@subly_fi/pay 0.6.2 → 0.7.1

package/dist/pay.js

@@ -2,6 +2,144 @@
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
 
+// ../../src/config/vault-catalog.ts
+import { readFileSync } from "node:fs";
+import { z } from "zod";
+
+// ../../src/lib/solana-address.ts
+var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var BASE58_LOOKUP = new Map(
+  [...BASE58_ALPHABET].map((character, index) => [character, BigInt(index)])
+);
+function assertSolanaAddress(value, fieldName) {
+  if (value.length < 32 || value.length > 44) {
+    throw new Error(`${fieldName} must be a valid Solana public key`);
+  }
+  if (decodeBase58(value).length !== 32) {
+    throw new Error(`${fieldName} must be a valid Solana public key`);
+  }
+  return value;
+}
+function decodeBase58(value) {
+  if (value.length === 0) {
+    return new Uint8Array();
+  }
+  let decoded = 0n;
+  for (const character of value) {
+    const digit = BASE58_LOOKUP.get(character);
+    if (digit === void 0) {
+      return new Uint8Array();
+    }
+    decoded = decoded * 58n + digit;
+  }
+  const bytes = [];
+  while (decoded > 0n) {
+    bytes.push(Number(decoded & 0xffn));
+    decoded >>= 8n;
+  }
+  for (const character of value) {
+    if (character !== "1") {
+      break;
+    }
+    bytes.push(0);
+  }
+  return Uint8Array.from(bytes.reverse());
+}
+
+// ../../src/config/vault.ts
+var MAINNET_USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+var KAMINO_VAULT_PROGRAM_ID = "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd";
+var NO_VAULT_FARM = "11111111111111111111111111111111";
+var DEFAULT_VAULT_CONFIG = Object.freeze({
+  address: "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr",
+  programId: KAMINO_VAULT_PROGRAM_ID,
+  usdcMint: MAINNET_USDC_MINT,
+  shareMint: "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a",
+  farm: "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
+});
+function vaultConfigFromEnv(env = process.env) {
+  const value = (name) => env[name]?.trim() || void 0;
+  const vaultAddress = value("SUBLY_VAULT_ADDRESS") ?? DEFAULT_VAULT_CONFIG.address;
+  const customVault = vaultAddress !== DEFAULT_VAULT_CONFIG.address;
+  const anchor = (name, fallback) => {
+    const configured = value(name);
+    if (customVault && configured === void 0) {
+      throw new Error(
+        `${name} is required for a custom vault. Generate its settings with npm run configure:vault -- <vault-address>; use ${NO_VAULT_FARM} for a vault without a farm.`
+      );
+    }
+    return assertSolanaAddress(configured ?? fallback, name);
+  };
+  const usdcMint = value("SUBLY_VAULT_USDC_MINT") ?? MAINNET_USDC_MINT;
+  if (usdcMint !== MAINNET_USDC_MINT) {
+    throw new Error(
+      "SUBLY_VAULT_USDC_MINT must be mainnet USDC; other deposit assets are not supported"
+    );
+  }
+  return Object.freeze({
+    address: assertSolanaAddress(vaultAddress, "SUBLY_VAULT_ADDRESS"),
+    programId: KAMINO_VAULT_PROGRAM_ID,
+    usdcMint,
+    shareMint: anchor("SUBLY_VAULT_SHARE_MINT", DEFAULT_VAULT_CONFIG.shareMint),
+    farm: anchor("SUBLY_VAULT_FARM", DEFAULT_VAULT_CONFIG.farm)
+  });
+}
+
+// ../../src/config/vault-catalog.ts
+var publicKey = z.string().refine((value) => {
+  try {
+    assertSolanaAddress(value, "vault catalog address");
+    return true;
+  } catch {
+    return false;
+  }
+}, "Invalid Solana public key");
+var catalogSchema = z.object({
+  version: z.literal(1),
+  defaultVault: publicKey,
+  vaults: z.array(z.object({
+    address: publicKey,
+    programId: z.literal(KAMINO_VAULT_PROGRAM_ID),
+    usdcMint: z.literal(MAINNET_USDC_MINT),
+    shareMint: publicKey,
+    farm: publicKey,
+    name: z.string().min(1).max(128).optional(),
+    depositsEnabled: z.boolean().optional(),
+    extraLookupTables: z.array(publicKey).max(16).optional()
+  }).strict()).min(1).max(100)
+}).strict();
+function parseVaultCatalog(value) {
+  const catalog = catalogSchema.parse(value);
+  const addresses = new Set(catalog.vaults.map((vault) => vault.address));
+  if (addresses.size !== catalog.vaults.length) throw new Error("Duplicate vault in catalog");
+  if (!addresses.has(catalog.defaultVault)) throw new Error("defaultVault must be in the vault catalog");
+  return { ...catalog, vaults: catalog.vaults.map((vault) => Object.freeze(vault)) };
+}
+function vaultCatalogFromEnv(env = process.env) {
+  const path = env.SUBLY_VAULTS_FILE?.trim();
+  if (!path) {
+    const vault = vaultConfigFromEnv(env);
+    return { version: 1, defaultVault: vault.address, vaults: [vault] };
+  }
+  const catalog = parseVaultCatalog(JSON.parse(readFileSync(path, "utf8")));
+  const selected = env.SUBLY_VAULT_ADDRESS?.trim() || catalog.defaultVault;
+  if (!catalog.vaults.some((vault) => vault.address === selected)) {
+    throw new Error("SUBLY_VAULT_ADDRESS must be in SUBLY_VAULTS_FILE");
+  }
+  return { ...catalog, defaultVault: selected };
+}
+function defaultCatalogVault(catalog) {
+  return catalog.vaults.find((vault) => vault.address === catalog.defaultVault);
+}
+
+// ../../src/config/constants.ts
+var PAYMENT_SCHEME = "subly-yield-exact";
+var SOLANA_MAINNET_NETWORK = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
+var SPL_TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+var ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+var SUBLY_VAULT = defaultCatalogVault(vaultCatalogFromEnv());
