@subly_fi/pay 0.1.0

package/dist/pay.js

@@ -0,0 +1,1769 @@
+// ../../demo/pay.ts
+import { readFileSync as readFileSync2, writeFileSync } from "node:fs";
+
+// ../../src/client/agent-wallet-signer.ts
+import { signBytes } from "@solana/kit";
+import bs584 from "bs58";
+
+// ../../src/solana/tx.ts
+import bs58 from "bs58";
+import {
+  appendTransactionMessageInstructions,
+  compileTransaction,
+  compressTransactionMessageUsingAddressLookupTables,
+  createTransactionMessage,
+  getBase64EncodedWireTransaction,
+  getTransactionDecoder,
+  partiallySignTransaction,
+  pipe,
+  setTransactionMessageFeePayer,
+  setTransactionMessageLifetimeUsingBlockhash
+} from "@solana/kit";
+
+// ../../src/lib/hash.ts
+import { createHash } from "node:crypto";
+var EMPTY_BODY_HASH = "sha256-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+function sha256TaggedHex(data) {
+  return `sha256-${createHash("sha256").update(data).digest("hex")}`;
+}
+function stableStringify(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (typeof value === "bigint") {
+    return JSON.stringify(value.toString());
+  }
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  const keys = Object.keys(value).filter((key) => value[key] !== void 0).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+}
+function hashStableJson(value) {
+  return sha256TaggedHex(stableStringify(value));
+}
+
+// ../../src/solana/tx.ts
+function decodeSerializedTransaction(serializedBase64) {
+  return getTransactionDecoder().decode(Buffer.from(serializedBase64, "base64"));
+}
+async function addSignaturesToSerializedTransaction(params) {
+  const decoded = decodeSerializedTransaction(params.serializedBase64);
+  const signed = await partiallySignTransaction(params.signers, decoded);
+  return {
+    serializedBase64: getBase64EncodedWireTransaction(signed),
+    transaction: signed
+  };
+}
+function signatureBase58ForSigner(transaction, signer2) {
+  const signature = transaction.signatures[signer2];
+  if (signature === null || signature === void 0) {
+    return null;
+  }
+  return bs58.encode(signature);
+}
+
+// ../../src/client/transaction-intent-validator.ts
+import bs583 from "bs58";
+import { getCompiledTransactionMessageDecoder } from "@solana/kit";
+
+// ../../src/config/constants.ts
+var PAYMENT_SCHEME = "subly-yield-exact";
+var SOLANA_MAINNET_NETWORK = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
+var SPL_TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+var ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+var SUBLY_VAULT = {
+  name: "Subly USDC Payment Vault Alpha",
+  address: "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr",
+  programId: "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd",
+  usdcMint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
+  shareMint: "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a",
+  lookupTable: "7UbXhDnpK7WVnwsfivzQRENoqKqAULQ5s19gS1xJrQEo",
+  farm: "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
+};
+var USDC_DECIMALS = 6;
+
+// ../../src/domain/request-binding.ts
+function computeRequestBindingHash(fields) {
+  return hashStableJson({
+    sellerRequestId: fields.sellerRequestId,
+    httpMethod: fields.httpMethod.toUpperCase(),
+    canonicalResourceUrl: fields.canonicalResourceUrl,
+    requestBodyHash: fields.requestBodyHash,
+    seller: fields.seller,
+    asset: fields.asset,
+    amountRawUsdc: fields.amountRawUsdc,
+    payTo: fields.payTo,
+    sellerUsdcAta: fields.sellerUsdcAta
+  });
+}
+
+// ../../src/lib/associated-token-account.ts
+import { createHash as createHash2 } from "node:crypto";
+import bs582 from "bs58";
+var PDA_MARKER = Buffer.from("ProgramDerivedAddress", "utf8");
+var ED25519_P = (1n << 255n) - 19n;
+var ED25519_D = mod(-121665n * modPow(121666n, ED25519_P - 2n, ED25519_P), ED25519_P);
+function deriveAssociatedTokenAddress(params) {
+  const owner = decodePublicKey(params.owner, "owner");
+  const mint = decodePublicKey(params.mint ?? SUBLY_VAULT.usdcMint, "mint");
+  const tokenProgramId = decodePublicKey(
+    params.tokenProgramId ?? SPL_TOKEN_PROGRAM_ID,
+    "tokenProgramId"
+  );
+  const associatedTokenProgramId = decodePublicKey(
+    ASSOCIATED_TOKEN_PROGRAM_ID,
+    "associatedTokenProgramId"
+  );
+  for (let bump = 255; bump >= 0; bump -= 1) {
+    const address2 = createProgramAddress(
+      [owner, tokenProgramId, mint, Uint8Array.of(bump)],
+      associatedTokenProgramId
+    );
+    if (address2 !== null) {
+      return bs582.encode(address2);
+    }
+  }
+  throw new Error("Unable to derive associated token account address");
+}
+function createProgramAddress(seeds, programId) {
+  const hash = createHash2("sha256");
+  for (const seed of seeds) {
+    hash.update(seed);
+  }
+  hash.update(programId);
+  hash.update(PDA_MARKER);
+  const digest = hash.digest();
+  return isEd25519Point(digest) ? null : new Uint8Array(digest);
+}
+function decodePublicKey(value, fieldName) {
+  const decoded = bs582.decode(value);
+  if (decoded.length !== 32) {
+    throw new Error(`${fieldName} must be a 32-byte public key`);
+  }
+  return decoded;
+}
+function isEd25519Point(bytes) {
+  if (bytes.length !== 32) {
+    return false;
+  }
+  const yBytes = Uint8Array.from(bytes);
+  yBytes[31] = yBytes[31] & 127;
+  const y = littleEndianToBigInt(yBytes);
+  if (y >= ED25519_P) {
+    return false;
+  }
+  const ySquared = mod(y * y, ED25519_P);
+  const numerator = mod(ySquared - 1n, ED25519_P);
+  const denominator = mod(ED25519_D * ySquared + 1n, ED25519_P);
+  if (denominator === 0n) {
+    return false;
+  }
+  const xSquared = mod(
+    numerator * modPow(denominator, ED25519_P - 2n, ED25519_P),
+    ED25519_P
+  );
+  return xSquared === 0n || modPow(xSquared, (ED25519_P - 1n) / 2n, ED25519_P) === 1n;
+}
+function littleEndianToBigInt(bytes) {
+  let value = 0n;
+  for (let index = bytes.length - 1; index >= 0; index -= 1) {
+    value = (value << 8n) + BigInt(bytes[index]);
+  }
+  return value;
+}
+function mod(value, modulus) {
+  const result = value % modulus;
+  return result >= 0n ? result : result + modulus;
+}
+function modPow(base, exponent, modulus) {
+  let result = 1n;
+  let nextBase = mod(base, modulus);
+  let nextExponent = exponent;
+  while (nextExponent > 0n) {
+    if ((nextExponent & 1n) === 1n) {
+      result = mod(result * nextBase, modulus);
+    }
+    nextBase = mod(nextBase * nextBase, modulus);
+    nextExponent >>= 1n;
+  }
+  return result;
+}
+
+// ../../src/client/transaction-intent-validator.ts
+var COMPUTE_BUDGET_PROGRAM_ID = "ComputeBudget111111111111111111111111111111";
+var SYSTEM_PROGRAM_ID = "11111111111111111111111111111111";
+var ASSOCIATED_TOKEN_PROGRAM_ID2 = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+var MEMO_PROGRAM_ID = "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr";
+var KVAULT_PROGRAM_ID = "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd";
+var KAMINO_FARMS_PROGRAM_ID = "FarmsPZpWu9i7Kky8tPN37rs2TpmMrAZrC7S7vJa91Hr";
+var KVAULT_WITHDRAW_DISCRIMINATOR = Uint8Array.from([
+  183,
+  18,
+  70,
+  156,
+  148,
+  109,
+  161,
+  34
+]);
+var KVAULT_WITHDRAW_FROM_AVAILABLE_DISCRIMINATOR = Uint8Array.from([
+  19,
+  131,
+  112,
+  155,
+  170,
+  220,
+  34,
+  57
+]);
+var KVAULT_DEPOSIT_DISCRIMINATOR = Uint8Array.from([
+  242,
+  35,
+  198,
+  137,
+  82,
+  225,
+  242,
+  182
+]);
+var U64_MAX = 18446744073709551615n;
+var MAX_TEMP_ACCOUNT_LAMPORTS = 10000000n;
+var DEFAULT_MAX_COMPUTE_UNIT_LIMIT = 14e5;
+var DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS = 100000n;
+var IntentValidationError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "IntentValidationError";
+    this.reason = reason;
+  }
+};
+function reject(reason, message) {
+  throw new IntentValidationError(reason, message);
+}
+function decodeIntentTransaction(params) {
