@relvo/mcp 0.1.2 → 0.1.4

package/dist/client/local-profile.js

@@ -1,21 +1,21 @@
 import { constants } from "node:fs";
-import { link, lstat, mkdir, open, realpath, rename, unlink } from "node:fs/promises";
+import { lstat, mkdir, open, realpath, rename, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { platformLocalSetupClientSchema, platformLocalSetupStartSchema, platformLocalSetupProofSchema, platformLocalSetupPollSchema } from "./local-setup.js";
 import { configFromEnvironment, hasRelvoEnvironment } from "./index.js";
-const registeredSchema = z.object({ client: z.enum(["claude", "codex"]), name: z.string().regex(/^(?:relvo|toolhub)-[a-f0-9]{24}$/), command: z.string().min(1), args: z.array(z.string()).min(1) }).strict();
-const common = { managedBy: z.enum(["relvo-cli", "toolhub-cli"]), version: z.literal(1), apiUrl: z.string().url(), consoleUrl: z.string().url(), local: z.boolean(),
-    legacyProfileSha256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+const registeredSchema = z.object({ client: z.enum(["claude", "codex"]), name: z.string().regex(/^relvo-[a-f0-9]{24}$/), command: z.string().min(1), args: z.array(z.string()).min(1) }).strict();
+const common = { managedBy: z.literal("relvo-cli"), version: z.literal(1), apiUrl: z.string().url(), consoleUrl: z.string().url(), local: z.boolean(),
     installationId: z.string().regex(/^[a-f0-9]{24}$/), registrations: z.array(registeredSchema).max(2).default([]) };
 export const localProfileSchema = z.discriminatedUnion("state", [
     z.object({ ...common, state: z.literal("pending"), client: platformLocalSetupClientSchema, request: platformLocalSetupStartSchema }).strict(),
     z.object({ ...common, state: z.literal("ready"), grant: platformLocalSetupPollSchema.options[1], pendingAck: platformLocalSetupProofSchema.optional() }).strict(),
 ]);
+const installationSchema = z.object({ managedBy: z.literal("relvo-cli"), version: z.literal(1),
+    installationId: common.installationId, registrations: common.registrations }).strict();
 export const localProfilePath = (home = homedir()) => join(home, ".config", "relvo", "profile.json");
-export const legacyLocalProfilePath = (home = homedir()) => join(home, ".config", "toolhub", "profile.json");
 function owned(mode, uid, privateMode) {
     if (typeof process.getuid === "function" && uid !== process.getuid() || mode & (privateMode ? 0o077 : 0o022))
         throw new Error("Relvo local storage has unsafe ownership or permissions.");
@@ -39,7 +39,7 @@ export async function safeDirectory(path, create = false, privateMode = false) {
 export async function profileDirectory(path = localProfilePath(), create = false) {
     if (process.platform === "win32")
         throw new Error("Relvo private local profiles currently require POSIX file permissions.");
-    if (!isAbsolute(path) || resolve(path) !== path || !/\/\.config\/(?:relvo|toolhub)\/profile\.json$/.test(path))
+    if (!isAbsolute(path) || resolve(path) !== path || !/\/\.config\/relvo\/profile\.json$/.test(path))
         throw new Error("Use the canonical managed Relvo profile path.");
     const root = dirname(dirname(dirname(path)));
     if (await realpath(root) !== root)
@@ -103,68 +103,6 @@ export async function writePrivateText(path, value, privateParent = true, maximu
 }
 export async function writePrivateJson(path, value, privateParent = true, maximumBytes = 65536) { await writePrivateText(path, JSON.stringify(value) + "\n", privateParent, maximumBytes); }
 export async function readLocalProfile(path = localProfilePath()) {
-    try {
-        path = await migratedProfileTarget(path);
-        let profile = await readOwnedProfile(path);
-        if (!profile && path.endsWith("/.config/relvo/profile.json")) {
-            const legacy = path.replace(/\/relvo\/profile\.json$/, "/toolhub/profile.json");
-            const previous = await readOwnedProfile(legacy);
-            if (previous) {
-                await assertLegacySetupIdle(legacy);
-                const raw = await readPrivateText(legacy);
-                const migrated = localProfileSchema.parse({ ...localProfileSchema.parse(JSON.parse(raw)), managedBy: "relvo-cli", legacyProfileSha256: digest(raw) });
-                await profileDirectory(path, true);
