@stripe/link-sdk 0.6.0 → 0.8.0

package/dist/index.js

@@ -1,5 +1,4 @@
-// src/resources/attestations.ts
-import { createHash as createHash2 } from "crypto";
+// src/resources/approval-policy.ts
 import { z } from "zod";
 
 // src/errors.ts
@@ -45,6 +44,224 @@ var LinkApiError = class extends LinkSdkError {
   }
 };
 
+// src/config.ts
+var DEFAULT_API_BASE_URL = "https://api.link.com";
+function createDefaultHeadersFetch(baseFetch, defaultHeaders) {
+  return ((input, init) => {
+    const headers = new Headers(init?.headers);
+    for (const [key, value] of Object.entries(defaultHeaders)) {
+      if (!headers.has(key)) {
+        headers.set(key, value);
+      }
+    }
+    return baseFetch(input, { ...init, headers });
+  });
+}
+function createDefaultLogger() {
+  return {
+    debug() {
+    }
+  };
+}
+function resolveLinkSdkConfig(options, defaults = {}) {
+  const verbose = options.verbose ?? false;
+  const logger = options.logger ?? createDefaultLogger();
+  if (options.accessToken !== void 0 && options.getAccessToken !== void 0) {
+    throw new LinkConfigurationError(
+      "Pass either `accessToken` or `getAccessToken`, not both."
+    );
+  }
+  let getAccessToken;
+  let canRefreshAccessToken;
+  if (options.accessToken !== void 0) {
+    if (options.accessToken.trim().length === 0) {
+      throw new LinkConfigurationError("`accessToken` cannot be empty.");
+    }
+    const accessToken = options.accessToken;
+    getAccessToken = () => accessToken;
+    canRefreshAccessToken = false;
+  } else if (typeof options.getAccessToken === "function") {
+    getAccessToken = options.getAccessToken;
+    canRefreshAccessToken = true;
+  } else {
+    throw new LinkConfigurationError(
+      "Pass `accessToken` or `getAccessToken` to the Link client."
+    );
+  }
+  const apiBaseUrl = options.apiBaseUrl ?? defaults.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+  const spendRequestBaseUrl = options.spendRequestBaseUrl ?? defaults.spendRequestBaseUrl ?? apiBaseUrl;
+  const baseFetch = options.fetch ?? globalThis.fetch;
+  const effectiveFetch = options.defaultHeaders && Object.keys(options.defaultHeaders).length > 0 ? createDefaultHeadersFetch(baseFetch, options.defaultHeaders) : baseFetch;
+  return {
+    verbose,
+    getAccessToken,
+    canRefreshAccessToken,
+    fetch: effectiveFetch,
+    apiBaseUrl,
+    spendRequestBaseUrl,
+    logger
+  };
+}
+function requireFetchImplementation(config) {
+  if (!config.fetch) {
+    throw new LinkConfigurationError(
+      "No fetch implementation available. Pass `fetch` in Link SDK options."
+    );
+  }
+  return config.fetch;
+}
+
+// src/resources/base.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function extractErrorMessage(data, rawBody) {
+  if (isRecord(data)) {
+    if (typeof data.error === "string") {
+      return data.error;
+    }
+    if (isRecord(data.error)) {
+      const nested = data.error;
+      if (typeof nested.message === "string") {
+        return nested.message;
+      }
+      if (typeof nested.code === "string") {
+        return nested.code;
+      }
+    }
+    if (typeof data.message === "string") {
+      return data.message;
+    }
+  }
+  return rawBody || "unknown error";
+}
+var BaseResource = class {
+  verbose;
+  getAccessToken;
+  canRefreshAccessToken;
+  fetchImpl;
+  endpoint;
+  logger;
+  constructor(options, endpointPath, base = "api") {
+    const config = resolveLinkSdkConfig(options);
+    this.verbose = config.verbose;
+    this.getAccessToken = config.getAccessToken;
+    this.canRefreshAccessToken = config.canRefreshAccessToken;
+    this.fetchImpl = requireFetchImplementation(config);
+    const baseUrl = base === "spend" ? config.spendRequestBaseUrl : config.apiBaseUrl;
+    this.endpoint = `${baseUrl}${endpointPath}`;
+    this.logger = config.logger;
+  }
+  async rawFetch(opts) {
+    if (this.verbose) {
+      this.logger.debug(`> ${opts.method} ${opts.url}`);
+    }
+    let response;
+    try {
+      const init = {
+        method: opts.method,
+        ...opts.headers !== void 0 && { headers: opts.headers },
+        ...opts.body !== void 0 && { body: opts.body },
+        ...opts.signal !== void 0 && { signal: opts.signal },
+        ...opts.redirect !== void 0 && { redirect: opts.redirect }
+      };
+      response = await this.fetchImpl(opts.url, init);
+    } catch (error) {
+      throw new LinkTransportError(
+        `Request failed: ${opts.method} ${opts.url}`,
+        { cause: error }
+      );
+    }
+    const rawBody = await response.text();
+    let data = null;
+    try {
+      data = JSON.parse(rawBody);
+    } catch {
+    }
+    if (this.verbose) {
+      this.logger.debug(`< ${response.status} ${response.statusText}`);
+    }
+    return { status: response.status, data, rawBody };
+  }
+  async apiFetch(opts) {
+    const token = await this.getAccessToken();
+    const authedOpts = {
+      ...opts,
+      headers: {
+        ...opts.headers,