+  const wire = Buffer.from(params.serializedTransaction, "base64");
+  const signatureCount = readShortVec(wire, 0);
+  if (signatureCount === null) {
+    reject("invalid_transaction_encoding", "Cannot parse signature count");
+  }
+  const messageOffset = signatureCount.nextOffset + signatureCount.value * 64;
+  if (messageOffset >= wire.length) {
+    reject("invalid_transaction_encoding", "Transaction has no message bytes");
+  }
+  const messageBytes = wire.subarray(messageOffset);
+  const compiled = getCompiledTransactionMessageDecoder().decode(messageBytes);
+  if (compiled.version !== 0) {
+    reject("unsupported_transaction_version", "Only v0 transactions are supported");
+  }
+  const staticAccounts = compiled.staticAccounts.map(String);
+  const loadedWritable = [];
+  const loadedReadonly = [];
+  const lookups = compiled.addressTableLookups ?? [];
+  for (const rawLookup of lookups) {
+    const lookup = rawLookup;
+    const table = params.lookupTables?.[String(lookup.lookupTableAddress)];
+    if (table === void 0) {
+      reject(
+        "lookup_table_unresolved",
+        `Transaction references unknown lookup table ${lookup.lookupTableAddress}`
+      );
+    }
+    const writableIndexes = lookup.writableIndexes ?? lookup.writableIndices ?? [];
+    const readonlyIndexes = lookup.readonlyIndexes ?? lookup.readableIndices ?? [];
+    for (const index of writableIndexes) {
+      const resolved = table[index];
+      if (resolved === void 0) {
+        reject("lookup_table_unresolved", "Lookup table index out of range");
+      }
+      loadedWritable.push(String(resolved));
+    }
+    for (const index of readonlyIndexes) {
+      const resolved = table[index];
+      if (resolved === void 0) {
+        reject("lookup_table_unresolved", "Lookup table index out of range");
+      }
+      loadedReadonly.push(String(resolved));
+    }
+  }
+  const orderedAccounts = [...staticAccounts, ...loadedWritable, ...loadedReadonly];
+  const instructions = compiled.instructions.map(
+    (instruction) => {
+      const programAddress = orderedAccounts[instruction.programAddressIndex];
+      if (programAddress === void 0) {
+        reject("invalid_transaction_encoding", "Program index out of range");
+      }
+      const accounts = (instruction.accountIndices ?? []).map((index) => {
+        const account = orderedAccounts[index];
+        if (account === void 0) {
+          reject("invalid_transaction_encoding", "Account index out of range");
+        }
+        return account;
+      });
+      return {
+        programAddress,
+        accounts,
+        data: instruction.data === void 0 ? new Uint8Array() : Uint8Array.from(instruction.data)
+      };
+    }
+  );
+  const feePayer = staticAccounts[0];
+  if (feePayer === void 0) {
+    reject("invalid_transaction_encoding", "Transaction has no fee payer");
+  }
+  return {
+    feePayer,
+    requiredSigners: staticAccounts.slice(0, compiled.header.numSignerAccounts),
+    instructions,
+    messageHash: sha256TaggedHex(Buffer.from(messageBytes))
+  };
+}
+function validatePaymentIntentTransaction(params) {
+  const { intent } = params;
+  const now = params.nowMs ?? Date.now();
+  const policy = resolveIntentValidationPolicy(params.policy);
+  if (new Date(intent.expiresAt).getTime() <= now) {
+    reject("expired", "Payment intent has expired");
+  }
+  if (intent.scheme !== PAYMENT_SCHEME) {
+    reject("scheme_mismatch", `scheme must be ${PAYMENT_SCHEME}`);
+  }
+  if (intent.network !== SOLANA_MAINNET_NETWORK) {
+    reject("network_mismatch", "Unsupported network");
+  }
+  if (intent.vault !== SUBLY_VAULT.address) {
+    reject("vault_mismatch", "Unsupported vault");
+  }
+  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
+    reject("share_mint_mismatch", "Unsupported share mint");
+  }
+  if (intent.asset !== SUBLY_VAULT.usdcMint) {
+    reject("asset_mismatch", "Only USDC payments are supported");
+  }
+  if (intent.memo !== intent.paymentId) {
+    reject("memo_mismatch", "Memo must equal the paymentId");
+  }
+  const expectedBinding = computeRequestBindingHash({
+    sellerRequestId: intent.sellerRequestId,
+    httpMethod: intent.httpMethod,
+    canonicalResourceUrl: intent.canonicalResourceUrl,
+    requestBodyHash: intent.requestBodyHash,
+    seller: intent.seller,
+    asset: intent.asset,
+    amountRawUsdc: intent.amountRawUsdc,
+    payTo: intent.payTo,
+    sellerUsdcAta: intent.sellerUsdcAta
+  });
+  if (expectedBinding !== intent.requestBindingHash) {
+    reject(
+      "request_binding_mismatch",
+      "requestBindingHash does not match the request fields"
+    );
+  }
+  const expectedSellerAta = deriveAssociatedTokenAddress({
+    owner: intent.payTo,
+    mint: intent.asset
+  });
+  if (expectedSellerAta !== intent.sellerUsdcAta) {
+    reject(
+      "seller_ata_mismatch",
+      "sellerUsdcAta must be the associated USDC account for payTo"
+    );
+  }
+  const expectedDustAta = deriveAssociatedTokenAddress({
+    owner: intent.wallet,
+    mint: intent.asset
+  });
+  if (expectedDustAta !== intent.dustRecipientUsdcAta) {
+    reject(
+      "dust_recipient_mismatch",
+      "dustRecipientUsdcAta must be the agent wallet's USDC ATA"
+    );
+  }
+  const decoded = decodeIntentTransaction({
+    serializedTransaction: params.serializedTransaction,
+    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
+  });
+  if (decoded.messageHash !== intent.preparedMessageHash) {
+    reject("message_hash_mismatch", "Prepared message hash mismatch");
+  }
+  if (decoded.feePayer !== intent.feePayer) {
+    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  }
+  const expectedSigners = /* @__PURE__ */ new Set([
+    intent.feePayer,
+    intent.wallet,
+    intent.temporarySettlementTokenAccount
+  ]);
+  if (decoded.requiredSigners.length !== expectedSigners.size || !decoded.requiredSigners.every((signer2) => expectedSigners.has(signer2))) {
+    reject(
+      "unexpected_signers",
+      "Transaction signers must be exactly the sponsor, the agent wallet, and the temporary settlement account"
+    );
+  }
+  const ixs = [...decoded.instructions];
+  expectComputeBudgetPair(ixs, policy);
+  expectCreateTemporaryAccount(ixs, intent, policy);
+  expectInitializeTemporaryAccount(ixs, intent);
+  consumeFarmInstructions(ixs, intent.wallet);
+  expectKvaultWithdraw(ixs, {
+    wallet: intent.wallet,
+    vault: intent.vault,
+    shareMint: intent.shareMint,
+    asset: intent.asset,
+    userTokenAccount: intent.temporarySettlementTokenAccount,
+    maxSharesToRedeemRaw: BigInt(intent.maxSharesToRedeemRaw),
+    allowFullExit: false
+  });
+  expectTransferChecked(ixs, {
+    source: intent.temporarySettlementTokenAccount,
+    mint: intent.asset,
+    destination: intent.sellerUsdcAta,
+    authority: intent.wallet,
+    amount: BigInt(intent.amountRawUsdc),
+    label: "seller transfer"
+  });
+  if (ixs[0] !== void 0 && ixs[0].programAddress === SPL_TOKEN_PROGRAM_ID && ixs[0].data[0] === 12) {
+    expectTransferChecked(ixs, {
+      source: intent.temporarySettlementTokenAccount,
+      mint: intent.asset,
+      destination: intent.dustRecipientUsdcAta,
+      authority: intent.wallet,
+      amount: null,
+      label: "dust sweep"
+    });
+  }
+  expectCloseAccount(ixs, {
+    account: intent.temporarySettlementTokenAccount,
+    destination: intent.feePayer,
+    owner: intent.wallet
+  });
+  expectMemo(ixs, intent.memo);
+  if (ixs.length > 0) {
+    reject(
+      "unexpected_instruction",
+      `Transaction contains ${ixs.length} unexpected trailing instruction(s)`
+    );
+  }
+}
+function validateDepositIntentTransaction(params) {
+  const { intent } = params;
+  const now = params.nowMs ?? Date.now();
+  const policy = resolveIntentValidationPolicy(params.policy);
+  if (new Date(intent.expiresAt).getTime() <= now) {
