@subly_fi/pay 0.6.0 → 0.6.2

package/dist/deposit.js

@@ -1,9 +1,132 @@
+// ../../src/api/wallet-auth.ts
+import { createHash } from "node:crypto";
+import bs58 from "bs58";
+import nacl from "tweetnacl";
+var WALLET_AUTH_WALLET_HEADER = "x-subly-wallet";
+var WALLET_AUTH_SIGNED_AT_HEADER = "x-subly-signed-at";
+var WALLET_AUTH_SIGNATURE_HEADER = "x-subly-signature";
+function sha256Hex(data) {
+  return createHash("sha256").update(data, "utf8").digest("hex");
+}
+function walletAuthMessage(params) {
+  return new TextEncoder().encode(
+    `subly-api:${params.method.toUpperCase()}:${params.path}:${sha256Hex(
+      params.rawBody
+    )}:${params.signedAtMs}`
+  );
+}
+
+// ../../src/client/wallet-auth-headers.ts
+async function walletAuthHeaders(params) {
+  const signedAtMs = String(Date.now());
+  const message = walletAuthMessage({
+    method: params.method,
+    path: (() => {
+      const url = new URL(params.url);
+      return url.pathname + url.search;
+    })(),
+    rawBody: params.body ?? "",
+    signedAtMs
+  });
+  return {
+    [WALLET_AUTH_WALLET_HEADER]: params.signer.walletAddress,
+    [WALLET_AUTH_SIGNED_AT_HEADER]: signedAtMs,
+    [WALLET_AUTH_SIGNATURE_HEADER]: await params.signer.signApiMessage(message)
+  };
+}
+
+// ../../src/client/onboarding.ts
+var SELF_SERVE_POLICY_ID = "self-serve";
+var OnboardingError = class extends Error {
+  constructor(step, message, detail = null) {
+    super(message);
+    this.step = step;
+    this.detail = detail;
+    this.name = "OnboardingError";
+  }
+  step;
+  detail;
+};
+async function ensureWalletOnboarded(params) {
+  const fetchImpl = params.fetchImpl ?? fetch;
+  const baseUrl = params.relayerBaseUrl.replace(/\/$/, "");
+  const post = async (step, path, body) => {
+    const url = `${baseUrl}${path}`;
+    const serialized = JSON.stringify(body);
+    const response = await fetchImpl(url, {
+      method: "POST",
+      headers: {
+        ...await walletAuthHeaders({
+          signer: params.signer,
+          method: "POST",
+          url,
+          body: serialized
+        }),
+        "content-type": "application/json"
+      },
+      body: serialized
+    });
+    if (response.status !== 200) {
+      let detail = null;
+      try {
+        detail = await response.json();
+      } catch {
+        detail = null;
+      }
+      throw new OnboardingError(
+        step,
+        `wallet onboarding ${step} failed with ${response.status}`,
+        detail
+      );
+    }
+  };
+  const wallet = params.signer.walletAddress;
+  await post("register", "/v1/wallets/agent", {
+    wallet,
+    signingPolicyId: SELF_SERVE_POLICY_ID,
+    signingMode: "non_interactive",
+    signerValidationMode: params.signer.validationMode,
+    signerProvider: params.signer.provider ?? "local-keypair",
+    activateForPayments: true
+  });
+  await post("sync", `/v1/wallets/${wallet}/sync`, { source: "chain" });
+}
+
+// ../../src/client/signer-env.ts
+import { createKeyPairSignerFromBytes as createKeyPairSignerFromBytes2 } from "@solana/kit";
+
+// ../../src/solana/keys.ts
+import { readFileSync } from "node:fs";
+import bs582 from "bs58";
+import {
+  createKeyPairSignerFromBytes
+} from "@solana/kit";
+function loadSecretKeyBytes(params) {
+  const { base58Secret, jsonFilePath, label } = params;
+  if (base58Secret !== void 0 && base58Secret.length > 0) {
+    const bytes = bs582.decode(base58Secret);
+    if (bytes.length !== 64) {
+      throw new Error(`${label} base58 secret must decode to 64 bytes`);
+    }
+    return bytes;
+  }
+  if (jsonFilePath !== void 0 && jsonFilePath.length > 0) {
+    const raw = JSON.parse(readFileSync(jsonFilePath, "utf8"));
+    if (!Array.isArray(raw) || raw.length !== 64) {
+      throw new Error(`${label} keypair file must be a 64-byte JSON array`);
+    }
+    return Uint8Array.from(raw);
+  }
+  throw new Error(`${label} keypair is not configured`);
+}
+
 // ../../src/client/agent-wallet-signer.ts
 import { signBytes } from "@solana/kit";
-import bs584 from "bs58";
+import bs587 from "bs58";
+import nacl3 from "tweetnacl";
 
 // ../../src/solana/tx.ts
-import bs58 from "bs58";
+import bs583 from "bs58";
 import {
   appendTransactionMessageInstructions,
   compileTransaction,
@@ -18,9 +141,9 @@ import {
 } from "@solana/kit";
 
 // ../../src/lib/hash.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 function sha256TaggedHex(data) {
-  return `sha256-${createHash("sha256").update(data).digest("hex")}`;
+  return `sha256-${createHash2("sha256").update(data).digest("hex")}`;
 }
 function stableStringify(value) {
   if (value === null) {
@@ -46,6 +169,24 @@ function hashStableJson(value) {
 function decodeSerializedTransaction(serializedBase64) {
   return getTransactionDecoder().decode(Buffer.from(serializedBase64, "base64"));
 }
+function attachExternalSignatureToTransaction(params) {
+  if (!(params.signer in params.transaction.signatures)) {
