@stripe/link-sdk 0.5.0 → 0.7.0

package/dist/index.js

@@ -1,4 +1,5 @@
-// src/resources/balances.ts
+// src/resources/attestations.ts
+import { createHash as createHash2 } from "crypto";
 import { z } from "zod";
 
 // src/errors.ts
@@ -44,6 +45,364 @@ var LinkApiError = class extends LinkSdkError {
   }
 };
 
+// src/resources/attestations-crypto.ts
+import {
+  createHash,
+  createPublicKey,
+  randomBytes,
+  timingSafeEqual
+} from "crypto";
+var TOKEN_TYPE = 2;
+var NONCE_SIZE = 32;
+var CHALLENGE_DIGEST_SIZE = 32;
+var TOKEN_KEY_ID_SIZE = 32;
+function base64urlEncode(buf) {
+  return Buffer.from(buf).toString("base64url");
+}
+function base64urlDecode(str) {
+  return new Uint8Array(Buffer.from(str, "base64url"));
+}
+function bytesToBigInt(bytes) {
+  let hex = "";
+  for (const b of bytes) {
+    hex += b.toString(16).padStart(2, "0");
+  }
+  return hex.length === 0 ? 0n : BigInt(`0x${hex}`);
+}
+function bigIntToBytes(n, length) {
+  if (!Number.isInteger(length) || length < 0) {
+    throw new Error("Integer encoding length must be a non-negative integer");
+  }
+  if (n < 0n || n >= 1n << BigInt(length * 8)) {
+    throw new Error(`Integer does not fit in ${length} bytes`);
+  }
+  const hex = n.toString(16).padStart(length * 2, "0");
+  const bytes = new Uint8Array(length);
+  for (let i = 0; i < length; i++) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function bitLength(value) {
+  if (value <= 0n) throw new Error("Bit length requires a positive integer");
+  return value.toString(2).length;
+}
+function modPow(base, exp, mod) {
+  let result = 1n;
+  let b = (base % mod + mod) % mod;
+  let e = exp;
+  while (e > 0n) {
+    if (e & 1n) {
+      result = result * b % mod;
+    }
+    e >>= 1n;
+    b = b * b % mod;
+  }
+  return result;
+}
+function modInverse(a, m) {
+  let [oldR, r] = [a, m];
+  let [oldS, s] = [1n, 0n];
+  while (r !== 0n) {
+    const q = oldR / r;
+    [oldR, r] = [r, oldR - q * r];
+    [oldS, s] = [s, oldS - q * s];
+  }
+  if (oldR !== 1n) {
+    throw new Error("Value has no modular inverse");
+  }
+  return (oldS % m + m) % m;
+}
+function greatestCommonDivisor(a, b) {
+  let x = a < 0n ? -a : a;
+  let y = b < 0n ? -b : b;
+  while (y !== 0n) {
+    [x, y] = [y, x % y];
+  }
+  return x;
+}
+function parseSpkiPublicKey(spkiDer) {
+  let keyObject;
+  try {
+    keyObject = createPublicKey({
+      key: Buffer.from(spkiDer),
+      format: "der",
+      type: "spki"
+    });
+  } catch (error) {
+    throw new Error("Invalid RSA issuer public key", { cause: error });
+  }
+  const details = keyObject.asymmetricKeyDetails;
+  if (keyObject.asymmetricKeyType !== "rsa-pss" || details?.modulusLength !== 2048 || details.hashAlgorithm !== "sha384" || details.mgf1HashAlgorithm !== "sha384" || details.saltLength !== 48) {
+    throw new Error(
+      "Issuer key must use 2048-bit RSA-PSS with SHA-384, MGF1-SHA-384, and a 48-byte salt"
+    );
+  }
+  const spki = readSequence(spkiDer, 0);
+  const algorithm = readTlv(spkiDer, spki.contentStart);
+  const bitString = readTlv(spkiDer, algorithm.end);
+  if (bitString.tag !== 3) {
+    throw new Error(
+      `Expected BIT STRING in SPKI, got 0x${bitString.tag.toString(16)}`
+    );
+  }
+  if (bitString.contentStart >= bitString.end || spkiDer[bitString.contentStart] !== 0) {
+    throw new Error("RSA SPKI BIT STRING must have zero unused bits");
+  }
+  const rsaPublicKeyDer = spkiDer.slice(
+    bitString.contentStart + 1,
+    bitString.end
+  );
+  const rsaPublicKey = readSequence(rsaPublicKeyDer, 0);
+  const modulus = readInteger(rsaPublicKeyDer, rsaPublicKey.contentStart);
+  const exponent = readInteger(rsaPublicKeyDer, modulus.end);
+  const n = bytesToBigInt(modulus.value);
+  const e = bytesToBigInt(exponent.value);
+  if (modulus.value.length !== 256 || bitLength(n) !== 2048) {
+    throw new Error("Token type 0x0002 requires a 2048-bit RSA modulus");
+  }
+  if (e < 3n || e % 2n === 0n) {
+    throw new Error("RSA public exponent must be an odd integer of at least 3");
+  }
+  return {
+    n,
+    e,
+    nLen: modulus.value.length
+  };
+}
+function readTlv(data, offset) {
+  if (offset >= data.length) {
+    throw new Error(`Unexpected end of DER at offset ${offset}`);
+  }
+  const tag = data[offset];
+  if (tag === void 0) {
+    throw new Error(`Unexpected end of DER at offset ${offset}`);
+  }
+  const { value: length, bytesRead } = parseDerLength(data, offset + 1);
+  const contentStart = offset + 1 + bytesRead;
+  const end = contentStart + length;
+  if (end > data.length) {
+    throw new Error(`DER element at offset ${offset} overruns the buffer`);
+  }
+  return { tag, contentStart, end };
+}
+function readSequence(data, offset) {
+  const tlv = readTlv(data, offset);
+  if (tlv.tag !== 48) {
+    throw new Error(
+      `Expected SEQUENCE at offset ${offset}, got 0x${tlv.tag.toString(16)}`
+    );
+  }
+  return tlv;
+}
+function readInteger(data, offset) {
+  const tlv = readTlv(data, offset);
+  if (tlv.tag !== 2) {
+    throw new Error(
+      `Expected INTEGER at offset ${offset}, got 0x${tlv.tag.toString(16)}`
+    );
+  }
+  let value = data.slice(tlv.contentStart, tlv.end);
+  if (value.length > 1 && value[0] === 0) {
+    value = value.slice(1);
+  }
+  return { value, end: tlv.end };
+}
+function parseDerLength(data, offset) {
+  const first = data[offset];
+  if (first === void 0) {
+    throw new Error(`Unexpected end of DER at offset ${offset}`);
+  }
+  if (first < 128) {
+    return { value: first, bytesRead: 1 };
+  }
+  const numBytes = first & 127;
+  if (numBytes === 0 || offset + numBytes >= data.length) {
+    throw new Error(`Invalid DER length at offset ${offset}`);
+  }
+  let value = 0;
+  for (let i = 0; i < numBytes; i++) {
+    const byte = data[offset + 1 + i];
+    if (byte === void 0) {
+      throw new Error(`Unexpected end of DER at offset ${offset + 1 + i}`);
+    }
+    value = value * 256 + byte;
+  }
+  return { value, bytesRead: 1 + numBytes };
+}
+function emsaPssEncode(message, emBits) {
+  const hashAlg = "sha384";
+  const hLen = 48;
+  const sLen = 48;
+  const emLen = Math.ceil(emBits / 8);
+  const mHash = createHash(hashAlg).update(message).digest();
+  if (emLen < hLen + sLen + 2) {
+    throw new Error("Encoding error: emLen too small");
+  }