+var USDC_DECIMALS = 6;
+
 // ../../src/api/wallet-auth.ts
 import { createHash } from "node:crypto";
 import bs58 from "bs58";
@@ -85,15 +223,148 @@ async function ensureWalletOnboarded(params) {
     }
   };
   const wallet = params.signer.walletAddress;
+  const vault = params.vault ?? params.signer.vault?.address ?? SUBLY_VAULT.address;
   await post("register", "/v1/wallets/agent", {
     wallet,
+    vault,
     signingPolicyId: SELF_SERVE_POLICY_ID,
     signingMode: "non_interactive",
     signerValidationMode: params.signer.validationMode,
     signerProvider: params.signer.provider ?? "local-keypair",
     activateForPayments: true
   });
-  await post("sync", `/v1/wallets/${wallet}/sync`, { source: "chain" });
+  await post("sync", `/v1/wallets/${wallet}/sync`, { source: "chain", vault });
+}
+
+// ../../src/lib/associated-token-account.ts
+import { createHash as createHash2 } from "node:crypto";
+import bs582 from "bs58";
+var PDA_MARKER = Buffer.from("ProgramDerivedAddress", "utf8");
+var ED25519_P = (1n << 255n) - 19n;
+var ED25519_D = mod(-121665n * modPow(121666n, ED25519_P - 2n, ED25519_P), ED25519_P);
+function deriveAssociatedTokenAddress(params) {
+  const owner = decodePublicKey(params.owner, "owner");
+  const mint = decodePublicKey(params.mint ?? SUBLY_VAULT.usdcMint, "mint");
+  const tokenProgramId = decodePublicKey(
+    params.tokenProgramId ?? SPL_TOKEN_PROGRAM_ID,
+    "tokenProgramId"
+  );
+  const associatedTokenProgramId = decodePublicKey(
+    ASSOCIATED_TOKEN_PROGRAM_ID,
+    "associatedTokenProgramId"
+  );
+  for (let bump = 255; bump >= 0; bump -= 1) {
+    const address3 = createProgramAddress(
+      [owner, tokenProgramId, mint, Uint8Array.of(bump)],
+      associatedTokenProgramId
+    );
+    if (address3 !== null) {
+      return bs582.encode(address3);
+    }
+  }
+  throw new Error("Unable to derive associated token account address");
+}
+function createProgramAddress(seeds, programId) {
+  const hash = createHash2("sha256");
+  for (const seed of seeds) {
+    hash.update(seed);
+  }
+  hash.update(programId);
+  hash.update(PDA_MARKER);
+  const digest = hash.digest();
+  return isEd25519Point(digest) ? null : new Uint8Array(digest);
+}
+function decodePublicKey(value, fieldName) {
+  const decoded = bs582.decode(value);
+  if (decoded.length !== 32) {
+    throw new Error(`${fieldName} must be a 32-byte public key`);
+  }
+  return decoded;
+}
+function isEd25519Point(bytes) {
+  if (bytes.length !== 32) {
+    return false;
+  }
+  const yBytes = Uint8Array.from(bytes);
+  yBytes[31] = yBytes[31] & 127;
+  const y = littleEndianToBigInt(yBytes);
+  if (y >= ED25519_P) {
+    return false;
+  }
+  const ySquared = mod(y * y, ED25519_P);
+  const numerator = mod(ySquared - 1n, ED25519_P);
+  const denominator = mod(ED25519_D * ySquared + 1n, ED25519_P);
+  if (denominator === 0n) {
+    return false;
+  }
+  const xSquared = mod(
+    numerator * modPow(denominator, ED25519_P - 2n, ED25519_P),
+    ED25519_P
+  );
+  return xSquared === 0n || modPow(xSquared, (ED25519_P - 1n) / 2n, ED25519_P) === 1n;
+}
+function littleEndianToBigInt(bytes) {
+  let value = 0n;
+  for (let index = bytes.length - 1; index >= 0; index -= 1) {
+    value = (value << 8n) + BigInt(bytes[index]);
+  }
+  return value;
+}
+function mod(value, modulus) {
+  const result = value % modulus;
+  return result >= 0n ? result : result + modulus;
+}
+function modPow(base, exponent, modulus) {
+  let result = 1n;
+  let nextBase = mod(base, modulus);
+  let nextExponent = exponent;
+  while (nextExponent > 0n) {
+    if ((nextExponent & 1n) === 1n) {
+      result = mod(result * nextBase, modulus);
+    }
+    nextBase = mod(nextBase * nextBase, modulus);
+    nextExponent >>= 1n;
+  }
+  return result;
+}
+
+// ../../src/client/withdrawal-preview.ts
+var ROUNDING_RAW_USDC = 10n;
+async function assertWithdrawalPreview(input) {
+  const destination = deriveAssociatedTokenAddress({ owner: input.wallet, mint: input.vault.usdcMint });
+  const simulation = await input.rpc.simulateTransaction(
+    input.serializedTransaction,
+    {
+      encoding: "base64",
+      commitment: "confirmed",
+      sigVerify: false,
+      replaceRecentBlockhash: false,
+      innerInstructions: true
+    }
+  ).send({ abortSignal: AbortSignal.timeout(15e3) });
+  if (simulation.value.err !== null) {
+    throw new Error("Withdrawal preview failed on the client RPC; no transaction was signed. Check liquidity, RPC and blockhash, then prepare again.");
+  }
+  let received = 0n;
+  for (const group of simulation.value.innerInstructions ?? []) {
+    for (const instruction of group.instructions) {
+      if (!("parsed" in instruction) || instruction.programId !== SPL_TOKEN_PROGRAM_ID) continue;
+      const parsed = instruction.parsed;
+      if (parsed.type !== "transfer" && parsed.type !== "transferChecked") continue;
+      const info = parsed.info;
+      if (!info || info.destination !== destination && info.source !== destination) continue;
+      const raw = parsed.type === "transferChecked" ? info.tokenAmount?.amount : info.amount;
+      if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
+        throw new Error("Withdrawal preview returned an invalid token amount");
+      }
+      const amount = BigInt(raw);
+      if (info.destination === destination) received += amount;
