@subly_fi/pay 0.6.1 → 0.7.0

package/dist/pay.js

@@ -2,104 +2,238 @@
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
 
-// ../../src/client/agent-wallet-signer.ts
-import { signBytes } from "@solana/kit";
-import bs584 from "bs58";
-
-// ../../src/solana/tx.ts
-import bs58 from "bs58";
-import {
-  appendTransactionMessageInstructions,
-  compileTransaction,
-  compressTransactionMessageUsingAddressLookupTables,
-  createTransactionMessage,
-  getBase64EncodedWireTransaction,
-  getTransactionDecoder,
-  partiallySignTransaction,
-  pipe,
-  setTransactionMessageFeePayer,
-  setTransactionMessageLifetimeUsingBlockhash
-} from "@solana/kit";
+// ../../src/config/vault-catalog.ts
+import { readFileSync } from "node:fs";
+import { z } from "zod";
 
-// ../../src/lib/hash.ts
-import { createHash } from "node:crypto";
-var EMPTY_BODY_HASH = "sha256-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
-function sha256TaggedHex(data) {
-  return `sha256-${createHash("sha256").update(data).digest("hex")}`;
+// ../../src/lib/solana-address.ts
+var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var BASE58_LOOKUP = new Map(
+  [...BASE58_ALPHABET].map((character, index) => [character, BigInt(index)])
+);
+function assertSolanaAddress(value, fieldName) {
+  if (value.length < 32 || value.length > 44) {
+    throw new Error(`${fieldName} must be a valid Solana public key`);
+  }
+  if (decodeBase58(value).length !== 32) {
+    throw new Error(`${fieldName} must be a valid Solana public key`);
+  }
+  return value;
 }
-function stableStringify(value) {
-  if (value === null) {
-    return "null";
+function decodeBase58(value) {
+  if (value.length === 0) {
+    return new Uint8Array();
   }
-  if (typeof value === "bigint") {
-    return JSON.stringify(value.toString());
+  let decoded = 0n;
+  for (const character of value) {
+    const digit = BASE58_LOOKUP.get(character);
+    if (digit === void 0) {
+      return new Uint8Array();
+    }
+    decoded = decoded * 58n + digit;
   }
-  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-    return JSON.stringify(value);
+  const bytes = [];
+  while (decoded > 0n) {
+    bytes.push(Number(decoded & 0xffn));
+    decoded >>= 8n;
   }
-  if (Array.isArray(value)) {
-    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  for (const character of value) {
+    if (character !== "1") {
+      break;
+    }
+    bytes.push(0);
   }
-  const keys = Object.keys(value).filter((key) => value[key] !== void 0).sort();
-  return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
-}
-function hashStableJson(value) {
-  return sha256TaggedHex(stableStringify(value));
+  return Uint8Array.from(bytes.reverse());
 }
 
-// ../../src/solana/tx.ts
-function decodeSerializedTransaction(serializedBase64) {
-  return getTransactionDecoder().decode(Buffer.from(serializedBase64, "base64"));
-}
-async function addSignaturesToSerializedTransaction(params) {
-  const decoded = decodeSerializedTransaction(params.serializedBase64);
-  const signed = await partiallySignTransaction(params.signers, decoded);
-  return {
-    serializedBase64: getBase64EncodedWireTransaction(signed),
-    transaction: signed
+// ../../src/config/vault.ts
+var MAINNET_USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+var KAMINO_VAULT_PROGRAM_ID = "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd";
+var NO_VAULT_FARM = "11111111111111111111111111111111";
+var DEFAULT_VAULT_CONFIG = Object.freeze({
+  address: "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr",
+  programId: KAMINO_VAULT_PROGRAM_ID,
+  usdcMint: MAINNET_USDC_MINT,
+  shareMint: "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a",
+  farm: "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
+});
+function vaultConfigFromEnv(env = process.env) {
+  const value = (name) => env[name]?.trim() || void 0;
+  const vaultAddress = value("SUBLY_VAULT_ADDRESS") ?? DEFAULT_VAULT_CONFIG.address;
+  const customVault = vaultAddress !== DEFAULT_VAULT_CONFIG.address;
+  const anchor = (name, fallback) => {
+    const configured = value(name);
+    if (customVault && configured === void 0) {
+      throw new Error(
+        `${name} is required for a custom vault. Generate its settings with npm run configure:vault -- <vault-address>; use ${NO_VAULT_FARM} for a vault without a farm.`
+      );
+    }
+    return assertSolanaAddress(configured ?? fallback, name);
   };
-}
-function signatureBase58ForSigner(transaction, signer2) {
-  const signature = transaction.signatures[signer2];
-  if (signature === null || signature === void 0) {
-    return null;
+  const usdcMint = value("SUBLY_VAULT_USDC_MINT") ?? MAINNET_USDC_MINT;
+  if (usdcMint !== MAINNET_USDC_MINT) {
+    throw new Error(
+      "SUBLY_VAULT_USDC_MINT must be mainnet USDC; other deposit assets are not supported"
+    );
   }
-  return bs58.encode(signature);
+  return Object.freeze({
+    address: assertSolanaAddress(vaultAddress, "SUBLY_VAULT_ADDRESS"),
+    programId: KAMINO_VAULT_PROGRAM_ID,
+    usdcMint,
+    shareMint: anchor("SUBLY_VAULT_SHARE_MINT", DEFAULT_VAULT_CONFIG.shareMint),
+    farm: anchor("SUBLY_VAULT_FARM", DEFAULT_VAULT_CONFIG.farm)
+  });
 }
 
-// ../../src/client/transaction-intent-validator.ts
-import bs583 from "bs58";
-import { getCompiledTransactionMessageDecoder } from "@solana/kit";
+// ../../src/config/vault-catalog.ts
+var publicKey = z.string().refine((value) => {
+  try {
+    assertSolanaAddress(value, "vault catalog address");
+    return true;
+  } catch {
+    return false;
+  }
+}, "Invalid Solana public key");
+var catalogSchema = z.object({
+  version: z.literal(1),
+  defaultVault: publicKey,
+  vaults: z.array(z.object({
+    address: publicKey,
+    programId: z.literal(KAMINO_VAULT_PROGRAM_ID),
+    usdcMint: z.literal(MAINNET_USDC_MINT),
+    shareMint: publicKey,
+    farm: publicKey,
+    name: z.string().min(1).max(128).optional(),
+    depositsEnabled: z.boolean().optional(),
+    extraLookupTables: z.array(publicKey).max(16).optional()
+  }).strict()).min(1).max(100)
+}).strict();
+function parseVaultCatalog(value) {
+  const catalog = catalogSchema.parse(value);
+  const addresses = new Set(catalog.vaults.map((vault) => vault.address));
+  if (addresses.size !== catalog.vaults.length) throw new Error("Duplicate vault in catalog");
+  if (!addresses.has(catalog.defaultVault)) throw new Error("defaultVault must be in the vault catalog");
+  return { ...catalog, vaults: catalog.vaults.map((vault) => Object.freeze(vault)) };
+}
+function vaultCatalogFromEnv(env = process.env) {
+  const path = env.SUBLY_VAULTS_FILE?.trim();
+  if (!path) {
+    const vault = vaultConfigFromEnv(env);
+    return { version: 1, defaultVault: vault.address, vaults: [vault] };
+  }
+  const catalog = parseVaultCatalog(JSON.parse(readFileSync(path, "utf8")));
+  const selected = env.SUBLY_VAULT_ADDRESS?.trim() || catalog.defaultVault;
+  if (!catalog.vaults.some((vault) => vault.address === selected)) {
+    throw new Error("SUBLY_VAULT_ADDRESS must be in SUBLY_VAULTS_FILE");
+  }
+  return { ...catalog, defaultVault: selected };
+}
+function defaultCatalogVault(catalog) {
+  return catalog.vaults.find((vault) => vault.address === catalog.defaultVault);
+}
 
 // ../../src/config/constants.ts
 var PAYMENT_SCHEME = "subly-yield-exact";
 var SOLANA_MAINNET_NETWORK = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
 var SPL_TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
 var ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
-var SUBLY_VAULT = {
-  name: "Subly USDC Payment Vault Alpha",
-  address: "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr",
-  programId: "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd",
-  usdcMint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
-  shareMint: "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a",
-  lookupTable: "7UbXhDnpK7WVnwsfivzQRENoqKqAULQ5s19gS1xJrQEo",
-  farm: "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
-};
+var SUBLY_VAULT = defaultCatalogVault(vaultCatalogFromEnv());
 var USDC_DECIMALS = 6;
 
-// ../../src/domain/request-binding.ts
-function computeRequestBindingHash(fields) {
-  return hashStableJson({
-    sellerRequestId: fields.sellerRequestId,
-    httpMethod: fields.httpMethod.toUpperCase(),
-    canonicalResourceUrl: fields.canonicalResourceUrl,
-    requestBodyHash: fields.requestBodyHash,
-    seller: fields.seller,
-    asset: fields.asset,
-    amountRawUsdc: fields.amountRawUsdc,
-    payTo: fields.payTo,
-    sellerUsdcAta: fields.sellerUsdcAta
+// ../../src/api/wallet-auth.ts
+import { createHash } from "node:crypto";
+import bs58 from "bs58";
+import nacl from "tweetnacl";
+var WALLET_AUTH_WALLET_HEADER = "x-subly-wallet";
+var WALLET_AUTH_SIGNED_AT_HEADER = "x-subly-signed-at";
+var WALLET_AUTH_SIGNATURE_HEADER = "x-subly-signature";
+function sha256Hex(data) {
+  return createHash("sha256").update(data, "utf8").digest("hex");
+}
+function walletAuthMessage(params) {
+  return new TextEncoder().encode(
+    `subly-api:${params.method.toUpperCase()}:${params.path}:${sha256Hex(
+      params.rawBody
+    )}:${params.signedAtMs}`
+  );
+}
+
+// ../../src/client/wallet-auth-headers.ts
+async function walletAuthHeaders(params) {
+  const signedAtMs = String(Date.now());
+  const message = walletAuthMessage({
+    method: params.method,
+    path: (() => {
+      const url2 = new URL(params.url);
+      return url2.pathname + url2.search;
+    })(),
+    rawBody: params.body ?? "",
+    signedAtMs
+  });
+  return {
+    [WALLET_AUTH_WALLET_HEADER]: params.signer.walletAddress,
+    [WALLET_AUTH_SIGNED_AT_HEADER]: signedAtMs,
+    [WALLET_AUTH_SIGNATURE_HEADER]: await params.signer.signApiMessage(message)
+  };
+}
+
+// ../../src/client/onboarding.ts
+var SELF_SERVE_POLICY_ID = "self-serve";
+var OnboardingError = class extends Error {
+  constructor(step, message, detail = null) {
+    super(message);
+    this.step = step;
+    this.detail = detail;
+    this.name = "OnboardingError";
+  }
+  step;
+  detail;
+};
+async function ensureWalletOnboarded(params) {
+  const fetchImpl = params.fetchImpl ?? fetch;
+  const baseUrl = params.relayerBaseUrl.replace(/\/$/, "");
+  const post = async (step, path, body2) => {
+    const url2 = `${baseUrl}${path}`;
+    const serialized = JSON.stringify(body2);
+    const response = await fetchImpl(url2, {
+      method: "POST",
+      headers: {
+        ...await walletAuthHeaders({
+          signer: params.signer,
+          method: "POST",
+          url: url2,
+          body: serialized
+        }),
+        "content-type": "application/json"
+      },
+      body: serialized
+    });
+    if (response.status !== 200) {
+      let detail = null;
+      try {
+        detail = await response.json();
+      } catch {
+        detail = null;
+      }
+      throw new OnboardingError(
+        step,
+        `wallet onboarding ${step} failed with ${response.status}`,
+        detail
+      );
+    }
+  };
+  const wallet = params.signer.walletAddress;
+  const vault = params.vault ?? params.signer.vault?.address ?? SUBLY_VAULT.address;
+  await post("register", "/v1/wallets/agent", {
+    wallet,
+    vault,
+    signingPolicyId: SELF_SERVE_POLICY_ID,
+    signingMode: "non_interactive",
+    signerValidationMode: params.signer.validationMode,
+    signerProvider: params.signer.provider ?? "local-keypair",
+    activateForPayments: true
   });
+  await post("sync", `/v1/wallets/${wallet}/sync`, { source: "chain", vault });
 }
 
 // ../../src/lib/associated-token-account.ts
@@ -120,12 +254,12 @@ function deriveAssociatedTokenAddress(params) {
     "associatedTokenProgramId"
   );
   for (let bump = 255; bump >= 0; bump -= 1) {
-    const address2 = createProgramAddress(
+    const address3 = createProgramAddress(
       [owner, tokenProgramId, mint, Uint8Array.of(bump)],
       associatedTokenProgramId
     );
-    if (address2 !== null) {
-      return bs582.encode(address2);
+    if (address3 !== null) {
+      return bs582.encode(address3);
     }
   }
   throw new Error("Unable to derive associated token account address");
@@ -194,1931 +328,2702 @@ function modPow(base, exponent, modulus) {
   return result;
 }
 