+  const salt = randomBytes(sLen);
+  const mPrime = Buffer.concat([Buffer.alloc(8), mHash, salt]);
+  const h = createHash(hashAlg).update(mPrime).digest();
+  const ps = Buffer.alloc(emLen - sLen - hLen - 2);
+  const db = Buffer.concat([ps, Buffer.from([1]), salt]);
+  const dbMask = mgf1(h, db.length, hashAlg);
+  const maskedDb = Buffer.alloc(db.length);
+  for (let i = 0; i < db.length; i++) {
+    maskedDb.writeUInt8(db.readUInt8(i) ^ dbMask.readUInt8(i), i);
+  }
+  const topBits = 8 * emLen - emBits;
+  maskedDb.writeUInt8(maskedDb.readUInt8(0) & 255 >> topBits, 0);
+  return new Uint8Array(Buffer.concat([maskedDb, h, Buffer.from([188])]));
+}
+function mgf1(seed, length, hashAlg) {
+  const hLen = hashAlg === "sha384" ? 48 : 32;
+  const result = Buffer.alloc(length);
+  let offset = 0;
+  let counter = 0;
+  while (offset < length) {
+    const c = Buffer.alloc(4);
+    c.writeUInt32BE(counter);
+    const hash = createHash(hashAlg).update(seed).update(c).digest();
+    const toCopy = Math.min(hLen, length - offset);
+    hash.copy(result, offset, 0, toCopy);
+    offset += toCopy;
+    counter++;
+  }
+  return result;
+}
+function generateBlindingFactor(n, nLen) {
+  while (true) {
+    const rBytes = randomBytes(nLen);
+    const r = bytesToBigInt(new Uint8Array(rBytes));
+    if (r < 1n || r >= n) continue;
+    try {
+      const rInv = modInverse(r, n);
+      return { r, rInv };
+    } catch {
+    }
+  }
+}
+function generateBlindedMessages(spkiDer, count, challengeDigest) {
+  if (!Number.isInteger(count) || count < 1 || count > 100) {
+    throw new Error("Token count must be an integer from 1 to 100");
+  }
+  if (challengeDigest.length !== CHALLENGE_DIGEST_SIZE) {
+    throw new Error("Challenge digest must be exactly 32 bytes");
+  }
+  const publicKey = parseSpkiPublicKey(spkiDer);
+  const tokenKeyId = new Uint8Array(
+    createHash("sha256").update(spkiDer).digest()
+  );
+  const emBits = bitLength(publicKey.n) - 1;
+  const tokens = [];
+  for (let i = 0; i < count; i++) {
+    const nonce = new Uint8Array(randomBytes(NONCE_SIZE));
+    const tokenInput = new Uint8Array(
+      2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE + TOKEN_KEY_ID_SIZE
+    );
+    tokenInput[0] = TOKEN_TYPE >> 8 & 255;
+    tokenInput[1] = TOKEN_TYPE & 255;
+    tokenInput.set(nonce, 2);
+    tokenInput.set(challengeDigest, 2 + NONCE_SIZE);
+    tokenInput.set(tokenKeyId, 2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE);
+    const encoded = emsaPssEncode(tokenInput, emBits);
+    const message = bytesToBigInt(encoded);
+    if (greatestCommonDivisor(message, publicKey.n) !== 1n) {
+      throw new Error(
+        "PSS-encoded token input is not coprime to the RSA modulus"
+      );
+    }
+    const { r, rInv } = generateBlindingFactor(publicKey.n, publicKey.nLen);
+    const blindedMessage = message * modPow(r, publicKey.e, publicKey.n) % publicKey.n;
+    tokens.push({
+      nonce,
+      blindedMsg: bigIntToBytes(blindedMessage, publicKey.nLen),
+      blindInverse: rInv,
+      encodedMessage: encoded
+    });
+  }
+  return { tokens, publicKey, challengeDigest, tokenKeyId };
+}
+function unblindSignatures(state, blindSigs) {
+  const { tokens, publicKey, tokenKeyId } = state;
+  if (blindSigs.length !== tokens.length) {
+    throw new Error(
+      `Expected ${tokens.length} blind signatures, got ${blindSigs.length}`
+    );
+  }
+  const results = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    const blindSignature = blindSigs[i];
+    if (!token || blindSignature === void 0) {
+      throw new Error(`Missing blind signature state at index ${i}`);
+    }
+    const blindSigBytes = base64urlDecode(blindSignature);
+    if (blindSigBytes.length !== publicKey.nLen) {
+      throw new Error(
+        `Blind signature ${i} must be exactly ${publicKey.nLen} bytes`
+      );
+    }
+    const blindSigInt = bytesToBigInt(blindSigBytes);
+    const sigInt = blindSigInt * token.blindInverse % publicKey.n;
+    const authenticator = bigIntToBytes(sigInt, publicKey.nLen);
+    const recoveredMessage = bigIntToBytes(
+      modPow(sigInt, publicKey.e, publicKey.n),
+      publicKey.nLen
+    );
+    if (!timingSafeEqual(
+      Buffer.from(recoveredMessage),
+      Buffer.from(token.encodedMessage)
+    )) {
+      throw new Error(`Blind signature ${i} failed verification`);
+    }
+    const raw = new Uint8Array(
+      2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE + TOKEN_KEY_ID_SIZE + publicKey.nLen
+    );
+    raw[0] = TOKEN_TYPE >> 8 & 255;
+    raw[1] = TOKEN_TYPE & 255;
+    raw.set(token.nonce, 2);
+    raw.set(state.challengeDigest, 2 + NONCE_SIZE);
+    raw.set(tokenKeyId, 2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE);
+    raw.set(
+      authenticator,
+      2 + NONCE_SIZE + CHALLENGE_DIGEST_SIZE + TOKEN_KEY_ID_SIZE
+    );
+    results.push({
+      raw,
+      base64url: base64urlEncode(raw)
+    });
+  }
+  return results;
+}
+function computeChallengeDigest(tokenType, issuerName) {
+  const issuerBytes = Buffer.from(issuerName, "utf-8");
+  const originBytes = Buffer.alloc(0);
+  if (!Number.isInteger(tokenType) || tokenType < 0 || tokenType > 65535) {
+    throw new Error("Token type must fit in an unsigned 16-bit integer");
+  }
+  if (issuerBytes.length > 65535) {
+    throw new Error("Issuer name must fit in an unsigned 16-bit length");
+  }
+  const challenge = Buffer.alloc(
+    2 + 2 + issuerBytes.length + 1 + 2 + originBytes.length
+  );
+  let offset = 0;
+  challenge.writeUInt16BE(tokenType, offset);
+  offset += 2;
+  challenge.writeUInt16BE(issuerBytes.length, offset);
+  offset += 2;
+  issuerBytes.copy(challenge, offset);
+  offset += issuerBytes.length;
+  challenge.writeUInt8(0, offset);
+  offset += 1;
+  challenge.writeUInt16BE(originBytes.length, offset);
+  offset += 2;
+  if (originBytes.length > 0) {
+    originBytes.copy(challenge, offset);
+  }
+  return new Uint8Array(createHash("sha256").update(challenge).digest());
+}
+
 // src/config.ts
 var DEFAULT_API_BASE_URL = "https://api.link.com";
 function createDefaultHeadersFetch(baseFetch, defaultHeaders) {
@@ -162,7 +521,8 @@ var BaseResource = class {
         method: opts.method,
         ...opts.headers !== void 0 && { headers: opts.headers },
         ...opts.body !== void 0 && { body: opts.body },