+      if (info.source === destination) received -= amount;
+    }
+  }
+  if (received <= 0n || received > input.amountRawUsdc + ROUNDING_RAW_USDC || received < input.amountRawUsdc - ROUNDING_RAW_USDC) {
+    throw new Error("Withdrawal preview differs from the requested USDC amount; no transaction was signed");
+  }
 }
 
 // ../../src/client/lookup-tables.ts
@@ -152,6 +423,8 @@ var VaultFlowClientError = class extends Error {
   errorDetails;
 };
 var VaultFlowClient = class {
+  vault;
+  rpc;
   baseUrl;
   signer;
   fetchImpl;
@@ -159,6 +432,11 @@ var VaultFlowClient = class {
   pollTimeoutMs;
   pollIntervalMs;
   constructor(config) {
+    this.rpc = config.rpc;
+    this.vault = config.vault ?? config.signer.vault ?? SUBLY_VAULT;
+    if (config.signer.vault && config.signer.vault.address !== this.vault.address) {
+      throw new Error("Vault flow client and signer must select the same vault");
+    }
     this.baseUrl = config.relayerBaseUrl.replace(/\/$/, "");
     this.signer = config.signer;
     this.fetchImpl = config.fetchImpl ?? fetch;
@@ -180,6 +458,7 @@ var VaultFlowClient = class {
     try {
       prepared = await this.postJson("prepare", "/v1/deposits/prepare", {
         wallet: this.signer.walletAddress,
+        vault: this.vault.address,
         amountRawUsdc: input.amountRawUsdc.toString(),
         ...approvalId2 === void 0 ? {} : { approvalId: approvalId2 }
       });
@@ -193,10 +472,14 @@ var VaultFlowClient = class {
       }
       prepared = await this.postJson("prepare", "/v1/deposits/prepare", {
         wallet: this.signer.walletAddress,
+        vault: this.vault.address,
         amountRawUsdc: input.amountRawUsdc.toString(),
         approvalId: approvalId2
       });
     }
+    if (prepared.signingIntent?.wallet !== this.signer.walletAddress || prepared.signingIntent.vault !== this.vault.address || prepared.signingIntent.amountRawUsdc !== input.amountRawUsdc.toString()) {
+      throw new VaultFlowClientError("prepare", "Prepared deposit differs from the requested wallet, vault or amount");
+    }
     const signed = await this.signer.signDeposit({
       intent: prepared.signingIntent,
       serializedTransaction: prepared.serializedTransaction,
@@ -234,12 +517,23 @@ var VaultFlowClient = class {
       "/v1/withdrawals/prepare",
       {
         wallet: this.signer.walletAddress,
+        vault: this.vault.address,
         amountRawUsdc: input.amountRawUsdc.toString(),
         ...input.purpose === void 0 ? {} : { purpose: input.purpose },
         ...input.payment === void 0 ? {} : { payment: input.payment },
         ...input.approvalId === void 0 ? {} : { approvalId: input.approvalId }
       }
     );
+    if (prepared.signingIntent?.wallet !== this.signer.walletAddress || prepared.signingIntent.vault !== this.vault.address || prepared.requestedWithdrawRawUsdc !== input.amountRawUsdc.toString() || prepared.purpose !== (input.purpose ?? "normal") || input.purpose === "yield_realize" && prepared.signingIntent.allowFullExit) {
+      throw new VaultFlowClientError("prepare", "Prepared withdrawal differs from the requested operation");
+    }
+    await assertWithdrawalPreview({
+      rpc: this.rpc,
+      serializedTransaction: prepared.serializedTransaction,
+      wallet: this.signer.walletAddress,
+      vault: this.vault,
+      amountRawUsdc: input.amountRawUsdc
+    });
     const signed = await this.signer.signWithdrawal({
       intent: prepared.signingIntent,
       serializedTransaction: prepared.serializedTransaction,
@@ -277,12 +571,12 @@ var VaultFlowClient = class {
         await this.postJson(
           "sync",
           `/v1/wallets/${this.signer.walletAddress}/sync`,
-          { source: "chain" }
+          { source: "chain", vault: this.vault.address }
         );
       } catch {
       }
     }
-    const url2 = `${this.baseUrl}/v1/wallets/${this.signer.walletAddress}/budget`;
+    const url2 = `${this.baseUrl}/v1/wallets/${this.signer.walletAddress}/budget?vault=${this.vault.address}`;
     const response = await this.fetchImpl(url2, {
       headers: await walletAuthHeaders({
         signer: this.signer,
@@ -308,8 +602,12 @@ var VaultFlowClient = class {
       );
     }
     const body2 = parsed;
+    if (body2.position?.vault !== void 0 && body2.position.vault !== this.vault.address) {
+      throw new VaultFlowClientError("budget", "Relayer returned the budget for a different vault");
+    }
     return {
       wallet: this.signer.walletAddress,
+      vault: this.vault.address,
       principalBasisRawUsdc: body2.position?.principalBasisRawUsdc ?? "0",
       positionValueRawUsdc: body2.budget?.positionValueRawUsdc ?? "0",
       grossYieldRawUsdc: body2.budget?.grossYieldRawUsdc ?? "0",
@@ -327,7 +625,7 @@ var VaultFlowClient = class {
   /** Wallet's approvals as the relayer sees them (optionally by status). */
   async listApprovals(status) {
     const body2 = await this.getJson(
-      `/v1/wallets/${this.signer.walletAddress}/approvals${status === void 0 ? "" : `?status=${encodeURIComponent(status)}`}`
+      `/v1/wallets/${this.signer.walletAddress}/approvals${`?vault=${this.vault.address}${status === void 0 ? "" : `&status=${encodeURIComponent(status)}`}`}`
     );
     return body2.approvals ?? [];
   }
@@ -336,16 +634,21 @@ var VaultFlowClient = class {
    * policy + initial deposit). Paste `setupUrl` into the chat verbatim.
