@stripe/link-sdk 0.4.2 → 0.6.0

package/dist/index.js

@@ -1,4 +1,5 @@
-// src/resources/balances.ts
+// src/resources/attestations.ts
+import { createHash as createHash2 } from "crypto";
 import { z } from "zod";
 
 // src/errors.ts
@@ -44,6 +45,364 @@ var LinkApiError = class extends LinkSdkError {
   }
 };
 
+// src/resources/attestations-crypto.ts
+import {
+  createHash,
+  createPublicKey,
+  randomBytes,
+  timingSafeEqual
+} from "crypto";
+var TOKEN_TYPE = 2;
+var NONCE_SIZE = 32;
+var CHALLENGE_DIGEST_SIZE = 32;
+var TOKEN_KEY_ID_SIZE = 32;
+function base64urlEncode(buf) {
+  return Buffer.from(buf).toString("base64url");
+}
+function base64urlDecode(str) {
+  return new Uint8Array(Buffer.from(str, "base64url"));
+}
+function bytesToBigInt(bytes) {
+  let hex = "";
+  for (const b of bytes) {
+    hex += b.toString(16).padStart(2, "0");
+  }
+  return hex.length === 0 ? 0n : BigInt(`0x${hex}`);
+}
+function bigIntToBytes(n, length) {
+  if (!Number.isInteger(length) || length < 0) {
+    throw new Error("Integer encoding length must be a non-negative integer");
+  }
+  if (n < 0n || n >= 1n << BigInt(length * 8)) {
+    throw new Error(`Integer does not fit in ${length} bytes`);
+  }
+  const hex = n.toString(16).padStart(length * 2, "0");
+  const bytes = new Uint8Array(length);
+  for (let i = 0; i < length; i++) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function bitLength(value) {
+  if (value <= 0n) throw new Error("Bit length requires a positive integer");
+  return value.toString(2).length;
+}
+function modPow(base, exp, mod) {
+  let result = 1n;
+  let b = (base % mod + mod) % mod;
+  let e = exp;
+  while (e > 0n) {
+    if (e & 1n) {
+      result = result * b % mod;
+    }
+    e >>= 1n;
+    b = b * b % mod;
+  }
+  return result;
+}
+function modInverse(a, m) {
+  let [oldR, r] = [a, m];
+  let [oldS, s] = [1n, 0n];
+  while (r !== 0n) {
+    const q = oldR / r;
+    [oldR, r] = [r, oldR - q * r];
+    [oldS, s] = [s, oldS - q * s];
+  }
+  if (oldR !== 1n) {
+    throw new Error("Value has no modular inverse");
+  }
+  return (oldS % m + m) % m;
+}
+function greatestCommonDivisor(a, b) {
+  let x = a < 0n ? -a : a;
+  let y = b < 0n ? -b : b;
+  while (y !== 0n) {
+    [x, y] = [y, x % y];
+  }
+  return x;
+}
+function parseSpkiPublicKey(spkiDer) {
+  let keyObject;
+  try {
+    keyObject = createPublicKey({
+      key: Buffer.from(spkiDer),
+      format: "der",
+      type: "spki"
+    });
+  } catch (error) {
+    throw new Error("Invalid RSA issuer public key", { cause: error });
+  }
+  const details = keyObject.asymmetricKeyDetails;
+  if (keyObject.asymmetricKeyType !== "rsa-pss" || details?.modulusLength !== 2048 || details.hashAlgorithm !== "sha384" || details.mgf1HashAlgorithm !== "sha384" || details.saltLength !== 48) {
+    throw new Error(
+      "Issuer key must use 2048-bit RSA-PSS with SHA-384, MGF1-SHA-384, and a 48-byte salt"
+    );
+  }
+  const spki = readSequence(spkiDer, 0);
+  const algorithm = readTlv(spkiDer, spki.contentStart);
+  const bitString = readTlv(spkiDer, algorithm.end);
+  if (bitString.tag !== 3) {
+    throw new Error(
+      `Expected BIT STRING in SPKI, got 0x${bitString.tag.toString(16)}`
+    );
+  }
+  if (bitString.contentStart >= bitString.end || spkiDer[bitString.contentStart] !== 0) {
+    throw new Error("RSA SPKI BIT STRING must have zero unused bits");
+  }
+  const rsaPublicKeyDer = spkiDer.slice(
+    bitString.contentStart + 1,
+    bitString.end
+  );
+  const rsaPublicKey = readSequence(rsaPublicKeyDer, 0);
+  const modulus = readInteger(rsaPublicKeyDer, rsaPublicKey.contentStart);
+  const exponent = readInteger(rsaPublicKeyDer, modulus.end);
+  const n = bytesToBigInt(modulus.value);
+  const e = bytesToBigInt(exponent.value);
+  if (modulus.value.length !== 256 || bitLength(n) !== 2048) {
+    throw new Error("Token type 0x0002 requires a 2048-bit RSA modulus");
+  }
+  if (e < 3n || e % 2n === 0n) {
+    throw new Error("RSA public exponent must be an odd integer of at least 3");
+  }
+  return {
+    n,
+    e,
+    nLen: modulus.value.length
+  };
+}
+function readTlv(data, offset) {
+  if (offset >= data.length) {
+    throw new Error(`Unexpected end of DER at offset ${offset}`);
+  }
+  const tag = data[offset];
+  if (tag === void 0) {
+    throw new Error(`Unexpected end of DER at offset ${offset}`);
+  }
+  const { value: length, bytesRead } = parseDerLength(data, offset + 1);
+  const contentStart = offset + 1 + bytesRead;
+  const end = contentStart + length;
+  if (end > data.length) {
+    throw new Error(`DER element at offset ${offset} overruns the buffer`);
+  }
+  return { tag, contentStart, end };