+    throw new Error(
+      `transaction does not expect a signature from ${params.signer}`
+    );
+  }
+  const transaction = Object.freeze({
+    ...params.transaction,
+    signatures: Object.freeze({
+      ...params.transaction.signatures,
+      [params.signer]: params.signature
+    })
+  });
+  return {
+    serializedBase64: getBase64EncodedWireTransaction(transaction),
+    transaction
+  };
+}
 async function addSignaturesToSerializedTransaction(params) {
   const decoded = decodeSerializedTransaction(params.serializedBase64);
   const signed = await partiallySignTransaction(params.signers, decoded);
@@ -59,11 +200,148 @@ function signatureBase58ForSigner(transaction, signer2) {
   if (signature === null || signature === void 0) {
     return null;
   }
-  return bs58.encode(signature);
+  return bs583.encode(signature);
+}
+
+// ../../src/client/remote-signer-transport.ts
+import bs584 from "bs58";
+import nacl2 from "tweetnacl";
+var RemoteSigningError = class extends Error {
+  constructor(provider, message, detail = null) {
+    super(`[${provider}] ${message}`);
+    this.provider = provider;
+    this.detail = detail;
+    this.name = "RemoteSigningError";
+  }
+  provider;
+  detail;
+};
+function ed25519PublicKeyBytes(provider, walletAddress) {
+  let bytes;
+  try {
+    bytes = bs584.decode(walletAddress);
+  } catch {
+    throw new RemoteSigningError(
+      provider,
+      `wallet address ${walletAddress} is not base58`
+    );
+  }
+  if (bytes.length !== 32) {
+    throw new RemoteSigningError(
+      provider,
+      `wallet address ${walletAddress} is not a 32-byte ed25519 key`
+    );
+  }
+  return bytes;
+}
+function verifiedEd25519Signature(params) {
+  const publicKey = ed25519PublicKeyBytes(params.provider, params.walletAddress);
+  const encoded = params.encodedSignature.trim();
+  for (const candidate of decodeSignatureCandidates(encoded)) {
+    if (nacl2.sign.detached.verify(params.message, candidate, publicKey)) {
+      return candidate;
+    }
+  }
+  throw new RemoteSigningError(
+    params.provider,
+    `signature did not verify for wallet ${params.walletAddress}`
+  );
+}
+function decodeSignatureCandidates(encoded) {
+  const candidates = [];
+  const hex = encoded.startsWith("0x") ? encoded.slice(2) : encoded;
+  if (/^[0-9a-fA-F]{128}$/.test(hex)) {
+    candidates.push(Uint8Array.from(Buffer.from(hex, "hex")));
+  }
+  try {
+    const fromBase58 = bs584.decode(encoded);
+    if (fromBase58.length === 64) {
+      candidates.push(fromBase58);
+    }
+  } catch {
+  }
+  if (/^[A-Za-z0-9+/=_-]+$/.test(encoded)) {
+    const fromBase64 = Uint8Array.from(
+      Buffer.from(encoded.replace(/-/g, "+").replace(/_/g, "/"), "base64")
+    );
+    if (fromBase64.length === 64) {
+      candidates.push(fromBase64);
+    }
+  }
+  return candidates;
+}
+async function requestVerifiedTransactionSignature(params) {
+  const { transport } = params;
+  const signedBase64 = await transport.signTransaction(
+    params.serializedTransactionBase64
+  );
+  let returned;
+  try {
+    returned = decodeSerializedTransaction(signedBase64);
+  } catch (error) {
+    throw new RemoteSigningError(
+      transport.provider,
+      "provider returned an undecodable signed transaction",
+      error
+    );
+  }
+  const signature = returned.signatures[transport.walletAddress] ?? null;
+  if (signature === null) {
+    throw new RemoteSigningError(
+      transport.provider,
+      `signed transaction is missing the signature for ${transport.walletAddress}`
+    );
+  }
+  const publicKey = params.publicKey ?? ed25519PublicKeyBytes(transport.provider, transport.walletAddress);
+  if (!nacl2.sign.detached.verify(params.messageBytes, signature, publicKey)) {
+    throw new RemoteSigningError(
+      transport.provider,
+      "returned signature does not verify over the requested transaction"
+    );
+  }
+  return signature;
+}
+async function externallySignedAgentTransaction(params) {
+  const original = decodeSerializedTransaction(params.serializedTransaction);
+  const signature = await requestVerifiedTransactionSignature({
+    transport: params.transport,
+    serializedTransactionBase64: params.serializedTransaction,
+    messageBytes: original.messageBytes
+  });
+  const attached = attachExternalSignatureToTransaction({
+    transaction: original,
+    signer: params.transport.walletAddress,
+    signature
+  });
+  return {
+    serializedTransaction: attached.serializedBase64,
+    agentSignature: bs584.encode(signature)
+  };
+}
+async function providerJsonRequest(params) {
+  const response = await params.fetchImpl(`${params.baseUrl}${params.path}`, {
+    method: params.method,
+    headers: { ...params.headers, "content-type": "application/json" },
+    ...params.body === void 0 ? {} : { body: JSON.stringify(params.body) }
+  });
+  let json = null;
+  try {