-// ../../src/client/transaction-intent-validator.ts
-var COMPUTE_BUDGET_PROGRAM_ID = "ComputeBudget111111111111111111111111111111";
-var SYSTEM_PROGRAM_ID = "11111111111111111111111111111111";
-var ASSOCIATED_TOKEN_PROGRAM_ID2 = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
-var MEMO_PROGRAM_ID = "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr";
-var KVAULT_PROGRAM_ID = "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd";
-var KAMINO_FARMS_PROGRAM_ID = "FarmsPZpWu9i7Kky8tPN37rs2TpmMrAZrC7S7vJa91Hr";
-var KVAULT_WITHDRAW_DISCRIMINATOR = Uint8Array.from([
-  183,
-  18,
-  70,
-  156,
-  148,
-  109,
-  161,
-  34
-]);
-var KVAULT_WITHDRAW_FROM_AVAILABLE_DISCRIMINATOR = Uint8Array.from([
-  19,
-  131,
-  112,
-  155,
-  170,
-  220,
-  34,
-  57
-]);
-var KVAULT_DEPOSIT_DISCRIMINATOR = Uint8Array.from([
-  242,
-  35,
-  198,
-  137,
-  82,
-  225,
-  242,
-  182
-]);
-var U64_MAX = 18446744073709551615n;
-var MAX_TEMP_ACCOUNT_LAMPORTS = 10000000n;
-var DEFAULT_MAX_COMPUTE_UNIT_LIMIT = 14e5;
-var DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS = 100000n;
-var IntentValidationError = class extends Error {
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.name = "IntentValidationError";
-    this.reason = reason;
+// ../../src/client/withdrawal-preview.ts
+var ROUNDING_RAW_USDC = 10n;
+async function assertWithdrawalPreview(input) {
+  const destination = deriveAssociatedTokenAddress({ owner: input.wallet, mint: input.vault.usdcMint });
+  const simulation = await input.rpc.simulateTransaction(
+    input.serializedTransaction,
+    {
+      encoding: "base64",
+      commitment: "confirmed",
+      sigVerify: false,
+      replaceRecentBlockhash: false,
+      innerInstructions: true
+    }
+  ).send({ abortSignal: AbortSignal.timeout(15e3) });
+  if (simulation.value.err !== null) {
+    throw new Error("Withdrawal preview failed on the client RPC; no transaction was signed. Check liquidity, RPC and blockhash, then prepare again.");
+  }
+  let received = 0n;
+  for (const group of simulation.value.innerInstructions ?? []) {
+    for (const instruction of group.instructions) {
+      if (!("parsed" in instruction) || instruction.programId !== SPL_TOKEN_PROGRAM_ID) continue;
+      const parsed = instruction.parsed;
+      if (parsed.type !== "transfer" && parsed.type !== "transferChecked") continue;
+      const info = parsed.info;
+      if (!info || info.destination !== destination && info.source !== destination) continue;
+      const raw = parsed.type === "transferChecked" ? info.tokenAmount?.amount : info.amount;
+      if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
+        throw new Error("Withdrawal preview returned an invalid token amount");
+      }
+      const amount = BigInt(raw);
+      if (info.destination === destination) received += amount;
+      if (info.source === destination) received -= amount;
+    }
   }
-};
-function reject(reason, message) {
-  throw new IntentValidationError(reason, message);
-}
-function decodeIntentTransaction(params) {
-  const wire = Buffer.from(params.serializedTransaction, "base64");
-  const signatureCount = readShortVec(wire, 0);
-  if (signatureCount === null) {
-    reject("invalid_transaction_encoding", "Cannot parse signature count");
+  if (received <= 0n || received > input.amountRawUsdc + ROUNDING_RAW_USDC || received < input.amountRawUsdc - ROUNDING_RAW_USDC) {
+    throw new Error("Withdrawal preview differs from the requested USDC amount; no transaction was signed");
   }
-  const messageOffset = signatureCount.nextOffset + signatureCount.value * 64;
-  if (messageOffset >= wire.length) {
-    reject("invalid_transaction_encoding", "Transaction has no message bytes");
+}
+
+// ../../src/client/lookup-tables.ts
+import { fetchAllMaybeAddressLookupTable } from "@solana-program/address-lookup-table";
+import { address, getCompiledTransactionMessageDecoder } from "@solana/kit";
+function lookupTableAddressesForTransaction(serializedTransaction) {
+  const wire = Buffer.from(serializedTransaction, "base64");
+  let offset = 0;
+  let signatureCount = 0;
+  let shift = 0;
+  while (offset < wire.length) {
+    const byte = wire[offset];
+    signatureCount |= (byte & 127) << shift;
+    offset += 1;
+    if ((byte & 128) === 0) {
+      break;
+    }
+    shift += 7;
   }
-  const messageBytes = wire.subarray(messageOffset);
+  const messageBytes = wire.subarray(offset + signatureCount * 64);
   const compiled = getCompiledTransactionMessageDecoder().decode(messageBytes);
-  if (compiled.version !== 0) {
-    reject("unsupported_transaction_version", "Only v0 transactions are supported");
-  }
-  const staticAccounts = compiled.staticAccounts.map(String);
-  const loadedWritable = [];
-  const loadedReadonly = [];
   const lookups = compiled.addressTableLookups ?? [];
-  for (const rawLookup of lookups) {
-    const lookup = rawLookup;
-    const table = params.lookupTables?.[String(lookup.lookupTableAddress)];
-    if (table === void 0) {
-      reject(
-        "lookup_table_unresolved",
-        `Transaction references unknown lookup table ${lookup.lookupTableAddress}`
-      );
-    }
-    const writableIndexes = lookup.writableIndexes ?? lookup.writableIndices ?? [];
-    const readonlyIndexes = lookup.readonlyIndexes ?? lookup.readableIndices ?? [];
-    for (const index of writableIndexes) {
-      const resolved = table[index];
-      if (resolved === void 0) {
-        reject("lookup_table_unresolved", "Lookup table index out of range");
-      }
-      loadedWritable.push(String(resolved));
-    }
-    for (const index of readonlyIndexes) {
-      const resolved = table[index];
-      if (resolved === void 0) {
-        reject("lookup_table_unresolved", "Lookup table index out of range");
-      }
-      loadedReadonly.push(String(resolved));
-    }
+  return lookups.map((lookup) => String(lookup.lookupTableAddress));
+}
+async function fetchLookupTablesForTransaction(rpc2, serializedTransaction) {
+  const addresses = lookupTableAddressesForTransaction(serializedTransaction);
+  if (addresses.length === 0) {
+    return {};
   }
-  const orderedAccounts = [...staticAccounts, ...loadedWritable, ...loadedReadonly];
-  const instructions = compiled.instructions.map(
-    (instruction) => {
-      const programAddress = orderedAccounts[instruction.programAddressIndex];
-      if (programAddress === void 0) {
-        reject("invalid_transaction_encoding", "Program index out of range");
-      }
-      const accounts = (instruction.accountIndices ?? []).map((index) => {
-        const account = orderedAccounts[index];
-        if (account === void 0) {
-          reject("invalid_transaction_encoding", "Account index out of range");
-        }
-        return account;
-      });
-      return {
-        programAddress,
-        accounts,
-        data: instruction.data === void 0 ? new Uint8Array() : Uint8Array.from(instruction.data)
-      };
-    }
+  const tables = await fetchAllMaybeAddressLookupTable(
+    rpc2,
+    addresses.map((value) => address(value))
   );
-  const feePayer = staticAccounts[0];
-  if (feePayer === void 0) {
-    reject("invalid_transaction_encoding", "Transaction has no fee payer");
+  const result = {};
+  for (const table of tables) {
+    if (table.exists) {
+      result[table.address] = table.data.addresses.map(String);
+    }
   }
-  return {
-    feePayer,
-    requiredSigners: staticAccounts.slice(0, compiled.header.numSignerAccounts),
-    instructions,
-    messageHash: sha256TaggedHex(Buffer.from(messageBytes))
-  };
+  return result;
 }
-function validatePaymentIntentTransaction(params) {
-  const { intent } = params;
-  const now = params.nowMs ?? Date.now();
-  const policy = resolveIntentValidationPolicy(params.policy);
-  if (new Date(intent.expiresAt).getTime() <= now) {
-    reject("expired", "Payment intent has expired");
-  }
-  if (intent.scheme !== PAYMENT_SCHEME) {
-    reject("scheme_mismatch", `scheme must be ${PAYMENT_SCHEME}`);
-  }
-  if (intent.network !== SOLANA_MAINNET_NETWORK) {
-    reject("network_mismatch", "Unsupported network");
-  }
-  if (intent.vault !== SUBLY_VAULT.address) {
-    reject("vault_mismatch", "Unsupported vault");
-  }
-  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
-    reject("share_mint_mismatch", "Unsupported share mint");
-  }
-  if (intent.asset !== SUBLY_VAULT.usdcMint) {
-    reject("asset_mismatch", "Only USDC payments are supported");
+
+// ../../src/client/vault-flows.ts
+var VaultFlowClientError = class extends Error {
+  constructor(step, message, detail = null, code = null, errorDetails = null) {
+    super(message);
+    this.step = step;
+    this.detail = detail;
+    this.code = code;
+    this.errorDetails = errorDetails;
+    this.name = "VaultFlowClientError";
   }
-  if (intent.memo !== intent.paymentId) {
-    reject("memo_mismatch", "Memo must equal the paymentId");
+  step;
+  detail;
+  code;
+  errorDetails;
+};
+var VaultFlowClient = class {
+  vault;
+  rpc;
+  baseUrl;
+  signer;
+  fetchImpl;
+  lookupTablesFor;
+  pollTimeoutMs;
+  pollIntervalMs;
+  constructor(config) {
+    this.rpc = config.rpc;
+    this.vault = config.vault ?? config.signer.vault ?? SUBLY_VAULT;
+    if (config.signer.vault && config.signer.vault.address !== this.vault.address) {
+      throw new Error("Vault flow client and signer must select the same vault");
+    }
+    this.baseUrl = config.relayerBaseUrl.replace(/\/$/, "");
+    this.signer = config.signer;
+    this.fetchImpl = config.fetchImpl ?? fetch;
+    this.lookupTablesFor = config.lookupTablesFor ?? ((serializedTransaction) => fetchLookupTablesForTransaction(config.rpc, serializedTransaction));
+    this.pollTimeoutMs = config.pollTimeoutMs ?? 9e4;
+    this.pollIntervalMs = config.pollIntervalMs ?? 2500;
   }
-  const expectedBinding = computeRequestBindingHash({
-    sellerRequestId: intent.sellerRequestId,
-    httpMethod: intent.httpMethod,
-    canonicalResourceUrl: intent.canonicalResourceUrl,
-    requestBodyHash: intent.requestBodyHash,
-    seller: intent.seller,
-    asset: intent.asset,
-    amountRawUsdc: intent.amountRawUsdc,
-    payTo: intent.payTo,
-    sellerUsdcAta: intent.sellerUsdcAta
-  });
-  if (expectedBinding !== intent.requestBindingHash) {
-    reject(
-      "request_binding_mismatch",
-      "requestBindingHash does not match the request fields"
-    );
+  /**
+   * Moves USDC from the agent wallet into the vault (fee sponsored). Under
+   * depositPolicy "owner_approval_required" the relayer refuses to prepare
+   * without an owner approval; when the caller passes none, an already
+   * APPROVED deposit approval for this exact amount (e.g. the mandate's
+   * initialDeposit — "one Face ID covers mandate + first deposit") is looked
+   * up and used automatically before surfacing deposit_approval_required.
+   */
+  async deposit(input) {
+    let approvalId2 = input.approvalId;
+    let prepared;
+    try {
+      prepared = await this.postJson("prepare", "/v1/deposits/prepare", {
+        wallet: this.signer.walletAddress,
+        vault: this.vault.address,
+        amountRawUsdc: input.amountRawUsdc.toString(),
+        ...approvalId2 === void 0 ? {} : { approvalId: approvalId2 }
+      });
+    } catch (error) {
+      if (!(error instanceof VaultFlowClientError) || error.code !== "deposit_approval_required" || approvalId2 !== void 0) {
+        throw error;
+      }
+      approvalId2 = await this.findApprovedDepositApproval(input.amountRawUsdc);
+      if (approvalId2 === void 0) {
+        throw error;
+      }
+      prepared = await this.postJson("prepare", "/v1/deposits/prepare", {
+        wallet: this.signer.walletAddress,
+        vault: this.vault.address,
+        amountRawUsdc: input.amountRawUsdc.toString(),
+        approvalId: approvalId2
+      });
+    }
+    if (prepared.signingIntent?.wallet !== this.signer.walletAddress || prepared.signingIntent.vault !== this.vault.address || prepared.signingIntent.amountRawUsdc !== input.amountRawUsdc.toString()) {
+      throw new VaultFlowClientError("prepare", "Prepared deposit differs from the requested wallet, vault or amount");
+    }
+    const signed = await this.signer.signDeposit({
+      intent: prepared.signingIntent,
+      serializedTransaction: prepared.serializedTransaction,
+      lookupTables: await this.lookupTablesFor(prepared.serializedTransaction)
+    });
+    let outcome = await this.postJson("submit", "/v1/deposits/submit", {
+      depositId: prepared.depositId,
+      serializedTransaction: signed.serializedTransaction,
+      agentSignature: signed.agentSignature
+    });
+    if (outcome.status === "submitted") {
+      outcome = await this.pollUntilTerminal(
+        `/v1/deposits/${prepared.depositId}`,
+        outcome
+      );
+    }
+    return {
+      depositId: prepared.depositId,
+      status: outcome.status,
+      txSignature: outcome.txSignature ?? null,
+      actualDepositRawUsdc: outcome.actualDepositRawUsdc ?? null,
+      sharesMintedRaw: outcome.sharesMintedRaw ?? null,
+      errorCode: outcome.errorCode ?? null
+    };
   }
-  const expectedSellerAta = deriveAssociatedTokenAddress({
-    owner: intent.payTo,
-    mint: intent.asset
-  });
-  if (expectedSellerAta !== intent.sellerUsdcAta) {
-    reject(
-      "seller_ata_mismatch",
-      "sellerUsdcAta must be the associated USDC account for payTo"
+  /**
+   * Moves USDC from the vault back to the agent wallet's USDC ATA (fee
+   * sponsored). A plain withdrawal is the exit path and MAY spend principal;
+   * with purpose "yield_realize" the relayer refuses anything beyond the
+   * spendable yield (the payment path, via RelayerYieldRealizer).
+   */
+  async withdraw(input) {
+    const prepared = await this.postJson(
+      "prepare",
+      "/v1/withdrawals/prepare",
+      {
+        wallet: this.signer.walletAddress,
+        vault: this.vault.address,
+        amountRawUsdc: input.amountRawUsdc.toString(),
+        ...input.purpose === void 0 ? {} : { purpose: input.purpose },
+        ...input.payment === void 0 ? {} : { payment: input.payment },
+        ...input.approvalId === void 0 ? {} : { approvalId: input.approvalId }
+      }
     );
+    if (prepared.signingIntent?.wallet !== this.signer.walletAddress || prepared.signingIntent.vault !== this.vault.address || prepared.requestedWithdrawRawUsdc !== input.amountRawUsdc.toString() || prepared.purpose !== (input.purpose ?? "normal") || input.purpose === "yield_realize" && prepared.signingIntent.allowFullExit) {
+      throw new VaultFlowClientError("prepare", "Prepared withdrawal differs from the requested operation");
+    }
+    await assertWithdrawalPreview({
+      rpc: this.rpc,
+      serializedTransaction: prepared.serializedTransaction,
+      wallet: this.signer.walletAddress,
+      vault: this.vault,
+      amountRawUsdc: input.amountRawUsdc
+    });
+    const signed = await this.signer.signWithdrawal({
+      intent: prepared.signingIntent,
+      serializedTransaction: prepared.serializedTransaction,
+      lookupTables: await this.lookupTablesFor(prepared.serializedTransaction)
+    });
+    let outcome = await this.postJson("submit", "/v1/withdrawals/submit", {
+      withdrawalId: prepared.withdrawalId,
+      serializedTransaction: signed.serializedTransaction,
+      agentSignature: signed.agentSignature
+    });
+    if (outcome.status === "submitted") {
+      outcome = await this.pollUntilTerminal(
+        `/v1/withdrawals/${prepared.withdrawalId}`,
+        outcome
+      );
+    }
+    return {
+      withdrawalId: prepared.withdrawalId,
+      status: outcome.status,
+      txSignature: outcome.txSignature ?? null,
+      destinationUsdcAta: prepared.destinationUsdcAta,
+      actualWithdrawRawUsdc: outcome.actualWithdrawRawUsdc ?? null,
+      actualSharesBurnedRaw: outcome.actualSharesBurnedRaw ?? null,
+      errorCode: outcome.errorCode ?? null
+    };
   }
-  const expectedDustAta = deriveAssociatedTokenAddress({
-    owner: intent.wallet,
-    mint: intent.asset
-  });
-  if (expectedDustAta !== intent.dustRecipientUsdcAta) {
-    reject(
-      "dust_recipient_mismatch",
-      "dustRecipientUsdcAta must be the agent wallet's USDC ATA"
-    );
-  }
-  const decoded = decodeIntentTransaction({
-    serializedTransaction: params.serializedTransaction,
-    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
-  });
-  if (decoded.messageHash !== intent.preparedMessageHash) {
-    reject("message_hash_mismatch", "Prepared message hash mismatch");
-  }
-  if (decoded.feePayer !== intent.feePayer) {
-    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
-  }
-  const expectedSigners = /* @__PURE__ */ new Set([
-    intent.feePayer,
-    intent.wallet,
-    intent.temporarySettlementTokenAccount
-  ]);
-  if (decoded.requiredSigners.length !== expectedSigners.size || !decoded.requiredSigners.every((signer2) => expectedSigners.has(signer2))) {
-    reject(
-      "unexpected_signers",
-      "Transaction signers must be exactly the sponsor, the agent wallet, and the temporary settlement account"
-    );
+  /**
+   * Reads the yield budget. Syncs the relayer's ledger from chain first (so
+   * yield accrued since the last sync shows up); the sync is best-effort and
+   * on failure the last-synced view is returned.
+   */
+  async getBudget(options = {}) {
+    if (options.refreshFromChain !== false) {
+      try {
+        await this.postJson(
+          "sync",
+          `/v1/wallets/${this.signer.walletAddress}/sync`,
+          { source: "chain", vault: this.vault.address }
+        );
+      } catch {
+      }
+    }
+    const url2 = `${this.baseUrl}/v1/wallets/${this.signer.walletAddress}/budget?vault=${this.vault.address}`;
+    const response = await this.fetchImpl(url2, {
+      headers: await walletAuthHeaders({
+        signer: this.signer,
+        method: "GET",
+        url: url2
+      })
+    });
+    const text = await response.text();
+    if (response.status !== 200) {
+      throw new VaultFlowClientError(
+        "budget",
+        `budget endpoint returned ${response.status}: ${text}`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw new VaultFlowClientError(
+        "budget",
+        "budget endpoint returned 200 with a non-JSON body",
+        text
+      );
+    }
+    const body2 = parsed;
+    if (body2.position?.vault !== void 0 && body2.position.vault !== this.vault.address) {
+      throw new VaultFlowClientError("budget", "Relayer returned the budget for a different vault");
+    }
+    return {
+      wallet: this.signer.walletAddress,
+      vault: this.vault.address,
+      principalBasisRawUsdc: body2.position?.principalBasisRawUsdc ?? "0",
+      positionValueRawUsdc: body2.budget?.positionValueRawUsdc ?? "0",
+      grossYieldRawUsdc: body2.budget?.grossYieldRawUsdc ?? "0",
+      spendableYieldRawUsdc: body2.budget?.spendableYieldRawUsdc ?? "0"
+    };
   }
-  const ixs = [...decoded.instructions];
-  expectComputeBudgetPair(ixs, policy);
-  expectCreateTemporaryAccount(ixs, intent, policy);
-  expectInitializeTemporaryAccount(ixs, intent);
-  consumeFarmInstructions(ixs, intent.wallet);
-  expectKvaultWithdraw(ixs, {
-    wallet: intent.wallet,
-    vault: intent.vault,
-    shareMint: intent.shareMint,
-    asset: intent.asset,
-    userTokenAccount: intent.temporarySettlementTokenAccount,
-    maxSharesToRedeemRaw: BigInt(intent.maxSharesToRedeemRaw),
-    allowFullExit: false
-  });
-  expectTransferChecked(ixs, {
-    source: intent.temporarySettlementTokenAccount,
-    mint: intent.asset,
-    destination: intent.sellerUsdcAta,
-    authority: intent.wallet,
-    amount: BigInt(intent.amountRawUsdc),
-    label: "seller transfer"
-  });
-  if (ixs[0] !== void 0 && ixs[0].programAddress === SPL_TOKEN_PROGRAM_ID && ixs[0].data[0] === 12) {
-    expectTransferChecked(ixs, {
-      source: intent.temporarySettlementTokenAccount,
-      mint: intent.asset,
-      destination: intent.dustRecipientUsdcAta,
-      authority: intent.wallet,
-      amount: null,
-      label: "dust sweep"
+  /** Best-effort audit link: reports the x402 payment tx a realize funded. */
+  async reportPayment(input) {
+    await this.postJson("submit", "/v1/payments/report", {
+      wallet: this.signer.walletAddress,
+      withdrawalId: input.withdrawalId,
+      paymentTxSignature: input.paymentTxSignature
     });
   }
-  expectCloseAccount(ixs, {
-    account: intent.temporarySettlementTokenAccount,
-    destination: intent.feePayer,
-    owner: intent.wallet
-  });
-  expectMemo(ixs, intent.memo);
-  if (ixs.length > 0) {
-    reject(
-      "unexpected_instruction",
-      `Transaction contains ${ixs.length} unexpected trailing instruction(s)`
+  /** Wallet's approvals as the relayer sees them (optionally by status). */
+  async listApprovals(status) {
+    const body2 = await this.getJson(
+      `/v1/wallets/${this.signer.walletAddress}/approvals${`?vault=${this.vault.address}${status === void 0 ? "" : `&status=${encodeURIComponent(status)}`}`}`
     );
+    return body2.approvals ?? [];
   }
-}
-function validateDepositIntentTransaction(params) {
-  const { intent } = params;
-  const now = params.nowMs ?? Date.now();
-  const policy = resolveIntentValidationPolicy(params.policy);
-  if (new Date(intent.expiresAt).getTime() <= now) {
-    reject("expired", "Deposit intent has expired");
+  /**
+   * Creates the owner-onboarding setup link (wallet-auth pins the agreed
+   * policy + initial deposit). Paste `setupUrl` into the chat verbatim.
+   */
+  async createSetupSession(input) {
+    const session = await this.postJson(
+      "prepare",
+      `/v1/wallets/${this.signer.walletAddress}/setup-sessions`,
+      {
+        vault: this.vault.address,
+        ...input.policy === void 0 ? {} : { policy: input.policy },
+        ...input.enforcementMode === void 0 ? {} : { enforcementMode: input.enforcementMode },
+        ...input.mandateTtlDays === void 0 ? {} : { mandateTtlDays: input.mandateTtlDays },
+        ...input.initialDepositRawUsdc === void 0 ? {} : { initialDepositRawUsdc: input.initialDepositRawUsdc }
+      }
+    );
+    if (session.vault !== this.vault.address || session.wallet !== this.signer.walletAddress) {
+      throw new VaultFlowClientError("prepare", "Relayer returned a setup session for a different wallet or vault");
+    }
+    return session;
   }
-  assertVaultIntentTargets(intent);
-  const decoded = decodeIntentTransaction({
-    serializedTransaction: params.serializedTransaction,
-    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
-  });
-  if (decoded.messageHash !== intent.preparedMessageHash) {
-    reject("message_hash_mismatch", "Prepared message hash mismatch");
+  /** Polls a setup session (public capability URL — no auth needed). */
+  async getSetupSession(sessionId) {
+    const url2 = `${this.baseUrl}/v1/setup-sessions/${encodeURIComponent(sessionId)}`;
+    const response = await this.fetchImpl(url2);
+    const text = await response.text();
+    if (response.status !== 200) {
+      const parsed = parseRelayerError(text);
+      throw new VaultFlowClientError(
+        "read",
+        parsed.message ?? `setup session read failed with ${response.status}`,
+        text,
+        parsed.code,
+        parsed.details
+      );
+    }
+    return JSON.parse(text);
   }
-  if (decoded.feePayer !== intent.feePayer) {
-    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  /**
+   * Finds an APPROVED, unconsumed deposit approval bound to exactly this
+   * amount — the shape the mandate's initialDeposit approval has.
+   */
+  async findApprovedDepositApproval(amountRawUsdc) {
+    try {
+      const approvals = await this.listApprovals("approved");
+      const match = approvals.find((approval) => {
+        const binding = approval.binding;
+        return binding?.kind === "deposit" && binding.amountRawUsdc === amountRawUsdc.toString();
+      });
+      return match?.approvalId;
+    } catch {
+      return void 0;
+    }
   }
-  let sawDeposit = false;
-  for (const ix of decoded.instructions) {
-    switch (ix.programAddress) {
-      case COMPUTE_BUDGET_PROGRAM_ID:
-        validateComputeBudgetInstruction(ix, policy);
-        break;
-      case ASSOCIATED_TOKEN_PROGRAM_ID2:
-        expectAtaCreateForOwner(ix, intent.wallet);
-        break;
-      case MEMO_PROGRAM_ID:
-        break;
-      case KVAULT_PROGRAM_ID: {
-        if (!bytesStartWith(ix.data, KVAULT_DEPOSIT_DISCRIMINATOR)) {
-          reject("unexpected_instruction", "Unexpected KVault instruction in deposit");
-        }
-        const maxAmount = readU64LE(ix.data, 8);
-        if (maxAmount !== BigInt(intent.amountRawUsdc)) {
-          reject("amount_mismatch", "Deposit amount does not match the intent");
-        }
-        if (ix.accounts[0] !== intent.wallet) {
-          reject("wallet_mismatch", "Deposit user is not the agent wallet");
-        }
-        if (ix.accounts[1] !== intent.vault) {
-          reject("vault_mismatch", "Deposit vault mismatch");
-        }
-        if (ix.accounts[3] !== intent.asset) {
-          reject("asset_mismatch", "Deposit token mint mismatch");
-        }
-        if (ix.accounts[5] !== intent.shareMint) {
-          reject("share_mint_mismatch", "Deposit share mint mismatch");
-        }
-        const expectedSourceAta = deriveAssociatedTokenAddress({
-          owner: intent.wallet,
-          mint: intent.asset
-        });
-        if (ix.accounts[6] !== expectedSourceAta) {
-          reject(
-            "source_ata_mismatch",
-            "Deposit source must be the agent wallet's USDC ATA"
-          );
-        }
-        sawDeposit = true;
-        break;
+  /**
+   * Polls the reconciling GET endpoint until the intent leaves "submitted"
+   * (each read looks the tx up on-chain) or the timeout elapses.
+   */
+  async pollUntilTerminal(path, last) {
+    const deadline = Date.now() + this.pollTimeoutMs;
+    let latest = last;
+    while (Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+      const url2 = `${this.baseUrl}${path}`;
+      const response = await this.fetchImpl(url2, {
+        headers: await walletAuthHeaders({
+          signer: this.signer,
+          method: "GET",
+          url: url2
+        })
+      });
+      if (response.status !== 200) {
+        continue;
+      }
+      try {
+        latest = await response.json();
+      } catch {
+        continue;
+      }
+      if (latest.status !== "submitted") {
+        return latest;
       }
-      default:
-        reject(
-          "unexpected_instruction",
-          `Unexpected program ${ix.programAddress} in deposit transaction`
-        );
     }
+    return latest;
   }
-  if (!sawDeposit) {
-    reject("missing_instruction", "Deposit transaction has no KVault deposit");
-  }
-}
-function validateWithdrawalIntentTransaction(params) {
-  const { intent } = params;
-  const now = params.nowMs ?? Date.now();
-  const policy = resolveIntentValidationPolicy(params.policy);
-  if (new Date(intent.expiresAt).getTime() <= now) {
-    reject("expired", "Withdrawal intent has expired");
-  }
-  assertVaultIntentTargets(intent);
-  const expectedDestination = deriveAssociatedTokenAddress({
-    owner: intent.wallet,
-    mint: intent.asset
-  });
-  if (expectedDestination !== intent.destinationUsdcAta) {
-    reject(
-      "destination_mismatch",
-      "Withdrawal destination must be the agent wallet's USDC ATA"
-    );
-  }
-  const decoded = decodeIntentTransaction({
-    serializedTransaction: params.serializedTransaction,
-    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
-  });
-  if (decoded.messageHash !== intent.preparedMessageHash) {
-    reject("message_hash_mismatch", "Prepared message hash mismatch");
-  }
-  if (decoded.feePayer !== intent.feePayer) {
-    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  async postJson(step, path, body2) {
+    const url2 = `${this.baseUrl}${path}`;
+    const serialized = JSON.stringify(body2);
+    const response = await this.fetchImpl(url2, {
+      method: "POST",
+      headers: {
+        ...await walletAuthHeaders({
+          signer: this.signer,
+          method: "POST",
+          url: url2,
+          body: serialized
+        }),
+        "content-type": "application/json"
+      },
+      body: serialized
+    });
+    const text = await response.text();
+    if (response.status !== 200) {
+      const parsed = parseRelayerError(text);
+      throw new VaultFlowClientError(
+        step,
+        parsed.message === null ? `${path} failed with ${response.status}: ${text}` : `${path} failed (${parsed.code ?? response.status}): ${parsed.message}`,
+        text,
+        parsed.code,
+        parsed.details
+      );
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new VaultFlowClientError(
+        step,
+        `${path} returned 200 with a non-JSON body`,
+        text
+      );
+    }
   }
-  let sawWithdraw = false;
-  for (const ix of decoded.instructions) {
-    switch (ix.programAddress) {
-      case COMPUTE_BUDGET_PROGRAM_ID:
-        validateComputeBudgetInstruction(ix, policy);
-        break;
-      case MEMO_PROGRAM_ID:
-      case KAMINO_FARMS_PROGRAM_ID:
-        break;
-      case ASSOCIATED_TOKEN_PROGRAM_ID2:
-        expectAtaCreateForOwner(ix, intent.wallet);
-        break;
-      case SPL_TOKEN_PROGRAM_ID: {
-        if (ix.data[0] !== 9) {
-          reject(
-            "unexpected_instruction",
-            "Only CloseAccount token instructions are allowed in withdrawals"
-          );
-        }
-        if (ix.accounts[1] !== intent.wallet || ix.accounts[2] !== intent.wallet) {
-          reject(
-            "unexpected_instruction",
-            "Withdrawal CloseAccount must pay out to the agent wallet"
-          );
-        }
-        break;
-      }
-      case KVAULT_PROGRAM_ID: {
-        validateKvaultWithdrawInstruction(ix, {
-          wallet: intent.wallet,
-          vault: intent.vault,
-          shareMint: intent.shareMint,
-          asset: intent.asset,
-          userTokenAccount: intent.destinationUsdcAta,
-          maxSharesToRedeemRaw: BigInt(intent.maxSharesToRedeemRaw),
-          allowFullExit: intent.allowFullExit
-        });
-        sawWithdraw = true;
-        break;
-      }
-      default:
-        reject(
-          "unexpected_instruction",
-          `Unexpected program ${ix.programAddress} in withdrawal transaction`
-        );
+  async getJson(path) {
+    const url2 = `${this.baseUrl}${path}`;
+    const response = await this.fetchImpl(url2, {
+      headers: await walletAuthHeaders({
+        signer: this.signer,
+        method: "GET",
+        url: url2
+      })
+    });
+    const text = await response.text();
+    if (response.status !== 200) {
+      const parsed = parseRelayerError(text);
+      throw new VaultFlowClientError(
+        "read",
+        parsed.message === null ? `${path} failed with ${response.status}: ${text}` : `${path} failed (${parsed.code ?? response.status}): ${parsed.message}`,
+        text,
+        parsed.code,
+        parsed.details
+      );
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new VaultFlowClientError(
+        "read",
+        `${path} returned 200 with a non-JSON body`,
+        text
+      );
     }
   }
-  if (!sawWithdraw) {
-    reject("missing_instruction", "Withdrawal transaction has no KVault withdraw");
+};
+function parseRelayerError(text) {
+  try {
+    const parsed = JSON.parse(text);
+    return {
+      code: typeof parsed.error?.code === "string" ? parsed.error.code : null,
+      message: typeof parsed.error?.message === "string" ? parsed.error.message : null,
+      details: parsed.error?.details ?? null
+    };
+  } catch {
+    return { code: null, message: null, details: null };
   }
 }
-function assertVaultIntentTargets(intent) {
-  if (intent.vault !== SUBLY_VAULT.address) {
-    reject("vault_mismatch", "Unsupported vault");
-  }
-  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
-    reject("share_mint_mismatch", "Unsupported share mint");
+
+// ../../src/client/relayer-yield-realizer.ts
+var REALIZE_OVERHEAD_RAW_USDC = 2500n;
+var RelayerRealizeError = class extends Error {
+  constructor(code, message, detail = null) {
+    super(message);
+    this.code = code;
+    this.detail = detail;
+    this.name = "RelayerRealizeError";
   }
-  if (intent.asset !== SUBLY_VAULT.usdcMint) {
-    reject("asset_mismatch", "Only USDC is supported");
+  code;
+  detail;
+};
+var RelayerYieldRealizer = class {
+  get vault() {
+    return this.vaultFlows.vault.address;
   }
-}
-function resolveIntentValidationPolicy(policy) {
-  const resolved = {
-    maxComputeUnitLimit: policy?.maxComputeUnitLimit ?? DEFAULT_MAX_COMPUTE_UNIT_LIMIT,
-    maxComputeUnitPriceMicroLamports: policy?.maxComputeUnitPriceMicroLamports ?? DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS,
-    maxTemporaryAccountLamports: policy?.maxTemporaryAccountLamports ?? MAX_TEMP_ACCOUNT_LAMPORTS
-  };
-  if (!Number.isSafeInteger(resolved.maxComputeUnitLimit) || resolved.maxComputeUnitLimit <= 0) {
-    reject("invalid_policy", "maxComputeUnitLimit must be a positive safe integer");
+  vaultFlows;
+  constructor(config) {
+    this.vaultFlows = new VaultFlowClient({
+      relayerBaseUrl: config.relayerBaseUrl,
+      signer: config.signer,
+      rpc: config.rpc,
+      ...config.fetchImpl === void 0 ? {} : { fetchImpl: config.fetchImpl },
+      ...config.lookupTablesFor === void 0 ? {} : { lookupTablesFor: config.lookupTablesFor }
+    });
   }
-  if (resolved.maxComputeUnitPriceMicroLamports < 0n) {
-    reject(
-      "invalid_policy",
-      "maxComputeUnitPriceMicroLamports must be non-negative"
-    );
+  async ensureUsdcAvailable(input) {
+    const shortfallRawUsdc = input.amountRawUsdc;
+    await this.assertSpendableYield(shortfallRawUsdc);
+    let outcome;
+    try {
+      outcome = await this.vaultFlows.withdraw({
+        amountRawUsdc: shortfallRawUsdc,
+        // The relayer refuses to prepare this withdrawal beyond the spendable
+        // yield — the principal-protection guard the client cannot bypass.
+        purpose: "yield_realize",
+        // Declares what is being paid so the relayer's spending-mandate layer
+        // can enforce caps/payee and keep the mandate → payment audit chain.
+        ...input.payment === void 0 ? {} : { payment: input.payment },
+        ...input.approvalId === void 0 ? {} : { approvalId: input.approvalId }
+      });
+    } catch (error) {
+      throw this.mapWithdrawError(error);
+    }
+    if (outcome.status !== "confirmed" || outcome.txSignature === null) {
+      throw new RelayerRealizeError(
+        "realize_not_confirmed",
+        `yield realize withdrawal did not confirm (status=${outcome.status})`,
+        outcome
+      );
+    }
+    return {
+      realizedRawUsdc: BigInt(outcome.actualWithdrawRawUsdc ?? "0"),
+      txSignature: outcome.txSignature,
+      withdrawalId: outcome.withdrawalId
+    };
   }
-  if (resolved.maxTemporaryAccountLamports <= 0n) {
-    reject("invalid_policy", "maxTemporaryAccountLamports must be positive");
+  /**
+   * Best-effort report-back of the x402 payment tx this realize funded —
+   * closes the relayer's mandate → realize → payment audit chain. Callers
+   * must never let a failure here affect the payment result.
+   */
+  async reportPayment(input) {
+    await this.vaultFlows.reportPayment(input);
   }
-  return resolved;
-}
-function expectComputeBudgetPair(ixs, policy) {
-  for (const discriminator of [2, 3]) {
-    const ix = ixs.shift();
-    if (ix === void 0 || ix.programAddress !== COMPUTE_BUDGET_PROGRAM_ID || ix.data[0] !== discriminator) {
-      reject(
-        "compute_budget_mismatch",
-        "Transaction must start with ComputeBudget limit and price instructions"
+  /**
+   * Refuses to realize more than the ledger's spendable yield (principal).
+   * getBudget syncs the relayer's ledger from chain first (best-effort), so a
+   * long-running client sees yield as it accrues instead of a frozen view.
+   */
+  async assertSpendableYield(shortfallRawUsdc) {
+    let spendable;
+    try {
+      const budget = await this.vaultFlows.getBudget();
+      spendable = BigInt(budget.spendableYieldRawUsdc);
+    } catch (error) {
+      throw new RelayerRealizeError(
+        "budget_unavailable",
+        "could not read the spendable-yield budget",
+        error
+      );
+    }
+    const requiredRawUsdc = shortfallRawUsdc + REALIZE_OVERHEAD_RAW_USDC;
+    if (spendable < requiredRawUsdc) {
+      throw new RelayerRealizeError(
+        "insufficient_yield",
+        `spendable yield ${spendable} cannot cover ${shortfallRawUsdc} raw USDC plus the ${REALIZE_OVERHEAD_RAW_USDC} raw fee headroom; the principal is never spent \u2014 wait for more yield`,
+        { spendableYieldRawUsdc: spendable.toString() }
       );
     }
-    validateComputeBudgetInstruction(ix, policy);
   }
-}
-function validateComputeBudgetInstruction(ix, policy) {
-  switch (ix.data[0]) {
-    case 2: {
-      const units = readU32LE(ix.data, 1);
-      if (units <= 0 || units > policy.maxComputeUnitLimit) {
-        reject(
-          "compute_budget_mismatch",
-          `Compute unit limit ${units} exceeds policy maximum ${policy.maxComputeUnitLimit}`
-        );
-      }
-      break;
+  mapWithdrawError(error) {
+    if (!(error instanceof VaultFlowClientError)) {
+      return new RelayerRealizeError(
+        "prepare_failed",
+        `yield realize failed: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
     }
-    case 3: {
-      const microLamports = readU64LE(ix.data, 1);
-      if (microLamports > policy.maxComputeUnitPriceMicroLamports) {
-        reject(
-          "compute_budget_mismatch",
-          `Compute unit price ${microLamports} exceeds policy maximum ${policy.maxComputeUnitPriceMicroLamports}`
-        );
-      }
-      break;
+    const serverCode = error.code ?? errorCodeFrom(error.detail);
+    if (serverCode === "approval_required") {
+      return new RelayerRealizeError(
+        "approval_required",
+        "this payment exceeds the owner-approval threshold; nothing was realized or paid. Ask the owner to approve, then retry with the approvalId",
+        error.errorDetails ?? error.detail
+      );
     }
-    default:
-      reject("compute_budget_mismatch", "Unexpected ComputeBudget instruction");
-  }
-}
-function expectCreateTemporaryAccount(ixs, intent, policy) {
-  const ix = ixs.shift();
-  if (ix === void 0 || ix.programAddress !== SYSTEM_PROGRAM_ID) {
-    reject("temp_account_mismatch", "Expected System createAccount instruction");
-  }
-  if (ix.data.length < 52 || readU32LE(ix.data, 0) !== 0) {
-    reject("temp_account_mismatch", "Expected createAccount discriminator");
-  }
-  const lamports = readU64LE(ix.data, 4);
-  const space = readU64LE(ix.data, 12);
-  const owner = bs583.encode(ix.data.subarray(20, 52));
-  if (space !== 165n) {
-    reject("temp_account_mismatch", "Temporary account space must be 165 bytes");
-  }
-  if (owner !== SPL_TOKEN_PROGRAM_ID) {
-    reject("temp_account_mismatch", "Temporary account owner must be the token program");
-  }
-  if (lamports > policy.maxTemporaryAccountLamports) {
-    reject("temp_account_mismatch", "Temporary account rent exceeds the cap");
+    if (serverCode === "insufficient_yield" || serverCode === "post_state_principal_invariant_failed") {
+      return new RelayerRealizeError(
+        "insufficient_yield",
+        "the relayer refused to realize beyond the spendable yield; the principal is never spent \u2014 wait for more yield",
+        error.detail
+      );
+    }
+    return new RelayerRealizeError(
+      error.step === "submit" ? "submit_failed" : "prepare_failed",
+      error.message,
+      error.detail
+    );
   }
-  if (ix.accounts[0] !== intent.feePayer) {
-    reject("temp_account_mismatch", "Temporary account must be funded by the sponsor");
+};
+function errorCodeFrom(detail) {
+  if (typeof detail !== "string") {
+    return null;
   }
-  if (ix.accounts[1] !== intent.temporarySettlementTokenAccount) {
-    reject("temp_account_mismatch", "createAccount target is not the temporary account");
+  try {
+    const parsed = JSON.parse(detail);
+    return typeof parsed.error?.code === "string" ? parsed.error.code : null;
+  } catch {
+    return null;
   }
 }
-function expectInitializeTemporaryAccount(ixs, intent) {
-  const ix = ixs.shift();
-  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 18) {
-    reject("temp_account_mismatch", "Expected InitializeAccount3 instruction");
+
+// ../../src/lib/canonical-json.ts
+import { createHash as createHash4 } from "node:crypto";
+
+// ../../src/lib/hash.ts
+import { createHash as createHash3 } from "node:crypto";
+var EMPTY_BODY_HASH = "sha256-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+function sha256TaggedHex(data) {
+  return `sha256-${createHash3("sha256").update(data).digest("hex")}`;
+}
+function stableStringify(value) {
+  if (value === null) {
+    return "null";
   }
-  const owner = bs583.encode(ix.data.subarray(1, 33));
-  if (owner !== intent.wallet) {
-    reject(
-      "temp_account_mismatch",
-      "Temporary account token authority must be the agent wallet"
-    );
+  if (typeof value === "bigint") {
+    return JSON.stringify(value.toString());
   }
-  if (ix.accounts[0] !== intent.temporarySettlementTokenAccount) {
-    reject("temp_account_mismatch", "InitializeAccount3 target mismatch");
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return JSON.stringify(value);
   }
-  if (ix.accounts[1] !== intent.asset) {
-    reject("temp_account_mismatch", "Temporary account mint must be USDC");
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
   }
+  const keys = Object.keys(value).filter((key) => value[key] !== void 0).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
 }
-function consumeFarmInstructions(ixs, wallet) {
-  while (ixs[0] !== void 0 && ixs[0].programAddress === KAMINO_FARMS_PROGRAM_ID) {
-    const ix = ixs.shift();
-    if (!ix.accounts.includes(wallet)) {
-      reject(
-        "farm_instruction_mismatch",
-        "Farm unstake instruction does not reference the agent wallet"
-      );
-    }
-  }
+function hashStableJson(value) {
+  return sha256TaggedHex(stableStringify(value));
 }
-function expectKvaultWithdraw(ixs, expectation) {
-  const ix = ixs.shift();
-  if (ix === void 0 || ix.programAddress !== KVAULT_PROGRAM_ID) {
-    reject("withdraw_mismatch", "Expected KVault withdraw instruction");
-  }
-  validateKvaultWithdrawInstruction(ix, expectation);
+
+// ../../src/lib/canonical-json.ts
+function sha256HexOf(data) {
+  return createHash4("sha256").update(data, "utf8").digest("hex");
 }
-function validateKvaultWithdrawInstruction(ix, expectation) {
-  const isWithdraw = bytesStartWith(ix.data, KVAULT_WITHDRAW_DISCRIMINATOR);
-  const isWithdrawFromAvailable = bytesStartWith(
-    ix.data,
-    KVAULT_WITHDRAW_FROM_AVAILABLE_DISCRIMINATOR
-  );
-  if (!isWithdraw && !isWithdrawFromAvailable) {
-    reject("withdraw_mismatch", "Unexpected KVault instruction");
-  }
-  const sharesAmount = readU64LE(ix.data, 8);
-  const fullExit = sharesAmount === U64_MAX;
-  if (fullExit && !expectation.allowFullExit) {
-    reject("withdraw_mismatch", "Full-exit share burn is not allowed for this intent");
+
+// ../../src/x402/headers.ts
+import { z as z2 } from "zod";
+var PAYMENT_REQUIRED_HEADER = "payment-required";
+var MAX_HEADER_JSON_BYTES = 16384;
+var X402HeaderError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "X402HeaderError";
+    this.reason = reason;
   }
-  if (!fullExit && sharesAmount > expectation.maxSharesToRedeemRaw) {
-    reject(
-      "shares_exceed_max",
-      `Withdraw burns ${sharesAmount} shares which exceeds the approved maximum ${expectation.maxSharesToRedeemRaw}`
+};
+var sublyPaymentRequirementsSchema = z2.object({
+  scheme: z2.literal(PAYMENT_SCHEME),
+  network: z2.string().min(1),
+  asset: z2.string().min(32),
+  /** Exact seller amount in raw USDC; the scheme settles exactly this. */
+  amountRawUsdc: z2.string().regex(/^[1-9]\d*$/),
+  resource: z2.string().url(),
+  description: z2.string().optional(),
+  mimeType: z2.string().optional(),
+  payTo: z2.string().min(32),
+  maxTimeoutSeconds: z2.number().int().positive(),
+  extra: z2.object({
+    sellerRequestId: z2.string().min(1),
+    seller: z2.string().min(32),
+    sellerUsdcAta: z2.string().min(32),
+    vault: z2.string().min(32),
+    shareMint: z2.string().min(32)
+  })
+}).loose();
+var paymentRequiredSchema = z2.object({
+  x402Version: z2.number().int(),
+  accepts: z2.array(z2.unknown()),
+  error: z2.string().optional()
+}).loose();
+var sublyPaymentPayloadSchema = z2.object({
+  x402Version: z2.number().int(),
+  scheme: z2.literal(PAYMENT_SCHEME),
+  network: z2.string().min(1),
+  payload: z2.object({
+    paymentId: z2.string().min(1),
+    requestBindingHash: z2.string().min(1),
+    preparedMessageHash: z2.string().min(1),
+    serializedTransaction: z2.string().min(1).max(4096),
+    agentSignature: z2.string().min(1).max(128),
+    temporarySettlementSignature: z2.string().min(1).max(128)
+  })
+}).loose();
+function decodeX402Header(headerValue) {
+  if (headerValue.length > Math.ceil(MAX_HEADER_JSON_BYTES * 4 / 3) + 4) {
+    throw new X402HeaderError(
+      "header_too_large",
+      `x402 header exceeds ${MAX_HEADER_JSON_BYTES} encoded bytes`
     );
   }
-  if (ix.accounts[0] !== expectation.wallet) {
-    reject("withdraw_mismatch", "Withdraw user is not the agent wallet");
-  }
-  if (ix.accounts[1] !== expectation.vault) {
-    reject("withdraw_mismatch", "Withdraw vault mismatch");
-  }
-  if (ix.accounts[5] !== expectation.userTokenAccount) {
-    reject(
-      "withdraw_mismatch",
-      "Withdraw token destination is not the approved account"
+  const json = Buffer.from(headerValue, "base64").toString("utf8");
+  try {
+    return JSON.parse(json);
+  } catch {
+    throw new X402HeaderError(
+      "invalid_header_encoding",
+      "x402 header is not base64-encoded JSON"
     );
   }
-  if (ix.accounts[6] !== expectation.asset) {
-    reject("withdraw_mismatch", "Withdraw token mint mismatch");
-  }
-  const expectedSharesAta = deriveAssociatedTokenAddress({
-    owner: expectation.wallet,
-    mint: expectation.shareMint
-  });
-  if (ix.accounts[7] !== expectedSharesAta) {
-    reject("withdraw_mismatch", "Withdraw share source must be the agent share ATA");
-  }
-  if (ix.accounts[8] !== expectation.shareMint) {
-    reject("withdraw_mismatch", "Withdraw share mint mismatch");
+}
+function requestBodyHashFor(body2) {
+  if (body2 === null || body2 === void 0 || body2.length === 0) {
+    return EMPTY_BODY_HASH;
   }
+  return sha256TaggedHex(
+    typeof body2 === "string" ? Buffer.from(body2, "utf8") : Buffer.from(body2)
+  );
 }
-function expectTransferChecked(ixs, expectation) {
-  const ix = ixs.shift();
-  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 12) {
-    reject("transfer_mismatch", `Expected TransferChecked for ${expectation.label}`);
+
+// ../../src/x402/standard-requirements.ts
+import { z as z3 } from "zod";
+var STANDARD_EXACT_SCHEME = "exact";
+var standardExactRequirementSchema = z3.object({
+  scheme: z3.literal(STANDARD_EXACT_SCHEME),
+  /** CAIP-2 chain id, e.g. "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp". */
+  network: z3.string().min(1),
+  /** SPL mint (Solana) or token contract (EVM); Subly only pays USDC/Solana. */
+  asset: z3.string().min(1),
+  /** Exact price in the asset's atomic units, as a decimal string. */
+  amount: z3.string().regex(/^[1-9]\d*$/),
+  /** Recipient wallet; the transfer destination ATA is derived from it. */
+  payTo: z3.string().min(1),
+  maxTimeoutSeconds: z3.number().int().positive().optional(),
+  extra: z3.object({
+    /** Facilitator address that pays the tx fee (gas sponsorship). */
+    feePayer: z3.string().min(1).optional()
+  }).loose().optional()
+}).loose();
+var standardPaymentRequiredSchema = z3.object({
+  x402Version: z3.number().int(),
+  accepts: z3.array(z3.unknown()),
+  error: z3.string().optional(),
+  resource: z3.object({ url: z3.string().optional() }).loose().optional()
+}).loose();
+var StandardX402ChallengeError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "StandardX402ChallengeError";
+    this.reason = reason;
   }
-  const amount = readU64LE(ix.data, 1);
-  const decimals = ix.data[9];
-  if (expectation.amount !== null && amount !== expectation.amount) {
-    reject(
-      "amount_mismatch",
-      `${expectation.label} amount ${amount} does not match ${expectation.amount}`
+};
+function parseStandardChallenge(challenge) {
+  const parsed = standardPaymentRequiredSchema.safeParse(challenge);
+  if (!parsed.success) {
+    throw new StandardX402ChallengeError(
+      "invalid_payment_required",
+      "Response is not a valid x402 PaymentRequired object"
     );
   }
-  if (decimals !== USDC_DECIMALS) {
-    reject("transfer_mismatch", `${expectation.label} has unexpected decimals`);
-  }
-  if (ix.accounts[0] !== expectation.source) {
-    reject("transfer_mismatch", `${expectation.label} source mismatch`);
-  }
-  if (ix.accounts[1] !== expectation.mint) {
-    reject("transfer_mismatch", `${expectation.label} mint mismatch`);
-  }
-  if (ix.accounts[2] !== expectation.destination) {
-    reject("transfer_mismatch", `${expectation.label} destination mismatch`);
-  }
-  if (ix.accounts[3] !== expectation.authority) {
-    reject("transfer_mismatch", `${expectation.label} authority mismatch`);
-  }
+  const solanaExactRequirements = parsed.data.accepts.flatMap((candidate) => {
+    const requirement = standardExactRequirementSchema.safeParse(candidate);
+    if (!requirement.success) {
+      return [];
+    }
+    return requirement.data.network.startsWith("solana:") ? [requirement.data] : [];
+  });
+  return { paymentRequired: parsed.data, solanaExactRequirements };
 }
-function expectCloseAccount(ixs, expectation) {
-  const ix = ixs.shift();
-  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 9) {
-    reject("close_mismatch", "Expected CloseAccount instruction");
-  }
-  if (ix.accounts[0] !== expectation.account) {
-    reject("close_mismatch", "CloseAccount target is not the temporary account");
-  }
-  if (ix.accounts[1] !== expectation.destination) {
-    reject("close_mismatch", "CloseAccount rent destination must be the sponsor");
-  }
-  if (ix.accounts[2] !== expectation.owner) {
-    reject("close_mismatch", "CloseAccount authority must be the agent wallet");
+function decodeStandardPaymentRequiredHeader(headerValue) {
+  let decoded;
+  try {
+    decoded = decodeX402Header(headerValue);
+  } catch (error) {
+    throw new StandardX402ChallengeError(
+      error instanceof X402HeaderError ? error.reason : "invalid_header",
+      "Cannot decode the payment-required header"
+    );
   }
+  return parseStandardChallenge(decoded);
 }
-function expectMemo(ixs, memo) {
-  const ix = ixs.shift();
-  if (ix === void 0 || ix.programAddress !== MEMO_PROGRAM_ID) {
-    reject("memo_mismatch", "Expected Memo instruction");
+function selectPayableSolanaRequirement(requirements, options) {
+  const network = options?.network ?? SOLANA_MAINNET_NETWORK;
+  const usdcMint = options?.usdcMint ?? SUBLY_VAULT.usdcMint;
+  const matchingRequirements = requirements.filter(
+    (candidate) => candidate.network === network && candidate.asset === usdcMint
+  );
+  if (matchingRequirements.length === 0) {
+    throw new StandardX402ChallengeError(
+      "no_payable_requirement",
+      `The challenge has no Solana exact requirement on ${network} paying ${usdcMint}`
+    );
   }
-  if (Buffer.from(ix.data).toString("utf8") !== memo) {
-    reject("memo_mismatch", "Memo content does not match the paymentId");
+  const requirement = matchingRequirements.find(
+    (candidate) => candidate.extra?.feePayer !== void 0
+  ) ?? null;
+  if (requirement === null) {
+    throw new StandardX402ChallengeError(
+      "missing_svm_fee_payer",
+      "The Solana exact requirement does not include extra.feePayer, which the official @x402/svm client requires for gas sponsorship"
+    );
   }
-}
-function expectAtaCreateForOwner(ix, owner) {
-  if (ix.accounts[2] !== owner) {
-    reject(
-      "unexpected_instruction",
-      "Associated token account creation for a foreign owner"
+  const feePayer = requirement.extra?.feePayer;
+  if (feePayer === void 0) {
+    throw new StandardX402ChallengeError(
+      "missing_svm_fee_payer",
+      "The Solana exact requirement does not include extra.feePayer, which the official @x402/svm client requires for gas sponsorship"
     );
   }
+  return {
+    requirement,
+    amountRawUsdc: BigInt(requirement.amount),
+    payTo: requirement.payTo,
+    feePayer
+  };
 }
-function bytesStartWith(data, prefix) {
-  if (data.length < prefix.length) {
-    return false;
-  }
-  return prefix.every((byte, index) => data[index] === byte);
+function standardRequirementMatchesSelected(candidate, selected) {
+  const parsed = standardExactRequirementSchema.safeParse(candidate);
+  return parsed.success && stableJson(parsed.data) === stableJson(selected.requirement);
 }
-function readU64LE(data, offset) {
-  if (data.length < offset + 8) {
-    reject("invalid_transaction_encoding", "Instruction data too short for u64");
-  }
-  return Buffer.from(data.subarray(offset, offset + 8)).readBigUInt64LE(0);
+function stableJson(value) {
+  return JSON.stringify(sortJson(value));
 }
-function readU32LE(data, offset) {
-  if (data.length < offset + 4) {
-    reject("invalid_transaction_encoding", "Instruction data too short for u32");
+function sortJson(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJson);
   }
-  return Buffer.from(data.subarray(offset, offset + 4)).readUInt32LE(0);
-}
-function readShortVec(bytes, startOffset) {
-  let value = 0;
-  let shift = 0;
-  let offset = startOffset;
-  while (offset < bytes.length) {
-    const byte = bytes[offset];
-    value |= (byte & 127) << shift;
-    offset += 1;
-    if ((byte & 128) === 0) {
-      return { value, nextOffset: offset };
-    }
-    shift += 7;
-    if (shift > 28) {
-      return null;
-    }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => [key, sortJson(entry)])
+    );
   }
-  return null;
+  return value;
 }
 