+}
+function readSequence(data, offset) {
+  const tlv = readTlv(data, offset);
+  if (tlv.tag !== 48) {
+    throw new Error(
+      `Expected SEQUENCE at offset ${offset}, got 0x${tlv.tag.toString(16)}`
+    );
+  }
+  return tlv;
+}
+function readInteger(data, offset) {
+  const tlv = readTlv(data, offset);
+  if (tlv.tag !== 2) {
+    throw new Error(
+      `Expected INTEGER at offset ${offset}, got 0x${tlv.tag.toString(16)}`
+    );
+  }
+  let value = data.slice(tlv.contentStart, tlv.end);
+  if (value.length > 1 && value[0] === 0) {
+    value = value.slice(1);
+  }
+  return { value, end: tlv.end };
+}
+function parseDerLength(data, offset) {
+  const first = data[offset];
+  if (first === void 0) {
+    throw new Error(`Unexpected end of DER at offset ${offset}`);
+  }
+  if (first < 128) {
+    return { value: first, bytesRead: 1 };
+  }
+  const numBytes = first & 127;
+  if (numBytes === 0 || offset + numBytes >= data.length) {
+    throw new Error(`Invalid DER length at offset ${offset}`);
+  }
+  let value = 0;
+  for (let i = 0; i < numBytes; i++) {
+    const byte = data[offset + 1 + i];
+    if (byte === void 0) {
+      throw new Error(`Unexpected end of DER at offset ${offset + 1 + i}`);
+    }
+    value = value * 256 + byte;
+  }
+  return { value, bytesRead: 1 + numBytes };
+}
+function emsaPssEncode(message, emBits) {
+  const hashAlg = "sha384";
+  const hLen = 48;
+  const sLen = 48;
+  const emLen = Math.ceil(emBits / 8);
+  const mHash = createHash(hashAlg).update(message).digest();
+  if (emLen < hLen + sLen + 2) {
+    throw new Error("Encoding error: emLen too small");
+  }
+  const salt = randomBytes(sLen);
+  const mPrime = Buffer.concat([Buffer.alloc(8), mHash, salt]);
+  const h = createHash(hashAlg).update(mPrime).digest();
+  const ps = Buffer.alloc(emLen - sLen - hLen - 2);
+  const db = Buffer.concat([ps, Buffer.from([1]), salt]);
+  const dbMask = mgf1(h, db.length, hashAlg);
+  const maskedDb = Buffer.alloc(db.length);
+  for (let i = 0; i < db.length; i++) {
+    maskedDb.writeUInt8(db.readUInt8(i) ^ dbMask.readUInt8(i), i);
+  }
+  const topBits = 8 * emLen - emBits;
+  maskedDb.writeUInt8(maskedDb.readUInt8(0) & 255 >> topBits, 0);
+  return new Uint8Array(Buffer.concat([maskedDb, h, Buffer.from([188])]));
+}
+function mgf1(seed, length, hashAlg) {
+  const hLen = hashAlg === "sha384" ? 48 : 32;
+  const result = Buffer.alloc(length);
+  let offset = 0;
+  let counter = 0;
+  while (offset < length) {
+    const c = Buffer.alloc(4);
+    c.writeUInt32BE(counter);
+    const hash = createHash(hashAlg).update(seed).update(c).digest();
+    const toCopy = Math.min(hLen, length - offset);
+    hash.copy(result, offset, 0, toCopy);
+    offset += toCopy;
+    counter++;
+  }
+  return result;
+}
+function generateBlindingFactor(n, nLen) {
+  while (true) {
+    const rBytes = randomBytes(nLen);
+    const r = bytesToBigInt(new Uint8Array(rBytes));
+    if (r < 1n || r >= n) continue;
+    try {
+      const rInv = modInverse(r, n);
+      return { r, rInv };
+    } catch {
+    }
+  }
+}
+function generateBlindedMessages(spkiDer, count, challengeDigest) {
+  if (!Number.isInteger(count) || count < 1 || count > 100) {
+    throw new Error("Token count must be an integer from 1 to 100");
+  }
+  if (challengeDigest.length !== CHALLENGE_DIGEST_SIZE) {
+    throw new Error("Challenge digest must be exactly 32 bytes");
+  }
+  const publicKey = parseSpkiPublicKey(spkiDer);
+  const tokenKeyId = new Uint8Array(
+    createHash("sha256").update(spkiDer).digest()
+  );
+  const emBits = bitLength(publicKey.n) - 1;
+  const tokens = [];
+  for (let i = 0; i < count; i++) {
+    const nonce = new Uint8Array(randomBytes(NONCE_SIZE));
+    const tokenInput = new Uint8Array(
+      2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE + TOKEN_KEY_ID_SIZE
+    );
+    tokenInput[0] = TOKEN_TYPE >> 8 & 255;
+    tokenInput[1] = TOKEN_TYPE & 255;
+    tokenInput.set(nonce, 2);
+    tokenInput.set(challengeDigest, 2 + NONCE_SIZE);
+    tokenInput.set(tokenKeyId, 2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE);
+    const encoded = emsaPssEncode(tokenInput, emBits);
+    const message = bytesToBigInt(encoded);
+    if (greatestCommonDivisor(message, publicKey.n) !== 1n) {
+      throw new Error(
+        "PSS-encoded token input is not coprime to the RSA modulus"
+      );
+    }
+    const { r, rInv } = generateBlindingFactor(publicKey.n, publicKey.nLen);
+    const blindedMessage = message * modPow(r, publicKey.e, publicKey.n) % publicKey.n;
+    tokens.push({
+      nonce,
+      blindedMsg: bigIntToBytes(blindedMessage, publicKey.nLen),
+      blindInverse: rInv,
