().nullable()
 });
-var PayCollectionInputSchema = import_zod4.z.object({
+var PayCollectionInputSchema = import_zod3.z.object({
   reference: ReferenceSchema,
   amountKobo: MoneyKoboSchema.optional(),
   currency: CurrencySchema2.optional(),
-  idempotencyKey: import_zod4.z.string().trim().min(8).max(160).optional()
+  idempotencyKey: import_zod3.z.string().trim().min(8).max(160).optional()
 });
-var CollectionPaymentSchema = import_zod4.z.object({
-  paymentId: import_zod4.z.string().uuid(),
-  intentId: import_zod4.z.string().uuid(),
-  accountId: import_zod4.z.string().uuid(),
-  payerUserId: import_zod4.z.string().uuid().nullable(),
-  merchantOwnerUserId: import_zod4.z.string().uuid(),
+var CollectionPaymentSchema = import_zod3.z.object({
+  paymentId: import_zod3.z.string().uuid(),
+  intentId: import_zod3.z.string().uuid(),
+  accountId: import_zod3.z.string().uuid(),
+  payerUserId: import_zod3.z.string().uuid().nullable(),
+  merchantOwnerUserId: import_zod3.z.string().uuid(),
   amountKobo: MoneyKoboSchema,
-  currency: import_zod4.z.string().length(3),
-  status: import_zod4.z.enum(COLLECTION_PAYMENT_STATUSES),
-  provider: import_zod4.z.string(),
-  providerReference: import_zod4.z.string().nullable(),
-  idempotencyKey: import_zod4.z.string().nullable(),
-  ledgerRef: import_zod4.z.string(),
-  failureCode: import_zod4.z.string().nullable(),
-  failureMessage: import_zod4.z.string().nullable(),
-  paidAtMs: import_zod4.z.number().int().nonnegative().nullable(),
-  createdAtMs: import_zod4.z.number().int().nonnegative(),
-  updatedAtMs: import_zod4.z.number().int().nonnegative()
+  currency: import_zod3.z.string().length(3),
+  status: import_zod3.z.enum(COLLECTION_PAYMENT_STATUSES),
+  provider: import_zod3.z.string(),
+  providerReference: import_zod3.z.string().nullable(),
+  idempotencyKey: import_zod3.z.string().nullable(),
+  ledgerRef: import_zod3.z.string(),
+  failureCode: import_zod3.z.string().nullable(),
+  failureMessage: import_zod3.z.string().nullable(),
+  paidAtMs: import_zod3.z.number().int().nonnegative().nullable(),
+  createdAtMs: import_zod3.z.number().int().nonnegative(),
+  updatedAtMs: import_zod3.z.number().int().nonnegative()
 });
-var CollectionPaymentResultSchema = import_zod4.z.object({
+var CollectionPaymentResultSchema = import_zod3.z.object({
   payment: CollectionPaymentSchema,
   intent: CollectionIntentSchema,
-  receipt: import_zod4.z.unknown().optional(),
-  replayed: import_zod4.z.boolean()
+  receipt: import_zod3.z.unknown().optional(),
+  replayed: import_zod3.z.boolean()
 });
-var CollectionReportSummarySchema = import_zod4.z.object({
-  accountId: import_zod4.z.string().uuid(),
-  fromMs: import_zod4.z.number().int().nonnegative(),
-  toMs: import_zod4.z.number().int().nonnegative(),
-  currency: import_zod4.z.string().length(3),
-  paidCount: import_zod4.z.number().int().nonnegative(),
-  paidAmountKobo: import_zod4.z.number().int().nonnegative(),
-  pendingCount: import_zod4.z.number().int().nonnegative(),
-  failedCount: import_zod4.z.number().int().nonnegative(),
-  reversedCount: import_zod4.z.number().int().nonnegative(),
-  availableBalanceKobo: import_zod4.z.number().int().nonnegative()
+var CollectionReportSummarySchema = import_zod3.z.object({
+  accountId: import_zod3.z.string().uuid(),
+  fromMs: import_zod3.z.number().int().nonnegative(),
+  toMs: import_zod3.z.number().int().nonnegative(),
+  currency: import_zod3.z.string().length(3),
+  paidCount: import_zod3.z.number().int().nonnegative(),
+  paidAmountKobo: import_zod3.z.number().int().nonnegative(),
+  pendingCount: import_zod3.z.number().int().nonnegative(),
+  failedCount: import_zod3.z.number().int().nonnegative(),
+  reversedCount: import_zod3.z.number().int().nonnegative(),
+  availableBalanceKobo: import_zod3.z.number().int().nonnegative()
 });
-var CollectionStatementSchema = import_zod4.z.object({
-  accountId: import_zod4.z.string().uuid(),
-  year: import_zod4.z.number().int(),
-  month: import_zod4.z.number().int().min(1).max(12),
-  currency: import_zod4.z.string().length(3),
-  totalPaidKobo: import_zod4.z.number().int().nonnegative(),
-  items: import_zod4.z.array(CollectionPaymentSchema)
+var CollectionStatementSchema = import_zod3.z.object({
+  accountId: import_zod3.z.string().uuid(),
+  year: import_zod3.z.number().int(),
+  month: import_zod3.z.number().int().min(1).max(12),
+  currency: import_zod3.z.string().length(3),
+  totalPaidKobo: import_zod3.z.number().int().nonnegative(),
+  items: import_zod3.z.array(CollectionPaymentSchema)
 });
-var CreatePayoutInputSchema = import_zod4.z.object({
+var CreatePayoutInputSchema = import_zod3.z.object({
   amountKobo: MoneyKoboSchema,
   currency: CurrencySchema2.optional(),
-  idempotencyKey: import_zod4.z.string().trim().min(8).max(160)
+  idempotencyKey: import_zod3.z.string().trim().min(8).max(160)
 });
-var MerchantPayoutSchema = import_zod4.z.object({
-  payoutId: import_zod4.z.string().uuid(),
-  accountId: import_zod4.z.string().uuid(),
+var MerchantPayoutSchema = import_zod3.z.object({
+  payoutId: import_zod3.z.string().uuid(),
+  accountId: import_zod3.z.string().uuid(),
   amountKobo: MoneyKoboSchema,
-  currency: import_zod4.z.string().length(3),
-  status: import_zod4.z.enum(MERCHANT_PAYOUT_STATUSES),
-  idempotencyKey: import_zod4.z.string().nullable(),
-  ledgerRef: import_zod4.z.string(),
-  providerReference: import_zod4.z.string().nullable(),
-  requestedByUserId: import_zod4.z.string().uuid().nullable(),
-  failureCode: import_zod4.z.string().nullable(),
-  failureMessage: import_zod4.z.string().nullable(),
-  createdAtMs: import_zod4.z.number().int().nonnegative(),
-  updatedAtMs: import_zod4.z.number().int().nonnegative()
+  currency: import_zod3.z.string().length(3),
+  status: import_zod3.z.enum(MERCHANT_PAYOUT_STATUSES),
+  idempotencyKey: import_zod3.z.string().nullable(),
+  ledgerRef: import_zod3.z.string(),
+  providerReference: import_zod3.z.string().nullable(),
+  requestedByUserId: import_zod3.z.string().uuid().nullable(),
+  failureCode: import_zod3.z.string().nullable(),
+  failureMessage: import_zod3.z.string().nullable(),
+  createdAtMs: import_zod3.z.number().int().nonnegative(),
+  updatedAtMs: import_zod3.z.number().int().nonnegative()
 });
-var ProviderEventInputSchema = import_zod4.z.object({
-  provider: import_zod4.z.string().trim().min(1).max(80),
-  eventId: import_zod4.z.string().trim().min(1).max(160),
-  eventType: import_zod4.z.string().trim().min(1).max(120),
-  payload: import_zod4.z.record(import_zod4.z.unknown()).optional()
+var ProviderEventInputSchema = import_zod3.z.object({
+  provider: import_zod3.z.string().trim().min(1).max(80),
+  eventId: import_zod3.z.string().trim().min(1).max(160),
+  eventType: import_zod3.z.string().trim().min(1).max(120),
+  payload: import_zod3.z.record(import_zod3.z.unknown()).optional()
 });
-var ProviderEventRecordSchema = import_zod4.z.object({
-  id: import_zod4.z.string().uuid(),
-  provider: import_zod4.z.string(),
-  eventId: import_zod4.z.string(),
-  eventType: import_zod4.z.string(),
-  signatureVerified: import_zod4.z.boolean(),
-  receivedAtMs: import_zod4.z.number().int().nonnegative(),
-  processedAtMs: import_zod4.z.number().int().nonnegative().nullable()
+var ProviderEventRecordSchema = import_zod3.z.object({
+  id: import_zod3.z.string().uuid(),
+  provider: import_zod3.z.string(),
+  eventId: import_zod3.z.string(),
+  eventType: import_zod3.z.string(),
+  signatureVerified: import_zod3.z.boolean(),
+  receivedAtMs: import_zod3.z.number().int().nonnegative(),
+  processedAtMs: import_zod3.z.number().int().nonnegative().nullable()
 });
 function createCollectionsClient(opts) {
   const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
@@ -1697,7 +1372,7 @@ var FlurClient = class {
     try {
       body = requestSchema ? JSON.stringify(requestSchema.parse(input)) : init2.body;
     } catch (err) {
-      if (err instanceof import_zod5.z.ZodError) {
+      if (err instanceof import_zod4.z.ZodError) {
         throw new FlurError("Invalid request payload", "INVALID_REQUEST", {
           details: err.flatten()
         });
@@ -1725,7 +1400,7 @@ var FlurClient = class {
       try {
         return responseSchema.parse(payload);
       } catch (err) {
-        if (err instanceof import_zod5.z.ZodError) {
+        if (err instanceof import_zod4.z.ZodError) {
           throw new FlurError(
             "SDK contract validation failed",
             "INVALID_REQUEST",
@@ -2156,7 +1831,7 @@ function constantTimeEqual(a, b) {
 }
 
 // src/offline/oac.ts
-var import_zod6 = require("zod");
+var import_zod5 = require("zod");
 
 // src/crypto/p256-issuer.ts
 var import_nist = require("@noble/curves/nist");
@@ -2238,20 +1913,20 @@ function verifyIssuerP256(bytes, signatureB64, issuerPublicKeySpkiB64) {
 var OAC_DEFAULT_PER_TX_KOBO = 5e5;
 var OAC_DEFAULT_CUMULATIVE_KOBO = 2e6;
 var OAC_DEFAULT_VALIDITY_MS = 24 * 60 * 60 * 1e3;
-var Base64Std2 = import_zod6.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64 (standard) string");
-var OACSchema = import_zod6.z.object({
-  userId: import_zod6.z.string().min(1),
-  deviceId: import_zod6.z.string().min(1),
+var Base64Std = import_zod5.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64 (standard) string");
+var OACSchema = import_zod5.z.object({
+  userId: import_zod5.z.string().min(1),
+  deviceId: import_zod5.z.string().min(1),
   /** SubjectPublicKeyInfo DER, base64 (P-256). */
-  devicePublicKey: Base64Std2,
-  perTxCapKobo: import_zod6.z.number().int().nonnegative(),
-  cumulativeCapKobo: import_zod6.z.number().int().nonnegative(),
-  validFromMs: import_zod6.z.number().int().nonnegative(),
-  validUntilMs: import_zod6.z.number().int().positive(),
-  counterSeed: import_zod6.z.number().int().nonnegative(),
-  nonce: import_zod6.z.string().min(1),
+  devicePublicKey: Base64Std,
+  perTxCapKobo: import_zod5.z.number().int().nonnegative(),
+  cumulativeCapKobo: import_zod5.z.number().int().nonnegative(),
+  validFromMs: import_zod5.z.number().int().nonnegative(),
+  validUntilMs: import_zod5.z.number().int().positive(),
+  counterSeed: import_zod5.z.number().int().nonnegative(),
+  nonce: import_zod5.z.string().min(1),
   /** ASN.1 DER ECDSA(SHA-256) signature, base64. */
-  issuerSig: Base64Std2
+  issuerSig: Base64Std
 }).refine((v) => v.validUntilMs > v.validFromMs, {
   message: "validUntilMs must be greater than validFromMs"
 }).refine((v) => v.perTxCapKobo <= v.cumulativeCapKobo, {
@@ -2345,19 +2020,19 @@ function decodeBase45(s) {
 }
 
 // src/offline/messages.ts
-var import_zod7 = require("zod");
-var Base64Sig = import_zod7.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64 (standard) signature");
-var OfflinePaymentRequestSchema = import_zod7.z.object({
-  reference: import_zod7.z.string().min(1),
-  amountKobo: import_zod7.z.number().int().positive(),
+var import_zod6 = require("zod");
+var Base64Sig = import_zod6.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64 (standard) signature");
+var OfflinePaymentRequestSchema = import_zod6.z.object({
+  reference: import_zod6.z.string().min(1),
+  amountKobo: import_zod6.z.number().int().positive(),
   merchantOAC: OACSchema,
-  expiresAtMs: import_zod7.z.number().int().positive(),
+  expiresAtMs: import_zod6.z.number().int().positive(),
   merchantSig: Base64Sig
 });
-var OfflinePaymentAuthorizationSchema = import_zod7.z.object({
+var OfflinePaymentAuthorizationSchema = import_zod6.z.object({
   request: OfflinePaymentRequestSchema,
   payerOAC: OACSchema,
-  payerCounter: import_zod7.z.number().int().positive(),
+  payerCounter: import_zod6.z.number().int().positive(),
   payerSig: Base64Sig
 });
 function buildPaymentRequest(input) {
@@ -2469,60 +2144,60 @@ function decodeAuthorizationQR(s) {
 }
 
 // src/offline/settlements.ts
-var import_zod8 = require("zod");
+var import_zod7 = require("zod");
 var import_sha256 = require("@noble/hashes/sha256");
 var import_utils = require("@noble/hashes/utils");
-var OfflineTokenSchema = import_zod8.z.object({
-  tokenId: import_zod8.z.string().uuid(),
-  tokenSerial: import_zod8.z.string(),
-  issuerAccountId: import_zod8.z.string().uuid(),
-  payerUserId: import_zod8.z.string().uuid(),
-  maxAmountKobo: import_zod8.z.number().int().positive(),
-  currency: import_zod8.z.string().length(3),
-  issuedAtMs: import_zod8.z.number().int().nonnegative(),
-  expiresAtMs: import_zod8.z.number().int().nonnegative(),
-  issuerSig: import_zod8.z.string()
+var OfflineTokenSchema = import_zod7.z.object({
+  tokenId: import_zod7.z.string().uuid(),
+  tokenSerial: import_zod7.z.string(),
+  issuerAccountId: import_zod7.z.string().uuid(),
+  payerUserId: import_zod7.z.string().uuid(),
+  maxAmountKobo: import_zod7.z.number().int().positive(),
+  currency: import_zod7.z.string().length(3),
+  issuedAtMs: import_zod7.z.number().int().nonnegative(),
+  expiresAtMs: import_zod7.z.number().int().nonnegative(),
+  issuerSig: import_zod7.z.string()
 });
-var PaymentClaimSchema = import_zod8.z.object({
-  encounterId: import_zod8.z.string().regex(/^[0-9a-f]{64}$/i).optional(),
-  tokenSerial: import_zod8.z.string(),
-  payerUserId: import_zod8.z.string().uuid(),
-  payeeUserId: import_zod8.z.string().uuid(),
-  payerNonce: import_zod8.z.string(),
-  payeeNonce: import_zod8.z.string(),
-  amountKobo: import_zod8.z.number().int().positive(),
-  currency: import_zod8.z.string().length(3).default("NGN"),
-  occurredAtMs: import_zod8.z.number().int().nonnegative(),
-  completedAtMs: import_zod8.z.number().int().nonnegative().optional(),
-  contextId: import_zod8.z.string().optional(),
+var PaymentClaimSchema = import_zod7.z.object({
+  encounterId: import_zod7.z.string().regex(/^[0-9a-f]{64}$/i).optional(),
+  tokenSerial: import_zod7.z.string(),
+  payerUserId: import_zod7.z.string().uuid(),
+  payeeUserId: import_zod7.z.string().uuid(),
+  payerNonce: import_zod7.z.string(),
+  payeeNonce: import_zod7.z.string(),
+  amountKobo: import_zod7.z.number().int().positive(),
+  currency: import_zod7.z.string().length(3).default("NGN"),
+  occurredAtMs: import_zod7.z.number().int().nonnegative(),
+  completedAtMs: import_zod7.z.number().int().nonnegative().optional(),
+  contextId: import_zod7.z.string().optional(),
   // Stage 2c: P-256 device keys are now SubjectPublicKeyInfo DER, base64.