+        Authorization: `Bearer ${token}`
+      }
+    };
+    const res = await this.rawFetch(authedOpts);
+    if (res.status === 401 && this.canRefreshAccessToken) {
+      const refreshedToken = await this.getAccessToken({ forceRefresh: true });
+      return this.rawFetch({
+        ...opts,
+        headers: {
+          ...opts.headers,
+          Authorization: `Bearer ${refreshedToken}`
+        }
+      });
+    }
+    return res;
+  }
+  throwApiError(operation, status, data, rawBody, cause) {
+    const msg = extractErrorMessage(data, rawBody);
+    throw new LinkApiError(`Failed to ${operation} (${status}): ${msg}`, {
+      status,
+      rawBody,
+      details: data,
+      cause
+    });
+  }
+  parseResponse(operation, status, parser) {
+    try {
+      return parser();
+    } catch (error) {
+      throw new LinkResponseError(operation, status, { cause: error });
+    }
+  }
+};
+
+// src/resources/approval-policy.ts
+var approvalPolicySchema = z.looseObject({
+  rules: z.array(
+    z.looseObject({
+      action: z.string(),
+      limits: z.looseObject({
+        per_purchase: z.looseObject({
+          amount: z.number().int(),
+          currency: z.string()
+        })
+      }),
+      allowed_payment_methods: z.array(z.string()).optional()
+    })
+  )
+});
+var ApprovalPolicyResource = class extends BaseResource {
+  constructor(options) {
+    super(options, "/approval-policy");
+  }
+  async retrieve() {
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "GET",
+      url: this.endpoint
+    });
+    if (status < 200 || status >= 300) {
+      this.throwApiError("retrieve approval policy", status, data, rawBody);
+    }
+    return this.parseResponse(
+      "retrieve approval policy",
+      status,
+      () => approvalPolicySchema.parse(data)
+    );
+  }
+};
+
+// src/resources/attestations.ts
+import { createHash as createHash2 } from "crypto";
+import { z as z2 } from "zod";
+
 // src/resources/attestations-crypto.ts
 import {
   createHash,
@@ -385,196 +602,23 @@ function computeChallengeDigest(tokenType, issuerName) {
   }
   const challenge = Buffer.alloc(
     2 + 2 + issuerBytes.length + 1 + 2 + originBytes.length
-  );
-  let offset = 0;
-  challenge.writeUInt16BE(tokenType, offset);
-  offset += 2;
-  challenge.writeUInt16BE(issuerBytes.length, offset);
-  offset += 2;
-  issuerBytes.copy(challenge, offset);
-  offset += issuerBytes.length;
-  challenge.writeUInt8(0, offset);
-  offset += 1;
-  challenge.writeUInt16BE(originBytes.length, offset);
-  offset += 2;
-  if (originBytes.length > 0) {
-    originBytes.copy(challenge, offset);
-  }
-  return new Uint8Array(createHash("sha256").update(challenge).digest());
-}
-
-// src/config.ts
-var DEFAULT_API_BASE_URL = "https://api.link.com";
-function createDefaultHeadersFetch(baseFetch, defaultHeaders) {
-  return ((input, init) => {
-    const headers = new Headers(init?.headers);
-    for (const [key, value] of Object.entries(defaultHeaders)) {
-      if (!headers.has(key)) {
-        headers.set(key, value);
-      }
-    }
-    return baseFetch(input, { ...init, headers });
-  });
-}
-function createDefaultLogger() {
-  return {
-    debug() {
-    }
-  };
-}
-function resolveLinkSdkConfig(options, defaults = {}) {
-  const verbose = options.verbose ?? false;
-  const logger = options.logger ?? createDefaultLogger();
-  if (options.accessToken !== void 0 && options.getAccessToken !== void 0) {
-    throw new LinkConfigurationError(
-      "Pass either `accessToken` or `getAccessToken`, not both."
-    );
-  }
-  let getAccessToken;
-  let canRefreshAccessToken;
-  if (options.accessToken !== void 0) {
-    if (options.accessToken.trim().length === 0) {
-      throw new LinkConfigurationError("`accessToken` cannot be empty.");
-    }
-    const accessToken = options.accessToken;
-    getAccessToken = () => accessToken;
-    canRefreshAccessToken = false;
-  } else if (typeof options.getAccessToken === "function") {
-    getAccessToken = options.getAccessToken;
-    canRefreshAccessToken = true;
-  } else {
-    throw new LinkConfigurationError(
-      "Pass `accessToken` or `getAccessToken` to the Link client."
-    );
-  }
-  const apiBaseUrl = options.apiBaseUrl ?? defaults.apiBaseUrl ?? DEFAULT_API_BASE_URL;
-  const spendRequestBaseUrl = options.spendRequestBaseUrl ?? defaults.spendRequestBaseUrl ?? apiBaseUrl;
-  const baseFetch = options.fetch ?? globalThis.fetch;
-  const effectiveFetch = options.defaultHeaders && Object.keys(options.defaultHeaders).length > 0 ? createDefaultHeadersFetch(baseFetch, options.defaultHeaders) : baseFetch;
-  return {
-    verbose,
-    getAccessToken,
-    canRefreshAccessToken,
-    fetch: effectiveFetch,
-    apiBaseUrl,
-    spendRequestBaseUrl,
-    logger
-  };
-}
-function requireFetchImplementation(config) {
-  if (!config.fetch) {
-    throw new LinkConfigurationError(
-      "No fetch implementation available. Pass `fetch` in Link SDK options."