+      encodedMessage: encoded
+    });
+  }
+  return { tokens, publicKey, challengeDigest, tokenKeyId };
+}
+function unblindSignatures(state, blindSigs) {
+  const { tokens, publicKey, tokenKeyId } = state;
+  if (blindSigs.length !== tokens.length) {
+    throw new Error(
+      `Expected ${tokens.length} blind signatures, got ${blindSigs.length}`
+    );
+  }
+  const results = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    const blindSignature = blindSigs[i];
+    if (!token || blindSignature === void 0) {
+      throw new Error(`Missing blind signature state at index ${i}`);
+    }
+    const blindSigBytes = base64urlDecode(blindSignature);
+    if (blindSigBytes.length !== publicKey.nLen) {
+      throw new Error(
+        `Blind signature ${i} must be exactly ${publicKey.nLen} bytes`
+      );
+    }
+    const blindSigInt = bytesToBigInt(blindSigBytes);
+    const sigInt = blindSigInt * token.blindInverse % publicKey.n;
+    const authenticator = bigIntToBytes(sigInt, publicKey.nLen);
+    const recoveredMessage = bigIntToBytes(
+      modPow(sigInt, publicKey.e, publicKey.n),
+      publicKey.nLen
+    );
+    if (!timingSafeEqual(
+      Buffer.from(recoveredMessage),
+      Buffer.from(token.encodedMessage)
+    )) {
+      throw new Error(`Blind signature ${i} failed verification`);
+    }
+    const raw = new Uint8Array(
+      2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE + TOKEN_KEY_ID_SIZE + publicKey.nLen
+    );
+    raw[0] = TOKEN_TYPE >> 8 & 255;
+    raw[1] = TOKEN_TYPE & 255;
+    raw.set(token.nonce, 2);
+    raw.set(state.challengeDigest, 2 + NONCE_SIZE);
+    raw.set(tokenKeyId, 2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE);
+    raw.set(
+      authenticator,
+      2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE + TOKEN_KEY_ID_SIZE
+    );
+    results.push({
+      raw,
+      base64url: base64urlEncode(raw)
+    });
+  }
+  return results;
+}
+function computeChallengeDigest(tokenType, issuerName) {
+  const issuerBytes = Buffer.from(issuerName, "utf-8");
+  const originBytes = Buffer.alloc(0);
+  if (!Number.isInteger(tokenType) || tokenType < 0 || tokenType > 65535) {
+    throw new Error("Token type must fit in an unsigned 16-bit integer");
+  }
+  if (issuerBytes.length > 65535) {
+    throw new Error("Issuer name must fit in an unsigned 16-bit length");
+  }
+  const challenge = Buffer.alloc(
+    2 + 2 + issuerBytes.length + 1 + 2 + originBytes.length
+  );
+  let offset = 0;
+  challenge.writeUInt16BE(tokenType, offset);
+  offset += 2;
+  challenge.writeUInt16BE(issuerBytes.length, offset);
+  offset += 2;
+  issuerBytes.copy(challenge, offset);
+  offset += issuerBytes.length;
+  challenge.writeUInt8(0, offset);
+  offset += 1;
+  challenge.writeUInt16BE(originBytes.length, offset);
+  offset += 2;
+  if (originBytes.length > 0) {
+    originBytes.copy(challenge, offset);
+  }
+  return new Uint8Array(createHash("sha256").update(challenge).digest());
+}
+
 // src/config.ts
 var DEFAULT_API_BASE_URL = "https://api.link.com";
 function createDefaultHeadersFetch(baseFetch, defaultHeaders) {
@@ -217,20 +576,350 @@ var BaseResource = class {
   }
 };
 
+// src/resources/attestations.ts
+var TOKEN_TYPE_BLIND_RSA = 2;
+var CONTENT_TYPE_TOKEN_REQUEST = "application/private-token-generic-batch-request";
+var CONTENT_TYPE_TOKEN_RESPONSE = "application/private-token-generic-batch-response";
+var LINK_ISSUER = "https://api.link.com";
+var LINK_ISSUER_HOSTNAME = "api.link.com";
+var LINK_ISSUER_METADATA_URL = `${LINK_ISSUER}/.well-known/aap-issuer`;
+var issuerMetadataSchema = z.looseObject({
+  issuer: z.literal(LINK_ISSUER),
+  token_issuance_endpoint: z.string(),
+  token_keys: z.string()
+});
+var tokenKeyDirectorySchema = z.looseObject({
+  "token-keys": z.array(
+    z.looseObject({
+      "token-type": z.number(),
+      "token-key": z.string(),
+      "not-before": z.number().int().nonnegative().optional()
+    })
+  )
+});
+function base64ToBytes(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  return new Uint8Array(Buffer.from(normalized, "base64"));
+}
+function minQuicVarintLength(value) {
+  if (value < 2 ** 6) return 1;
+  if (value < 2 ** 14) return 2;
+  if (value < 2 ** 30) return 4;
+  return 8;
+}
+function encodeQuicVarint(value) {
+  if (!Number.isSafeInteger(value) || value < 0 || value >= 2 ** 62) {
+    throw new Error(`Cannot encode ${value} as a QUIC variable-length integer`);
+  }
+  const length = minQuicVarintLength(value);
+  const encoded = Buffer.alloc(length);
+  let remaining = BigInt(value);
+  for (let index = length - 1; index >= 0; index--) {
+    encoded[index] = Number(remaining & 0xffn);
+    remaining >>= 8n;