   // Signatures are ASN.1 DER ECDSA(SHA-256), base64. Backwards-incompatible
   // wire change; the backend has the matching widening in offline-settlements
   // service + zod schema.
-  payerPubkey: import_zod8.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/),
-  payerSignature: import_zod8.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/),
-  payeePubkey: import_zod8.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/).optional(),
-  payeeSignature: import_zod8.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/).optional()
+  payerPubkey: import_zod7.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/),
+  payerSignature: import_zod7.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/),
+  payeePubkey: import_zod7.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/).optional(),
+  payeeSignature: import_zod7.z.string().min(16).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/).optional()
 });
-var SettlementSchema = import_zod8.z.object({
-  settlementId: import_zod8.z.string().uuid(),
-  settlementKey: import_zod8.z.string().regex(/^[0-9a-f]{64}$/i),
-  encounterId: import_zod8.z.string().regex(/^[0-9a-f]{64}$/i),
-  issuerAccountId: import_zod8.z.string().uuid(),
-  tokenSerial: import_zod8.z.string(),
-  payerUserId: import_zod8.z.string().uuid(),
-  payeeUserId: import_zod8.z.string().uuid(),
-  amountKobo: import_zod8.z.number().int().nonnegative(),
-  currency: import_zod8.z.string().length(3),
-  receiptId: import_zod8.z.string().nullable(),
-  status: import_zod8.z.enum(["SETTLED", "REVIEW", "REJECTED"]),
-  issuerSig: import_zod8.z.string(),
-  createdAtMs: import_zod8.z.number().int().nonnegative()
+var SettlementSchema = import_zod7.z.object({
+  settlementId: import_zod7.z.string().uuid(),
+  settlementKey: import_zod7.z.string().regex(/^[0-9a-f]{64}$/i),
+  encounterId: import_zod7.z.string().regex(/^[0-9a-f]{64}$/i),
+  issuerAccountId: import_zod7.z.string().uuid(),
+  tokenSerial: import_zod7.z.string(),
+  payerUserId: import_zod7.z.string().uuid(),
+  payeeUserId: import_zod7.z.string().uuid(),
+  amountKobo: import_zod7.z.number().int().nonnegative(),
+  currency: import_zod7.z.string().length(3),
+  receiptId: import_zod7.z.string().nullable(),
+  status: import_zod7.z.enum(["SETTLED", "REVIEW", "REJECTED"]),
+  issuerSig: import_zod7.z.string(),
+  createdAtMs: import_zod7.z.number().int().nonnegative()
 });
-var SettleResponseSchema = import_zod8.z.object({
+var SettleResponseSchema = import_zod7.z.object({
   settlement: SettlementSchema,
-  encounterId: import_zod8.z.string().regex(/^[0-9a-f]{64}$/i),
-  replayed: import_zod8.z.boolean()
+  encounterId: import_zod7.z.string().regex(/^[0-9a-f]{64}$/i),
+  replayed: import_zod7.z.boolean()
 });
 var ENCOUNTER_DOMAIN = "offline:v1:encounter";
 async function sha256Hex(input) {
@@ -2696,7 +2371,7 @@ function createHmacFetch(opts) {
 }
 
 // src/partner/client.ts
-var import_zod9 = require("zod");
+var import_zod8 = require("zod");
 var import_sha2563 = require("@noble/hashes/sha256");
 var import_hmac4 = require("@noble/hashes/hmac");
 var import_utils2 = require("@noble/hashes/utils");
@@ -2720,18 +2395,18 @@ var PARTNER_SCOPES = [
   "partner:payout:write",
   "partner:reconciliation:read"
 ];
-var ApiCredentialPublicSchema = import_zod9.z.object({
-  id: import_zod9.z.string().uuid(),
-  accountId: import_zod9.z.string().uuid(),
-  keyId: import_zod9.z.string(),
-  scopes: import_zod9.z.array(import_zod9.z.enum(PARTNER_SCOPES)),
-  label: import_zod9.z.string().nullable(),
-  createdAtMs: import_zod9.z.number().int().nonnegative(),
-  lastUsedAtMs: import_zod9.z.number().int().nonnegative().nullable(),
-  revokedAtMs: import_zod9.z.number().int().nonnegative().nullable()
+var ApiCredentialPublicSchema = import_zod8.z.object({
+  id: import_zod8.z.string().uuid(),
+  accountId: import_zod8.z.string().uuid(),
+  keyId: import_zod8.z.string(),
+  scopes: import_zod8.z.array(import_zod8.z.enum(PARTNER_SCOPES)),
+  label: import_zod8.z.string().nullable(),
+  createdAtMs: import_zod8.z.number().int().nonnegative(),
+  lastUsedAtMs: import_zod8.z.number().int().nonnegative().nullable(),
+  revokedAtMs: import_zod8.z.number().int().nonnegative().nullable()
 });
 var MintedApiCredentialSchema = ApiCredentialPublicSchema.extend({
-  secret: import_zod9.z.string().min(1)
+  secret: import_zod8.z.string().min(1)
 });
 var enc = new TextEncoder();
 async function sha256Hex2(input) {
@@ -2888,8 +2563,8 @@ function createApiCredentialsAdminClient(opts) {
     }
     return parser(raw);
   }
-  const listSchema = import_zod9.z.object({
-    items: import_zod9.z.array(ApiCredentialPublicSchema)
+  const listSchema = import_zod8.z.object({
+    items: import_zod8.z.array(ApiCredentialPublicSchema)
   });
   return {
     list: (accountId) => call(
@@ -2914,7 +2589,7 @@ function createApiCredentialsAdminClient(opts) {
 }
 
 // src/passes/pass.ts
-var import_zod10 = require("zod");
+var import_zod9 = require("zod");
 var PASS_KINDS = [
   "ride-ticket",
   "transit-pass",
@@ -2930,39 +2605,39 @@ var PASS_STATES = [
   "expired",
   "revoked"
 ];
-var PassMetadataSchema = import_zod10.z.record(
-  import_zod10.z.union([import_zod10.z.string(), import_zod10.z.number(), import_zod10.z.boolean(), import_zod10.z.null()])
+var PassMetadataSchema = import_zod9.z.record(
+  import_zod9.z.union([import_zod9.z.string(), import_zod9.z.number(), import_zod9.z.boolean(), import_zod9.z.null()])
 );
-var PassSchema = import_zod10.z.object({
-  passId: import_zod10.z.string().min(1),
+var PassSchema = import_zod9.z.object({
+  passId: import_zod9.z.string().min(1),
   /** Optional client/template grouping id (server may omit). */
-  templateId: import_zod10.z.string().min(1).optional(),
+  templateId: import_zod9.z.string().min(1).optional(),
   /** Optional human-facing holder identity (server may omit). The cryptographic binding
    *  is `holderDevicePubkey` below. */
-  holderUserId: import_zod10.z.string().min(1).optional(),
-  kind: import_zod10.z.enum(PASS_KINDS),
-  issuerId: import_zod10.z.string().min(1),
-  issuedAtMs: import_zod10.z.number().int().nonnegative(),
-  validFromMs: import_zod10.z.number().int().nonnegative(),
-  validUntilMs: import_zod10.z.number().int().positive(),
-  state: import_zod10.z.enum(PASS_STATES),
+  holderUserId: import_zod9.z.string().min(1).optional(),
+  kind: import_zod9.z.enum(PASS_KINDS),
+  issuerId: import_zod9.z.string().min(1),
+  issuedAtMs: import_zod9.z.number().int().nonnegative(),
+  validFromMs: import_zod9.z.number().int().nonnegative(),
+  validUntilMs: import_zod9.z.number().int().positive(),
+  state: import_zod9.z.enum(PASS_STATES),
   metadata: PassMetadataSchema,
-  nonce: import_zod10.z.string().min(1),
+  nonce: import_zod9.z.string().min(1),
   /** Device id this pass is bound to (FK to backend `device_keys`). */
-  holderDeviceId: import_zod10.z.string().min(1),
+  holderDeviceId: import_zod9.z.string().min(1),
   /** SubjectPublicKeyInfo DER (P-256) of the bound device, base64. The redemption
    *  signature is verified against this key — it is the security-critical binding. */
-  holderDevicePubkey: import_zod10.z.string().min(64).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/),
+  holderDevicePubkey: import_zod9.z.string().min(64).max(4096).regex(/^[A-Za-z0-9+/]+={0,2}$/),
   /** Optional fixed amount for monetary passes (vouchers, gift cards) in kobo. */
-  amountKobo: import_zod10.z.number().int().nonnegative().optional(),
+  amountKobo: import_zod9.z.number().int().nonnegative().optional(),
   /** ISO-4217-ish currency code; required on the wire. SDK builders default to NGN. */
-  currency: import_zod10.z.string().min(3).max(8),
+  currency: import_zod9.z.string().min(3).max(8),
   /** Monotonic redemption counter floor. Redemption.counter MUST be > counterSeed. */
-  counterSeed: import_zod10.z.number().int().nonnegative(),
+  counterSeed: import_zod9.z.number().int().nonnegative(),
   /** Optional cumulative spend cap in kobo across all redemptions of this pass. */
-  cumulativeCapKobo: import_zod10.z.number().int().nonnegative().optional(),
+  cumulativeCapKobo: import_zod9.z.number().int().nonnegative().optional(),
   /** ASN.1 DER ECDSA P-256 signature, base64. */
-  issuerSig: import_zod10.z.string().min(64).max(2048).regex(/^[A-Za-z0-9+/]+={0,2}$/)
+  issuerSig: import_zod9.z.string().min(64).max(2048).regex(/^[A-Za-z0-9+/]+={0,2}$/)
 }).refine((v) => v.validUntilMs > v.validFromMs, {
   message: "validUntilMs must be greater than validFromMs"
 });
@@ -3019,20 +2694,20 @@ function isPassWithinValidity(pass, nowMs) {
 }
 
 // src/passes/redemption.ts
-var import_zod11 = require("zod");
-var Base64Std3 = import_zod11.z.string().min(16).max(2048).regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64 (std)");
-var RedemptionSchema = import_zod11.z.object({
+var import_zod10 = require("zod");
+var Base64Std2 = import_zod10.z.string().min(16).max(2048).regex(/^[A-Za-z0-9+/]+={0,2}$/, "expected base64 (std)");
+var RedemptionSchema = import_zod10.z.object({
   pass: PassSchema,
-  redeemerId: import_zod11.z.string().min(1),
-  redeemedAtMs: import_zod11.z.number().int().nonnegative(),
+  redeemerId: import_zod10.z.string().min(1),
+  redeemedAtMs: import_zod10.z.number().int().nonnegative(),
   /** Strictly monotonic counter scoped to a single pass. Must be > pass.counterSeed
    *  and > the redeemer's lastSeenCounter for this pass. */
-  counter: import_zod11.z.number().int().positive(),
+  counter: import_zod10.z.number().int().positive(),
   /** Amount being redeemed in kobo (0 for non-monetary passes like ride tickets). */
-  amountKobo: import_zod11.z.number().int().nonnegative(),
-  nonce: import_zod11.z.string().min(1),