-    );
-  }
-  return config.fetch;
-}
-
-// src/resources/base.ts
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function extractErrorMessage(data, rawBody) {
-  if (isRecord(data)) {
-    if (typeof data.error === "string") {
-      return data.error;
-    }
-    if (isRecord(data.error)) {
-      const nested = data.error;
-      if (typeof nested.message === "string") {
-        return nested.message;
-      }
-      if (typeof nested.code === "string") {
-        return nested.code;
-      }
-    }
-    if (typeof data.message === "string") {
-      return data.message;
-    }
-  }
-  return rawBody || "unknown error";
-}
-var BaseResource = class {
-  verbose;
-  getAccessToken;
-  canRefreshAccessToken;
-  fetchImpl;
-  endpoint;
-  logger;
-  constructor(options, endpointPath, base = "api") {
-    const config = resolveLinkSdkConfig(options);
-    this.verbose = config.verbose;
-    this.getAccessToken = config.getAccessToken;
-    this.canRefreshAccessToken = config.canRefreshAccessToken;
-    this.fetchImpl = requireFetchImplementation(config);
-    const baseUrl = base === "spend" ? config.spendRequestBaseUrl : config.apiBaseUrl;
-    this.endpoint = `${baseUrl}${endpointPath}`;
-    this.logger = config.logger;
-  }
-  async rawFetch(opts) {
-    if (this.verbose) {
-      this.logger.debug(`> ${opts.method} ${opts.url}`);
-    }
-    let response;
-    try {
-      const init = {
-        method: opts.method,
-        ...opts.headers !== void 0 && { headers: opts.headers },
-        ...opts.body !== void 0 && { body: opts.body },
-        ...opts.signal !== void 0 && { signal: opts.signal }
-      };
-      response = await this.fetchImpl(opts.url, init);
-    } catch (error) {
-      throw new LinkTransportError(
-        `Request failed: ${opts.method} ${opts.url}`,
-        { cause: error }
-      );
-    }
-    const rawBody = await response.text();
-    let data = null;
-    try {
-      data = JSON.parse(rawBody);
-    } catch {
-    }
-    if (this.verbose) {
-      this.logger.debug(`< ${response.status} ${response.statusText}`);
-    }
-    return { status: response.status, data, rawBody };
-  }
-  async apiFetch(opts) {
-    const token = await this.getAccessToken();
-    const authedOpts = {
-      ...opts,
-      headers: {
-        ...opts.headers,
-        Authorization: `Bearer ${token}`
-      }
-    };
-    const res = await this.rawFetch(authedOpts);
-    if (res.status === 401 && this.canRefreshAccessToken) {
-      const refreshedToken = await this.getAccessToken({ forceRefresh: true });
-      authedOpts.headers.Authorization = `Bearer ${refreshedToken}`;
-      return this.rawFetch(authedOpts);
-    }
-    return res;
-  }
-  throwApiError(operation, status, data, rawBody, cause) {
-    const msg = extractErrorMessage(data, rawBody);
-    throw new LinkApiError(`Failed to ${operation} (${status}): ${msg}`, {
-      status,
-      rawBody,
-      details: data,
-      cause
-    });
-  }
-  parseResponse(operation, status, parser) {
-    try {
-      return parser();
-    } catch (error) {
-      throw new LinkResponseError(operation, status, { cause: error });
-    }
+  );
+  let offset = 0;
+  challenge.writeUInt16BE(tokenType, offset);
+  offset += 2;
+  challenge.writeUInt16BE(issuerBytes.length, offset);
+  offset += 2;
+  issuerBytes.copy(challenge, offset);
+  offset += issuerBytes.length;
+  challenge.writeUInt8(0, offset);
+  offset += 1;
+  challenge.writeUInt16BE(originBytes.length, offset);
+  offset += 2;
+  if (originBytes.length > 0) {
+    originBytes.copy(challenge, offset);
   }
-};
+  return new Uint8Array(createHash("sha256").update(challenge).digest());
+}
 
 // src/resources/attestations.ts
 var TOKEN_TYPE_BLIND_RSA = 2;
@@ -583,17 +627,17 @@ var CONTENT_TYPE_TOKEN_RESPONSE = "application/private-token-generic-batch-respo
 var LINK_ISSUER = "https://api.link.com";
 var LINK_ISSUER_HOSTNAME = "api.link.com";
 var LINK_ISSUER_METADATA_URL = `${LINK_ISSUER}/.well-known/aap-issuer`;
-var issuerMetadataSchema = z.looseObject({
-  issuer: z.literal(LINK_ISSUER),
-  token_issuance_endpoint: z.string(),
-  token_keys: z.string()
+var issuerMetadataSchema = z2.looseObject({
+  issuer: z2.literal(LINK_ISSUER),
+  token_issuance_endpoint: z2.string(),
+  token_keys: z2.string()
 });
-var tokenKeyDirectorySchema = z.looseObject({
-  "token-keys": z.array(
-    z.looseObject({
-      "token-type": z.number(),
-      "token-key": z.string(),
-      "not-before": z.number().int().nonnegative().optional()
+var tokenKeyDirectorySchema = z2.looseObject({
+  "token-keys": z2.array(
+    z2.looseObject({
+      "token-type": z2.number(),
+      "token-key": z2.string(),
+      "not-before": z2.number().int().nonnegative().optional()
     })
   )
 });
@@ -906,20 +950,20 @@ var AttestationsResource = class extends BaseResource {
 };
 
 // src/resources/balances.ts
-import { z as z2 } from "zod";
-var currencyAmountsSchema = z2.record(z2.string(), z2.number());
-var balanceSchema = z2.looseObject({
-  source_id: z2.string(),
-  type: z2.enum(["cash", "credit"]),
-  cash: z2.looseObject({ available: currencyAmountsSchema }).nullable().optional(),
-  credit: z2.looseObject({ used: currencyAmountsSchema.nullable() }).nullable().optional(),
-  current: z2.number(),
-  currency: z2.string(),
-  as_of: z2.string()
+import { z as z3 } from "zod";
+var currencyAmountsSchema = z3.record(z3.string(), z3.number());