+  }
+  encoded[0] = encoded.readUInt8(0) | Math.log2(length) << 6;
+  return encoded;
+}
+function readQuicVarint(body, offset = 0) {
+  const first = body[offset];
+  if (first === void 0) throw new Error("QUIC varint is absent");
+  const length = 1 << (first >> 6);
+  if (body.length < offset + length)
+    throw new Error("QUIC varint is truncated");
+  let value = BigInt(first & 63);
+  for (let index = 1; index < length; index++) {
+    value = value << 8n | BigInt(body.readUInt8(offset + index));
+  }
+  if (value > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error("QUIC varint exceeds the JavaScript safe integer range");
+  }
+  const numeric = Number(value);
+  if (minQuicVarintLength(numeric) !== length) {
+    throw new Error("QUIC varint is not minimally encoded");
+  }
+  return { value: numeric, length };
+}
+function encodeBatchTokenRequest(blindedMessages, truncatedTokenKeyId) {
+  const entries = blindedMessages.map((blindedMessage) => {
+    const entry = Buffer.alloc(3 + blindedMessage.length);
+    entry.writeUInt16BE(TOKEN_TYPE_BLIND_RSA, 0);
+    entry.writeUInt8(truncatedTokenKeyId, 2);
+    Buffer.from(blindedMessage).copy(entry, 3);
+    return entry;
+  });
+  const vector = Buffer.concat(entries);
+  return Buffer.concat([encodeQuicVarint(vector.length), vector]);
+}
+function decodeBatchTokenResponse(body, elementSize, expectedCount) {
+  const prefix = readQuicVarint(body);
+  const vector = body.subarray(prefix.length);
+  if (vector.length !== prefix.value) {
+    throw new Error(
+      `BatchTokenResponse length prefix says ${prefix.value} bytes but ${vector.length} bytes follow`
+    );
+  }
+  if (vector.length === 0)
+    throw new Error("BatchTokenResponse vector is empty");
+  const signatures = [];
+  let offset = 0;
+  while (offset < vector.length) {
+    const present = vector[offset++];
+    if (present === 0) {
+      throw new Error(
+        `Issuer refused token request at index ${signatures.length}`
+      );
+    }
+    if (present !== 1) {
+      throw new Error(`Invalid OptionalTokenResponse presence byte ${present}`);
+    }
+    if (offset + 2 + elementSize > vector.length) {
+      throw new Error("Present GenericTokenResponse is truncated");
+    }
+    const tokenType = vector.readUInt16BE(offset);
+    offset += 2;
+    if (tokenType !== TOKEN_TYPE_BLIND_RSA) {
+      throw new Error(
+        `GenericTokenResponse has unsupported token type 0x${tokenType.toString(16).padStart(4, "0")}`
+      );
+    }
+    signatures.push(
+      base64urlEncode(
+        new Uint8Array(vector.subarray(offset, offset + elementSize))
+      )
+    );
+    offset += elementSize;
+  }
+  if (signatures.length !== expectedCount) {
+    throw new Error(
+      `Issuer returned ${signatures.length} token responses for ${expectedCount} token requests`
+    );
+  }
+  return signatures;
+}
+function requireLinkEndpoint(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (error) {
+    throw new TypeError(`${field} is not a valid URL`, { cause: error });
+  }
+  if (url.protocol !== "https:" || url.origin !== LINK_ISSUER || url.username || url.password) {
+    throw new TypeError(`${field} must be an HTTPS URL on ${LINK_ISSUER}`);
+  }
+  return url.href;
+}
+var AttestationsResource = class extends BaseResource {
+  /** Creates an attestation resource using the SDK's authentication config. */
+  constructor(options) {
+    super(options, "");
+  }
+  /** Fetches JSON without following redirects and normalizes API errors. */
+  async fetchJson(url, operation) {
+    let response;
+    try {
+      response = await this.fetchImpl(url, { redirect: "manual" });
+    } catch (error) {
+      throw new LinkTransportError(`Request failed: GET ${url}`, {
+        cause: error
+      });
+    }
+    const rawBody = await response.text();
+    if (response.status >= 300 && response.status < 400) {
+      throw new LinkApiError(
+        `Refused redirect while attempting to ${operation} (${response.status})`,
+        {
+          status: response.status,
+          rawBody
+        }
+      );
+    }
+    let data = null;
+    try {
+      data = JSON.parse(rawBody);
+    } catch (error) {
+      if (response.ok) {
+        throw new LinkResponseError(operation, response.status, {
+          cause: error
+        });
+      }
+    }
+    if (!response.ok) {
+      throw new LinkApiError(
+        `Failed to ${operation} (${response.status}): ${rawBody}`,
+        {
+          status: response.status,
+          rawBody,
+          details: data
+        }
+      );
+    }
+    return { data, status: response.status };
+  }
+  /** Sends a blinded batch with the current or refreshed access token. */