+    reject("expired", "Deposit intent has expired");
+  }
+  assertVaultIntentTargets(intent);
+  const decoded = decodeIntentTransaction({
+    serializedTransaction: params.serializedTransaction,
+    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
+  });
+  if (decoded.messageHash !== intent.preparedMessageHash) {
+    reject("message_hash_mismatch", "Prepared message hash mismatch");
+  }
+  if (decoded.feePayer !== intent.feePayer) {
+    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  }
+  let sawDeposit = false;
+  for (const ix of decoded.instructions) {
+    switch (ix.programAddress) {
+      case COMPUTE_BUDGET_PROGRAM_ID:
+        validateComputeBudgetInstruction(ix, policy);
+        break;
+      case ASSOCIATED_TOKEN_PROGRAM_ID2:
+        expectAtaCreateForOwner(ix, intent.wallet);
+        break;
+      case MEMO_PROGRAM_ID:
+        break;
+      case KVAULT_PROGRAM_ID: {
+        if (!bytesStartWith(ix.data, KVAULT_DEPOSIT_DISCRIMINATOR)) {
+          reject("unexpected_instruction", "Unexpected KVault instruction in deposit");
+        }
+        const maxAmount = readU64LE(ix.data, 8);
+        if (maxAmount !== BigInt(intent.amountRawUsdc)) {
+          reject("amount_mismatch", "Deposit amount does not match the intent");
+        }
+        if (ix.accounts[0] !== intent.wallet) {
+          reject("wallet_mismatch", "Deposit user is not the agent wallet");
+        }
+        if (ix.accounts[1] !== intent.vault) {
+          reject("vault_mismatch", "Deposit vault mismatch");
+        }
+        if (ix.accounts[3] !== intent.asset) {
+          reject("asset_mismatch", "Deposit token mint mismatch");
+        }
+        if (ix.accounts[5] !== intent.shareMint) {
+          reject("share_mint_mismatch", "Deposit share mint mismatch");
+        }
+        const expectedSourceAta = deriveAssociatedTokenAddress({
+          owner: intent.wallet,
+          mint: intent.asset
+        });
+        if (ix.accounts[6] !== expectedSourceAta) {
+          reject(
+            "source_ata_mismatch",
+            "Deposit source must be the agent wallet's USDC ATA"
+          );
+        }
+        sawDeposit = true;
+        break;
+      }
+      default:
+        reject(
+          "unexpected_instruction",
+          `Unexpected program ${ix.programAddress} in deposit transaction`
+        );
+    }
+  }
+  if (!sawDeposit) {
+    reject("missing_instruction", "Deposit transaction has no KVault deposit");
+  }
+}
+function validateWithdrawalIntentTransaction(params) {
+  const { intent } = params;
+  const now = params.nowMs ?? Date.now();
+  const policy = resolveIntentValidationPolicy(params.policy);
+  if (new Date(intent.expiresAt).getTime() <= now) {
+    reject("expired", "Withdrawal intent has expired");
+  }
+  assertVaultIntentTargets(intent);
+  const expectedDestination = deriveAssociatedTokenAddress({
+    owner: intent.wallet,
+    mint: intent.asset
+  });
+  if (expectedDestination !== intent.destinationUsdcAta) {
+    reject(
+      "destination_mismatch",
+      "Withdrawal destination must be the agent wallet's USDC ATA"
+    );
+  }
+  const decoded = decodeIntentTransaction({
+    serializedTransaction: params.serializedTransaction,
+    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
+  });
+  if (decoded.messageHash !== intent.preparedMessageHash) {
+    reject("message_hash_mismatch", "Prepared message hash mismatch");
+  }
+  if (decoded.feePayer !== intent.feePayer) {
+    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  }
+  let sawWithdraw = false;
+  for (const ix of decoded.instructions) {
+    switch (ix.programAddress) {
+      case COMPUTE_BUDGET_PROGRAM_ID:
+        validateComputeBudgetInstruction(ix, policy);
+        break;
+      case MEMO_PROGRAM_ID:
+      case KAMINO_FARMS_PROGRAM_ID:
+        break;
+      case ASSOCIATED_TOKEN_PROGRAM_ID2:
+        expectAtaCreateForOwner(ix, intent.wallet);
+        break;
+      case SPL_TOKEN_PROGRAM_ID: {
+        if (ix.data[0] !== 9) {
+          reject(
+            "unexpected_instruction",
+            "Only CloseAccount token instructions are allowed in withdrawals"
+          );
+        }
+        if (ix.accounts[1] !== intent.wallet || ix.accounts[2] !== intent.wallet) {
+          reject(
+            "unexpected_instruction",
+            "Withdrawal CloseAccount must pay out to the agent wallet"
+          );
+        }
+        break;
+      }
+      case KVAULT_PROGRAM_ID: {
+        validateKvaultWithdrawInstruction(ix, {
+          wallet: intent.wallet,
+          vault: intent.vault,
+          shareMint: intent.shareMint,
+          asset: intent.asset,
+          userTokenAccount: intent.destinationUsdcAta,
+          maxSharesToRedeemRaw: BigInt(intent.maxSharesToRedeemRaw),
+          allowFullExit: intent.allowFullExit
+        });
+        sawWithdraw = true;
+        break;
+      }
+      default:
+        reject(
+          "unexpected_instruction",
+          `Unexpected program ${ix.programAddress} in withdrawal transaction`
+        );
+    }
+  }
+  if (!sawWithdraw) {
+    reject("missing_instruction", "Withdrawal transaction has no KVault withdraw");
+  }
+}
+function assertVaultIntentTargets(intent) {
+  if (intent.vault !== SUBLY_VAULT.address) {
+    reject("vault_mismatch", "Unsupported vault");
+  }
+  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
+    reject("share_mint_mismatch", "Unsupported share mint");
+  }
+  if (intent.asset !== SUBLY_VAULT.usdcMint) {
+    reject("asset_mismatch", "Only USDC is supported");
+  }
+}
+function resolveIntentValidationPolicy(policy) {
+  const resolved = {
+    maxComputeUnitLimit: policy?.maxComputeUnitLimit ?? DEFAULT_MAX_COMPUTE_UNIT_LIMIT,
+    maxComputeUnitPriceMicroLamports: policy?.maxComputeUnitPriceMicroLamports ?? DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS,
+    maxTemporaryAccountLamports: policy?.maxTemporaryAccountLamports ?? MAX_TEMP_ACCOUNT_LAMPORTS
+  };
+  if (!Number.isSafeInteger(resolved.maxComputeUnitLimit) || resolved.maxComputeUnitLimit <= 0) {
+    reject("invalid_policy", "maxComputeUnitLimit must be a positive safe integer");
+  }
+  if (resolved.maxComputeUnitPriceMicroLamports < 0n) {
+    reject(
+      "invalid_policy",
+      "maxComputeUnitPriceMicroLamports must be non-negative"
+    );
+  }
+  if (resolved.maxTemporaryAccountLamports <= 0n) {
+    reject("invalid_policy", "maxTemporaryAccountLamports must be positive");
+  }
+  return resolved;
+}
+function expectComputeBudgetPair(ixs, policy) {
+  for (const discriminator of [2, 3]) {
+    const ix = ixs.shift();
+    if (ix === void 0 || ix.programAddress !== COMPUTE_BUDGET_PROGRAM_ID || ix.data[0] !== discriminator) {
+      reject(
+        "compute_budget_mismatch",
+        "Transaction must start with ComputeBudget limit and price instructions"
+      );
+    }
+    validateComputeBudgetInstruction(ix, policy);
+  }
+}
+function validateComputeBudgetInstruction(ix, policy) {
+  switch (ix.data[0]) {
+    case 2: {
+      const units = readU32LE(ix.data, 1);
+      if (units <= 0 || units > policy.maxComputeUnitLimit) {
+        reject(
+          "compute_budget_mismatch",
+          `Compute unit limit ${units} exceeds policy maximum ${policy.maxComputeUnitLimit}`
+        );
+      }
+      break;
+    }
+    case 3: {
+      const microLamports = readU64LE(ix.data, 1);
+      if (microLamports > policy.maxComputeUnitPriceMicroLamports) {
+        reject(
+          "compute_budget_mismatch",
+          `Compute unit price ${microLamports} exceeds policy maximum ${policy.maxComputeUnitPriceMicroLamports}`
+        );
+      }
+      break;
+    }
+    default:
+      reject("compute_budget_mismatch", "Unexpected ComputeBudget instruction");
+  }
+}