-// ../../src/client/agent-wallet-signer.ts
-var LocalKeypairAgentWalletSigner = class {
-  validationMode = "structured_intent_transaction";
-  keyPairSigner;
-  validationPolicy;
-  constructor(keyPairSigner2, validationPolicy) {
-    this.keyPairSigner = keyPairSigner2;
-    this.validationPolicy = validationPolicy;
-  }
-  get walletAddress() {
-    return this.keyPairSigner.address;
+// ../../src/client/standard-x402-payer.ts
+var StandardX402PayError = class extends Error {
+  constructor(reason, message, detail = null) {
+    super(message);
+    this.reason = reason;
+    this.detail = detail;
+    this.name = "StandardX402PayError";
   }
-  async signPayment(params) {
-    this.assertIntentWallet(params.intent.wallet);
-    validatePaymentIntentTransaction({
-      ...params,
-      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
-    });
-    return this.sign(params.serializedTransaction);
+  reason;
+  detail;
+};
+var StandardX402Payer = class {
+  realizer;
+  x402Fetch;
+  probeFetch;
+  defaultMaxAmountRawUsdc;
+  network;
+  usdcMint;
+  stateStore;
+  pending = /* @__PURE__ */ new Map();
+  inFlight = /* @__PURE__ */ new Map();
+  nowMs;
+  constructor(config) {
+    this.realizer = config.realizer;
+    this.x402Fetch = config.x402Fetch;
+    this.probeFetch = config.probeFetch ?? fetch;
+    this.defaultMaxAmountRawUsdc = config.defaultMaxAmountRawUsdc;
+    this.network = config.network ?? SOLANA_MAINNET_NETWORK;
+    this.usdcMint = config.usdcMint ?? SUBLY_VAULT.usdcMint;
+    this.stateStore = config.stateStore ?? null;
+    this.nowMs = config.nowMs ?? (() => Date.now());
+    if (this.stateStore !== null) {
+      for (const record of this.stateStore.load()) {
+        this.pending.set(record.key, record);
+      }
+    }
   }
-  async signDeposit(params) {
-    this.assertIntentWallet(params.intent.wallet);
-    validateDepositIntentTransaction({
-      ...params,
-      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
+  pay(input, realizer = this.realizer) {
+    const method2 = (input.method ?? "GET").toUpperCase();
+    const requestBodyHash = requestBodyHashFor(input.body ?? null);
+    const pendingKey = pendingPaymentKey({
+      url: input.url,
+      method: method2,
+      requestBodyHash
     });
-    return this.sign(params.serializedTransaction);
-  }
-  async signWithdrawal(params) {
-    this.assertIntentWallet(params.intent.wallet);
-    validateWithdrawalIntentTransaction({
-      ...params,
-      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
+    const existingFlow = this.inFlight.get(pendingKey);
+    if (existingFlow !== void 0) {
+      return existingFlow;
+    }
+    const run = async () => {
+      if (this.stateStore?.withExclusiveLock) {
+        this.pending.clear();
+        for (const record of this.stateStore.load()) this.pending.set(record.key, record);
+      }
+      return this.run(input, { method: method2, requestBodyHash, pendingKey }, realizer);
+    };
+    const flow = (this.stateStore?.withExclusiveLock ? this.stateStore.withExclusiveLock(run) : run()).finally(() => {
+      this.inFlight.delete(pendingKey);
     });
-    return this.sign(params.serializedTransaction);
+    this.inFlight.set(pendingKey, flow);
+    return flow;
   }
-  assertIntentWallet(wallet) {
-    if (wallet !== this.keyPairSigner.address) {
-      throw new IntentValidationError(
-        "wallet_mismatch",
-        "Intent wallet does not match this signer's wallet"
+  async run(input, computed, realizer) {
+    const { method: method2, requestBodyHash, pendingKey } = computed;
+    const existingPending = this.pending.get(pendingKey);
+    if (existingPending !== void 0 && input.forceNewPayment !== true) {
+      throw new StandardX402PayError(
+        "payment_outcome_unknown",
+        "a previous external x402 payment for this request has an unknown outcome. Verify whether it settled before purchasing again; to pay again anyway, call with forceNewPayment=true.",
+        existingPending
       );
     }
-  }
-  async signApiMessage(message) {
-    const signature = await signBytes(
-      this.keyPairSigner.keyPair.privateKey,
-      message
-    );
-    return bs584.encode(signature);
-  }
-  async sign(serializedTransaction) {
-    const { serializedBase64, transaction } = await addSignaturesToSerializedTransaction({
-      serializedBase64: serializedTransaction,
-      signers: [this.keyPairSigner.keyPair]
-    });
-    const agentSignature = signatureBase58ForSigner(
-      transaction,
-      this.keyPairSigner.address
-    );
-    if (agentSignature === null) {
-      throw new IntentValidationError(
-        "signing_failed",
-        "Agent signature was not produced"
-      );
+    if (existingPending !== void 0 && input.forceNewPayment === true) {
+      try {
+        this.untrack(pendingKey);
+      } catch (error) {
+        throw new StandardX402PayError(
+          "state_persist_failed",
+          "could not clear the previous pending x402 marker before forcing a new payment",
+          error
+        );
+      }
     }
-    return { serializedTransaction: serializedBase64, agentSignature };
-  }
-};
-
-// ../../src/api/wallet-auth.ts
-import { createHash as createHash3 } from "node:crypto";
-import bs585 from "bs58";
-import nacl from "tweetnacl";
-var WALLET_AUTH_WALLET_HEADER = "x-subly-wallet";
-var WALLET_AUTH_SIGNED_AT_HEADER = "x-subly-signed-at";
-var WALLET_AUTH_SIGNATURE_HEADER = "x-subly-signature";
-function sha256Hex(data) {
-  return createHash3("sha256").update(data, "utf8").digest("hex");
-}
-function walletAuthMessage(params) {
-  return new TextEncoder().encode(
-    `subly-api:${params.method.toUpperCase()}:${params.path}:${sha256Hex(
-      params.rawBody
-    )}:${params.signedAtMs}`
-  );
-}
-
-// ../../src/client/wallet-auth-headers.ts
-async function walletAuthHeaders(params) {
-  const signedAtMs = String(Date.now());
-  const message = walletAuthMessage({
-    method: params.method,
-    path: new URL(params.url).pathname,
-    rawBody: params.body ?? "",
-    signedAtMs
-  });
-  return {
-    [WALLET_AUTH_WALLET_HEADER]: params.signer.walletAddress,
-    [WALLET_AUTH_SIGNED_AT_HEADER]: signedAtMs,
-    [WALLET_AUTH_SIGNATURE_HEADER]: await params.signer.signApiMessage(message)
-  };
-}
-
-// ../../src/client/onboarding.ts
-var SELF_SERVE_POLICY_ID = "self-serve";
-var OnboardingError = class extends Error {
-  constructor(step, message, detail = null) {
-    super(message);
-    this.step = step;
-    this.detail = detail;
-    this.name = "OnboardingError";
-  }
-  step;
-  detail;
-};
-async function ensureWalletOnboarded(params) {
-  const fetchImpl = params.fetchImpl ?? fetch;
-  const baseUrl = params.relayerBaseUrl.replace(/\/$/, "");
-  const post = async (step, path, body2) => {
-    const url2 = `${baseUrl}${path}`;
-    const serialized = JSON.stringify(body2);
-    const response = await fetchImpl(url2, {
-      method: "POST",
-      headers: {
-        ...await walletAuthHeaders({
-          signer: params.signer,
-          method: "POST",
-          url: url2,
-          body: serialized
-        }),
-        "content-type": "application/json"
-      },
-      body: serialized
-    });
-    if (response.status !== 200) {
-      let detail = null;
-      try {
-        detail = await response.json();
-      } catch {
-        detail = null;
-      }
-      throw new OnboardingError(
-        step,
-        `wallet onboarding ${step} failed with ${response.status}`,
-        detail
-      );
-    }
-  };
-  const wallet = params.signer.walletAddress;
-  await post("register", "/v1/wallets/agent", {
-    wallet,
-    signingPolicyId: SELF_SERVE_POLICY_ID,
-    signingMode: "non_interactive",
-    signerValidationMode: params.signer.validationMode,
-    signerProvider: "local-keypair",
-    activateForPayments: true
-  });
-  await post("sync", `/v1/wallets/${wallet}/sync`, { source: "chain" });
-}
-
-// ../../src/client/lookup-tables.ts
-import { fetchAllMaybeAddressLookupTable } from "@solana-program/address-lookup-table";
-import { address, getCompiledTransactionMessageDecoder as getCompiledTransactionMessageDecoder2 } from "@solana/kit";
-function lookupTableAddressesForTransaction(serializedTransaction) {
-  const wire = Buffer.from(serializedTransaction, "base64");
-  let offset = 0;
-  let signatureCount = 0;
-  let shift = 0;
-  while (offset < wire.length) {
-    const byte = wire[offset];
-    signatureCount |= (byte & 127) << shift;
-    offset += 1;
-    if ((byte & 128) === 0) {
-      break;
+    const init = {
+      method: method2,
+      ...input.body === void 0 ? {} : { body: input.body },
+      ...input.headers === void 0 ? {} : { headers: input.headers }
+    };
+    const probe = await this.probeFetch(input.url, init);
+    if (probe.status !== 402) {
+      return { paid: false, status: probe.status, body: await probe.text() };
     }
-    shift += 7;
-  }
-  const messageBytes = wire.subarray(offset + signatureCount * 64);
-  const compiled = getCompiledTransactionMessageDecoder2().decode(messageBytes);
-  const lookups = compiled.addressTableLookups ?? [];
-  return lookups.map((lookup) => String(lookup.lookupTableAddress));
-}
-async function fetchLookupTablesForTransaction(rpc2, serializedTransaction) {
-  const addresses = lookupTableAddressesForTransaction(serializedTransaction);
-  if (addresses.length === 0) {
-    return {};
-  }
-  const tables = await fetchAllMaybeAddressLookupTable(
-    rpc2,
-    addresses.map((value) => address(value))
-  );
-  const result = {};
-  for (const table of tables) {
-    if (table.exists) {
-      result[table.address] = table.data.addresses.map(String);
+    const selected = await this.selectRequirement(probe);
+    const cap = input.maxAmountRawUsdc ?? this.defaultMaxAmountRawUsdc;
+    if (selected.amountRawUsdc > cap) {
+      throw new StandardX402PayError(
+        "amount_exceeds_client_cap",
+        `the challenge demands ${selected.amountRawUsdc} raw USDC, above the client cap of ${cap}; nothing was paid`,
+        { amountRawUsdc: selected.amountRawUsdc.toString(), payTo: selected.payTo }
+      );
     }
-  }
-  return result;
-}
-
-// ../../src/client/vault-flows.ts
-var VaultFlowClientError = class extends Error {
-  constructor(step, message, detail = null, code = null, errorDetails = null) {
-    super(message);
-    this.step = step;
-    this.detail = detail;
-    this.code = code;
-    this.errorDetails = errorDetails;
-    this.name = "VaultFlowClientError";
-  }
-  step;
-  detail;
-  code;
-  errorDetails;
-};
-var VaultFlowClient = class {
-  baseUrl;
-  signer;
-  fetchImpl;
-  lookupTablesFor;
-  pollTimeoutMs;
-  pollIntervalMs;
-  constructor(config) {
-    this.baseUrl = config.relayerBaseUrl.replace(/\/$/, "");
-    this.signer = config.signer;
-    this.fetchImpl = config.fetchImpl ?? fetch;
-    this.lookupTablesFor = config.lookupTablesFor ?? ((serializedTransaction) => fetchLookupTablesForTransaction(config.rpc, serializedTransaction));
-    this.pollTimeoutMs = config.pollTimeoutMs ?? 9e4;
-    this.pollIntervalMs = config.pollIntervalMs ?? 2500;
-  }
-  /**
-   * Moves USDC from the agent wallet into the vault (fee sponsored). Under
-   * depositPolicy "owner_approval_required" the relayer refuses to prepare
-   * without an owner approval; when the caller passes none, an already
-   * APPROVED deposit approval for this exact amount (e.g. the mandate's
-   * initialDeposit — "one Face ID covers mandate + first deposit") is looked
-   * up and used automatically before surfacing deposit_approval_required.
-   */
-  async deposit(input) {
-    let approvalId2 = input.approvalId;
-    let prepared;
+    let realized;
     try {
-      prepared = await this.postJson("prepare", "/v1/deposits/prepare", {
-        wallet: this.signer.walletAddress,
-        amountRawUsdc: input.amountRawUsdc.toString(),
-        ...approvalId2 === void 0 ? {} : { approvalId: approvalId2 }
+      realized = await realizer.ensureUsdcAvailable({
+        amountRawUsdc: selected.amountRawUsdc,
+        payment: {
+          payTo: selected.payTo,
+          amountRawUsdc: selected.amountRawUsdc.toString(),
+          resourceUrlHash: sha256HexOf(input.url),
+          method: method2
+        },
+        ...input.approvalId === void 0 ? {} : { approvalId: input.approvalId }
       });
     } catch (error) {
-      if (!(error instanceof VaultFlowClientError) || error.code !== "deposit_approval_required" || approvalId2 !== void 0) {
-        throw error;
-      }
-      approvalId2 = await this.findApprovedDepositApproval(input.amountRawUsdc);
-      if (approvalId2 === void 0) {
-        throw error;
+      if (error.code === "approval_required") {
+        throw new StandardX402PayError(
+          "approval_required",
+          "this payment exceeds the owner-approval threshold; NOTHING was paid. Ask the owner to open the approveUrl, then retry the same call with the approvalId",
+          error.detail ?? null
+        );
       }
-      prepared = await this.postJson("prepare", "/v1/deposits/prepare", {
-        wallet: this.signer.walletAddress,
-        amountRawUsdc: input.amountRawUsdc.toString(),
-        approvalId: approvalId2
-      });
-    }
-    const signed = await this.signer.signDeposit({
-      intent: prepared.signingIntent,
-      serializedTransaction: prepared.serializedTransaction,
-      lookupTables: await this.lookupTablesFor(prepared.serializedTransaction)
-    });
-    let outcome = await this.postJson("submit", "/v1/deposits/submit", {
-      depositId: prepared.depositId,
-      serializedTransaction: signed.serializedTransaction,
-      agentSignature: signed.agentSignature
-    });
-    if (outcome.status === "submitted") {
-      outcome = await this.pollUntilTerminal(
-        `/v1/deposits/${prepared.depositId}`,
-        outcome
+      throw new StandardX402PayError(
+        "realize_failed",
+        `could not realize yield to cover ${selected.amountRawUsdc} raw USDC: ${error instanceof Error ? error.message : String(error)}`,
+        error
       );
     }
-    return {
-      depositId: prepared.depositId,
-      status: outcome.status,
-      txSignature: outcome.txSignature ?? null,
-      actualDepositRawUsdc: outcome.actualDepositRawUsdc ?? null,
-      sharesMintedRaw: outcome.sharesMintedRaw ?? null,
-      errorCode: outcome.errorCode ?? null
+    const pendingRecord = {
+      key: pendingKey,
+      url: input.url,
+      method: method2,
+      requestBodyHash,
+      amountRawUsdc: selected.amountRawUsdc.toString(),
+      payTo: selected.payTo,
+      feePayer: selected.feePayer,
+      realizedRawUsdc: realized.realizedRawUsdc.toString(),
+      realizeTxSignature: realized.txSignature,
+      status: "realized",
+      createdAtMs: this.nowMs(),
+      updatedAtMs: this.nowMs()
     };
-  }
-  /**
-   * Moves USDC from the vault back to the agent wallet's USDC ATA (fee
-   * sponsored). A plain withdrawal is the exit path and MAY spend principal;
-   * with purpose "yield_realize" the relayer refuses anything beyond the
-   * spendable yield (the payment path, via RelayerYieldRealizer).
-   */
-  async withdraw(input) {
-    const prepared = await this.postJson(
-      "prepare",
-      "/v1/withdrawals/prepare",
-      {
-        wallet: this.signer.walletAddress,
-        amountRawUsdc: input.amountRawUsdc.toString(),
-        ...input.purpose === void 0 ? {} : { purpose: input.purpose },
-        ...input.payment === void 0 ? {} : { payment: input.payment },
-        ...input.approvalId === void 0 ? {} : { approvalId: input.approvalId }
-      }
-    );
-    const signed = await this.signer.signWithdrawal({
-      intent: prepared.signingIntent,
-      serializedTransaction: prepared.serializedTransaction,
-      lookupTables: await this.lookupTablesFor(prepared.serializedTransaction)
-    });
-    let outcome = await this.postJson("submit", "/v1/withdrawals/submit", {
-      withdrawalId: prepared.withdrawalId,
-      serializedTransaction: signed.serializedTransaction,
-      agentSignature: signed.agentSignature
-    });
-    if (outcome.status === "submitted") {
-      outcome = await this.pollUntilTerminal(
-        `/v1/withdrawals/${prepared.withdrawalId}`,
-        outcome
+    try {
+      this.track(pendingRecord);
+    } catch (error) {
+      throw new StandardX402PayError(
+        "state_persist_failed",
+        "could not persist the pending x402 marker; refusing to attempt the external payment because a restart would not be double-payment safe",
+        { error, pendingPayment: pendingRecord }
+      );
+    }
+    let response;
+    try {
+      response = await this.x402Fetch(input.url, init, selected);
+    } catch (error) {
+      const persistError = this.tryMarkUnknown(pendingKey, {
+        message: error instanceof Error ? error.message : String(error)
+      });
+      throw new StandardX402PayError(
+        "payment_outcome_unknown",
+        `the x402 payment attempt failed after yield was realized; verify whether it settled before paying again: ${error instanceof Error ? error.message : String(error)}`,
+        { error, persistError }
+      );
+    }
+    const bodyText = await response.text();
+    if (response.status !== 200) {
+      const persistError = this.tryMarkUnknown(pendingKey, {
+        status: response.status,
+        body: bodyText
+      });
+      throw new StandardX402PayError(
+        "payment_outcome_unknown",
+        `the x402 payment attempt returned ${response.status} after yield was realized; verify whether it settled before paying again`,
+        { status: response.status, body: bodyText, persistError }
       );
     }
+    this.clearDelivered(pendingKey);
+    const paymentTxSignature = extractSettledPaymentTxSignature(response);
+    if (paymentTxSignature !== null && typeof realized.withdrawalId === "string" && realizer.reportPayment !== void 0) {
+      try {
+        await realizer.reportPayment({
+          withdrawalId: realized.withdrawalId,
+          paymentTxSignature
+        });
+      } catch (error) {
+        console.error(
+          `[subly-x402] payment report-back failed (audit only, payment ok): ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
     return {
-      withdrawalId: prepared.withdrawalId,
-      status: outcome.status,
-      txSignature: outcome.txSignature ?? null,
-      destinationUsdcAta: prepared.destinationUsdcAta,
-      actualWithdrawRawUsdc: outcome.actualWithdrawRawUsdc ?? null,
-      actualSharesBurnedRaw: outcome.actualSharesBurnedRaw ?? null,
-      errorCode: outcome.errorCode ?? null
+      paid: true,
+      ...realizer.vault === void 0 ? {} : { fundingVault: realizer.vault },
+      status: response.status,
+      body: bodyText,
+      payment: {
+        amountRawUsdc: selected.amountRawUsdc.toString(),
+        payTo: selected.payTo,
+        feePayer: selected.feePayer,
+        realizedRawUsdc: realized.realizedRawUsdc.toString(),
+        realizeTxSignature: realized.txSignature,
+        paymentTxSignature
+      }
     };
   }
-  /**
-   * Reads the yield budget. Syncs the relayer's ledger from chain first (so
-   * yield accrued since the last sync shows up); the sync is best-effort and
-   * on failure the last-synced view is returned.
-   */
-  async getBudget(options = {}) {
-    if (options.refreshFromChain !== false) {
-      try {
-        await this.postJson(
-          "sync",
-          `/v1/wallets/${this.signer.walletAddress}/sync`,
-          { source: "chain" }
-        );
-      } catch {
+  /** Reads the challenge from the header (preferred) or the JSON body. */
+  async selectRequirement(probe) {
+    const header = probe.headers.get(PAYMENT_REQUIRED_HEADER);
+    let requirements;
+    try {
+      if (header !== null) {
+        requirements = decodeStandardPaymentRequiredHeader(header).solanaExactRequirements;
+      } else {
+        requirements = parseStandardChallenge(
+          await probe.json()
+        ).solanaExactRequirements;
+      }
+    } catch (error) {
+      throw new StandardX402PayError(
+        error instanceof StandardX402ChallengeError ? error.reason : "invalid_challenge",
+        "could not parse the x402 402 challenge",
+        error
+      );
+    }
+    try {
+      return selectPayableSolanaRequirement(requirements, {
+        network: this.network,
+        usdcMint: this.usdcMint
+      });
+    } catch (error) {
+      throw new StandardX402PayError(
+        "no_payable_requirement",
+        error instanceof Error ? error.message : String(error),
+        error
+      );
+    }
+  }
+  track(record) {
+    const previous = this.pending.get(record.key);
+    this.pending.set(record.key, record);
+    try {
+      this.persist();
+    } catch (error) {
+      if (previous === void 0) {
+        this.pending.delete(record.key);
+      } else {
+        this.pending.set(record.key, previous);
+      }
+      throw error;
+    }
+  }
+  markUnknown(key, detail) {
+    const current = this.pending.get(key);
+    if (current === void 0) {
+      return;
+    }
+    const next = {
+      ...current,
+      status: "external_outcome_unknown",
+      updatedAtMs: this.nowMs(),
+      detail
+    };
+    this.pending.set(key, next);
+    try {
+      this.persist();
+    } catch (error) {
+      this.pending.set(key, current);
+      throw error;
+    }
+  }
+  tryMarkUnknown(key, detail) {
+    try {
+      this.markUnknown(key, detail);
+      return null;
+    } catch (error) {
+      return error;
+    }
+  }
+  untrack(key) {
+    const previous = this.pending.get(key);
+    const existed = previous !== void 0;
+    this.pending.delete(key);
+    try {
+      this.persist();
+    } catch (error) {
+      if (existed) {
+        this.pending.set(key, previous);
+      }
+      throw error;
+    }
+  }
+  clearDelivered(key) {
+    const previous = this.pending.get(key);
+    this.pending.delete(key);
+    try {
+      this.persist();
+    } catch (error) {
+      if (previous !== void 0) {
+        this.pending.set(key, previous);
+      }
+      console.error(
+        `[subly-x402] payment delivered but pending marker could not be cleared: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  persist() {
+    if (this.stateStore === null) {
+      return;
+    }
+    this.stateStore.save([...this.pending.values()]);
+  }
+};
+function pendingPaymentKey(input) {
+  return `${input.method}:${input.url}:${input.requestBodyHash}`;
+}
+function extractSettledPaymentTxSignature(response) {
+  const header = response.headers.get("x-payment-response");
+  if (header === null || header.length === 0) {
+    return null;
+  }
+  try {
+    const decoded = JSON.parse(
+      Buffer.from(header, "base64").toString("utf8")
+    );
+    if (typeof decoded.transaction === "string" && decoded.transaction.length > 0) {
+      return decoded.transaction;
+    }
+    if (typeof decoded.txHash === "string" && decoded.txHash.length > 0) {
+      return decoded.txHash;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+// ../../src/client/relayer-payer.ts
+function createRelayerX402Payer(config) {
+  const realizer = new RelayerYieldRealizer({
+    relayerBaseUrl: config.relayerBaseUrl,
+    signer: config.signer,
+    rpc: config.rpc
+  });
+  return new StandardX402Payer({
+    realizer,
+    x402Fetch: config.x402Fetch,
+    defaultMaxAmountRawUsdc: config.defaultMaxAmountRawUsdc,
+    ...config.stateStore === void 0 ? {} : { stateStore: config.stateStore }
+  });
+}
+
+// ../../src/client/signer-env.ts
+import { createKeyPairSignerFromBytes as createKeyPairSignerFromBytes2 } from "@solana/kit";
+
+// ../../src/solana/keys.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import bs583 from "bs58";
+import {
+  createKeyPairSignerFromBytes
+} from "@solana/kit";
+function loadSecretKeyBytes(params) {
+  const { base58Secret, jsonFilePath, label } = params;
+  if (base58Secret !== void 0 && base58Secret.length > 0) {
+    const bytes = bs583.decode(base58Secret);
+    if (bytes.length !== 64) {
+      throw new Error(`${label} base58 secret must decode to 64 bytes`);
+    }
+    return bytes;
+  }
+  if (jsonFilePath !== void 0 && jsonFilePath.length > 0) {
+    const raw = JSON.parse(readFileSync2(jsonFilePath, "utf8"));
+    if (!Array.isArray(raw) || raw.length !== 64) {
+      throw new Error(`${label} keypair file must be a 64-byte JSON array`);
+    }
+    return Uint8Array.from(raw);
+  }
+  throw new Error(`${label} keypair is not configured`);
+}
+
+// ../../src/client/agent-wallet-signer.ts
+import { signBytes } from "@solana/kit";
+import bs587 from "bs58";
+import nacl3 from "tweetnacl";
+
+// ../../src/solana/tx.ts
+import bs584 from "bs58";
+import {
+  appendTransactionMessageInstructions,
+  compileTransaction,
+  compressTransactionMessageUsingAddressLookupTables,
+  createTransactionMessage,
+  getBase64EncodedWireTransaction,
+  getTransactionDecoder,
+  partiallySignTransaction,
+  pipe,
+  setTransactionMessageFeePayer,
+  setTransactionMessageLifetimeUsingBlockhash
+} from "@solana/kit";
+function decodeSerializedTransaction(serializedBase64) {
+  return getTransactionDecoder().decode(Buffer.from(serializedBase64, "base64"));
+}
+function attachExternalSignatureToTransaction(params) {
+  if (!(params.signer in params.transaction.signatures)) {
+    throw new Error(
+      `transaction does not expect a signature from ${params.signer}`
+    );
+  }
+  const transaction = Object.freeze({
+    ...params.transaction,
+    signatures: Object.freeze({
+      ...params.transaction.signatures,
+      [params.signer]: params.signature
+    })
+  });
+  return {
+    serializedBase64: getBase64EncodedWireTransaction(transaction),
+    transaction
+  };
+}
+async function addSignaturesToSerializedTransaction(params) {
+  const decoded = decodeSerializedTransaction(params.serializedBase64);
+  const signed = await partiallySignTransaction(params.signers, decoded);
+  return {
+    serializedBase64: getBase64EncodedWireTransaction(signed),
+    transaction: signed
+  };
+}
+function signatureBase58ForSigner(transaction, signer2) {
+  const signature = transaction.signatures[signer2];
+  if (signature === null || signature === void 0) {
+    return null;
+  }
+  return bs584.encode(signature);
+}
+
+// ../../src/client/remote-signer-transport.ts
+import bs585 from "bs58";
+import nacl2 from "tweetnacl";
+var RemoteSigningError = class extends Error {
+  constructor(provider, message, detail = null) {
+    super(`[${provider}] ${message}`);
+    this.provider = provider;
+    this.detail = detail;
+    this.name = "RemoteSigningError";
+  }
+  provider;
+  detail;
+};
+function ed25519PublicKeyBytes(provider, walletAddress) {
+  let bytes;
+  try {
+    bytes = bs585.decode(walletAddress);
+  } catch {
+    throw new RemoteSigningError(
+      provider,
+      `wallet address ${walletAddress} is not base58`
+    );
+  }
+  if (bytes.length !== 32) {
+    throw new RemoteSigningError(
+      provider,
+      `wallet address ${walletAddress} is not a 32-byte ed25519 key`
+    );
+  }
+  return bytes;
+}
+function verifiedEd25519Signature(params) {
+  const publicKey2 = ed25519PublicKeyBytes(params.provider, params.walletAddress);
+  const encoded = params.encodedSignature.trim();
+  for (const candidate of decodeSignatureCandidates(encoded)) {
+    if (nacl2.sign.detached.verify(params.message, candidate, publicKey2)) {
+      return candidate;
+    }
+  }
+  throw new RemoteSigningError(
+    params.provider,
+    `signature did not verify for wallet ${params.walletAddress}`
+  );
+}
+function decodeSignatureCandidates(encoded) {
+  const candidates = [];
+  const hex = encoded.startsWith("0x") ? encoded.slice(2) : encoded;
+  if (/^[0-9a-fA-F]{128}$/.test(hex)) {
+    candidates.push(Uint8Array.from(Buffer.from(hex, "hex")));
+  }
+  try {
+    const fromBase58 = bs585.decode(encoded);
+    if (fromBase58.length === 64) {
+      candidates.push(fromBase58);
+    }
+  } catch {
+  }
+  if (/^[A-Za-z0-9+/=_-]+$/.test(encoded)) {
+    const fromBase64 = Uint8Array.from(
+      Buffer.from(encoded.replace(/-/g, "+").replace(/_/g, "/"), "base64")
+    );
+    if (fromBase64.length === 64) {
+      candidates.push(fromBase64);
+    }
+  }
+  return candidates;
+}
+async function requestVerifiedTransactionSignature(params) {
+  const { transport } = params;
+  const signedBase64 = await transport.signTransaction(
+    params.serializedTransactionBase64
+  );
+  let returned;
+  try {
+    returned = decodeSerializedTransaction(signedBase64);
+  } catch (error) {
+    throw new RemoteSigningError(
+      transport.provider,
+      "provider returned an undecodable signed transaction",
+      error
+    );
+  }
+  const signature = returned.signatures[transport.walletAddress] ?? null;
+  if (signature === null) {
+    throw new RemoteSigningError(
+      transport.provider,
+      `signed transaction is missing the signature for ${transport.walletAddress}`
+    );
+  }
+  const publicKey2 = params.publicKey ?? ed25519PublicKeyBytes(transport.provider, transport.walletAddress);
+  if (!nacl2.sign.detached.verify(params.messageBytes, signature, publicKey2)) {
+    throw new RemoteSigningError(
+      transport.provider,
+      "returned signature does not verify over the requested transaction"
+    );
+  }
+  return signature;
+}
+async function externallySignedAgentTransaction(params) {
+  const original = decodeSerializedTransaction(params.serializedTransaction);
+  const signature = await requestVerifiedTransactionSignature({
+    transport: params.transport,
+    serializedTransactionBase64: params.serializedTransaction,
+    messageBytes: original.messageBytes
+  });
+  const attached = attachExternalSignatureToTransaction({
+    transaction: original,
+    signer: params.transport.walletAddress,
+    signature
+  });
+  return {
+    serializedTransaction: attached.serializedBase64,
+    agentSignature: bs585.encode(signature)
+  };
+}
+async function providerJsonRequest(params) {
+  const response = await params.fetchImpl(`${params.baseUrl}${params.path}`, {
+    method: params.method,
+    headers: { ...params.headers, "content-type": "application/json" },
+    ...params.body === void 0 ? {} : { body: JSON.stringify(params.body) }
+  });
+  let json = null;
+  try {
+    json = await response.json();
+  } catch {
+    json = null;
+  }
+  if (!response.ok) {
+    throw new RemoteSigningError(
+      params.provider,
+      `${params.method} ${params.path} failed with ${response.status}`,
+      json
+    );
+  }
+  return json;
+}
+
+// ../../src/client/transaction-intent-validator.ts
+import bs586 from "bs58";
+import { getCompiledTransactionMessageDecoder as getCompiledTransactionMessageDecoder2 } from "@solana/kit";
+
+// ../../src/domain/request-binding.ts
+function computeRequestBindingHash(fields) {
+  return hashStableJson({
+    sellerRequestId: fields.sellerRequestId,
+    httpMethod: fields.httpMethod.toUpperCase(),
+    canonicalResourceUrl: fields.canonicalResourceUrl,
+    requestBodyHash: fields.requestBodyHash,
+    seller: fields.seller,
+    asset: fields.asset,
+    amountRawUsdc: fields.amountRawUsdc,
+    payTo: fields.payTo,
+    sellerUsdcAta: fields.sellerUsdcAta
+  });
+}
+
+// ../../src/client/transaction-intent-validator.ts
+var COMPUTE_BUDGET_PROGRAM_ID = "ComputeBudget111111111111111111111111111111";
+var SYSTEM_PROGRAM_ID = "11111111111111111111111111111111";
+var ASSOCIATED_TOKEN_PROGRAM_ID2 = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+var MEMO_PROGRAM_ID = "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr";
+var KVAULT_PROGRAM_ID = "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd";
+var KAMINO_FARMS_PROGRAM_ID = "FarmsPZpWu9i7Kky8tPN37rs2TpmMrAZrC7S7vJa91Hr";
+var KVAULT_WITHDRAW_DISCRIMINATOR = Uint8Array.from([
+  183,
+  18,
+  70,
+  156,
+  148,
+  109,
+  161,
+  34
+]);
+var KVAULT_WITHDRAW_FROM_AVAILABLE_DISCRIMINATOR = Uint8Array.from([
+  19,
+  131,
+  112,
+  155,
+  170,
+  220,
+  34,
+  57
+]);
+var KVAULT_DEPOSIT_DISCRIMINATOR = Uint8Array.from([
+  242,
+  35,
+  198,
+  137,
+  82,
+  225,
+  242,
+  182
+]);
+var U64_MAX = 18446744073709551615n;
+var MAX_TEMP_ACCOUNT_LAMPORTS = 10000000n;
+var DEFAULT_MAX_COMPUTE_UNIT_LIMIT = 14e5;
+var DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS = 100000n;
+var IntentValidationError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "IntentValidationError";
+    this.reason = reason;
+  }
+};
+function reject(reason, message) {
+  throw new IntentValidationError(reason, message);
+}
+function decodeIntentTransaction(params) {
+  const wire = Buffer.from(params.serializedTransaction, "base64");
+  const signatureCount = readShortVec(wire, 0);
+  if (signatureCount === null) {
+    reject("invalid_transaction_encoding", "Cannot parse signature count");
+  }
+  const messageOffset = signatureCount.nextOffset + signatureCount.value * 64;
+  if (messageOffset >= wire.length) {
+    reject("invalid_transaction_encoding", "Transaction has no message bytes");
+  }
+  const messageBytes = wire.subarray(messageOffset);
+  const compiled = getCompiledTransactionMessageDecoder2().decode(messageBytes);
+  if (compiled.version !== 0) {
+    reject("unsupported_transaction_version", "Only v0 transactions are supported");
+  }
+  const staticAccounts = compiled.staticAccounts.map(String);
+  const loadedWritable = [];
+  const loadedReadonly = [];
+  const lookups = compiled.addressTableLookups ?? [];
+  for (const rawLookup of lookups) {
+    const lookup = rawLookup;
+    const table = params.lookupTables?.[String(lookup.lookupTableAddress)];
+    if (table === void 0) {
+      reject(
+        "lookup_table_unresolved",
+        `Transaction references unknown lookup table ${lookup.lookupTableAddress}`
+      );
+    }
+    const writableIndexes = lookup.writableIndexes ?? lookup.writableIndices ?? [];
+    const readonlyIndexes = lookup.readonlyIndexes ?? lookup.readableIndices ?? [];
+    for (const index of writableIndexes) {
+      const resolved = table[index];
+      if (resolved === void 0) {
+        reject("lookup_table_unresolved", "Lookup table index out of range");
+      }
+      loadedWritable.push(String(resolved));
+    }
+    for (const index of readonlyIndexes) {
+      const resolved = table[index];
+      if (resolved === void 0) {
+        reject("lookup_table_unresolved", "Lookup table index out of range");
+      }
+      loadedReadonly.push(String(resolved));
+    }
+  }
+  const orderedAccounts = [...staticAccounts, ...loadedWritable, ...loadedReadonly];
+  const instructions = compiled.instructions.map(
+    (instruction) => {
+      const programAddress = orderedAccounts[instruction.programAddressIndex];
+      if (programAddress === void 0) {
+        reject("invalid_transaction_encoding", "Program index out of range");
+      }
+      const accounts = (instruction.accountIndices ?? []).map((index) => {
+        const account = orderedAccounts[index];
+        if (account === void 0) {
+          reject("invalid_transaction_encoding", "Account index out of range");
+        }
+        return account;
+      });
+      return {
+        programAddress,
+        accounts,
+        data: instruction.data === void 0 ? new Uint8Array() : Uint8Array.from(instruction.data)
+      };
+    }
+  );
+  const feePayer = staticAccounts[0];
+  if (feePayer === void 0) {
+    reject("invalid_transaction_encoding", "Transaction has no fee payer");
+  }
+  return {
+    feePayer,
+    requiredSigners: staticAccounts.slice(0, compiled.header.numSignerAccounts),
+    instructions,
+    messageHash: sha256TaggedHex(Buffer.from(messageBytes))
+  };
+}
+function validatePaymentIntentTransaction(params) {
+  const { intent } = params;
+  const now = params.nowMs ?? Date.now();
+  const policy = resolveIntentValidationPolicy(params.policy);
+  if (new Date(intent.expiresAt).getTime() <= now) {
+    reject("expired", "Payment intent has expired");
+  }
+  if (intent.scheme !== PAYMENT_SCHEME) {
+    reject("scheme_mismatch", `scheme must be ${PAYMENT_SCHEME}`);
+  }
+  if (intent.network !== SOLANA_MAINNET_NETWORK) {
+    reject("network_mismatch", "Unsupported network");
+  }
+  if (intent.vault !== policy.vault.address) {
+    reject("vault_mismatch", "Unsupported vault");
+  }
+  if (intent.shareMint !== policy.vault.shareMint) {
+    reject("share_mint_mismatch", "Unsupported share mint");
+  }
+  if (intent.farm !== policy.vault.farm) {
+    reject("farm_mismatch", "Unsupported Kamino farm");
+  }
+  if (intent.asset !== policy.vault.usdcMint) {
+    reject("asset_mismatch", "Only USDC payments are supported");
+  }
+  if (intent.memo !== intent.paymentId) {
+    reject("memo_mismatch", "Memo must equal the paymentId");
+  }
+  const expectedBinding = computeRequestBindingHash({
+    sellerRequestId: intent.sellerRequestId,
+    httpMethod: intent.httpMethod,
+    canonicalResourceUrl: intent.canonicalResourceUrl,
+    requestBodyHash: intent.requestBodyHash,
+    seller: intent.seller,
+    asset: intent.asset,
+    amountRawUsdc: intent.amountRawUsdc,
+    payTo: intent.payTo,
+    sellerUsdcAta: intent.sellerUsdcAta
+  });
+  if (expectedBinding !== intent.requestBindingHash) {
+    reject(
+      "request_binding_mismatch",
+      "requestBindingHash does not match the request fields"
+    );
+  }
+  const expectedSellerAta = deriveAssociatedTokenAddress({
+    owner: intent.payTo,
+    mint: intent.asset
+  });
+  if (expectedSellerAta !== intent.sellerUsdcAta) {
+    reject(
+      "seller_ata_mismatch",
+      "sellerUsdcAta must be the associated USDC account for payTo"
+    );
+  }
+  const expectedDustAta = deriveAssociatedTokenAddress({
+    owner: intent.wallet,
+    mint: intent.asset
+  });
+  if (expectedDustAta !== intent.dustRecipientUsdcAta) {
+    reject(
+      "dust_recipient_mismatch",
+      "dustRecipientUsdcAta must be the agent wallet's USDC ATA"
+    );
+  }
+  const decoded = decodeIntentTransaction({
+    serializedTransaction: params.serializedTransaction,
+    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
+  });
+  if (decoded.messageHash !== intent.preparedMessageHash) {
+    reject("message_hash_mismatch", "Prepared message hash mismatch");
+  }
+  if (decoded.feePayer !== intent.feePayer) {
+    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  }
+  const expectedSigners = /* @__PURE__ */ new Set([
+    intent.feePayer,
+    intent.wallet,
+    intent.temporarySettlementTokenAccount
+  ]);
+  if (decoded.requiredSigners.length !== expectedSigners.size || !decoded.requiredSigners.every((signer2) => expectedSigners.has(signer2))) {
+    reject(
+      "unexpected_signers",
+      "Transaction signers must be exactly the sponsor, the agent wallet, and the temporary settlement account"
+    );
+  }
+  const ixs = [...decoded.instructions];
+  expectComputeBudgetPair(ixs, policy);
+  expectCreateTemporaryAccount(ixs, intent, policy);
+  expectInitializeTemporaryAccount(ixs, intent);
+  consumeFarmInstructions(ixs, intent);
+  expectKvaultWithdraw(ixs, {
+    wallet: intent.wallet,
+    vault: intent.vault,
+    shareMint: intent.shareMint,
+    asset: intent.asset,
+    userTokenAccount: intent.temporarySettlementTokenAccount,
+    maxSharesToRedeemRaw: BigInt(intent.maxSharesToRedeemRaw),
+    allowFullExit: false
+  });
+  expectTransferChecked(ixs, {
+    source: intent.temporarySettlementTokenAccount,
+    mint: intent.asset,
+    destination: intent.sellerUsdcAta,
+    authority: intent.wallet,
+    amount: BigInt(intent.amountRawUsdc),
+    label: "seller transfer"
+  });
+  if (ixs[0] !== void 0 && ixs[0].programAddress === SPL_TOKEN_PROGRAM_ID && ixs[0].data[0] === 12) {
+    expectTransferChecked(ixs, {
+      source: intent.temporarySettlementTokenAccount,
+      mint: intent.asset,
+      destination: intent.dustRecipientUsdcAta,
+      authority: intent.wallet,
+      amount: null,
+      label: "dust sweep"
+    });
+  }
+  expectCloseAccount(ixs, {
+    account: intent.temporarySettlementTokenAccount,
+    destination: intent.feePayer,
+    owner: intent.wallet
+  });
+  expectMemo(ixs, intent.memo);
+  if (ixs.length > 0) {
+    reject(
+      "unexpected_instruction",
+      `Transaction contains ${ixs.length} unexpected trailing instruction(s)`
+    );
+  }
+}
+function validateDepositIntentTransaction(params) {
+  const { intent } = params;
+  const now = params.nowMs ?? Date.now();
+  const policy = resolveIntentValidationPolicy(params.policy);
+  if (new Date(intent.expiresAt).getTime() <= now) {
+    reject("expired", "Deposit intent has expired");
+  }
+  assertVaultIntentTargets(intent, policy.vault);
+  const decoded = decodeIntentTransaction({
+    serializedTransaction: params.serializedTransaction,
+    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
+  });
+  if (decoded.messageHash !== intent.preparedMessageHash) {
+    reject("message_hash_mismatch", "Prepared message hash mismatch");
+  }
+  if (decoded.feePayer !== intent.feePayer) {
+    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  }
+  let sawDeposit = false;
+  for (const ix of decoded.instructions) {
+    switch (ix.programAddress) {
+      case COMPUTE_BUDGET_PROGRAM_ID:
+        validateComputeBudgetInstruction(ix, policy);
+        break;
+      case ASSOCIATED_TOKEN_PROGRAM_ID2:
+        expectAtaCreateForOwner(ix, intent.wallet);
+        break;
+      case MEMO_PROGRAM_ID:
+        break;
+      case KVAULT_PROGRAM_ID: {
+        if (sawDeposit) {
+          reject("duplicate_deposit", "A deposit intent authorizes exactly one KVault deposit");
+        }
+        if (!bytesStartWith(ix.data, KVAULT_DEPOSIT_DISCRIMINATOR)) {
+          reject("unexpected_instruction", "Unexpected KVault instruction in deposit");
+        }
+        const maxAmount = readU64LE(ix.data, 8);
+        if (maxAmount !== BigInt(intent.amountRawUsdc)) {
+          reject("amount_mismatch", "Deposit amount does not match the intent");
+        }
+        if (ix.accounts[0] !== intent.wallet) {
+          reject("wallet_mismatch", "Deposit user is not the agent wallet");
+        }
+        if (ix.accounts[1] !== intent.vault) {
+          reject("vault_mismatch", "Deposit vault mismatch");
+        }
+        if (ix.accounts[3] !== intent.asset) {
+          reject("asset_mismatch", "Deposit token mint mismatch");
+        }
+        if (ix.accounts[5] !== intent.shareMint) {
+          reject("share_mint_mismatch", "Deposit share mint mismatch");
+        }
+        const expectedSourceAta = deriveAssociatedTokenAddress({
+          owner: intent.wallet,
+          mint: intent.asset
+        });
+        if (ix.accounts[6] !== expectedSourceAta) {
+          reject(
+            "source_ata_mismatch",
+            "Deposit source must be the agent wallet's USDC ATA"
+          );
+        }
+        sawDeposit = true;
+        break;
       }
+      default:
+        reject(
+          "unexpected_instruction",
+          `Unexpected program ${ix.programAddress} in deposit transaction`
+        );
     }
-    const url2 = `${this.baseUrl}/v1/wallets/${this.signer.walletAddress}/budget`;
-    const response = await this.fetchImpl(url2, {
-      headers: await walletAuthHeaders({
-        signer: this.signer,
-        method: "GET",
-        url: url2
-      })
-    });
-    const text = await response.text();
-    if (response.status !== 200) {
-      throw new VaultFlowClientError(
-        "budget",
-        `budget endpoint returned ${response.status}: ${text}`
-      );
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(text);
-    } catch {
-      throw new VaultFlowClientError(
-        "budget",
-        "budget endpoint returned 200 with a non-JSON body",
-        text
-      );
-    }
-    const body2 = parsed;
-    return {
-      wallet: this.signer.walletAddress,
-      principalBasisRawUsdc: body2.position?.principalBasisRawUsdc ?? "0",
-      positionValueRawUsdc: body2.budget?.positionValueRawUsdc ?? "0",
-      grossYieldRawUsdc: body2.budget?.grossYieldRawUsdc ?? "0",
-      spendableYieldRawUsdc: body2.budget?.spendableYieldRawUsdc ?? "0"
-    };
   }
-  /** Best-effort audit link: reports the x402 payment tx a realize funded. */
-  async reportPayment(input) {
-    await this.postJson("submit", "/v1/payments/report", {
-      wallet: this.signer.walletAddress,
-      withdrawalId: input.withdrawalId,
-      paymentTxSignature: input.paymentTxSignature
-    });
+  if (!sawDeposit) {
+    reject("missing_instruction", "Deposit transaction has no KVault deposit");
   }
-  /** Wallet's approvals as the relayer sees them (optionally by status). */
-  async listApprovals(status) {
-    const body2 = await this.getJson(
-      `/v1/wallets/${this.signer.walletAddress}/approvals${status === void 0 ? "" : `?status=${encodeURIComponent(status)}`}`
-    );
-    return body2.approvals ?? [];
+}
+function validateWithdrawalIntentTransaction(params) {
+  const { intent } = params;
+  const now = params.nowMs ?? Date.now();
+  const policy = resolveIntentValidationPolicy(params.policy);
+  if (new Date(intent.expiresAt).getTime() <= now) {
+    reject("expired", "Withdrawal intent has expired");
   }
-  /**
-   * Creates the owner-onboarding setup link (wallet-auth pins the agreed
-   * policy + initial deposit). Paste `setupUrl` into the chat verbatim.
-   */
-  async createSetupSession(input) {
-    return await this.postJson(
-      "prepare",
-      `/v1/wallets/${this.signer.walletAddress}/setup-sessions`,
-      {
-        ...input.policy === void 0 ? {} : { policy: input.policy },
-        ...input.enforcementMode === void 0 ? {} : { enforcementMode: input.enforcementMode },
-        ...input.mandateTtlDays === void 0 ? {} : { mandateTtlDays: input.mandateTtlDays },
-        ...input.initialDepositRawUsdc === void 0 ? {} : { initialDepositRawUsdc: input.initialDepositRawUsdc }
-      }
+  assertVaultIntentTargets(intent, policy.vault);
+  const expectedDestination = deriveAssociatedTokenAddress({
+    owner: intent.wallet,
+    mint: intent.asset
+  });
+  if (expectedDestination !== intent.destinationUsdcAta) {
+    reject(
+      "destination_mismatch",
+      "Withdrawal destination must be the agent wallet's USDC ATA"
     );
   }
-  /** Polls a setup session (public capability URL — no auth needed). */
-  async getSetupSession(sessionId) {
-    const url2 = `${this.baseUrl}/v1/setup-sessions/${encodeURIComponent(sessionId)}`;
-    const response = await this.fetchImpl(url2);
-    const text = await response.text();
-    if (response.status !== 200) {
-      const parsed = parseRelayerError(text);
-      throw new VaultFlowClientError(
-        "read",
-        parsed.message ?? `setup session read failed with ${response.status}`,
-        text,
-        parsed.code,
-        parsed.details
-      );
-    }
-    return JSON.parse(text);
+  const decoded = decodeIntentTransaction({
+    serializedTransaction: params.serializedTransaction,
+    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
+  });
+  if (decoded.messageHash !== intent.preparedMessageHash) {
+    reject("message_hash_mismatch", "Prepared message hash mismatch");
   }
-  /**
-   * Finds an APPROVED, unconsumed deposit approval bound to exactly this
-   * amount — the shape the mandate's initialDeposit approval has.
-   */
-  async findApprovedDepositApproval(amountRawUsdc) {
-    try {
-      const approvals = await this.listApprovals("approved");
-      const match = approvals.find((approval) => {
-        const binding = approval.binding;
-        return binding?.kind === "deposit" && binding.amountRawUsdc === amountRawUsdc.toString();
-      });
-      return match?.approvalId;
-    } catch {
-      return void 0;
-    }
+  if (decoded.feePayer !== intent.feePayer) {
+    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
   }
-  /**
-   * Polls the reconciling GET endpoint until the intent leaves "submitted"
-   * (each read looks the tx up on-chain) or the timeout elapses.
-   */
-  async pollUntilTerminal(path, last) {
-    const deadline = Date.now() + this.pollTimeoutMs;
-    let latest = last;
-    while (Date.now() < deadline) {
-      await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
-      const url2 = `${this.baseUrl}${path}`;
-      const response = await this.fetchImpl(url2, {
-        headers: await walletAuthHeaders({
-          signer: this.signer,
-          method: "GET",
-          url: url2
-        })
-      });
-      if (response.status !== 200) {
-        continue;
-      }
-      try {
-        latest = await response.json();
-      } catch {
-        continue;
-      }
-      if (latest.status !== "submitted") {
-        return latest;
+  let sawWithdraw = false;
+  let farmUserState = null;
+  let farmInstructionCount = 0;
+  for (const ix of decoded.instructions) {
+    switch (ix.programAddress) {
+      case COMPUTE_BUDGET_PROGRAM_ID:
+        validateComputeBudgetInstruction(ix, policy);
+        break;
+      case MEMO_PROGRAM_ID:
+        break;
+      case KAMINO_FARMS_PROGRAM_ID:
+        farmInstructionCount += 1;
+        if (farmInstructionCount === 1) {
+          farmUserState = validateFarmUnstakeInstruction(ix, intent);
+        } else if (farmInstructionCount === 2) {
+          validateFarmWithdrawInstruction(ix, intent, farmUserState);
+        } else {
+          reject(
+            "farm_instruction_mismatch",
+            "Withdrawal may contain only one farm unstake and one farm withdrawal"
+          );
+        }
+        break;
+      case ASSOCIATED_TOKEN_PROGRAM_ID2:
+        expectAtaCreateForOwner(ix, intent.wallet);
+        break;
+      case SPL_TOKEN_PROGRAM_ID: {
+        if (ix.data[0] !== 9) {
+          reject(
+            "unexpected_instruction",
+            "Only CloseAccount token instructions are allowed in withdrawals"
+          );
+        }
+        if (ix.accounts[1] !== intent.wallet || ix.accounts[2] !== intent.wallet) {
+          reject(
+            "unexpected_instruction",
+            "Withdrawal CloseAccount must pay out to the agent wallet"
+          );
+        }
+        break;
       }
-    }
-    return latest;
-  }
-  async postJson(step, path, body2) {
-    const url2 = `${this.baseUrl}${path}`;
-    const serialized = JSON.stringify(body2);
-    const response = await this.fetchImpl(url2, {
-      method: "POST",
-      headers: {
-        ...await walletAuthHeaders({
-          signer: this.signer,
-          method: "POST",
-          url: url2,
-          body: serialized
-        }),
-        "content-type": "application/json"
-      },
-      body: serialized
-    });
-    const text = await response.text();
-    if (response.status !== 200) {
-      const parsed = parseRelayerError(text);
-      throw new VaultFlowClientError(
-        step,
-        parsed.message === null ? `${path} failed with ${response.status}: ${text}` : `${path} failed (${parsed.code ?? response.status}): ${parsed.message}`,
-        text,
-        parsed.code,
-        parsed.details
-      );
-    }
-    try {
-      return JSON.parse(text);
-    } catch {
-      throw new VaultFlowClientError(
-        step,
-        `${path} returned 200 with a non-JSON body`,
-        text
-      );
-    }
-  }
-  async getJson(path) {
-    const url2 = `${this.baseUrl}${path}`;
-    const response = await this.fetchImpl(url2, {
-      headers: await walletAuthHeaders({
-        signer: this.signer,
-        method: "GET",
-        url: url2
-      })
-    });
-    const text = await response.text();
-    if (response.status !== 200) {
-      const parsed = parseRelayerError(text);
-      throw new VaultFlowClientError(
-        "read",
-        parsed.message === null ? `${path} failed with ${response.status}: ${text}` : `${path} failed (${parsed.code ?? response.status}): ${parsed.message}`,
-        text,
-        parsed.code,
-        parsed.details
-      );
-    }
-    try {
-      return JSON.parse(text);
-    } catch {
-      throw new VaultFlowClientError(
-        "read",
-        `${path} returned 200 with a non-JSON body`,
-        text
-      );
+      case KVAULT_PROGRAM_ID: {
+        if (sawWithdraw) {
+          reject(
+            "withdraw_mismatch",
+            "Withdrawal may contain only one KVault withdraw instruction"
+          );
+        }
+        validateKvaultWithdrawInstruction(ix, {
+          wallet: intent.wallet,
+          vault: intent.vault,
+          shareMint: intent.shareMint,
+          asset: intent.asset,
+          userTokenAccount: intent.destinationUsdcAta,
+          maxSharesToRedeemRaw: BigInt(intent.maxSharesToRedeemRaw),
+          allowFullExit: intent.allowFullExit
+        });
+        sawWithdraw = true;
+        break;
+      }
+      default:
+        reject(
+          "unexpected_instruction",
+          `Unexpected program ${ix.programAddress} in withdrawal transaction`
+        );
     }
   }
-};
-function parseRelayerError(text) {
-  try {
-    const parsed = JSON.parse(text);
-    return {
-      code: typeof parsed.error?.code === "string" ? parsed.error.code : null,
-      message: typeof parsed.error?.message === "string" ? parsed.error.message : null,
-      details: parsed.error?.details ?? null
-    };
-  } catch {
-    return { code: null, message: null, details: null };
+  if (!sawWithdraw) {
+    reject("missing_instruction", "Withdrawal transaction has no KVault withdraw");
+  }
+  if (farmInstructionCount === 1) {
+    reject(
+      "farm_instruction_mismatch",
+      "A farm unstake must be followed by a farm withdrawal"
+    );
   }
 }
-
-// ../../src/client/relayer-yield-realizer.ts
-var REALIZE_OVERHEAD_RAW_USDC = 2500n;
-var RelayerRealizeError = class extends Error {
-  constructor(code, message, detail = null) {
-    super(message);
-    this.code = code;
-    this.detail = detail;
-    this.name = "RelayerRealizeError";
+function assertVaultIntentTargets(intent, vault) {
+  if (intent.vault !== vault.address) {
+    reject("vault_mismatch", "Unsupported vault");
   }
-  code;
-  detail;
-};
-var RelayerYieldRealizer = class {
-  vaultFlows;
-  constructor(config) {
-    this.vaultFlows = new VaultFlowClient({
-      relayerBaseUrl: config.relayerBaseUrl,
-      signer: config.signer,
-      rpc: config.rpc,
-      ...config.fetchImpl === void 0 ? {} : { fetchImpl: config.fetchImpl },
-      ...config.lookupTablesFor === void 0 ? {} : { lookupTablesFor: config.lookupTablesFor }
-    });
+  if (intent.shareMint !== vault.shareMint) {
+    reject("share_mint_mismatch", "Unsupported share mint");
   }
-  async ensureUsdcAvailable(input) {
-    const shortfallRawUsdc = input.amountRawUsdc;
-    await this.assertSpendableYield(shortfallRawUsdc);
-    let outcome;
-    try {
-      outcome = await this.vaultFlows.withdraw({
-        amountRawUsdc: shortfallRawUsdc,
-        // The relayer refuses to prepare this withdrawal beyond the spendable
-        // yield — the principal-protection guard the client cannot bypass.
-        purpose: "yield_realize",
-        // Declares what is being paid so the relayer's spending-mandate layer
-        // can enforce caps/payee and keep the mandate → payment audit chain.
-        ...input.payment === void 0 ? {} : { payment: input.payment },
-        ...input.approvalId === void 0 ? {} : { approvalId: input.approvalId }
-      });
-    } catch (error) {
-      throw this.mapWithdrawError(error);
-    }
-    if (outcome.status !== "confirmed" || outcome.txSignature === null) {
-      throw new RelayerRealizeError(
-        "realize_not_confirmed",
-        `yield realize withdrawal did not confirm (status=${outcome.status})`,
-        outcome
-      );
-    }
-    return {
-      realizedRawUsdc: BigInt(outcome.actualWithdrawRawUsdc ?? "0"),
-      txSignature: outcome.txSignature,
-      withdrawalId: outcome.withdrawalId
-    };
+  if (intent.farm !== vault.farm) {
+    reject("farm_mismatch", "Unsupported Kamino farm");
   }
-  /**
-   * Best-effort report-back of the x402 payment tx this realize funded —
-   * closes the relayer's mandate → realize → payment audit chain. Callers
-   * must never let a failure here affect the payment result.
-   */
-  async reportPayment(input) {
-    await this.vaultFlows.reportPayment(input);
+  if (intent.asset !== vault.usdcMint) {
+    reject("asset_mismatch", "Only USDC is supported");
   }
-  /**
-   * Refuses to realize more than the ledger's spendable yield (principal).
-   * getBudget syncs the relayer's ledger from chain first (best-effort), so a
-   * long-running client sees yield as it accrues instead of a frozen view.
-   */
-  async assertSpendableYield(shortfallRawUsdc) {
-    let spendable;
-    try {
-      const budget = await this.vaultFlows.getBudget();
-      spendable = BigInt(budget.spendableYieldRawUsdc);
-    } catch (error) {
-      throw new RelayerRealizeError(
-        "budget_unavailable",
-        "could not read the spendable-yield budget",
-        error
-      );
-    }
-    const requiredRawUsdc = shortfallRawUsdc + REALIZE_OVERHEAD_RAW_USDC;
-    if (spendable < requiredRawUsdc) {
-      throw new RelayerRealizeError(
-        "insufficient_yield",
-        `spendable yield ${spendable} cannot cover ${shortfallRawUsdc} raw USDC plus the ${REALIZE_OVERHEAD_RAW_USDC} raw fee headroom; the principal is never spent \u2014 wait for more yield`,
-        { spendableYieldRawUsdc: spendable.toString() }
-      );
-    }
+}
+function resolveIntentValidationPolicy(policy) {
+  const resolved = {
+    vault: policy?.vault ?? SUBLY_VAULT,
+    maxComputeUnitLimit: policy?.maxComputeUnitLimit ?? DEFAULT_MAX_COMPUTE_UNIT_LIMIT,
+    maxComputeUnitPriceMicroLamports: policy?.maxComputeUnitPriceMicroLamports ?? DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS,
+    maxTemporaryAccountLamports: policy?.maxTemporaryAccountLamports ?? MAX_TEMP_ACCOUNT_LAMPORTS
+  };
+  if (!Number.isSafeInteger(resolved.maxComputeUnitLimit) || resolved.maxComputeUnitLimit <= 0) {
+    reject("invalid_policy", "maxComputeUnitLimit must be a positive safe integer");
   }
-  mapWithdrawError(error) {
-    if (!(error instanceof VaultFlowClientError)) {
-      return new RelayerRealizeError(
-        "prepare_failed",
-        `yield realize failed: ${error instanceof Error ? error.message : String(error)}`,
-        error
+  if (resolved.maxComputeUnitPriceMicroLamports < 0n) {
+    reject(
+      "invalid_policy",
+      "maxComputeUnitPriceMicroLamports must be non-negative"
+    );
+  }
+  if (resolved.maxTemporaryAccountLamports <= 0n) {
+    reject("invalid_policy", "maxTemporaryAccountLamports must be positive");
+  }
+  return resolved;
+}
+function expectComputeBudgetPair(ixs, policy) {
+  for (const discriminator of [2, 3]) {
+    const ix = ixs.shift();
+    if (ix === void 0 || ix.programAddress !== COMPUTE_BUDGET_PROGRAM_ID || ix.data[0] !== discriminator) {
+      reject(
+        "compute_budget_mismatch",
+        "Transaction must start with ComputeBudget limit and price instructions"
       );
     }
-    const serverCode = error.code ?? errorCodeFrom(error.detail);
-    if (serverCode === "approval_required") {
-      return new RelayerRealizeError(
-        "approval_required",
-        "this payment exceeds the owner-approval threshold; nothing was realized or paid. Ask the owner to approve, then retry with the approvalId",
-        error.errorDetails ?? error.detail
-      );
+    validateComputeBudgetInstruction(ix, policy);
+  }
+}
+function validateComputeBudgetInstruction(ix, policy) {
+  switch (ix.data[0]) {
+    case 2: {
+      const units = readU32LE(ix.data, 1);
+      if (units <= 0 || units > policy.maxComputeUnitLimit) {
+        reject(
+          "compute_budget_mismatch",
+          `Compute unit limit ${units} exceeds policy maximum ${policy.maxComputeUnitLimit}`
+        );
+      }
+      break;
     }
-    if (serverCode === "insufficient_yield" || serverCode === "post_state_principal_invariant_failed") {
-      return new RelayerRealizeError(
-        "insufficient_yield",
-        "the relayer refused to realize beyond the spendable yield; the principal is never spent \u2014 wait for more yield",
-        error.detail
-      );
+    case 3: {
+      const microLamports = readU64LE(ix.data, 1);
+      if (microLamports > policy.maxComputeUnitPriceMicroLamports) {
+        reject(
+          "compute_budget_mismatch",
+          `Compute unit price ${microLamports} exceeds policy maximum ${policy.maxComputeUnitPriceMicroLamports}`
+        );
+      }
+      break;
     }
-    return new RelayerRealizeError(
-      error.step === "submit" ? "submit_failed" : "prepare_failed",
-      error.message,
-      error.detail
+    default:
+      reject("compute_budget_mismatch", "Unexpected ComputeBudget instruction");
+  }
+}
+function expectCreateTemporaryAccount(ixs, intent, policy) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SYSTEM_PROGRAM_ID) {
+    reject("temp_account_mismatch", "Expected System createAccount instruction");
+  }
+  if (ix.data.length < 52 || readU32LE(ix.data, 0) !== 0) {
+    reject("temp_account_mismatch", "Expected createAccount discriminator");
+  }
+  const lamports = readU64LE(ix.data, 4);
+  const space = readU64LE(ix.data, 12);
+  const owner = bs586.encode(ix.data.subarray(20, 52));
+  if (space !== 165n) {
+    reject("temp_account_mismatch", "Temporary account space must be 165 bytes");
+  }
+  if (owner !== SPL_TOKEN_PROGRAM_ID) {
+    reject("temp_account_mismatch", "Temporary account owner must be the token program");
+  }
+  if (lamports > policy.maxTemporaryAccountLamports) {
+    reject("temp_account_mismatch", "Temporary account rent exceeds the cap");
+  }
+  if (ix.accounts[0] !== intent.feePayer) {
+    reject("temp_account_mismatch", "Temporary account must be funded by the sponsor");
+  }
+  if (ix.accounts[1] !== intent.temporarySettlementTokenAccount) {
+    reject("temp_account_mismatch", "createAccount target is not the temporary account");
+  }
+}
+function expectInitializeTemporaryAccount(ixs, intent) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 18) {
+    reject("temp_account_mismatch", "Expected InitializeAccount3 instruction");
+  }
+  const owner = bs586.encode(ix.data.subarray(1, 33));
+  if (owner !== intent.wallet) {
+    reject(
+      "temp_account_mismatch",
+      "Temporary account token authority must be the agent wallet"
     );
   }
-};
-function errorCodeFrom(detail) {
-  if (typeof detail !== "string") {
-    return null;
+  if (ix.accounts[0] !== intent.temporarySettlementTokenAccount) {
+    reject("temp_account_mismatch", "InitializeAccount3 target mismatch");
+  }
+  if (ix.accounts[1] !== intent.asset) {
+    reject("temp_account_mismatch", "Temporary account mint must be USDC");
+  }
+}
+function consumeFarmInstructions(ixs, intent) {
+  if (ixs[0]?.programAddress !== KAMINO_FARMS_PROGRAM_ID) {
+    return;
+  }
+  const unstake = ixs.shift();
+  const userState = validateFarmUnstakeInstruction(unstake, intent);
+  if (ixs[0]?.programAddress !== KAMINO_FARMS_PROGRAM_ID) {
+    reject(
+      "farm_instruction_mismatch",
+      "A farm unstake must be followed by a farm withdrawal"
+    );
+  }
+  const withdraw = ixs.shift();
+  validateFarmWithdrawInstruction(withdraw, intent, userState);
+  if (ixs[0]?.programAddress === KAMINO_FARMS_PROGRAM_ID) {
+    reject(
+      "farm_instruction_mismatch",
+      "Payment may contain only one farm unstake and one farm withdrawal"
+    );
+  }
+}
+var KAMINO_FARMS_UNSTAKE_DISCRIMINATOR = Uint8Array.from([
+  90,
+  95,
+  107,
+  42,
+  205,
+  124,
+  50,
+  225
+]);
+var KAMINO_FARMS_WITHDRAW_UNSTAKED_DISCRIMINATOR = Uint8Array.from([
+  36,
+  102,
+  187,
+  49,
+  220,
+  36,
+  132,
+  67
+]);
+function validateFarmUnstakeInstruction(ix, intent) {
+  if (ix.programAddress !== KAMINO_FARMS_PROGRAM_ID || !bytesStartWith(ix.data, KAMINO_FARMS_UNSTAKE_DISCRIMINATOR) || ix.data.length !== 24 || readU128LE(ix.data, 8) <= 0n) {
+    reject(
+      "farm_instruction_mismatch",
+      "Expected a non-zero Kamino farm unstake instruction"
+    );
+  }
+  if (ix.accounts.length !== 4) {
+    reject(
+      "farm_instruction_mismatch",
+      "Farm unstake account list is not canonical"
+    );
   }
-  try {
-    const parsed = JSON.parse(detail);
-    return typeof parsed.error?.code === "string" ? parsed.error.code : null;
-  } catch {
-    return null;
+  if (ix.accounts[0] !== intent.wallet) {
+    reject("farm_instruction_mismatch", "Farm unstake owner must be the agent wallet");
   }
+  if (ix.accounts[2] !== intent.farm) {
+    reject("farm_instruction_mismatch", "Farm unstake target is not the approved farm");
+  }
+  return ix.accounts[1];
 }
-
-// ../../src/lib/canonical-json.ts
-import { createHash as createHash4 } from "node:crypto";
-function sha256HexOf(data) {
-  return createHash4("sha256").update(data, "utf8").digest("hex");
-}
-
-// ../../src/x402/headers.ts
-import { z } from "zod";
-var PAYMENT_REQUIRED_HEADER = "payment-required";
-var MAX_HEADER_JSON_BYTES = 16384;
-var X402HeaderError = class extends Error {
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.name = "X402HeaderError";
-    this.reason = reason;
+function validateFarmWithdrawInstruction(ix, intent, expectedUserState) {
+  if (ix.programAddress !== KAMINO_FARMS_PROGRAM_ID || !bytesStartWith(ix.data, KAMINO_FARMS_WITHDRAW_UNSTAKED_DISCRIMINATOR) || ix.data.length !== 8) {
+    reject(
+      "farm_instruction_mismatch",
+      "Expected a canonical Kamino farm withdrawal instruction"
+    );
   }
-};
-var sublyPaymentRequirementsSchema = z.object({
-  scheme: z.literal(PAYMENT_SCHEME),
-  network: z.string().min(1),
-  asset: z.string().min(32),
-  /** Exact seller amount in raw USDC; the scheme settles exactly this. */
-  amountRawUsdc: z.string().regex(/^[1-9]\d*$/),
-  resource: z.string().url(),
-  description: z.string().optional(),
-  mimeType: z.string().optional(),
-  payTo: z.string().min(32),
-  maxTimeoutSeconds: z.number().int().positive(),
-  extra: z.object({
-    sellerRequestId: z.string().min(1),
-    seller: z.string().min(32),
-    sellerUsdcAta: z.string().min(32),
-    vault: z.string().min(32),
-    shareMint: z.string().min(32)
-  })
-}).loose();
-var paymentRequiredSchema = z.object({
-  x402Version: z.number().int(),
-  accepts: z.array(z.unknown()),
-  error: z.string().optional()
-}).loose();
-var sublyPaymentPayloadSchema = z.object({
-  x402Version: z.number().int(),
-  scheme: z.literal(PAYMENT_SCHEME),
-  network: z.string().min(1),
-  payload: z.object({
-    paymentId: z.string().min(1),
-    requestBindingHash: z.string().min(1),
-    preparedMessageHash: z.string().min(1),
-    serializedTransaction: z.string().min(1).max(4096),
-    agentSignature: z.string().min(1).max(128),
-    temporarySettlementSignature: z.string().min(1).max(128)
-  })
-}).loose();
-function decodeX402Header(headerValue) {
-  if (headerValue.length > Math.ceil(MAX_HEADER_JSON_BYTES * 4 / 3) + 4) {
-    throw new X402HeaderError(
-      "header_too_large",
-      `x402 header exceeds ${MAX_HEADER_JSON_BYTES} encoded bytes`
+  if (ix.accounts.length !== 7) {
+    reject(
+      "farm_instruction_mismatch",
+      "Farm withdrawal account list is not canonical"
     );
   }
-  const json = Buffer.from(headerValue, "base64").toString("utf8");
-  try {
-    return JSON.parse(json);
-  } catch {
-    throw new X402HeaderError(
-      "invalid_header_encoding",
-      "x402 header is not base64-encoded JSON"
+  const expectedSharesAta = deriveAssociatedTokenAddress({
+    owner: intent.wallet,
+    mint: intent.shareMint
+  });
+  if (ix.accounts[0] !== intent.wallet || ix.accounts[1] !== expectedUserState || ix.accounts[2] !== intent.farm || ix.accounts[3] !== expectedSharesAta || ix.accounts[6] !== SPL_TOKEN_PROGRAM_ID) {
+    reject(
+      "farm_instruction_mismatch",
+      "Farm withdrawal must return the approved vault shares to the agent wallet"
     );
   }
 }
-function requestBodyHashFor(body2) {
-  if (body2 === null || body2 === void 0 || body2.length === 0) {
-    return EMPTY_BODY_HASH;
+function expectKvaultWithdraw(ixs, expectation) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== KVAULT_PROGRAM_ID) {
+    reject("withdraw_mismatch", "Expected KVault withdraw instruction");
   }
-  return sha256TaggedHex(
-    typeof body2 === "string" ? Buffer.from(body2, "utf8") : Buffer.from(body2)
-  );
+  validateKvaultWithdrawInstruction(ix, expectation);
 }
-
-// ../../src/x402/standard-requirements.ts
-import { z as z2 } from "zod";
-var STANDARD_EXACT_SCHEME = "exact";
-var standardExactRequirementSchema = z2.object({
-  scheme: z2.literal(STANDARD_EXACT_SCHEME),
-  /** CAIP-2 chain id, e.g. "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp". */
-  network: z2.string().min(1),
-  /** SPL mint (Solana) or token contract (EVM); Subly only pays USDC/Solana. */
-  asset: z2.string().min(1),
-  /** Exact price in the asset's atomic units, as a decimal string. */
-  amount: z2.string().regex(/^[1-9]\d*$/),
-  /** Recipient wallet; the transfer destination ATA is derived from it. */
-  payTo: z2.string().min(1),
-  maxTimeoutSeconds: z2.number().int().positive().optional(),
-  extra: z2.object({
-    /** Facilitator address that pays the tx fee (gas sponsorship). */
-    feePayer: z2.string().min(1).optional()
-  }).loose().optional()
-}).loose();
-var standardPaymentRequiredSchema = z2.object({
-  x402Version: z2.number().int(),
-  accepts: z2.array(z2.unknown()),
-  error: z2.string().optional(),
-  resource: z2.object({ url: z2.string().optional() }).loose().optional()
-}).loose();
-var StandardX402ChallengeError = class extends Error {
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.name = "StandardX402ChallengeError";
-    this.reason = reason;
+function validateKvaultWithdrawInstruction(ix, expectation) {
+  const isWithdraw = bytesStartWith(ix.data, KVAULT_WITHDRAW_DISCRIMINATOR);
+  const isWithdrawFromAvailable = bytesStartWith(
+    ix.data,
+    KVAULT_WITHDRAW_FROM_AVAILABLE_DISCRIMINATOR
+  );
+  if (!isWithdraw && !isWithdrawFromAvailable) {
+    reject("withdraw_mismatch", "Unexpected KVault instruction");
   }
-};
-function parseStandardChallenge(challenge) {
-  const parsed = standardPaymentRequiredSchema.safeParse(challenge);
-  if (!parsed.success) {
-    throw new StandardX402ChallengeError(
-      "invalid_payment_required",
-      "Response is not a valid x402 PaymentRequired object"
+  const sharesAmount = readU64LE(ix.data, 8);
+  const fullExit = sharesAmount === U64_MAX;
+  if (fullExit && !expectation.allowFullExit) {
+    reject("withdraw_mismatch", "Full-exit share burn is not allowed for this intent");
+  }
+  if (!fullExit && sharesAmount > expectation.maxSharesToRedeemRaw) {
+    reject(
+      "shares_exceed_max",
+      `Withdraw burns ${sharesAmount} shares which exceeds the approved maximum ${expectation.maxSharesToRedeemRaw}`
     );
   }
-  const solanaExactRequirements = parsed.data.accepts.flatMap((candidate) => {
-    const requirement = standardExactRequirementSchema.safeParse(candidate);
-    if (!requirement.success) {
-      return [];
-    }
-    return requirement.data.network.startsWith("solana:") ? [requirement.data] : [];
+  if (ix.accounts[0] !== expectation.wallet) {
+    reject("withdraw_mismatch", "Withdraw user is not the agent wallet");
+  }
+  if (ix.accounts[1] !== expectation.vault) {
+    reject("withdraw_mismatch", "Withdraw vault mismatch");
+  }
+  if (ix.accounts[5] !== expectation.userTokenAccount) {
+    reject(
+      "withdraw_mismatch",
+      "Withdraw token destination is not the approved account"
+    );
+  }
+  if (ix.accounts[6] !== expectation.asset) {
+    reject("withdraw_mismatch", "Withdraw token mint mismatch");
+  }
+  const expectedSharesAta = deriveAssociatedTokenAddress({
+    owner: expectation.wallet,
+    mint: expectation.shareMint
   });
-  return { paymentRequired: parsed.data, solanaExactRequirements };
+  if (ix.accounts[7] !== expectedSharesAta) {
+    reject("withdraw_mismatch", "Withdraw share source must be the agent share ATA");
+  }
+  if (ix.accounts[8] !== expectation.shareMint) {
+    reject("withdraw_mismatch", "Withdraw share mint mismatch");
+  }
 }
-function decodeStandardPaymentRequiredHeader(headerValue) {
-  let decoded;
-  try {
-    decoded = decodeX402Header(headerValue);
-  } catch (error) {
-    throw new StandardX402ChallengeError(
-      error instanceof X402HeaderError ? error.reason : "invalid_header",
-      "Cannot decode the payment-required header"
+function expectTransferChecked(ixs, expectation) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 12) {
+    reject("transfer_mismatch", `Expected TransferChecked for ${expectation.label}`);
+  }
+  const amount = readU64LE(ix.data, 1);
+  const decimals = ix.data[9];
+  if (expectation.amount !== null && amount !== expectation.amount) {
+    reject(
+      "amount_mismatch",
+      `${expectation.label} amount ${amount} does not match ${expectation.amount}`
     );
   }
-  return parseStandardChallenge(decoded);
+  if (decimals !== USDC_DECIMALS) {
+    reject("transfer_mismatch", `${expectation.label} has unexpected decimals`);
+  }
+  if (ix.accounts[0] !== expectation.source) {
+    reject("transfer_mismatch", `${expectation.label} source mismatch`);
+  }
+  if (ix.accounts[1] !== expectation.mint) {
+    reject("transfer_mismatch", `${expectation.label} mint mismatch`);
+  }
+  if (ix.accounts[2] !== expectation.destination) {
+    reject("transfer_mismatch", `${expectation.label} destination mismatch`);
+  }
+  if (ix.accounts[3] !== expectation.authority) {
+    reject("transfer_mismatch", `${expectation.label} authority mismatch`);
+  }
 }
-function selectPayableSolanaRequirement(requirements, options) {
-  const network = options?.network ?? SOLANA_MAINNET_NETWORK;
-  const usdcMint = options?.usdcMint ?? SUBLY_VAULT.usdcMint;
-  const matchingRequirements = requirements.filter(
-    (candidate) => candidate.network === network && candidate.asset === usdcMint
-  );
-  if (matchingRequirements.length === 0) {
-    throw new StandardX402ChallengeError(
-      "no_payable_requirement",
-      `The challenge has no Solana exact requirement on ${network} paying ${usdcMint}`
-    );
+function expectCloseAccount(ixs, expectation) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 9) {
+    reject("close_mismatch", "Expected CloseAccount instruction");
   }
-  const requirement = matchingRequirements.find(
-    (candidate) => candidate.extra?.feePayer !== void 0
-  ) ?? null;
-  if (requirement === null) {
-    throw new StandardX402ChallengeError(
-      "missing_svm_fee_payer",
-      "The Solana exact requirement does not include extra.feePayer, which the official @x402/svm client requires for gas sponsorship"
-    );
+  if (ix.accounts[0] !== expectation.account) {
+    reject("close_mismatch", "CloseAccount target is not the temporary account");
   }
-  const feePayer = requirement.extra?.feePayer;
-  if (feePayer === void 0) {
-    throw new StandardX402ChallengeError(
-      "missing_svm_fee_payer",
-      "The Solana exact requirement does not include extra.feePayer, which the official @x402/svm client requires for gas sponsorship"
+  if (ix.accounts[1] !== expectation.destination) {
+    reject("close_mismatch", "CloseAccount rent destination must be the sponsor");
+  }
+  if (ix.accounts[2] !== expectation.owner) {
+    reject("close_mismatch", "CloseAccount authority must be the agent wallet");
+  }
+}
+function expectMemo(ixs, memo) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== MEMO_PROGRAM_ID) {
+    reject("memo_mismatch", "Expected Memo instruction");
+  }
+  if (Buffer.from(ix.data).toString("utf8") !== memo) {
+    reject("memo_mismatch", "Memo content does not match the paymentId");
+  }
+}
+function expectAtaCreateForOwner(ix, owner) {
+  if (ix.accounts[2] !== owner) {
+    reject(
+      "unexpected_instruction",
+      "Associated token account creation for a foreign owner"
     );
   }
-  return {
-    requirement,
-    amountRawUsdc: BigInt(requirement.amount),
-    payTo: requirement.payTo,
-    feePayer
-  };
 }
-function standardRequirementMatchesSelected(candidate, selected) {
-  const parsed = standardExactRequirementSchema.safeParse(candidate);
-  return parsed.success && stableJson(parsed.data) === stableJson(selected.requirement);
+function bytesStartWith(data, prefix) {
+  if (data.length < prefix.length) {
+    return false;
+  }
+  return prefix.every((byte, index) => data[index] === byte);
 }
-function stableJson(value) {
-  return JSON.stringify(sortJson(value));
+function readU64LE(data, offset) {
+  if (data.length < offset + 8) {
+    reject("invalid_transaction_encoding", "Instruction data too short for u64");
+  }
+  return Buffer.from(data.subarray(offset, offset + 8)).readBigUInt64LE(0);
 }
-function sortJson(value) {
-  if (Array.isArray(value)) {
-    return value.map(sortJson);
+function readU32LE(data, offset) {
+  if (data.length < offset + 4) {
+    reject("invalid_transaction_encoding", "Instruction data too short for u32");
   }
-  if (value !== null && typeof value === "object") {
-    return Object.fromEntries(
-      Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => [key, sortJson(entry)])
-    );
+  return Buffer.from(data.subarray(offset, offset + 4)).readUInt32LE(0);
+}
+function readU128LE(data, offset) {
+  if (data.length < offset + 16) {
+    reject("invalid_transaction_encoding", "Instruction data too short for u128");
+  }
+  let value = 0n;
+  for (let index = 0; index < 16; index += 1) {
+    value |= BigInt(data[offset + index]) << BigInt(index * 8);
   }
   return value;
 }
+function readShortVec(bytes, startOffset) {
+  let value = 0;
+  let shift = 0;
+  let offset = startOffset;
+  while (offset < bytes.length) {
+    const byte = bytes[offset];
+    value |= (byte & 127) << shift;
+    offset += 1;
+    if ((byte & 128) === 0) {
+      return { value, nextOffset: offset };
+    }
+    shift += 7;
+    if (shift > 28) {
+      return null;
+    }
+  }
+  return null;
+}
 