-        ...opts.signal !== void 0 && { signal: opts.signal }
+        ...opts.signal !== void 0 && { signal: opts.signal },
+        ...opts.redirect !== void 0 && { redirect: opts.redirect }
       };
       response = await this.fetchImpl(opts.url, init);
     } catch (error) {
@@ -194,8 +554,13 @@ var BaseResource = class {
     const res = await this.rawFetch(authedOpts);
     if (res.status === 401 && this.canRefreshAccessToken) {
       const refreshedToken = await this.getAccessToken({ forceRefresh: true });
-      authedOpts.headers.Authorization = `Bearer ${refreshedToken}`;
-      return this.rawFetch(authedOpts);
+      return this.rawFetch({
+        ...opts,
+        headers: {
+          ...opts.headers,
+          Authorization: `Bearer ${refreshedToken}`
+        }
+      });
     }
     return res;
   }
@@ -217,20 +582,350 @@ var BaseResource = class {
   }
 };
 
+// src/resources/attestations.ts
+var TOKEN_TYPE_BLIND_RSA = 2;
+var CONTENT_TYPE_TOKEN_REQUEST = "application/private-token-generic-batch-request";
+var CONTENT_TYPE_TOKEN_RESPONSE = "application/private-token-generic-batch-response";
+var LINK_ISSUER = "https://api.link.com";
+var LINK_ISSUER_HOSTNAME = "api.link.com";
+var LINK_ISSUER_METADATA_URL = `${LINK_ISSUER}/.well-known/aap-issuer`;
+var issuerMetadataSchema = z.looseObject({
+  issuer: z.literal(LINK_ISSUER),
+  token_issuance_endpoint: z.string(),
+  token_keys: z.string()
+});
+var tokenKeyDirectorySchema = z.looseObject({
+  "token-keys": z.array(
+    z.looseObject({
+      "token-type": z.number(),
+      "token-key": z.string(),
+      "not-before": z.number().int().nonnegative().optional()
+    })
+  )
+});
+function base64ToBytes(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  return new Uint8Array(Buffer.from(normalized, "base64"));
+}
+function minQuicVarintLength(value) {
+  if (value < 2 ** 6) return 1;
+  if (value < 2 ** 14) return 2;
+  if (value < 2 ** 30) return 4;
+  return 8;
+}
+function encodeQuicVarint(value) {
+  if (!Number.isSafeInteger(value) || value < 0 || value >= 2 ** 62) {
+    throw new Error(`Cannot encode ${value} as a QUIC variable-length integer`);
+  }
+  const length = minQuicVarintLength(value);
+  const encoded = Buffer.alloc(length);
+  let remaining = BigInt(value);
+  for (let index = length - 1; index >= 0; index--) {
+    encoded[index] = Number(remaining & 0xffn);
+    remaining >>= 8n;
+  }
+  encoded[0] = encoded.readUInt8(0) | Math.log2(length) << 6;
+  return encoded;
+}
+function readQuicVarint(body, offset = 0) {
+  const first = body[offset];
+  if (first === void 0) throw new Error("QUIC varint is absent");
+  const length = 1 << (first >> 6);
+  if (body.length < offset + length)
+    throw new Error("QUIC varint is truncated");
+  let value = BigInt(first & 63);
+  for (let index = 1; index < length; index++) {
+    value = value << 8n | BigInt(body.readUInt8(offset + index));
+  }
+  if (value > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error("QUIC varint exceeds the JavaScript safe integer range");
+  }
+  const numeric = Number(value);
+  if (minQuicVarintLength(numeric) !== length) {
+    throw new Error("QUIC varint is not minimally encoded");
+  }
+  return { value: numeric, length };
+}
+function encodeBatchTokenRequest(blindedMessages, truncatedTokenKeyId) {
+  const entries = blindedMessages.map((blindedMessage) => {
+    const entry = Buffer.alloc(3 + blindedMessage.length);
+    entry.writeUInt16BE(TOKEN_TYPE_BLIND_RSA, 0);
+    entry.writeUInt8(truncatedTokenKeyId, 2);
+    Buffer.from(blindedMessage).copy(entry, 3);
+    return entry;
+  });
+  const vector = Buffer.concat(entries);
+  return Buffer.concat([encodeQuicVarint(vector.length), vector]);
+}
+function decodeBatchTokenResponse(body, elementSize, expectedCount) {
+  const prefix = readQuicVarint(body);
+  const vector = body.subarray(prefix.length);
+  if (vector.length !== prefix.value) {
+    throw new Error(
+      `BatchTokenResponse length prefix says ${prefix.value} bytes but ${vector.length} bytes follow`
+    );
+  }
+  if (vector.length === 0)
+    throw new Error("BatchTokenResponse vector is empty");
+  const signatures = [];
+  let offset = 0;
+  while (offset < vector.length) {
+    const present = vector[offset++];
+    if (present === 0) {
+      throw new Error(
+        `Issuer refused token request at index ${signatures.length}`
+      );
+    }
+    if (present !== 1) {
+      throw new Error(`Invalid OptionalTokenResponse presence byte ${present}`);
+    }
+    if (offset + 2 + elementSize > vector.length) {
+      throw new Error("Present GenericTokenResponse is truncated");
+    }
+    const tokenType = vector.readUInt16BE(offset);
+    offset += 2;
+    if (tokenType !== TOKEN_TYPE_BLIND_RSA) {
+      throw new Error(
+        `GenericTokenResponse has unsupported token type 0x${tokenType.toString(16).padStart(4, "0")}`
+      );
+    }
+    signatures.push(
+      base64urlEncode(
+        new Uint8Array(vector.subarray(offset, offset + elementSize))
+      )
+    );
+    offset += elementSize;
+  }
+  if (signatures.length !== expectedCount) {
+    throw new Error(
+      `Issuer returned ${signatures.length} token responses for ${expectedCount} token requests`
+    );
+  }
+  return signatures;
+}
+function requireLinkEndpoint(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (error) {
+    throw new TypeError(`${field} is not a valid URL`, { cause: error });
+  }
+  if (url.protocol !== "https:" || url.origin !== LINK_ISSUER || url.username || url.password) {
+    throw new TypeError(`${field} must be an HTTPS URL on ${LINK_ISSUER}`);
+  }
+  return url.href;
+}
+var AttestationsResource = class extends BaseResource {
+  /** Creates an attestation resource using the SDK's authentication config. */
+  constructor(options) {
+    super(options, "");
+  }
+  /** Fetches JSON without following redirects and normalizes API errors. */
+  async fetchJson(url, operation) {
+    let response;
+    try {
+      response = await this.fetchImpl(url, { redirect: "manual" });
+    } catch (error) {
+      throw new LinkTransportError(`Request failed: GET ${url}`, {
+        cause: error
+      });
+    }
+    const rawBody = await response.text();
+    if (response.status >= 300 && response.status < 400) {