+    json = await response.json();
+  } catch {
+    json = null;
+  }
+  if (!response.ok) {
+    throw new RemoteSigningError(
+      params.provider,
+      `${params.method} ${params.path} failed with ${response.status}`,
+      json
+    );
+  }
+  return json;
 }
 
 // ../../src/client/transaction-intent-validator.ts
-import bs583 from "bs58";
+import bs586 from "bs58";
 import { getCompiledTransactionMessageDecoder } from "@solana/kit";
 
 // ../../src/config/constants.ts
@@ -71,14 +349,30 @@ var PAYMENT_SCHEME = "subly-yield-exact";
 var SOLANA_MAINNET_NETWORK = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
 var SPL_TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
 var ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+var envOr = (name, fallback) => {
+  const value = process.env[name]?.trim();
+  return value ? value : fallback;
+};
 var SUBLY_VAULT = {
   name: "Subly USDC Payment Vault Alpha",
-  address: "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr",
+  address: envOr(
+    "SUBLY_VAULT_ADDRESS",
+    "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr"
+  ),
   programId: "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd",
-  usdcMint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
-  shareMint: "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a",
+  usdcMint: envOr(
+    "SUBLY_VAULT_USDC_MINT",
+    "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"
+  ),
+  shareMint: envOr(
+    "SUBLY_VAULT_SHARE_MINT",
+    "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a"
+  ),
   lookupTable: "7UbXhDnpK7WVnwsfivzQRENoqKqAULQ5s19gS1xJrQEo",
-  farm: "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
+  farm: envOr(
+    "SUBLY_VAULT_FARM",
+    "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
+  )
 };
 var USDC_DECIMALS = 6;
 
@@ -98,8 +392,8 @@ function computeRequestBindingHash(fields) {
 }
 
 // ../../src/lib/associated-token-account.ts
-import { createHash as createHash2 } from "node:crypto";
-import bs582 from "bs58";
+import { createHash as createHash3 } from "node:crypto";
+import bs585 from "bs58";
 var PDA_MARKER = Buffer.from("ProgramDerivedAddress", "utf8");
 var ED25519_P = (1n << 255n) - 19n;
 var ED25519_D = mod(-121665n * modPow(121666n, ED25519_P - 2n, ED25519_P), ED25519_P);
@@ -120,13 +414,13 @@ function deriveAssociatedTokenAddress(params) {
       associatedTokenProgramId
     );
     if (address2 !== null) {
-      return bs582.encode(address2);
+      return bs585.encode(address2);
     }
   }
   throw new Error("Unable to derive associated token account address");
 }
 function createProgramAddress(seeds, programId) {
-  const hash = createHash2("sha256");
+  const hash = createHash3("sha256");
   for (const seed of seeds) {
     hash.update(seed);
   }
@@ -136,7 +430,7 @@ function createProgramAddress(seeds, programId) {
   return isEd25519Point(digest) ? null : new Uint8Array(digest);
 }
 function decodePublicKey(value, fieldName) {
-  const decoded = bs582.decode(value);
+  const decoded = bs585.decode(value);
   if (decoded.length !== 32) {
     throw new Error(`${fieldName} must be a 32-byte public key`);
   }
@@ -337,6 +631,9 @@ function validatePaymentIntentTransaction(params) {
   if (intent.shareMint !== SUBLY_VAULT.shareMint) {
     reject("share_mint_mismatch", "Unsupported share mint");
   }
+  if (intent.farm !== SUBLY_VAULT.farm) {
+    reject("farm_mismatch", "Unsupported Kamino farm");
+  }
   if (intent.asset !== SUBLY_VAULT.usdcMint) {
     reject("asset_mismatch", "Only USDC payments are supported");
   }
@@ -405,7 +702,7 @@ function validatePaymentIntentTransaction(params) {
   expectComputeBudgetPair(ixs, policy);
   expectCreateTemporaryAccount(ixs, intent, policy);
   expectInitializeTemporaryAccount(ixs, intent);
-  consumeFarmInstructions(ixs, intent.wallet);
+  consumeFarmInstructions(ixs, intent);
   expectKvaultWithdraw(ixs, {
     wallet: intent.wallet,
     vault: intent.vault,
@@ -548,13 +845,27 @@ function validateWithdrawalIntentTransaction(params) {
     reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
   }
   let sawWithdraw = false;
+  let farmUserState = null;
+  let farmInstructionCount = 0;
   for (const ix of decoded.instructions) {
     switch (ix.programAddress) {
       case COMPUTE_BUDGET_PROGRAM_ID:
         validateComputeBudgetInstruction(ix, policy);
         break;
       case MEMO_PROGRAM_ID:
+        break;
       case KAMINO_FARMS_PROGRAM_ID:
+        farmInstructionCount += 1;
+        if (farmInstructionCount === 1) {
+          farmUserState = validateFarmUnstakeInstruction(ix, intent);
+        } else if (farmInstructionCount === 2) {
+          validateFarmWithdrawInstruction(ix, intent, farmUserState);
+        } else {
+          reject(
+            "farm_instruction_mismatch",
+            "Withdrawal may contain only one farm unstake and one farm withdrawal"
+          );