+var balanceSchema = z3.looseObject({
+  source_id: z3.string(),
+  type: z3.enum(["cash", "credit"]),
+  cash: z3.looseObject({ available: currencyAmountsSchema }).nullable().optional(),
+  credit: z3.looseObject({ used: currencyAmountsSchema.nullable() }).nullable().optional(),
+  current: z3.number(),
+  currency: z3.string(),
+  as_of: z3.string()
 });
-var balancesPageSchema = z2.looseObject({
-  data: z2.array(balanceSchema),
-  has_more: z2.boolean().optional()
+var balancesPageSchema = z3.looseObject({
+  data: z3.array(balanceSchema),
+  has_more: z3.boolean().optional()
 });
 var BalancesResource = class extends BaseResource {
   constructor(options) {
@@ -959,17 +1003,150 @@ var BalancesResource = class extends BaseResource {
   }
 };
 
+// src/resources/identity-credentials.ts
+import { z as z4 } from "zod";
+
+// src/resources/holder-jwk.ts
+import { createHash as createHash3 } from "crypto";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function holderJwkThumbprint(jwk) {
+  const canonical = JSON.stringify({
+    crv: jwk.crv,
+    kty: jwk.kty,
+    x: jwk.x
+  });
+  return createHash3("sha256").update(canonical).digest("base64url");
+}
+function holderJwksEqual(left, right) {
+  return holderJwkThumbprint(left) === holderJwkThumbprint(right);
+}
+function parseHolderPublicJwk(value) {
+  if (!isRecord2(value)) {
+    throw new LinkConfigurationError("Holder public key must be a JWK object");
+  }
+  if (typeof value.kty !== "string") {
+    throw new LinkConfigurationError("Holder public key is missing kty");
+  }
+  if (value.kty !== "OKP" || value.crv !== "Ed25519" || typeof value.x !== "string" || value.x.length === 0) {
+    throw new LinkConfigurationError(
+      "Holder public key must be an Ed25519 OKP JWK with an x member"
+    );
+  }
+  return { kty: "OKP", crv: "Ed25519", x: value.x };
+}
+
+// src/resources/identity-credentials.ts
+var LINK_ISSUER2 = "https://api.link.com";
+var LINK_ISSUER_METADATA_URL2 = `${LINK_ISSUER2}/.well-known/aap-issuer`;
+var identityCredentialIssuerMetadataSchema = z4.looseObject({
+  issuer: z4.literal(LINK_ISSUER2),
+  credential_endpoint: z4.string()
+});
+var issueIdentityCredentialResponseSchema = z4.looseObject({
+  credential: z4.string(),
+  issuer: z4.literal(LINK_ISSUER2),
+  expires_at: z4.string()
+});
+function requireLinkEndpoint2(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (error) {
+    throw new TypeError(`${field} is not a valid URL`, { cause: error });
+  }
+  if (url.protocol !== "https:" || url.origin !== LINK_ISSUER2 || url.username || url.password) {
+    throw new TypeError(`${field} must be an HTTPS URL on ${LINK_ISSUER2}`);
+  }
+  return url.href;
+}
+var IdentityCredentialsResource = class extends BaseResource {
+  constructor(options) {
+    super(options, "");
+  }
+  async discoverCredentialEndpoint() {
+    const { status, data, rawBody } = await this.rawFetch({
+      method: "GET",
+      url: LINK_ISSUER_METADATA_URL2,
+      redirect: "manual"
+    });
+    if (status >= 300 && status < 400) {
+      throw new LinkApiError(
+        `Refused redirect while fetching identity credential issuer metadata (${status})`,
+        { status, rawBody }
+      );
+    }
+    if (status < 200 || status >= 300) {
+      this.throwApiError(
+        "fetch identity credential issuer metadata",
+        status,
+        data,
+        rawBody
+      );
+    }
+    const metadata = this.parseResponse(
+      "parse identity credential issuer metadata",
+      status,
+      () => identityCredentialIssuerMetadataSchema.parse(data)
+    );
+    return this.parseResponse(
+      "validate identity credential issuer metadata",
+      status,
+      () => requireLinkEndpoint2(
+        metadata.credential_endpoint,
+        "credential_endpoint"
+      )
+    );
+  }
+  async issue(params) {
+    const publicJwk = parseHolderPublicJwk(params.cnf.jwk);
+    const endpoint = await this.discoverCredentialEndpoint();
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "POST",
+      url: endpoint,
+      redirect: "manual",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify({ cnf: { jwk: publicJwk } })
+    });
+    if (status >= 300 && status < 400) {
+      throw new LinkApiError(
+        `Refused redirect while issuing identity credential (${status})`,
+        { status, rawBody }
+      );
+    }
+    if (status < 200 || status >= 300) {
+      this.throwApiError("issue identity credential", status, data, rawBody);
+    }
+    return this.parseResponse(
+      "issue identity credential",
+      status,
+      () => issueIdentityCredentialResponseSchema.parse(data)
+    );
+  }
+};
+
 // src/resources/payment-methods.ts
-import { z as z3 } from "zod";
-var paymentMethodSchema = z3.looseObject({
-  id: z3.string(),
-  type: z3.string(),
-  is_default: z3.boolean(),
-  name: z3.string(),
-  nickname: z3.optional(z3.string().nullable())
+import { z as z5 } from "zod";
+var balanceDetailsSchema = z5.looseObject({
+  available_balance: z5.looseObject({
+    amount: z5.number().int(),
+    currency: z5.string()
+  }).optional()
 });
-var paymentMethodsResponseSchema = z3.looseObject({
-  payment_details: z3.array(paymentMethodSchema)
+var paymentMethodSchema = z5.looseObject({
+  id: z5.string(),
+  type: z5.string(),
+  is_default: z5.boolean(),
+  name: z5.string(),
+  nickname: z5.optional(z5.string().nullable()),
