@settlemint/dalp-sdk 3.1.33 → 3.2.0-rc.1

package/dist/chunk-6hckdbwt.js

@@ -0,0 +1,600 @@
+import {
+  createDalpSdkConfigurationError2
+} from "./chunk-k3ntysxx.js";
+
+// src/auth-surface.ts
+var DALP_AUTH_SURFACE_HEADER2 = "X-Dalp-Auth-Surface";
+
+// src/secret.ts
+var SECRET_REDACTION_MARKER2 = "[REDACTED]";
+var inspectSymbol = Symbol.for("nodejs.util.inspect.custom");
+var secretValue = new WeakMap;
+
+class Secret2 {
+  constructor(value) {
+    secretValue.set(this, value);
+    Object.freeze(this);
+  }
+  static from(value) {
+    if (value.trim().length === 0) {
+      throw new TypeError("DALP SDK: a secret value must not be empty.");
+    }
+    return new Secret2(value);
+  }
+  toString() {
+    return SECRET_REDACTION_MARKER2;
+  }
+  toJSON() {
+    return SECRET_REDACTION_MARKER2;
+  }
+  [inspectSymbol]() {
+    return SECRET_REDACTION_MARKER2;
+  }
+}
+var secret2 = (value) => Secret2.from(value);
+var unwrapSecret = (value) => {
+  const raw = secretValue.get(value);
+  if (raw === undefined) {
+    throw new TypeError("DALP SDK: cannot unwrap an invalid secret value.");
+  }
+  return raw;
+};
+
+// src/runtime.ts
+var REACT_NATIVE_NAVIGATOR_PRODUCT = "ReactNative";
+function detectDalpRuntime() {
+  if (Reflect.get(globalThis, "navigator") !== undefined && Reflect.get(navigator, "product") === REACT_NATIVE_NAVIGATOR_PRODUCT) {
+    return "react-native";
+  }
+  return globalThis.window === undefined ? "server" : "browser";
+}
+function runtimeCredentials(runtime) {
+  return runtime === "browser" ? "include" : "omit";
+}
+function refuseCrossOriginBrowserSession(runtime, baseUrl, usesApiKey) {
+  if (runtime !== "browser" || usesApiKey) {
+    return;
+  }
+  const browserOrigin = globalThis.window?.location?.origin;
+  const targetOrigin = new URL(baseUrl).origin;
+  if (browserOrigin === undefined || browserOrigin === targetOrigin) {
+    return;
+  }
+  throw createDalpSdkConfigurationError2({
+    message: "DALP SDK: browser cookie sessions must use the application origin; mount createDalpProxy at /api.",
+    why: `The browser page is ${browserOrigin}, but the client targets ${targetOrigin}; host-only session cookies do not cross origins.`,
+    fix: "Set the browser client baseUrl to window.location.origin and mount createDalpProxy at /api on that origin."
+  });
+}
+var WHATWG_FETCH_POLYFILL_FLAG = "polyfill";
+function isBufferingFetch(fetchImpl) {
+  return typeof fetchImpl === "function" && Reflect.get(fetchImpl, WHATWG_FETCH_POLYFILL_FLAG) === true;
+}
+function keepBufferingMarker(wrapped, wrapper) {
+  return isBufferingFetch(wrapped) ? Object.assign(wrapper, { [WHATWG_FETCH_POLYFILL_FLAG]: true }) : wrapper;
+}
+function globalFetch() {
+  return keepBufferingMarker(globalThis.fetch, (input, init) => globalThis.fetch(input, init));
+}
+function refuseBundledApiKey(runtime) {
+  if (runtime === "server") {
+    return;
+  }
+  throw createDalpSdkConfigurationError2({
+    message: `DALP SDK: API keys are server/CLI-only credentials and cannot configure a ${runtime} client.`,
+    why: "An API key placed in a browser or app bundle ships the credential to every visitor or device.",
+    fix: "Keep the API key on the server or CLI process; browser and app clients authenticate with the session cookie."