+        }
         break;
       case ASSOCIATED_TOKEN_PROGRAM_ID2:
         expectAtaCreateForOwner(ix, intent.wallet);
@@ -575,6 +886,12 @@ function validateWithdrawalIntentTransaction(params) {
         break;
       }
       case KVAULT_PROGRAM_ID: {
+        if (sawWithdraw) {
+          reject(
+            "withdraw_mismatch",
+            "Withdrawal may contain only one KVault withdraw instruction"
+          );
+        }
         validateKvaultWithdrawInstruction(ix, {
           wallet: intent.wallet,
           vault: intent.vault,
@@ -597,6 +914,12 @@ function validateWithdrawalIntentTransaction(params) {
   if (!sawWithdraw) {
     reject("missing_instruction", "Withdrawal transaction has no KVault withdraw");
   }
+  if (farmInstructionCount === 1) {
+    reject(
+      "farm_instruction_mismatch",
+      "A farm unstake must be followed by a farm withdrawal"
+    );
+  }
 }
 function assertVaultIntentTargets(intent) {
   if (intent.vault !== SUBLY_VAULT.address) {
@@ -605,6 +928,9 @@ function assertVaultIntentTargets(intent) {
   if (intent.shareMint !== SUBLY_VAULT.shareMint) {
     reject("share_mint_mismatch", "Unsupported share mint");
   }
+  if (intent.farm !== SUBLY_VAULT.farm) {
+    reject("farm_mismatch", "Unsupported Kamino farm");
+  }
   if (intent.asset !== SUBLY_VAULT.usdcMint) {
     reject("asset_mismatch", "Only USDC is supported");
   }
@@ -677,7 +1003,7 @@ function expectCreateTemporaryAccount(ixs, intent, policy) {
   }
   const lamports = readU64LE(ix.data, 4);
   const space = readU64LE(ix.data, 12);
-  const owner = bs583.encode(ix.data.subarray(20, 52));
+  const owner = bs586.encode(ix.data.subarray(20, 52));
   if (space !== 165n) {
     reject("temp_account_mismatch", "Temporary account space must be 165 bytes");
   }
@@ -699,7 +1025,7 @@ function expectInitializeTemporaryAccount(ixs, intent) {
   if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 18) {
     reject("temp_account_mismatch", "Expected InitializeAccount3 instruction");
   }
-  const owner = bs583.encode(ix.data.subarray(1, 33));
+  const owner = bs586.encode(ix.data.subarray(1, 33));
   if (owner !== intent.wallet) {
     reject(
       "temp_account_mismatch",
@@ -713,15 +1039,90 @@ function expectInitializeTemporaryAccount(ixs, intent) {
     reject("temp_account_mismatch", "Temporary account mint must be USDC");
   }
 }
-function consumeFarmInstructions(ixs, wallet) {
-  while (ixs[0] !== void 0 && ixs[0].programAddress === KAMINO_FARMS_PROGRAM_ID) {
-    const ix = ixs.shift();
-    if (!ix.accounts.includes(wallet)) {
-      reject(
-        "farm_instruction_mismatch",
-        "Farm unstake instruction does not reference the agent wallet"
-      );
-    }
+function consumeFarmInstructions(ixs, intent) {
+  if (ixs[0]?.programAddress !== KAMINO_FARMS_PROGRAM_ID) {
+    return;
+  }
+  const unstake = ixs.shift();
+  const userState = validateFarmUnstakeInstruction(unstake, intent);
+  if (ixs[0]?.programAddress !== KAMINO_FARMS_PROGRAM_ID) {
+    reject(
+      "farm_instruction_mismatch",
+      "A farm unstake must be followed by a farm withdrawal"
+    );
+  }
+  const withdraw = ixs.shift();
+  validateFarmWithdrawInstruction(withdraw, intent, userState);
+  if (ixs[0]?.programAddress === KAMINO_FARMS_PROGRAM_ID) {
+    reject(
+      "farm_instruction_mismatch",
+      "Payment may contain only one farm unstake and one farm withdrawal"
+    );
+  }
+}
+var KAMINO_FARMS_UNSTAKE_DISCRIMINATOR = Uint8Array.from([
+  90,
+  95,
+  107,
+  42,
+  205,
+  124,
+  50,
+  225
+]);
+var KAMINO_FARMS_WITHDRAW_UNSTAKED_DISCRIMINATOR = Uint8Array.from([
+  36,
+  102,
+  187,
+  49,
+  220,
+  36,
+  132,
+  67
+]);
+function validateFarmUnstakeInstruction(ix, intent) {
+  if (ix.programAddress !== KAMINO_FARMS_PROGRAM_ID || !bytesStartWith(ix.data, KAMINO_FARMS_UNSTAKE_DISCRIMINATOR) || ix.data.length !== 24 || readU128LE(ix.data, 8) <= 0n) {
+    reject(
+      "farm_instruction_mismatch",
+      "Expected a non-zero Kamino farm unstake instruction"
+    );
+  }
+  if (ix.accounts.length !== 4) {
+    reject(
+      "farm_instruction_mismatch",
+      "Farm unstake account list is not canonical"
+    );
+  }
+  if (ix.accounts[0] !== intent.wallet) {
+    reject("farm_instruction_mismatch", "Farm unstake owner must be the agent wallet");
+  }
+  if (ix.accounts[2] !== intent.farm) {
+    reject("farm_instruction_mismatch", "Farm unstake target is not the approved farm");
+  }
+  return ix.accounts[1];
+}
+function validateFarmWithdrawInstruction(ix, intent, expectedUserState) {
+  if (ix.programAddress !== KAMINO_FARMS_PROGRAM_ID || !bytesStartWith(ix.data, KAMINO_FARMS_WITHDRAW_UNSTAKED_DISCRIMINATOR) || ix.data.length !== 8) {
+    reject(
+      "farm_instruction_mismatch",
+      "Expected a canonical Kamino farm withdrawal instruction"
+    );
+  }
+  if (ix.accounts.length !== 7) {
+    reject(