+      throw new LinkApiError(
+        `Refused redirect while attempting to ${operation} (${response.status})`,
+        {
+          status: response.status,
+          rawBody
+        }
+      );
+    }
+    let data = null;
+    try {
+      data = JSON.parse(rawBody);
+    } catch (error) {
+      if (response.ok) {
+        throw new LinkResponseError(operation, response.status, {
+          cause: error
+        });
+      }
+    }
+    if (!response.ok) {
+      throw new LinkApiError(
+        `Failed to ${operation} (${response.status}): ${rawBody}`,
+        {
+          status: response.status,
+          rawBody,
+          details: data
+        }
+      );
+    }
+    return { data, status: response.status };
+  }
+  /** Sends a blinded batch with the current or refreshed access token. */
+  async issueTokens(url, body, forceRefresh = false) {
+    const token = await this.getAccessToken(
+      forceRefresh ? { forceRefresh: true } : void 0
+    );
+    const requestBody = new ArrayBuffer(body.byteLength);
+    new Uint8Array(requestBody).set(body);
+    try {
+      return await this.fetchImpl(url, {
+        method: "POST",
+        redirect: "manual",
+        headers: {
+          "Content-Type": CONTENT_TYPE_TOKEN_REQUEST,
+          Accept: CONTENT_TYPE_TOKEN_RESPONSE,
+          Authorization: `Bearer ${token}`
+        },
+        body: requestBody
+      });
+    } catch (error) {
+      throw new LinkTransportError(`Request failed: POST ${url}`, {
+        cause: error
+      });
+    }
+  }
+  /** Requests, verifies, and returns a batch of Link attestation tokens. */
+  async request(params) {
+    const { count } = params;
+    if (!Number.isInteger(count) || count < 1 || count > 100) {
+      throw new LinkConfigurationError(
+        "Attestation token count must be an integer from 1 to 100"
+      );
+    }
+    const metadataResponse = await this.fetchJson(
+      LINK_ISSUER_METADATA_URL,
+      "fetch issuer metadata"
+    );
+    const metadata = this.parseResponse(
+      "parse issuer metadata",
+      metadataResponse.status,
+      () => issuerMetadataSchema.parse(metadataResponse.data)
+    );
+    let tokenKeysUrl;
+    let issuanceUrl;
+    try {
+      tokenKeysUrl = requireLinkEndpoint(metadata.token_keys, "token_keys");
+      issuanceUrl = requireLinkEndpoint(
+        metadata.token_issuance_endpoint,
+        "token_issuance_endpoint"
+      );
+    } catch (error) {
+      throw new LinkResponseError(
+        "validate issuer metadata",
+        metadataResponse.status,
+        { cause: error }
+      );
+    }
+    const directoryResponse = await this.fetchJson(
+      tokenKeysUrl,
+      "fetch token keys"
+    );
+    const directory = this.parseResponse(
+      "parse token key directory",
+      directoryResponse.status,
+      () => tokenKeyDirectorySchema.parse(directoryResponse.data)
+    );
+    const now = Math.floor(Date.now() / 1e3);
+    const tokenKey = directory["token-keys"].find(
+      (entry) => entry["token-type"] === TOKEN_TYPE_BLIND_RSA && (entry["not-before"] === void 0 || entry["not-before"] <= now)
+    );
+    if (!tokenKey) {
+      throw new LinkResponseError(
+        "select Blind RSA token key",
+        directoryResponse.status,
+        {
+          cause: new Error(
+            "No active token key with type 0x0002 found in directory"
+          )
+        }
+      );
+    }
+    const spkiDer = base64ToBytes(tokenKey["token-key"]);
+    const challengeDigest = computeChallengeDigest(
+      TOKEN_TYPE_BLIND_RSA,
+      LINK_ISSUER_HOSTNAME
+    );
+    const blindingState = generateBlindedMessages(
+      spkiDer,
+      count,
+      challengeDigest
+    );
+    const tokenKeyIdBytes = new Uint8Array(
+      createHash2("sha256").update(spkiDer).digest()
+    );
+    const truncatedTokenKeyId = tokenKeyIdBytes.at(-1);
+    if (truncatedTokenKeyId === void 0) {
+      throw new LinkResponseError("derive Blind RSA token key ID", 200);
+    }
+    const requestBody = encodeBatchTokenRequest(
+      blindingState.tokens.map((token) => token.blindedMsg),
+      truncatedTokenKeyId
+    );
+    let issueResponse = await this.issueTokens(
+      issuanceUrl,
+      new Uint8Array(requestBody)
+    );
+    if (issueResponse.status === 401 && this.canRefreshAccessToken) {
+      issueResponse = await this.issueTokens(
+        issuanceUrl,
+        new Uint8Array(requestBody),
+        true
+      );
+    }
+    if (!issueResponse.ok) {
+      const rawBody = await issueResponse.text();
+      throw new LinkApiError(
+        `Failed to issue attestation tokens (${issueResponse.status}): ${rawBody}`,
+        {
+          status: issueResponse.status,
+          rawBody
+        }
+      );
+    }
+    let blindSignatures;
+    try {
+      blindSignatures = decodeBatchTokenResponse(
+        Buffer.from(await issueResponse.arrayBuffer()),
+        blindingState.publicKey.nLen,
+        count
+      );
+    } catch (error) {
+      throw new LinkResponseError(
+        "decode attestation token response",
+        issueResponse.status,
+        { cause: error }
+      );
+    }
+    const finalTokens = unblindSignatures(
+      blindingState,
+      blindSignatures
+    );
+    return {
+      tokens: finalTokens.map((finalToken) => finalToken.base64url),
+      issuer: LINK_ISSUER,
+      token_key_id: base64urlEncode(blindingState.tokenKeyId),
+      count: finalTokens.length
+    };
+  }
+};
+
 // src/resources/balances.ts
-var currencyAmountsSchema = z.record(z.string(), z.number());
-var balanceSchema = z.looseObject({
-  source_id: z.string(),
-  type: z.enum(["cash", "credit"]),
-  cash: z.looseObject({ available: currencyAmountsSchema }).nullable().optional(),
-  credit: z.looseObject({ used: currencyAmountsSchema }).nullable().optional(),
-  current: z.number(),
-  currency: z.string(),
-  as_of: z.string()
+import { z as z2 } from "zod";
+var currencyAmountsSchema = z2.record(z2.string(), z2.number());
+var balanceSchema = z2.looseObject({
+  source_id: z2.string(),
+  type: z2.enum(["cash", "credit"]),
+  cash: z2.looseObject({ available: currencyAmountsSchema }).nullable().optional(),
+  credit: z2.looseObject({ used: currencyAmountsSchema.nullable() }).nullable().optional(),
+  current: z2.number(),