+  amountKobo: import_zod10.z.number().int().nonnegative(),
+  nonce: import_zod10.z.string().min(1),
   /** ASN.1 DER ECDSA P-256 signature over canonicalJSONBytes(unsigned), base64. */
-  holderSig: Base64Std3
+  holderSig: Base64Std2
 });
 var REDEEMABLE_STATES = /* @__PURE__ */ new Set(["issued", "active"]);
 function buildRedemption(input) {
@@ -3114,40 +2789,40 @@ function verifyRedemption(r, issuerPublicKeySpkiB64) {
 }
 
 // src/receipts/receipt.ts
-var import_zod12 = require("zod");
+var import_zod11 = require("zod");
 var RECEIPT_CHANNELS = ["cash", "pass"];
 var RECEIPT_KINDS = RECEIPT_CHANNELS;
-var ReceiptPayloadSchema = import_zod12.z.record(
-  import_zod12.z.union([import_zod12.z.string(), import_zod12.z.number(), import_zod12.z.boolean(), import_zod12.z.null()])
+var ReceiptPayloadSchema = import_zod11.z.record(
+  import_zod11.z.union([import_zod11.z.string(), import_zod11.z.number(), import_zod11.z.boolean(), import_zod11.z.null()])
 );
-var ReceiptSchema = import_zod12.z.object({
-  receiptId: import_zod12.z.string().min(1),
-  channel: import_zod12.z.enum(RECEIPT_CHANNELS),
+var ReceiptSchema = import_zod11.z.object({
+  receiptId: import_zod11.z.string().min(1),
+  channel: import_zod11.z.enum(RECEIPT_CHANNELS),
   /** Cash-channel: send_intents.id. Required when channel === 'cash'. */
-  intentId: import_zod12.z.string().min(1).optional(),
+  intentId: import_zod11.z.string().min(1).optional(),
   /** Pass-channel: pass_redemptions.id. Required when channel === 'pass'. */
-  passRedemptionId: import_zod12.z.string().min(1).optional(),
-  payerUserId: import_zod12.z.string().min(1),
-  payeeUserId: import_zod12.z.string().min(1),
-  amountKobo: import_zod12.z.number().int().nonnegative(),
-  currency: import_zod12.z.string().min(3).max(8),
-  issuedAtMs: import_zod12.z.number().int().nonnegative(),
-  issuerId: import_zod12.z.string().min(1),
+  passRedemptionId: import_zod11.z.string().min(1).optional(),
+  payerUserId: import_zod11.z.string().min(1),
+  payeeUserId: import_zod11.z.string().min(1),
+  amountKobo: import_zod11.z.number().int().nonnegative(),
+  currency: import_zod11.z.string().min(3).max(8),
+  issuedAtMs: import_zod11.z.number().int().nonnegative(),
+  issuerId: import_zod11.z.string().min(1),
   payload: ReceiptPayloadSchema,
   /** ASN.1 DER ECDSA P-256 signature, base64. */
-  issuerSig: import_zod12.z.string().min(64).max(2048).regex(/^[A-Za-z0-9+/]+={0,2}$/)
+  issuerSig: import_zod11.z.string().min(64).max(2048).regex(/^[A-Za-z0-9+/]+={0,2}$/)
 }).superRefine((v, ctx) => {
   if (v.channel === "cash") {
     if (!v.intentId) {
       ctx.addIssue({
-        code: import_zod12.z.ZodIssueCode.custom,
+        code: import_zod11.z.ZodIssueCode.custom,
         message: "cash receipts require intentId",
         path: ["intentId"]
       });
     }
     if (v.passRedemptionId) {
       ctx.addIssue({
-        code: import_zod12.z.ZodIssueCode.custom,
+        code: import_zod11.z.ZodIssueCode.custom,
         message: "cash receipts must not carry passRedemptionId",
         path: ["passRedemptionId"]
       });
@@ -3155,14 +2830,14 @@ var ReceiptSchema = import_zod12.z.object({
   } else if (v.channel === "pass") {
     if (!v.passRedemptionId) {
       ctx.addIssue({
-        code: import_zod12.z.ZodIssueCode.custom,
+        code: import_zod11.z.ZodIssueCode.custom,
         message: "pass receipts require passRedemptionId",
         path: ["passRedemptionId"]
       });
     }
     if (v.intentId) {
       ctx.addIssue({
-        code: import_zod12.z.ZodIssueCode.custom,
+        code: import_zod11.z.ZodIssueCode.custom,
         message: "pass receipts must not carry intentId",
         path: ["intentId"]
       });
@@ -3464,28 +3139,244 @@ function init(opts) {
 }
 
 // src/accounts/client.ts
-var import_zod13 = require("zod");
+var import_zod12 = require("zod");
 var ACCOUNT_TYPES = ["personal", "business", "partner"];
 var ACCOUNT_STATUSES = ["active", "suspended", "closed"];
 var MEMBERSHIP_ROLES = ["owner", "admin", "driver", "staff"];
-var AccountSchema = import_zod13.z.object({
-  accountId: import_zod13.z.string().uuid(),
-  type: import_zod13.z.enum(ACCOUNT_TYPES),
-  displayName: import_zod13.z.string().min(1),
-  status: import_zod13.z.enum(ACCOUNT_STATUSES),
-  ownerUserId: import_zod13.z.string().uuid().nullable(),
-  createdAtMs: import_zod13.z.number().int().nonnegative()
+var AccountSchema = import_zod12.z.object({
+  accountId: import_zod12.z.string().uuid(),
+  type: import_zod12.z.enum(ACCOUNT_TYPES),
+  displayName: import_zod12.z.string().min(1),
+  status: import_zod12.z.enum(ACCOUNT_STATUSES),
+  ownerUserId: import_zod12.z.string().uuid().nullable(),
+  createdAtMs: import_zod12.z.number().int().nonnegative()
+});
+var AccountMembershipSchema = import_zod12.z.object({
+  accountId: import_zod12.z.string().uuid(),
+  userId: import_zod12.z.string().uuid(),
+  role: import_zod12.z.enum(MEMBERSHIP_ROLES),
+  createdAtMs: import_zod12.z.number().int().nonnegative()
+});
+function createAccountsClient(opts) {
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  if (!fetchImpl) {
+    throw new Error("createAccountsClient: no fetch implementation available");
+  }
+  const baseUrl = opts.baseUrl.replace(/\/$/, "");
+  async function call(method, path, body, parser) {
+    const init2 = {
+      method,
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json"
+      }
+    };
+    if (body !== void 0) init2.body = JSON.stringify(body);
+    const resp = await fetchImpl(`${baseUrl}${path}`, init2);
+    const text = await resp.text();
+    let raw = void 0;
+    if (text) {
+      try {
+        raw = JSON.parse(text);
+      } catch {
+      }
+    }
+    if (!resp.ok) {
+      const code = raw && typeof raw === "object" && "code" in raw && typeof raw.code === "string" ? raw.code : `http_${resp.status}`;
+      const message = raw && typeof raw === "object" && "message" in raw && typeof raw.message === "string" ? raw.message : `request failed with status ${resp.status}`;
+      throw new FlurApiError(resp.status, code, message, raw);
+    }
+    return parser(raw);
+  }
+  const itemsSchema = import_zod12.z.object({ items: import_zod12.z.array(AccountSchema) });
+  const memberItemsSchema = import_zod12.z.object({
+    items: import_zod12.z.array(AccountMembershipSchema)
+  });
+  return {
+    listMyAccounts: () => call(
+      "GET",
+      "/v1/accounts/me",
+      void 0,
+      (raw) => itemsSchema.parse(raw)
+    ),
+    getAccount: (accountId) => call(
+      "GET",
+      `/v1/accounts/${encodeURIComponent(accountId)}`,
+      void 0,
+      (raw) => AccountSchema.parse(raw)
+    ),
+    listMembers: (accountId) => call(
+      "GET",
+      `/v1/accounts/${encodeURIComponent(accountId)}/members`,
+      void 0,
+      (raw) => memberItemsSchema.parse(raw)
+    ),
+    createBusinessAccount: (input) => call("POST", "/v1/accounts", input, (raw) => AccountSchema.parse(raw)),
+    addMember: (accountId, input) => call(
+      "POST",
+      `/v1/accounts/${encodeURIComponent(accountId)}/members`,
+      input,
+      (raw) => AccountMembershipSchema.parse(raw)
+    )
+  };
+}
+
+// src/me-offline/client.ts
+var import_zod13 = require("zod");
+var Sha256Hex = import_zod13.z.string().regex(/^[0-9a-f]{64}$/);
+var Base64Std3 = import_zod13.z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/);
+var ClaimNonce = import_zod13.z.string().min(8).max(128).refine((value) => !value.includes("|"), {
+  message: "nonce must not contain |"
+});
+var ACCOUNT_FUNDED_OAC_MAX_TTL_MS = 1e3 * 60 * 60 * 24 * 7;
+var CONSUMER_OFFLINE_CLAIM_SUBMIT_GRACE_MS = 1e3 * 60 * 60 * 24;
+var AttestationSecurityLevelSchema = import_zod13.z.enum([
+  "STRONGBOX",
+  "TEE",
+  "SECURE_ENCLAVE",
+  "SOFTWARE"
+]);
+var DeviceKeyAlgSchema = import_zod13.z.literal("p256");
+var RegisterDeviceKeyP256InputSchema = import_zod13.z.object({
+  deviceId: import_zod13.z.string().min(1).max(128),
+  /** P-256 SubjectPublicKeyInfo DER, base64. */
+  publicKeySpkiB64: Base64Std3.min(64).max(4096),
+  /** Base64 of the server-issued enrollment challenge string. */
+  challengeB64: Base64Std3.min(8).max(1024),
+  /** iOS App Attest payload or Android X.509 Key Attestation chain. */
+  attestationChainB64: import_zod13.z.array(Base64Std3.min(16).max(16384)).min(1).max(16),
+  securityLevel: AttestationSecurityLevelSchema
+});
+var P256EnrollmentChallengeInputSchema = import_zod13.z.object({
+  deviceId: import_zod13.z.string().min(1).max(128)
+});
+var P256EnrollmentChallengeResultSchema = import_zod13.z.object({
+  challenge: import_zod13.z.string().min(16),
+  expiresAtMs: import_zod13.z.number().int().positive()
+});
+var DeviceKeyRecordSchema = import_zod13.z.object({
+  id: import_zod13.z.string().uuid(),
+  userId: import_zod13.z.string().uuid(),
+  deviceId: import_zod13.z.string(),
+  /** Always 'p256' on the consumer offline rail. Field retained for forward-compat. */
+  alg: DeviceKeyAlgSchema.default("p256"),
+  /** P-256 SubjectPublicKeyInfo DER, base64. */
+  publicKeySpkiB64: Base64Std3.nullable().default(null),
+  securityLevel: AttestationSecurityLevelSchema.nullable().default(null),
+  hardwareBacked: import_zod13.z.boolean().default(false),
+  attestedAtMs: import_zod13.z.number().int().nonnegative().nullable().default(null),
+  createdAtMs: import_zod13.z.number().int().nonnegative(),
+  revokedAtMs: import_zod13.z.number().int().nonnegative().nullable()
+});
+var ConsumerOACSchema = import_zod13.z.object({
+  oacId: import_zod13.z.string().uuid(),
+  issuerId: import_zod13.z.string().min(1).max(64),
+  userId: import_zod13.z.string().uuid(),
+  deviceId: import_zod13.z.string().min(1).max(128),
+  /**
+   * Always 'p256'. Required on the wire (backend always emits it).