-// ../../src/client/standard-x402-payer.ts
-var StandardX402PayError = class extends Error {
-  constructor(reason, message, detail = null) {
-    super(message);
-    this.reason = reason;
-    this.detail = detail;
-    this.name = "StandardX402PayError";
+// ../../src/client/agent-wallet-signer.ts
+var IntentValidatingAgentWalletSigner = class {
+  vault;
+  validationMode = "structured_intent_transaction";
+  validationPolicy;
+  constructor(validationPolicy) {
+    this.vault = Object.freeze({ ...validationPolicy?.vault ?? SUBLY_VAULT });
+    this.validationPolicy = { ...validationPolicy, vault: this.vault };
   }
-  reason;
-  detail;
-};
-var StandardX402Payer = class {
-  realizer;
-  x402Fetch;
-  probeFetch;
-  defaultMaxAmountRawUsdc;
-  network;
-  usdcMint;
-  stateStore;
-  pending = /* @__PURE__ */ new Map();
-  inFlight = /* @__PURE__ */ new Map();
-  nowMs;
-  constructor(config) {
-    this.realizer = config.realizer;
-    this.x402Fetch = config.x402Fetch;
-    this.probeFetch = config.probeFetch ?? fetch;
-    this.defaultMaxAmountRawUsdc = config.defaultMaxAmountRawUsdc;
-    this.network = config.network ?? SOLANA_MAINNET_NETWORK;
-    this.usdcMint = config.usdcMint ?? SUBLY_VAULT.usdcMint;
-    this.stateStore = config.stateStore ?? null;
-    this.nowMs = config.nowMs ?? (() => Date.now());
-    if (this.stateStore !== null) {
-      for (const record of this.stateStore.load()) {
-        this.pending.set(record.key, record);
-      }
-    }
+  async signPayment(params) {
+    this.assertIntentWallet(params.intent.wallet);
+    validatePaymentIntentTransaction({ ...params, ...this.policySpread() });
+    return this.sign(params.serializedTransaction);
   }
-  pay(input) {
-    const method2 = (input.method ?? "GET").toUpperCase();
-    const requestBodyHash = requestBodyHashFor(input.body ?? null);
-    const pendingKey = pendingPaymentKey({
-      url: input.url,
-      method: method2,
-      requestBodyHash
-    });
-    const existingFlow = this.inFlight.get(pendingKey);
-    if (existingFlow !== void 0) {
-      return existingFlow;
-    }
-    const flow = this.run(input, {
-      method: method2,
-      requestBodyHash,
-      pendingKey
-    }).finally(() => {
-      this.inFlight.delete(pendingKey);
-    });
-    this.inFlight.set(pendingKey, flow);
-    return flow;
+  async signDeposit(params) {
+    this.assertIntentWallet(params.intent.wallet);
+    validateDepositIntentTransaction({ ...params, ...this.policySpread() });
+    return this.sign(params.serializedTransaction);
   }
-  async run(input, computed) {
-    const { method: method2, requestBodyHash, pendingKey } = computed;
-    const existingPending = this.pending.get(pendingKey);
-    if (existingPending !== void 0 && input.forceNewPayment !== true) {
-      throw new StandardX402PayError(
-        "payment_outcome_unknown",
-        "a previous external x402 payment for this request has an unknown outcome. Verify whether it settled before purchasing again; to pay again anyway, call with forceNewPayment=true.",
-        existingPending
-      );
-    }
-    if (existingPending !== void 0 && input.forceNewPayment === true) {
-      try {
-        this.untrack(pendingKey);
-      } catch (error) {
-        throw new StandardX402PayError(
-          "state_persist_failed",
-          "could not clear the previous pending x402 marker before forcing a new payment",
-          error
-        );
-      }
-    }
-    const init = {
-      method: method2,
-      ...input.body === void 0 ? {} : { body: input.body },
-      ...input.headers === void 0 ? {} : { headers: input.headers }
-    };
-    const probe = await this.probeFetch(input.url, init);
-    if (probe.status !== 402) {
-      return { paid: false, status: probe.status, body: await probe.text() };
-    }
-    const selected = await this.selectRequirement(probe);
-    const cap = input.maxAmountRawUsdc ?? this.defaultMaxAmountRawUsdc;
-    if (selected.amountRawUsdc > cap) {
-      throw new StandardX402PayError(
-        "amount_exceeds_client_cap",
-        `the challenge demands ${selected.amountRawUsdc} raw USDC, above the client cap of ${cap}; nothing was paid`,
-        { amountRawUsdc: selected.amountRawUsdc.toString(), payTo: selected.payTo }
-      );
-    }
-    let realized;
-    try {
-      realized = await this.realizer.ensureUsdcAvailable({
-        amountRawUsdc: selected.amountRawUsdc,
-        payment: {
-          payTo: selected.payTo,
-          amountRawUsdc: selected.amountRawUsdc.toString(),
-          resourceUrlHash: sha256HexOf(input.url),
-          method: method2
-        },
-        ...input.approvalId === void 0 ? {} : { approvalId: input.approvalId }
-      });
-    } catch (error) {
-      if (error.code === "approval_required") {
-        throw new StandardX402PayError(
-          "approval_required",
-          "this payment exceeds the owner-approval threshold; NOTHING was paid. Ask the owner to open the approveUrl, then retry the same call with the approvalId",
-          error.detail ?? null
-        );
-      }
-      throw new StandardX402PayError(
-        "realize_failed",
-        `could not realize yield to cover ${selected.amountRawUsdc} raw USDC: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-    const pendingRecord = {
-      key: pendingKey,
-      url: input.url,
-      method: method2,
-      requestBodyHash,
-      amountRawUsdc: selected.amountRawUsdc.toString(),
-      payTo: selected.payTo,
-      feePayer: selected.feePayer,
-      realizedRawUsdc: realized.realizedRawUsdc.toString(),
-      realizeTxSignature: realized.txSignature,
-      status: "realized",
-      createdAtMs: this.nowMs(),
-      updatedAtMs: this.nowMs()
-    };
-    try {
-      this.track(pendingRecord);
-    } catch (error) {
-      throw new StandardX402PayError(
-        "state_persist_failed",
-        "could not persist the pending x402 marker; refusing to attempt the external payment because a restart would not be double-payment safe",
-        { error, pendingPayment: pendingRecord }
-      );
-    }
-    let response;
-    try {
-      response = await this.x402Fetch(input.url, init, selected);
-    } catch (error) {
-      const persistError = this.tryMarkUnknown(pendingKey, {
-        message: error instanceof Error ? error.message : String(error)
-      });
-      throw new StandardX402PayError(
-        "payment_outcome_unknown",
-        `the x402 payment attempt failed after yield was realized; verify whether it settled before paying again: ${error instanceof Error ? error.message : String(error)}`,
-        { error, persistError }
-      );
-    }
-    const bodyText = await response.text();
-    if (response.status !== 200) {
-      const persistError = this.tryMarkUnknown(pendingKey, {
-        status: response.status,
-        body: bodyText
-      });
-      throw new StandardX402PayError(
-        "payment_outcome_unknown",
-        `the x402 payment attempt returned ${response.status} after yield was realized; verify whether it settled before paying again`,
-        { status: response.status, body: bodyText, persistError }
+  async signWithdrawal(params) {
+    this.assertIntentWallet(params.intent.wallet);
+    validateWithdrawalIntentTransaction({ ...params, ...this.policySpread() });
+    return this.sign(params.serializedTransaction);
+  }
+  policySpread() {
+    return this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy };
+  }
+  assertIntentWallet(wallet) {
+    if (wallet !== this.walletAddress) {
+      throw new IntentValidationError(
+        "wallet_mismatch",
+        "Intent wallet does not match this signer's wallet"
       );
     }
-    this.clearDelivered(pendingKey);
-    const paymentTxSignature = extractSettledPaymentTxSignature(response);
-    if (paymentTxSignature !== null && typeof realized.withdrawalId === "string" && this.realizer.reportPayment !== void 0) {
-      try {
-        await this.realizer.reportPayment({
-          withdrawalId: realized.withdrawalId,
-          paymentTxSignature
-        });
-      } catch (error) {
-        console.error(
-          `[subly-x402] payment report-back failed (audit only, payment ok): ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-    return {
-      paid: true,
-      status: response.status,
-      body: bodyText,
-      payment: {
-        amountRawUsdc: selected.amountRawUsdc.toString(),
-        payTo: selected.payTo,
-        feePayer: selected.feePayer,
-        realizedRawUsdc: realized.realizedRawUsdc.toString(),
-        realizeTxSignature: realized.txSignature,
-        paymentTxSignature
-      }
-    };
   }
-  /** Reads the challenge from the header (preferred) or the JSON body. */
-  async selectRequirement(probe) {
-    const header = probe.headers.get(PAYMENT_REQUIRED_HEADER);
-    let requirements;
-    try {
-      if (header !== null) {
-        requirements = decodeStandardPaymentRequiredHeader(header).solanaExactRequirements;
-      } else {
-        requirements = parseStandardChallenge(
-          await probe.json()
-        ).solanaExactRequirements;
-      }
-    } catch (error) {
-      throw new StandardX402PayError(
-        error instanceof StandardX402ChallengeError ? error.reason : "invalid_challenge",
-        "could not parse the x402 402 challenge",
-        error
+};
+var LocalKeypairAgentWalletSigner = class extends IntentValidatingAgentWalletSigner {
+  provider = "local-keypair";
+  keyPairSigner;
+  constructor(keyPairSigner, validationPolicy) {
+    super(validationPolicy);
+    this.keyPairSigner = keyPairSigner;
+  }
+  get walletAddress() {
+    return this.keyPairSigner.address;
+  }
+  async signApiMessage(message) {
+    const signature = await signBytes(
+      this.keyPairSigner.keyPair.privateKey,
+      message
+    );
+    return bs587.encode(signature);
+  }
+  async sign(serializedTransaction) {
+    const { serializedBase64, transaction } = await addSignaturesToSerializedTransaction({
+      serializedBase64: serializedTransaction,
+      signers: [this.keyPairSigner.keyPair]
+    });
+    const agentSignature = signatureBase58ForSigner(
+      transaction,
+      this.keyPairSigner.address
+    );
+    if (agentSignature === null) {
+      throw new IntentValidationError(
+        "signing_failed",
+        "Agent signature was not produced"
       );
     }
-    try {
-      return selectPayableSolanaRequirement(requirements, {
-        network: this.network,
-        usdcMint: this.usdcMint
-      });
-    } catch (error) {
-      throw new StandardX402PayError(
-        "no_payable_requirement",
-        error instanceof Error ? error.message : String(error),
-        error
+    return { serializedTransaction: serializedBase64, agentSignature };
+  }
+};
+var RemoteAgentWalletSigner = class extends IntentValidatingAgentWalletSigner {
+  transport;
+  publicKey;
+  constructor(transport, validationPolicy) {
+    super(validationPolicy);
+    this.transport = transport;
+    this.publicKey = ed25519PublicKeyBytes(
+      transport.provider,
+      transport.walletAddress
+    );
+  }
+  get walletAddress() {
+    return this.transport.walletAddress;
+  }
+  get provider() {
+    return this.transport.provider;
+  }
+  async signApiMessage(message) {
+    const signature = await this.transport.signMessage(message);
+    if (!nacl3.sign.detached.verify(message, signature, this.publicKey)) {
+      throw new RemoteSigningError(
+        this.transport.provider,
+        "message signature did not verify for the agent wallet"
       );
     }
+    return bs587.encode(signature);
   }
-  track(record) {
-    const previous = this.pending.get(record.key);
-    this.pending.set(record.key, record);
-    try {
-      this.persist();
-    } catch (error) {
-      if (previous === void 0) {
-        this.pending.delete(record.key);
-      } else {
-        this.pending.set(record.key, previous);
-      }
-      throw error;
-    }
+  sign(serializedTransaction) {
+    return externallySignedAgentTransaction({
+      transport: this.transport,
+      serializedTransaction
+    });
   }
-  markUnknown(key, detail) {
-    const current = this.pending.get(key);
-    if (current === void 0) {
-      return;
-    }
-    const next = {
-      ...current,
-      status: "external_outcome_unknown",
-      updatedAtMs: this.nowMs(),
-      detail
-    };
-    this.pending.set(key, next);
-    try {
-      this.persist();
-    } catch (error) {
-      this.pending.set(key, current);
-      throw error;
-    }
+};
+
+// ../../src/client/signer-transports/circle.ts
+import {
+  constants,
+  createPublicKey,
+  publicEncrypt
+} from "node:crypto";
+var PROVIDER = "circle";
+var DEFAULT_BASE_URL = "https://api.circle.com";
+async function createCircleSignerTransport(config) {
+  if (!/^[0-9a-fA-F]{64}$/.test(config.entitySecret)) {
+    throw new RemoteSigningError(
+      PROVIDER,
+      "entity secret must be 32 bytes of hex (64 hex chars)"
+    );
   }
-  tryMarkUnknown(key, detail) {
-    try {
-      this.markUnknown(key, detail);
-      return null;
-    } catch (error) {
-      return error;
+  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+  const fetchImpl = config.fetchImpl ?? fetch;
+  const request = async (method2, path, body2) => {
+    const json = await providerJsonRequest({
+      provider: PROVIDER,
+      fetchImpl,
+      baseUrl,
+      path,
+      method: method2,
+      headers: { authorization: `Bearer ${config.apiKey}` },
+      body: body2
+    });
+    const data = json?.data;
+    if (data === void 0) {
+      throw new RemoteSigningError(
+        PROVIDER,
+        `${method2} ${path} returned no data envelope`,
+        json
+      );
     }
+    return data;
+  };
+  const walletData = await request("GET", `/v1/w3s/wallets/${config.walletId}`);
+  const wallet = walletData.wallet;
+  if (wallet?.address === void 0) {
+    throw new RemoteSigningError(
+      PROVIDER,
+      `wallet ${config.walletId} has no address`,
+      walletData
+    );
   }
-  untrack(key) {
-    const previous = this.pending.get(key);
-    const existed = previous !== void 0;
-    this.pending.delete(key);
-    try {
-      this.persist();
-    } catch (error) {
-      if (existed) {
-        this.pending.set(key, previous);
+  if (wallet.blockchain !== "SOL") {
+    throw new RemoteSigningError(
+      PROVIDER,
+      `wallet ${config.walletId} is on ${String(
+        wallet.blockchain
+      )}, expected SOL (Solana mainnet)`
+    );
+  }
+  const walletAddress = wallet.address;
+  let entityPublicKey = null;
+  const entitySecretCiphertext = async () => {
+    if (entityPublicKey === null) {
+      const data = await request("GET", "/v1/w3s/config/entity/publicKey");
+      const publicKey2 = data.publicKey;
+      if (typeof publicKey2 !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER,
+          "entity public key response has no publicKey",
+          data
+        );
       }
-      throw error;
+      entityPublicKey = createPublicKey(publicKey2);
     }
-  }
-  clearDelivered(key) {
-    const previous = this.pending.get(key);
-    this.pending.delete(key);
-    try {
-      this.persist();
-    } catch (error) {
-      if (previous !== void 0) {
-        this.pending.set(key, previous);
+    return publicEncrypt(
+      {
+        key: entityPublicKey,
+        padding: constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: "sha256"
+      },
+      Buffer.from(config.entitySecret, "hex")
+    ).toString("base64");
+  };
+  return {
+    provider: PROVIDER,
+    walletAddress,
+    async signMessage(message) {
+      const data = await request("POST", "/v1/w3s/developer/sign/message", {
+        walletId: config.walletId,
+        message: `0x${Buffer.from(message).toString("hex")}`,
+        encodedByHex: true,
+        entitySecretCiphertext: await entitySecretCiphertext()
+      });
+      const signature = data.signature;
+      if (typeof signature !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER,
+          "sign/message returned no signature",
+          data
+        );
       }
-      console.error(
-        `[subly-x402] payment delivered but pending marker could not be cleared: ${error instanceof Error ? error.message : String(error)}`
+      return verifiedEd25519Signature({
+        provider: PROVIDER,
+        encodedSignature: signature,
+        message,
+        walletAddress
+      });
+    },
+    async signTransaction(serializedTransactionBase64) {
+      const data = await request(
+        "POST",
+        "/v1/w3s/developer/sign/transaction",
+        {
+          walletId: config.walletId,
+          rawTransaction: serializedTransactionBase64,
+          entitySecretCiphertext: await entitySecretCiphertext()
+        }
       );
+      const signedTransaction = data.signedTransaction;
+      if (typeof signedTransaction !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER,
+          "sign/transaction returned no signedTransaction",
+          data
+        );
+      }
+      return signedTransaction;
     }
+  };
+}
+
+// ../../src/client/signer-transports/privy.ts
+import { createPrivateKey, createSign } from "node:crypto";
+var PROVIDER2 = "privy";
+var DEFAULT_BASE_URL2 = "https://api.privy.io";
+function canonicalJson(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(",")}]`;
   }
-  persist() {
-    if (this.stateStore === null) {
-      return;
-    }
-    this.stateStore.save([...this.pending.values()]);
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
   }
-};
-function pendingPaymentKey(input) {
-  return `${input.method}:${input.url}:${input.requestBodyHash}`;
+  return JSON.stringify(value);
 }
-function extractSettledPaymentTxSignature(response) {
-  const header = response.headers.get("x-payment-response");
-  if (header === null || header.length === 0) {
-    return null;
-  }
+function parseAuthorizationKey(base64Pkcs8) {
+  const stripped = base64Pkcs8.replace(/^wallet-auth:/, "").trim();
   try {
-    const decoded = JSON.parse(
-      Buffer.from(header, "base64").toString("utf8")
+    return createPrivateKey({
+      key: Buffer.from(stripped, "base64"),
+      format: "der",
+      type: "pkcs8"
+    });
+  } catch (error) {
+    throw new RemoteSigningError(
+      PROVIDER2,
+      "authorization key is not a base64 PKCS#8 P-256 private key",
+      error
     );
-    if (typeof decoded.transaction === "string" && decoded.transaction.length > 0) {
-      return decoded.transaction;
+  }
+}
+function authorizationSignature(params) {
+  const payload = {
+    version: 1,
+    method: params.method,
+    url: params.url,
+    body: params.body,
+    headers: { "privy-app-id": params.appId }
+  };
+  const signer2 = createSign("sha256");
+  signer2.update(canonicalJson(payload));
+  return signer2.sign(params.key).toString("base64");
+}
+async function createPrivySignerTransport(config) {
+  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL2).replace(/\/$/, "");
+  const fetchImpl = config.fetchImpl ?? fetch;
+  const authorizationKey = config.authorizationPrivateKey === void 0 ? null : parseAuthorizationKey(config.authorizationPrivateKey);
+  const baseHeaders = {
+    authorization: `Basic ${Buffer.from(
+      `${config.appId}:${config.appSecret}`
+    ).toString("base64")}`,
+    "privy-app-id": config.appId
+  };
+  const request = async (method2, path, body2) => {
+    const headers = authorizationKey !== null && method2 !== "GET" && body2 !== void 0 ? {
+      ...baseHeaders,
+      "privy-authorization-signature": authorizationSignature({
+        key: authorizationKey,
+        appId: config.appId,
+        method: method2,
+        url: `${baseUrl}${path}`,
+        body: body2
+      })
+    } : baseHeaders;
+    const json = await providerJsonRequest({
+      provider: PROVIDER2,
+      fetchImpl,
+      baseUrl,
+      path,
+      method: method2,
+      headers,
+      body: body2
+    });
+    if (json === null || typeof json !== "object") {
+      throw new RemoteSigningError(
+        PROVIDER2,
+        `${method2} ${path} returned a non-JSON body`
+      );
     }
-    if (typeof decoded.txHash === "string" && decoded.txHash.length > 0) {
-      return decoded.txHash;
+    return json;
+  };
+  const rpc2 = async (body2) => {
+    const response = await request(
+      "POST",
+      `/v1/wallets/${config.walletId}/rpc`,
+      body2
+    );
+    const data = response.data;
+    if (data === null || typeof data !== "object") {
+      throw new RemoteSigningError(PROVIDER2, "rpc returned no data", response);
     }
-    return null;
-  } catch {
-    return null;
+    return data;
+  };
+  const wallet = await request("GET", `/v1/wallets/${config.walletId}`);
+  const walletAddress = wallet.address;
+  if (typeof walletAddress !== "string") {
+    throw new RemoteSigningError(
+      PROVIDER2,
+      `wallet ${config.walletId} has no address`,
+      wallet
+    );
+  }
+  if (wallet.chain_type !== "solana") {
+    throw new RemoteSigningError(
+      PROVIDER2,
+      `wallet ${config.walletId} is ${String(
+        wallet.chain_type
+      )}, expected solana`
+    );
   }
+  return {
+    provider: PROVIDER2,
+    walletAddress,
+    async signMessage(message) {
+      const data = await rpc2({
+        chain_type: "solana",
+        method: "signMessage",
+        params: {
+          message: Buffer.from(message).toString("base64"),
+          encoding: "base64"
+        }
+      });
+      const signature = data.signature;
+      if (typeof signature !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER2,
+          "signMessage returned no signature",
+          data
+        );
+      }
+      return verifiedEd25519Signature({
+        provider: PROVIDER2,
+        encodedSignature: signature,
+        message,
+        walletAddress
+      });
+    },
+    async signTransaction(serializedTransactionBase64) {
+      const data = await rpc2({
+        chain_type: "solana",
+        method: "signTransaction",
+        params: {
+          transaction: serializedTransactionBase64,
+          encoding: "base64"
+        }
+      });
+      const signedTransaction = data.signed_transaction;
+      if (typeof signedTransaction !== "string") {
+        throw new RemoteSigningError(
+          PROVIDER2,
+          "signTransaction returned no signed_transaction",
+          data
+        );
+      }
+      return signedTransaction;
+    }
+  };
 }
 