+      "farm_instruction_mismatch",
+      "Farm withdrawal account list is not canonical"
+    );
+  }
+  const expectedSharesAta = deriveAssociatedTokenAddress({
+    owner: intent.wallet,
+    mint: intent.shareMint
+  });
+  if (ix.accounts[0] !== intent.wallet || ix.accounts[1] !== expectedUserState || ix.accounts[2] !== intent.farm || ix.accounts[3] !== expectedSharesAta || ix.accounts[6] !== SPL_TOKEN_PROGRAM_ID) {
+    reject(
+      "farm_instruction_mismatch",
+      "Farm withdrawal must return the approved vault shares to the agent wallet"
+    );
   }
 }
 function expectKvaultWithdraw(ixs, expectation) {
@@ -856,6 +1257,16 @@ function readU32LE(data, offset) {
   }
   return Buffer.from(data.subarray(offset, offset + 4)).readUInt32LE(0);
 }
+function readU128LE(data, offset) {
+  if (data.length < offset + 16) {
+    reject("invalid_transaction_encoding", "Instruction data too short for u128");
+  }
+  let value = 0n;
+  for (let index = 0; index < 16; index += 1) {
+    value |= BigInt(data[offset + index]) << BigInt(index * 8);
+  }
+  return value;
+}
 function readShortVec(bytes, startOffset) {
   let value = 0;
   let shift = 0;
@@ -876,55 +1287,55 @@ function readShortVec(bytes, startOffset) {
 }
 
 // ../../src/client/agent-wallet-signer.ts
-var LocalKeypairAgentWalletSigner = class {
+var IntentValidatingAgentWalletSigner = class {
   validationMode = "structured_intent_transaction";
-  keyPairSigner;
   validationPolicy;
-  constructor(keyPairSigner2, validationPolicy) {
-    this.keyPairSigner = keyPairSigner2;
+  constructor(validationPolicy) {
     this.validationPolicy = validationPolicy;
   }
-  get walletAddress() {
-    return this.keyPairSigner.address;
-  }
   async signPayment(params) {
     this.assertIntentWallet(params.intent.wallet);
-    validatePaymentIntentTransaction({
-      ...params,
-      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
-    });
+    validatePaymentIntentTransaction({ ...params, ...this.policySpread() });
     return this.sign(params.serializedTransaction);
   }
   async signDeposit(params) {
     this.assertIntentWallet(params.intent.wallet);
-    validateDepositIntentTransaction({
-      ...params,
-      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
-    });
+    validateDepositIntentTransaction({ ...params, ...this.policySpread() });
     return this.sign(params.serializedTransaction);
   }
   async signWithdrawal(params) {
     this.assertIntentWallet(params.intent.wallet);
-    validateWithdrawalIntentTransaction({
-      ...params,
-      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
-    });
+    validateWithdrawalIntentTransaction({ ...params, ...this.policySpread() });
     return this.sign(params.serializedTransaction);
   }
+  policySpread() {
+    return this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy };
+  }
   assertIntentWallet(wallet) {
-    if (wallet !== this.keyPairSigner.address) {
+    if (wallet !== this.walletAddress) {
       throw new IntentValidationError(
         "wallet_mismatch",
         "Intent wallet does not match this signer's wallet"
       );
     }
   }
+};
+var LocalKeypairAgentWalletSigner = class extends IntentValidatingAgentWalletSigner {
+  provider = "local-keypair";
+  keyPairSigner;
+  constructor(keyPairSigner, validationPolicy) {
+    super(validationPolicy);
+    this.keyPairSigner = keyPairSigner;
+  }
+  get walletAddress() {
+    return this.keyPairSigner.address;
+  }
   async signApiMessage(message) {
     const signature = await signBytes(
       this.keyPairSigner.keyPair.privateKey,
       message
     );
-    return bs584.encode(signature);
+    return bs587.encode(signature);
   }
   async sign(serializedTransaction) {
     const { serializedBase64, transaction } = await addSignaturesToSerializedTransaction({
@@ -944,96 +1355,378 @@ var LocalKeypairAgentWalletSigner = class {
     return { serializedTransaction: serializedBase64, agentSignature };
   }
 };
+var RemoteAgentWalletSigner = class extends IntentValidatingAgentWalletSigner {
+  transport;
+  publicKey;
+  constructor(transport, validationPolicy) {
+    super(validationPolicy);
+    this.transport = transport;
+    this.publicKey = ed25519PublicKeyBytes(
+      transport.provider,
+      transport.walletAddress
+    );
+  }
+  get walletAddress() {
+    return this.transport.walletAddress;
+  }
+  get provider() {
+    return this.transport.provider;
+  }
+  async signApiMessage(message) {
+    const signature = await this.transport.signMessage(message);
+    if (!nacl3.sign.detached.verify(message, signature, this.publicKey)) {
+      throw new RemoteSigningError(
+        this.transport.provider,
+        "message signature did not verify for the agent wallet"
+      );
+    }
+    return bs587.encode(signature);
+  }
+  sign(serializedTransaction) {
+    return externallySignedAgentTransaction({
+      transport: this.transport,