+  });
+}
+
+// ../kernel/error/src/base-error-fields.ts
+import { Function, Schema as Schema2 } from "effect";
+
+// ../kernel/error/src/sensitive-error-fields.ts
+import { Effect, Predicate, Result, Schema, SchemaGetter } from "effect";
+
+// ../kernel/error/src/scrub-url-credentials.ts
+var CREDENTIAL_PATH_SEGMENT_RE = /[A-Za-z0-9_-]{16,}/gu;
+var TRAILING_PUNCTUATION_RE = /[.,;:!?]+$/u;
+var REDACTED = "[REDACTED]";
+function scrubUrlCredentials(candidate) {
+  const trailing = TRAILING_PUNCTUATION_RE.exec(candidate)?.[0] ?? "";
+  const core = trailing === "" ? candidate : candidate.slice(0, -trailing.length);
+  try {
+    const url = new URL(core);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.pathname = url.pathname.split("/").map((segment) => segment.replaceAll(CREDENTIAL_PATH_SEGMENT_RE, REDACTED)).join("/");
+    return url.toString() + trailing;
+  } catch {
+    return `[REDACTED-URL]${trailing}`;
+  }
+}
+
+// ../kernel/error/src/sensitive-error-fields.ts
+var LOWER_UPPER_BOUNDARY_PATTERN = /([a-z0-9])([A-Z])/gu;
+var ACRONYM_BOUNDARY_PATTERN = /([A-Z]+)([A-Z][a-z])/gu;
+var NON_ALPHANUMERIC_RUN_PATTERN = /[^a-zA-Z0-9]+/u;
+var TRAILING_DIGITS_PATTERN = /\d+$/u;
+var SERIALIZABLE_CAUSE_MAX_DEPTH = 8;
+var SERIALIZABLE_CAUSE_MAX_BYTES = 32768;
+var TRUNCATED_CAUSE = "[Truncated]";
+var REDACTED_CAUSE = "[Redacted]";
+var CIRCULAR_CAUSE = "[Circular]";
+var UNAVAILABLE_CAUSE = "[Unavailable]";
+var textEncoder = new TextEncoder;
+var isJson = Schema.is(Schema.Json);
+var strongDiagnosticSuffixes = new Set([
+  "algorithm",
+  "count",
+  "country",
+  "domain",
+  "format",
+  "kind",
+  "length",
+  "scheme",
+  "size",
+  "status",
+  "type",
+  "version"
+]);
+var weakDiagnosticSuffixes = new Set(["code", "name"]);
+var sensitiveSingleTokens = new Set([
+  "authorization",
+  "cookie",
+  "credential",
+  "cvv",
+  "email",
+  "iban",
+  "jwt",
+  "mnemonic",
+  "otp",
+  "password",
+  "payload",
+  "phone",
+  "pii",
+  "pin",
+  "secret",
+  "signature",
+  "ssn",
+  "token"
+]);
+var sensitiveTokenSequences = [
+  ["account", "number"],
+  ["api", "key"],
+  ["card", "number"],
+  ["date", "of", "birth"],
+  ["national", "id"],
+  ["passport", "number"],
+  ["private", "key"],
+  ["seed", "phrase"],
+  ["session", "id"]
+];
+var splitEncodedKey = (key) => key.replaceAll(LOWER_UPPER_BOUNDARY_PATTERN, "$1 $2").replaceAll(ACRONYM_BOUNDARY_PATTERN, "$1 $2").split(NON_ALPHANUMERIC_RUN_PATTERN).filter((part) => part.length > 0).map((part) => part.toLowerCase());
+var hasOnlyDiagnosticSuffix = (tokens, sensitiveEnd) => {
+  const suffix = tokens.slice(sensitiveEnd);
+  if (suffix.length === 0 || !strongDiagnosticSuffixes.has(suffix[0] ?? "")) {
+    return false;
+  }
+  for (let index = 0;index < suffix.length; index += 1) {
+    const token = suffix[index] ?? "";
+    if (strongDiagnosticSuffixes.has(token)) {
+      continue;
+    }
+    if (weakDiagnosticSuffixes.has(token) && suffix[index - 1] === "country") {
+      continue;
+    }
+    return false;
+  }
+  return true;
+};
+var flattenedSensitiveSequences = sensitiveTokenSequences.map((sequence) => sequence.join(""));
+var tokenMatchesSequencePart = (token, part) => {
+  const digitless = token.replace(TRAILING_DIGITS_PATTERN, "");