-                await createProfileExclusive(path, migrated);
-                profile = await readOwnedProfile(path);
-            }
-        }
-        if (!profile && path.endsWith("/.config/toolhub/profile.json"))
-            return readLocalProfile(path.replace(/\/toolhub\/profile\.json$/, "/relvo/profile.json"));
-        if (profile?.legacyProfileSha256)
-            await unchangedLegacyProfile(path, profile.legacyProfileSha256);
-        return profile;
-    }
-    catch (error) {
-        if (error instanceof Error && "code" in error && error.code === "ENOENT")
-            return null;
-        throw new Error("Relvo local profile is unsafe or invalid. No credentials were changed.");
-    }
-}
-const digest = (raw) => createHash("sha256").update(raw).digest("hex");
-async function createProfileExclusive(path, profile) {
-    const value = JSON.stringify(profile) + "\n";
-    if (Buffer.byteLength(value, "utf8") > 65536)
-        throw new Error("The migrated profile exceeds its private file limit.");
-    const temporary = join(dirname(path), `.relvo-migrate-${randomUUID()}.tmp`);
-    const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-    try {
-        try {
-            await handle.writeFile(value);
-            await handle.sync();
-        }
-        finally {
-            await handle.close();
-        }
-        try {
-            await link(temporary, path);
-        }
-        catch (error) {
-            if (!(error instanceof Error && "code" in error && error.code === "EEXIST"))
-                throw error;
-        }
-    }
-    finally {
-        await unlink(temporary);
-    }
-    const parent = await open(dirname(path), constants.O_RDONLY);
-    try {
-        await parent.sync();
-    }
-    finally {
-        await parent.close();
-    }
-}
-async function readOwnedProfile(path) {
     try {
         await profileDirectory(path);
         return localProfileSchema.parse(await readPrivateJson(path));
@@ -172,59 +110,33 @@ async function readOwnedProfile(path) {
     catch (error) {
         if (error instanceof Error && "code" in error && error.code === "ENOENT")
             return null;
-        throw error;
+        throw new Error("Relvo local profile is unsafe or invalid. No credentials were changed.");
     }
 }
-async function migratedProfileTarget(path) {
-    if (!path.endsWith("/.config/toolhub/profile.json"))
-        return path;
-    const canonical = path.replace(/\/toolhub\/profile\.json$/, "/relvo/profile.json");
-    const profile = await readOwnedProfile(canonical);
-    return profile && (profile.legacyProfileSha256 || !await readOwnedProfile(path)) ? canonical : path;
+export async function writeLocalProfile(path, profile) {
+    await profileDirectory(path, true);
+    await readLocalProfile(path);
+    await writePrivateJson(path, localProfileSchema.parse({ ...profile, managedBy: "relvo-cli" }));
 }
-async function assertLegacySetupIdle(path) {
-    let lock;
+export async function readLocalInstallation(path = localProfilePath()) {
     try {
-        lock = z.object({ managedBy: z.enum(["toolhub-cli", "relvo-cli"]), pid: z.number().int().positive() }).strict().parse(await readPrivateJson(join(dirname(path), "setup.lock")));
+        const directory = await profileDirectory(path);
+        return installationSchema.parse(await readPrivateJson(join(directory, "installation.json")));
     }
     catch (error) {
         if (error instanceof Error && "code" in error && error.code === "ENOENT")
-            return;
-        throw error;
-    }
-    try {
-        process.kill(lock.pid, 0);
-    }
-    catch (error) {
-        if (error instanceof Error && "code" in error && error.code === "ESRCH")
-            return;
-        throw error;
+            return null;
+        throw new Error("Relvo installation ownership is unsafe or invalid. No registrations were changed.");
     }
-    throw new Error("The existing setup is active. Wait for it to finish before migrating.");
-}
-async function unchangedLegacyProfile(path, expected) {
-    if (!path.endsWith("/.config/relvo/profile.json"))
-        throw new Error("Invalid migrated profile path");
-    const legacy = path.replace(/\/relvo\/profile\.json$/, "/toolhub/profile.json");