    */
   async createSetupSession(input) {
-    return await this.postJson(
+    const session = await this.postJson(
       "prepare",
       `/v1/wallets/${this.signer.walletAddress}/setup-sessions`,
       {
+        vault: this.vault.address,
         ...input.policy === void 0 ? {} : { policy: input.policy },
         ...input.enforcementMode === void 0 ? {} : { enforcementMode: input.enforcementMode },
         ...input.mandateTtlDays === void 0 ? {} : { mandateTtlDays: input.mandateTtlDays },
         ...input.initialDepositRawUsdc === void 0 ? {} : { initialDepositRawUsdc: input.initialDepositRawUsdc }
       }
     );
+    if (session.vault !== this.vault.address || session.wallet !== this.signer.walletAddress) {
+      throw new VaultFlowClientError("prepare", "Relayer returned a setup session for a different wallet or vault");
+    }
+    return session;
   }
   /** Polls a setup session (public capability URL — no auth needed). */
   async getSetupSession(sessionId) {
@@ -505,6 +808,9 @@ var RelayerRealizeError = class extends Error {
   detail;
 };
 var RelayerYieldRealizer = class {
+  get vault() {
+    return this.vaultFlows.vault.address;
+  }
   vaultFlows;
   constructor(config) {
     this.vaultFlows = new VaultFlowClient({
@@ -622,46 +928,14 @@ function errorCodeFrom(detail) {
   }
 }
 
-// ../../src/config/constants.ts
-var PAYMENT_SCHEME = "subly-yield-exact";
-var SOLANA_MAINNET_NETWORK = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
-var SPL_TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
-var ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
-var envOr = (name, fallback) => {
-  const value = process.env[name]?.trim();
-  return value ? value : fallback;
-};
-var SUBLY_VAULT = {
-  name: "Subly USDC Payment Vault Alpha",
-  address: envOr(
-    "SUBLY_VAULT_ADDRESS",
-    "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr"
-  ),
-  programId: "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd",
-  usdcMint: envOr(
-    "SUBLY_VAULT_USDC_MINT",
-    "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"
-  ),
-  shareMint: envOr(
-    "SUBLY_VAULT_SHARE_MINT",
-    "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a"
-  ),
-  lookupTable: "7UbXhDnpK7WVnwsfivzQRENoqKqAULQ5s19gS1xJrQEo",
-  farm: envOr(
-    "SUBLY_VAULT_FARM",
-    "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
-  )
-};
-var USDC_DECIMALS = 6;
-
 // ../../src/lib/canonical-json.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 
 // ../../src/lib/hash.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 var EMPTY_BODY_HASH = "sha256-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
 function sha256TaggedHex(data) {
-  return `sha256-${createHash2("sha256").update(data).digest("hex")}`;
+  return `sha256-${createHash3("sha256").update(data).digest("hex")}`;
 }
 function stableStringify(value) {
   if (value === null) {
@@ -685,11 +959,11 @@ function hashStableJson(value) {
 
 // ../../src/lib/canonical-json.ts
 function sha256HexOf(data) {
-  return createHash3("sha256").update(data, "utf8").digest("hex");
+  return createHash4("sha256").update(data, "utf8").digest("hex");
 }
 
 // ../../src/x402/headers.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 var PAYMENT_REQUIRED_HEADER = "payment-required";
 var MAX_HEADER_JSON_BYTES = 16384;
 var X402HeaderError = class extends Error {
@@ -700,41 +974,41 @@ var X402HeaderError = class extends Error {
     this.reason = reason;
   }
 };
-var sublyPaymentRequirementsSchema = z.object({
-  scheme: z.literal(PAYMENT_SCHEME),
-  network: z.string().min(1),
-  asset: z.string().min(32),
+var sublyPaymentRequirementsSchema = z2.object({
+  scheme: z2.literal(PAYMENT_SCHEME),
+  network: z2.string().min(1),
+  asset: z2.string().min(32),
   /** Exact seller amount in raw USDC; the scheme settles exactly this. */
-  amountRawUsdc: z.string().regex(/^[1-9]\d*$/),
-  resource: z.string().url(),
-  description: z.string().optional(),
-  mimeType: z.string().optional(),
-  payTo: z.string().min(32),
-  maxTimeoutSeconds: z.number().int().positive(),
-  extra: z.object({
-    sellerRequestId: z.string().min(1),
-    seller: z.string().min(32),
-    sellerUsdcAta: z.string().min(32),
-    vault: z.string().min(32),
-    shareMint: z.string().min(32)
+  amountRawUsdc: z2.string().regex(/^[1-9]\d*$/),
+  resource: z2.string().url(),
+  description: z2.string().optional(),
+  mimeType: z2.string().optional(),
+  payTo: z2.string().min(32),
+  maxTimeoutSeconds: z2.number().int().positive(),
+  extra: z2.object({
+    sellerRequestId: z2.string().min(1),
+    seller: z2.string().min(32),
+    sellerUsdcAta: z2.string().min(32),
+    vault: z2.string().min(32),
+    shareMint: z2.string().min(32)
   })
 }).loose();
-var paymentRequiredSchema = z.object({
-  x402Version: z.number().int(),
-  accepts: z.array(z.unknown()),
-  error: z.string().optional()
+var paymentRequiredSchema = z2.object({
+  x402Version: z2.number().int(),
+  accepts: z2.array(z2.unknown()),
+  error: z2.string().optional()