-// ../../src/client/relayer-payer.ts
-function createRelayerX402Payer(config) {
-  const realizer = new RelayerYieldRealizer({
-    relayerBaseUrl: config.relayerBaseUrl,
-    signer: config.signer,
-    rpc: config.rpc
-  });
-  return new StandardX402Payer({
-    realizer,
-    x402Fetch: config.x402Fetch,
-    defaultMaxAmountRawUsdc: config.defaultMaxAmountRawUsdc,
-    ...config.stateStore === void 0 ? {} : { stateStore: config.stateStore }
-  });
+// ../../src/client/signer-env.ts
+async function agentWalletSignerFromEnv(env = process.env) {
+  const nonEmpty = (value) => {
+    const trimmed = value?.trim();
+    return trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
+  };
+  const provider = nonEmpty(env.SUBLY_SIGNER_PROVIDER)?.toLowerCase() ?? "local";
+  const pickVar = (name) => nonEmpty(env[`SUBLY_${name}`]) ?? nonEmpty(env[name]);
+  const requireVar = (name) => {
+    const value = pickVar(name);
+    if (value === void 0) {
+      throw new Error(
+        `${name} (or SUBLY_${name}) is required for SUBLY_SIGNER_PROVIDER=${provider}`
+      );
+    }
+    return value;
+  };
+  if (provider === "local") {
+    const localSecretKey = loadSecretKeyBytes({
+      base58Secret: env.SUBLY_DEMO_AGENT_KEYPAIR,
+      jsonFilePath: env.SUBLY_DEMO_AGENT_KEYPAIR_PATH,
+      label: "SUBLY_DEMO_AGENT_KEYPAIR"
+    });
+    return {
+      provider,
+      signer: new LocalKeypairAgentWalletSigner(
+        await createKeyPairSignerFromBytes2(localSecretKey)
+      ),
+      localSecretKey
+    };
+  }
+  if (provider === "circle") {
+    const transport = await createCircleSignerTransport({
+      apiKey: requireVar("CIRCLE_API_KEY"),
+      entitySecret: requireVar("CIRCLE_ENTITY_SECRET"),
+      walletId: requireVar("CIRCLE_WALLET_ID"),
+      baseUrl: pickVar("CIRCLE_BASE_URL")
+    });
+    return { provider, signer: new RemoteAgentWalletSigner(transport), transport };
+  }
+  if (provider === "privy") {
+    const transport = await createPrivySignerTransport({
+      appId: requireVar("PRIVY_APP_ID"),
+      appSecret: requireVar("PRIVY_APP_SECRET"),
+      walletId: requireVar("PRIVY_WALLET_ID"),
+      authorizationPrivateKey: pickVar("PRIVY_AUTHORIZATION_KEY"),
+      baseUrl: pickVar("PRIVY_BASE_URL")
+    });
+    return { provider, signer: new RemoteAgentWalletSigner(transport), transport };
+  }
+  throw new Error(
+    `unknown SUBLY_SIGNER_PROVIDER "${provider}" (expected local, circle, or privy)`
+  );
 }
 