+   * Kept as a literal so input/output infer identically and the schema
+   * can be nested inside other response shapes without Zod input/output
+   * divergence under tsup DTS bundling.
+   */
+  alg: import_zod13.z.literal("p256"),
+  /** P-256 SubjectPublicKeyInfo DER, base64. */
+  devicePubkeySpkiB64: Base64Std3.min(64).max(4096),
+  perTxCapKobo: import_zod13.z.number().int().positive(),
+  cumulativeCapKobo: import_zod13.z.number().int().positive(),
+  currency: import_zod13.z.string().length(3),
+  validFromMs: import_zod13.z.number().int().nonnegative(),
+  validUntilMs: import_zod13.z.number().int().nonnegative(),
+  counterSeed: import_zod13.z.number().int().nonnegative(),
+  issuedAtMs: import_zod13.z.number().int().nonnegative()
+});
+var SignedConsumerOACSchema = import_zod13.z.object({
+  oac: ConsumerOACSchema,
+  /** ASN.1 DER ECDSA P-256 issuer signature, base64. */
+  issuerSig: Base64Std3.min(16).max(2048),
+  /** Issuer's P-256 public key as SubjectPublicKeyInfo DER, base64. */
+  issuerPublicKeySpkiB64: Base64Std3.min(64).max(4096)
 });
-var AccountMembershipSchema = import_zod13.z.object({
-  accountId: import_zod13.z.string().uuid(),
-  userId: import_zod13.z.string().uuid(),
-  role: import_zod13.z.enum(MEMBERSHIP_ROLES),
-  createdAtMs: import_zod13.z.number().int().nonnegative()
+var OACRecordSchema = SignedConsumerOACSchema.extend({
+  currentOfflineSpentKobo: import_zod13.z.number().int().nonnegative(),
+  status: import_zod13.z.enum(["active", "superseded", "expired", "revoked"]),
+  supersededAtMs: import_zod13.z.number().int().nonnegative().nullable(),
+  revokedAtMs: import_zod13.z.number().int().nonnegative().nullable()
 });
-function createAccountsClient(opts) {
+var IssueAccountOacInputSchema = import_zod13.z.object({
+  deviceId: import_zod13.z.string().min(1).max(128),
+  perTxCapKobo: import_zod13.z.number().int().positive().optional(),
+  cumulativeCapKobo: import_zod13.z.number().int().positive().optional(),
+  ttlMs: import_zod13.z.number().int().min(6e4).max(ACCOUNT_FUNDED_OAC_MAX_TTL_MS).optional()
+});
+var OfflineStatusResultSchema = import_zod13.z.object({
+  active: OACRecordSchema.nullable()
+});
+var ConsumerPaymentClaimSchema = import_zod13.z.object({
+  /** Always 'p256'. Retained for forward-compat and as an explicit domain marker. */
+  alg: import_zod13.z.literal("p256").default("p256"),
+  oacId: import_zod13.z.string().uuid(),
+  encounterId: Sha256Hex.optional(),
+  payerUserId: import_zod13.z.string().uuid(),
+  payeeUserId: import_zod13.z.string().uuid(),
+  payerDeviceId: import_zod13.z.string().min(1).max(128),
+  payerNonce: ClaimNonce,
+  payeeNonce: ClaimNonce,
+  amountKobo: import_zod13.z.number().int().positive(),
+  currency: import_zod13.z.string().length(3).default("NGN"),
+  occurredAtMs: import_zod13.z.number().int().nonnegative(),
+  completedAtMs: import_zod13.z.number().int().nonnegative().optional(),
+  contextId: import_zod13.z.string().max(128).optional(),
+  requestId: import_zod13.z.string().uuid().optional(),
+  requestMode: import_zod13.z.enum(["fixed", "editable"]).optional(),
+  requestTakerUserId: import_zod13.z.string().uuid().optional(),
+  requestAmountKobo: import_zod13.z.number().int().positive().optional(),
+  requestCurrency: import_zod13.z.string().length(3).optional(),
+  requestReference: import_zod13.z.string().max(128).nullable().optional(),
+  requestCreatedAtMs: import_zod13.z.number().int().nonnegative().optional(),
+  requestExpiresAtMs: import_zod13.z.number().int().positive().optional(),
+  requestNonce: import_zod13.z.string().min(8).max(128).optional(),
+  requestTakerDeviceId: import_zod13.z.string().min(1).max(128).nullable().optional(),
+  requestTakerPubkeySpkiB64: Base64Std3.min(64).max(4096).optional(),
+  requestTakerSignatureDerB64: Base64Std3.min(16).max(2048).optional(),
+  payerPubkeySpkiB64: Base64Std3.min(64).max(4096),
+  payerSignatureDerB64: Base64Std3.min(16).max(2048),
+  payeePubkeySpkiB64: Base64Std3.min(64).max(4096).optional(),
+  payeeSignatureDerB64: Base64Std3.min(16).max(2048).optional()
+});
+var ConsumerSettlementSchema = import_zod13.z.object({
+  settlementId: import_zod13.z.string().uuid(),
+  settlementKey: Sha256Hex,
+  encounterId: Sha256Hex,
+  oacId: import_zod13.z.string().uuid(),
+  payerUserId: import_zod13.z.string().uuid(),
+  payeeUserId: import_zod13.z.string().uuid(),
+  amountKobo: import_zod13.z.number().int().positive(),
+  currency: import_zod13.z.string().length(3),
+  status: import_zod13.z.enum(["SETTLED", "REVIEW"]),
+  reviewReason: import_zod13.z.string().nullable(),
+  ledgerRef: import_zod13.z.string().nullable(),
+  /** ASN.1 DER ECDSA P-256 issuer signature, base64. */
+  issuerSig: Base64Std3.min(16).max(2048),
+  /** Canonical millisecond timestamp signed into the settlement receipt. */
+  issuedAtMs: import_zod13.z.number().int().nonnegative(),
+  /** Compatibility alias for API consumers that predate issuedAtMs. */
+  createdAtMs: import_zod13.z.number().int().nonnegative().optional()
+});
+var ConsumerSettleResultSchema = import_zod13.z.object({
+  settlement: ConsumerSettlementSchema,
+  encounterId: Sha256Hex,
+  replayed: import_zod13.z.boolean()
+});
+var RevokeDeviceKeyInputSchema = import_zod13.z.object({
+  deviceId: import_zod13.z.string().min(1).max(128),
+  /** Step-up token from /api/v1/auth/send/verify with purpose='offline_revoke'. */
+  sendAuthToken: import_zod13.z.string().min(16)
+});
+function createMeOfflineClient(opts) {
   const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
   if (!fetchImpl) {
-    throw new Error("createAccountsClient: no fetch implementation available");
+    throw new Error("createMeOfflineClient: no fetch implementation available");
   }
   const baseUrl = opts.baseUrl.replace(/\/$/, "");
   async function call(method, path, body, parser) {
@@ -3513,42 +3404,67 @@ function createAccountsClient(opts) {
     }
     return parser(raw);
   }
-  const itemsSchema = import_zod13.z.object({ items: import_zod13.z.array(AccountSchema) });
-  const memberItemsSchema = import_zod13.z.object({
-    items: import_zod13.z.array(AccountMembershipSchema)
-  });
+  const deviceKeyItems = import_zod13.z.object({ items: import_zod13.z.array(DeviceKeyRecordSchema) });
   return {
-    listMyAccounts: () => call(
-      "GET",
-      "/v1/accounts/me",
-      void 0,
-      (raw) => itemsSchema.parse(raw)
+    issueP256EnrollmentChallenge: (input) => call(
+      "POST",
+      "/v1/me/offline/keys/p256/challenge",
+      P256EnrollmentChallengeInputSchema.parse(input),
+      (raw) => P256EnrollmentChallengeResultSchema.parse(raw)
     ),
-    getAccount: (accountId) => call(
-      "GET",
-      `/v1/accounts/${encodeURIComponent(accountId)}`,
-      void 0,
-      (raw) => AccountSchema.parse(raw)
+    registerDeviceKeyP256: (input) => call(
+      "POST",
+      "/v1/me/offline/keys/p256",
+      RegisterDeviceKeyP256InputSchema.parse(input),
+      (raw) => DeviceKeyRecordSchema.parse(raw)
     ),
-    listMembers: (accountId) => call(
+    listDeviceKeys: () => call(
       "GET",
-      `/v1/accounts/${encodeURIComponent(accountId)}/members`,
+      "/v1/me/offline/keys",
       void 0,
-      (raw) => memberItemsSchema.parse(raw)
+      (raw) => deviceKeyItems.parse(raw)
     ),
-    createBusinessAccount: (input) => call("POST", "/v1/accounts", input, (raw) => AccountSchema.parse(raw)),
-    addMember: (accountId, input) => call(
+    revokeDeviceKey: (input) => call(
       "POST",
-      `/v1/accounts/${encodeURIComponent(accountId)}/members`,
-      input,
-      (raw) => AccountMembershipSchema.parse(raw)
+      "/v1/me/offline/keys/revoke",
+      RevokeDeviceKeyInputSchema.parse(input),
+      () => void 0
+    ),
+    issueAccountOac: (input) => call(
+      "POST",
+      "/v1/me/offline/oac",
+      IssueAccountOacInputSchema.parse(input),
+      (raw) => OACRecordSchema.parse(raw)
+    ),
+    getStatus: (deviceId) => {
+      const qs = deviceId ? `?deviceId=${encodeURIComponent(deviceId)}` : "";
+      return call(
+        "GET",
+        `/v1/me/offline/status${qs}`,
+        void 0,
+        (raw) => OfflineStatusResultSchema.parse(raw)
+      );
+    },
+    submitClaim: (claim) => call(
+      "POST",
+      "/v1/me/offline/claims",
+      ConsumerPaymentClaimSchema.parse(claim),
+      (raw) => ConsumerSettleResultSchema.parse(raw)
+    ),
+    getSettlement: (idOrKey) => call(
+      "GET",
+      `/v1/me/offline/settlements/${encodeURIComponent(idOrKey)}`,
+      void 0,
+      (raw) => ConsumerSettlementSchema.parse(raw)
     )
   };
 }
 
 // src/me-offline/signer.ts
 var import_nist2 = require("@noble/curves/nist");
+var import_sha2 = require("@noble/hashes/sha2");
 var CLAIM_DOMAIN_V2 = "flur:consumer-offline:v2:claim";
+var ENCOUNTER_DOMAIN2 = "flur:consumer-offline:v1:encounter";
 function canonicalClaimSigningPayload(claim) {
   return {
     domain: CLAIM_DOMAIN_V2,
@@ -3569,6 +3485,27 @@ function canonicalClaimSigningPayload(claim) {
 function canonicalClaimSigningBytes(claim) {
   return canonicalJSONBytes(canonicalClaimSigningPayload(claim));
 }
+function computeConsumerClaimEncounterId(input) {
+  const material = `${ENCOUNTER_DOMAIN2}|${[
+    assertEncounterPart("oacId", input.oacId),
+    assertEncounterPart("payerUserId", input.payerUserId),
+    assertEncounterPart("payeeUserId", input.payeeUserId),
+    assertEncounterPart("payerNonce", input.payerNonce),
+    assertEncounterPart("payeeNonce", input.payeeNonce)
+  ].join("|")}`;
+  return bytesToHex5((0, import_sha2.sha256)(new TextEncoder().encode(material)));
+}
+function assertEncounterPart(field, value) {
+  if (value.includes("|")) {
+    throw new Error(`consumer encounter id ${field} must not contain |`);
+  }
+  return value;
+}
+function bytesToHex5(bytes) {
+  let out = "";
+  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+  return out;
+}
 function bytesToBase642(bytes) {
   if (typeof Buffer !== "undefined") {
     return Buffer.from(bytes).toString("base64");
@@ -3664,38 +3601,192 @@ function verifyClaimSignature(input) {
   }
 }
 
-// src/me-offline/sms.ts
-var OFFLINE_CLAIM_SMS_PREFIX = "FLURC1.";
-var TOKEN_RE = /(?:^|\s)(FLURC1\.[A-Za-z0-9_-]+={0,2})(?:\s|$)/;
-function encodeOfflineClaimSmsMessage(claim) {
-  const parsed = ConsumerPaymentClaimSchema.parse(claim);
-  const json = JSON.stringify(parsed);
-  return `${OFFLINE_CLAIM_SMS_PREFIX}${base64UrlEncodeUtf8(json)}`;
+// src/me-offline/request.ts
+var import_zod14 = require("zod");
+var Base64Std4 = import_zod14.z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/);