+      serializedTransaction
+    });
+  }
+};
 
-// ../../src/api/wallet-auth.ts
-import { createHash as createHash3 } from "node:crypto";
-import bs585 from "bs58";
-import nacl from "tweetnacl";
-var WALLET_AUTH_WALLET_HEADER = "x-subly-wallet";
-var WALLET_AUTH_SIGNED_AT_HEADER = "x-subly-signed-at";
-var WALLET_AUTH_SIGNATURE_HEADER = "x-subly-signature";
-function sha256Hex(data) {
-  return createHash3("sha256").update(data, "utf8").digest("hex");
-}
-function walletAuthMessage(params) {
-  return new TextEncoder().encode(
-    `subly-api:${params.method.toUpperCase()}:${params.path}:${sha256Hex(
-      params.rawBody
-    )}:${params.signedAtMs}`
-  );
-}
-
-// ../../src/client/wallet-auth-headers.ts
-async function walletAuthHeaders(params) {
-  const signedAtMs = String(Date.now());
-  const message = walletAuthMessage({
-    method: params.method,
-    path: new URL(params.url).pathname,
-    rawBody: params.body ?? "",
-    signedAtMs
-  });
+// ../../src/client/signer-transports/circle.ts
+import {
+  constants,
+  createPublicKey,
+  publicEncrypt
+} from "node:crypto";
+var PROVIDER = "circle";
+var DEFAULT_BASE_URL = "https://api.circle.com";
+async function createCircleSignerTransport(config) {
+  if (!/^[0-9a-fA-F]{64}$/.test(config.entitySecret)) {
+    throw new RemoteSigningError(
+      PROVIDER,
+      "entity secret must be 32 bytes of hex (64 hex chars)"
+    );
+  }
+  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+  const fetchImpl = config.fetchImpl ?? fetch;
+  const request = async (method, path, body) => {
+    const json = await providerJsonRequest({
+      provider: PROVIDER,
+      fetchImpl,
+      baseUrl,
+      path,
+      method,
+      headers: { authorization: `Bearer ${config.apiKey}` },
+      body
+    });
+    const data = json?.data;
+    if (data === void 0) {
+      throw new RemoteSigningError(
+        PROVIDER,
+        `${method} ${path} returned no data envelope`,
+        json
+      );
+    }
+    return data;
+  };
+  const walletData = await request("GET", `/v1/w3s/wallets/${config.walletId}`);
+  const wallet = walletData.wallet;
+  if (wallet?.address === void 0) {
+    throw new RemoteSigningError(
+      PROVIDER,
+      `wallet ${config.walletId} has no address`,
+      walletData
+    );
+  }
+  if (wallet.blockchain !== "SOL") {
+    throw new RemoteSigningError(
+      PROVIDER,
+      `wallet ${config.walletId} is on ${String(
+        wallet.blockchain
+      )}, expected SOL (Solana mainnet)`
+    );
+  }
+  const walletAddress = wallet.address;
+  let entityPublicKey = null;
+  const entitySecretCiphertext = async () => {
+    if (entityPublicKey === null) {
+      const data = await request("GET", "/v1/w3s/config/entity/publicKey");
+      const publicKey = data.publicKey;
+      if (typeof publicKey !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER,
+          "entity public key response has no publicKey",
+          data
+        );
+      }
+      entityPublicKey = createPublicKey(publicKey);
+    }
+    return publicEncrypt(
+      {
+        key: entityPublicKey,
+        padding: constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: "sha256"
+      },
+      Buffer.from(config.entitySecret, "hex")
+    ).toString("base64");
+  };
   return {
-    [WALLET_AUTH_WALLET_HEADER]: params.signer.walletAddress,
-    [WALLET_AUTH_SIGNED_AT_HEADER]: signedAtMs,
-    [WALLET_AUTH_SIGNATURE_HEADER]: await params.signer.signApiMessage(message)
+    provider: PROVIDER,
+    walletAddress,
+    async signMessage(message) {
+      const data = await request("POST", "/v1/w3s/developer/sign/message", {
+        walletId: config.walletId,
+        message: `0x${Buffer.from(message).toString("hex")}`,
+        encodedByHex: true,
+        entitySecretCiphertext: await entitySecretCiphertext()
+      });
+      const signature = data.signature;
+      if (typeof signature !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER,
+          "sign/message returned no signature",
+          data
+        );
+      }
+      return verifiedEd25519Signature({
+        provider: PROVIDER,
+        encodedSignature: signature,
+        message,
+        walletAddress
+      });
+    },
+    async signTransaction(serializedTransactionBase64) {
+      const data = await request(
+        "POST",
+        "/v1/w3s/developer/sign/transaction",
+        {
+          walletId: config.walletId,
+          rawTransaction: serializedTransactionBase64,
+          entitySecretCiphertext: await entitySecretCiphertext()
+        }
+      );
+      const signedTransaction = data.signedTransaction;
+      if (typeof signedTransaction !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER,
+          "sign/transaction returned no signedTransaction",
+          data
+        );
+      }
+      return signedTransaction;
+    }
   };
 }
 
-// ../../src/client/onboarding.ts