+function expectCreateTemporaryAccount(ixs, intent, policy) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SYSTEM_PROGRAM_ID) {
+    reject("temp_account_mismatch", "Expected System createAccount instruction");
+  }
+  if (ix.data.length < 52 || readU32LE(ix.data, 0) !== 0) {
+    reject("temp_account_mismatch", "Expected createAccount discriminator");
+  }
+  const lamports = readU64LE(ix.data, 4);
+  const space = readU64LE(ix.data, 12);
+  const owner = bs583.encode(ix.data.subarray(20, 52));
+  if (space !== 165n) {
+    reject("temp_account_mismatch", "Temporary account space must be 165 bytes");
+  }
+  if (owner !== SPL_TOKEN_PROGRAM_ID) {
+    reject("temp_account_mismatch", "Temporary account owner must be the token program");
+  }
+  if (lamports > policy.maxTemporaryAccountLamports) {
+    reject("temp_account_mismatch", "Temporary account rent exceeds the cap");
+  }
+  if (ix.accounts[0] !== intent.feePayer) {
+    reject("temp_account_mismatch", "Temporary account must be funded by the sponsor");
+  }
+  if (ix.accounts[1] !== intent.temporarySettlementTokenAccount) {
+    reject("temp_account_mismatch", "createAccount target is not the temporary account");
+  }
+}
+function expectInitializeTemporaryAccount(ixs, intent) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 18) {
+    reject("temp_account_mismatch", "Expected InitializeAccount3 instruction");
+  }
+  const owner = bs583.encode(ix.data.subarray(1, 33));
+  if (owner !== intent.wallet) {
+    reject(
+      "temp_account_mismatch",
+      "Temporary account token authority must be the agent wallet"
+    );
+  }
+  if (ix.accounts[0] !== intent.temporarySettlementTokenAccount) {
+    reject("temp_account_mismatch", "InitializeAccount3 target mismatch");
+  }
+  if (ix.accounts[1] !== intent.asset) {
+    reject("temp_account_mismatch", "Temporary account mint must be USDC");
+  }
+}
+function consumeFarmInstructions(ixs, wallet) {
+  while (ixs[0] !== void 0 && ixs[0].programAddress === KAMINO_FARMS_PROGRAM_ID) {
+    const ix = ixs.shift();
+    if (!ix.accounts.includes(wallet)) {
+      reject(
+        "farm_instruction_mismatch",
+        "Farm unstake instruction does not reference the agent wallet"
+      );
+    }
+  }
+}
+function expectKvaultWithdraw(ixs, expectation) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== KVAULT_PROGRAM_ID) {
+    reject("withdraw_mismatch", "Expected KVault withdraw instruction");
+  }
+  validateKvaultWithdrawInstruction(ix, expectation);
+}
+function validateKvaultWithdrawInstruction(ix, expectation) {
+  const isWithdraw = bytesStartWith(ix.data, KVAULT_WITHDRAW_DISCRIMINATOR);
+  const isWithdrawFromAvailable = bytesStartWith(
+    ix.data,
+    KVAULT_WITHDRAW_FROM_AVAILABLE_DISCRIMINATOR
+  );
+  if (!isWithdraw && !isWithdrawFromAvailable) {
+    reject("withdraw_mismatch", "Unexpected KVault instruction");
+  }
+  const sharesAmount = readU64LE(ix.data, 8);
+  const fullExit = sharesAmount === U64_MAX;
+  if (fullExit && !expectation.allowFullExit) {
+    reject("withdraw_mismatch", "Full-exit share burn is not allowed for this intent");
+  }
+  if (!fullExit && sharesAmount > expectation.maxSharesToRedeemRaw) {
+    reject(
+      "shares_exceed_max",
+      `Withdraw burns ${sharesAmount} shares which exceeds the approved maximum ${expectation.maxSharesToRedeemRaw}`
+    );
+  }
+  if (ix.accounts[0] !== expectation.wallet) {
+    reject("withdraw_mismatch", "Withdraw user is not the agent wallet");
+  }
+  if (ix.accounts[1] !== expectation.vault) {
+    reject("withdraw_mismatch", "Withdraw vault mismatch");
+  }
+  if (ix.accounts[5] !== expectation.userTokenAccount) {
+    reject(
+      "withdraw_mismatch",
+      "Withdraw token destination is not the approved account"
+    );
+  }
+  if (ix.accounts[6] !== expectation.asset) {
+    reject("withdraw_mismatch", "Withdraw token mint mismatch");
+  }
+  const expectedSharesAta = deriveAssociatedTokenAddress({
+    owner: expectation.wallet,
+    mint: expectation.shareMint
+  });
+  if (ix.accounts[7] !== expectedSharesAta) {
+    reject("withdraw_mismatch", "Withdraw share source must be the agent share ATA");
+  }
+  if (ix.accounts[8] !== expectation.shareMint) {
+    reject("withdraw_mismatch", "Withdraw share mint mismatch");
+  }
+}
+function expectTransferChecked(ixs, expectation) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 12) {
+    reject("transfer_mismatch", `Expected TransferChecked for ${expectation.label}`);
+  }
+  const amount = readU64LE(ix.data, 1);
+  const decimals = ix.data[9];
+  if (expectation.amount !== null && amount !== expectation.amount) {
+    reject(
+      "amount_mismatch",
+      `${expectation.label} amount ${amount} does not match ${expectation.amount}`
+    );
+  }
+  if (decimals !== USDC_DECIMALS) {
+    reject("transfer_mismatch", `${expectation.label} has unexpected decimals`);
+  }
+  if (ix.accounts[0] !== expectation.source) {
+    reject("transfer_mismatch", `${expectation.label} source mismatch`);
+  }
+  if (ix.accounts[1] !== expectation.mint) {
+    reject("transfer_mismatch", `${expectation.label} mint mismatch`);
+  }
+  if (ix.accounts[2] !== expectation.destination) {
+    reject("transfer_mismatch", `${expectation.label} destination mismatch`);
+  }
+  if (ix.accounts[3] !== expectation.authority) {
+    reject("transfer_mismatch", `${expectation.label} authority mismatch`);
+  }
+}
+function expectCloseAccount(ixs, expectation) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 9) {
+    reject("close_mismatch", "Expected CloseAccount instruction");
+  }
+  if (ix.accounts[0] !== expectation.account) {
+    reject("close_mismatch", "CloseAccount target is not the temporary account");
+  }
+  if (ix.accounts[1] !== expectation.destination) {
+    reject("close_mismatch", "CloseAccount rent destination must be the sponsor");
+  }
+  if (ix.accounts[2] !== expectation.owner) {
+    reject("close_mismatch", "CloseAccount authority must be the agent wallet");
+  }
+}
+function expectMemo(ixs, memo) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== MEMO_PROGRAM_ID) {
+    reject("memo_mismatch", "Expected Memo instruction");
+  }
+  if (Buffer.from(ix.data).toString("utf8") !== memo) {
+    reject("memo_mismatch", "Memo content does not match the paymentId");
+  }
+}
+function expectAtaCreateForOwner(ix, owner) {
+  if (ix.accounts[2] !== owner) {
+    reject(
+      "unexpected_instruction",
+      "Associated token account creation for a foreign owner"
+    );
+  }
+}
+function bytesStartWith(data, prefix) {
+  if (data.length < prefix.length) {
+    return false;
+  }
+  return prefix.every((byte, index) => data[index] === byte);
+}
+function readU64LE(data, offset) {
+  if (data.length < offset + 8) {
+    reject("invalid_transaction_encoding", "Instruction data too short for u64");
+  }
+  return Buffer.from(data.subarray(offset, offset + 8)).readBigUInt64LE(0);
+}
+function readU32LE(data, offset) {
+  if (data.length < offset + 4) {
+    reject("invalid_transaction_encoding", "Instruction data too short for u32");
+  }
+  return Buffer.from(data.subarray(offset, offset + 4)).readUInt32LE(0);
+}
+function readShortVec(bytes, startOffset) {
+  let value = 0;
+  let shift = 0;
+  let offset = startOffset;
+  while (offset < bytes.length) {
+    const byte = bytes[offset];
+    value |= (byte & 127) << shift;
+    offset += 1;
+    if ((byte & 128) === 0) {
+      return { value, nextOffset: offset };
+    }
+    shift += 7;
+    if (shift > 28) {
+      return null;
+    }
+  }
+  return null;
+}
+
+// ../../src/client/agent-wallet-signer.ts
+var LocalKeypairAgentWalletSigner = class {
+  validationMode = "structured_intent_transaction";
+  keyPairSigner;
+  validationPolicy;
+  constructor(keyPairSigner2, validationPolicy) {
+    this.keyPairSigner = keyPairSigner2;
+    this.validationPolicy = validationPolicy;