+var CONSUMER_PAYMENT_REQUEST_DOMAIN = "flur:consumer-offline:v1:request";
+var ConsumerPaymentRequestEnvelopeSchema = import_zod14.z.object({
+  requestId: import_zod14.z.string().uuid(),
+  mode: import_zod14.z.enum(["fixed", "editable"]),
+  takerUserId: import_zod14.z.string().uuid(),
+  amountKobo: import_zod14.z.number().int().positive(),
+  currency: import_zod14.z.string().length(3).default("NGN"),
+  reference: import_zod14.z.string().max(128).nullable().default(null),
+  createdAtMs: import_zod14.z.number().int().nonnegative(),
+  expiresAtMs: import_zod14.z.number().int().positive(),
+  nonce: import_zod14.z.string().min(8).max(128),
+  takerDeviceId: import_zod14.z.string().min(1).max(128).nullable().default(null),
+  takerPubkeySpkiB64: Base64Std4.min(64).max(4096).optional(),
+  takerSignatureDerB64: Base64Std4.min(16).max(2048).optional()
+}).superRefine((value, ctx) => {
+  if (value.expiresAtMs <= value.createdAtMs) {
+    ctx.addIssue({
+      code: import_zod14.z.ZodIssueCode.custom,
+      path: ["expiresAtMs"],
+      message: "expiresAtMs must be greater than createdAtMs"
+    });
+  }
+  const hasSignature = Boolean(
+    value.takerPubkeySpkiB64 || value.takerSignatureDerB64
+  );
+  if (value.mode === "fixed" || hasSignature) {
+    if (!value.takerDeviceId) {
+      ctx.addIssue({
+        code: import_zod14.z.ZodIssueCode.custom,
+        path: ["takerDeviceId"],
+        message: "signed requests require takerDeviceId"
+      });
+    }
+    if (!value.takerPubkeySpkiB64) {
+      ctx.addIssue({
+        code: import_zod14.z.ZodIssueCode.custom,
+        path: ["takerPubkeySpkiB64"],
+        message: "signed requests require takerPubkeySpkiB64"
+      });
+    }
+    if (!value.takerSignatureDerB64) {
+      ctx.addIssue({
+        code: import_zod14.z.ZodIssueCode.custom,
+        path: ["takerSignatureDerB64"],
+        message: "signed requests require takerSignatureDerB64"
+      });
+    }
+  }
+});
+function buildConsumerPaymentRequest(input) {
+  const unsigned = {
+    requestId: input.requestId,
+    mode: input.mode,
+    takerUserId: input.takerUserId,
+    amountKobo: input.amountKobo,
+    currency: input.currency ?? "NGN",
+    reference: input.reference ?? null,
+    createdAtMs: input.createdAtMs,
+    expiresAtMs: input.expiresAtMs,
+    nonce: input.nonce,
+    takerDeviceId: input.takerDeviceId ?? null
+  };
+  if (unsigned.mode === "fixed" && !unsigned.takerDeviceId) {
+    throw new Error("fixed requests require takerDeviceId");
+  }
+  if (unsigned.expiresAtMs <= unsigned.createdAtMs) {
+    throw new Error("expiresAtMs must be greater than createdAtMs");
+  }
+  return unsigned;
 }
-function decodeOfflineClaimSmsMessage(message) {
-  const token = extractOfflineClaimSmsToken(message);
-  if (!token) {
-    throw new Error("offline claim SMS token not found");
+function consumerPaymentRequestSigningPayload(request) {
+  return {
+    domain: CONSUMER_PAYMENT_REQUEST_DOMAIN,
+    version: 1,
+    requestId: request.requestId,
+    mode: request.mode,
+    takerUserId: request.takerUserId,
+    amountKobo: request.amountKobo,
+    currency: request.currency,
+    reference: request.reference ?? null,
+    createdAtMs: request.createdAtMs,
+    expiresAtMs: request.expiresAtMs,
+    nonce: request.nonce,
+    takerDeviceId: request.takerDeviceId ?? null
+  };
+}
+function consumerPaymentRequestSigningBytes(request) {
+  return canonicalJSONBytes(consumerPaymentRequestSigningPayload(request));
+}
+async function signConsumerPaymentRequest(unsigned, signer) {
+  if (signer.alg !== "p256") {
+    throw new Error("consumer payment requests require p256 signer");
   }
-  const encoded = token.slice(OFFLINE_CLAIM_SMS_PREFIX.length);
+  const publicKey = await signer.getPublicKey();
+  if (publicKey.alg !== "p256") {
+    throw new Error("consumer payment requests require p256 public key");
+  }
+  const signature = await signer.sign(
+    consumerPaymentRequestSigningBytes(unsigned)
+  );
+  return ConsumerPaymentRequestEnvelopeSchema.parse({
+    ...unsigned,
+    takerPubkeySpkiB64: publicKey.publicKey,
+    takerSignatureDerB64: signature.signature
+  });
+}
+function verifyConsumerPaymentRequest(request) {
+  const parsed = ConsumerPaymentRequestEnvelopeSchema.safeParse(request);
+  if (!parsed.success) return false;
+  const value = parsed.data;
+  if (!value.takerPubkeySpkiB64 || !value.takerSignatureDerB64) return false;
+  return verifyClaimSignature({
+    alg: "p256",
+    bytes: consumerPaymentRequestSigningBytes(value),
+    signature: value.takerSignatureDerB64,
+    publicKey: value.takerPubkeySpkiB64
+  });
+}
+function isConsumerPaymentRequestExpired(request, nowMs = Date.now()) {
+  const parsed = ConsumerPaymentRequestEnvelopeSchema.parse(request);
+  return parsed.expiresAtMs <= nowMs;
+}
+
+// src/me-offline/settlement.ts
+var CONSUMER_SETTLEMENT_DOMAIN = "flur:consumer-offline:v1:settlement";
+var CONSUMER_SETTLEMENT_RECEIPT_QR_PREFIX = "FLURSR1.";
+function consumerSettlementSigningPayload(settlement) {
+  return {
+    domain: CONSUMER_SETTLEMENT_DOMAIN,
+    settlementId: settlement.settlementId,
+    settlementKey: settlement.settlementKey,
+    encounterId: settlement.encounterId,
+    oacId: settlement.oacId,
+    payerUserId: settlement.payerUserId,
+    payeeUserId: settlement.payeeUserId,
+    amountKobo: settlement.amountKobo,
+    currency: settlement.currency,
+    status: settlement.status,
+    reviewReason: settlement.reviewReason,
+    ledgerRef: settlement.ledgerRef,
+    issuedAtMs: settlement.issuedAtMs
+  };
+}
+function verifyConsumerSettlement(settlement, issuerPublicKeySpkiB64) {
+  const parsed = ConsumerSettlementSchema.safeParse(settlement);
+  if (!parsed.success) return false;
+  return verifyIssuerP256(
+    canonicalJSONBytes(consumerSettlementSigningPayload(parsed.data)),
+    parsed.data.issuerSig,
+    issuerPublicKeySpkiB64
+  );
+}
+function encodeConsumerSettlementReceiptQR(settlement) {
+  const parsed = ConsumerSettlementSchema.parse(settlement);
+  return `${CONSUMER_SETTLEMENT_RECEIPT_QR_PREFIX}${base64UrlEncodeUtf8(
+    JSON.stringify(parsed)
+  )}`;
+}
+function decodeUnverifiedConsumerSettlementReceiptQR(value) {
+  if (!value.startsWith(CONSUMER_SETTLEMENT_RECEIPT_QR_PREFIX)) {
+    throw new Error("not a Flur consumer settlement receipt QR");
+  }
+  const encoded = value.slice(CONSUMER_SETTLEMENT_RECEIPT_QR_PREFIX.length);
   let raw;
   try {
     raw = JSON.parse(base64UrlDecodeUtf8(encoded));
   } catch {
-    throw new Error("offline claim SMS token is malformed");
+    throw new Error("consumer settlement receipt QR is malformed");
   }
-  const parsed = ConsumerPaymentClaimSchema.safeParse(raw);
-  if (!parsed.success) {
-    throw new Error("offline claim SMS token is invalid");
+  return ConsumerSettlementSchema.parse(raw);
+}
+function verifyConsumerSettlementReceiptQR(value, issuerPublicKeySpkiB64) {
+  const settlement = decodeUnverifiedConsumerSettlementReceiptQR(value);
+  if (!verifyConsumerSettlement(settlement, issuerPublicKeySpkiB64)) {
+    throw new Error("consumer settlement receipt QR signature invalid");
   }
-  return parsed.data;
+  return settlement;
 }
-function extractOfflineClaimSmsToken(message) {
-  const trimmed = message.trim();
-  if (trimmed.startsWith(OFFLINE_CLAIM_SMS_PREFIX)) {
-    return trimmed.split(/\s+/, 1)[0] ?? null;
+function decodeConsumerSettlementReceiptQR(value, issuerPublicKeySpkiB64) {
+  if (!issuerPublicKeySpkiB64) {
+    return decodeUnverifiedConsumerSettlementReceiptQR(value);
   }
-  return TOKEN_RE.exec(message)?.[1] ?? null;
+  return verifyConsumerSettlementReceiptQR(value, issuerPublicKeySpkiB64);
 }
 function base64UrlEncodeUtf8(input) {
   const bytes = new TextEncoder().encode(input);
@@ -3725,15 +3816,281 @@ function base64UrlDecodeUtf8(input) {
   throw new Error("base64 decoder unavailable");
 }
 
+// src/me-offline/sms.ts
+var import_nist3 = require("@noble/curves/nist");
+var OFFLINE_CLAIM_SMS_PREFIX = "FLURC1.";
+var CLAIM_TOKEN_RE = /(?:^|\s)(FLURC1\.[A-Za-z0-9_-]+={0,2})(?:\s|$)/;
+function encodeOfflineClaimSmsMessage(claim) {
+  const parsed = ConsumerPaymentClaimSchema.parse(claim);
+  return `${OFFLINE_CLAIM_SMS_PREFIX}${base64UrlEncodeUtf82(
+    JSON.stringify(parsed)
+  )}`;
+}
+function decodeOfflineClaimSmsMessage(message) {
+  const token = extractOfflineClaimSmsToken(message);
+  if (!token) throw new Error("offline claim QR token not found");
+  const encoded = token.slice(OFFLINE_CLAIM_SMS_PREFIX.length);
+  let raw;
+  try {
+    raw = JSON.parse(base64UrlDecodeUtf82(encoded));
+  } catch {
+    throw new Error("offline claim QR token is malformed");
+  }
+  const parsed = ConsumerPaymentClaimSchema.safeParse(raw);
+  if (!parsed.success) throw new Error("offline claim QR token is invalid");
+  return parsed.data;
+}
+function extractOfflineClaimSmsToken(message) {
+  const trimmed = message.trim();
+  if (trimmed.startsWith(OFFLINE_CLAIM_SMS_PREFIX)) {
+    return trimmed.split(/\s+/, 1)[0] ?? null;
+  }
+  return CLAIM_TOKEN_RE.exec(message)?.[1] ?? null;
+}
+var OFFLINE_SMS_SETTLE_PREFIX = "FLURA1.";
+var OFFLINE_SMS_SETTLE_DOMAIN = "flur:consumer-offline:v1:attest";
+var OFFLINE_SMS_SETTLE_TOKEN_BYTES = 112;
+var OFFLINE_SMS_SETTLE_HEADER_BYTES = 48;
+var OFFLINE_SMS_SETTLE_SIGNATURE_BYTES = 64;
+var OFFLINE_SMS_SETTLE_VERSION = 1;
+var TOKEN_RE = /(?:^|[\s,;:()<>"'])(FLURA1\.[A-Za-z0-9_-]{150})/;
+async function encodeOfflineSmsSettleToken(input, signer) {
+  const header = await buildSmsSettleHeader(input);
+  const sig = await signer.signRaw(domainTag(header));
+  if (sig.length !== OFFLINE_SMS_SETTLE_SIGNATURE_BYTES) {
+    throw new Error(
+      `FLURA1: signer returned ${sig.length}-byte sig; expected ${OFFLINE_SMS_SETTLE_SIGNATURE_BYTES}`
+    );
+  }
+  const out = new Uint8Array(OFFLINE_SMS_SETTLE_TOKEN_BYTES);
+  out.set(header, 0);
+  out.set(sig, OFFLINE_SMS_SETTLE_HEADER_BYTES);
+  return `${OFFLINE_SMS_SETTLE_PREFIX}${bytesToBase64Url(out)}`;
+}
+async function buildSmsSettleHeader(input) {
+  assertSafeUint64(input.amountKobo, "amountKobo");
+  if (input.amountKobo <= 0) {
+    throw new Error("FLURA1: amountKobo must be greater than zero");
+  }
+  assertSafeUint48(input.occurredAtMs, "occurredAtMs");
+  const encounterPrefix = (await sha2565(utf8(input.encounterId))).slice(0, 16);
+  const payerPrefix = uuidToBytes(input.payerUserId).slice(0, 8);
+  const payeePrefix = uuidToBytes(input.payeeUserId).slice(0, 8);
+  const header = new Uint8Array(OFFLINE_SMS_SETTLE_HEADER_BYTES);
+  const dv = new DataView(header.buffer);