-var SELF_SERVE_POLICY_ID = "self-serve";
-var OnboardingError = class extends Error {
-  constructor(step, message, detail = null) {
-    super(message);
-    this.step = step;
-    this.detail = detail;
-    this.name = "OnboardingError";
+// ../../src/client/signer-transports/privy.ts
+import { createPrivateKey, createSign } from "node:crypto";
+var PROVIDER2 = "privy";
+var DEFAULT_BASE_URL2 = "https://api.privy.io";
+function canonicalJson(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(",")}]`;
   }
-  step;
-  detail;
-};
-async function ensureWalletOnboarded(params) {
-  const fetchImpl = params.fetchImpl ?? fetch;
-  const baseUrl = params.relayerBaseUrl.replace(/\/$/, "");
-  const post = async (step, path, body) => {
-    const url = `${baseUrl}${path}`;
-    const serialized = JSON.stringify(body);
-    const response = await fetchImpl(url, {
-      method: "POST",
-      headers: {
-        ...await walletAuthHeaders({
-          signer: params.signer,
-          method: "POST",
-          url,
-          body: serialized
-        }),
-        "content-type": "application/json"
-      },
-      body: serialized
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function parseAuthorizationKey(base64Pkcs8) {
+  const stripped = base64Pkcs8.replace(/^wallet-auth:/, "").trim();
+  try {
+    return createPrivateKey({
+      key: Buffer.from(stripped, "base64"),
+      format: "der",
+      type: "pkcs8"
     });
-    if (response.status !== 200) {
-      let detail = null;
-      try {
-        detail = await response.json();
-      } catch {
-        detail = null;
+  } catch (error) {
+    throw new RemoteSigningError(
+      PROVIDER2,
+      "authorization key is not a base64 PKCS#8 P-256 private key",
+      error
+    );
+  }
+}
+function authorizationSignature(params) {
+  const payload = {
+    version: 1,
+    method: params.method,
+    url: params.url,
+    body: params.body,
+    headers: { "privy-app-id": params.appId }
+  };
+  const signer2 = createSign("sha256");
+  signer2.update(canonicalJson(payload));
+  return signer2.sign(params.key).toString("base64");
+}
+async function createPrivySignerTransport(config) {
+  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL2).replace(/\/$/, "");
+  const fetchImpl = config.fetchImpl ?? fetch;
+  const authorizationKey = config.authorizationPrivateKey === void 0 ? null : parseAuthorizationKey(config.authorizationPrivateKey);
+  const baseHeaders = {
+    authorization: `Basic ${Buffer.from(
+      `${config.appId}:${config.appSecret}`
+    ).toString("base64")}`,
+    "privy-app-id": config.appId
+  };
+  const request = async (method, path, body) => {
+    const headers = authorizationKey !== null && method !== "GET" && body !== void 0 ? {
+      ...baseHeaders,
+      "privy-authorization-signature": authorizationSignature({
+        key: authorizationKey,
+        appId: config.appId,
+        method,
+        url: `${baseUrl}${path}`,
+        body
+      })
+    } : baseHeaders;
+    const json = await providerJsonRequest({
+      provider: PROVIDER2,
+      fetchImpl,
+      baseUrl,
+      path,
+      method,
+      headers,
+      body
+    });
+    if (json === null || typeof json !== "object") {
+      throw new RemoteSigningError(
+        PROVIDER2,
+        `${method} ${path} returned a non-JSON body`
+      );
+    }
+    return json;
+  };
+  const rpc2 = async (body) => {
+    const response = await request(
+      "POST",
+      `/v1/wallets/${config.walletId}/rpc`,
+      body
+    );
+    const data = response.data;
+    if (data === null || typeof data !== "object") {
+      throw new RemoteSigningError(PROVIDER2, "rpc returned no data", response);
+    }
+    return data;
+  };
+  const wallet = await request("GET", `/v1/wallets/${config.walletId}`);
+  const walletAddress = wallet.address;
+  if (typeof walletAddress !== "string") {
+    throw new RemoteSigningError(
+      PROVIDER2,
+      `wallet ${config.walletId} has no address`,
+      wallet
+    );
+  }
+  if (wallet.chain_type !== "solana") {
+    throw new RemoteSigningError(
+      PROVIDER2,
+      `wallet ${config.walletId} is ${String(
+        wallet.chain_type
+      )}, expected solana`
+    );
+  }
+  return {
+    provider: PROVIDER2,
+    walletAddress,
+    async signMessage(message) {
+      const data = await rpc2({
+        chain_type: "solana",
+        method: "signMessage",
+        params: {
+          message: Buffer.from(message).toString("base64"),
+          encoding: "base64"
+        }
+      });
+      const signature = data.signature;
+      if (typeof signature !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER2,
+          "signMessage returned no signature",
+          data
+        );
       }
-      throw new OnboardingError(
-        step,
-        `wallet onboarding ${step} failed with ${response.status}`,
-        detail
