npm - @visa/cli - Versions diffs - 5.0.0-rc.355 → 5.0.0-rc.356 - Mend

@visa/cli 5.0.0-rc.355 → 5.0.0-rc.356

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/cli.js +7 -7
package/dist/mcp-server/index.js +46 -46
package/dist/merchant-ucp-mcp/index.js +3 -3
package/native/bin/win32-x64/visa-keychain-win.exe +0 -0
package/package.json +1 -1
package/server.json +2 -2

package/dist/cli.js CHANGED Viewed

@@ -1,9 +1,9 @@
 "use strict";var Ibr=Object.create;var MG=Object.defineProperty;var Pbr=Object.getOwnPropertyDescriptor;var xbr=Object.getOwnPropertyNames;var Obr=Object.getPrototypeOf,Rbr=Object.prototype.hasOwnProperty;var A=(e,t,r)=>()=>{if(r)throw r[0];try{return e&&(t=e(e=0)),t}catch(n){throw r=[n],n}};var _=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(r){throw t=0,r}},ha=(e,t)=>{for(var r in t)MG(e,r,{get:t[r],enumerable:!0})},lYe=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of xbr(t))!Rbr.call(e,i)&&i!==r&&MG(e,i,{get:()=>t[i],enumerable:!(n=Pbr(t,i))||n.enumerable});return e};var ie=(e,t,r)=>(r=e!=null?Ibr(Obr(e)):{},lYe(t||!e||!e.__esModule?MG(r,"default",{value:e,enumerable:!0}):r,e)),W=e=>lYe(MG({},"__esModule",{value:!0}),e);var Qm,Age=A(()=>{"use strict";Qm="6820f6e91b762e645c9bf020c0d3673bb99d4a25a824880c0d548e10bb9bc7b1"});function hYe(e){return`${e}-${mYe.randomBytes(24).toString("base64url")}`}function gYe(e=process.env){return e.NODE_ENV==="test"||e[Nbr]==="true"}function eh(e=process.env){return e.VISA_MOCK_KEYCHAIN==="true"&&gYe(e)}function _Ye(e=process.env){return e.VISA_MOCK_TOUCHID==="true"&&gYe(e)}function yYe(){return pYe??=hYe("mock-session"),pYe}function wge(e=process.env){return e.NODE_ENV==="test"?Qm:(fYe??=hYe("mock-rc"),fYe)}var mYe,Nbr,pYe,fYe,Ige=A(()=>{"use strict";mYe=ie(require("crypto"));Age();Nbr="VISA_ALLOW_INSECURE_MOCKS"});function To(e=process.env){let t=e[SYe];return typeof t=="string"&&t.trim().length>0?t:kG.join(EYe.homedir(),".visa-cli")}function vYe(e=process.env){let t=e[SYe];return typeof t=="string"&&t.trim().length>0}function TYe(e=process.env){let t=kG.resolve(To(e));return bYe.createHash("sha256").update(t).digest("hex").slice(0,16)}var bYe,EYe,kG,SYe,kd=A(()=>{"use strict";bYe=ie(require("crypto")),EYe=ie(require("os")),kG=ie(require("path")),SYe="VISA_CLI_HOME"});function Cbr(e){return typeof e=="object"&&e!==null&&"code"in e&&e.code==="ENOENT"}function ga(e,t){return new Ok(`${e} ${t}`)}function UG(e=process.platform){if(e==="win32")throw new Ok("owner-only identity files are not supported on Windows yet; protocol-v2 pairing is disabled until verified ACL storage is available")}function Xw(e,t,r,n){try{return r.lstatSync(e)}catch(i){if(n&&Cbr(i))return null;throw ga(t,"could not be inspected safely")}}function IYe(e,t){UG(t);let r=e.expectedUid??process.geteuid?.();if(!Number.isSafeInteger(r)||r<0)throw new Ok("private state owner could not be verified against the process effective uid");return r}function F4(e,t,r){return!(r!=="win32"||e.dev!==0||t.dev!==0||e.ino!==0||t.ino!==0)||e.dev===t.dev&&e.ino===t.ino}function DG(e,t,r,n){if(e.isSymbolicLink()||!e.isDirectory())throw ga(t,"must be a real owner-only directory, not a symlink");if(r!=="win32"){if(e.uid!==n)throw ga(t,"must be owned by the current effective user");if((e.mode&63)!==0)throw ga(t,"must not grant access to group or other users (use mode 0700)")}}function xk(e,t,r,n){if(e.isSymbolicLink()||!e.isFile())throw ga(t,"must be a real owner-only regular file, not a symlink");if(r!=="win32"){if(e.uid!==n)throw ga(t,"must be owned by the current effective user");if((e.mode&63)!==0)throw ga(t,"must not grant access to group or other users (use mode 0600)")}}function Vc(e,t={}){let r=t.ops??LG,n=t.platform??process.platform,i=IYe(t,n),o=Xw(e,"private state directory",r,!0);return o?(DG(o,"private state directory",n,i),!0):!1}function BG(e,t={}){let r=t.ops??LG,n=t.platform??process.platform,i=t.maxBytes??$4;if(!Number.isSafeInteger(i)||i<1)throw new Error("private state maximum size must be a positive safe integer");let o=IYe(t,n),s=Zw.dirname(e),a=Xw(s,"private state directory",r,!0);if(!a)return null;DG(a,"private state directory",n,o);let c=Xw(e,"private state file",r,!0);if(!c)return null;xk(c,"private state file",n,o);let u;try{try{u=r.openSync(e,r.constants.O_RDONLY|(r.constants.O_NOFOLLOW??0))}catch{throw ga("private state file","changed or could not be opened safely")}let d=r.fstatSync(u);if(xk(d,"private state file",n,o),!F4(c,d,n))throw ga("private state file","changed while it was being opened");if(!Number.isSafeInteger(d.size)||d.size<0||d.size>i)throw ga("private state file",`exceeds the ${i}-byte safety limit`);let l=Xw(e,"private state file",r,!1);if(xk(l,"private state file",n,o),!F4(d,l,n))throw ga("private state file","changed while it was being opened");let p=Xw(s,"private state directory",r,!1);if(DG(p,"private state directory",n,o),!F4(a,p,n))throw ga("private state directory","changed while private state was being opened");let f=[],m=0;for(;m<=i;){let b=Buffer.allocUnsafe(Math.min(65536,i+1-m)),E=r.readSync(u,b,0,b.length,null);if(E===0)break;if(m+=E,m>i)throw ga("private state file",`exceeds the ${i}-byte safety limit`);f.push(b.subarray(0,E))}let h=r.fstatSync(u);if(xk(h,"private state file",n,o),!F4(d,h,n)||h.size!==d.size||h.mtimeMs!==d.mtimeMs||h.ctimeMs!==d.ctimeMs||m!==h.size)throw ga("private state file","changed while it was being read");let g=Xw(e,"private state file",r,!1);if(xk(g,"private state file",n,o),!F4(h,g,n))throw ga("private state file","changed while it was being read");let y=Xw(s,"private state directory",r,!1);if(DG(y,"private state directory",n,o),!F4(a,y,n))throw ga("private state directory","changed while private state was being read");let S;try{S=new wYe.TextDecoder("utf-8",{fatal:!0}).decode(Buffer.concat(f,m))}catch{throw ga("private state file","must contain valid UTF-8")}return{contents:S,mtimeMs:h.mtimeMs}}finally{u!==void 0&&r.closeSync(u)}}function Xl(e,t={}){return BG(e,t)?.contents??null}function Fc(e,t,r=LG,n=process.platform){UG(n);let i=Zw.dirname(e),o=Zw.join(i,`.${Zw.basename(e)}.${process.pid}.${(0,AYe.randomBytes)(8).toString("hex")}.tmp`),s=r.constants.O_NOFOLLOW??0,a,c=!1;try{a=r.openSync(o,r.constants.O_WRONLY|r.constants.O_CREAT|r.constants.O_EXCL|s,384),r.writeFileSync(a,t,{encoding:"utf8"}),r.fsyncSync(a),r.closeSync(a),a=void 0,r.renameSync(o,e),c=!0;let u;try{u=r.openSync(e,r.constants.O_RDONLY|s),r.fsyncSync(u)}finally{u!==void 0&&r.closeSync(u)}let d;try{let l=r.constants.O_DIRECTORY??0;d=r.openSync(i,r.constants.O_RDONLY|l|s),r.fsyncSync(d)}finally{d!==void 0&&r.closeSync(d)}}finally{a!==void 0&&r.closeSync(a),c||r.rmSync(o,{force:!0})}}var AYe,LG,Zw,wYe,$4,Ok,q_=A(()=>{"use strict";AYe=require("node:crypto"),LG=ie(require("node:fs")),Zw=ie(require("node:path")),wYe=require("node:util"),$4=1024*1024,Ok=class extends Error{constructor(t){super(t),this.name="PrivateStateSecurityError"}}});function xge(e=process.env){return qG.join(To(e),"owner-profiles")}function Oge(e=process.env){return qG.join(xge(e),"profiles.json")}function xYe(e,t){return`op_${(0,jG.createHash)("sha256").update(`${Rge(e)}\0${t}`).digest("hex").slice(0,24)}`}function Rge(e){let t=new URL(e);if(t.username||t.password||t.search||t.hash||t.pathname!==""&&t.pathname!=="/"||t.protocol!=="https:"&&!(t.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(t.hostname)))throw new Error("owner profile auth origin must be HTTPS (or HTTP loopback)");return t.origin}function OYe(e){if(!e||typeof e!="object"||Array.isArray(e))return!1;let t=e;if(!Mbr.test(String(t.profileId??""))||!Pge.test(String(t.ownerPublicId??""))||!Pge.test(String(t.runtimeId??""))||typeof t.loginLabel!="string"||t.loginLabel.length<1||t.loginLabel.length>320||typeof t.createdAt!="string"||!Number.isFinite(Date.parse(t.createdAt)))return!1;try{return Rge(String(t.authOrigin??""))===t.authOrigin&&xYe(String(t.authOrigin),String(t.ownerPublicId))===t.profileId}catch{return!1}}function PYe(){return{version:1,activeProfileId:null,profiles:[]}}function Rk(e=process.env){let t=Oge(e);if(!pS.existsSync(t))return PYe();let r=Xl(t,{maxBytes:128*1024});if(r===null)return PYe();let n;try{n=JSON.parse(r)}catch{throw new Error(`owner profile registry contains invalid JSON at ${t}. Rename that file out of the directory, then run \`visa connect\` to rebuild it; this signs local profiles out.`)}if(!n||typeof n!="object"||Array.isArray(n))throw new Error(`owner profile registry is invalid at ${t}. Rename that file out of the directory, then run \`visa connect\` to rebuild it; this signs local profiles out.`);let i=n;if(i.version!==1||!Array.isArray(i.profiles)||!i.profiles.every(OYe))throw new Error(`owner profile registry is invalid at ${t}. Rename that file out of the directory, then run \`visa connect\` to rebuild it; this signs local profiles out.`);let o=i.profiles,s=new Set(o.map(c=>c.profileId));if(s.size!==o.length)throw new Error(`owner profile registry has duplicate profiles at ${t}. Rename that file out of the directory, then run \`visa connect\` to rebuild it; this signs local profiles out.`);let a=i.activeProfileId;if(a!==null&&(typeof a!="string"||!s.has(a)))throw new Error(`owner profile registry active profile is invalid at ${t}. Rename that file out of the directory, then run \`visa connect\` to rebuild it; this signs local profiles out.`);return{version:1,activeProfileId:a,profiles:o}}function RYe(e,t=process.env){let r=xge(t);pS.mkdirSync(r,{recursive:!0,mode:448}),pS.chmodSync(r,448),Vc(r),Fc(Oge(t),JSON.stringify(e,null,2))}function H_(e=process.env){return[...Rk(e).profiles]}function Bu(e=process.env){let t=Rk(e);return t.profiles.find(r=>r.profileId===t.activeProfileId)??null}function NYe(e){let t=e.env??process.env,r=Rge(e.authOrigin);if(!Pge.test(e.ownerPublicId))throw new Error("owner profile requires a stable owner UUID");let n=e.loginLabel.normalize("NFC").trim();if(!n||n.length>320)throw new Error("owner profile login label is invalid");let i=Rk(t),o=xYe(r,e.ownerPublicId),s=i.profiles.find(c=>c.profileId===o);return s?{...s,loginLabel:n}:{profileId:o,authOrigin:r,ownerPublicId:e.ownerPublicId,loginLabel:n,runtimeId:(0,jG.randomUUID)(),createdAt:(e.now??new Date).toISOString()}}function CYe(e,t=process.env){if(!OYe(e))throw new Error("refusing to activate an invalid owner profile");let r=Rk(t);return RYe({version:1,activeProfileId:e.profileId,profiles:[...r.profiles.filter(n=>n.profileId!==e.profileId),e]},t),e}function MYe(e,t=process.env){let r=Rk(t),n=r.profiles.filter(i=>i.profileId!==e);RYe({version:1,activeProfileId:r.activeProfileId===e?null:r.activeProfileId,profiles:n},t)}function kYe(e=process.env){let t=Oge(e);try{pS.unlinkSync(t)}catch(r){if(r.code!=="ENOENT")throw r}}function HG(e){return`session-token:${e.profileId}`}function fS(e,t=process.env){return qG.join(xge(t),e.profileId,"session-token")}function Nge(e){return`attestation-key:${e.profileId}:${e.runtimeId}`}var jG,pS,qG,Mbr,Pge,mS=A(()=>{"use strict";jG=require("node:crypto"),pS=ie(require("node:fs")),qG=ie(require("node:path"));kd();q_();Mbr=/^op_[a-f0-9]{24}$/,Pge=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/});function Dbr(){Dd.existsSync(Mge)||Dd.mkdirSync(Mge,{recursive:!0,mode:448})}function Lbr(){if(!Cge){if(Dbr(),Dd.existsSync(Nk)&&Dd.statSync(Nk).size>kbr){let t=Nk+".1";Dd.existsSync(t)&&Dd.unlinkSync(t),Dd.renameSync(Nk,t)}Cge=Dd.createWriteStream(Nk,{flags:"a"})}return Cge}function Ubr(e){return e==="WARN"||e==="ERROR"?!0:process.env.VISA_CLI_DEBUG==="1"}function VG(e,...t){let r=new Date().toISOString(),n=t.map(o=>typeof o=="string"?o:JSON.stringify(o,null,2)).join(" "),i=`[${r}] [${e}] ${n}