 }).loose();
-var sublyPaymentPayloadSchema = z.object({
-  x402Version: z.number().int(),
-  scheme: z.literal(PAYMENT_SCHEME),
-  network: z.string().min(1),
-  payload: z.object({
-    paymentId: z.string().min(1),
-    requestBindingHash: z.string().min(1),
-    preparedMessageHash: z.string().min(1),
-    serializedTransaction: z.string().min(1).max(4096),
-    agentSignature: z.string().min(1).max(128),
-    temporarySettlementSignature: z.string().min(1).max(128)
+var sublyPaymentPayloadSchema = z2.object({
+  x402Version: z2.number().int(),
+  scheme: z2.literal(PAYMENT_SCHEME),
+  network: z2.string().min(1),
+  payload: z2.object({
+    paymentId: z2.string().min(1),
+    requestBindingHash: z2.string().min(1),
+    preparedMessageHash: z2.string().min(1),
+    serializedTransaction: z2.string().min(1).max(4096),
+    agentSignature: z2.string().min(1).max(128),
+    temporarySettlementSignature: z2.string().min(1).max(128)
   })
 }).loose();
 function decodeX402Header(headerValue) {
@@ -764,29 +1038,29 @@ function requestBodyHashFor(body2) {
 }
 
 // ../../src/x402/standard-requirements.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var STANDARD_EXACT_SCHEME = "exact";
-var standardExactRequirementSchema = z2.object({
-  scheme: z2.literal(STANDARD_EXACT_SCHEME),
+var standardExactRequirementSchema = z3.object({
+  scheme: z3.literal(STANDARD_EXACT_SCHEME),
   /** CAIP-2 chain id, e.g. "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp". */
-  network: z2.string().min(1),
+  network: z3.string().min(1),
   /** SPL mint (Solana) or token contract (EVM); Subly only pays USDC/Solana. */
-  asset: z2.string().min(1),
+  asset: z3.string().min(1),
   /** Exact price in the asset's atomic units, as a decimal string. */
-  amount: z2.string().regex(/^[1-9]\d*$/),
+  amount: z3.string().regex(/^[1-9]\d*$/),
   /** Recipient wallet; the transfer destination ATA is derived from it. */
-  payTo: z2.string().min(1),
-  maxTimeoutSeconds: z2.number().int().positive().optional(),
-  extra: z2.object({
+  payTo: z3.string().min(1),
+  maxTimeoutSeconds: z3.number().int().positive().optional(),
+  extra: z3.object({
     /** Facilitator address that pays the tx fee (gas sponsorship). */
-    feePayer: z2.string().min(1).optional()
+    feePayer: z3.string().min(1).optional()
   }).loose().optional()
 }).loose();
-var standardPaymentRequiredSchema = z2.object({
-  x402Version: z2.number().int(),
-  accepts: z2.array(z2.unknown()),
-  error: z2.string().optional(),
-  resource: z2.object({ url: z2.string().optional() }).loose().optional()
+var standardPaymentRequiredSchema = z3.object({
+  x402Version: z3.number().int(),
+  accepts: z3.array(z3.unknown()),
+  error: z3.string().optional(),
+  resource: z3.object({ url: z3.string().optional() }).loose().optional()
 }).loose();
 var StandardX402ChallengeError = class extends Error {
   reason;
@@ -916,7 +1190,7 @@ var StandardX402Payer = class {
       }
     }
   }
-  pay(input) {
+  pay(input, realizer = this.realizer) {
     const method2 = (input.method ?? "GET").toUpperCase();
     const requestBodyHash = requestBodyHashFor(input.body ?? null);
     const pendingKey = pendingPaymentKey({
@@ -928,17 +1202,20 @@ var StandardX402Payer = class {
     if (existingFlow !== void 0) {
       return existingFlow;
     }
-    const flow = this.run(input, {
-      method: method2,
-      requestBodyHash,
-      pendingKey
-    }).finally(() => {
+    const run = async () => {
+      if (this.stateStore?.withExclusiveLock) {
+        this.pending.clear();
+        for (const record of this.stateStore.load()) this.pending.set(record.key, record);
+      }
+      return this.run(input, { method: method2, requestBodyHash, pendingKey }, realizer);
+    };
+    const flow = (this.stateStore?.withExclusiveLock ? this.stateStore.withExclusiveLock(run) : run()).finally(() => {
       this.inFlight.delete(pendingKey);
     });
     this.inFlight.set(pendingKey, flow);
     return flow;
   }
-  async run(input, computed) {
+  async run(input, computed, realizer) {
     const { method: method2, requestBodyHash, pendingKey } = computed;
     const existingPending = this.pending.get(pendingKey);
     if (existingPending !== void 0 && input.forceNewPayment !== true) {
@@ -979,7 +1256,7 @@ var StandardX402Payer = class {
     }
     let realized;
     try {
-      realized = await this.realizer.ensureUsdcAvailable({
+      realized = await realizer.ensureUsdcAvailable({
         amountRawUsdc: selected.amountRawUsdc,
         payment: {
           payTo: selected.payTo,
@@ -1053,9 +1330,9 @@ var StandardX402Payer = class {
     }
     this.clearDelivered(pendingKey);
     const paymentTxSignature = extractSettledPaymentTxSignature(response);
-    if (paymentTxSignature !== null && typeof realized.withdrawalId === "string" && this.realizer.reportPayment !== void 0) {
+    if (paymentTxSignature !== null && typeof realized.withdrawalId === "string" && realizer.reportPayment !== void 0) {
       try {