+      return verifiedEd25519Signature({
+        provider: PROVIDER2,
+        encodedSignature: signature,
+        message,
+        walletAddress
+      });
+    },
+    async signTransaction(serializedTransactionBase64) {
+      const data = await rpc2({
+        chain_type: "solana",
+        method: "signTransaction",
+        params: {
+          transaction: serializedTransactionBase64,
+          encoding: "base64"
+        }
+      });
+      const signedTransaction = data.signed_transaction;
+      if (typeof signedTransaction !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER2,
+          "signTransaction returned no signed_transaction",
+          data
+        );
+      }
+      return signedTransaction;
+    }
+  };
+}
+
+// ../../src/client/signer-env.ts
+async function agentWalletSignerFromEnv(env = process.env) {
+  const nonEmpty = (value) => {
+    const trimmed = value?.trim();
+    return trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
+  };
+  const provider = nonEmpty(env.SUBLY_SIGNER_PROVIDER)?.toLowerCase() ?? "local";
+  const pickVar = (name) => nonEmpty(env[`SUBLY_${name}`]) ?? nonEmpty(env[name]);
+  const requireVar = (name) => {
+    const value = pickVar(name);
+    if (value === void 0) {
+      throw new Error(
+        `${name} (or SUBLY_${name}) is required for SUBLY_SIGNER_PROVIDER=${provider}`
       );
     }
+    return value;
   };
-  const wallet = params.signer.walletAddress;
-  await post("register", "/v1/wallets/agent", {
-    wallet,
-    signingPolicyId: SELF_SERVE_POLICY_ID,
-    signingMode: "non_interactive",
-    signerValidationMode: params.signer.validationMode,
-    signerProvider: "local-keypair",
-    activateForPayments: true
-  });
-  await post("sync", `/v1/wallets/${wallet}/sync`, { source: "chain" });
+  if (provider === "local") {
+    const localSecretKey = loadSecretKeyBytes({
+      base58Secret: env.SUBLY_DEMO_AGENT_KEYPAIR,
+      jsonFilePath: env.SUBLY_DEMO_AGENT_KEYPAIR_PATH,
+      label: "SUBLY_DEMO_AGENT_KEYPAIR"
+    });
+    return {
+      provider,
+      signer: new LocalKeypairAgentWalletSigner(
+        await createKeyPairSignerFromBytes2(localSecretKey)
+      ),
+      localSecretKey
+    };
+  }
+  if (provider === "circle") {
+    const transport = await createCircleSignerTransport({
+      apiKey: requireVar("CIRCLE_API_KEY"),
+      entitySecret: requireVar("CIRCLE_ENTITY_SECRET"),
+      walletId: requireVar("CIRCLE_WALLET_ID"),
+      baseUrl: pickVar("CIRCLE_BASE_URL")
+    });
+    return { provider, signer: new RemoteAgentWalletSigner(transport), transport };
+  }
+  if (provider === "privy") {
+    const transport = await createPrivySignerTransport({
+      appId: requireVar("PRIVY_APP_ID"),
+      appSecret: requireVar("PRIVY_APP_SECRET"),
+      walletId: requireVar("PRIVY_WALLET_ID"),
+      authorizationPrivateKey: pickVar("PRIVY_AUTHORIZATION_KEY"),
+      baseUrl: pickVar("PRIVY_BASE_URL")
+    });
+    return { provider, signer: new RemoteAgentWalletSigner(transport), transport };
+  }
+  throw new Error(
+    `unknown SUBLY_SIGNER_PROVIDER "${provider}" (expected local, circle, or privy)`
+  );
 }
 
 // ../../src/client/lookup-tables.ts
@@ -1432,31 +2125,6 @@ function parseRelayerError(text) {
   }
 }
 
-// ../../src/solana/keys.ts
-import { readFileSync } from "node:fs";
-import bs586 from "bs58";
-import {
-  createKeyPairSignerFromBytes
-} from "@solana/kit";
-async function loadKeyPairSigner(params) {
-  const { base58Secret, jsonFilePath, label } = params;
-  if (base58Secret !== void 0 && base58Secret.length > 0) {
-    const bytes = bs586.decode(base58Secret);
-    if (bytes.length !== 64) {
-      throw new Error(`${label} base58 secret must decode to 64 bytes`);
-    }
-    return createKeyPairSignerFromBytes(bytes);
-  }
-  if (jsonFilePath !== void 0 && jsonFilePath.length > 0) {
-    const raw = JSON.parse(readFileSync(jsonFilePath, "utf8"));
-    if (!Array.isArray(raw) || raw.length !== 64) {
-      throw new Error(`${label} keypair file must be a 64-byte JSON array`);
-    }
-    return createKeyPairSignerFromBytes(Uint8Array.from(raw));
-  }
-  throw new Error(`${label} keypair is not configured`);
-}
-
 // ../../src/solana/rpc.ts
 import { createSolanaRpc } from "@solana/kit";
 function createRpc(url) {
@@ -1487,12 +2155,7 @@ var approvalId = process.argv[3];
 if (approvalId !== void 0 && !/^apr_[0-9a-f]+$/i.test(approvalId)) {
   fail(`unrecognized argument: ${approvalId} (expected apr_<approvalId>)`);
 }
-var keyPairSigner = await loadKeyPairSigner({
-  base58Secret: process.env.SUBLY_DEMO_AGENT_KEYPAIR,
-  jsonFilePath: process.env.SUBLY_DEMO_AGENT_KEYPAIR_PATH,
-  label: "SUBLY_DEMO_AGENT_KEYPAIR"
-});
-var signer = new LocalKeypairAgentWalletSigner(keyPairSigner);
+var { signer } = await agentWalletSignerFromEnv();
 var rpc = createRpc(
   process.env.SOLANA_RPC_URL ?? "https://api.mainnet-beta.solana.com"
 );