+  currency: z2.string(),
+  as_of: z2.string()
 });
-var balancesPageSchema = z.looseObject({
-  data: z.array(balanceSchema),
-  has_more: z.boolean().optional()
+var balancesPageSchema = z2.looseObject({
+  data: z2.array(balanceSchema),
+  has_more: z2.boolean().optional()
 });
 var BalancesResource = class extends BaseResource {
   constructor(options) {
@@ -270,17 +965,143 @@ var BalancesResource = class extends BaseResource {
   }
 };
 
+// src/resources/identity-credentials.ts
+import { z as z3 } from "zod";
+
+// src/resources/holder-jwk.ts
+import { createHash as createHash3 } from "crypto";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function holderJwkThumbprint(jwk) {
+  const canonical = JSON.stringify({
+    crv: jwk.crv,
+    kty: jwk.kty,
+    x: jwk.x
+  });
+  return createHash3("sha256").update(canonical).digest("base64url");
+}
+function holderJwksEqual(left, right) {
+  return holderJwkThumbprint(left) === holderJwkThumbprint(right);
+}
+function parseHolderPublicJwk(value) {
+  if (!isRecord2(value)) {
+    throw new LinkConfigurationError("Holder public key must be a JWK object");
+  }
+  if (typeof value.kty !== "string") {
+    throw new LinkConfigurationError("Holder public key is missing kty");
+  }
+  if (value.kty !== "OKP" || value.crv !== "Ed25519" || typeof value.x !== "string" || value.x.length === 0) {
+    throw new LinkConfigurationError(
+      "Holder public key must be an Ed25519 OKP JWK with an x member"
+    );
+  }
+  return { kty: "OKP", crv: "Ed25519", x: value.x };
+}
+
+// src/resources/identity-credentials.ts
+var LINK_ISSUER2 = "https://api.link.com";
+var LINK_ISSUER_METADATA_URL2 = `${LINK_ISSUER2}/.well-known/aap-issuer`;
+var identityCredentialIssuerMetadataSchema = z3.looseObject({
+  issuer: z3.literal(LINK_ISSUER2),
+  credential_endpoint: z3.string()
+});
+var issueIdentityCredentialResponseSchema = z3.looseObject({
+  credential: z3.string(),
+  issuer: z3.literal(LINK_ISSUER2),
+  expires_at: z3.string()
+});
+function requireLinkEndpoint2(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (error) {
+    throw new TypeError(`${field} is not a valid URL`, { cause: error });
+  }
+  if (url.protocol !== "https:" || url.origin !== LINK_ISSUER2 || url.username || url.password) {
+    throw new TypeError(`${field} must be an HTTPS URL on ${LINK_ISSUER2}`);
+  }
+  return url.href;
+}
+var IdentityCredentialsResource = class extends BaseResource {
+  constructor(options) {
+    super(options, "");
+  }
+  async discoverCredentialEndpoint() {
+    const { status, data, rawBody } = await this.rawFetch({
+      method: "GET",
+      url: LINK_ISSUER_METADATA_URL2,
+      redirect: "manual"
+    });
+    if (status >= 300 && status < 400) {
+      throw new LinkApiError(
+        `Refused redirect while fetching identity credential issuer metadata (${status})`,
+        { status, rawBody }
+      );
+    }
+    if (status < 200 || status >= 300) {
+      this.throwApiError(
+        "fetch identity credential issuer metadata",
+        status,
+        data,
+        rawBody
+      );
+    }
+    const metadata = this.parseResponse(
+      "parse identity credential issuer metadata",
+      status,
+      () => identityCredentialIssuerMetadataSchema.parse(data)
+    );
+    return this.parseResponse(
+      "validate identity credential issuer metadata",
+      status,
+      () => requireLinkEndpoint2(
+        metadata.credential_endpoint,
+        "credential_endpoint"
+      )
+    );
+  }
+  async issue(params) {
+    const publicJwk = parseHolderPublicJwk(params.cnf.jwk);
+    const endpoint = await this.discoverCredentialEndpoint();
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "POST",
+      url: endpoint,
+      redirect: "manual",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify({ cnf: { jwk: publicJwk } })
+    });
+    if (status >= 300 && status < 400) {
+      throw new LinkApiError(
+        `Refused redirect while issuing identity credential (${status})`,
+        { status, rawBody }
+      );
+    }
+    if (status < 200 || status >= 300) {
+      this.throwApiError("issue identity credential", status, data, rawBody);
+    }
+    return this.parseResponse(
+      "issue identity credential",
+      status,
+      () => issueIdentityCredentialResponseSchema.parse(data)
+    );
+  }
+};
+
 // src/resources/payment-methods.ts
-import { z as z2 } from "zod";
-var paymentMethodSchema = z2.looseObject({
-  id: z2.string(),
-  type: z2.string(),
-  is_default: z2.boolean(),
-  name: z2.string(),
-  nickname: z2.optional(z2.string().nullable())
+import { z as z4 } from "zod";
+var paymentMethodSchema = z4.looseObject({
+  id: z4.string(),
+  type: z4.string(),
+  is_default: z4.boolean(),
+  name: z4.string(),
+  nickname: z4.optional(z4.string().nullable())
 });
-var paymentMethodsResponseSchema = z2.looseObject({
-  payment_details: z2.array(paymentMethodSchema)
+var paymentMethodsResponseSchema = z4.looseObject({
+  payment_details: z4.array(paymentMethodSchema)
 });
 var PaymentMethodsResource = class extends BaseResource {
   constructor(options) {
@@ -303,14 +1124,14 @@ var PaymentMethodsResource = class extends BaseResource {
 };
 
 // src/resources/report.ts
-import { z as z3 } from "zod";
-var reportRecordSchema = z3.looseObject({
-  object: z3.string(),
-  created_at: z3.string(),
-  domain: z3.string(),
-  outcome: z3.string(),
-  spend_request_id: z3.string(),
-  status: z3.string()
+import { z as z5 } from "zod";
+var reportRecordSchema = z5.looseObject({
+  object: z5.string(),
+  created_at: z5.string(),
+  domain: z5.string(),
+  outcome: z5.string(),
+  spend_request_id: z5.string(),
+  status: z5.string()
 });
 var ReportResource = class extends BaseResource {
   constructor(options) {
@@ -335,15 +1156,15 @@ var ReportResource = class extends BaseResource {
 };
 
 // src/resources/shipping-address.ts
-import { z as z4 } from "zod";
-var shippingAddressSchema = z4.looseObject({
-  id: z4.string(),
-  is_default: z4.boolean(),
-  nickname: z4.optional(z4.string().nullable()),
-  address: z4.looseObject({}).nullable()
+import { z as z6 } from "zod";
+var shippingAddressSchema = z6.looseObject({
+  id: z6.string(),
+  is_default: z6.boolean(),
+  nickname: z6.optional(z6.string().nullable()),
+  address: z6.looseObject({}).nullable()