+  return digitless === part || digitless === `${part}s`;
+};
+var tokenIsSensitiveSingle = (token) => {
+  const digitless = token.replace(TRAILING_DIGITS_PATTERN, "");
+  if (sensitiveSingleTokens.has(digitless)) {
+    return true;
+  }
+  return digitless.endsWith("s") && sensitiveSingleTokens.has(digitless.slice(0, -1));
+};
+var tokenIsFusedSensitive = (token) => {
+  if (flattenedSensitiveSequences.some((fragment) => token.includes(fragment))) {
+    return true;
+  }
+  for (const fragment of sensitiveSingleTokens) {
+    if (token === fragment) {
+      continue;
+    }
+    if (fragment.length >= 5 ? token.includes(fragment) : token.startsWith(fragment) || token.endsWith(fragment)) {
+      return true;
+    }
+  }
+  return false;
+};
+var findSensitiveMatches = (tokens) => {
+  const matches = [];
+  for (const sequence of sensitiveTokenSequences) {
+    for (let start = 0;start <= tokens.length - sequence.length; start += 1) {
+      if (sequence.every((part, offset) => tokenMatchesSequencePart(tokens[start + offset] ?? "", part))) {
+        matches.push({ start, end: start + sequence.length });
+      }
+    }
+  }
+  for (let index = 0;index < tokens.length; index += 1) {
+    if (tokenIsSensitiveSingle(tokens[index] ?? "")) {
+      matches.push({ start: index, end: index + 1 });
+    }
+  }
+  return matches;
+};
+var encodedKeyIsForbidden = (key) => {
+  const tokens = splitEncodedKey(key);
+  const matches = findSensitiveMatches(tokens);
+  const matchedIndexes = new Set(matches.flatMap((match) => Array.from({ length: match.end - match.start }, (_, offset) => match.start + offset)));
+  for (let index = 0;index < tokens.length; index += 1) {
+    if (!matchedIndexes.has(index) && tokenIsFusedSensitive(tokens[index] ?? "")) {
+      return true;
+    }
+  }
+  if (matches.length === 0) {
+    return false;
+  }
+  if (new Set(matches.map((match) => match.start)).size > 1) {
+    return true;
+  }
+  if (Math.min(...matches.map((match) => match.start)) !== 0) {
+    return true;
+  }
+  return !hasOnlyDiagnosticSuffix(tokens, Math.max(...matches.map((match) => match.end)));
+};
+var encodedKeyIsUrl = (key) => splitEncodedKey(key).some((token) => token === "url" || token === "uri" || token === "href");
+var redactedValueKeys = new Set(["query", "sql", "params", "parameters"]);
+var encodedKeyIsRedacted = (key) => redactedValueKeys.has(splitEncodedKey(key).join(""));
+var scrubUrlLikeString = (value) => value.includes("://") ? scrubUrlCredentials(value) : value;
+var isReflectableObject = (value) => Predicate.isObjectOrArray(value) || typeof value === "function";
+var ownEnumerableDataEntries = (value) => {
+  if (!isReflectableObject(value)) {
+    return [];
+  }
+  return Object.keys(value).flatMap((key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor?.enumerable === true && "value" in descriptor ? [[key, descriptor.value]] : [];
+  });
+};
+var readDataProperty = (value, key) => {
+  if (!isReflectableObject(value)) {
+    return;
+  }
+  let current = value;
+  while (current !== null) {
+    const descriptor = Object.getOwnPropertyDescriptor(current, key);
+    if (descriptor !== undefined) {
+      return "value" in descriptor ? descriptor.value : undefined;
+    }