 `;Ubr(e)&&process.stderr.write(i),Lbr().write(i)}var Dd,kge,DYe,Mge,Nk,kbr,Cge,Wn,Zl=A(()=>{"use strict";Dd=ie(require("fs")),kge=ie(require("path")),DYe=ie(require("os")),Mge=kge.join(DYe.homedir(),".visa-mcp"),Nk=kge.join(Mge,"mcp-server.log"),kbr=5*1024*1024,Cge=null;Wn={debug:(...e)=>VG("DEBUG",...e),info:(...e)=>VG("INFO",...e),warn:(...e)=>VG("WARN",...e),error:(...e)=>VG("ERROR",...e)}});var Ck,Mk,FG,$G,zG,Dge=A(()=>{"use strict";Ck=class extends Error{code="ATTESTATION_KEY_DRIFT";kind="attestation";nextAction="visa disconnect --all";fix="Run `visa disconnect --all` to clear the stale device credential, then `visa connect` to enroll again.";hint;constructor(t,r){super(t),this.name="AttestationDriftError",this.hint=r}},Mk=class extends Error{code="session_required";kind="session";nextAction="visa connect";fix="visa connect";status;constructor(t,r){super(t),this.name="SessionRequiredError",this.status=r}},FG=class extends Error{code="server_unavailable";kind="server";nextAction=void 0;fix;status;retryable;constructor(t,r=503,n=!0){super(t),this.name="ServerUnavailableError",this.status=r,this.retryable=n,this.fix=n?"Wait a moment and retry. If the outage persists check https://visacli.sh for status.":"Do not retry this request automatically; inspect the server error and reconcile the existing attempt."}},$G=class extends Error{code="surface_disabled";kind="server";nextAction=void 0;fix="This surface is disabled or not configured on the server (kill switch or missing config). Escalate to a human \u2014 retrying will not help.";status;disabledSurface;flag;correlationId;constructor(t,r={}){super(t),this.name="SurfaceDisabledError",this.status=r.status??503,this.disabledSurface=r.disabledSurface,this.flag=r.flag,this.correlationId=r.correlationId}},zG=class extends Error{constructor(r,n){super(r);this.retryAfterSeconds=n;this.name="RateLimitError",this.nextAction=void 0,this.fix=`Wait ${n}s before retrying.`}retryAfterSeconds;code="rate_limited";kind="rate_limit";fix;status=429;nextAction=void 0}});function qbr(){for(let e of VYe)if(hS.existsSync(e))return e;return null}function Vbr(){if(!GG())return!1;try{return hS.existsSync(LYe)||qbr()!==null?!0:(UYe||(UYe=!0,Wn.warn("binary:missing:win32",{message:"visa-keychain-win.exe not found; Windows Hello attestation unavailable on this install.",binPath:LYe,searchedPrebuiltPaths:VYe})),!1)}catch{return!1}}function Fbr(){return _Ye()||Bbr()?!0:GG()?Vbr():!1}async function $Ye(e){if(GG())return;let t=Nge(e);if(await th())try{await HYe("security",["delete-generic-password","-s",FYe,"-a",t],{timeout:5e3})}catch{}}async function zYe(){if(!Fbr())return;let e=[...H_().map(Nge),Hbr];for(let t of new Set(e))if(!GG())try{await HYe("security",["delete-generic-password","-s",FYe,"-a",t],{timeout:5e3})}catch{}}var BYe,jYe,hS,qYe,Ql,HYe,Bbr,GG,z4,bAi,LYe,jbr,EAi,SAi,vAi,TAi,VYe,FYe,Hbr,UYe,Lge=A(()=>{"use strict";BYe=require("child_process"),jYe=require("util"),hS=ie(require("fs")),qYe=ie(require("os")),Ql=ie(require("path"));Zl();Ige();$0();Dge();mS();HYe=(0,jYe.promisify)(BYe.execFile),Bbr=()=>process.platform==="darwin",GG=()=>process.platform==="win32",z4=Ql.join(qYe.homedir(),".visa-mcp","bin"),bAi=Ql.join(z4,"Visa CLI"),LYe=Ql.join(z4,"visa-keychain-win.exe"),jbr=Ql.join(__dirname,"..","native"),EAi=Ql.join(z4,"visa-keychain.version"),SAi=Ql.join(z4,"visa-keychain.sha256"),vAi=Ql.join(z4,"visa-keychain-win.version"),TAi=Ql.join(z4,"visa-keychain-win.sha256"),VYe=[Ql.join(jbr,"bin","win32-x64","visa-keychain-win.exe"),Ql.resolve(__dirname,"..","..","native","bin","win32-x64","visa-keychain-win.exe"),Ql.resolve(__dirname,"..","native","bin","win32-x64","visa-keychain-win.exe")];FYe="visa-cli",Hbr="attestation-key",UYe=!1});function z0(e=process.env){let t=e.VISA_CLI_HOME,r=typeof t=="string"&&t.trim().length>0?t:Lk.homedir();return W4.join(r,".visa-mcp","session-token")}function G4(e=process.env){let t=e.VISA_CLI_HOME,r=typeof t=="string"&&t.trim().length>0?t:Lk.homedir();return W4.join(r,".visa-mcp","rc-access")}function KG(e=process.env){return vYe(e)?`rc-access:home:${TYe(e)}`:V_}function zbr(e){let t=e;return[t?.message,t?.stderr].filter(r=>typeof r=="string").join(`
 `)}function Uge(e){let t=e;if(t?.code==="EPERM"||t?.code==="EACCES")return!0;let r=zbr(e).toLowerCase();return r.includes("operation not permitted")||r.includes("permission denied")}function th(){return process.platform!=="darwin"?Promise.resolve(!1):(KYe??=(async()=>{try{return await ep("security",["default-keychain","-d","user"],{timeout:5e3}),!0}catch(e){return Uge(e)}})(),KYe)}function Gbr(){if(process.platform!=="darwin")return!1;if(kk!==null)return kk;try{(0,e6.execFileSync)("security",["default-keychain","-d","user"],{timeout:1e3,encoding:"utf8",stdio:["pipe","pipe","ignore"]}),kk=!0}catch{kk=!1}return kk}async function Kbr(e=F_){if(!await th())return null;try{let{stdout:t}=await ep("security",["find-generic-password","-s",tp,"-a",e,"-w"],{timeout:5e3});return t.trim()||null}catch(t){if(Uge(t))throw new YG("Unable to read Visa CLI credentials from macOS Keychain. In sandboxed agents such as Codex, rerun with keychain access or run this command outside the sandbox.");return null}}async function Wbr(e,t=F_){if(!await th())return!1;try{try{await ep("security",["delete-generic-password","-s",tp,"-a",t],{timeout:5e3})}catch{}return await ep("security",["add-generic-password","-s",tp,"-a",t,"-w",e],{timeout:5e3}),!0}catch{return!1}}async function Ybr(e=F_){if(await th())try{await ep("security",["delete-generic-password","-s",tp,"-a",e],{timeout:5e3})}catch{}}async function Jbr(e=F_){if(!Bge())return null;try{let{stdout:t}=await ep("secret-tool",["lookup","service",tp,"account",e],{timeout:5e3});return t.trim()||null}catch{return null}}async function Xbr(e,t=F_){if(!Bge())return!1;try{let r=(0,e6.execFile)("secret-tool",["store","--label",`${tp} ${t}`,"service",tp,"account",t]);return r.stdin?(r.stdin.write(e),r.stdin.end(),await Promise.race([new Promise((n,i)=>{r.on("exit",o=>o===0?n():i(new Error(`secret-tool exited ${o}`))),r.on("error",i)}),new Promise((n,i)=>setTimeout(()=>{r.kill(),i(new Error("secret-tool timed out"))},$br))]),!0):!1}catch{return!1}}async function Zbr(e=F_){if(Bge())try{await ep("secret-tool",["clear","service",tp,"account",e],{timeout:5e3})}catch{}}function Bge(){return!!process.env.DBUS_SESSION_BUS_ADDRESS}async function Qbr(e=V_){if(!await th())return null;try{let{stdout:t}=await ep("security",["find-generic-password","-s",tp,"-a",e,"-w"],{timeout:5e3});return t.trim()||null}catch{return null}}async function eEr(e,t=V_){if(await th())try{try{await ep("security",["delete-generic-password","-s",tp,"-a",t],{timeout:5e3})}catch{}await ep("security",["add-generic-password","-s",tp,"-a",t,"-w",e],{timeout:5e3})}catch{}}async function WYe(e=V_){if(await th())try{await ep("security",["delete-generic-password","-s",tp,"-a",e],{timeout:5e3})}catch{}}function tEr(e=V_){if(!Gbr())return null;try{return(0,e6.execFileSync)("security",["find-generic-password","-s",tp,"-a",e,"-w"],{timeout:1e3,encoding:"utf8",stdio:["pipe","pipe","ignore"]}).trim()||null}catch{return null}}function K4(e=z0()){try{return _a.readFileSync(e,"utf-8").trim()||null}catch(t){if(Uge(t))throw new YG(`Unable to read Visa CLI credentials from ${e}. Check file permissions or rerun with access to the Visa CLI credential directory.`);return null}}function WG(e,t=z0()){let r=W4.dirname(t);_a.mkdirSync(r,{recursive:!0,mode:448}),_a.writeFileSync(t,e,{mode:384}),process.platform==="win32"&&rEr(t)}function Qw(e=z0()){try{_a.unlinkSync(e)}catch{}}function rEr(e){try{let t=Lk.userInfo().username;(0,e6.execFile)("icacls",[e,"/inheritance:r","/grant:r",`${t}:F`],{timeout:5e3},r=>{r&&console.error(`[visa-cli] icacls ACL restriction failed: ${r.message}`)})}catch(t){console.error(`[visa-cli] Failed to invoke icacls: ${t instanceof Error?t.message:String(t)}`)}}function Dk(e=F_,t=z0()){switch(process.platform){case"darwin":return{get:()=>Kbr(e),store:r=>Wbr(r,e),delete:()=>Ybr(e)};case"linux":return{get:()=>Jbr(e),store:r=>Xbr(r,e),delete:()=>Zbr(e)};default:return{get:async()=>K4(t),store:async r=>{try{return WG(r,t),!0}catch{return!1}},delete:async()=>Qw(t),storesInSessionFile:!0}}}var e6,YYe,_a,Lk,W4,ep,tp,F_,V_,$br,YG,KYe,kk,sn,$0=A(()=>{"use strict";e6=require("child_process"),YYe=require("util"),_a=ie(require("fs")),Lk=ie(require("os")),W4=ie(require("path"));Ige();kd();mS();Lge();ep=(0,YYe.promisify)(e6.execFile);tp="visa-cli",F_="session-token",V_="rc-access";$br=5e3,YG=class extends Error{constructor(t){super(t),this.name="CredentialAccessError"}};KYe=null,kk=null;sn=class{static profileBackend(t){return Dk(HG(t),fS(t))}static async getSessionToken(t=process.env){if(eh(t))return Promise.resolve(yYe());let r=Bu(t);if(!r&&H_(t).length>0)return null;let n=r?this.profileBackend(r):Dk(),i=r?fS(r,t):z0(t),o=await n.get();if(o)return o;let s=K4(i);return s?(await n.store(s),s):null}static async saveSessionToken(t,r={}){let n=r.env??process.env;if(eh(n))return;let i=Bu(n);if(i){await this.saveProfileSessionToken(i,t,r);return}let o=Dk(),s=z0(n),a=await o.store(t);if(a&&await o.get()===t){o.storesInSessionFile||Qw(s);return}if(a&&await o.delete(),WG(t,s),K4(s)!==t)throw new Error("Failed to persist session token in the unlabeled slot.")}static async saveProfileSessionToken(t,r,n={}){let i=n.env??process.env;if(eh(i))return;let o=this.profileBackend(t),s=fS(t,i);if(await o.store(r)){if(await o.get()===r){o.storesInSessionFile||Qw(s),n.preserveLegacy||await this.deleteLegacySessionToken(i);return}await o.delete()}if(WG(r,s),K4(s)!==r)throw new Error("Failed to persist session token. "+(process.platform==="darwin"?'Check Keychain Access permissions for "visa-cli".':`Ensure ${W4.dirname(s)} is writable.`));n.preserveLegacy||await this.deleteLegacySessionToken(i)}static async retireLegacySessionToken(t=process.env){eh(t)||await this.deleteLegacySessionToken(t)}static async deleteLegacySessionToken(t=process.env){await Dk().delete(),Qw(z0(t))}static async getRcAccessRecord(t=process.env){if(eh(t)){let s=wge(t);return{token:s,source:s?"keychain":null}}let r=KG(t),n=G4(t),i=await Qbr(r);if(i)return{token:i,source:"keychain"};let o=K4(n);return o?{token:o,source:"file"}:{token:null,source:null}}static getRcAccessRecordSync(t=process.env){if(eh(t)){let s=wge(t);return{token:s,source:s?"keychain":null}}let r=KG(t),n=G4(t),i=tEr(r);if(i)return{token:i,source:"keychain"};let o=K4(n);return o?{token:o,source:"file"}:{token:null,source:null}}static async getRcAccessToken(t=process.env){return(await this.getRcAccessRecord(t)).token}static getRcAccessTokenSync(t=process.env){return this.getRcAccessRecordSync(t).token}static async saveRcAccessToken(t,r=process.env){if(eh(r))return;let n=KG(r),i=G4(r);await eEr(t,n);try{WG(t,i)}catch{}}static async deleteRcAccessToken(t=process.env){if(eh(t))return;let r=KG(t),n=G4(t);await WYe(r),r!==V_&&await WYe(V_),Qw(n)}static async deleteSessionToken(t=process.env){if(eh(t))return;let r=Bu(t),n=r?this.profileBackend(r):Dk(),i=r?fS(r,t):z0(t);await n.delete(),Qw(i)}static async deleteProfileSessionToken(t,r=process.env){eh(r)||(await this.profileBackend(t).delete(),Qw(fS(t,r)))}static async listKeychainItems(t){if(!await th())return[];try{let{stdout:r}=await ep("security",["dump-keychain"],{timeout:5e3}),n=r.split(`