 });
-var shippingAddressesResponseSchema = z4.looseObject({
-  shipping_addresses: z4.array(shippingAddressSchema)
+var shippingAddressesResponseSchema = z6.looseObject({
+  shipping_addresses: z6.array(shippingAddressSchema)
 });
 var ShippingAddressResource = class extends BaseResource {
   constructor(options) {
@@ -366,21 +1187,21 @@ var ShippingAddressResource = class extends BaseResource {
 };
 
 // src/resources/sources.ts
-import { z as z5 } from "zod";
-var nullableRecordSchema = z5.record(z5.string(), z5.unknown()).nullable().optional();
-var sourceSchema = z5.looseObject({
-  id: z5.string().nullable().optional(),
-  name: z5.string().nullable().optional(),
-  type: z5.string().nullable().optional(),
+import { z as z7 } from "zod";
+var nullableRecordSchema = z7.record(z7.string(), z7.unknown()).nullable().optional();
+var sourceSchema = z7.looseObject({
+  id: z7.string().nullable().optional(),
+  name: z7.string().nullable().optional(),
+  type: z7.string().nullable().optional(),
   capabilities: nullableRecordSchema,
   external_connection: nullableRecordSchema,
-  granted_actions: z5.array(z5.string()).nullable().optional(),
+  granted_actions: z7.array(z7.string()).nullable().optional(),
   bank_account: nullableRecordSchema,
   card: nullableRecordSchema
 });
-var sourcesPageSchema = z5.looseObject({
-  data: z5.array(sourceSchema),
-  has_more: z5.boolean().optional()
+var sourcesPageSchema = z7.looseObject({
+  data: z7.array(sourceSchema),
+  has_more: z7.boolean().optional()
 });
 var SourcesResource = class extends BaseResource {
   constructor(options) {
@@ -416,34 +1237,34 @@ var SourcesResource = class extends BaseResource {
 };
 
 // src/resources/spend-request.ts
-import { z as z6 } from "zod";
-var sharedPaymentTokenSchema = z6.union([
-  z6.string().transform((id) => ({ id })),
-  z6.looseObject({ id: z6.string() })
+import { z as z8 } from "zod";
+var sharedPaymentTokenSchema = z8.union([
+  z8.string().transform((id) => ({ id })),
+  z8.looseObject({ id: z8.string() })
 ]);
-var spendRequestSchema = z6.looseObject({
-  id: z6.string(),
-  payment_details: z6.string().optional(),
-  status: z6.string(),
-  line_items: z6.array(z6.unknown()).optional(),
-  totals: z6.array(z6.unknown()).optional(),
-  created_at: z6.string(),
-  updated_at: z6.string(),
+var spendRequestSchema = z8.looseObject({
+  id: z8.string(),
+  payment_details: z8.string().optional(),
+  status: z8.string(),
+  line_items: z8.array(z8.unknown()).optional(),
+  totals: z8.array(z8.unknown()).optional(),
+  created_at: z8.string(),
+  updated_at: z8.string(),
   shared_payment_token: sharedPaymentTokenSchema.nullable().optional()
 });
-var spendRequestsResponseSchema = z6.looseObject({
-  data: z6.array(spendRequestSchema)
+var spendRequestsResponseSchema = z8.looseObject({
+  data: z8.array(spendRequestSchema)
 });
-var requestApprovalResponseSchema = z6.looseObject({
-  id: z6.string(),
-  approval_link: z6.string()
+var requestApprovalResponseSchema = z8.looseObject({
+  id: z8.string(),
+  approval_link: z8.string()
 }).transform(({ approval_link, ...response }) => ({
   ...response,
   approval_url: approval_link
 }));
-var duplicateSpendRequestErrorSchema = z6.looseObject({
-  error: z6.looseObject({
-    duplicate_spend_request: z6.unknown().optional()
+var duplicateSpendRequestErrorSchema = z8.looseObject({
+  error: z8.looseObject({
+    duplicate_spend_request: z8.unknown().optional()
   })
 });
 function parseSpendRequest(value) {
@@ -562,24 +1383,83 @@ var SpendRequestResource = class extends BaseResource {
   }
 };
 
+// src/resources/summaries.ts
+import { z as z9 } from "zod";
+var summaryValueSchema = z9.discriminatedUnion("unit", [
+  z9.looseObject({ unit: z9.literal("count"), count: z9.number() }),
+  z9.looseObject({
+    unit: z9.literal("payment_volume"),
+    amount: z9.number(),
+    currency: z9.string()
+  })
+]);
+var summaryDataValueSchema = z9.discriminatedUnion("unit", [
+  z9.looseObject({ unit: z9.literal("count"), amount: z9.number() }),
+  z9.looseObject({
+    unit: z9.literal("payment_volume"),
+    amount: z9.number(),
+    currency: z9.string()
+  })
+]);
+var summarySchema = z9.looseObject({
+  id: z9.string(),
+  description: z9.string(),
+  created_at: z9.string().nullable().optional(),
+  status: z9.enum(["ready", "pending", "no_data"]),
+  entries: z9.array(z9.looseObject({ label: z9.string(), value: summaryValueSchema })).default([]),
+  as_of: z9.number().optional(),
+  data: z9.array(z9.looseObject({ label: z9.string(), value: summaryDataValueSchema })).nullable().optional()
+});
+var summariesPageSchema = z9.looseObject({
+  data: z9.array(summarySchema),
+  has_more: z9.boolean().optional()
+});
+var SummariesResource = class extends BaseResource {
+  constructor(options) {
+    super(options, "/summaries");
+  }
+  buildUrl(params) {
+    const url = new URL(this.endpoint);
+    if (params.starting_after !== void 0)
+      url.searchParams.set("starting_after", params.starting_after);
+    if (params.summaries !== void 0)
+      for (const summary of params.summaries)
+        url.searchParams.append("summaries[]", summary);
+    return url.toString();
+  }
+  async list(params = {}) {
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "GET",
+      url: this.buildUrl(params)
+    });
+    if (status < 200 || status >= 300)
+      this.throwApiError("list summaries", status, data, rawBody);
+    return this.parseResponse(
+      "list summaries",
+      status,
+      () => summariesPageSchema.parse(data)
+    );
+  }
+};
+
 // src/resources/transactions.ts
-import { z as z7 } from "zod";
-var transactionSchema = z7.looseObject({
-  id: z7.string(),
-  source_id: z7.string().nullable(),
-  amount: z7.number(),
-  currency: z7.string(),
-  created_date: z7.string(),
-  description: z7.string(),
-  origin: z7.enum(["link", "external_connection"]),
-  category: z7.string().nullable(),
-  status: z7.string()
+import { z as z10 } from "zod";
+var transactionSchema = z10.looseObject({
+  id: z10.string(),
+  source_id: z10.string().nullable(),
+  amount: z10.number(),
+  currency: z10.string(),
+  created_date: z10.string(),
+  description: z10.string(),
+  origin: z10.enum(["link", "external_connection"]),
+  category: z10.string().nullable(),