+    current = Reflect.getPrototypeOf(current);
+  }
+  return;
+};
+var objectTypeName = (value) => {
+  const constructor = readDataProperty(value, "constructor");
+  if (typeof constructor !== "function") {
+    return "Object";
+  }
+  const name = readDataProperty(constructor, "name");
+  return Predicate.isString(name) && name.length > 0 ? name : "Object";
+};
+var boundCauseEntry = (key, value, depth, traversal) => {
+  if (encodedKeyIsRedacted(key)) {
+    return REDACTED_CAUSE;
+  }
+  return encodedKeyIsUrl(key) && Predicate.isString(value) ? scrubUrlCredentials(value) : boundDefectCause(value, depth, traversal);
+};
+var boundDefectCause = (value, depth = 0, traversal) => {
+  try {
+    return boundDefectCauseUnsafe(value, depth, traversal);
+  } catch {
+    return UNAVAILABLE_CAUSE;
+  }
+};
+var boundErrorCause = (value, depth, traversal) => {
+  const ownFields = Object.fromEntries(ownEnumerableDataEntries(value).map(([key, entry]) => [key, boundCauseEntry(key, entry, depth + 1, traversal)]));
+  const name = readDataProperty(value, "name");
+  const message = readDataProperty(value, "message");
+  const cause = readDataProperty(value, "cause");
+  return {
+    ...ownFields,
+    name: Predicate.isString(name) ? scrubUrlLikeString(name) : "Error",
+    message: Predicate.isString(message) ? scrubUrlLikeString(message) : UNAVAILABLE_CAUSE,
+    ...cause === undefined ? {} : { cause: boundDefectCause(cause, depth + 1, traversal) }
+  };
+};
+var boundSchemaErrorCause = (value) => ({
+  name: "SchemaError",
+  message: Predicate.isString(value.message) ? scrubUrlLikeString(value.message) : UNAVAILABLE_CAUSE
+});
+var boundObjectCause = (value, depth, traversal) => {
+  const entries = ownEnumerableDataEntries(value);
+  if (entries.length > 0) {
+    return Object.fromEntries(entries.map(([key, entry]) => [key, boundCauseEntry(key, entry, depth + 1, traversal)]));
+  }
+  const plainObject = Predicate.isObject(value) && Reflect.getPrototypeOf(value) === Object.prototype;
+  return plainObject ? {} : { type: objectTypeName(value) };
+};
+var boundContainerCause = (value, depth, traversal) => {
+  if (Array.isArray(value)) {
+    return value.map((entry) => boundDefectCause(entry, depth + 1, traversal));
+  }
+  if (Predicate.isMap(value)) {
+    return {
+      entries: Array.from(value.entries(), ([key, entry]) => [
+        boundDefectCause(key, depth + 1, traversal),
+        boundDefectCause(entry, depth + 1, traversal)
+      ])
+    };
+  }
+  if (Predicate.isSet(value)) {
+    return { values: Array.from(value, (entry) => boundDefectCause(entry, depth + 1, traversal)) };
+  }
+  if (Schema.isSchemaError(value)) {
+    return boundSchemaErrorCause(value);
+  }
+  if (Predicate.isError(value)) {
+    return boundErrorCause(value, depth, traversal);
+  }
+  return Predicate.isObject(value) ? boundObjectCause(value, depth, traversal) : UNAVAILABLE_CAUSE;
+};
+var boundScalarCause = (value) => {
+  if (Predicate.isString(value)) {
+    return scrubUrlLikeString(value);
+  }
+  if (value === null || Predicate.isBoolean(value) || Predicate.isNumber(value) && Number.isFinite(value)) {
+    return value;
+  }
+  return UNAVAILABLE_CAUSE;
+};
+var boundDefectCauseUnsafe = (value, depth = 0, traversal) => {