-    if (!await readOwnedProfile(legacy))
-        return null;
-    if (digest(await readPrivateText(legacy)) !== expected)
-        throw new Error("The existing profile changed after migration and was preserved.");
-    return legacy;
-}
-export async function writeLocalProfile(path, profile) {
-    path = await migratedProfileTarget(path);
-    await profileDirectory(path, true);
-    const previous = await readLocalProfile(path);
-    await writePrivateJson(path, localProfileSchema.parse({ ...profile, managedBy: "relvo-cli", ...(previous?.legacyProfileSha256 ? { legacyProfileSha256: previous.legacyProfileSha256 } : {}) }));
 }
 export async function removeLocalProfile(path) {
-    path = await migratedProfileTarget(path);
     const profile = await readLocalProfile(path);
     if (profile) {
-        const legacy = profile.legacyProfileSha256 ? await unchangedLegacyProfile(path, profile.legacyProfileSha256) : null;
-        if (legacy)
-            await unlink(legacy);
+        const installation = await readLocalInstallation(path);
+        if (installation && installation.installationId !== profile.installationId)
+            throw new Error("Relvo installation ownership changed. The login was preserved.");
+        await writePrivateJson(join(dirname(path), "installation.json"), installationSchema.parse({ managedBy: "relvo-cli", version: 1,
+            installationId: profile.installationId, registrations: profile.registrations }));
         await unlink(path);
     }
 }

package/dist/client/local-setup.js

@@ -8,7 +8,6 @@ export function relvoApiUrl(value, local = false) {
         throw new Error("Relvo URLs must use HTTPS; --local permits loopback HTTP only.");
     return url.href.replace(/\/$/, "");
 }
-export const toolhubApiUrl = relvoApiUrl;
 export function verificationUrl(value, consoleUrl, authorizationRequest, local = false) {
     const trusted = new URL(relvoApiUrl(consoleUrl, local));
     if (trusted.pathname !== "/")

package/dist/client/tool-name-hints.js

@@ -0,0 +1,48 @@
+const MAX_REMEMBERED_NAMES = 64, MAX_SUGGESTIONS = 3;
+const normalized = (name) => name.split("_").map(word => word.length > 4 ? word.replace(/ies$/, "y").replace(/s$/, "") : word).join("_");
+function oneEditApart(left, right) {
+    if (Math.abs(left.length - right.length) > 1)
+        return false;
+    let a = 0, b = 0, edits = 0;
+    while (a < left.length && b < right.length) {
+        if (left[a] === right[b]) {
+            a++;
+            b++;
+            continue;
+        }
+        if (++edits > 1)
+            return false;
+        if (left.length <= right.length)
+            b++;
+        if (left.length >= right.length)
+            a++;
+    }
+    return edits + Number(a < left.length || b < right.length) <= 1;
+}
+export class ToolNameHints {
+    names = new Set();
+    credential;
+    remember(names, credential) {
+        if (this.credential !== credential) {
+            this.names.clear();
+            this.credential = credential;
+        }
+        for (const name of names) {
+            this.names.delete(name);
+            this.names.add(name);
+            if (this.names.size > MAX_REMEMBERED_NAMES) {
+                const oldest = this.names.values().next().value;
+                if (oldest !== undefined)
+                    this.names.delete(oldest);
+            }
+        }
+    }
+    hint(requested, credential) {
+        if (credential !== this.credential)
+            return undefined;
+        const query = normalized(requested), prefix = requested.split("_")[0];
+        const found = [...this.names].filter(name => name !== requested && name.split("_")[0] === prefix && oneEditApart(query, normalized(name)))
+            .sort((a, b) => Number(normalized(a) !== query) - Number(normalized(b) !== query) || a.localeCompare(b)).slice(0, MAX_SUGGESTIONS);
+        return found.length ? `Loaded tool names: ${found.join(", ")}. Inspect the intended definition before quoting.` : undefined;
+    }
+}

package/dist/client/wallet-access.js

@@ -0,0 +1,207 @@
+import { randomBytes } from "node:crypto";
+import { z } from "zod";
+import { PLATFORM_WALLET_ROUTES } from "../schema/platformRoutes.js";
+import { PLATFORM_WALLET_TOP_UP_MIN_CENTS } from "../schema/platformFunding.js";