+  status: z10.string()
 });
-var transactionsPageSchema = z7.union([
-  z7.array(transactionSchema).transform((data) => ({ data })),
-  z7.looseObject({
-    data: z7.array(transactionSchema),
-    has_more: z7.boolean().optional()
+var transactionsPageSchema = z10.union([
+  z10.array(transactionSchema).transform((data) => ({ data })),
+  z10.looseObject({
+    data: z10.array(transactionSchema),
+    has_more: z10.boolean().optional()
   })
 ]);
 var TransactionsResource = class extends BaseResource {
@@ -632,36 +1512,246 @@ var TransactionsResource = class extends BaseResource {
   }
 };
 
+// src/resources/ucp.ts
+function extractApiError(data, rawBody) {
+  if (data && typeof data === "object") {
+    const body = data;
+    if (body.error && typeof body.error === "object") {
+      const err = body.error;
+      if (typeof err.message === "string") return err.message;
+    }
+    if (typeof body.error === "string") return body.error;
+    if (typeof body.message === "string") return body.message;
+  }
+  return rawBody || "unknown error";
+}
+function normalizeSearchResult(data) {
+  const body = data ?? {};
+  const items = Array.isArray(body.data) ? body.data : [];
+  return { ...body, data: items };
+}
+function normalizeCheckout(data) {
+  const body = data ?? {};
+  return { ...body, id: String(body.id ?? "") };
+}
+var UcpResource = class {
+  verbose;
+  getAccessToken;
+  fetchImpl;
+  ucpEndpoint;
+  logger;
+  constructor(options) {
+    const config = resolveLinkSdkConfig(options);
+    this.verbose = config.verbose;
+    this.getAccessToken = config.getAccessToken;
+    this.fetchImpl = requireFetchImplementation(config);
+    this.ucpEndpoint = `${config.apiBaseUrl}/ucp`;
+    this.logger = config.logger;
+  }
+  async rawFetch(opts) {
+    if (this.verbose) {
+      const redactedHeaders = { ...opts.headers };
+      if (redactedHeaders.Authorization)
+        redactedHeaders.Authorization = "Bearer <redacted>";
+      this.logger.debug(`> ${opts.method} ${opts.url}`);
+      this.logger.debug(`  Headers: ${JSON.stringify(redactedHeaders)}`);
+      if (opts.body) this.logger.debug(opts.body);
+    }
+    const fetchOpts = {
+      method: opts.method,
+      ...opts.headers ? { headers: opts.headers } : {}
+    };
+    if (opts.body) fetchOpts.body = opts.body;
+    let response;
+    try {
+      response = await this.fetchImpl(opts.url, fetchOpts);
+    } catch (error) {
+      throw new LinkTransportError(
+        `Request failed: ${opts.method} ${opts.url}`,
+        {
+          cause: error
+        }
+      );
+    }
+    const rawBody = await response.text();
+    let data = null;
+    try {
+      data = JSON.parse(rawBody);
+    } catch {
+    }
+    if (this.verbose) {
+      this.logger.debug(`< ${response.status} ${response.statusText}`);
+      response.headers.forEach((value, key) => {
+        this.logger.debug(`  ${key}: ${value}`);
+      });
+      this.logger.debug(JSON.stringify(data, null, 2) ?? rawBody);
+    }
+    return { status: response.status, data, rawBody };
+  }
+  /** Injects the Bearer token; retries once on 401 after refreshing. */
+  async apiFetch(opts) {
+    const token = await this.getAccessToken();
+    const authedOpts = {
+      ...opts,
+      headers: { ...opts.headers, Authorization: `Bearer ${token}` }
+    };
+    const res = await this.rawFetch(authedOpts);
+    if (res.status === 401) {
+      const refreshedToken = await this.getAccessToken({ forceRefresh: true });
+      authedOpts.headers.Authorization = `Bearer ${refreshedToken}`;
+      return this.rawFetch(authedOpts);
+    }
+    return res;
+  }
+  buildSearchUrl(params) {
+    const url = new URL(`${this.ucpEndpoint}/catalog/search`);
+    const setIf = (key, value) => {
+      if (value !== void 0) url.searchParams.set(key, String(value));
+    };
+    setIf("query", params.query);
+    setIf("profile_id", params.profile_id);
+    setIf("sku", params.sku);
+    setIf("price_min", params.price_min);
+    setIf("price_max", params.price_max);
+    setIf("currency", params.currency);
+    setIf("availability", params.availability);
+    setIf("sort", params.sort);
+    setIf("group_by", params.group_by);
+    setIf("limit", params.limit);
+    setIf("offset", params.offset);
+    if (params.include_facets) url.searchParams.set("include_facets", "true");
+    const arrays = [
+      ["brand", params.brand],
+      ["category", params.category],
+      ["color", params.color],
+      ["size", params.size],
+      ["material", params.material],
+      ["gender", params.gender],
+      ["condition", params.condition]
+    ];
+    for (const [key, values] of arrays) {
+      if (values)
+        for (const value of values) url.searchParams.append(`${key}[]`, value);
+    }
+    if (params.test) url.searchParams.set("test", "true");
+    return url.toString();
+  }
+  async searchCatalog(params) {
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "GET",
+      url: this.buildSearchUrl(params)
+    });
+    if (status < 200 || status >= 300) {
+      throw new LinkApiError(
+        `Failed to search UCP catalog (${status}): ${extractApiError(data, rawBody)}`,
+        { status, rawBody, details: data }
+      );
+    }
+    return normalizeSearchResult(data);
+  }
+  async createCheckout(params) {
+    const body = {
+      profile_id: params.profile_id,
+      line_items: params.line_items
+    };
+    if (params.currency !== void 0) body.currency = params.currency;
+    if (params.fulfillment_details !== void 0)
+      body.fulfillment_details = params.fulfillment_details;
+    if (params.test) body.test = true;
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "POST",
+      url: `${this.ucpEndpoint}/checkout`,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (status < 200 || status >= 300) {
+      throw new LinkApiError(
+        `Failed to create UCP checkout (${status}): ${extractApiError(data, rawBody)}`,
+        { status, rawBody, details: data }
+      );
+    }
+    return normalizeCheckout(data);
+  }
+  async completeCheckout(id, params) {
+    const body = {
+      spend_request_id: params.spend_request_id,
+      profile_id: params.profile_id
+    };
+    if (params.test) body.test = true;
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "POST",