+  const currentTraversal = traversal ?? { ancestors: new Set, visited: new Set };
+  if (!Predicate.isObjectOrArray(value)) {
+    return boundScalarCause(value);
+  }
+  if (depth >= SERIALIZABLE_CAUSE_MAX_DEPTH) {
+    return TRUNCATED_CAUSE;
+  }
+  if (currentTraversal.ancestors.has(value)) {
+    return CIRCULAR_CAUSE;
+  }
+  if (currentTraversal.visited.has(value)) {
+    return TRUNCATED_CAUSE;
+  }
+  currentTraversal.ancestors.add(value);
+  currentTraversal.visited.add(value);
+  const bounded = boundContainerCause(value, depth, currentTraversal);
+  currentTraversal.ancestors.delete(value);
+  return bounded;
+};
+var findForbiddenEncodedMapKey = (value) => {
+  if (!Array.isArray(value)) {
+    return;
+  }
+  for (const entry of value) {
+    const mapKey = Array.isArray(entry) ? entry[0] : undefined;
+    if (Predicate.isString(mapKey) && encodedKeyIsForbidden(mapKey)) {
+      return mapKey;
+    }
+  }
+  return;
+};
+var prohibitedFieldMessage = (field) => `Serializable cause contains prohibited field ${field}`;
+var findProhibitedField = (key, value) => {
+  if (encodedKeyIsForbidden(key)) {
+    return key;
+  }
+  return key === "entries" ? findForbiddenEncodedMapKey(value) : undefined;
+};
+var scanCauseObject = (entries, depth, pending) => {
+  for (const [key, entry] of entries) {
+    const prohibited = findProhibitedField(key, entry);
+    if (prohibited !== undefined) {
+      return prohibitedFieldMessage(prohibited);
+    }
+    pending.push({ value: entry, depth: depth + 1 });
+  }
+  return;
+};
+var visitCauseNode = (value, depth, pending, seen) => {
+  if (!Predicate.isObjectOrArray(value)) {
+    return;
+  }
+  if (depth > SERIALIZABLE_CAUSE_MAX_DEPTH) {
+    return `Serializable cause exceeds depth ${SERIALIZABLE_CAUSE_MAX_DEPTH}`;
+  }
+  if (seen.has(value)) {
+    return;
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    pending.push(...value.map((entry) => ({ value: entry, depth: depth + 1 })));
+    return;
+  }
+  return scanCauseObject(Object.entries(value), depth, pending);
+};
+var checkEncodedCauseKeys = (root) => {
+  const pending = [{ value: root, depth: 0 }];
+  const seen = new Set;
+  for (const current of pending) {
+    const violation = visitCauseNode(current.value, current.depth, pending, seen);
+    if (violation !== undefined) {
+      return violation;
+    }
+  }
+  return true;
+};
+var encodeJsonText = Schema.encodeResult(Schema.fromJsonString(Schema.Json));
+var unwritableCauseByteLength = Number.POSITIVE_INFINITY;
+var encodedJsonByteLength = (value) => {
+  const encoded = encodeJsonText(value);
+  return Result.isSuccess(encoded) ? textEncoder.encode(encoded.success).byteLength : unwritableCauseByteLength;
+};
+var truncateOversizedEncodedCause = (value) => encodedJsonByteLength(value) <= SERIALIZABLE_CAUSE_MAX_BYTES ? value : TRUNCATED_CAUSE;
+var scrubEncodedCauseUrlEntry = (key, entry) => {
+  if (encodedKeyIsRedacted(key)) {
+    return REDACTED_CAUSE;
+  }
+  if (encodedKeyIsUrl(key) && Predicate.isString(entry)) {
+    return scrubUrlCredentials(entry);
+  }
+  return isJson(entry) ? scrubEncodedCauseUrls(entry) : null;
+};
+var scrubEncodedCauseUrls = (value) => {
+  if (Predicate.isString(value)) {