-`),i=[],o=null,s=null;for(let a of n){a.includes("keychain:")&&(o===t&&s&&!i.includes(s)&&i.push(s),o=null,s=null);let c=a.match(/"svce"<blob>="([^"]+)"/);c&&(o=c[1]);let u=a.match(/"acct"<blob>="([^"]+)"/);u&&(s=u[1])}return o===t&&s&&!i.includes(s)&&i.push(s),i}catch{return[]}}static async listStoredCredentials(t={}){let r=t.env??process.env,n=[];if(process.platform==="darwin"&&await th())for(let s of["visa-cli","visa-mcp"]){let a=await this.listKeychainItems(s);for(let c of a)n.push({service:s,account:c,backend:"keychain"})}let i=z0(r);_a.existsSync(i)&&n.push({service:"visa-cli",account:F_,backend:"file",path:i});for(let s of H_(r)){let a=fS(s,r);_a.existsSync(a)&&n.push({service:"visa-cli",account:HG(s),backend:"file",path:a})}let o=G4(r);return _a.existsSync(o)&&n.push({service:"visa-cli",account:V_,backend:"file",path:o}),n}static async purgeAll(t={}){let r=t.env??process.env,n=[];if(process.platform==="darwin"&&await th())for(let s of["visa-cli","visa-mcp"]){let a=await this.listKeychainItems(s);for(let c of a)try{await ep("security",["delete-generic-password","-s",s,"-a",c],{timeout:5e3}),n.push({service:s,account:c,backend:"keychain"})}catch{}}let i=z0(r);if(_a.existsSync(i))try{_a.unlinkSync(i),n.push({service:"visa-cli",account:F_,backend:"file",path:i})}catch{}let o=G4(r);if(_a.existsSync(o))try{_a.unlinkSync(o),n.push({service:"visa-cli",account:V_,backend:"file",path:o})}catch{}for(let s of H_(r)){let a=fS(s,r);if(_a.existsSync(a))try{_a.unlinkSync(a),n.push({service:"visa-cli",account:HG(s),backend:"file",path:a})}catch{}}try{kYe(r)}catch{}return await zYe(),n}static async clearAll(t=process.env){for(let r of H_(t))await this.deleteProfileSessionToken(r,t);await this.deleteLegacySessionToken(t),await this.deleteRcAccessToken(t)}}});function JG(e){return typeof e=="string"&&Object.prototype.hasOwnProperty.call(jge,e)}function G0(e,t={}){let r=jge[e],n=t.fix!==void 0?t.fix:r.fix;if(r.kind==="platform"&&r.escalation!=="awaiting_human"&&n!==null)throw new Error(`agent-contract: ${r.escalation} code "${e}" cannot carry a fix \u2014 no command resolves it`);return{code:e,kind:r.kind,fix:n,nextAction:t.nextAction??r.nextAction}}function JYe(e){if(e instanceof $c)return e.diagnostic;if(e&&typeof e=="object"){let t=e.code??e.errorCode;if(JG(t))return G0(t);if(typeof t=="string"){let n=t.toLowerCase();if(JG(n))return G0(n)}let r=e.message;if(JG(r))return G0(r)}return G0("unspecified_error")}function XYe(e){if(!(e instanceof $c)||!e.details)return;let t=e.details,r={};return Number.isInteger(t.upstreamStatus)&&Number(t.upstreamStatus)>=100&&Number(t.upstreamStatus)<=599&&(r.upstreamStatus=t.upstreamStatus),JG(t.reason)&&t.reason===e.code&&(r.reason=t.reason),e.code==="terms_conflict"&&typeof t.purchaseId=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(t.purchaseId)&&(r.purchaseId=t.purchaseId),e.code==="purchase_transport_uncertain"&&(t.transportReason==="timeout"||t.transportReason==="network"||t.transportReason==="response")&&(r.transportReason=t.transportReason),Object.keys(r).length?r:void 0}var jge,xAi,$c,$_=A(()=>{"use strict";jge={update_required:{kind:"caller",fix:"npm install -g @visa/cli@rc",nextAction:"Upgrade Visa CLI to the minimum compatible version or newer, then retry the command."},session_required:{kind:"caller",fix:"agent_enroll",nextAction:"Run visa connect (shell) or call agent_enroll (MCP) and complete the browser sign-in. Both resume where they left off. Retry the original command after that."},identity_required:{kind:"caller",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"Call agent_enroll or run visa connect, open the printed URL, enter the code at /agent/enroll/protected-agent, and have the owner approve the device and its limits. Both entrances use the same protected enrollment implementation."},legacy_door_removed:{kind:"caller",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"Call agent_enroll or run visa connect, open the printed URL, enter the code at /agent/enroll/protected-agent, approve the device and its limits, then pay with the pay tool. Do not retry the retired command; nothing was signed, paired, or paid."},agent_selection_required:{kind:"caller",fix:null,nextAction:"Retry the command with one exact agent id from the executable choices in the error."},invalid_argument:{kind:"caller",fix:null,nextAction:"Correct the invalid argument named in the error, then retry the command once. Do not escalate this as a platform incident."},rate_limited:{kind:"caller",fix:"sleep <retry-after-seconds>",nextAction:"Wait the exact Retry-After duration named in the error, then retry the same request once. Do not retry sooner or switch agents to bypass the limit."},activity_entry_not_found:{kind:"caller",fix:"history",nextAction:'Call history for the same agent, select an exact activity id from that result, then read it with history { "id": "<activity-id>" }.'},x402_policy_refused:{kind:"caller",fix:null,nextAction:"Nothing was signed or paid. Do not retry unchanged; ask the owner to approve a higher ceiling or choose a payment that fits the existing policy."},managed_wallet_scheme_unsupported:{kind:"caller",fix:"discover",nextAction:"Nothing was reserved, signed, or paid. Choose an x402 endpoint advertising scheme exact with EIP-3009; managed upto/Permit2 support is intentionally deferred until the final measured TVC protocol."},wallet_network_mismatch:{kind:"caller",fix:"discover",nextAction:"The unpaid challenge offered no usable USDC payment on this wallet's configured network. Nothing was reserved, signed, or paid. Choose a discovered endpoint on the configured network; do not retry the same challenge unchanged."},agent_operations_cli_upgrade_required:{kind:"caller",fix:null,nextAction:"Use a reviewed CLI build at or above the minimum version named by the server, restart the agent session, and retry once. The payment was not sent."},agent_operation_forbidden:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This owner, agent, runtime, rail, or rollout state is not admitted to the universal payment route. Ask the owner to inspect the selected agent; do not retry through a legacy path."},runtime_context_not_found:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The server cannot find a current managed runtime contract for this exact agent and device. Ask the owner to inspect or renew that runtime before retrying."},product_policy_not_active:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The wallet setup did not install its server-owned spend policy. Resume the owner-approved wallet setup for this agent; do not retry the payment unchanged."},runtime_spend_session_not_active:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The wallet setup has no active runtime spend session. Resume the owner-approved wallet setup for this agent; do not retry the payment unchanged."},runtime_spend_attenuation_not_active:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The wallet runtime spend limits are not bound to the active owner policy. Resume the owner-approved wallet setup for this agent; do not retry the payment unchanged."},runtime_revoked:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This exact runtime has been revoked. Do not reuse it; ask the owner to certify a new runtime for the same agent if access should continue."},certified_runtime_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This payment requires an owner-certified runtime. Ask the owner to approve the wallet runtime certificate, then retry once."},runtime_certificate_invalid:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The wallet runtime certificate is invalid, expired, or no longer current. Ask the owner to renew it; do not retry unchanged."},runtime_delegation_missing:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This runtime has no active owner delegation for short signing leases. Ask the owner to finish secure wallet setup before retrying."},runtime_delegation_expired:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This runtime owner delegation has expired. Ask the owner to renew secure wallet authority before retrying."},runtime_authority_unavailable:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"The server could not verify runtime authority. Surface the outage to an operator and do not retry or fall back until authority health is restored."},universal_required_managed_only:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The universal route requires a fully managed TVC wallet for this agent. Ask the owner to finish managed wallet setup before retrying."},wallet_authority_cli_upgrade_required:{kind:"caller",fix:null,nextAction:"Upgrade the CLI to the minimum version named by the server, restart this agent session, and retry once. Nothing was signed or paid."},tap_signature_required:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"Escalate to a human. A TAP identity signer is available on this runtime, so an unsigned paid x402 request is a platform defect. Do not retry the payment unsigned. Probe remains unsigned."},wallet_payment_reconciling:{kind:"caller",fix:null,nextAction:"Do not submit this purchase again. Call history for the same agent and economic intent; only begin a fresh payment after the existing authorization is terminal."},attestation_key_drift:{kind:"caller",fix:"visa connect",nextAction:"This device holds a credential the server does not recognize (machine swap, keychain wipe, restored backup). Clear the stale local credential, enroll a fresh protected agent with visa connect, then retry."