 // ../../src/client/standard-x402-state-store.ts
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { closeSync, mkdirSync, openSync, readFileSync as readFileSync3, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 function fileStandardX402StateStore(path) {
   return {
+    async withExclusiveLock(operation) {
+      mkdirSync(dirname(path), { recursive: true, mode: 448 });
+      const lockPath = `${path}.lock`;
+      let fd;
+      try {
+        fd = openSync(lockPath, "wx", 384);
+      } catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "EEXIST") {
+          throw new Error(`Payment state is locked: ${lockPath}. Another client may be paying. After a crash, stop all clients before removing only this .lock file; preserve the payment state JSON.`);
+        }
+        throw error;
+      }
+      try {
+        writeFileSync(fd, JSON.stringify({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() }));
+        return await operation();
+      } finally {
+        closeSync(fd);
+        unlinkSync(lockPath);
+      }
+    },
     load() {
       let text;
       try {
-        text = readFileSync(path, "utf8");
+        text = readFileSync3(path, "utf8");
       } catch (error) {
         if (isMissingFileError(error)) {
           return [];
@@ -2140,12 +3045,12 @@ function fileStandardX402StateStore(path) {
     },
     save(records) {
       const directory = dirname(path);
-      mkdirSync(directory, { recursive: true });
+      mkdirSync(directory, { recursive: true, mode: 448 });
       const tempPath = join(
         directory,
         `.${basename(path)}.${process.pid}.${Date.now()}.tmp`
       );
-      writeFileSync(tempPath, JSON.stringify(records, null, 2));
+      writeFileSync(tempPath, JSON.stringify(records, null, 2), { mode: 384, flag: "wx" });
       renameSync(tempPath, path);
     }
   };
@@ -2161,63 +3066,55 @@ function isPendingPaymentRecord(value) {
   return typeof record.key === "string" && typeof record.url === "string" && typeof record.method === "string" && typeof record.requestBodyHash === "string" && typeof record.amountRawUsdc === "string" && typeof record.payTo === "string" && (record.feePayer === null || typeof record.feePayer === "string") && typeof record.realizedRawUsdc === "string" && (record.realizeTxSignature === null || typeof record.realizeTxSignature === "string") && (record.status === "realized" || record.status === "external_outcome_unknown") && typeof record.createdAtMs === "number" && typeof record.updatedAtMs === "number";
 }
 