+    return scrubUrlLikeString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map(scrubEncodedCauseUrls);
+  }
+  if (Predicate.isObject(value)) {
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, scrubEncodedCauseUrlEntry(key, entry)]));
+  }
+  return value;
+};
+var encodedCauseKeyCheck = SchemaGetter.checkEffect((encoded) => Effect.succeed(checkEncodedCauseKeys(encoded)));
+var encodedCauseSizeCheck = SchemaGetter.checkEffect((encoded) => Effect.succeed(encodedJsonByteLength(encoded) <= SERIALIZABLE_CAUSE_MAX_BYTES ? true : `Serializable cause exceeds ${SERIALIZABLE_CAUSE_MAX_BYTES} encoded bytes`));
+var decodeEncodedCause = SchemaGetter.compose(SchemaGetter.compose(SchemaGetter.transform(scrubEncodedCauseUrls), encodedCauseKeyCheck), encodedCauseSizeCheck);
+var encodeEncodedCause = SchemaGetter.compose(encodedCauseKeyCheck, SchemaGetter.transform(truncateOversizedEncodedCause));
+var decodeCause = (value) => {
+  if (Array.isArray(value)) {
+    return value.map(decodeCause);
+  }
+  if (!Predicate.isObject(value)) {
+    return value;
+  }
+  const fields = Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, isJson(entry) ? decodeCause(entry) : null]));
+  if (typeof fields.message !== "string") {
+    return fields;
+  }
+  const error = new Error(fields.message);
+  for (const [key, entry] of Object.entries(fields)) {
+    Object.defineProperty(error, key, { value: entry, enumerable: true, configurable: true, writable: true });
+  }
+  return error;
+};
+var SerializableCause = Schema.Json.pipe(Schema.decodeTo(Schema.Unknown, {
+  decode: SchemaGetter.transform(decodeCause),
+  encode: SchemaGetter.transform((value) => {
+    const bounded = boundDefectCause(value);
+    return isJson(bounded) ? bounded : UNAVAILABLE_CAUSE;
+  })
+}), Schema.encode({ decode: decodeEncodedCause, encode: encodeEncodedCause }));
+
+// ../kernel/error/src/base-error-fields.ts
+var BaseErrorFields = {
+  message: Schema2.NonEmptyString,
+  cause: Schema2.optional(SerializableCause)
+};
+var messageFromCause = Function.dual(2, (cause, fallback) => {
+  if (!(cause instanceof Error)) {
+    return fallback;
+  }
+  const message = cause.message;
+  if (typeof message === "string" && message.length > 0) {
+    return message;
+  }
+  return cause.name === "" || cause.name === "Error" ? fallback : `${fallback}: ${cause.name}`;
+});
+
+// ../kernel/error/src/invariant-violation-error.ts
+import { Schema as Schema3 } from "effect";
+var InvariantViolationErrorBase = Schema3.TaggedError()("InvariantViolationError", BaseErrorFields);
+
+class InvariantViolationError extends InvariantViolationErrorBase {
+  code = "core.error.INVARIANT_VIOLATION";
+  category = "domain";
+  retryable = false;
+  why = "A value violated an invariant the owning module requires.";
+  fix = "Supply a value that satisfies the documented module contract.";
+}
+var invariantViolation = (message) => InvariantViolationError.make({ message });
+
+// ../kernel/json/src/json-text.ts
+import { Result as Result2, Schema as Schema4 } from "effect";
+var jsonText = Schema4.fromJsonString(Schema4.Unknown);
+var makeJsonTextEncoder = (options) => Schema4.encodeUnknownResult(Schema4.fromJsonString(Schema4.Unknown, options));