},rc_access_required:{kind:"platform",escalation:"awaiting_human",fix:"export VISA_RC_CODE=<access code>",nextAction:"This is a release-candidate build restricted to Visa employees. Set VISA_RC_CODE in this process, then retry. Ask your team lead or Visa Crypto Labs for the code \u2014 do not guess it."},early_access_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Escalate to a human: an admin must enable this tool for the account. Do not retry until they confirm."},capability_attach_pending_approval:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Ask the owner to finish the approval already open in their browser at /agent/enroll/protected-agent \u2014 the device and its limits are approved there. Do not start a second ceremony; wait for the owner, then retry the original command."},card_checkout_not_on_pay:{kind:"caller",fix:"purchase_create",nextAction:"Nothing was probed further, created or charged. This URL answered no x402 challenge, so it is an ordinary merchant checkout and `pay` cannot do it: `pay` spends from the agent wallet only. Card checkouts are the `purchase` resource (`purchase_create`, then `purchase_retrieve`), where Visa issues the credential and YOUR runtime drives the browser. Do not retry this target on `pay`."},card_draw_not_live:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Escalate to a human now. The card-draw surface is not live on this build (it is opt-in server-side), so no local configuration change makes this command work. Do not retry."},checkout_review_refused:{kind:"caller",fix:null,nextAction:"Nothing was charged. This checkout needs a supported card-field adapter. Choose another supported checkout, or give the merchant and adapter details to the product team; do not retry unchanged."},checkout_action_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Nothing was charged and no payment credential was requested. Ask the human to complete the named verification step, then retry the review once."},checkout_mandate_blocked:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Nothing was charged. Ask the owner to approve a mandate that covers the exact merchant, amount, and currency, then start a new review. Do not widen authority yourself."},card_mandate_activation_uncertain:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The owner approved the budget but the card network did not confirm its activation. No budget is usable and nothing was charged. Do not start another approval while this one is valid: ask the owner to review the budget in the Visa Console and, once the approval has expired or been revoked there, approve a fresh budget. Quote the request id when reporting it."},ucp_platform_profile_unavailable:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Do not retry this checkout. Escalate to the Visa deployment owner: the exact UCP platform profile advertised to merchants must serve a valid HTTPS JSON profile without redirects before checkout handoff can work."},wallet_capability_unavailable:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Escalate to a human now. The wallet (x402) capability is not served by this build. Do not retry."},surface_disabled:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Escalate to a human now. The server reports this surface disabled or not configured (kill switch or missing server config \u2014 see the flag and correlation_id in the error). No retry or local change resolves it."},wallet_grant_required:{kind:"platform",escalation:"awaiting_human",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"The Turnkey wallet is delegated by the human owner, not self-minted here. Call agent_enroll or ask the owner to run visa connect and approve the device and its limits at /agent/enroll/protected-agent, then retry."},wallet_credential_required:{kind:"platform",escalation:"awaiting_human",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"Call agent_enroll or ask the owner to run visa connect for the intended agent and approve the device and its limits at /agent/enroll/protected-agent, then retry. Identity alone does not grant spend authority."},managed_limits_owner_controlled:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Nothing was signed or paid. Managed wallet limits are owner-set on the server. Read them with get_status, then ask the owner to change them in the Visa Console at /agent/enroll/limits?agent=<agent-id>."},agent_paused:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Ask the owner to resume this exact agent in the Visa Console (Agents). Retry only after get_status reports it ready; do not create a replacement credential while the agent is paused."},agent_revoked:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This agent is permanently revoked. Do not retry or reuse its credentials; ask the owner whether to pair a new agent identity."},agent_stale:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The server cannot prove this agent is currently usable. Ask the owner to inspect its lifecycle and reauthorize it before retrying."},agent_lifecycle_unknown:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"The lifecycle state is unknown. Surface the full preflight result to a human and do not retry a money operation until the server reports active."},wallet_delivery_required:{kind:"platform",escalation:"awaiting_human",fix:"visa connect",nextAction:"The approved wallet runtime was not delivered completely. Ask the owner to re-run visa connect and re-approve the device and its limits before paying; do not self-mint a mainnet wallet."},wallet_authority_revoked:{kind:"caller",fix:"get_status",nextAction:"This wallet is preserved for recovery only. Inspect its balance and receipts with get_status or history; do not retry a payment or policy change until the owner approves a new wallet grant."},wallet_authority_replacement_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This compatibility error came from an older single-wallet runtime. Upgrade the CLI and re-run the wallet grant; current builds isolate wallet authority per agent."},wallet_policy_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Nothing was signed. Ask the owner to set per-purchase and daily spend caps in the Visa Console at /agent/enroll/limits?agent=<agent-id>, then retry once. Caps are enforced before anything is signed."},wallet_funding_required:{kind:"caller",fix:"get_status",nextAction:"Deposit USDC into this agent wallet address before paying. get_status carries the deposit address and the live on-chain balance; the owner can also read the address on their account page in the Visa Console."},wallet_unavailable:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Ask the owner to finish wallet setup in the Visa console (their account has no usable wallet yet), then re-run the grant. Do not keep polling: the ceremony cannot complete until the wallet exists."},checkout_agent_access_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Escalate to a human: this account is not enabled for agent checkout, so grant ceremonies are refused server-side. Do not retry until an admin confirms the account has access."},unknown_tool:{kind:"caller",fix:null,nextAction:"Call tools/list and dispatch one of the served names. The tool you asked for is not registered on this runtime."},handoff_not_found:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The Console claim code was not found or was mistyped. Ask the human for a fresh claim code from the Visa Console; do not retry this code."},handoff_expired:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This Console claim code has expired. Ask the human to create a new setup code in the Visa Console."},handoff_already_redeemed:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This Console claim code has already been redeemed. Ask the human to create a new setup code in the Visa Console."},no_paired_agent:{kind:"caller",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"No protected agent on this device. Call agent_enroll or run visa connect and complete the owner ceremony at /agent/enroll/protected-agent first."},feedback_unconfirmed:{kind:"caller",fix:null,nextAction:"Show the user the exact feedback text and obtain explicit confirmation before calling feedback with confirmed: true."},agent_id_required:{kind:"caller",fix:null,nextAction:"Pass the agentId to identify which agent ceremony to operate on."},already_terminal:{kind:"caller",fix:null,nextAction:"This ceremony is already terminal or cancelled. No further action needed."},purchase_transport_uncertain:{kind:"caller",fix:null,nextAction:"Wait briefly, then repeat the identical Visa purchase call with the same arguments, request key and purchase ID. The original request may have succeeded; its journal recovers the same attempt. Do not cancel, create a replacement or submit Pay at the merchant again. Escalate repeated transport failures."},purchase_refused:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The authority refused this purchase request. Use the recorded upstream status and error to resolve the refusal before trying again. Preserve the original purchase and request key; a refusal is not permission to mint a replacement or repeat merchant payment."},recovery_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Inspect the original purchase and checkout with the owner or support. Preserve the purchase ID and request key. Do not create a replacement, release uncertain liability or submit Pay again."},card_recovery_unconfigured:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Card recovery is not configured. Ask support to restore the protected recovery worker before retrying the same Visa request. Preserve the purchase ID; do not create another purchase or click merchant Pay again."},card_recovery_original_not_expired:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The original credential attempt is still live. Retrieve the same purchase without include:card and follow its continuation; do not force recovery, create another purchase or click merchant Pay again."},card_recovery_liability_present:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The original attempt still has liability. Ask support to reconcile that attempt and inspect the existing checkout. Do not release funds, issue replacement credentials or click merchant Pay again."},card_recovery_issuance_conflict:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Recovery found conflicting issuance evidence. Stop and ask support to reconcile the original purchase and attempt. Do not create another purchase or click merchant Pay again."