+  header[0] = OFFLINE_SMS_SETTLE_VERSION;
+  header[1] = 0;
+  header.set(encounterPrefix, 2);
+  header.set(payerPrefix, 18);
+  header.set(payeePrefix, 26);
+  writeUint64BE(dv, 34, input.amountKobo);
+  writeUint48BE(dv, 42, input.occurredAtMs);
+  return header;
+}
+function domainTag(header) {
+  if (header.length !== OFFLINE_SMS_SETTLE_HEADER_BYTES) {
+    throw new Error(
+      `FLURA1: header must be ${OFFLINE_SMS_SETTLE_HEADER_BYTES} bytes`
+    );
+  }
+  const domain = utf8(OFFLINE_SMS_SETTLE_DOMAIN);
+  const out = new Uint8Array(domain.length + header.length);
+  out.set(domain, 0);
+  out.set(header, domain.length);
+  return out;
+}
+function decodeOfflineSmsSettleToken(message) {
+  const token = extractOfflineSmsSettleToken(message);
+  if (!token) throw new Error("FLURA1: token not found");
+  const encoded = token.slice(OFFLINE_SMS_SETTLE_PREFIX.length);
+  let bytes;
+  try {
+    bytes = base64UrlToBytes(encoded);
+  } catch {
+    throw new Error("FLURA1: token base64url is malformed");
+  }
+  if (bytesToBase64Url(bytes) !== encoded) {
+    throw new Error("FLURA1: token base64url is malformed");
+  }
+  if (bytes.length !== OFFLINE_SMS_SETTLE_TOKEN_BYTES) {
+    throw new Error(
+      `FLURA1: expected ${OFFLINE_SMS_SETTLE_TOKEN_BYTES} bytes, got ${bytes.length}`
+    );
+  }
+  const version = bytes[0];
+  const flags = bytes[1];
+  if (version !== OFFLINE_SMS_SETTLE_VERSION) {
+    throw new Error(`FLURA1: unsupported version ${version}`);
+  }
+  if (flags !== 0) {
+    throw new Error(`FLURA1: reserved flags must be 0, got ${flags}`);
+  }
+  const header = bytes.slice(0, OFFLINE_SMS_SETTLE_HEADER_BYTES);
+  const signature = bytes.slice(OFFLINE_SMS_SETTLE_HEADER_BYTES);
+  const dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const amountKobo = readUint64BE(dv, 34);
+  if (amountKobo <= 0) {
+    throw new Error("FLURA1: amountKobo must be greater than zero");
+  }
+  return {
+    version,
+    flags,
+    encounterIdPrefixHex: bytesToHex6(bytes.slice(2, 18)),
+    payerUserIdPrefixHex: bytesToHex6(bytes.slice(18, 26)),
+    payeeUserIdPrefixHex: bytesToHex6(bytes.slice(26, 34)),
+    amountKobo,
+    occurredAtMs: readUint48BE(dv, 42),
+    signature,
+    header,
+    signedBytes: domainTag(header)
+  };
+}
+function extractOfflineSmsSettleToken(message) {
+  const trimmed = message.trim();
+  if (trimmed.startsWith(OFFLINE_SMS_SETTLE_PREFIX)) {
+    return trimmed.split(/\s+/, 1)[0] ?? null;
+  }
+  return TOKEN_RE.exec(message)?.[1] ?? null;
+}
+function verifyOfflineSmsSettleToken(decoded, payerPubkeySpkiB64) {
+  try {
+    const pubRaw = p256SpkiB64ToRaw(payerPubkeySpkiB64);
+    return import_nist3.p256.verify(decoded.signature, decoded.signedBytes, pubRaw, {
+      prehash: true,
+      format: "compact"
+    });
+  } catch {
+    return false;
+  }
+}
+function derToRawP256Signature(derBytes) {
+  const sig = import_nist3.p256.Signature.fromBytes(derBytes, "der");
+  const raw = sig.toBytes("compact");
+  if (raw.length !== OFFLINE_SMS_SETTLE_SIGNATURE_BYTES) {
+    throw new Error(
+      `FLURA1: DER\u2192raw produced ${raw.length} bytes; expected ${OFFLINE_SMS_SETTLE_SIGNATURE_BYTES}`
+    );
+  }
+  return raw;
+}
+function utf8(s) {
+  return new TextEncoder().encode(s);
+}
+async function sha2565(bytes) {
+  const subtle = typeof globalThis !== "undefined" && globalThis.crypto?.subtle || void 0;
+  if (subtle) {
+    const digest = await subtle.digest("SHA-256", bytes);
+    return new Uint8Array(digest);
+  }
+  const { sha256: nobleSha256 } = await import("@noble/hashes/sha2");
+  return nobleSha256(bytes);
+}
+function uuidToBytes(uuid) {
+  const hex = uuid.replace(/-/g, "").toLowerCase();
+  if (hex.length !== 32 || !/^[0-9a-f]{32}$/.test(hex)) {
+    throw new Error(`FLURA1: invalid UUID: ${uuid}`);
+  }
+  const out = new Uint8Array(16);
+  for (let i = 0; i < 16; i++) {
+    out[i] = parseInt(hex.substring(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+function assertSafeUint64(value, field) {
+  if (!Number.isInteger(value) || value < 0) {
+    throw new Error(`FLURA1: ${field} must be a non-negative integer`);
+  }
+  if (value > Number.MAX_SAFE_INTEGER) {
+    throw new Error(`FLURA1: ${field} exceeds Number.MAX_SAFE_INTEGER`);
+  }
+}
+function assertSafeUint48(value, field) {
+  assertSafeUint64(value, field);
+  if (value > 281474976710655) {
+    throw new Error(`FLURA1: ${field} exceeds uint48 range`);
+  }
+}
+function writeUint64BE(dv, offset, value) {
+  const high = Math.floor(value / 4294967296);
+  const low = value >>> 0;
+  dv.setUint32(offset, high, false);
+  dv.setUint32(offset + 4, low, false);
+}
+function readUint64BE(dv, offset) {
+  const high = dv.getUint32(offset, false);
+  const low = dv.getUint32(offset + 4, false);
+  if (high > 2097151) {
+    throw new Error("FLURA1: amountKobo exceeds Number.MAX_SAFE_INTEGER");
+  }
+  return high * 4294967296 + low;
+}
+function writeUint48BE(dv, offset, value) {
+  const high = Math.floor(value / 65536);
+  const low = value & 65535;
+  dv.setUint32(offset, high, false);
+  dv.setUint16(offset + 4, low, false);
+}
+function readUint48BE(dv, offset) {
+  const high = dv.getUint32(offset, false);
+  const low = dv.getUint16(offset + 4, false);
+  return high * 65536 + low;
+}
+function bytesToHex6(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) {
+    out += bytes[i].toString(16).padStart(2, "0");
+  }
+  return out;
+}
+function bytesToBase64Url(bytes) {
+  let base64;
+  if (typeof Buffer !== "undefined") {
+    base64 = Buffer.from(bytes).toString("base64");
+  } else {
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++) {
+      binary += String.fromCharCode(bytes[i]);
+    }
+    if (typeof btoa !== "function") {
+      throw new Error("FLURA1: base64 encoder unavailable");
+    }
+    base64 = btoa(binary);
+  }
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlEncodeUtf82(input) {
+  return bytesToBase64Url(utf8(input));
+}
+function base64UrlDecodeUtf82(input) {
+  return new TextDecoder().decode(base64UrlToBytes(input));
+}
+function base64UrlToBytes(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(
+    base64.length + (4 - base64.length % 4) % 4,
+    "="
+  );
+  if (typeof Buffer !== "undefined") {
+    return new Uint8Array(Buffer.from(padded, "base64"));
+  }
+  if (typeof atob !== "function") {
+    throw new Error("FLURA1: base64 decoder unavailable");
+  }
+  const binary = atob(padded);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
 // src/partner-funding/client.ts
-var import_zod14 = require("zod");
-var MinorString = import_zod14.z.string().regex(/^-?\d+$/);
-var PositiveMinor = import_zod14.z.union([
-  import_zod14.z.number().int().positive(),
-  import_zod14.z.string().regex(/^[1-9]\d{0,18}$/)
+var import_zod15 = require("zod");
+var MinorString = import_zod15.z.string().regex(/^-?\d+$/);
+var PositiveMinor = import_zod15.z.union([
+  import_zod15.z.number().int().positive(),
+  import_zod15.z.string().regex(/^[1-9]\d{0,18}$/)
 ]);
-var Currency = import_zod14.z.string().trim().length(3).transform((v) => v.toUpperCase());
-var Metadata = import_zod14.z.record(import_zod14.z.unknown());
+var Currency = import_zod15.z.string().trim().length(3).transform((v) => v.toUpperCase());
+var Metadata = import_zod15.z.record(import_zod15.z.unknown());
 var PARTNER_KINDS = ["bank", "merchant"];
 var CUSTODIAL_MODES = ["agent_of_bank", "flur_virtual_pool"];
 var PARTNER_PROFILE_STATUSES = [
@@ -3760,126 +4117,126 @@ var WITHDRAWAL_STATES = [
   "failed",
   "reversed"
 ];
-var PartnerProfileSchema = import_zod14.z.object({
-  partnerAccountId: import_zod14.z.string().uuid(),
-  kind: import_zod14.z.enum(PARTNER_KINDS),
-  custodialMode: import_zod14.z.enum(CUSTODIAL_MODES),
-  displayName: import_zod14.z.string(),
-  bankCode: import_zod14.z.string().nullable(),
-  poolAccountNumber: import_zod14.z.string().nullable(),
-  status: import_zod14.z.enum(PARTNER_PROFILE_STATUSES),
+var PartnerProfileSchema = import_zod15.z.object({
+  partnerAccountId: import_zod15.z.string().uuid(),
+  kind: import_zod15.z.enum(PARTNER_KINDS),
+  custodialMode: import_zod15.z.enum(CUSTODIAL_MODES),
+  displayName: import_zod15.z.string(),
+  bankCode: import_zod15.z.string().nullable(),
+  poolAccountNumber: import_zod15.z.string().nullable(),
+  status: import_zod15.z.enum(PARTNER_PROFILE_STATUSES),
   metadata: Metadata,
-  createdAtMs: import_zod14.z.number().int().nonnegative(),
-  updatedAtMs: import_zod14.z.number().int().nonnegative()
+  createdAtMs: import_zod15.z.number().int().nonnegative(),
+  updatedAtMs: import_zod15.z.number().int().nonnegative()
 });
-var UpsertPartnerProfileInputSchema = import_zod14.z.object({
-  kind: import_zod14.z.enum(PARTNER_KINDS),
-  custodialMode: import_zod14.z.enum(CUSTODIAL_MODES),
-  displayName: import_zod14.z.string().trim().min(1).max(200),
-  bankCode: import_zod14.z.string().trim().min(1).max(64).optional(),
-  poolAccountNumber: import_zod14.z.string().trim().min(1).max(64).optional(),
+var UpsertPartnerProfileInputSchema = import_zod15.z.object({
+  kind: import_zod15.z.enum(PARTNER_KINDS),
+  custodialMode: import_zod15.z.enum(CUSTODIAL_MODES),
+  displayName: import_zod15.z.string().trim().min(1).max(200),
+  bankCode: import_zod15.z.string().trim().min(1).max(64).optional(),
+  poolAccountNumber: import_zod15.z.string().trim().min(1).max(64).optional(),
   metadata: Metadata.optional()
 });
-var PartnerFundingEventInputSchema = import_zod14.z.object({
-  externalRef: import_zod14.z.string().trim().min(8).max(128),
-  direction: import_zod14.z.enum(PARTNER_FUNDING_DIRECTIONS).optional(),
-  userId: import_zod14.z.string().uuid().optional(),
-  accountId: import_zod14.z.string().uuid().optional(),
+var PartnerFundingEventInputSchema = import_zod15.z.object({
+  externalRef: import_zod15.z.string().trim().min(8).max(128),
+  direction: import_zod15.z.enum(PARTNER_FUNDING_DIRECTIONS).optional(),
+  userId: import_zod15.z.string().uuid().optional(),
+  accountId: import_zod15.z.string().uuid().optional(),
   amountMinor: PositiveMinor,
   currency: Currency,
-  fundingSource: import_zod14.z.string().trim().min(1).max(64).optional(),
+  fundingSource: import_zod15.z.string().trim().min(1).max(64).optional(),
   providerMetadata: Metadata.optional()
 });
-var PartnerFundingSchema = import_zod14.z.object({
-  fundingId: import_zod14.z.string().uuid(),
-  partnerId: import_zod14.z.string().uuid(),
-  accountId: import_zod14.z.string().uuid(),
-  userId: import_zod14.z.string().uuid().nullable(),