+  balance_details: balanceDetailsSchema.nullable().optional()
+});
+var paymentMethodsResponseSchema = z5.looseObject({
+  payment_details: z5.array(paymentMethodSchema)
 });
 var PaymentMethodsResource = class extends BaseResource {
   constructor(options) {
@@ -989,17 +1166,48 @@ var PaymentMethodsResource = class extends BaseResource {
       () => paymentMethodsResponseSchema.parse(data).payment_details
     );
   }
+  async retrieve(id) {
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "GET",
+      url: `${this.endpoint}/${encodeURIComponent(id)}`
+    });
+    if (status === 404) return null;
+    if (status < 200 || status >= 300) {
+      this.throwApiError("retrieve payment method", status, data, rawBody);
+    }
+    return this.parseResponse(
+      "retrieve payment method",
+      status,
+      () => paymentMethodSchema.parse(data)
+    );
+  }
+  async update(id, params) {
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "POST",
+      url: `${this.endpoint}/${encodeURIComponent(id)}`,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ nickname: params.nickname })
+    });
+    if (status < 200 || status >= 300) {
+      this.throwApiError("update payment method", status, data, rawBody);
+    }
+    return this.parseResponse(
+      "update payment method",
+      status,
+      () => paymentMethodSchema.parse(data)
+    );
+  }
 };
 
 // src/resources/report.ts
-import { z as z4 } from "zod";
-var reportRecordSchema = z4.looseObject({
-  object: z4.string(),
-  created_at: z4.string(),
-  domain: z4.string(),
-  outcome: z4.string(),
-  spend_request_id: z4.string(),
-  status: z4.string()
+import { z as z6 } from "zod";
+var reportRecordSchema = z6.looseObject({
+  object: z6.string(),
+  created_at: z6.string(),
+  domain: z6.string(),
+  outcome: z6.string(),
+  spend_request_id: z6.string(),
+  status: z6.string()
 });
 var ReportResource = class extends BaseResource {
   constructor(options) {
@@ -1024,15 +1232,15 @@ var ReportResource = class extends BaseResource {
 };
 
 // src/resources/shipping-address.ts
-import { z as z5 } from "zod";
-var shippingAddressSchema = z5.looseObject({
-  id: z5.string(),
-  is_default: z5.boolean(),
-  nickname: z5.optional(z5.string().nullable()),
-  address: z5.looseObject({}).nullable()
+import { z as z7 } from "zod";
+var shippingAddressSchema = z7.looseObject({
+  id: z7.string(),
+  is_default: z7.boolean(),
+  nickname: z7.optional(z7.string().nullable()),
+  address: z7.looseObject({}).nullable()
 });
-var shippingAddressesResponseSchema = z5.looseObject({
-  shipping_addresses: z5.array(shippingAddressSchema)
+var shippingAddressesResponseSchema = z7.looseObject({
+  shipping_addresses: z7.array(shippingAddressSchema)
 });
 var ShippingAddressResource = class extends BaseResource {
   constructor(options) {
@@ -1055,21 +1263,21 @@ var ShippingAddressResource = class extends BaseResource {
 };
 
 // src/resources/sources.ts
-import { z as z6 } from "zod";
-var nullableRecordSchema = z6.record(z6.string(), z6.unknown()).nullable().optional();
-var sourceSchema = z6.looseObject({
-  id: z6.string().nullable().optional(),
-  name: z6.string().nullable().optional(),
-  type: z6.string().nullable().optional(),
+import { z as z8 } from "zod";
+var nullableRecordSchema = z8.record(z8.string(), z8.unknown()).nullable().optional();
+var sourceSchema = z8.looseObject({
+  id: z8.string().nullable().optional(),
+  name: z8.string().nullable().optional(),
+  type: z8.string().nullable().optional(),
   capabilities: nullableRecordSchema,
   external_connection: nullableRecordSchema,
-  granted_actions: z6.array(z6.string()).nullable().optional(),
+  granted_actions: z8.array(z8.string()).nullable().optional(),
   bank_account: nullableRecordSchema,
   card: nullableRecordSchema
 });
-var sourcesPageSchema = z6.looseObject({
-  data: z6.array(sourceSchema),
-  has_more: z6.boolean().optional()
+var sourcesPageSchema = z8.looseObject({
+  data: z8.array(sourceSchema),
+  has_more: z8.boolean().optional()
 });
 var SourcesResource = class extends BaseResource {
   constructor(options) {
@@ -1105,34 +1313,34 @@ var SourcesResource = class extends BaseResource {
 };
 
 // src/resources/spend-request.ts
-import { z as z7 } from "zod";
-var sharedPaymentTokenSchema = z7.union([
-  z7.string().transform((id) => ({ id })),
-  z7.looseObject({ id: z7.string() })
+import { z as z9 } from "zod";
+var sharedPaymentTokenSchema = z9.union([
+  z9.string().transform((id) => ({ id })),
+  z9.looseObject({ id: z9.string() })
 ]);
-var spendRequestSchema = z7.looseObject({
-  id: z7.string(),
-  payment_details: z7.string().optional(),
-  status: z7.string(),
-  line_items: z7.array(z7.unknown()).optional(),
-  totals: z7.array(z7.unknown()).optional(),
-  created_at: z7.string(),
-  updated_at: z7.string(),
+var spendRequestSchema = z9.looseObject({
+  id: z9.string(),
+  payment_details: z9.string().optional(),
+  status: z9.string(),
+  line_items: z9.array(z9.unknown()).optional(),
+  totals: z9.array(z9.unknown()).optional(),
+  created_at: z9.string(),
+  updated_at: z9.string(),
   shared_payment_token: sharedPaymentTokenSchema.nullable().optional()
 });
-var spendRequestsResponseSchema = z7.looseObject({
-  data: z7.array(spendRequestSchema)
+var spendRequestsResponseSchema = z9.looseObject({
+  data: z9.array(spendRequestSchema)
 });
-var requestApprovalResponseSchema = z7.looseObject({
-  id: z7.string(),