},card_recovery_proof_invalid:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The recovery proof could not be verified. Ask support to repair recovery for the existing device and purchase; do not replay the invalid proof, replace the identity or click merchant Pay again."},card_purchase_quarantined:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This purchase is quarantined for reconciliation. Ask support to inspect its original attempt and the existing checkout. Do not create another purchase, release its liability or click merchant Pay again."},card_credential_not_available:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Credentials are not available for this purchase state. Retrieve the same purchase without include:card and follow its continuation. Do not recreate the purchase or click merchant Pay again."},purchase_submission_observed:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Submission was already reported for this purchase. Inspect the existing merchant checkout and report its current state on the same purchase. Do not request replacement credentials or click merchant Pay again."},protected_card_request_invalid:{kind:"caller",fix:null,nextAction:"The card executor refused the saved delivery request, usually because its admission has expired. Retrieve the same purchase and follow its continuation; if it reads expired, run purchase create again with the same request file. Do not create a replacement purchase by hand."},protected_card_delivery_conflict:{kind:"caller",fix:null,nextAction:"The saved delivery request differs from the one already in progress for this attempt. Retrieve the same purchase and follow its continuation; do not alter or replay edited request bytes."},protected_card_authority_unavailable:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The card authority did not answer the executor. Nothing was issued. Wait a moment and retrieve the same purchase; recovery continues server-side."},purchase_cancelled:{kind:"caller",fix:null,nextAction:"This purchase was cancelled; it accepts no new credential. Create a new purchase for a fresh checkout if the buyer still wants it. Do not click merchant Pay."},card_intent_unobserved:{kind:"caller",fix:null,nextAction:"The owner's card allowance for this agent is not active yet. Follow next.open_url so the owner finishes card setup, then retry the same checkout."},card_intent_mandate_exists:{kind:"caller",fix:null,nextAction:"The owner's current approval already has a card allowance in progress. Wait for it to finish (or ask the owner to check the limits page), then retry the same checkout."},card_intent_conflict:{kind:"caller",fix:null,nextAction:"A different card allowance request already exists under this id. Retrieve current status instead of resending edited request bytes."},card_vic_provider_refused:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The provider refused credential issuance. Ask the owner or support to inspect the original purchase and provider refusal before retrying; an HTTP error does not prove its reservation was released. Do not create a replacement purchase or click merchant Pay again."},terms_conflict:{kind:"caller",fix:null,nextAction:"The request conflicts with the existing checkout commitment or quote bound. Retrieve the original purchase and compare the exact final terms. Do not change the request key or checkout ID to bypass the conflict; resolve it under the checkout replacement rules."},card_checkout_expired:{kind:"caller",fix:null,nextAction:"The exact checkout quote expired. Inspect the original purchase before obtaining a new final quote. Do not reuse stale terms or bypass checkout replacement rules by changing the request key or checkout ID."},card_mandate_expired:{kind:"caller",fix:null,nextAction:"The owner's card allowance for this agent has lapsed (the provider limits each one to 7 days) while the approval itself is still valid. Follow next.open_url to the limits page so the owner issues a new allowance, then retry the same checkout. Do not create a replacement purchase."},card_reservation_expired:{kind:"caller",fix:null,nextAction:"Retrieve the same purchase to resolve its expired reservation. Follow its current continuation; do not replay stale admission bytes or create a replacement to hide an unresolved attempt."},card_merchant_country_mismatch:{kind:"caller",fix:null,nextAction:"Use the actual merchant country consistently in the signed checkout terms and settlement envelope. Preserve the existing purchase commitment; do not change keys to bypass a terms conflict."},protected_grant_proof_mismatch:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Ask the owner or support to verify the current grant and runtime proof for this existing agent. Do not retry an unchanged invalid proof or create replacement authority."},purchase_resume_invalid:{kind:"caller",fix:null,nextAction:"Use the exact saved purchase resume reference by itself; do not combine it with a new request. Preserve the original purchase and merchant checkout."},purchase_draft_invalid:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The saved purchase request is damaged or changed. Stop and ask support to recover the original draft; do not overwrite it, invent new terms or click merchant Pay again."},purchase_draft_not_found:{kind:"caller",fix:null,nextAction:"Use the original device and exact saved resume reference. Locate the existing draft before continuing; do not recreate the request or click merchant Pay again."},purchase_draft_agent_invalid:{kind:"caller",fix:null,nextAction:"Select the existing protected agent by its exact UUID and resume the original draft. Do not create a replacement identity or purchase."},purchase_draft_agent_mismatch:{kind:"caller",fix:null,nextAction:"Resume this draft with the same protected agent it already selected. Do not switch agents, replace the draft or click merchant Pay again."},purchase_draft_owner_mismatch:{kind:"caller",fix:null,nextAction:"Sign in as the owner who started this draft on the original device, then resume that same draft. Do not transfer it to another owner or create a replacement purchase."},purchase_draft_owner_required:{kind:"caller",fix:null,nextAction:"Complete the returned owner sign-in step, then resume the same saved draft. Do not start another identity enrollment or purchase."},purchase_draft_busy:{kind:"caller",fix:null,nextAction:"Wait for the current Visa purchase call to finish, then repeat the same resume reference. Do not run concurrent purchase calls, create a replacement or click merchant Pay again."},purchase_not_found:{kind:"caller",fix:null,nextAction:"Check the original purchase ID and selected agent. Recover the existing purchase record; do not mint a replacement merely because a read could not find it."},invalid_contract:{kind:"caller",fix:null,nextAction:"Correct the request using the declared tool schema, then retry only with valid input. Never fabricate facts or change existing payment identifiers to bypass their commitment."},invalid_amount:{kind:"caller",fix:null,nextAction:"Supply a positive canonical amount in the units required by the selected tool. Follow its total and precision constraints; never change identifiers to bypass an existing payment commitment."},invalid_currency:{kind:"caller",fix:null,nextAction:"Use the currency required by the selected payment profile. Do not infer merchant country from currency."},unsupported_version:{kind:"caller",fix:null,nextAction:"Use a supported protocol version and profile. Check the current tool schema or update Visa CLI, then retry the same logical operation without bypassing its existing commitment."},native_runtime_signer_not_installed:{kind:"platform",escalation:"awaiting_human",fix:"npm i -g @visa/cli@rc",nextAction:"The Visa CLI install on this machine has no native signer for this platform, so no wallet key can be proven. Ask the owner to reinstall Visa CLI; do not retry."},native_runtime_signer_not_executable:{kind:"platform",escalation:"awaiting_human",fix:"npm i -g @visa/cli@rc",nextAction:"The native signer is present but this machine will not run it, and Visa CLI could not repair its file mode. Ask the owner to reinstall Visa CLI, or to run chmod 755 on the path in the error; do not retry."},native_runtime_platform_unsupported:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Visa CLI ships no native signer for this operating system and CPU, so wallet keys cannot be held here. Surface this to the owner; do not retry."},native_runtime_unavailable:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The native signer could not be started. The error names why (EACCES is the executable bit; ENOENT is a missing binary). Surface it to the owner; do not retry."},native_runtime_closed:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The native signer exited before answering. The error carries its exit code and its last output. Surface it to the owner; do not retry."},native_runtime_response_invalid:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"The native signer answered with something Visa CLI could not read, which usually means the CLI and its signer are from different builds. Ask the owner to reinstall Visa CLI; do not retry."},keychain_locked_or_unavailable:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The operating-system keychain refused to open for the native signer, so the wallet key could not be read. On macOS this is the login keychain being locked or an Allow prompt being declined. Ask the owner to unlock the keychain and allow visa-runtime-signer; do not retry on your own."},unspecified_error:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"This failure could not be classified, so it is reported as platform to avoid a silent retry loop. Surface the human-readable error to a human rather than retrying."}},xAi=Object.keys(jge);$c=class extends Error{diagnostic;details;constructor(t,r,n={}){super(t),this.name="AgentContractError",this.diagnostic=G0(r,n),this.details=n.details}get code(){return this.diagnostic.code}}});var Y4=_(zc=>{"use strict";Object.defineProperty(zc,"__esModule",{value:!0});zc.CANONICAL_OPAQUE_ID_MAX_BYTES=zc.CANONICAL_OPAQUE_ID_RE=zc.CANONICAL_OPAQUE_ID_PATTERN=void 0;zc.utf8ByteLength=Hge;zc.isCanonicalText=iEr;zc.compareCanonicalKeys=oEr;zc.isCanonicalOpaqueId=ZYe;zc.assertCanonicalOpaqueId=sEr;zc.CANONICAL_OPAQUE_ID_PATTERN="^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$";zc.CANONICAL_OPAQUE_ID_RE=new RegExp(zc.CANONICAL_OPAQUE_ID_PATTERN);zc.CANONICAL_OPAQUE_ID_MAX_BYTES=128;var nEr=/[\u0000-\u001f\u007f\u2028\u2029]/,qge=new TextEncoder;function Hge(e){return qge.encode(e).length}function iEr(e,t){return typeof e=="string"&&e.length>0&&Hge(e)<=t&&e.trim()===e&&e.normalize("NFC")===e&&!nEr.test(e)}function oEr(e,t){let r=qge.encode(e),n=qge.encode(t),i=Math.min(r.length,n.length);for(let o=0;o<i;o+=1)if(r[o]!