-  direction: import_zod14.z.enum(PARTNER_FUNDING_DIRECTIONS),
-  currency: import_zod14.z.string(),
+var PartnerFundingSchema = import_zod15.z.object({
+  fundingId: import_zod15.z.string().uuid(),
+  partnerId: import_zod15.z.string().uuid(),
+  accountId: import_zod15.z.string().uuid(),
+  userId: import_zod15.z.string().uuid().nullable(),
+  direction: import_zod15.z.enum(PARTNER_FUNDING_DIRECTIONS),
+  currency: import_zod15.z.string(),
   amountMinor: MinorString,
-  externalRef: import_zod14.z.string(),
-  status: import_zod14.z.enum(PARTNER_FUNDING_STATUSES),
-  fundingSource: import_zod14.z.string(),
-  ledgerRef: import_zod14.z.string(),
+  externalRef: import_zod15.z.string(),
+  status: import_zod15.z.enum(PARTNER_FUNDING_STATUSES),
+  fundingSource: import_zod15.z.string(),
+  ledgerRef: import_zod15.z.string(),
   providerMetadata: Metadata,
-  createdAtMs: import_zod14.z.number().int().nonnegative(),
-  updatedAtMs: import_zod14.z.number().int().nonnegative()
+  createdAtMs: import_zod15.z.number().int().nonnegative(),
+  updatedAtMs: import_zod15.z.number().int().nonnegative()
 });
-var IngestFundingResultSchema = import_zod14.z.object({
+var IngestFundingResultSchema = import_zod15.z.object({
   funding: PartnerFundingSchema,
-  replayed: import_zod14.z.boolean()
+  replayed: import_zod15.z.boolean()
 });
-var PayoutDestinationSchema = import_zod14.z.object({
-  destinationId: import_zod14.z.string().uuid(),
-  accountId: import_zod14.z.string().uuid(),
-  partnerId: import_zod14.z.string().uuid(),
-  bankCode: import_zod14.z.string(),
-  accountNumber: import_zod14.z.string(),
-  accountName: import_zod14.z.string(),
-  status: import_zod14.z.enum(PAYOUT_DESTINATION_STATUSES),
-  verifiedAtMs: import_zod14.z.number().int().nonnegative().nullable(),
+var PayoutDestinationSchema = import_zod15.z.object({
+  destinationId: import_zod15.z.string().uuid(),
+  accountId: import_zod15.z.string().uuid(),
+  partnerId: import_zod15.z.string().uuid(),
+  bankCode: import_zod15.z.string(),
+  accountNumber: import_zod15.z.string(),
+  accountName: import_zod15.z.string(),
+  status: import_zod15.z.enum(PAYOUT_DESTINATION_STATUSES),
+  verifiedAtMs: import_zod15.z.number().int().nonnegative().nullable(),
   metadata: Metadata,
-  createdAtMs: import_zod14.z.number().int().nonnegative(),
-  updatedAtMs: import_zod14.z.number().int().nonnegative()
+  createdAtMs: import_zod15.z.number().int().nonnegative(),
+  updatedAtMs: import_zod15.z.number().int().nonnegative()
 });
-var CreatePayoutDestinationInputSchema = import_zod14.z.object({
-  partnerId: import_zod14.z.string().uuid(),
-  bankCode: import_zod14.z.string().trim().min(1).max(32),
-  accountNumber: import_zod14.z.string().trim().min(4).max(64),
-  accountName: import_zod14.z.string().trim().min(1).max(200),
+var CreatePayoutDestinationInputSchema = import_zod15.z.object({
+  partnerId: import_zod15.z.string().uuid(),
+  bankCode: import_zod15.z.string().trim().min(1).max(32),
+  accountNumber: import_zod15.z.string().trim().min(4).max(64),
+  accountName: import_zod15.z.string().trim().min(1).max(200),
   metadata: Metadata.optional()
 });
-var ListPayoutDestinationsResultSchema = import_zod14.z.object({
-  items: import_zod14.z.array(PayoutDestinationSchema)
+var ListPayoutDestinationsResultSchema = import_zod15.z.object({
+  items: import_zod15.z.array(PayoutDestinationSchema)
 });
-var WithdrawalSchema = import_zod14.z.object({
-  withdrawalId: import_zod14.z.string().uuid(),
-  accountId: import_zod14.z.string().uuid(),
-  userId: import_zod14.z.string().uuid(),
-  partnerId: import_zod14.z.string().uuid(),
-  destinationId: import_zod14.z.string().uuid(),
-  currency: import_zod14.z.string(),
+var WithdrawalSchema = import_zod15.z.object({
+  withdrawalId: import_zod15.z.string().uuid(),
+  accountId: import_zod15.z.string().uuid(),
+  userId: import_zod15.z.string().uuid(),
+  partnerId: import_zod15.z.string().uuid(),
+  destinationId: import_zod15.z.string().uuid(),
+  currency: import_zod15.z.string(),
   amountMinor: MinorString,
-  state: import_zod14.z.enum(WITHDRAWAL_STATES),
-  idempotencyKey: import_zod14.z.string(),
-  providerRef: import_zod14.z.string().nullable(),
-  lastError: import_zod14.z.string().nullable(),
-  ledgerRef: import_zod14.z.string(),
-  reverseLedgerRef: import_zod14.z.string().nullable(),
+  state: import_zod15.z.enum(WITHDRAWAL_STATES),
+  idempotencyKey: import_zod15.z.string(),
+  providerRef: import_zod15.z.string().nullable(),
+  lastError: import_zod15.z.string().nullable(),
+  ledgerRef: import_zod15.z.string(),
+  reverseLedgerRef: import_zod15.z.string().nullable(),
   metadata: Metadata,
-  createdAtMs: import_zod14.z.number().int().nonnegative(),
-  updatedAtMs: import_zod14.z.number().int().nonnegative()
+  createdAtMs: import_zod15.z.number().int().nonnegative(),
+  updatedAtMs: import_zod15.z.number().int().nonnegative()
 });
-var CreateWithdrawalInputSchema = import_zod14.z.object({
-  destinationId: import_zod14.z.string().uuid(),
+var CreateWithdrawalInputSchema = import_zod15.z.object({
+  destinationId: import_zod15.z.string().uuid(),
   amountMinor: PositiveMinor,
   currency: Currency,
-  idempotencyKey: import_zod14.z.string().trim().min(8).max(128),
+  idempotencyKey: import_zod15.z.string().trim().min(8).max(128),
   metadata: Metadata.optional()
 });
-var CreateWithdrawalResultSchema = import_zod14.z.object({
+var CreateWithdrawalResultSchema = import_zod15.z.object({
   withdrawal: WithdrawalSchema,
-  replayed: import_zod14.z.boolean()
+  replayed: import_zod15.z.boolean()
 });
-var PayoutEventInputSchema = import_zod14.z.object({
-  externalRef: import_zod14.z.string().trim().min(8).max(128),
-  withdrawalId: import_zod14.z.string().uuid().optional(),
-  state: import_zod14.z.enum(["submitted", "processing", "paid", "failed"]),
-  providerRef: import_zod14.z.string().trim().min(1).max(128).optional(),
-  failureCode: import_zod14.z.string().trim().max(64).optional(),
-  failureMessage: import_zod14.z.string().trim().max(512).optional(),
+var PayoutEventInputSchema = import_zod15.z.object({
+  externalRef: import_zod15.z.string().trim().min(8).max(128),
+  withdrawalId: import_zod15.z.string().uuid().optional(),
+  state: import_zod15.z.enum(["submitted", "processing", "paid", "failed"]),
+  providerRef: import_zod15.z.string().trim().min(1).max(128).optional(),
+  failureCode: import_zod15.z.string().trim().max(64).optional(),
+  failureMessage: import_zod15.z.string().trim().max(512).optional(),
   providerMetadata: Metadata.optional()
 });
-var RecordPayoutEventResultSchema = import_zod14.z.object({
+var RecordPayoutEventResultSchema = import_zod15.z.object({
   withdrawal: WithdrawalSchema,
-  replayed: import_zod14.z.boolean()
+  replayed: import_zod15.z.boolean()
 });
-var ReconciliationReportSchema = import_zod14.z.object({
-  partnerId: import_zod14.z.string().uuid(),
-  currency: import_zod14.z.string(),
-  fromMs: import_zod14.z.number().int().nonnegative(),
-  toMs: import_zod14.z.number().int().nonnegative(),
+var ReconciliationReportSchema = import_zod15.z.object({
+  partnerId: import_zod15.z.string().uuid(),
+  currency: import_zod15.z.string(),
+  fromMs: import_zod15.z.number().int().nonnegative(),
+  toMs: import_zod15.z.number().int().nonnegative(),
   fundingsCreditMinor: MinorString,
   fundingsDebitMinor: MinorString,
   withdrawalsPaidMinor: MinorString,
@@ -3888,7 +4245,7 @@ var ReconciliationReportSchema = import_zod14.z.object({
   expectedReserveBalanceMinor: MinorString,
   actualReserveBalanceMinor: MinorString,
   imbalanceMinor: MinorString,
-  generatedAtMs: import_zod14.z.number().int().nonnegative()
+  generatedAtMs: import_zod15.z.number().int().nonnegative()
 });
 function createPartnerFundingClient(partner) {
   return {
@@ -4040,19 +4397,19 @@ function createPartnerProfileAdminClient(opts) {
 }
 
 // src/artifacts/envelope.ts
-var import_zod15 = require("zod");
+var import_zod16 = require("zod");
 var FLUR_ARTIFACT_URI_SCHEME = "flur";
 var FLUR_ARTIFACT_VERSION = 1;
 var FLUR_ARTIFACT_URI_PREFIX = `${FLUR_ARTIFACT_URI_SCHEME}://v${FLUR_ARTIFACT_VERSION}/`;
 var ArtifactTypeRe = /^[a-z][a-z0-9_]{1,63}$/;
-var ArtifactHeaderSchema = import_zod15.z.object({
-  v: import_zod15.z.literal(FLUR_ARTIFACT_VERSION),
-  t: import_zod15.z.string().regex(ArtifactTypeRe, "invalid artifact type"),
-  iss: import_zod15.z.string().min(1).max(128),
-  kid: import_zod15.z.string().min(1).max(128),
-  iat: import_zod15.z.number().int().nonnegative(),
-  exp: import_zod15.z.number().int().positive().optional(),
-  nonce: import_zod15.z.string().min(8).max(64).regex(/^[A-Za-z0-9_-]+$/, "nonce must be url-safe")
+var ArtifactHeaderSchema = import_zod16.z.object({
+  v: import_zod16.z.literal(FLUR_ARTIFACT_VERSION),
+  t: import_zod16.z.string().regex(ArtifactTypeRe, "invalid artifact type"),
+  iss: import_zod16.z.string().min(1).max(128),
+  kid: import_zod16.z.string().min(1).max(128),
+  iat: import_zod16.z.number().int().nonnegative(),
+  exp: import_zod16.z.number().int().positive().optional(),
+  nonce: import_zod16.z.string().min(8).max(64).regex(/^[A-Za-z0-9_-]+$/, "nonce must be url-safe")
 });
 var FlurArtifactError = class extends Error {
   constructor(message, code) {
@@ -4191,7 +4548,7 @@ function verifyArtifactSignature(decoded, publicKeySpkiB64, options = {}) {
 }
 
 // src/artifacts/types.ts
-var import_zod16 = require("zod");
+var import_zod17 = require("zod");
 var ARTIFACT_TYPES = {
   OFFLINE_PAYMENT_AUTHORIZATION: "offline_payment_authorization",
   RECEIPT: "receipt",
@@ -4206,32 +4563,32 @@ var ARTIFACT_TYPES = {
   PASS: "pass",
   IDENTITY: "identity"
 };
-var HexString = (length) => import_zod16.z.string().regex(
+var HexString = (length) => import_zod17.z.string().regex(
   new RegExp(`^[0-9a-fA-F]{${length * 2}}$`),
   `expected ${length}-byte hex string`
 );
-var OfflinePaymentAuthorizationArtifactSchema = import_zod16.z.object({
+var OfflinePaymentAuthorizationArtifactSchema = import_zod17.z.object({
   authorization: OfflinePaymentAuthorizationSchema
 });
-var ReceiptArtifactSchema = import_zod16.z.object({
-  receiptId: import_zod16.z.string().min(1).max(64),
-  paymentReference: import_zod16.z.string().min(1).max(64),
-  payerUserId: import_zod16.z.string().min(1).max(64).optional(),
-  payeeUserId: import_zod16.z.string().min(1).max(64),
-  amountKobo: import_zod16.z.number().int().positive(),
-  currency: import_zod16.z.literal("NGN"),
-  channel: import_zod16.z.enum(["online", "offline_reconciled", "pay_link", "nqr"]),
-  settledAtMs: import_zod16.z.number().int().positive(),