+  async issueTokens(url, body, forceRefresh = false) {
+    const token = await this.getAccessToken(
+      forceRefresh ? { forceRefresh: true } : void 0
+    );
+    const requestBody = new ArrayBuffer(body.byteLength);
+    new Uint8Array(requestBody).set(body);
+    try {
+      return await this.fetchImpl(url, {
+        method: "POST",
+        redirect: "manual",
+        headers: {
+          "Content-Type": CONTENT_TYPE_TOKEN_REQUEST,
+          Accept: CONTENT_TYPE_TOKEN_RESPONSE,
+          Authorization: `Bearer ${token}`
+        },
+        body: requestBody
+      });
+    } catch (error) {
+      throw new LinkTransportError(`Request failed: POST ${url}`, {
+        cause: error
+      });
+    }
+  }
+  /** Requests, verifies, and returns a batch of Link attestation tokens. */
+  async request(params) {
+    const { count } = params;
+    if (!Number.isInteger(count) || count < 1 || count > 100) {
+      throw new LinkConfigurationError(
+        "Attestation token count must be an integer from 1 to 100"
+      );
+    }
+    const metadataResponse = await this.fetchJson(
+      LINK_ISSUER_METADATA_URL,
+      "fetch issuer metadata"
+    );
+    const metadata = this.parseResponse(
+      "parse issuer metadata",
+      metadataResponse.status,
+      () => issuerMetadataSchema.parse(metadataResponse.data)
+    );
+    let tokenKeysUrl;
+    let issuanceUrl;
+    try {
+      tokenKeysUrl = requireLinkEndpoint(metadata.token_keys, "token_keys");
+      issuanceUrl = requireLinkEndpoint(
+        metadata.token_issuance_endpoint,
+        "token_issuance_endpoint"
+      );
+    } catch (error) {
+      throw new LinkResponseError(
+        "validate issuer metadata",
+        metadataResponse.status,
+        { cause: error }
+      );
+    }
+    const directoryResponse = await this.fetchJson(
+      tokenKeysUrl,
+      "fetch token keys"
+    );
+    const directory = this.parseResponse(
+      "parse token key directory",
+      directoryResponse.status,
+      () => tokenKeyDirectorySchema.parse(directoryResponse.data)
+    );
+    const now = Math.floor(Date.now() / 1e3);
+    const tokenKey = directory["token-keys"].find(
+      (entry) => entry["token-type"] === TOKEN_TYPE_BLIND_RSA && (entry["not-before"] === void 0 || entry["not-before"] <= now)
+    );
+    if (!tokenKey) {
+      throw new LinkResponseError(
+        "select Blind RSA token key",
+        directoryResponse.status,
+        {
+          cause: new Error(
+            "No active token key with type 0x0002 found in directory"
+          )
+        }
+      );
+    }
+    const spkiDer = base64ToBytes(tokenKey["token-key"]);
+    const challengeDigest = computeChallengeDigest(
+      TOKEN_TYPE_BLIND_RSA,
+      LINK_ISSUER_HOSTNAME
+    );
+    const blindingState = generateBlindedMessages(
+      spkiDer,
+      count,
+      challengeDigest
+    );
+    const tokenKeyIdBytes = new Uint8Array(
+      createHash2("sha256").update(spkiDer).digest()
+    );
+    const truncatedTokenKeyId = tokenKeyIdBytes.at(-1);
+    if (truncatedTokenKeyId === void 0) {
+      throw new LinkResponseError("derive Blind RSA token key ID", 200);
+    }
+    const requestBody = encodeBatchTokenRequest(
+      blindingState.tokens.map((token) => token.blindedMsg),
+      truncatedTokenKeyId
+    );
+    let issueResponse = await this.issueTokens(
+      issuanceUrl,
+      new Uint8Array(requestBody)
+    );
+    if (issueResponse.status === 401 && this.canRefreshAccessToken) {
+      issueResponse = await this.issueTokens(
+        issuanceUrl,
+        new Uint8Array(requestBody),
+        true
+      );
+    }
+    if (!issueResponse.ok) {
+      const rawBody = await issueResponse.text();
+      throw new LinkApiError(
+        `Failed to issue attestation tokens (${issueResponse.status}): ${rawBody}`,
+        {
+          status: issueResponse.status,
+          rawBody
+        }
+      );
+    }
+    let blindSignatures;
+    try {
+      blindSignatures = decodeBatchTokenResponse(
+        Buffer.from(await issueResponse.arrayBuffer()),
+        blindingState.publicKey.nLen,
+        count
+      );
+    } catch (error) {
+      throw new LinkResponseError(
+        "decode attestation token response",
+        issueResponse.status,
+        { cause: error }
+      );
+    }
+    const finalTokens = unblindSignatures(
+      blindingState,
+      blindSignatures
+    );
+    return {
+      tokens: finalTokens.map((finalToken) => finalToken.base64url),
+      issuer: LINK_ISSUER,
+      token_key_id: base64urlEncode(blindingState.tokenKeyId),
+      count: finalTokens.length
+    };
+  }
+};
+