==n[o])return r[o]-n[o];return r.length-n.length}function ZYe(e){return typeof e=="string"&&Hge(e)<=zc.CANONICAL_OPAQUE_ID_MAX_BYTES&&zc.CANONICAL_OPAQUE_ID_RE.test(e)}function sEr(e,t="value"){if(!ZYe(e))throw new Error(`${t} must be a canonical opaque id (max 128 ASCII bytes)`)}});var G_=_(rh=>{"use strict";Object.defineProperty(rh,"__esModule",{value:!0});rh.AgentOperationContractError=rh.AGENT_OPERATION_CONTRACT_ERROR_CODES=void 0;rh.record=eJe;rh.bounded=tJe;rh.canonicalJsonValue=rJe;rh.canonicalJson=aEr;rh.canonicalEnvelopeJson=cEr;var QYe=Y4();rh.AGENT_OPERATION_CONTRACT_ERROR_CODES=["commitment_mismatch","intent_mismatch","invalid_amount","invalid_contract","invalid_currency","invalid_effect","invalid_evidence","invalid_principal","invalid_window","settlement_amount_invalid","unsupported_version"];var z_=class extends Error{code;constructor(t,r){super(r),this.code=t,this.name="AgentOperationContractError"}};rh.AgentOperationContractError=z_;function eJe(e,t){if(typeof e!="object"||e===null||Array.isArray(e))throw new z_("invalid_contract",`${t} must be an object`);return e}function tJe(e,t,r=4096){if(!(0,QYe.isCanonicalText)(e,r))throw new z_("invalid_contract",`${t} is not bounded canonical text`);return e}function rJe(e,t=0){return XG(e,t,16)}function XG(e,t,r){if(t>r)throw new z_("invalid_contract","payload nesting is too deep");if(e===null||typeof e=="string"||typeof e=="boolean"||typeof e=="number"&&Number.isSafeInteger(e)&&!Object.is(e,-0))return e;if(typeof e=="number")throw new z_("invalid_contract","JSON numbers must be safe canonical integers; use strings for larger or decimal values");if(Array.isArray(e)){if(e.length>1024)throw new z_("invalid_contract","payload array is too large");return e.map(o=>XG(o,t+1,r))}let n=eJe(e,"payload"),i=Object.entries(n);if(i.length>512)throw new z_("invalid_contract","payload object is too large");return Object.fromEntries(i.sort(([o],[s])=>(0,QYe.compareCanonicalKeys)(o,s)).map(([o,s])=>[tJe(o,"payload key",128),XG(s,t+1,r)]))}function aEr(e){return JSON.stringify(rJe(e))}function cEr(e){return JSON.stringify(XG(e,0,64))}});var gS=_(Et=>{"use strict";Object.defineProperty(Et,"__esModule",{value:!0});Et.AGENT_OPERATION_TRANSITION_SQL_PREDICATE=Et.AGENT_OPERATION_TERMINAL_SQL_LIST=Et.AGENT_OPERATION_RESUMABLE_SQL_LIST=Et.AGENT_OPERATION_TERMINAL_STATES=Et.AGENT_OPERATION_EVIDENCE_ELIGIBLE_STATES=Et.AGENT_OPERATION_RESUMABLE_STATES=Et.AGENT_OPERATION_ALLOWED_TRANSITIONS=Et.AGENT_OPERATION_STATES=Et.EXECUTOR_BINDING_VERSION=Et.EXECUTION_EVIDENCE_VERSION=Et.AGENT_OPERATION_RESULT_VERSION=Et.AGENT_OPERATION_VERSION=Et.canonicalJsonValue=Et.canonicalJson=Et.AgentOperationContractError=Et.AGENT_OPERATION_CONTRACT_ERROR_CODES=Et.canonicalEnvelopeJson=void 0;Et.isAgentOperationTransitionAllowed=fEr;Et.agentOperationIntentPreimage=mEr;Et.parseAgentMoneyEconomics=oJe;Et.parseAgentOperationStructure=sJe;Et.parseExecutionEvidence=_Er;Et.parsePreparedAgentOperationStructure=yEr;Et.agentOperationPopSigningInput=bEr;var yt=G_(),Uk=G_();Object.defineProperty(Et,"canonicalEnvelopeJson",{enumerable:!0,get:function(){return Uk.canonicalEnvelopeJson}});Object.defineProperty(Et,"AGENT_OPERATION_CONTRACT_ERROR_CODES",{enumerable:!0,get:function(){return Uk.AGENT_OPERATION_CONTRACT_ERROR_CODES}});Object.defineProperty(Et,"AgentOperationContractError",{enumerable:!0,get:function(){return Uk.AgentOperationContractError}});Object.defineProperty(Et,"canonicalJson",{enumerable:!0,get:function(){return Uk.canonicalJson}});Object.defineProperty(Et,"canonicalJsonValue",{enumerable:!0,get:function(){return Uk.canonicalJsonValue}});Et.AGENT_OPERATION_VERSION=1;Et.AGENT_OPERATION_RESULT_VERSION=1;Et.EXECUTION_EVIDENCE_VERSION=1;Et.EXECUTOR_BINDING_VERSION=1;var uEr=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,dEr=/^[A-Za-z0-9_-]{43}$/,lEr=/^[a-z][a-z0-9]*(?:[._:-][a-z0-9]+)*$/,pEr=/^[A-Z][A-Z0-9]{2,11}$/,iJe=96*1024,Vge=9223372036854775807n;Et.AGENT_OPERATION_STATES=["claimed","reserved","dispatched","authorized","settling","committed","released","indeterminate","denied"];Et.AGENT_OPERATION_ALLOWED_TRANSITIONS={claimed:["reserved","denied"],reserved:["dispatched","released","indeterminate","settling"],dispatched:["authorized","released","indeterminate","settling"],authorized:["settling","indeterminate"],settling:["committed","released","indeterminate"],committed:[],released:[],indeterminate:["settling"],denied:[]};Et.AGENT_OPERATION_RESUMABLE_STATES=["claimed","reserved","dispatched"];Et.AGENT_OPERATION_EVIDENCE_ELIGIBLE_STATES=["reserved","dispatched","authorized","indeterminate"];Et.AGENT_OPERATION_TERMINAL_STATES=["committed","released","denied"];function fEr(e,t){return e===t||Et.AGENT_OPERATION_ALLOWED_TRANSITIONS[e].includes(t)}function Fge(e){return e.map(t=>`'${t}'`).join(", ")}Et.AGENT_OPERATION_RESUMABLE_SQL_LIST=Fge(Et.AGENT_OPERATION_RESUMABLE_STATES);Et.AGENT_OPERATION_TERMINAL_SQL_LIST=Fge(Et.AGENT_OPERATION_TERMINAL_STATES);Et.AGENT_OPERATION_TRANSITION_SQL_PREDICATE=["NEW.state = OLD.state",...Et.AGENT_OPERATION_STATES.filter(e=>Et.AGENT_OPERATION_ALLOWED_TRANSITIONS[e].length>0).map(e=>`(OLD.state = '${e}' AND NEW.state IN (${Fge(Et.AGENT_OPERATION_ALLOWED_TRANSITIONS[e])}))`)].join(`
-    OR `);function pf(e,t,r=[]){let n=new Set([...t,...r]);if(t.some(i=>!(i in e))||Object.keys(e).some(i=>!n.has(i)))throw new yt.AgentOperationContractError("invalid_contract","contract contains missing or unknown fields")}function J4(e,t){let r=(0,yt.bounded)(e,t,36).toLowerCase();if(!uEr.test(r))throw new yt.AgentOperationContractError("invalid_contract",`${t} must be a UUID`);return r}function K0(e,t){let r=(0,yt.bounded)(e,t,43);if(!dEr.test(r)||!/[AEIMQUYcgkosw048]$/.test(r))throw new yt.AgentOperationContractError("invalid_contract",`${t} must be a canonical 32-byte hash`);return r}function ZG(e,t){let r=(0,yt.bounded)(e,t,128);if(!lEr.test(r))throw new yt.AgentOperationContractError("invalid_contract",`${t} must be a stable lowercase token`);return r}function nJe(e,t){let r=(0,yt.bounded)(e,t,32),n=Date.parse(r);if(!Number.isFinite(n)||new Date(n).toISOString()!==r)throw new yt.AgentOperationContractError("invalid_contract",`${t} must be canonical ISO-8601`);return r}function mEr(e){let t={domain:"visa.agent-operation-intent.v1",operationId:e.operationId,idempotencyKey:e.idempotencyKey,agentId:e.agentId,runtimeId:e.runtimeId,rail:e.rail,effect:e.effect,execution:{adapter:e.execution.adapter,commitment:e.execution.commitment,payloadHash:e.execution.payloadHash},createdAt:e.createdAt,expiresAt:e.expiresAt};return(0,yt.canonicalJson)(t)}function hEr(e){let t=(0,yt.record)(e,"principal");if(t.kind==="identity_pop")return pf(t,["kind","popJwt","keyJkt"]),{kind:t.kind,popJwt:(0,yt.bounded)(t.popJwt,"popJwt",16384),keyJkt:K0(t.keyJkt,"keyJkt")};if(t.kind==="certified_runtime_pop")return pf(t,["kind","popJwt","runtimeCertificate","rootJkt","childJkt"]),{kind:t.kind,popJwt:(0,yt.bounded)(t.popJwt,"popJwt",16384),runtimeCertificate:(0,yt.bounded)(t.runtimeCertificate,"runtimeCertificate",32768),rootJkt:K0(t.rootJkt,"rootJkt"),childJkt:K0(t.childJkt,"childJkt")};if(t.kind==="delegated_runtime_lease_pop"){if(pf(t,["kind","v","popJwt","delegation","lease","rootJkt","runtimeJkt"]),t.v!==2)throw new yt.AgentOperationContractError("invalid_principal","delegated runtime lease principal must use version 2");return{kind:t.kind,v:t.v,popJwt:(0,yt.bounded)(t.popJwt,"popJwt",16384),delegation:(0,yt.bounded)(t.delegation,"delegation",32768),lease:(0,yt.bounded)(t.lease,"lease",32768),rootJkt:K0(t.rootJkt,"rootJkt"),runtimeJkt:K0(t.runtimeJkt,"runtimeJkt")}}if(t.kind==="tap_signature")return pf(t,["kind","signature","runtimeCertificate","signedPayload"]),{kind:t.kind,signature:(0,yt.bounded)(t.signature,"signature",2048),runtimeCertificate:(0,yt.bounded)(t.runtimeCertificate,"runtimeCertificate",32768),signedPayload:K0(t.signedPayload,"signedPayload")};throw new yt.AgentOperationContractError("invalid_principal","unsupported principal proof kind")}function oJe(e){let t=(0,yt.record)(e,"money economics");pf(t,["amountMicros","currency","merchant"]);let r=(0,yt.bounded)(t.amountMicros,"amountMicros",40);if(!/^[1-9][0-9]*$/.test(r)||BigInt(r)>Vge)throw new yt.AgentOperationContractError("invalid_amount","amountMicros must be positive and canonical");let n=(0,yt.bounded)(t.currency,"currency",12);if(!pEr.test(n))throw new yt.AgentOperationContractError("invalid_currency","currency must be canonical");let i=(0,yt.record)(t.merchant,"merchant");return pf(i,["id"],["name","url"]),{amountMicros:r,currency:n,merchant:{id:(0,yt.bounded)(i.id,"merchant.id",512),...i.name===void 0?{}:{name:(0,yt.bounded)(i.name,"merchant.name",255)},...i.url===void 0?{}:{url:(0,yt.bounded)(i.url,"merchant.url",2048)}}}}function gEr(e){let t=(0,yt.record)(e,"effect");if(t.kind==="money"){pf(t,["kind","amountMicros","currency","merchant","grantId","budgetEpochId"],["maxAmountMicros"]);let r=oJe({amountMicros:t.amountMicros,currency:t.currency,merchant:t.merchant}),n;if(t.maxAmountMicros!==void 0&&(n=(0,yt.bounded)(t.maxAmountMicros,"maxAmountMicros",40),!/^[1-9][0-9]*$/.test(n)||BigInt(n)>Vge))throw new yt.AgentOperationContractError("invalid_amount","maxAmountMicros must be positive and canonical");return{kind:t.kind,...r,grantId:J4(t.grantId,"grantId"),budgetEpochId:J4(t.budgetEpochId,"budgetEpochId"),...n===void 0?{}:{maxAmountMicros:n}}}if(t.kind==="resource")return pf(t,["kind","resource","action","audience"]),{kind:t.kind,resource:(0,yt.bounded)(t.resource,"resource",4096),action:ZG(t.action,"action"),audience:(0,yt.bounded)(t.audience,"audience",255)};throw new yt.AgentOperationContractError("invalid_effect","unsupported operation effect")}function sJe(e,t=Date.now()){let r=(0,yt.record)(e,"operation");if(pf(r,["v","operationId","idempotencyKey","agentId","runtimeId","rail","intentHash","principal","effect","execution","createdAt","expiresAt"]),r.v!==Et.AGENT_OPERATION_VERSION)throw new yt.AgentOperationContractError("unsupported_version","unsupported operation version");let n=(0,yt.record)(r.execution,"execution");pf(n,["adapter","commitment","payloadHash","payload"]);let i=(0,yt.canonicalJsonValue)(n.payload);if(new TextEncoder().encode(JSON.stringify(i)).length>iJe)throw new yt.AgentOperationContractError("invalid_contract","execution payload is too large");let o=K0(n.commitment,"execution.commitment"),s=K0(n.payloadHash,"execution.payloadHash"),a=nJe(r.createdAt,"createdAt"),c=nJe(r.expiresAt,"expiresAt");if(!Number.isFinite(t)||Date.parse(a)>t+3e4||Date.parse(a)<t-5*6e4||Date.parse(c)<=t||Date.parse(c)<=Date.parse(a)||Date.parse(c)-Date.parse(a)>10*6e4)throw new yt.AgentOperationContractError("invalid_window","operation validity window is not currently usable");let u={v:Et.AGENT_OPERATION_VERSION,operationId:J4(r.operationId,"operationId"),idempotencyKey:(0,yt.bounded)(r.idempotencyKey,"idempotencyKey",255),agentId:J4(r.agentId,"agentId"),runtimeId:J4(r.runtimeId,"runtimeId"),rail:ZG(r.rail,"rail"),intentHash:K0(r.intentHash,"intentHash"),principal:hEr(r.principal),effect:gEr(r.effect),execution:{adapter:ZG(n.adapter,"execution.adapter"),commitment:o,payloadHash:s,payload:i},createdAt:a,expiresAt:c};if(u.rail==="wallet:x402"&&u.effect.kind==="money"&&u.effect.merchant.url===void 0)throw new yt.AgentOperationContractError("invalid_contract","merchant.url is required for wallet:x402 operations");if(u.principal.kind==="tap_signature"&&u.principal.signedPayload!