-        await this.realizer.reportPayment({
+        await realizer.reportPayment({
           withdrawalId: realized.withdrawalId,
           paymentTxSignature
         });
@@ -1067,6 +1344,7 @@ var StandardX402Payer = class {
     }
     return {
       paid: true,
+      ...realizer.vault === void 0 ? {} : { fundingVault: realizer.vault },
       status: response.status,
       body: bodyText,
       payment: {
@@ -1229,22 +1507,22 @@ function createRelayerX402Payer(config) {
 import { createKeyPairSignerFromBytes as createKeyPairSignerFromBytes2 } from "@solana/kit";
 
 // ../../src/solana/keys.ts
-import { readFileSync } from "node:fs";
-import bs582 from "bs58";
+import { readFileSync as readFileSync2 } from "node:fs";
+import bs583 from "bs58";
 import {
   createKeyPairSignerFromBytes
 } from "@solana/kit";
 function loadSecretKeyBytes(params) {
   const { base58Secret, jsonFilePath, label } = params;
   if (base58Secret !== void 0 && base58Secret.length > 0) {
-    const bytes = bs582.decode(base58Secret);
+    const bytes = bs583.decode(base58Secret);
     if (bytes.length !== 64) {
       throw new Error(`${label} base58 secret must decode to 64 bytes`);
     }
     return bytes;
   }
   if (jsonFilePath !== void 0 && jsonFilePath.length > 0) {
-    const raw = JSON.parse(readFileSync(jsonFilePath, "utf8"));
+    const raw = JSON.parse(readFileSync2(jsonFilePath, "utf8"));
     if (!Array.isArray(raw) || raw.length !== 64) {
       throw new Error(`${label} keypair file must be a 64-byte JSON array`);
     }
@@ -1259,7 +1537,7 @@ import bs587 from "bs58";
 import nacl3 from "tweetnacl";
 
 // ../../src/solana/tx.ts
-import bs583 from "bs58";
+import bs584 from "bs58";
 import {
   appendTransactionMessageInstructions,
   compileTransaction,
@@ -1306,11 +1584,11 @@ function signatureBase58ForSigner(transaction, signer2) {
   if (signature === null || signature === void 0) {
     return null;
   }
-  return bs583.encode(signature);
+  return bs584.encode(signature);
 }
 
 // ../../src/client/remote-signer-transport.ts
-import bs584 from "bs58";
+import bs585 from "bs58";
 import nacl2 from "tweetnacl";
 var RemoteSigningError = class extends Error {
   constructor(provider, message, detail = null) {
@@ -1325,7 +1603,7 @@ var RemoteSigningError = class extends Error {
 function ed25519PublicKeyBytes(provider, walletAddress) {
   let bytes;
   try {
-    bytes = bs584.decode(walletAddress);
+    bytes = bs585.decode(walletAddress);
   } catch {
     throw new RemoteSigningError(
       provider,
@@ -1341,10 +1619,10 @@ function ed25519PublicKeyBytes(provider, walletAddress) {
   return bytes;
 }
 function verifiedEd25519Signature(params) {
-  const publicKey = ed25519PublicKeyBytes(params.provider, params.walletAddress);
+  const publicKey2 = ed25519PublicKeyBytes(params.provider, params.walletAddress);
   const encoded = params.encodedSignature.trim();
   for (const candidate of decodeSignatureCandidates(encoded)) {
-    if (nacl2.sign.detached.verify(params.message, candidate, publicKey)) {
+    if (nacl2.sign.detached.verify(params.message, candidate, publicKey2)) {
       return candidate;
     }
   }
@@ -1360,7 +1638,7 @@ function decodeSignatureCandidates(encoded) {
     candidates.push(Uint8Array.from(Buffer.from(hex, "hex")));
   }
   try {
-    const fromBase58 = bs584.decode(encoded);
+    const fromBase58 = bs585.decode(encoded);
     if (fromBase58.length === 64) {
       candidates.push(fromBase58);
     }
@@ -1398,8 +1676,8 @@ async function requestVerifiedTransactionSignature(params) {
       `signed transaction is missing the signature for ${transport.walletAddress}`
     );
   }
-  const publicKey = params.publicKey ?? ed25519PublicKeyBytes(transport.provider, transport.walletAddress);
-  if (!nacl2.sign.detached.verify(params.messageBytes, signature, publicKey)) {
+  const publicKey2 = params.publicKey ?? ed25519PublicKeyBytes(transport.provider, transport.walletAddress);
+  if (!nacl2.sign.detached.verify(params.messageBytes, signature, publicKey2)) {
     throw new RemoteSigningError(
       transport.provider,
       "returned signature does not verify over the requested transaction"
@@ -1421,7 +1699,7 @@ async function externallySignedAgentTransaction(params) {
   });
   return {
     serializedTransaction: attached.serializedBase64,
-    agentSignature: bs584.encode(signature)
+    agentSignature: bs585.encode(signature)
   };
 }
 async function providerJsonRequest(params) {
@@ -1465,98 +1743,6 @@ function computeRequestBindingHash(fields) {
   });
 }
 
-// ../../src/lib/associated-token-account.ts
-import { createHash as createHash4 } from "node:crypto";
-import bs585 from "bs58";
-var PDA_MARKER = Buffer.from("ProgramDerivedAddress", "utf8");
-var ED25519_P = (1n << 255n) - 19n;
-var ED25519_D = mod(-121665n * modPow(121666n, ED25519_P - 2n, ED25519_P), ED25519_P);
-function deriveAssociatedTokenAddress(params) {
-  const owner = decodePublicKey(params.owner, "owner");
-  const mint = decodePublicKey(params.mint ?? SUBLY_VAULT.usdcMint, "mint");