 // src/resources/balances.ts
-var currencyAmountsSchema = z.record(z.string(), z.number());
-var balanceSchema = z.looseObject({
-  source_id: z.string(),
-  type: z.enum(["cash", "credit"]),
-  cash: z.looseObject({ available: currencyAmountsSchema }).nullable().optional(),
-  credit: z.looseObject({ used: currencyAmountsSchema }).nullable().optional(),
-  current: z.number(),
-  currency: z.string(),
-  as_of: z.string()
+import { z as z2 } from "zod";
+var currencyAmountsSchema = z2.record(z2.string(), z2.number());
+var balanceSchema = z2.looseObject({
+  source_id: z2.string(),
+  type: z2.enum(["cash", "credit"]),
+  cash: z2.looseObject({ available: currencyAmountsSchema }).nullable().optional(),
+  credit: z2.looseObject({ used: currencyAmountsSchema.nullable() }).nullable().optional(),
+  current: z2.number(),
+  currency: z2.string(),
+  as_of: z2.string()
 });
-var balancesPageSchema = z.looseObject({
-  data: z.array(balanceSchema),
-  has_more: z.boolean().optional()
+var balancesPageSchema = z2.looseObject({
+  data: z2.array(balanceSchema),
+  has_more: z2.boolean().optional()
 });
 var BalancesResource = class extends BaseResource {
   constructor(options) {
@@ -271,16 +960,16 @@ var BalancesResource = class extends BaseResource {
 };
 
 // src/resources/payment-methods.ts
-import { z as z2 } from "zod";
-var paymentMethodSchema = z2.looseObject({
-  id: z2.string(),
-  type: z2.string(),
-  is_default: z2.boolean(),
-  name: z2.string(),
-  nickname: z2.optional(z2.string().nullable())
+import { z as z3 } from "zod";
+var paymentMethodSchema = z3.looseObject({
+  id: z3.string(),
+  type: z3.string(),
+  is_default: z3.boolean(),
+  name: z3.string(),
+  nickname: z3.optional(z3.string().nullable())
 });
-var paymentMethodsResponseSchema = z2.looseObject({
-  payment_details: z2.array(paymentMethodSchema)
+var paymentMethodsResponseSchema = z3.looseObject({
+  payment_details: z3.array(paymentMethodSchema)
 });
 var PaymentMethodsResource = class extends BaseResource {
   constructor(options) {
@@ -303,14 +992,14 @@ var PaymentMethodsResource = class extends BaseResource {
 };
 
 // src/resources/report.ts
-import { z as z3 } from "zod";
-var reportRecordSchema = z3.looseObject({
-  object: z3.string(),
-  created_at: z3.string(),
-  domain: z3.string(),
-  outcome: z3.string(),
-  spend_request_id: z3.string(),
-  status: z3.string()
+import { z as z4 } from "zod";
+var reportRecordSchema = z4.looseObject({
+  object: z4.string(),
+  created_at: z4.string(),
+  domain: z4.string(),
+  outcome: z4.string(),
+  spend_request_id: z4.string(),
+  status: z4.string()
 });
 var ReportResource = class extends BaseResource {
   constructor(options) {
@@ -335,15 +1024,15 @@ var ReportResource = class extends BaseResource {
 };
 
 // src/resources/shipping-address.ts
-import { z as z4 } from "zod";
-var shippingAddressSchema = z4.looseObject({
-  id: z4.string(),
-  is_default: z4.boolean(),
-  nickname: z4.optional(z4.string().nullable()),
-  address: z4.looseObject({}).nullable()
+import { z as z5 } from "zod";
+var shippingAddressSchema = z5.looseObject({
+  id: z5.string(),
+  is_default: z5.boolean(),
+  nickname: z5.optional(z5.string().nullable()),
+  address: z5.looseObject({}).nullable()
 });
-var shippingAddressesResponseSchema = z4.looseObject({
-  shipping_addresses: z4.array(shippingAddressSchema)
+var shippingAddressesResponseSchema = z5.looseObject({
+  shipping_addresses: z5.array(shippingAddressSchema)
 });
 var ShippingAddressResource = class extends BaseResource {
   constructor(options) {
@@ -366,21 +1055,21 @@ var ShippingAddressResource = class extends BaseResource {
 };
 
 // src/resources/sources.ts
-import { z as z5 } from "zod";
-var nullableRecordSchema = z5.record(z5.string(), z5.unknown()).nullable().optional();
-var sourceSchema = z5.looseObject({
-  id: z5.string().nullable().optional(),
-  name: z5.string().nullable().optional(),
-  type: z5.string().nullable().optional(),
+import { z as z6 } from "zod";
+var nullableRecordSchema = z6.record(z6.string(), z6.unknown()).nullable().optional();
+var sourceSchema = z6.looseObject({
+  id: z6.string().nullable().optional(),
+  name: z6.string().nullable().optional(),
+  type: z6.string().nullable().optional(),
   capabilities: nullableRecordSchema,
   external_connection: nullableRecordSchema,
-  granted_actions: z5.array(z5.string()).nullable().optional(),
+  granted_actions: z6.array(z6.string()).nullable().optional(),
   bank_account: nullableRecordSchema,
   card: nullableRecordSchema
 });
-var sourcesPageSchema = z5.looseObject({
-  data: z5.array(sourceSchema),
-  has_more: z5.boolean().optional()
+var sourcesPageSchema = z6.looseObject({