-  approval_link: z7.string()
+var requestApprovalResponseSchema = z9.looseObject({
+  id: z9.string(),
+  approval_link: z9.string()
 }).transform(({ approval_link, ...response }) => ({
   ...response,
   approval_url: approval_link
 }));
-var duplicateSpendRequestErrorSchema = z7.looseObject({
-  error: z7.looseObject({
-    duplicate_spend_request: z7.unknown().optional()
+var duplicateSpendRequestErrorSchema = z9.looseObject({
+  error: z9.looseObject({
+    duplicate_spend_request: z9.unknown().optional()
   })
 });
 function parseSpendRequest(value) {
@@ -1251,83 +1459,24 @@ var SpendRequestResource = class extends BaseResource {
   }
 };
 
-// src/resources/summaries.ts
-import { z as z8 } from "zod";
-var summaryValueSchema = z8.discriminatedUnion("unit", [
-  z8.looseObject({ unit: z8.literal("count"), count: z8.number() }),
-  z8.looseObject({
-    unit: z8.literal("payment_volume"),
-    amount: z8.number(),
-    currency: z8.string()
-  })
-]);
-var summaryDataValueSchema = z8.discriminatedUnion("unit", [
-  z8.looseObject({ unit: z8.literal("count"), amount: z8.number() }),
-  z8.looseObject({
-    unit: z8.literal("payment_volume"),
-    amount: z8.number(),
-    currency: z8.string()
-  })
-]);
-var summarySchema = z8.looseObject({
-  id: z8.string(),
-  description: z8.string(),
-  created_at: z8.string().nullable().optional(),
-  status: z8.enum(["ready", "pending", "no_data"]),
-  entries: z8.array(z8.looseObject({ label: z8.string(), value: summaryValueSchema })).default([]),
-  as_of: z8.number().optional(),
-  data: z8.array(z8.looseObject({ label: z8.string(), value: summaryDataValueSchema })).nullable().optional()
-});
-var summariesPageSchema = z8.looseObject({
-  data: z8.array(summarySchema),
-  has_more: z8.boolean().optional()
-});
-var SummariesResource = class extends BaseResource {
-  constructor(options) {
-    super(options, "/summaries");
-  }
-  buildUrl(params) {
-    const url = new URL(this.endpoint);
-    if (params.starting_after !== void 0)
-      url.searchParams.set("starting_after", params.starting_after);
-    if (params.summaries !== void 0)
-      for (const summary of params.summaries)
-        url.searchParams.append("summaries[]", summary);
-    return url.toString();
-  }
-  async list(params = {}) {
-    const { status, data, rawBody } = await this.apiFetch({
-      method: "GET",
-      url: this.buildUrl(params)
-    });
-    if (status < 200 || status >= 300)
-      this.throwApiError("list summaries", status, data, rawBody);
-    return this.parseResponse(
-      "list summaries",
-      status,
-      () => summariesPageSchema.parse(data)
-    );
-  }
-};
-
 // src/resources/transactions.ts
-import { z as z9 } from "zod";
-var transactionSchema = z9.looseObject({
-  id: z9.string(),
-  source_id: z9.string().nullable(),
-  amount: z9.number(),
-  currency: z9.string(),
-  created_date: z9.string(),
-  description: z9.string(),
-  origin: z9.enum(["link", "external_connection"]),
-  category: z9.string().nullable(),
-  status: z9.string()
+import { z as z10 } from "zod";
+var transactionSchema = z10.looseObject({
+  id: z10.string(),
+  source_id: z10.string().nullable(),
+  amount: z10.number(),
+  currency: z10.string(),
+  created_date: z10.string(),
+  description: z10.string(),
+  origin: z10.enum(["link", "external_connection"]),
+  category: z10.string().nullable(),
+  status: z10.string()
 });
-var transactionsPageSchema = z9.union([
-  z9.array(transactionSchema).transform((data) => ({ data })),
-  z9.looseObject({
-    data: z9.array(transactionSchema),
-    has_more: z9.boolean().optional()
+var transactionsPageSchema = z10.union([
+  z10.array(transactionSchema).transform((data) => ({ data })),
+  z10.looseObject({
+    data: z10.array(transactionSchema),
+    has_more: z10.boolean().optional()
   })
 ]);
 var TransactionsResource = class extends BaseResource {
@@ -1380,53 +1529,273 @@ var TransactionsResource = class extends BaseResource {
   }
 };
 
+// src/resources/ucp.ts
+function extractApiError(data, rawBody) {
+  if (data && typeof data === "object") {
+    const body = data;
+    if (body.error && typeof body.error === "object") {
+      const err = body.error;
+      if (typeof err.message === "string") return err.message;
+    }
+    if (typeof body.error === "string") return body.error;
+    if (typeof body.message === "string") return body.message;
+  }
+  return rawBody || "unknown error";
+}
+function normalizeSearchResult(data) {
+  const body = data ?? {};
+  const items = Array.isArray(body.data) ? body.data : [];
+  return { ...body, data: items };
+}
+function normalizeCheckout(data) {
+  const body = data ?? {};
+  return { ...body, id: String(body.id ?? "") };
+}
+var UcpResource = class {
+  verbose;
+  getAccessToken;
+  fetchImpl;
+  ucpEndpoint;
+  logger;
+  constructor(options) {
+    const config = resolveLinkSdkConfig(options);
+    this.verbose = config.verbose;
+    this.getAccessToken = config.getAccessToken;
+    this.fetchImpl = requireFetchImplementation(config);
+    this.ucpEndpoint = `${config.apiBaseUrl}/ucp`;
+    this.logger = config.logger;
+  }
+  async rawFetch(opts) {
+    if (this.verbose) {
+      const redactedHeaders = { ...opts.headers };
+      if (redactedHeaders.Authorization)
+        redactedHeaders.Authorization = "Bearer <redacted>";
+      this.logger.debug(`> ${opts.method} ${opts.url}`);