==u.intentHash)throw new yt.AgentOperationContractError("intent_mismatch","TAP signedPayload must equal the universal operation intentHash");return u}function _Er(e){let t=(0,yt.record)(e,"evidence");if(pf(t,["v","operationId","adapter","outcome","artifactHash","providerReference","proof"],["settledMicros"]),t.v!==Et.EXECUTION_EVIDENCE_VERSION||t.outcome!=="committed"&&t.outcome!=="released")throw new yt.AgentOperationContractError("invalid_evidence","unsupported evidence version or outcome");let r;if(t.settledMicros!==void 0){if(r=(0,yt.bounded)(t.settledMicros,"settledMicros",40),!/^(?:0|[1-9][0-9]*)$/.test(r)||BigInt(r)>Vge)throw new yt.AgentOperationContractError("invalid_evidence","settledMicros is not canonical");if(t.outcome==="released"&&r!=="0")throw new yt.AgentOperationContractError("settlement_amount_invalid","released evidence must settle zero")}let n=(0,yt.canonicalJsonValue)(t.proof);if(new TextEncoder().encode(JSON.stringify(n)).length>iJe)throw new yt.AgentOperationContractError("invalid_evidence","evidence proof is too large");return{v:Et.EXECUTION_EVIDENCE_VERSION,operationId:J4(t.operationId,"operationId"),adapter:ZG(t.adapter,"adapter"),outcome:t.outcome,artifactHash:K0(t.artifactHash,"artifactHash"),...r===void 0?{}:{settledMicros:r},providerReference:(0,yt.bounded)(t.providerReference,"providerReference",255),proof:n}}function yEr(e,t=Date.now()){let r=(0,yt.record)(e,"prepared operation");pf(r,["operationId","idempotencyKey","agentId","runtimeId","rail","intentHash","effect","execution","createdAt","expiresAt"]);let{v:n,principal:i,...o}=sJe({...r,v:1,principal:{kind:"identity_pop",popJwt:"unsigned",keyJkt:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}},t);return o}function bEr(e){let t=r=>btoa(String.fromCharCode(...new TextEncoder().encode(JSON.stringify(r)))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"");return`${t({alg:"EdDSA",kid:e.childJkt,typ:"visa-agent-pop+jwt"})}.${t({cnf:{jwk:{kty:e.childPublicJwk.kty,crv:e.childPublicJwk.crv,x:e.childPublicJwk.x}},nonce:e.operationId,aud:"visa-agent-operations:v1",iat:e.issuedAtSec,int:e.intentHash,...e.runtimeCertificate?{rkc:e.runtimeCertificate}:{}})}`}});var eK=_(QG=>{"use strict";Object.defineProperty(QG,"__esModule",{value:!0});QG.parsePurchaseTerms=aJe;QG.purchaseTermsPreimage=vEr;var an=G_(),EEr=gS();function X4(e,t){if(Object.keys(e).sort().join(",")!==[...t].sort().join(","))throw new an.AgentOperationContractError("invalid_contract","purchase terms fields are not canonical")}function aJe(e){let t=(0,an.record)(e,"purchase terms"),r=t.profile==="exact_card_checkout_v1";if(X4(t,["v","profile","alternatives",...r?["checkout","disclosureMode",...t.merchantCountryCode===void 0?[]:["merchantCountryCode"]]:[]]),t.v!==1||typeof t.profile!="string"||!["url_resource_v1","approved_x402_request_v1","exact_card_checkout_v1"].includes(String(t.profile)))throw new an.AgentOperationContractError("unsupported_version","unsupported purchase terms profile");if(!Array.isArray(t.alternatives)||t.alternatives.length<1||t.alternatives.length>2)throw new an.AgentOperationContractError("invalid_contract","purchase requires one or two exact rail alternatives");let n=t.profile==="approved_x402_request_v1";if(n&&t.alternatives.length!==1)throw new an.AgentOperationContractError("invalid_contract","request-bound purchase requires one wallet alternative");let i=t.alternatives.map(o=>{let s=(0,an.record)(o,"purchase alternative"),a=(0,EEr.parseAgentMoneyEconomics)(s.economics),c=(0,an.bounded)(a.merchant.url,"purchase resource URL",2048),u;try{u=new URL(c)}catch{throw new an.AgentOperationContractError("invalid_contract","purchase resource URL is invalid")}if(u.protocol!=="https:"||u.username||u.password||u.hash)throw new an.AgentOperationContractError("invalid_contract","purchase requires an HTTPS resource without credentials or fragment");if(s.rail==="wallet:x402"){X4(s,["rail","economics","network","asset","payee",...n?["requestHash"]:[]]);let d=n?(0,an.bounded)(s.requestHash,"request hash",43):void 0;if(d!==void 0&&!/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(d))throw new an.AgentOperationContractError("invalid_contract","invalid request hash");let l=(0,an.bounded)(s.network,"network",64),p=(0,an.bounded)(s.asset,"asset",128),f=(0,an.bounded)(s.payee,"payee",42);if(!/^eip155:[1-9][0-9]{0,15}$/.test(l)||!new RegExp(`^${l}/erc20:0x[0-9a-f]{40}$`).test(p)||!/^0x[0-9a-f]{40}$/.test(f)||a.currency!=="USDC")throw new an.AgentOperationContractError("invalid_contract","invalid exact wallet economic coordinates");return{rail:s.rail,economics:a,network:l,asset:p,payee:f,...d?{requestHash:d}:{}}}if(s.rail==="card:vic"&&!n){if(X4(s,["rail","economics","processorAction","captureMode"]),s.processorAction!=="charge_and_capture"||s.captureMode!=="exact"||a.currency!=="USD"||BigInt(a.amountMicros)%10000n!==0n)throw new an.AgentOperationContractError("invalid_contract","purchase card profile requires exact whole-cent capture");return{rail:s.rail,economics:a,processorAction:"charge_and_capture",captureMode:"exact"}}throw new an.AgentOperationContractError("invalid_contract","unsupported purchase rail")});if(new Set(i.map(o=>o.rail)).size!==i.length)throw new an.AgentOperationContractError("invalid_contract","purchase rail alternatives must be unique");if(i.sort((o,s)=>o.rail<s.rail?-1:o.rail>s.rail?1:0),r){if(i.length!==1||i[0].rail!=="card:vic"||!i[0].economics.merchant.name)throw new an.AgentOperationContractError("invalid_contract","exact checkout requires one card alternative");if(t.disclosureMode!=="private"&&t.disclosureMode!=="agent_history")throw new an.AgentOperationContractError("invalid_contract","unsupported card disclosure mode");if(t.merchantCountryCode!==void 0&&(typeof t.merchantCountryCode!="string"||!/^[A-Z]{2}$/.test(t.merchantCountryCode)))throw new an.AgentOperationContractError("invalid_contract","invalid merchant country");return{v:1,profile:"exact_card_checkout_v1",...t.merchantCountryCode===void 0?{}:{merchantCountryCode:t.merchantCountryCode},alternatives:i,checkout:SEr(t.checkout,i[0].economics.amountMicros),disclosureMode:t.disclosureMode}}return{v:1,profile:t.profile,alternatives:i}}function SEr(e,t){let r=(0,an.record)(e,"checkout");X4(r,["id","revision","source","expiresAt","items","taxMicros","shippingMicros","discountMicros","fulfillment","customerHash"]);let n=()=>{throw new an.AgentOperationContractError("invalid_contract","invalid exact card checkout")},i=l=>((typeof l!="string"||!/^(0|[1-9][0-9]{0,17})$/.test(l)||BigInt(l)%10000n!==0n)&&n(),l),o=l=>((typeof l!="string"||!/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(l))&&n(),l);(r.source!=="runtime_observed"||typeof r.expiresAt!="string"||!Number.isFinite(Date.parse(r.expiresAt))||new Date(r.expiresAt).toISOString()!==r.expiresAt||!Array.isArray(r.items)||r.items.length<1||r.items.length>100)&&n();let s=r.items.map(l=>{let p=(0,an.record)(l,"checkout item");return X4(p,["id","name","quantity","totalMicros"]),(!Number.isSafeInteger(p.quantity)||Number(p.quantity)<1||Number(p.quantity)>1e6)&&n(),{id:(0,an.bounded)(p.id,"checkout item ID",256),name:(0,an.bounded)(p.name,"checkout item name",512),quantity:p.quantity,totalMicros:i(p.totalMicros)}});new Set(s.map(l=>l.id)).size!==s.length&&n();let a=i(r.taxMicros),c=i(r.shippingMicros),u=i(r.discountMicros);s.reduce((l,p)=>l+BigInt(p.totalMicros),0n)+BigInt(a)+BigInt(c)-BigInt(u)!==BigInt(t)&&n();let d=(0,an.record)(r.fulfillment,"checkout fulfillment");return X4(d,["method","detailsHash"]),{id:(0,an.bounded)(r.id,"checkout ID",256),revision:(0,an.bounded)(r.revision,"checkout revision",256),source:"runtime_observed",expiresAt:r.expiresAt,items:s,taxMicros:a,shippingMicros:c,discountMicros:u,fulfillment:{method:(0,an.bounded)(d.method,"fulfillment method",256),detailsHash:o(d.detailsHash)},customerHash:o(r.customerHash)}}function vEr(e){return(0,an.canonicalJson)({domain:"visa.purchase-terms.v1",terms:aJe(e)})}});var $ge=_(nc=>{"use strict";Object.defineProperty(nc,"__esModule",{value:!0});nc.ACCOUNT_OPERATION_EVIDENCE_TYPES=nc.ACCOUNT_OPERATION_PROOF_LEVELS=nc.ACCOUNT_OPERATION_OUTCOMES=nc.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION=void 0;nc.cardProofLevel=TEr;nc.cardStatusClaimsProcessorTruth=AEr;nc.parseAccountOperationReceipt=PEr;nc.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION=1;nc.ACCOUNT_OPERATION_OUTCOMES=["pending","completed","failed","uncertain","released","reversed","disputed"];nc.ACCOUNT_OPERATION_PROOF_LEVELS=["none","platform_observed","merchant_reported","owner_attested","processor_confirmed","network_verified","settled"];var cJe={sale_accepted:"merchant_reported",auth_held:"merchant_reported",capture_pending:"merchant_reported",captured:"processor_confirmed",voided:"processor_confirmed",refunded:"processor_confirmed",partially_refunded:"processor_confirmed",refund_pending:"processor_confirmed",chargeback_open:"processor_confirmed",chargeback_lost:"processor_confirmed",chargeback_won:"processor_confirmed",pending:"platform_observed",needs_reconciliation:"platform_observed"};function TEr(e,t){let r=cJe[e]??"platform_observed";return r==="processor_confirmed"&&!t?"merchant_reported":r}function AEr(e){return cJe[e]==="processor_confirmed"}nc.ACCOUNT_OPERATION_EVIDENCE_TYPES=["platform_activity","merchant_confirmation","card_lifecycle","onchain_transaction"];function _S(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function K_(e){return e===null||typeof e=="string"}function Bk(e){return typeof e=="string"&&e.length>0&&!Number.isNaN(Date.parse(e))}function yS(e,t){let r=Object.keys(e).sort(),n=[...t].sort();return r.length===n.length&&r.every((i,o)=>i===n[o])}function wEr(e){return _S(e)?yS(e,["type","source","observedAt","reference","url"])&&typeof e.type=="string"&&nc.ACCOUNT_OPERATION_EVIDENCE_TYPES.includes(e.type)&&typeof e.source=="string"&&Bk(e.observedAt)&&K_(e.reference)&&K_(e.url):!1}function IEr(e){return _S(e)?yS(e,["type","at"])&&typeof e.type=="string"&&e.type.length>0&&Bk(e.at):!1}function PEr(e){if(!_S(e)||!yS(e,["schemaVersion","operationId","activityId","payment","route","party","authority","outcome","evidence","timeline","dataCompleteness"])||e.schemaVersion!