+var encodeJsonText2 = Schema4.encodeUnknownResult(jsonText);
+var encodeJsonTextEffect = Schema4.encodeUnknownEffect(jsonText);
+var decodeJsonText = Schema4.decodeUnknownResult(jsonText);
+var decodeJsonTextEffect = Schema4.decodeUnknownEffect(jsonText);
+var bigintAsString = (_key, value) => typeof value === "bigint" ? value.toString() : value;
+var encodeBigintJsonText = makeJsonTextEncoder({ replacer: bigintAsString });
+var encodeBigintJsonTextEffect = Schema4.encodeUnknownEffect(Schema4.fromJsonString(Schema4.Unknown, { replacer: bigintAsString }));
+var dieOnEncode = (encoded) => {
+  if (Result2.isFailure(encoded)) {
+    throw invariantViolation("A value could not be written as JSON text");
+  }
+  return encoded.success;
+};
+var makeJsonTextEncoderOrDie = (options) => {
+  const encode = makeJsonTextEncoder(options);
+  return (value) => dieOnEncode(encode(value));
+};
+var encodeJsonTextOrDie = (value) => dieOnEncode(encodeJsonText2(value));
+var encodePrettyJsonTextOrDie = makeJsonTextEncoderOrDie({ space: 2 });
+
+// ../kernel/json/src/step-up-payload-text.ts
+var PROOF_FIELD = "walletVerification";
+var isAbsent = (value) => value === undefined || typeof value === "function" || typeof value === "symbol";
+var byKey = ([left], [right]) => {
+  if (left < right) {
+    return -1;
+  }
+  if (left > right) {
+    return 1;
+  }
+  return 0;
+};
+var presentEntries = (fields, omitted) => {
+  const entries = [];
+  for (const [key, field] of fields) {
+    if (key !== omitted && !isAbsent(field)) {
+      entries.push([key, field]);
+    }
+  }
+  return entries.toSorted(byKey);
+};
+var canonicalText = (value, omitted = null) => {
+  if (value === null || isAbsent(value)) {
+    return "null";
+  }
+  if (typeof value !== "object") {
+    return encodeJsonTextOrDie(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalText(item)).join(",")}]`;
+  }
+  return `{${presentEntries(Object.entries(value), omitted).map(([key, field]) => `${encodeJsonTextOrDie(key)}:${canonicalText(field)}`).join(",")}}`;
+};
+var stepUpPayloadText = (body) => canonicalText(body, PROOF_FIELD);
+
+// src/client/step-up-challenge.ts
+import { sha256, stringToBytes } from "viem/utils";
+var STEP_UP_CHALLENGE_HEADER = "X-Step-Up-Challenge";
+var WALLET_VERIFICATION_HEADER = "X-Wallet-Verification";
+var STEP_UP_CHALLENGE_PATH = "/api/v2/step-up-challenges";
+var PROOF_FIELD2 = "walletVerification";
+var HEX_PREFIX = "0x";
+function carriesWalletProof(body) {
+  if (body === null || typeof body !== "object" || Array.isArray(body)) {
+    return false;
+  }
+  const proof = Reflect.get(body, PROOF_FIELD2);
+  return proof !== null && proof !== undefined;
+}
+async function stepUpChallengeRequest(operation, target, body) {
+  const payloadDigest = sha256(stringToBytes(stepUpPayloadText(body))).slice(HEX_PREFIX.length);
+  return { operation, target, payloadDigest };
+}
+
+export { DALP_AUTH_SURFACE_HEADER2, SECRET_REDACTION_MARKER2, Secret2, secret2, unwrapSecret, detectDalpRuntime, runtimeCredentials, refuseCrossOriginBrowserSession, isBufferingFetch, keepBufferingMarker, globalFetch, refuseBundledApiKey, encodeJsonTextOrDie, STEP_UP_CHALLENGE_HEADER, WALLET_VERIFICATION_HEADER, STEP_UP_CHALLENGE_PATH, carriesWalletProof, stepUpChallengeRequest };