+  }
+  get walletAddress() {
+    return this.keyPairSigner.address;
+  }
+  async signPayment(params) {
+    this.assertIntentWallet(params.intent.wallet);
+    validatePaymentIntentTransaction({
+      ...params,
+      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
+    });
+    return this.sign(params.serializedTransaction);
+  }
+  async signDeposit(params) {
+    this.assertIntentWallet(params.intent.wallet);
+    validateDepositIntentTransaction({
+      ...params,
+      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
+    });
+    return this.sign(params.serializedTransaction);
+  }
+  async signWithdrawal(params) {
+    this.assertIntentWallet(params.intent.wallet);
+    validateWithdrawalIntentTransaction({
+      ...params,
+      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
+    });
+    return this.sign(params.serializedTransaction);
+  }
+  assertIntentWallet(wallet) {
+    if (wallet !== this.keyPairSigner.address) {
+      throw new IntentValidationError(
+        "wallet_mismatch",
+        "Intent wallet does not match this signer's wallet"
+      );
+    }
+  }
+  async signApiMessage(message) {
+    const signature = await signBytes(
+      this.keyPairSigner.keyPair.privateKey,
+      message
+    );
+    return bs584.encode(signature);
+  }
+  async sign(serializedTransaction) {
+    const { serializedBase64, transaction } = await addSignaturesToSerializedTransaction({
+      serializedBase64: serializedTransaction,
+      signers: [this.keyPairSigner.keyPair]
+    });
+    const agentSignature = signatureBase58ForSigner(
+      transaction,
+      this.keyPairSigner.address
+    );
+    if (agentSignature === null) {
+      throw new IntentValidationError(
+        "signing_failed",
+        "Agent signature was not produced"
+      );
+    }
+    return { serializedTransaction: serializedBase64, agentSignature };
+  }
+};
+
+// ../../src/client/lookup-tables.ts
+import { fetchAllMaybeAddressLookupTable } from "@solana-program/address-lookup-table";
+import { address, getCompiledTransactionMessageDecoder as getCompiledTransactionMessageDecoder2 } from "@solana/kit";
+function lookupTableAddressesForTransaction(serializedTransaction) {
+  const wire = Buffer.from(serializedTransaction, "base64");
+  let offset = 0;
+  let signatureCount = 0;
+  let shift = 0;
+  while (offset < wire.length) {
+    const byte = wire[offset];
+    signatureCount |= (byte & 127) << shift;
+    offset += 1;
+    if ((byte & 128) === 0) {
+      break;
+    }
+    shift += 7;
+  }
+  const messageBytes = wire.subarray(offset + signatureCount * 64);
+  const compiled = getCompiledTransactionMessageDecoder2().decode(messageBytes);
+  const lookups = compiled.addressTableLookups ?? [];
+  return lookups.map((lookup) => String(lookup.lookupTableAddress));
+}
+async function fetchLookupTablesForTransaction(rpc2, serializedTransaction) {
+  const addresses = lookupTableAddressesForTransaction(serializedTransaction);
+  if (addresses.length === 0) {
+    return {};
+  }
+  const tables = await fetchAllMaybeAddressLookupTable(
+    rpc2,
+    addresses.map((value) => address(value))
+  );
+  const result = {};
+  for (const table of tables) {
+    if (table.exists) {
+      result[table.address] = table.data.addresses.map(String);
+    }
+  }
+  return result;
+}
+
+// ../../src/api/wallet-auth.ts
+import { createHash as createHash3 } from "node:crypto";
+import bs585 from "bs58";
+import nacl from "tweetnacl";
+var WALLET_AUTH_WALLET_HEADER = "x-subly-wallet";
+var WALLET_AUTH_SIGNED_AT_HEADER = "x-subly-signed-at";
+var WALLET_AUTH_SIGNATURE_HEADER = "x-subly-signature";
+function sha256Hex(data) {
+  return createHash3("sha256").update(data, "utf8").digest("hex");
+}
+function walletAuthMessage(params) {
+  return new TextEncoder().encode(
+    `subly-api:${params.method.toUpperCase()}:${params.path}:${sha256Hex(
+      params.rawBody
+    )}:${params.signedAtMs}`
+  );
+}
+
+// ../../src/client/wallet-auth-headers.ts
+async function walletAuthHeaders(params) {
+  const signedAtMs = String(Date.now());
+  const message = walletAuthMessage({
+    method: params.method,
+    path: new URL(params.url).pathname,
+    rawBody: params.body ?? "",
+    signedAtMs
+  });
+  return {
+    [WALLET_AUTH_WALLET_HEADER]: params.signer.walletAddress,
+    [WALLET_AUTH_SIGNED_AT_HEADER]: signedAtMs,
+    [WALLET_AUTH_SIGNATURE_HEADER]: await params.signer.signApiMessage(message)
+  };
+}
+
+// ../../src/client/onboarding.ts
+var SELF_SERVE_POLICY_ID = "self-serve";
+var OnboardingError = class extends Error {
+  constructor(step, message, detail = null) {
+    super(message);
+    this.step = step;
+    this.detail = detail;
+    this.name = "OnboardingError";
+  }
+  step;
+  detail;
+};
+async function ensureWalletOnboarded(params) {
+  const fetchImpl = params.fetchImpl ?? fetch;
+  const baseUrl = params.facilitatorBaseUrl.replace(/\/$/, "");
+  const post = async (step, path, body) => {
+    const url2 = `${baseUrl}${path}`;
+    const serialized = JSON.stringify(body);
+    const response = await fetchImpl(url2, {
+      method: "POST",
+      headers: {
+        ...await walletAuthHeaders({
+          signer: params.signer,
+          method: "POST",
+          url: url2,
+          body: serialized
+        }),
+        "content-type": "application/json"
+      },
+      body: serialized
+    });
+    if (response.status !== 200) {
+      let detail = null;
+      try {
+        detail = await response.json();
+      } catch {
+        detail = null;
+      }
+      throw new OnboardingError(
+        step,
+        `wallet onboarding ${step} failed with ${response.status}`,
+        detail
+      );
+    }
+  };
+  const wallet = params.signer.walletAddress;
+  await post("register", "/v1/wallets/agent", {
+    wallet,
+    signingPolicyId: SELF_SERVE_POLICY_ID,
+    signingMode: "non_interactive",
+    signerValidationMode: params.signer.validationMode,
+    signerProvider: "local-keypair",
+    activateForPayments: true
+  });
+  await post("sync", `/v1/wallets/${wallet}/sync`, { source: "chain" });
+}
+
+// ../../src/x402/headers.ts
+import { z } from "zod";
+var PAYMENT_REQUIRED_HEADER = "payment-required";
+var PAYMENT_SIGNATURE_HEADER = "payment-signature";
+var PAYMENT_RESPONSE_HEADER = "payment-response";
+var X402_VERSION = 2;
+var MAX_HEADER_JSON_BYTES = 16384;
+var X402HeaderError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "X402HeaderError";
+    this.reason = reason;
+  }
+};
+var sublyPaymentRequirementsSchema = z.object({
+  scheme: z.literal(PAYMENT_SCHEME),
+  network: z.string().min(1),
+  asset: z.string().min(32),
+  /** Exact seller amount in raw USDC; the scheme settles exactly this. */
+  amountRawUsdc: z.string().regex(/^[1-9]\d*$/),
+  resource: z.string().url(),
+  description: z.string().optional(),
+  mimeType: z.string().optional(),
+  payTo: z.string().min(32),
+  maxTimeoutSeconds: z.number().int().positive(),
+  extra: z.object({
+    sellerRequestId: z.string().min(1),
+    seller: z.string().min(32),
+    sellerUsdcAta: z.string().min(32),
+    vault: z.string().min(32),
+    shareMint: z.string().min(32)
+  })
+}).loose();
+var paymentRequiredSchema = z.object({
+  x402Version: z.number().int(),
+  accepts: z.array(z.unknown()),
+  error: z.string().optional()
+}).loose();
+var sublyPaymentPayloadSchema = z.object({
+  x402Version: z.number().int(),
+  scheme: z.literal(PAYMENT_SCHEME),
+  network: z.string().min(1),
+  payload: z.object({
+    paymentId: z.string().min(1),
+    requestBindingHash: z.string().min(1),
+    preparedMessageHash: z.string().min(1),
+    serializedTransaction: z.string().min(1).max(4096),
+    agentSignature: z.string().min(1).max(128),
+    temporarySettlementSignature: z.string().min(1).max(128)
+  })
+}).loose();