+      this.logger.debug(`  Headers: ${JSON.stringify(redactedHeaders)}`);
+      if (opts.body) this.logger.debug(opts.body);
+    }
+    const fetchOpts = {
+      method: opts.method,
+      ...opts.headers ? { headers: opts.headers } : {}
+    };
+    if (opts.body) fetchOpts.body = opts.body;
+    let response;
+    try {
+      response = await this.fetchImpl(opts.url, fetchOpts);
+    } catch (error) {
+      throw new LinkTransportError(
+        `Request failed: ${opts.method} ${opts.url}`,
+        {
+          cause: error
+        }
+      );
+    }
+    const rawBody = await response.text();
+    let data = null;
+    try {
+      data = JSON.parse(rawBody);
+    } catch {
+    }
+    if (this.verbose) {
+      this.logger.debug(`< ${response.status} ${response.statusText}`);
+      response.headers.forEach((value, key) => {
+        this.logger.debug(`  ${key}: ${value}`);
+      });
+      this.logger.debug(JSON.stringify(data, null, 2) ?? rawBody);
+    }
+    return { status: response.status, data, rawBody };
+  }
+  /** Injects the Bearer token; retries once on 401 after refreshing. */
+  async apiFetch(opts) {
+    const token = await this.getAccessToken();
+    const authedOpts = {
+      ...opts,
+      headers: { ...opts.headers, Authorization: `Bearer ${token}` }
+    };
+    const res = await this.rawFetch(authedOpts);
+    if (res.status === 401) {
+      const refreshedToken = await this.getAccessToken({ forceRefresh: true });
+      authedOpts.headers.Authorization = `Bearer ${refreshedToken}`;
+      return this.rawFetch(authedOpts);
+    }
+    return res;
+  }
+  buildSearchUrl(params) {
+    const url = new URL(`${this.ucpEndpoint}/catalog/search`);
+    const setIf = (key, value) => {
+      if (value !== void 0) url.searchParams.set(key, String(value));
+    };
+    setIf("query", params.query);
+    setIf("profile_id", params.profile_id);
+    setIf("sku", params.sku);
+    setIf("price_min", params.price_min);
+    setIf("price_max", params.price_max);
+    setIf("currency", params.currency);
+    setIf("availability", params.availability);
+    setIf("sort", params.sort);
+    setIf("group_by", params.group_by);
+    setIf("limit", params.limit);
+    setIf("offset", params.offset);
+    if (params.include_facets) url.searchParams.set("include_facets", "true");
+    const arrays = [
+      ["brand", params.brand],
+      ["category", params.category],
+      ["color", params.color],
+      ["size", params.size],
+      ["material", params.material],
+      ["gender", params.gender],
+      ["condition", params.condition]
+    ];
+    for (const [key, values] of arrays) {
+      if (values)
+        for (const value of values) url.searchParams.append(`${key}[]`, value);
+    }
+    if (params.test) url.searchParams.set("test", "true");
+    return url.toString();
+  }
+  async searchCatalog(params) {
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "GET",
+      url: this.buildSearchUrl(params)
+    });
+    if (status < 200 || status >= 300) {
+      throw new LinkApiError(
+        `Failed to search UCP catalog (${status}): ${extractApiError(data, rawBody)}`,
+        { status, rawBody, details: data }
+      );
+    }
+    return normalizeSearchResult(data);
+  }
+  async createCheckout(params) {
+    const body = {
+      profile_id: params.profile_id,
+      line_items: params.line_items
+    };
+    if (params.currency !== void 0) body.currency = params.currency;
+    if (params.fulfillment_details !== void 0)
+      body.fulfillment_details = params.fulfillment_details;
+    if (params.test) body.test = true;
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "POST",
+      url: `${this.ucpEndpoint}/checkout`,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (status < 200 || status >= 300) {
+      throw new LinkApiError(
+        `Failed to create UCP checkout (${status}): ${extractApiError(data, rawBody)}`,
+        { status, rawBody, details: data }
+      );
+    }
+    return normalizeCheckout(data);
+  }
+  async completeCheckout(id, params) {
+    const body = {
+      spend_request_id: params.spend_request_id,
+      profile_id: params.profile_id
+    };
+    if (params.test) body.test = true;
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "POST",
+      url: `${this.ucpEndpoint}/checkout/${encodeURIComponent(id)}/complete`,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (status < 200 || status >= 300) {
+      throw new LinkApiError(
+        `Failed to complete UCP checkout (${status}): ${extractApiError(data, rawBody)}`,
+        { status, rawBody, details: data }
+      );
+    }
+    return normalizeCheckout(data);
+  }
+  async retrieveCheckout(id, params) {
+    const url = new URL(
+      `${this.ucpEndpoint}/checkout/${encodeURIComponent(id)}`
+    );
+    url.searchParams.set("spend_request_id", params.spend_request_id);
+    if (params.test) url.searchParams.set("test", "true");
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "GET",
+      url: url.toString()
+    });
+    if (status < 200 || status >= 300) {
+      throw new LinkApiError(
+        `Failed to retrieve UCP checkout (${status}): ${extractApiError(data, rawBody)}`,
+        { status, rawBody, details: data }
+      );
+    }
+    return normalizeCheckout(data);
+  }
+};
+
 // src/resources/user-info.ts
-import { z as z10 } from "zod";
-var rollingSpendLimitSchema = z10.object({
-  limit: z10.number().int().nullable(),