-// ../../src/solana/keys.ts
-import { readFileSync as readFileSync2 } from "node:fs";
-import bs586 from "bs58";
+// ../../src/solana/rpc.ts
+import { createSolanaRpc } from "@solana/kit";
+function createRpc(url2) {
+  return createSolanaRpc(url2);
+}
+
+// src/svm-signer.ts
 import {
-  createKeyPairSignerFromBytes
+  address as address2,
+  createKeyPairSignerFromBytes as createKeyPairSignerFromBytes3,
+  getBase64EncodedWireTransaction as getBase64EncodedWireTransaction2
 } from "@solana/kit";
-async function loadKeyPairSigner(params) {
-  const { base58Secret, jsonFilePath, label } = params;
-  if (base58Secret !== void 0 && base58Secret.length > 0) {
-    const bytes = bs586.decode(base58Secret);
-    if (bytes.length !== 64) {
-      throw new Error(`${label} base58 secret must decode to 64 bytes`);
-    }
-    return createKeyPairSignerFromBytes(bytes);
-  }
-  if (jsonFilePath !== void 0 && jsonFilePath.length > 0) {
-    const raw = JSON.parse(readFileSync2(jsonFilePath, "utf8"));
-    if (!Array.isArray(raw) || raw.length !== 64) {
-      throw new Error(`${label} keypair file must be a 64-byte JSON array`);
-    }
-    return createKeyPairSignerFromBytes(Uint8Array.from(raw));
+async function svmTransactionSignerFromBundle(bundle2) {
+  if (bundle2.provider === "local") {
+    return createKeyPairSignerFromBytes3(bundle2.localSecretKey);
   }
-  throw new Error(`${label} keypair is not configured`);
+  return remoteSvmTransactionSigner(bundle2.transport);
 }
-function loadSecretKeyBytes(params) {
-  const { base58Secret, jsonFilePath, label } = params;
-  if (base58Secret !== void 0 && base58Secret.length > 0) {
-    const bytes = bs586.decode(base58Secret);
-    if (bytes.length !== 64) {
-      throw new Error(`${label} base58 secret must decode to 64 bytes`);
-    }
-    return bytes;
-  }
-  if (jsonFilePath !== void 0 && jsonFilePath.length > 0) {
-    const raw = JSON.parse(readFileSync2(jsonFilePath, "utf8"));
-    if (!Array.isArray(raw) || raw.length !== 64) {
-      throw new Error(`${label} keypair file must be a 64-byte JSON array`);
+function remoteSvmTransactionSigner(transport) {
+  const signerAddress = address2(transport.walletAddress);
+  const publicKey2 = ed25519PublicKeyBytes(
+    transport.provider,
+    transport.walletAddress
+  );
+  return {
+    address: signerAddress,
+    async signTransactions(transactions) {
+      const dictionaries = [];
+      for (const transaction of transactions) {
+        const signature = await requestVerifiedTransactionSignature({
+          transport,
+          serializedTransactionBase64: getBase64EncodedWireTransaction2(transaction),
+          messageBytes: transaction.messageBytes,
+          publicKey: publicKey2
+        });
+        dictionaries.push(
+          Object.freeze({ [signerAddress]: signature })
+        );
+      }
+      return dictionaries;
     }
-    return Uint8Array.from(raw);
-  }
-  throw new Error(`${label} keypair is not configured`);
-}
-
-// ../../src/solana/rpc.ts
-import { createSolanaRpc } from "@solana/kit";
-function createRpc(url2) {
-  return createSolanaRpc(url2);
+  };
 }
 