+function encodeX402Header(value) {
+  const json = JSON.stringify(value);
+  if (Buffer.byteLength(json, "utf8") > MAX_HEADER_JSON_BYTES) {
+    throw new X402HeaderError(
+      "header_too_large",
+      `x402 header JSON exceeds ${MAX_HEADER_JSON_BYTES} bytes`
+    );
+  }
+  return Buffer.from(json, "utf8").toString("base64");
+}
+function decodeX402Header(headerValue) {
+  if (headerValue.length > Math.ceil(MAX_HEADER_JSON_BYTES * 4 / 3) + 4) {
+    throw new X402HeaderError(
+      "header_too_large",
+      `x402 header exceeds ${MAX_HEADER_JSON_BYTES} encoded bytes`
+    );
+  }
+  const json = Buffer.from(headerValue, "base64").toString("utf8");
+  try {
+    return JSON.parse(json);
+  } catch {
+    throw new X402HeaderError(
+      "invalid_header_encoding",
+      "x402 header is not base64-encoded JSON"
+    );
+  }
+}
+function decodePaymentRequiredHeader(headerValue) {
+  const parsed = paymentRequiredSchema.safeParse(decodeX402Header(headerValue));
+  if (!parsed.success) {
+    throw new X402HeaderError(
+      "invalid_payment_required",
+      "PAYMENT-REQUIRED header is not a valid x402 PaymentRequired object"
+    );
+  }
+  const sublyRequirements = parsed.data.accepts.flatMap((candidate) => {
+    const requirement = sublyPaymentRequirementsSchema.safeParse(candidate);
+    return requirement.success ? [requirement.data] : [];
+  });
+  return { paymentRequired: parsed.data, sublyRequirements };
+}
+function requestBodyHashFor(body) {
+  if (body === null || body === void 0 || body.length === 0) {
+    return EMPTY_BODY_HASH;
+  }
+  return sha256TaggedHex(
+    typeof body === "string" ? Buffer.from(body, "utf8") : Buffer.from(body)
+  );
+}
+
+// ../../src/client/paid-fetch.ts
+var PaidFetchError = class extends Error {
+  constructor(reason, message, detail = null) {
+    super(message);
+    this.reason = reason;
+    this.detail = detail;
+    this.name = "PaidFetchError";
+  }
+  reason;
+  detail;
+};
+var DEFAULT_PENDING_TTL_MS = 11e4;
+var DEFAULT_MAX_TRACKED_URLS = 1e3;
+var DEFAULT_MAX_BODY_CHARS = 2e4;
+function formatRawUsdcAmount(raw) {
+  const value = BigInt(raw);
+  const negative = value < 0n;
+  const abs = negative ? -value : value;
+  const whole = abs / 1000000n;
+  const frac = (abs % 1000000n).toString().padStart(6, "0");
+  return `${negative ? "-" : ""}${whole}.${frac}`;
+}
+var PaidFetchService = class {
+  signatureBuilder;
+  fetchImpl;
+  fetchBudget;
+  paymentStatusFor;
+  defaultMaxAmountRawUsdc;
+  pendingTtlMs;
+  maxTrackedUrls;
+  maxBodyChars;
+  nowMs;
+  stateStore;
+  pending = /* @__PURE__ */ new Map();
+  inFlight = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.signatureBuilder = config.signatureBuilder;
+    this.fetchImpl = config.fetchImpl ?? fetch;
+    this.fetchBudget = config.fetchBudget ?? (async () => null);
+    this.paymentStatusFor = config.paymentStatusFor ?? (async () => "indeterminate");
+    this.defaultMaxAmountRawUsdc = config.defaultMaxAmountRawUsdc;
+    this.pendingTtlMs = config.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    this.maxTrackedUrls = config.maxTrackedUrls ?? DEFAULT_MAX_TRACKED_URLS;
+    this.maxBodyChars = config.maxBodyChars ?? DEFAULT_MAX_BODY_CHARS;
+    this.nowMs = config.nowMs ?? (() => Date.now());
+    this.stateStore = config.stateStore ?? null;
+    if (this.stateStore !== null) {
+      for (const record of this.stateStore.load()) {
+        const { url: url2, ...entry } = record;
+        this.pending.set(url2, entry);
+      }
+    }
+  }
+  /**
+   * GET the URL, paying a 402 challenge when needed. Concurrent calls for the
+   * same URL share one flow and one result.
+   */
+  paidFetch(params) {
+    const existing = this.inFlight.get(params.url);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const flow = this.run(params).finally(() => {
+      this.inFlight.delete(params.url);
+    });
+    this.inFlight.set(params.url, flow);
+    return flow;
+  }
+  async run(params) {
+    const { url: url2 } = params;
+    const pending = this.pending.get(url2);
+    if (pending !== void 0) {
+      const expired = this.nowMs() - pending.challengeAtMs > this.pendingTtlMs;
+      if (pending.unresolved || expired) {
+        if (params.forceNewPayment === true) {
+          this.untrack(url2);
+        } else {
+          const outcome = await this.paymentStatusFor(pending.paymentId);
+          if (outcome === "not_settled") {
+            this.untrack(url2);
+          } else if (outcome === "settled") {
+            throw new PaidFetchError(
+              "payment_already_settled",
+              `the previous payment for this URL settled (paymentId=${pending.paymentId}) but the content delivery was lost, and the signature can no longer be retried. Calling again with forceNewPayment=true will PAY A SECOND TIME for the same resource.`,
+              { paymentId: pending.paymentId }
+            );
+          } else {
+            throw new PaidFetchError(
+              "payment_outcome_unknown",
+              `a previously signed payment for this URL (paymentId=${pending.paymentId}) has an unknown outcome. Verify whether it settled before purchasing again; to pay again anyway, call this tool with forceNewPayment=true.`,
+              { paymentId: pending.paymentId }
+            );
+          }
+        }
+      } else {
+        return this.deliver(url2, pending, {
+          retried: true,
+          budgetBefore: null
+        });
+      }
+    }
+    const challengeAtMs = this.nowMs();
+    const first = await this.fetchImpl(url2);
+    const firstText = await first.text();
+    if (first.status !== 402) {
+      return {
+        paid: false,
+        status: first.status,
+        body: this.truncated(firstText)
+      };
+    }
+    const challengeHeader = first.headers.get(PAYMENT_REQUIRED_HEADER);
+    if (challengeHeader === null) {
+      throw new PaidFetchError(
+        "invalid_challenge",
+        "402 response is missing the PAYMENT-REQUIRED header"
+      );
+    }
+    const requirement = decodePaymentRequiredHeader(challengeHeader).sublyRequirements[0];
+    if (requirement === void 0) {
+      throw new PaidFetchError(
+        "invalid_challenge",
+        "402 challenge contains no subly-yield-exact requirement"
+      );
+    }
+    const amountRawUsdc = BigInt(requirement.amountRawUsdc);
+    const maxAmountRawUsdc = params.maxAmountRawUsdc ?? this.defaultMaxAmountRawUsdc;
+    if (amountRawUsdc > maxAmountRawUsdc) {
+      throw new PaidFetchError(
+        "amount_exceeds_client_cap",
+        `the challenge demands ${formatRawUsdcAmount(amountRawUsdc)} USDC, above this tool call's cap of ${formatRawUsdcAmount(maxAmountRawUsdc)} USDC; nothing was paid. Raise maxAmountRawUsdc only if this price is expected.`,
+        {
+          amountRawUsdc: requirement.amountRawUsdc,
+          maxAmountRawUsdc: maxAmountRawUsdc.toString(),
+          payTo: requirement.payTo
+        }
+      );
+    }
+    const budgetBefore = await this.fetchBudget();
+    const { headerValue, paymentId } = await this.signatureBuilder.buildPaymentSignatureHeader({
+      paymentRequiredHeader: challengeHeader,
+      httpMethod: "GET",
+      url: url2
+    });
+    const entry = {
+      headerValue,
+      paymentId,
+      amountUsdc: formatRawUsdcAmount(amountRawUsdc),
+      payTo: requirement.payTo,
+      challengeAtMs,
+      unresolved: false
+    };
+    this.track(url2, entry);
+    return this.deliver(url2, entry, { retried: false, budgetBefore });
+  }
+  /**
+   * Sends the signed PAYMENT-SIGNATURE retry. The tracked entry is removed
+   * only on confirmed delivery (200). A fresh 402 proves the signature can no
+   * longer settle, so the entry is kept as an unresolved marker; every other
+   * failure keeps it retryable so the next call reuses the same signature.