+      url: `${this.ucpEndpoint}/checkout/${encodeURIComponent(id)}/complete`,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (status < 200 || status >= 300) {
+      throw new LinkApiError(
+        `Failed to complete UCP checkout (${status}): ${extractApiError(data, rawBody)}`,
+        { status, rawBody, details: data }
+      );
+    }
+    return normalizeCheckout(data);
+  }
+  async retrieveCheckout(id, params) {
+    const url = new URL(
+      `${this.ucpEndpoint}/checkout/${encodeURIComponent(id)}`
+    );
+    url.searchParams.set("spend_request_id", params.spend_request_id);
+    if (params.test) url.searchParams.set("test", "true");
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "GET",
+      url: url.toString()
+    });
+    if (status < 200 || status >= 300) {
+      throw new LinkApiError(
+        `Failed to retrieve UCP checkout (${status}): ${extractApiError(data, rawBody)}`,
+        { status, rawBody, details: data }
+      );
+    }
+    return normalizeCheckout(data);
+  }
+};
+
 // src/resources/user-info.ts
-import { z as z8 } from "zod";
-var rollingSpendLimitSchema = z8.object({
-  limit: z8.number().int().nullable(),
-  used: z8.number().int(),
-  remaining: z8.number().int().nullable()
+import { z as z11 } from "zod";
+var rollingSpendLimitSchema = z11.object({
+  limit: z11.number().int().nullable(),
+  used: z11.number().int(),
+  remaining: z11.number().int().nullable()
 });
-var agentWalletSpendLimitsSchema = z8.object({
-  per_transaction: z8.object({
-    limit: z8.number().int().nullable()
+var agentWalletSpendLimitsSchema = z11.object({
+  per_transaction: z11.object({
+    limit: z11.number().int().nullable()
   }),
   daily: rollingSpendLimitSchema,
   thirty_day: rollingSpendLimitSchema
 });
-var agentWalletVerificationRequirementSchema = z8.object({
-  status: z8.enum([
+var agentWalletVerificationRequirementSchema = z11.object({
+  status: z11.enum([
     "not_required",
     "ssn_verification",
     "identity_verification",
     "contact_support",
     "complete"
   ]),
-  action_url: z8.string().nullable()
+  action_url: z11.string().nullable()
 });
-var userInfoSchema = z8.looseObject({
-  email: z8.string().nullable().optional(),
-  name: z8.string().nullable().optional(),
-  first_name: z8.string().nullable().optional(),
-  last_name: z8.string().nullable().optional(),
-  phone: z8.string().nullable().optional(),
+var userInfoAddressSchema = z11.object({
+  line1: z11.string().nullable(),
+  line2: z11.string().nullable(),
+  city: z11.string().nullable(),
+  state: z11.string().nullable(),
+  postal_code: z11.string().nullable(),
+  country: z11.string().nullable()
+});
+var userInfoSchema = z11.looseObject({
+  email: z11.string().nullable().optional(),
+  name: z11.string().nullable().optional(),
+  first_name: z11.string().nullable().optional(),
+  last_name: z11.string().nullable().optional(),
+  phone: z11.string().nullable().optional(),
+  address: userInfoAddressSchema.nullable().optional(),
+  eligible_for_balance: z11.boolean().optional(),
   agent_wallet_spend_limits: agentWalletSpendLimitsSchema.optional(),
   agent_wallet_step_up: agentWalletVerificationRequirementSchema.optional()
 }).transform(
@@ -671,6 +1761,8 @@ var userInfoSchema = z8.looseObject({
     first_name,
     last_name,
     phone,
+    address,
+    eligible_for_balance,
     agent_wallet_spend_limits,
     agent_wallet_step_up
   }) => ({
@@ -679,6 +1771,8 @@ var userInfoSchema = z8.looseObject({
     first_name: first_name ?? null,
     last_name: last_name ?? null,
     phone: phone ?? null,
+    ...address === void 0 ? {} : { address },
+    ...eligible_for_balance === void 0 ? {} : { eligible_for_balance },
     ...agent_wallet_spend_limits === void 0 ? {} : { agent_wallet_spend_limits },
     ...agent_wallet_step_up === void 0 ? {} : { agent_wallet_verification_requirement: agent_wallet_step_up }
   })
@@ -704,16 +1798,16 @@ var UserInfoResource = class extends BaseResource {
 };
 
 // src/resources/web-bot-auth.ts
-import { z as z9 } from "zod";
+import { z as z12 } from "zod";
 var EXPIRY_BUFFER_MS = 3e4;
-var webBotAuthBlockSchema = z9.looseObject({
-  signature: z9.string(),
-  signature_input: z9.string(),
-  signature_agent: z9.string(),
-  authority: z9.string(),
-  expires_at: z9.string()
+var webBotAuthBlockSchema = z12.looseObject({
+  signature: z12.string(),
+  signature_input: z12.string(),
+  signature_agent: z12.string(),
+  authority: z12.string(),
+  expires_at: z12.string()
 });
-var webBotAuthResponseSchema = z9.looseObject({
+var webBotAuthResponseSchema = z12.looseObject({
   web_bot_auth: webBotAuthBlockSchema
 });
 var WebBotAuthResource = class extends BaseResource {
@@ -759,6 +1853,8 @@ var WebBotAuthResource = class extends BaseResource {
 
 // src/client.ts
 var Link = class {
+  attestations;
+  identityCredentials;
   spendRequests;
   paymentMethods;
   shippingAddresses;
@@ -766,9 +1862,13 @@ var Link = class {
   transactions;
   sources;
   balances;
+  summaries;
   webBotAuth;
   reports;
+  ucp;
   constructor(options) {
+    this.attestations = new AttestationsResource(options);
+    this.identityCredentials = new IdentityCredentialsResource(options);
     this.spendRequests = new SpendRequestResource(options);
     this.paymentMethods = new PaymentMethodsResource(options);
     this.shippingAddresses = new ShippingAddressResource(options);
@@ -776,8 +1876,10 @@ var Link = class {
     this.transactions = new TransactionsResource(options);
     this.sources = new SourcesResource(options);
     this.balances = new BalancesResource(options);
+    this.summaries = new SummariesResource(options);
     this.webBotAuth = new WebBotAuthResource(options);
     this.reports = new ReportResource(options);
+    this.ucp = new UcpResource(options);
   }
 };
 var client_default = Link;
@@ -802,6 +1904,7 @@ var REPORT_TAGS = [
 ];
 var REPORT_ATTEMPT_TRACE_MAX_LENGTH = 8e3;
 export {
+  AttestationsResource,
   Link,
   LinkApiError,
   LinkConfigurationError,
@@ -811,7 +1914,11 @@ export {
   REPORT_ATTEMPT_TRACE_MAX_LENGTH,
   REPORT_OUTCOMES,
   REPORT_TAGS,
+  SummariesResource,
   client_default as default,
-  getDuplicateSpendRequest
+  getDuplicateSpendRequest,
+  holderJwkThumbprint,
+  holderJwksEqual,
+  parseHolderPublicJwk
 };
 //# sourceMappingURL=index.js.map