+import { checksumAddress, loadEvmWallet } from "./evm-wallet.js";
+import { relvoApiUrl } from "./local-setup.js";
+const MICROS_PER_CENT = 10_000;
+const REQUEST_TIMEOUT_MS = 60_000;
+const SIGN_IN_HEADER = "SIGN-IN-WITH-X";
+const PAYMENT_REQUIRED_HEADER = "PAYMENT-REQUIRED";
+const PAYMENT_SIGNATURE_HEADER = "PAYMENT-SIGNATURE";
+const NETWORKS = {
+    "eip155:8453": { chainId: 8453, usdc: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" },
+    "eip155:84532": { chainId: 84532, usdc: "0x036CbD53842c5426634e7929541eC2318f3dCF7e" },
+};
+const isNetwork = (value) => Object.hasOwn(NETWORKS, value);
+export class WalletAccessError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "WalletAccessError";
+    }
+}
+const address = z.string().regex(/^0x[0-9a-fA-F]{40}$/);
+const resourceSchema = z.object({ url: z.string(), description: z.string().optional(), mimeType: z.string().optional() }).passthrough();
+const requirementSchema = z.object({
+    scheme: z.string(), network: z.string(), amount: z.string().regex(/^\d+$/), asset: z.string(), payTo: z.string(),
+    maxTimeoutSeconds: z.number().int().positive(), extra: z.record(z.string(), z.unknown()).optional(),
+}).passthrough();
+const paymentRequiredSchema = z.object({
+    x402Version: z.literal(2), error: z.string().optional(), resource: resourceSchema, accepts: z.array(requirementSchema),
+    extensions: z.record(z.string(), z.unknown()).optional(),
+}).passthrough();
+const signInInfoSchema = z.object({
+    domain: z.string().min(1), uri: z.string().min(1), version: z.literal("1"), nonce: z.string().min(1), issuedAt: z.string().min(1),
+    expirationTime: z.string().optional(), notBefore: z.string().optional(), statement: z.string().optional(),
+    resources: z.array(z.string()).optional(), requestId: z.string().optional(),
+}).passthrough();
+const signInExtensionSchema = z.object({
+    info: signInInfoSchema, supportedChains: z.array(z.object({ chainId: z.string(), type: z.string() }).passthrough()),
+}).passthrough();
+const signInResultSchema = z.object({ data: z.object({
+        apiKey: z.string(), expiresAt: z.string(), address: z.string(), organizationId: z.string(), projectId: z.string(), created: z.boolean(),
+    }) });
+const topUpResultSchema = z.object({ data: z.object({
+        creditedCents: z.number().int().positive(), transaction: z.string().nullable(), network: z.string(), payer: z.string(),
+    }) });
+const base64Json = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64");
+function api(apiUrl, local) {
+    const url = new URL(relvoApiUrl(apiUrl, local));
+    return { url, base: url.href.replace(/\/$/, "") };
+}
+async function serverMessage(response) {
+    try {
+        const body = z.object({ error: z.object({ message: z.string().regex(/^[a-z0-9_]{1,80}$/) }) }).safeParse(await response.json());
+        return body.success ? body.data.error.message : "no error code";
+    }
+    catch {
+        return "no error code";
+    }
+}
+async function send(fetchImpl, url, init, what) {
+    try {
+        return await fetchImpl(url, { ...init, redirect: "error", signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    }
+    catch {
+        throw new WalletAccessError(`The Relvo API could not be reached for ${what}.`);
+    }
+}
+async function readPaymentRequired(response) {
+    const header = response.headers.get(PAYMENT_REQUIRED_HEADER);
+    let json;
+    try {
+        json = header ? JSON.parse(Buffer.from(header, "base64").toString("utf8")) : (await response.json()).paymentRequired;
+    }
+    catch {
+        throw new WalletAccessError("The Relvo API returned an unreadable payment requirement.", response.status);
+    }
+    const parsed = paymentRequiredSchema.safeParse(json);
+    if (!parsed.success)
+        throw new WalletAccessError("The Relvo API returned an unexpected payment requirement.", response.status);
+    return parsed.data;
+}
+function siweMessage(fields) {
+    const lines = [`${fields.domain} wants you to sign in with your Ethereum account:`, checksumAddress(fields.address), ""];
+    if (fields.statement)
+        lines.push(fields.statement, "");
+    lines.push(`URI: ${fields.uri}`, `Version: ${fields.version}`, `Chain ID: ${fields.chainId.replace(/^eip155:/, "")}`, `Nonce: ${fields.nonce}`, `Issued At: ${fields.issuedAt}`);