-  ledgerTxnId: import_zod16.z.string().min(1).max(64).optional(),
-  memo: import_zod16.z.string().max(140).optional(),
+var ReceiptArtifactSchema = import_zod17.z.object({
+  receiptId: import_zod17.z.string().min(1).max(64),
+  paymentReference: import_zod17.z.string().min(1).max(64),
+  payerUserId: import_zod17.z.string().min(1).max(64).optional(),
+  payeeUserId: import_zod17.z.string().min(1).max(64),
+  amountKobo: import_zod17.z.number().int().positive(),
+  currency: import_zod17.z.literal("NGN"),
+  channel: import_zod17.z.enum(["online", "offline_reconciled", "pay_link", "nqr"]),
+  settledAtMs: import_zod17.z.number().int().positive(),
+  ledgerTxnId: import_zod17.z.string().min(1).max(64).optional(),
+  memo: import_zod17.z.string().max(140).optional(),
   hashChainPrev: HexString(32).optional()
 });
-var ShortId = import_zod16.z.string().min(1).max(64);
-var PositiveInt = import_zod16.z.number().int().positive();
-var NonNegativeInt = import_zod16.z.number().int().nonnegative();
-var Currency2 = import_zod16.z.literal("NGN");
-var Memo = import_zod16.z.string().max(140);
-var NqrPaymentRequestArtifactSchema = import_zod16.z.object({
+var ShortId = import_zod17.z.string().min(1).max(64);
+var PositiveInt = import_zod17.z.number().int().positive();
+var NonNegativeInt = import_zod17.z.number().int().nonnegative();
+var Currency2 = import_zod17.z.literal("NGN");
+var Memo = import_zod17.z.string().max(140);
+var NqrPaymentRequestArtifactSchema = import_zod17.z.object({
   requestId: ShortId,
   payeeUserId: ShortId,
   amountKobo: PositiveInt.optional(),
@@ -4239,7 +4596,7 @@ var NqrPaymentRequestArtifactSchema = import_zod16.z.object({
   memo: Memo.optional(),
   expiresAtMs: PositiveInt.optional()
 });
-var PaymentIntentArtifactSchema = import_zod16.z.object({
+var PaymentIntentArtifactSchema = import_zod17.z.object({
   intentId: ShortId,
   payerUserId: ShortId,
   payeeUserId: ShortId,
@@ -4248,7 +4605,7 @@ var PaymentIntentArtifactSchema = import_zod16.z.object({
   idempotencyKey: ShortId,
   createdAtMs: PositiveInt
 });
-var OfflineClaimArtifactSchema = import_zod16.z.object({
+var OfflineClaimArtifactSchema = import_zod17.z.object({
   claimId: ShortId,
   authorizationId: ShortId,
   payeeUserId: ShortId,
@@ -4257,10 +4614,10 @@ var OfflineClaimArtifactSchema = import_zod16.z.object({
   claimedAtMs: PositiveInt,
   paymentReference: ShortId.optional()
 });
-var SettlementRecordArtifactSchema = import_zod16.z.object({
+var SettlementRecordArtifactSchema = import_zod17.z.object({
   settlementId: ShortId,
   ledgerTxnId: ShortId,
-  sourceRefType: import_zod16.z.enum([
+  sourceRefType: import_zod17.z.enum([
     "offline_authorization",
     "offline_claim",
     "transfer",
@@ -4271,12 +4628,12 @@ var SettlementRecordArtifactSchema = import_zod16.z.object({
   currency: Currency2,
   settledAtMs: PositiveInt
 });
-var ReversalRecordArtifactSchema = import_zod16.z.object({
+var ReversalRecordArtifactSchema = import_zod17.z.object({
   reversalId: ShortId,
   originalTxnId: ShortId,
   amountKobo: PositiveInt,
   currency: Currency2,
-  reason: import_zod16.z.enum([
+  reason: import_zod17.z.enum([
     "user_dispute",
     "fraud",
     "duplicate",
@@ -4286,7 +4643,7 @@ var ReversalRecordArtifactSchema = import_zod16.z.object({
   reversedAtMs: PositiveInt,
   memo: Memo.optional()
 });
-var LedgerJournalEntryArtifactSchema = import_zod16.z.object({
+var LedgerJournalEntryArtifactSchema = import_zod17.z.object({
   entryId: ShortId,
   journalId: ShortId,
   debitAccountId: ShortId,
@@ -4297,13 +4654,13 @@ var LedgerJournalEntryArtifactSchema = import_zod16.z.object({
   refType: ShortId.optional(),
   refId: ShortId.optional()
 });
-var StatementArtifactSchema = import_zod16.z.object({
+var StatementArtifactSchema = import_zod17.z.object({
   statementId: ShortId,
   userId: ShortId,
   periodStartMs: PositiveInt,
   periodEndMs: PositiveInt,
-  openingBalanceKobo: import_zod16.z.number().int(),
-  closingBalanceKobo: import_zod16.z.number().int(),
+  openingBalanceKobo: import_zod17.z.number().int(),
+  closingBalanceKobo: import_zod17.z.number().int(),
   transactionCount: NonNegativeInt,
   currency: Currency2,
   hashChainPrev: HexString(32).optional()
@@ -4311,16 +4668,16 @@ var StatementArtifactSchema = import_zod16.z.object({
   message: "periodEndMs must be greater than periodStartMs",
   path: ["periodEndMs"]
 });
-var PassArtifactSchema = import_zod16.z.object({
+var PassArtifactSchema = import_zod17.z.object({
   passId: ShortId,
   holderId: ShortId,
-  category: import_zod16.z.enum(["membership", "ticket", "loyalty", "access", "voucher"]),
-  title: import_zod16.z.string().min(1).max(120),
+  category: import_zod17.z.enum(["membership", "ticket", "loyalty", "access", "voucher"]),
+  title: import_zod17.z.string().min(1).max(120),
   validFromMs: PositiveInt,
   validUntilMs: PositiveInt.optional(),
-  metadata: import_zod16.z.record(
-    import_zod16.z.string().min(1).max(64),
-    import_zod16.z.union([import_zod16.z.string().max(280), import_zod16.z.number(), import_zod16.z.boolean()])
+  metadata: import_zod17.z.record(
+    import_zod17.z.string().min(1).max(64),
+    import_zod17.z.union([import_zod17.z.string().max(280), import_zod17.z.number(), import_zod17.z.boolean()])
   ).optional()
 }).refine(
   (v) => v.validUntilMs === void 0 || v.validUntilMs > v.validFromMs,
@@ -4329,10 +4686,10 @@ var PassArtifactSchema = import_zod16.z.object({
     path: ["validUntilMs"]
   }
 );
-var IdentityArtifactSchema = import_zod16.z.object({
+var IdentityArtifactSchema = import_zod17.z.object({
   attestationId: ShortId,
   subjectId: ShortId,
-  claimType: import_zod16.z.enum([
+  claimType: import_zod17.z.enum([
     "phone_verified",
     "email_verified",
     "bvn_verified",
@@ -4453,6 +4810,7 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACCOUNT_FUNDED_OAC_MAX_TTL_MS,
   ACCOUNT_STATUSES,
   ACCOUNT_TYPES,
   ADDITIONAL_DATA_SUBFIELD,
@@ -4466,6 +4824,10 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   CLAIM_DOMAIN_V2,
   COLLECTION_INTENT_STATUSES,
   COLLECTION_PAYMENT_STATUSES,
+  CONSUMER_OFFLINE_CLAIM_SUBMIT_GRACE_MS,
+  CONSUMER_PAYMENT_REQUEST_DOMAIN,
+  CONSUMER_SETTLEMENT_DOMAIN,
+  CONSUMER_SETTLEMENT_RECEIPT_QR_PREFIX,
   CUSTODIAL_MODES,
   CollectionIntentSchema,
   CollectionPaymentResultSchema,
@@ -4475,6 +4837,7 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   ConsumerOACRecordSchema,
   ConsumerOACSchema,
   ConsumerPaymentClaimSchema,
+  ConsumerPaymentRequestEnvelopeSchema,
   ConsumerSettleResultSchema,
   ConsumerSettlementSchema,
   CreateCollectionIntentInputSchema,
@@ -4484,10 +4847,6 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   CreateWithdrawalResultSchema,
   DeviceKeyAlgSchema,
   DeviceKeyRecordSchema,
-  DisableOfflineInputSchema,
-  DisableOfflineResultSchema,
-  EnableOfflineInputSchema,
-  EnableOfflineResultSchema,
   FIELD,
   FLUR_ARTIFACT_URI_PREFIX,
   FLUR_ARTIFACT_URI_SCHEME,
@@ -4503,7 +4862,6 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   IdentityArtifactSchema,
   IngestFundingResultSchema,
   IssueAccountOacInputSchema,
-  IssueOACInputSchema,
   LedgerJournalEntryArtifactSchema,
   ListPayoutDestinationsResultSchema,
   MEMBERSHIP_ROLES,
@@ -4521,12 +4879,16 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   OAC_DEFAULT_PER_TX_KOBO,
   OAC_DEFAULT_VALIDITY_MS,
   OFFLINE_CLAIM_SMS_PREFIX,
+  OFFLINE_SMS_SETTLE_DOMAIN,
+  OFFLINE_SMS_SETTLE_HEADER_BYTES,
+  OFFLINE_SMS_SETTLE_PREFIX,
+  OFFLINE_SMS_SETTLE_SIGNATURE_BYTES,
+  OFFLINE_SMS_SETTLE_TOKEN_BYTES,
+  OFFLINE_SMS_SETTLE_VERSION,
   OfflineClaimArtifactSchema,
-  OfflineHoldRecordSchema,
   OfflinePaymentAuthorizationArtifactSchema,
   OfflinePaymentAuthorizationSchema,
   OfflinePaymentRequestSchema,
-  OfflineStateResultSchema,
   OfflineStatusResultSchema,
   OfflineTokenSchema,
   P256EnrollmentChallengeInputSchema,
@@ -4554,8 +4916,6 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   PayoutEventInputSchema,
   ProviderEventInputSchema,
   ProviderEventRecordSchema,
-  ProvisionOfflineAllowanceInputSchema,
-  ProvisionOfflineAllowanceResultSchema,
   PublicCollectionIntentSchema,
   RECEIPT_CHANNELS,
   RECEIPT_KINDS,
@@ -4566,7 +4926,6 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   ReconciliationReportSchema,
   RecordPayoutEventResultSchema,
   RedemptionSchema,
-  RegisterDeviceKeyInputSchema,
   RegisterDeviceKeyP256InputSchema,
   ReversalRecordArtifactSchema,
   RevokeDeviceKeyInputSchema,
@@ -4585,18 +4944,25 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   bodySha256Hex,
   buildArtifactBody,
   buildAuthorization,
+  buildConsumerPaymentRequest,
   buildOAC,
   buildPass,
   buildPaymentRequest,
   buildReceipt,
   buildRedemption,
+  buildSmsSettleHeader,
+  buildSmsSettleSignedBytes,
   canonicalClaimSigningBytes,
   canonicalClaimSigningPayload,
   canonicalJSONBytes,
   canonicalJSONStringify,
   canonicalRequestString,
+  computeConsumerClaimEncounterId,
   computeEncounterId,
   constantTimeEqual,
+  consumerPaymentRequestSigningBytes,
+  consumerPaymentRequestSigningPayload,
+  consumerSettlementSigningPayload,
   crc16ccitt,
   crc16ccittHex,
   createAccountsClient,
@@ -4620,19 +4986,27 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   decodeArtifactUri,
   decodeAuthorizationQR,
   decodeBase45,
+  decodeConsumerSettlementReceiptQR,
   decodeOfflineClaimSmsMessage,
+  decodeOfflineSmsSettleToken,
   decodePaymentRequestQR,
+  decodeUnverifiedConsumerSettlementReceiptQR,
+  derToRawP256Signature,
   encodeArtifactUri,
   encodeAuthorizationQR,
   encodeBase45,
+  encodeConsumerSettlementReceiptQR,
   encodeNQR,
   encodeOfflineClaimSmsMessage,
+  encodeOfflineSmsSettleToken,
   encodePaymentRequestQR,
   extractOfflineClaimSmsToken,
+  extractOfflineSmsSettleToken,
   formatAmount,
   generateDynamicQR,
   generateStaticQR,
   init,
+  isConsumerPaymentRequestExpired,
   isHardenedArtifactType,
   isKnownArtifactType,
   isPassWithinValidity,
@@ -4645,6 +5019,7 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   routingHint,
   signArtifact,
   signAuthorization,
+  signConsumerPaymentRequest,
   signOAC,
   signPartnerRequest,
   signPass,
@@ -4656,7 +5031,11 @@ function createOfflinePaymentAuthorizationArtifactUri(input) {
   verifyArtifactUri,
   verifyAuthorization,
   verifyClaimSignature,
+  verifyConsumerPaymentRequest,
+  verifyConsumerSettlement,
+  verifyConsumerSettlementReceiptQR,
   verifyOAC,
+  verifyOfflineSmsSettleToken,
   verifyPass,
   verifyPaymentRequest,
   verifyReceipt,