-  used: z10.number().int(),
-  remaining: z10.number().int().nullable()
+import { z as z11 } from "zod";
+var rollingSpendLimitSchema = z11.object({
+  limit: z11.number().int().nullable(),
+  used: z11.number().int(),
+  remaining: z11.number().int().nullable()
 });
-var agentWalletSpendLimitsSchema = z10.object({
-  per_transaction: z10.object({
-    limit: z10.number().int().nullable()
+var agentWalletSpendLimitsSchema = z11.object({
+  per_transaction: z11.object({
+    limit: z11.number().int().nullable()
   }),
   daily: rollingSpendLimitSchema,
   thirty_day: rollingSpendLimitSchema
 });
-var agentWalletVerificationRequirementSchema = z10.object({
-  status: z10.enum([
+var agentWalletVerificationRequirementSchema = z11.object({
+  status: z11.enum([
     "not_required",
     "ssn_verification",
     "identity_verification",
     "contact_support",
     "complete"
   ]),
-  action_url: z10.string().nullable()
+  action_url: z11.string().nullable()
 });
-var userInfoSchema = z10.looseObject({
-  email: z10.string().nullable().optional(),
-  name: z10.string().nullable().optional(),
-  first_name: z10.string().nullable().optional(),
-  last_name: z10.string().nullable().optional(),
-  phone: z10.string().nullable().optional(),
+var userInfoAddressSchema = z11.object({
+  line1: z11.string().nullable(),
+  line2: z11.string().nullable().optional(),
+  city: z11.string().nullable(),
+  state: z11.string().nullable(),
+  postal_code: z11.string().nullable(),
+  country: z11.string().nullable()
+}).transform(({ line2, ...address }) => ({
+  ...address,
+  ...line2 === void 0 ? {} : { line2 }
+}));
+var userInfoSchema = z11.looseObject({
+  id: z11.string().min(1).optional(),
+  email: z11.string().nullable().optional(),
+  name: z11.string().nullable().optional(),
+  first_name: z11.string().nullable().optional(),
+  last_name: z11.string().nullable().optional(),
+  phone: z11.string().nullable().optional(),
+  address: userInfoAddressSchema.nullable().optional(),
+  eligible_for_balance: z11.boolean().optional(),
   agent_wallet_spend_limits: agentWalletSpendLimitsSchema.optional(),
   agent_wallet_step_up: agentWalletVerificationRequirementSchema.optional()
 }).transform(
   ({
+    id,
     email,
     name,
     first_name,
     last_name,
     phone,
+    address,
+    eligible_for_balance,
     agent_wallet_spend_limits,
     agent_wallet_step_up
   }) => ({
+    ...id === void 0 ? {} : { id },
     email: email ?? null,
     name: name ?? null,
     first_name: first_name ?? null,
     last_name: last_name ?? null,
     phone: phone ?? null,
+    ...address === void 0 ? {} : { address },
+    ...eligible_for_balance === void 0 ? {} : { eligible_for_balance },
     ...agent_wallet_spend_limits === void 0 ? {} : { agent_wallet_spend_limits },
     ...agent_wallet_step_up === void 0 ? {} : { agent_wallet_verification_requirement: agent_wallet_step_up }
   })
@@ -1452,16 +1821,16 @@ var UserInfoResource = class extends BaseResource {
 };
 
 // src/resources/web-bot-auth.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var EXPIRY_BUFFER_MS = 3e4;
-var webBotAuthBlockSchema = z11.looseObject({
-  signature: z11.string(),
-  signature_input: z11.string(),
-  signature_agent: z11.string(),
-  authority: z11.string(),
-  expires_at: z11.string()
+var webBotAuthBlockSchema = z12.looseObject({
+  signature: z12.string(),
+  signature_input: z12.string(),
+  signature_agent: z12.string(),
+  authority: z12.string(),
+  expires_at: z12.string()
 });
-var webBotAuthResponseSchema = z11.looseObject({
+var webBotAuthResponseSchema = z12.looseObject({
   web_bot_auth: webBotAuthBlockSchema
 });
 var WebBotAuthResource = class extends BaseResource {
@@ -1508,28 +1877,32 @@ var WebBotAuthResource = class extends BaseResource {
 // src/client.ts
 var Link = class {
   attestations;
+  identityCredentials;
   spendRequests;
   paymentMethods;
   shippingAddresses;
   userInfo;
+  approvalPolicy;
   transactions;
   sources;
   balances;
-  summaries;
   webBotAuth;
   reports;
+  ucp;
   constructor(options) {
     this.attestations = new AttestationsResource(options);
+    this.identityCredentials = new IdentityCredentialsResource(options);
     this.spendRequests = new SpendRequestResource(options);
     this.paymentMethods = new PaymentMethodsResource(options);
     this.shippingAddresses = new ShippingAddressResource(options);
     this.userInfo = new UserInfoResource(options);
+    this.approvalPolicy = new ApprovalPolicyResource(options);
     this.transactions = new TransactionsResource(options);
     this.sources = new SourcesResource(options);
     this.balances = new BalancesResource(options);
-    this.summaries = new SummariesResource(options);
     this.webBotAuth = new WebBotAuthResource(options);
     this.reports = new ReportResource(options);
+    this.ucp = new UcpResource(options);
   }
 };
 var client_default = Link;
@@ -1554,6 +1927,7 @@ var REPORT_TAGS = [
 ];
 var REPORT_ATTEMPT_TRACE_MAX_LENGTH = 8e3;
 export {
+  ApprovalPolicyResource,
   AttestationsResource,
   Link,
   LinkApiError,
@@ -1564,8 +1938,10 @@ export {
   REPORT_ATTEMPT_TRACE_MAX_LENGTH,
   REPORT_OUTCOMES,
   REPORT_TAGS,
-  SummariesResource,
   client_default as default,
-  getDuplicateSpendRequest
+  getDuplicateSpendRequest,
+  holderJwkThumbprint,
+  holderJwksEqual,
+  parseHolderPublicJwk
 };
 //# sourceMappingURL=index.js.map