+  data: z6.array(sourceSchema),
+  has_more: z6.boolean().optional()
 });
 var SourcesResource = class extends BaseResource {
   constructor(options) {
@@ -416,34 +1105,34 @@ var SourcesResource = class extends BaseResource {
 };
 
 // src/resources/spend-request.ts
-import { z as z6 } from "zod";
-var sharedPaymentTokenSchema = z6.union([
-  z6.string().transform((id) => ({ id })),
-  z6.looseObject({ id: z6.string() })
+import { z as z7 } from "zod";
+var sharedPaymentTokenSchema = z7.union([
+  z7.string().transform((id) => ({ id })),
+  z7.looseObject({ id: z7.string() })
 ]);
-var spendRequestSchema = z6.looseObject({
-  id: z6.string(),
-  payment_details: z6.string().optional(),
-  status: z6.string(),
-  line_items: z6.array(z6.unknown()).optional(),
-  totals: z6.array(z6.unknown()).optional(),
-  created_at: z6.string(),
-  updated_at: z6.string(),
+var spendRequestSchema = z7.looseObject({
+  id: z7.string(),
+  payment_details: z7.string().optional(),
+  status: z7.string(),
+  line_items: z7.array(z7.unknown()).optional(),
+  totals: z7.array(z7.unknown()).optional(),
+  created_at: z7.string(),
+  updated_at: z7.string(),
   shared_payment_token: sharedPaymentTokenSchema.nullable().optional()
 });
-var spendRequestsResponseSchema = z6.looseObject({
-  data: z6.array(spendRequestSchema)
+var spendRequestsResponseSchema = z7.looseObject({
+  data: z7.array(spendRequestSchema)
 });
-var requestApprovalResponseSchema = z6.looseObject({
-  id: z6.string(),
-  approval_link: z6.string()
+var requestApprovalResponseSchema = z7.looseObject({
+  id: z7.string(),
+  approval_link: z7.string()
 }).transform(({ approval_link, ...response }) => ({
   ...response,
   approval_url: approval_link
 }));
-var duplicateSpendRequestErrorSchema = z6.looseObject({
-  error: z6.looseObject({
-    duplicate_spend_request: z6.unknown().optional()
+var duplicateSpendRequestErrorSchema = z7.looseObject({
+  error: z7.looseObject({
+    duplicate_spend_request: z7.unknown().optional()
   })
 });
 function parseSpendRequest(value) {
@@ -562,24 +1251,83 @@ var SpendRequestResource = class extends BaseResource {
   }
 };
 
+// src/resources/summaries.ts
+import { z as z8 } from "zod";
+var summaryValueSchema = z8.discriminatedUnion("unit", [
+  z8.looseObject({ unit: z8.literal("count"), count: z8.number() }),
+  z8.looseObject({
+    unit: z8.literal("payment_volume"),
+    amount: z8.number(),
+    currency: z8.string()
+  })
+]);
+var summaryDataValueSchema = z8.discriminatedUnion("unit", [
+  z8.looseObject({ unit: z8.literal("count"), amount: z8.number() }),
+  z8.looseObject({
+    unit: z8.literal("payment_volume"),
+    amount: z8.number(),
+    currency: z8.string()
+  })
+]);
+var summarySchema = z8.looseObject({
+  id: z8.string(),
+  description: z8.string(),
+  created_at: z8.string().nullable().optional(),
+  status: z8.enum(["ready", "pending", "no_data"]),
+  entries: z8.array(z8.looseObject({ label: z8.string(), value: summaryValueSchema })).default([]),
+  as_of: z8.number().optional(),
+  data: z8.array(z8.looseObject({ label: z8.string(), value: summaryDataValueSchema })).nullable().optional()
+});
+var summariesPageSchema = z8.looseObject({
+  data: z8.array(summarySchema),
+  has_more: z8.boolean().optional()
+});
+var SummariesResource = class extends BaseResource {
+  constructor(options) {
+    super(options, "/summaries");
+  }
+  buildUrl(params) {
+    const url = new URL(this.endpoint);
+    if (params.starting_after !== void 0)
+      url.searchParams.set("starting_after", params.starting_after);
+    if (params.summaries !== void 0)
+      for (const summary of params.summaries)
+        url.searchParams.append("summaries[]", summary);
+    return url.toString();
+  }
+  async list(params = {}) {
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "GET",
+      url: this.buildUrl(params)
+    });
+    if (status < 200 || status >= 300)
+      this.throwApiError("list summaries", status, data, rawBody);
+    return this.parseResponse(
+      "list summaries",
+      status,
+      () => summariesPageSchema.parse(data)
+    );
+  }
+};
+
 // src/resources/transactions.ts
-import { z as z7 } from "zod";
-var transactionSchema = z7.looseObject({
-  id: z7.string(),
-  source_id: z7.string().nullable(),
-  amount: z7.number(),
-  currency: z7.string(),
-  created_date: z7.string(),
-  description: z7.string(),
-  origin: z7.enum(["link", "external_connection"]),
-  category: z7.string().nullable(),
-  status: z7.string()
+import { z as z9 } from "zod";
+var transactionSchema = z9.looseObject({
+  id: z9.string(),
+  source_id: z9.string().nullable(),
+  amount: z9.number(),