+    if (fields.expirationTime)
+        lines.push(`Expiration Time: ${fields.expirationTime}`);
+    if (fields.notBefore)
+        lines.push(`Not Before: ${fields.notBefore}`);
+    if (fields.requestId)
+        lines.push(`Request ID: ${fields.requestId}`);
+    if (fields.resources?.length)
+        lines.push("Resources:", ...fields.resources.map((resource) => `- ${resource}`));
+    return lines.join("\n");
+}
+export async function walletSignIn({ apiUrl, wallet, local, fetch: fetchImpl = fetch }) {
+    const { url, base } = api(apiUrl, local), endpoint = `${base}${PLATFORM_WALLET_ROUTES.signIn}`;
+    const challenge = await send(fetchImpl, endpoint, { method: "POST" }, "sign-in");
+    if (challenge.status !== 402)
+        throw new WalletAccessError(`Wallet sign-in is unavailable (${await serverMessage(challenge)}).`, challenge.status);
+    const extension = signInExtensionSchema.safeParse((await readPaymentRequired(challenge)).extensions?.["sign-in-with-x"]);
+    if (!extension.success)
+        throw new WalletAccessError("The Relvo API did not offer wallet sign-in.", 402);
+    const { info, supportedChains } = extension.data;
+    let uriOrigin;
+    try {
+        uriOrigin = new URL(info.uri).origin;
+    }
+    catch {
+        uriOrigin = undefined;
+    }
+    if (info.domain !== url.host || uriOrigin !== url.origin)
+        throw new WalletAccessError("The sign-in challenge names a different site than the API URL; nothing was signed.");
+    if (info.expirationTime && Date.parse(info.expirationTime) <= Date.now())
+        throw new WalletAccessError("The sign-in challenge has already expired; nothing was signed.");
+    const chain = supportedChains.find((candidate) => candidate.type === "eip191" && isNetwork(candidate.chainId));
+    if (!chain)
+        throw new WalletAccessError("The sign-in challenge offers no supported chain.");
+    const fields = { ...info, address: wallet.address, chainId: chain.chainId };
+    const proof = { domain: info.domain, address: wallet.address, uri: info.uri, version: info.version, chainId: chain.chainId, type: "eip191", nonce: info.nonce,
+        issuedAt: info.issuedAt, ...(info.statement ? { statement: info.statement } : {}), ...(info.expirationTime ? { expirationTime: info.expirationTime } : {}),
+        ...(info.notBefore ? { notBefore: info.notBefore } : {}), ...(info.requestId ? { requestId: info.requestId } : {}),
+        ...(info.resources ? { resources: info.resources } : {}), signature: wallet.signPersonalMessage(siweMessage(fields)) };
+    const response = await send(fetchImpl, endpoint, { method: "POST", headers: { [SIGN_IN_HEADER]: base64Json(proof) } }, "sign-in");
+    if (!response.ok)
+        throw new WalletAccessError(`Wallet sign-in was rejected (${await serverMessage(response)}).`, response.status);
+    const parsed = signInResultSchema.safeParse(await response.json().catch(() => null));
+    if (!parsed.success)
+        throw new WalletAccessError("The Relvo API returned an unexpected sign-in response.", response.status);
+    return parsed.data.data;
+}
+export function walletAutoTopUp(options) {
+    let committedCents = 0;
+    return async (shortfall) => {
+        if (shortfall.reason !== "balance")
+            return null;
+        const deficit = BigInt(shortfall.requiredMicros) - BigInt(shortfall.availableMicros);
+        if (deficit <= 0n)
+            return null;
+        const amountCents = Math.max(PLATFORM_WALLET_TOP_UP_MIN_CENTS, Number((deficit + BigInt(MICROS_PER_CENT) - 1n) / BigInt(MICROS_PER_CENT)));
+        if (committedCents + amountCents > options.maximumTotalCents)
+            return null;
+        committedCents += amountCents;
+        return walletTopUp({ ...options, amountCents, maximumCents: amountCents });
+    };
+}
+export function walletAutoTopUpFromEnvironment(env, api) {
+    const key = env.RELVO_WALLET_PRIVATE_KEY?.trim(), cap = env.RELVO_WALLET_AUTO_TOP_UP_USD?.trim();
+    if (!key || !cap)
+        return undefined;
+    if (!/^\d{1,6}(?:\.\d{1,2})?$/.test(cap))
+        throw new WalletAccessError("RELVO_WALLET_AUTO_TOP_UP_USD must be a USD amount such as 5 or 5.00.");