+   */
+  async deliver(url2, entry, params) {
+    let second;
+    let secondText;
+    try {
+      second = await this.fetchImpl(url2, {
+        headers: { [PAYMENT_SIGNATURE_HEADER]: entry.headerValue }
+      });
+      secondText = await second.text();
+    } catch (error) {
+      throw new PaidFetchError(
+        "delivery_failed_payment_pending",
+        `delivery request failed in flight (${error instanceof Error ? error.message : String(error)}); the payment (paymentId=${entry.paymentId}) is already signed and may settle. Call this tool again with the same URL to retry delivery with the same payment signature \u2014 do NOT treat this as unpaid.`,
+        { paymentId: entry.paymentId }
+      );
+    }
+    if (second.status === 200) {
+      this.untrack(url2);
+      const transaction = receiptTransaction(second.headers);
+      return {
+        paid: true,
+        status: second.status,
+        body: this.truncated(secondText),
+        ...params.retried ? { retriedPendingPayment: true } : {},
+        payment: {
+          amountUsdc: entry.amountUsdc,
+          payTo: entry.payTo,
+          paymentId: entry.paymentId,
+          transaction,
+          solscanUrl: transaction === null ? null : `https://solscan.io/tx/${transaction}`,
+          budgetBefore: params.budgetBefore,
+          budgetAfter: await this.fetchBudget()
+        }
+      };
+    }
+    if (second.status === 402) {
+      entry.unresolved = true;
+      this.persist();
+      throw new PaidFetchError(
+        "payment_outcome_unknown",
+        `the seller no longer accepts the signed payment (paymentId=${entry.paymentId}); it may or may not have settled. Verify the payment before purchasing again; to pay again anyway, call this tool with forceNewPayment=true.`,
+        { paymentId: entry.paymentId }
+      );
+    }
+    throw new PaidFetchError(
+      "delivery_failed_payment_pending",
+      `paid delivery failed with ${second.status} (paymentId=${entry.paymentId}); the payment may already have settled. Call this tool again with the same URL to retry delivery with the same payment signature \u2014 do NOT treat this as unpaid.`,
+      {
+        paymentId: entry.paymentId,
+        status: second.status,
+        body: this.truncated(secondText)
+      }
+    );
+  }
+  track(url2, entry) {
+    if (!this.pending.has(url2) && this.pending.size >= this.maxTrackedUrls) {
+      const oldest = this.pending.keys().next();
+      if (!oldest.done) {
+        this.pending.delete(oldest.value);
+      }
+    }
+    this.pending.set(url2, entry);
+    this.persist();
+  }
+  untrack(url2) {
+    this.pending.delete(url2);
+    this.persist();
+  }
+  persist() {
+    if (this.stateStore === null) {
+      return;
+    }
+    this.stateStore.save(
+      [...this.pending.entries()].map(([url2, entry]) => ({ url: url2, ...entry }))
+    );
+  }
+  truncated(text) {
+    return text.length > this.maxBodyChars ? `${text.slice(0, this.maxBodyChars)}
+... (truncated)` : text;
+  }
+};
+function receiptTransaction(headers) {
+  try {
+    const receiptHeader = headers.get(PAYMENT_RESPONSE_HEADER);
+    if (receiptHeader === null) {
+      return null;
+    }
+    const receipt = decodeX402Header(receiptHeader);
+    return typeof receipt.transaction === "string" && receipt.transaction.length > 0 ? receipt.transaction : null;
+  } catch {
+    return null;
+  }
+}
+
+// ../../src/solana/keys.ts
+import { readFileSync } from "node:fs";
+import bs586 from "bs58";
+import {
+  createKeyPairSignerFromBytes
+} from "@solana/kit";
+async function loadKeyPairSigner(params) {
+  const { base58Secret, jsonFilePath, label } = params;
+  if (base58Secret !== void 0 && base58Secret.length > 0) {
+    const bytes = bs586.decode(base58Secret);
+    if (bytes.length !== 64) {
+      throw new Error(`${label} base58 secret must decode to 64 bytes`);
+    }
+    return createKeyPairSignerFromBytes(bytes);
+  }
+  if (jsonFilePath !== void 0 && jsonFilePath.length > 0) {
+    const raw = JSON.parse(readFileSync(jsonFilePath, "utf8"));
+    if (!Array.isArray(raw) || raw.length !== 64) {
+      throw new Error(`${label} keypair file must be a 64-byte JSON array`);
+    }
+    return createKeyPairSignerFromBytes(Uint8Array.from(raw));
+  }
+  throw new Error(`${label} keypair is not configured`);
+}
+
+// ../../src/solana/rpc.ts
+import { createSolanaRpc } from "@solana/kit";
+function createRpc(url2) {
+  return createSolanaRpc(url2);
+}
+
+// ../../src/x402/client.ts
+var X402ClientError = class extends Error {
+  reason;
+  detail;
+  constructor(reason, message, detail) {
+    super(message);
+    this.name = "X402ClientError";
+    this.reason = reason;
+    this.detail = detail;
+  }
+};
+var SublyX402Client = class {
+  config;
+  signer;
+  lookupTablesFor;
+  fetchImpl;
+  constructor(config) {
+    this.config = {
+      facilitatorBaseUrl: config.facilitatorBaseUrl.replace(/\/$/, ""),
+      network: config.network ?? SOLANA_MAINNET_NETWORK
+    };
+    this.signer = config.signer;
+    this.lookupTablesFor = config.lookupTablesFor ?? null;
+    this.fetchImpl = config.fetchImpl ?? fetch;
+  }
+  /**
+   * Builds the PAYMENT-SIGNATURE header for a 402 challenge. The request
+   * method, URL, and body must be exactly the request being retried; they are
+   * bound into the payment and verified again by the seller and facilitator.
+   */
+  async buildPaymentSignatureHeader(input) {
+    const requirement = this.selectRequirement(input.paymentRequiredHeader);
+    if (requirement.resource !== input.url) {
+      throw new X402ClientError(
+        "resource_mismatch",
+        "PAYMENT-REQUIRED resource does not match the request URL"
+      );
+    }
+    const requestBodyHash = requestBodyHashFor(input.body);
+    const prepared = await this.preparePayment({
+      requirement,
+      httpMethod: input.httpMethod.toUpperCase(),
+      requestBodyHash
+    });
+    const lookupTables = this.lookupTablesFor === null ? void 0 : await this.lookupTablesFor(prepared.intentJson.serializedTransaction);
+    const signed = await this.signer.signPayment({
+      intent: prepared.intentJson.signingIntent,
+      serializedTransaction: prepared.intentJson.serializedTransaction,
+      lookupTables
+    });
+    const payload = {
+      x402Version: X402_VERSION,
+      scheme: requirement.scheme,
+      network: requirement.network,
+      payload: {
+        paymentId: prepared.paymentId,
+        requestBindingHash: prepared.requestBindingHash,
+        preparedMessageHash: prepared.preparedMessageHash,
+        serializedTransaction: signed.serializedTransaction,
+        agentSignature: signed.agentSignature,
+        temporarySettlementSignature: prepared.temporarySettlementSignature
+      }
+    };
+    return {
+      headerValue: encodeX402Header(payload),
+      paymentId: prepared.paymentId
+    };
+  }
+  /**
+   * Convenience wrapper: performs the request, and on a 402 with a Subly
+   * requirement pays from vault yield and retries once.