-  const tokenProgramId = decodePublicKey(
-    params.tokenProgramId ?? SPL_TOKEN_PROGRAM_ID,
-    "tokenProgramId"
-  );
-  const associatedTokenProgramId = decodePublicKey(
-    ASSOCIATED_TOKEN_PROGRAM_ID,
-    "associatedTokenProgramId"
-  );
-  for (let bump = 255; bump >= 0; bump -= 1) {
-    const address3 = createProgramAddress(
-      [owner, tokenProgramId, mint, Uint8Array.of(bump)],
-      associatedTokenProgramId
-    );
-    if (address3 !== null) {
-      return bs585.encode(address3);
-    }
-  }
-  throw new Error("Unable to derive associated token account address");
-}
-function createProgramAddress(seeds, programId) {
-  const hash = createHash4("sha256");
-  for (const seed of seeds) {
-    hash.update(seed);
-  }
-  hash.update(programId);
-  hash.update(PDA_MARKER);
-  const digest = hash.digest();
-  return isEd25519Point(digest) ? null : new Uint8Array(digest);
-}
-function decodePublicKey(value, fieldName) {
-  const decoded = bs585.decode(value);
-  if (decoded.length !== 32) {
-    throw new Error(`${fieldName} must be a 32-byte public key`);
-  }
-  return decoded;
-}
-function isEd25519Point(bytes) {
-  if (bytes.length !== 32) {
-    return false;
-  }
-  const yBytes = Uint8Array.from(bytes);
-  yBytes[31] = yBytes[31] & 127;
-  const y = littleEndianToBigInt(yBytes);
-  if (y >= ED25519_P) {
-    return false;
-  }
-  const ySquared = mod(y * y, ED25519_P);
-  const numerator = mod(ySquared - 1n, ED25519_P);
-  const denominator = mod(ED25519_D * ySquared + 1n, ED25519_P);
-  if (denominator === 0n) {
-    return false;
-  }
-  const xSquared = mod(
-    numerator * modPow(denominator, ED25519_P - 2n, ED25519_P),
-    ED25519_P
-  );
-  return xSquared === 0n || modPow(xSquared, (ED25519_P - 1n) / 2n, ED25519_P) === 1n;
-}
-function littleEndianToBigInt(bytes) {
-  let value = 0n;
-  for (let index = bytes.length - 1; index >= 0; index -= 1) {
-    value = (value << 8n) + BigInt(bytes[index]);
-  }
-  return value;
-}
-function mod(value, modulus) {
-  const result = value % modulus;
-  return result >= 0n ? result : result + modulus;
-}
-function modPow(base, exponent, modulus) {
-  let result = 1n;
-  let nextBase = mod(base, modulus);
-  let nextExponent = exponent;
-  while (nextExponent > 0n) {
-    if ((nextExponent & 1n) === 1n) {
-      result = mod(result * nextBase, modulus);
-    }
-    nextBase = mod(nextBase * nextBase, modulus);
-    nextExponent >>= 1n;
-  }
-  return result;
-}
-
 // ../../src/client/transaction-intent-validator.ts
 var COMPUTE_BUDGET_PROGRAM_ID = "ComputeBudget111111111111111111111111111111";
 var SYSTEM_PROGRAM_ID = "11111111111111111111111111111111";
@@ -1699,16 +1885,16 @@ function validatePaymentIntentTransaction(params) {
   if (intent.network !== SOLANA_MAINNET_NETWORK) {
     reject("network_mismatch", "Unsupported network");
   }
-  if (intent.vault !== SUBLY_VAULT.address) {
+  if (intent.vault !== policy.vault.address) {
     reject("vault_mismatch", "Unsupported vault");
   }
-  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
+  if (intent.shareMint !== policy.vault.shareMint) {
     reject("share_mint_mismatch", "Unsupported share mint");
   }
-  if (intent.farm !== SUBLY_VAULT.farm) {
+  if (intent.farm !== policy.vault.farm) {
     reject("farm_mismatch", "Unsupported Kamino farm");
   }
-  if (intent.asset !== SUBLY_VAULT.usdcMint) {
+  if (intent.asset !== policy.vault.usdcMint) {
     reject("asset_mismatch", "Only USDC payments are supported");
   }
   if (intent.memo !== intent.paymentId) {
@@ -1824,7 +2010,7 @@ function validateDepositIntentTransaction(params) {
   if (new Date(intent.expiresAt).getTime() <= now) {
     reject("expired", "Deposit intent has expired");
   }
-  assertVaultIntentTargets(intent);
+  assertVaultIntentTargets(intent, policy.vault);
   const decoded = decodeIntentTransaction({
     serializedTransaction: params.serializedTransaction,
     ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
@@ -1847,6 +2033,9 @@ function validateDepositIntentTransaction(params) {
       case MEMO_PROGRAM_ID:
         break;
       case KVAULT_PROGRAM_ID: {
+        if (sawDeposit) {
+          reject("duplicate_deposit", "A deposit intent authorizes exactly one KVault deposit");
+        }
         if (!bytesStartWith(ix.data, KVAULT_DEPOSIT_DISCRIMINATOR)) {
           reject("unexpected_instruction", "Unexpected KVault instruction in deposit");
         }
@@ -1897,7 +2086,7 @@ function validateWithdrawalIntentTransaction(params) {
   if (new Date(intent.expiresAt).getTime() <= now) {
     reject("expired", "Withdrawal intent has expired");
   }
-  assertVaultIntentTargets(intent);
+  assertVaultIntentTargets(intent, policy.vault);
   const expectedDestination = deriveAssociatedTokenAddress({
     owner: intent.wallet,
     mint: intent.asset
@@ -1995,22 +2184,23 @@ function validateWithdrawalIntentTransaction(params) {
     );
   }
 }
-function assertVaultIntentTargets(intent) {
-  if (intent.vault !== SUBLY_VAULT.address) {