+    const [dollars, cents = ""] = cap.split(".");
+    return walletAutoTopUp({ ...api, wallet: loadEvmWallet(key), maximumTotalCents: Number(dollars) * 100 + Number(cents.padEnd(2, "0")) });
+}
+export async function walletTopUp({ apiUrl, wallet, local, fetch: fetchImpl = fetch, apiKey, amountCents, maximumCents }) {
+    if (!Number.isSafeInteger(amountCents) || amountCents <= 0 || !Number.isSafeInteger(maximumCents) || maximumCents < amountCents)
+        throw new WalletAccessError("Use a positive whole-cent amount that does not exceed the maximum.");
+    const { base } = api(apiUrl, local), endpoint = `${base}${PLATFORM_WALLET_ROUTES.topUp}`;
+    const headers = { authorization: `Bearer ${apiKey}`, "content-type": "application/json" };
+    const body = JSON.stringify({ amountCents });
+    const quote = await send(fetchImpl, endpoint, { method: "POST", headers, body }, "top-up");
+    if (quote.status !== 402)
+        throw new WalletAccessError(`Top-up is unavailable (${await serverMessage(quote)}).`, quote.status);
+    const required = await readPaymentRequired(quote), accepted = required.accepts[0];
+    if (!accepted)
+        throw new WalletAccessError("The Relvo API offered no payment requirement.", 402);
+    if (accepted.scheme !== "exact")
+        throw new WalletAccessError("The payment requirement is not the exact scheme; nothing was signed.");
+    if (!isNetwork(accepted.network) || accepted.asset.toLowerCase() !== NETWORKS[accepted.network].usdc.toLowerCase())
+        throw new WalletAccessError("The payment requirement names an unknown network or token; nothing was signed.");
+    const micros = BigInt(accepted.amount);
+    if (micros > BigInt(maximumCents) * BigInt(MICROS_PER_CENT) || micros !== BigInt(amountCents) * BigInt(MICROS_PER_CENT))
+        throw new WalletAccessError("The payment requirement differs from the requested amount or exceeds the maximum; nothing was signed.");
+    if (!address.safeParse(accepted.payTo).success)
+        throw new WalletAccessError("The payment requirement has an invalid recipient; nothing was signed.");
+    const { name, version } = accepted.extra ?? {};
+    if (typeof name !== "string" || typeof version !== "string")
+        throw new WalletAccessError("The payment requirement lacks the token's signing domain; nothing was signed.");
+    const nonce = `0x${randomBytes(32).toString("hex")}`;
+    const authorization = { from: wallet.address, to: accepted.payTo, value: accepted.amount, validAfter: "0",
+        validBefore: String(Math.floor(Date.now() / 1000) + accepted.maxTimeoutSeconds), nonce };
+    const signature = wallet.signTypedData({ name, version, chainId: NETWORKS[accepted.network].chainId, verifyingContract: accepted.asset }, { TransferWithAuthorization: [
+            { name: "from", type: "address" }, { name: "to", type: "address" }, { name: "value", type: "uint256" },
+            { name: "validAfter", type: "uint256" }, { name: "validBefore", type: "uint256" }, { name: "nonce", type: "bytes32" },
+        ] }, "TransferWithAuthorization", authorization);
+    const payment = { x402Version: 2, resource: required.resource, accepted, payload: { signature, authorization } };
+    let response;
+    try {
+        response = await send(fetchImpl, endpoint, { method: "POST", headers: { ...headers, [PAYMENT_SIGNATURE_HEADER]: base64Json(payment) }, body }, "top-up");
+    }
+    catch {
+        throw new WalletAccessError("The payment was signed but the reply was lost; it may have been settled. Check the balance with relvo usage before paying again.");
+    }
+    if (response.status === 402)
+        throw new WalletAccessError(`The payment was rejected (${(await readPaymentRequired(response)).error ?? "no reason given"}).`, 402);
+    if (!response.ok)
+        throw new WalletAccessError(`Top-up failed (${await serverMessage(response)}); the payment may be pending, so check the balance before paying again.`, response.status);
+    const parsed = topUpResultSchema.safeParse(await response.json().catch(() => null));
+    if (!parsed.success)
+        throw new WalletAccessError("The Relvo API returned an unexpected top-up response; check the balance before paying again.", response.status);
+    return parsed.data.data;
+}