 // src/svm-x402-fetch.ts
-import { createKeyPairSignerFromBytes as createKeyPairSignerFromBytes2 } from "@solana/kit";
 import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
 import { ExactSvmScheme, toClientSvmSigner } from "@x402/svm";
 async function createSvmX402Fetch(params) {
-  const signer2 = toClientSvmSigner(
-    await createKeyPairSignerFromBytes2(params.agentSecretKey)
-  );
+  const signer2 = toClientSvmSigner(params.signer);
   return (url2, init, expected) => {
     const wrapped = wrapFetchWithPaymentFromConfig(fetch, {
       schemes: [
@@ -2269,23 +3166,17 @@ var relayerBaseUrl = process.env.SUBLY_RELAYER_URL ?? process.env.SUBLY_FACILITA
 var rpcUrl = process.env.SOLANA_RPC_URL ?? "https://api.mainnet-beta.solana.com";
 var defaultMaxAmountRawUsdc = process.env.SUBLY_MCP_MAX_AMOUNT_RAW_USDC === void 0 ? 10000n : BigInt(process.env.SUBLY_MCP_MAX_AMOUNT_RAW_USDC);
 var pendingStatePath = process.env.SUBLY_MCP_STATE_PATH ?? join2(homedir(), ".subly", "standard-x402-pending.json");
-var keyPairSigner = await loadKeyPairSigner({
-  base58Secret: process.env.SUBLY_DEMO_AGENT_KEYPAIR,
-  jsonFilePath: process.env.SUBLY_DEMO_AGENT_KEYPAIR_PATH,
-  label: "SUBLY_DEMO_AGENT_KEYPAIR"
-});
-var agentSecretKey = loadSecretKeyBytes({
-  base58Secret: process.env.SUBLY_DEMO_AGENT_KEYPAIR,
-  jsonFilePath: process.env.SUBLY_DEMO_AGENT_KEYPAIR_PATH,
-  label: "SUBLY_DEMO_AGENT_KEYPAIR"
-});
-var signer = new LocalKeypairAgentWalletSigner(keyPairSigner);
+var bundle = await agentWalletSignerFromEnv();
+var signer = bundle.signer;
 var rpc = createRpc(rpcUrl);
 var payer = createRelayerX402Payer({
   relayerBaseUrl,
   signer,
   rpc,
-  x402Fetch: await createSvmX402Fetch({ agentSecretKey, rpcUrl }),
+  x402Fetch: await createSvmX402Fetch({
+    signer: await svmTransactionSignerFromBundle(bundle),
+    rpcUrl
+  }),
   defaultMaxAmountRawUsdc,
   stateStore: fileStandardX402StateStore(pendingStatePath)
 });