+  currency: z9.string(),
+  created_date: z9.string(),
+  description: z9.string(),
+  origin: z9.enum(["link", "external_connection"]),
+  category: z9.string().nullable(),
+  status: z9.string()
 });
-var transactionsPageSchema = z7.union([
-  z7.array(transactionSchema).transform((data) => ({ data })),
-  z7.looseObject({
-    data: z7.array(transactionSchema),
-    has_more: z7.boolean().optional()
+var transactionsPageSchema = z9.union([
+  z9.array(transactionSchema).transform((data) => ({ data })),
+  z9.looseObject({
+    data: z9.array(transactionSchema),
+    has_more: z9.boolean().optional()
   })
 ]);
 var TransactionsResource = class extends BaseResource {
@@ -633,35 +1381,35 @@ var TransactionsResource = class extends BaseResource {
 };
 
 // src/resources/user-info.ts
-import { z as z8 } from "zod";
-var rollingSpendLimitSchema = z8.object({
-  limit: z8.number().int().nullable(),
-  used: z8.number().int(),
-  remaining: z8.number().int().nullable()
+import { z as z10 } from "zod";
+var rollingSpendLimitSchema = z10.object({
+  limit: z10.number().int().nullable(),
+  used: z10.number().int(),
+  remaining: z10.number().int().nullable()
 });
-var agentWalletSpendLimitsSchema = z8.object({
-  per_transaction: z8.object({
-    limit: z8.number().int().nullable()
+var agentWalletSpendLimitsSchema = z10.object({
+  per_transaction: z10.object({
+    limit: z10.number().int().nullable()
   }),
   daily: rollingSpendLimitSchema,
   thirty_day: rollingSpendLimitSchema
 });
-var agentWalletVerificationRequirementSchema = z8.object({
-  status: z8.enum([
+var agentWalletVerificationRequirementSchema = z10.object({
+  status: z10.enum([
     "not_required",
     "ssn_verification",
     "identity_verification",
     "contact_support",
     "complete"
   ]),
-  action_url: z8.string().nullable()
+  action_url: z10.string().nullable()
 });
-var userInfoSchema = z8.looseObject({
-  email: z8.string().nullable().optional(),
-  name: z8.string().nullable().optional(),
-  first_name: z8.string().nullable().optional(),
-  last_name: z8.string().nullable().optional(),
-  phone: z8.string().nullable().optional(),
+var userInfoSchema = z10.looseObject({
+  email: z10.string().nullable().optional(),
+  name: z10.string().nullable().optional(),
+  first_name: z10.string().nullable().optional(),
+  last_name: z10.string().nullable().optional(),
+  phone: z10.string().nullable().optional(),
   agent_wallet_spend_limits: agentWalletSpendLimitsSchema.optional(),
   agent_wallet_step_up: agentWalletVerificationRequirementSchema.optional()
 }).transform(
@@ -704,16 +1452,16 @@ var UserInfoResource = class extends BaseResource {
 };
 
 // src/resources/web-bot-auth.ts
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 var EXPIRY_BUFFER_MS = 3e4;
-var webBotAuthBlockSchema = z9.looseObject({
-  signature: z9.string(),
-  signature_input: z9.string(),
-  signature_agent: z9.string(),
-  authority: z9.string(),
-  expires_at: z9.string()
+var webBotAuthBlockSchema = z11.looseObject({
+  signature: z11.string(),
+  signature_input: z11.string(),
+  signature_agent: z11.string(),
+  authority: z11.string(),
+  expires_at: z11.string()
 });
-var webBotAuthResponseSchema = z9.looseObject({
+var webBotAuthResponseSchema = z11.looseObject({
   web_bot_auth: webBotAuthBlockSchema
 });
 var WebBotAuthResource = class extends BaseResource {
@@ -759,6 +1507,7 @@ var WebBotAuthResource = class extends BaseResource {
 
 // src/client.ts
 var Link = class {
+  attestations;
   spendRequests;
   paymentMethods;
   shippingAddresses;
@@ -766,9 +1515,11 @@ var Link = class {
   transactions;
   sources;
   balances;
+  summaries;
   webBotAuth;
   reports;
   constructor(options) {
+    this.attestations = new AttestationsResource(options);
     this.spendRequests = new SpendRequestResource(options);
     this.paymentMethods = new PaymentMethodsResource(options);
     this.shippingAddresses = new ShippingAddressResource(options);
@@ -776,6 +1527,7 @@ var Link = class {
     this.transactions = new TransactionsResource(options);
     this.sources = new SourcesResource(options);
     this.balances = new BalancesResource(options);
+    this.summaries = new SummariesResource(options);
     this.webBotAuth = new WebBotAuthResource(options);
     this.reports = new ReportResource(options);
   }
@@ -802,6 +1554,7 @@ var REPORT_TAGS = [
 ];
 var REPORT_ATTEMPT_TRACE_MAX_LENGTH = 8e3;
 export {
+  AttestationsResource,
   Link,
   LinkApiError,
   LinkConfigurationError,
@@ -811,6 +1564,7 @@ export {
   REPORT_ATTEMPT_TRACE_MAX_LENGTH,
   REPORT_OUTCOMES,
   REPORT_TAGS,
+  SummariesResource,
   client_default as default,
   getDuplicateSpendRequest
 };