+   */
+  async fetchWithPayment(url2, init) {
+    const first = await this.fetchImpl(url2, init);
+    if (first.status !== 402) {
+      return first;
+    }
+    const challenge = first.headers.get(PAYMENT_REQUIRED_HEADER);
+    if (challenge === null) {
+      return first;
+    }
+    const { headerValue } = await this.buildPaymentSignatureHeader({
+      paymentRequiredHeader: challenge,
+      httpMethod: init?.method ?? "GET",
+      url: url2,
+      body: init?.body ?? null
+    });
+    return this.fetchImpl(url2, {
+      ...init,
+      headers: {
+        ...init?.headers,
+        [PAYMENT_SIGNATURE_HEADER]: headerValue
+      }
+    });
+  }
+  selectRequirement(paymentRequiredHeader) {
+    let sublyRequirements;
+    try {
+      sublyRequirements = decodePaymentRequiredHeader(
+        paymentRequiredHeader
+      ).sublyRequirements;
+    } catch (error) {
+      throw new X402ClientError(
+        error instanceof X402HeaderError ? error.reason : "invalid_challenge",
+        "Cannot decode the PAYMENT-REQUIRED header"
+      );
+    }
+    const selected = sublyRequirements.find(
+      (candidate) => candidate.network === this.config.network && candidate.extra.vault === SUBLY_VAULT.address && candidate.extra.shareMint === SUBLY_VAULT.shareMint && candidate.asset === SUBLY_VAULT.usdcMint
+    ) ?? null;
+    if (selected === null) {
+      throw new X402ClientError(
+        "no_supported_requirement",
+        "The 402 challenge contains no supported subly-yield-exact requirement"
+      );
+    }
+    return selected;
+  }
+  async preparePayment(input) {
+    const { requirement } = input;
+    const wallet = this.signer.walletAddress;
+    const prepareUrl = `${this.config.facilitatorBaseUrl}/v1/payments/prepare`;
+    const prepareBody = JSON.stringify({
+      wallet,
+      scheme: requirement.scheme,
+      network: requirement.network,
+      vault: requirement.extra.vault,
+      shareMint: requirement.extra.shareMint,
+      asset: requirement.asset,
+      seller: requirement.extra.seller,
+      sellerRequestId: requirement.extra.sellerRequestId,
+      httpMethod: input.httpMethod,
+      canonicalResourceUrl: requirement.resource,
+      requestBodyHash: input.requestBodyHash,
+      amountRawUsdc: requirement.amountRawUsdc,
+      payTo: requirement.payTo,
+      sellerUsdcAta: requirement.extra.sellerUsdcAta,
+      dustRecipientUsdcAta: deriveAssociatedTokenAddress({
+        owner: wallet,
+        mint: SUBLY_VAULT.usdcMint
+      })
+    });
+    const response = await this.fetchImpl(prepareUrl, {
+      method: "POST",
+      headers: {
+        ...await walletAuthHeaders({
+          signer: this.signer,
+          method: "POST",
+          url: prepareUrl,
+          body: prepareBody
+        }),
+        "content-type": "application/json"
+      },
+      body: prepareBody
+    });
+    const body = await response.json();
+    if (response.status !== 200) {
+      const error = body.error;
+      throw new X402ClientError(
+        typeof error?.code === "string" ? error.code : "prepare_failed",
+        "Payment preparation failed at the facilitator",
+        body
+      );
+    }
+    const prepared = body;
+    if (typeof prepared.paymentId !== "string" || typeof prepared.preparedMessageHash !== "string" || typeof prepared.intentJson?.serializedTransaction !== "string" || typeof prepared.intentJson?.signingIntent !== "object") {
+      throw new X402ClientError(
+        "invalid_prepare_response",
+        "Facilitator prepare response is missing required fields"
+      );
+    }
+    return prepared;
+  }
+};
+
+// ../../demo/shared.ts
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+// ../../demo/pay.ts
+var url = process.argv[2];
+if (url === void 0 || !/^https?:\/\//.test(url)) {
+  fail("Usage: npm run demo:pay -- <url> [maxAmountRawUsdc]");
+}
+var maxAmountArg = process.argv[3];
+var facilitatorBaseUrl = process.env.SUBLY_FACILITATOR_URL ?? "https://api.demo.sublyfi.com";
+var rpcUrl = process.env.SOLANA_RPC_URL ?? "https://api.mainnet-beta.solana.com";
+var defaultMaxAmountRawUsdc = process.env.SUBLY_MCP_MAX_AMOUNT_RAW_USDC === void 0 ? 10000n : BigInt(process.env.SUBLY_MCP_MAX_AMOUNT_RAW_USDC);
+var pendingStatePath = process.env.SUBLY_MCP_STATE_PATH ?? "demo/env/mcp-pending-payments.json";
+var keyPairSigner = await loadKeyPairSigner({
+  base58Secret: process.env.SUBLY_DEMO_AGENT_KEYPAIR,
+  jsonFilePath: process.env.SUBLY_DEMO_AGENT_KEYPAIR_PATH,
+  label: "SUBLY_DEMO_AGENT_KEYPAIR"
+});
+var signer = new LocalKeypairAgentWalletSigner(keyPairSigner);
+var rpc = createRpc(rpcUrl);
+async function fetchBudget() {
+  try {
+    const budgetUrl = `${facilitatorBaseUrl}/v1/wallets/${signer.walletAddress}/budget`;
+    const response = await fetch(budgetUrl, {
+      headers: await walletAuthHeaders({ signer, method: "GET", url: budgetUrl })
+    });
+    if (response.status !== 200) {
+      return null;
+    }
+    const body = await response.json();
+    return body.budget === void 0 ? null : {
+      positionValueUsdc: formatRawUsdcAmount(body.budget.positionValueRawUsdc),
+      spendableYieldUsdc: formatRawUsdcAmount(
+        body.budget.spendableYieldRawUsdc
+      )
+    };
+  } catch {
+    return null;
+  }
+}
+async function paymentStatusFor(paymentId) {
+  try {
+    const statusUrl = `${facilitatorBaseUrl}/v1/payments/${paymentId}`;
+    const response = await fetch(statusUrl, {
+      headers: await walletAuthHeaders({ signer, method: "GET", url: statusUrl })
+    });
+    if (response.status !== 200) {
+      return "indeterminate";
+    }
+    const body = await response.json();
+    if (body.status === "settled") {
+      return "settled";
+    }
+    if (body.status === "expired" || body.status === "failed" || body.status === "failed_not_submitted") {
+      return "not_settled";
+    }
+    return "indeterminate";
+  } catch {
+    return "indeterminate";
+  }
+}
+function fileStateStore(path) {
+  return {
+    load() {
+      try {
+        const parsed = JSON.parse(readFileSync2(path, "utf8"));
+        return Array.isArray(parsed) ? parsed : [];
+      } catch {
+        return [];
+      }
+    },
+    save(records) {
+      try {
+        writeFileSync(path, JSON.stringify(records));
+      } catch (error) {
+        console.error(
+          `[subly-pay] failed to persist pending payments: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  };
+}
+var service = new PaidFetchService({
+  signatureBuilder: new SublyX402Client({
+    facilitatorBaseUrl,
+    signer,
+    lookupTablesFor: (serializedTransaction) => fetchLookupTablesForTransaction(rpc, serializedTransaction)
+  }),
+  defaultMaxAmountRawUsdc,
+  fetchBudget,
+  paymentStatusFor,
+  stateStore: fileStateStore(pendingStatePath)
+});
+console.error(`[subly-pay] agent ${signer.walletAddress} -> ${facilitatorBaseUrl}`);
+try {
+  await ensureWalletOnboarded({ facilitatorBaseUrl, signer });
+} catch (error) {
+  console.error(
+    `[subly-pay] onboarding skipped: ${error instanceof Error ? error.message : String(error)}`
+  );
+}
+try {
+  const result = await service.paidFetch({
+    url,
+    ...maxAmountArg === void 0 ? {} : { maxAmountRawUsdc: BigInt(maxAmountArg) }
+  });
+  process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+} catch (error) {
+  if (error instanceof PaidFetchError) {
+    process.stdout.write(
+      `${JSON.stringify(
+        { paid: false, refused: true, reason: error.reason, message: error.message, detail: error.detail },
+        null,
+        2
+      )}
+`
+    );
+    process.exit(1);
+  }
+  fail(`[subly-pay] ${error instanceof Error ? error.message : String(error)}`);
+}