+function assertVaultIntentTargets(intent, vault) {
+  if (intent.vault !== vault.address) {
     reject("vault_mismatch", "Unsupported vault");
   }
-  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
+  if (intent.shareMint !== vault.shareMint) {
     reject("share_mint_mismatch", "Unsupported share mint");
   }
-  if (intent.farm !== SUBLY_VAULT.farm) {
+  if (intent.farm !== vault.farm) {
     reject("farm_mismatch", "Unsupported Kamino farm");
   }
-  if (intent.asset !== SUBLY_VAULT.usdcMint) {
+  if (intent.asset !== vault.usdcMint) {
     reject("asset_mismatch", "Only USDC is supported");
   }
 }
 function resolveIntentValidationPolicy(policy) {
   const resolved = {
+    vault: policy?.vault ?? SUBLY_VAULT,
     maxComputeUnitLimit: policy?.maxComputeUnitLimit ?? DEFAULT_MAX_COMPUTE_UNIT_LIMIT,
     maxComputeUnitPriceMicroLamports: policy?.maxComputeUnitPriceMicroLamports ?? DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS,
     maxTemporaryAccountLamports: policy?.maxTemporaryAccountLamports ?? MAX_TEMP_ACCOUNT_LAMPORTS
@@ -2362,10 +2552,12 @@ function readShortVec(bytes, startOffset) {
 
 // ../../src/client/agent-wallet-signer.ts
 var IntentValidatingAgentWalletSigner = class {
+  vault;
   validationMode = "structured_intent_transaction";
   validationPolicy;
   constructor(validationPolicy) {
-    this.validationPolicy = validationPolicy;
+    this.vault = Object.freeze({ ...validationPolicy?.vault ?? SUBLY_VAULT });
+    this.validationPolicy = { ...validationPolicy, vault: this.vault };
   }
   async signPayment(params) {
     this.assertIntentWallet(params.intent.wallet);
@@ -2523,15 +2715,15 @@ async function createCircleSignerTransport(config) {
   const entitySecretCiphertext = async () => {
     if (entityPublicKey === null) {
       const data = await request("GET", "/v1/w3s/config/entity/publicKey");
-      const publicKey = data.publicKey;
-      if (typeof publicKey !== "string") {
+      const publicKey2 = data.publicKey;
+      if (typeof publicKey2 !== "string") {
         throw new RemoteSigningError(
           PROVIDER,
           "entity public key response has no publicKey",
           data
         );
       }
-      entityPublicKey = createPublicKey(publicKey);
+      entityPublicKey = createPublicKey(publicKey2);
     }
     return publicEncrypt(
       {
@@ -2804,14 +2996,34 @@ async function agentWalletSignerFromEnv(env = process.env) {
 }
 
 // ../../src/client/standard-x402-state-store.ts
-import { mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "node:fs";
+import { closeSync, mkdirSync, openSync, readFileSync as readFileSync3, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 function fileStandardX402StateStore(path) {
   return {
+    async withExclusiveLock(operation) {
+      mkdirSync(dirname(path), { recursive: true, mode: 448 });
+      const lockPath = `${path}.lock`;
+      let fd;
+      try {
+        fd = openSync(lockPath, "wx", 384);
+      } catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "EEXIST") {
+          throw new Error(`Payment state is locked: ${lockPath}. Another client may be paying. After a crash, stop all clients before removing only this .lock file; preserve the payment state JSON.`);
+        }
+        throw error;
+      }
+      try {
+        writeFileSync(fd, JSON.stringify({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() }));
+        return await operation();
+      } finally {
+        closeSync(fd);
+        unlinkSync(lockPath);
+      }
+    },
     load() {
       let text;
       try {
-        text = readFileSync2(path, "utf8");
+        text = readFileSync3(path, "utf8");
       } catch (error) {
         if (isMissingFileError(error)) {
           return [];
@@ -2833,12 +3045,12 @@ function fileStandardX402StateStore(path) {
     },
     save(records) {
       const directory = dirname(path);
-      mkdirSync(directory, { recursive: true });
+      mkdirSync(directory, { recursive: true, mode: 448 });
       const tempPath = join(
         directory,
         `.${basename(path)}.${process.pid}.${Date.now()}.tmp`
       );
-      writeFileSync(tempPath, JSON.stringify(records, null, 2));
+      writeFileSync(tempPath, JSON.stringify(records, null, 2), { mode: 384, flag: "wx" });
       renameSync(tempPath, path);
     }
   };
@@ -2874,7 +3086,7 @@ async function svmTransactionSignerFromBundle(bundle2) {
 }
 function remoteSvmTransactionSigner(transport) {
   const signerAddress = address2(transport.walletAddress);
-  const publicKey = ed25519PublicKeyBytes(
+  const publicKey2 = ed25519PublicKeyBytes(
     transport.provider,
     transport.walletAddress
   );
@@ -2887,7 +3099,7 @@ function remoteSvmTransactionSigner(transport) {
           transport,
           serializedTransactionBase64: getBase64EncodedWireTransaction2(transaction),
           messageBytes: transaction.messageBytes,
-          publicKey
+          publicKey: publicKey2
         });
         dictionaries.push(
           Object.freeze({ [signerAddress]: signature })