==nc.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION||typeof e.operationId!="string"||typeof e.activityId!="string"||e.dataCompleteness!=="complete"&&e.dataCompleteness!=="partial"||!Array.isArray(e.evidence)||!e.evidence.every(wEr)||!Array.isArray(e.timeline)||!e.timeline.every(IEr))return null;let t=e.payment,r=e.route,n=e.party,i=e.authority,o=e.outcome;return!_S(t)||!yS(t,["amountAtomic","decimals","currency","merchant","description","createdAt"])||typeof t.amountAtomic!="string"||!/^\d+$/.test(t.amountAtomic)||typeof t.decimals!="number"||!Number.isInteger(t.decimals)||t.decimals<0||t.decimals>18||typeof t.currency!="string"||typeof t.merchant!="string"||typeof t.description!="string"||!Bk(t.createdAt)||!_S(r)||!yS(r,["rail","protocol","network","cardLast4"])||r.rail!=="wallet"&&r.rail!=="card"||!(r.protocol===null||r.protocol==="x402"||r.protocol==="mpp"||r.protocol==="vic"||r.protocol==="virtual_card")||!K_(r.network)||!K_(r.cardLast4)||!_S(n)||!yS(n,["agentId","agentName"])||!K_(n.agentId)||!K_(n.agentName)||!_S(i)||!yS(i,["grantId","mandateId","drawId"])||!K_(i.grantId)||!K_(i.mandateId)||!K_(i.drawId)||!_S(o)||!yS(o,["status","proofLevel","final","updatedAt","finalizesBy"])||typeof o.status!="string"||!nc.ACCOUNT_OPERATION_OUTCOMES.includes(o.status)||typeof o.proofLevel!="string"||!nc.ACCOUNT_OPERATION_PROOF_LEVELS.includes(o.proofLevel)||typeof o.final!="boolean"||!Bk(o.updatedAt)||!(o.finalizesBy===null||Bk(o.finalizesBy))?null:e}});var lJe=_(rp=>{"use strict";Object.defineProperty(rp,"__esModule",{value:!0});rp.PURCHASE_RESOURCE_AUDIENCE=rp.PURCHASE_OBSERVATIONS=void 0;rp.parsePurchaseReceipt=REr;rp.parsePurchaseResourceRequest=dJe;rp.purchaseResourceRequestHash=NEr;var xEr=require("node:crypto"),W0=G_(),OEr=eK(),uJe=$ge();rp.PURCHASE_OBSERVATIONS=["credential_delivered","submission_started","buyer_action_required","order_reported","submission_failed"];function REr(e,t){let r=(0,W0.record)(e,"purchase receipt"),n=(0,W0.record)(r.outcome,"purchase outcome");if(!t||r.operationId!==t||typeof r.credentialIssued!="boolean"||!uJe.ACCOUNT_OPERATION_OUTCOMES.includes(n.status)||!uJe.ACCOUNT_OPERATION_PROOF_LEVELS.includes(n.proofLevel)||typeof n.final!="boolean"||!Array.isArray(r.observations)||r.observations.length>rp.PURCHASE_OBSERVATIONS.length||r.observations.some(o=>!rp.PURCHASE_OBSERVATIONS.includes(o))||new Set(r.observations).size!==r.observations.length)throw new W0.AgentOperationContractError("invalid_contract","invalid purchase receipt");let i=r.refusal===void 0?void 0:(0,W0.record)(r.refusal,"refusal");if(i!==void 0&&(!Number.isSafeInteger(i.providerStatus)||Number(i.providerStatus)<100||Number(i.providerStatus)>999||typeof i.providerCode!="string"||!/^[a-z0-9_]{1,64}$/.test(i.providerCode)||n.status!=="failed"||n.final!==!0||r.credentialIssued!==!1))throw new W0.AgentOperationContractError("invalid_contract","invalid purchase refusal");return{operationId:t,credentialIssued:r.credentialIssued,outcome:{status:n.status,proofLevel:n.proofLevel,final:n.final},observations:r.observations,...i?{refusal:{providerStatus:Number(i.providerStatus),providerCode:i.providerCode}}:{}}}rp.PURCHASE_RESOURCE_AUDIENCE="visa:purchase-resource:v1";function dJe(e){let t=(0,W0.record)(e,"purchase request"),r=()=>{throw new W0.AgentOperationContractError("invalid_contract","invalid purchase request")};(t.v!==1||typeof t.action!="string"||!["create","retrieve","cancel"].includes(t.action))&&r();let n=["v","action","requestId","agentId","runtimeId",...t.action==="create"?["requestKey","terms"]:["purchaseId"],...t.action==="retrieve"&&t.include!==void 0?["include"]:[],...t.action==="retrieve"&&t.observation!==void 0?["observation"]:[]];Object.keys(t).sort().join(",")!==n.sort().join(",")&&r(),t.include!==void 0&&t.include!=="card"&&r();let i;if(t.observation!==void 0){t.include!==void 0&&r();let s=(0,W0.record)(t.observation,"purchase observation");(Object.keys(s).sort().join(",")!=="attemptId,kind,termsHash"||!rp.PURCHASE_OBSERVATIONS.includes(s.kind)||typeof s.attemptId!="string"||!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(s.attemptId)||typeof s.termsHash!="string"||!/^[A-Za-z0-9_-]{43}$/.test(s.termsHash))&&r(),i=s}for(let s of["requestId","agentId","runtimeId",...t.action==="create"?[]:["purchaseId"]])(typeof t[s]!="string"||!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(t[s]))&&r();let o={v:1,requestId:t.requestId,agentId:t.agentId,runtimeId:t.runtimeId};if(t.action==="create"){let s=(0,OEr.parsePurchaseTerms)(t.terms);return(s.profile!=="exact_card_checkout_v1"||s.alternatives.length!==1||s.alternatives[0].rail!=="card:vic")&&r(),{...o,action:"create",requestKey:(0,W0.bounded)(t.requestKey,"purchase request key",256),terms:s}}return{...o,action:t.action,purchaseId:t.purchaseId,...t.action==="retrieve"&&t.include==="card"?{include:"card"}:{},...i?{observation:i}:{}}}function NEr(e){return(0,xEr.createHash)("sha256").update((0,W0.canonicalJson)({domain:rp.PURCHASE_RESOURCE_AUDIENCE,request:dJe(e)})).digest("base64url")}});var Wge=_(An=>{"use strict";var CEr=An&&An.__createBinding||(Object.create?(function(e,t,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(t,r);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[r]}}),Object.defineProperty(e,n,i)}):(function(e,t,r,n){n===void 0&&(n=r),e[n]=t[r]})),zge=An&&An.__exportStar||function(e,t){for(var r in e)r!=="default"&&!Object.prototype.hasOwnProperty.call(t,r)&&CEr(t,e,r)};Object.defineProperty(An,"__esModule",{value:!0});An.CARD_ADMISSION_RECOVERY_AUDIENCE=void 0;An.cardAdmissionRecoveryRequestHash=MEr;An.agentOperationIntentHash=Gge;An.agentExecutionCommitment=Kge;An.purchaseTermsHash=kEr;An.purchaseAlternativeFromOperation=DEr;An.x402ResourceCommitment=LEr;An.agentOperationIdempotencyKey=fJe;An.purchaseAttemptIdempotencyKey=UEr;An.agentOperationTermsFingerprint=mJe;An.legacyAgentOperationEnvelopeFingerprint=hJe;An.persistedAgentOperationMatchesTerms=BEr;An.artifactHash=jEr;An.prepareAgentOperationV1=gJe;An.finalizeAgentOperationV1=_Je;An.createAgentOperationV1=HEr;An.parseHistoricalAgentOperation=VEr;An.parseAgentOperation=jk;var Y0=require("node:crypto"),Ao=G_(),pJe=eK();zge(eK(),An);zge(lJe(),An);var tK=gS();zge(gS(),An);An.CARD_ADMISSION_RECOVERY_AUDIENCE="visa:card-admission-recovery:v1";function MEr(e,t){return(0,Y0.createHash)("sha256").update("visa:card-admission-recovery:v1\0","utf8").update((0,Ao.canonicalJson)({original:e,replacement:t}),"utf8").digest("base64url")}function Gge(e){return(0,Y0.createHash)("sha256").update((0,tK.agentOperationIntentPreimage)(e)).digest("base64url")}function Kge(e){return(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)(e)).digest("base64url")}function kEr(e){return(0,Y0.createHash)("sha256").update((0,pJe.purchaseTermsPreimage)(e)).digest("base64url")}function DEr(e,t=Date.now()){let r=jk(e,t);if(r.effect.kind!=="money")throw new Ao.AgentOperationContractError("invalid_effect","purchase requires financial economics");let{amountMicros:n,currency:i,merchant:o}=r.effect,s={amountMicros:n,currency:i,merchant:o},a=(0,Ao.record)(r.execution.payload,"purchase native payload"),c=r.rail==="wallet:x402"?["scheme","network","asset","payer","typedData","nonce","keyRef",...a.walletBinding===void 0?[]:["walletBinding"],...a.approvedRequest===void 0&&a.requestHash===void 0?[]:["approvedRequest","requestHash"]]:["mandateId","tokenId","processorIntentId","processorAction","captureMode"];if(Object.keys(a).sort().join(",")!==c.sort().join(","))throw new Ao.AgentOperationContractError("invalid_contract","purchase producer has unrepresented native fields");let u;if(r.rail==="wallet:x402"&&r.execution.adapter==="wallet.eip3009"){let d=(0,Ao.record)(a.typedData,"wallet typed data"),l=(0,Ao.record)(d.message,"wallet message");if(a.scheme!=="exact"||l.value!==n)throw new Ao.AgentOperationContractError("invalid_amount","wallet value differs from purchase amount");u={rail:r.rail,economics:s,network:a.network,asset:a.asset,payee:l.to,...a.approvedRequest===void 0&&a.requestHash===void 0?{}:{requestHash:a.requestHash}}}else if(r.rail==="card:vic"&&r.execution.adapter==="card.vic")u={rail:r.rail,economics:s,processorAction:a.processorAction,captureMode:a.captureMode};else throw new Ao.AgentOperationContractError("invalid_contract","unsupported purchase producer profile");if(a.requestHash!==void 0&&(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)(a.approvedRequest)).digest("base64url")!==a.requestHash)throw new Ao.AgentOperationContractError("invalid_contract","purchase request hash mismatch");return(0,pJe.parsePurchaseTerms)({v:1,profile:a.requestHash===void 0?"url_resource_v1":"approved_x402_request_v1",alternatives:[u]}).alternatives[0]}function LEr(e){let t=(0,Ao.bounded)(e,"x402 resource",2048);return(0,Y0.createHash)("sha256").update(`visa-x402-resource:v1:${t}`,"utf8").digest("base64url")}function fJe(e){return`economic:${(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)({domain:"visa.agent-operation-idempotency.v1",agentId:e.agentId,economicIntentId:e.economicIntentId})).digest("base64url")}`}function UEr(e){let t=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;for(let r of["agentId","purchaseId","attemptId"])if(typeof e[r]!="string"||!t.test(e[r]))throw new Ao.AgentOperationContractError("invalid_contract",`${r} must be a canonical UUID`);if(typeof e.termsHash!="string"||!/^[A-Za-z0-9_-]{43}$/.test(e.termsHash)||Buffer.from(e.termsHash,"base64url").toString("base64url")!==e.termsHash)throw new Ao.AgentOperationContractError("invalid_contract","termsHash must be canonical SHA-256");return fJe({agentId:e.agentId,economicIntentId:`purchase:${e.purchaseId}:attempt:${e.attemptId}:terms:${e.termsHash}`})}function mJe(e){return(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)({domain:"visa.agent-operation-terms.v1",operationId:e.operationId,idempotencyKey:e.idempotencyKey,agentId:e.agentId,runtimeId:e.runtimeId,rail:e.rail,effect:e.effect,execution:e.execution})).digest("base64url")}function hJe(e){return(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)(e)).digest("base64url")}function BEr(e,t,r){return t===r?!0:mJe(e)!==r?!1:t===hJe(e)}function jEr(e){return(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)(e)).digest("base64url")}var qEr={kind:"identity_pop",popJwt:"unsigned",keyJkt:Buffer.alloc(32).toString("base64url")};function gJe(e,t=Date.now()){let r={v:tK.AGENT_OPERATION_VERSION,...e,principal:qEr,intentHash:Buffer.alloc(32).toString("base64url"),execution:{...e.execution,payloadHash:Kge(e.execution.payload)}};r.intentHash=Gge(r);let n=jk(r,t),{v:i,principal:o,...s}=n;return s}function _Je(e,t,r=Date.now()){return jk({v:tK.AGENT_OPERATION_VERSION,...e,principal:t},r)}function HEr(e,t=Date.now()){let{principal:r,...n}=e;return _Je(gJe(n,t),r,t)}function VEr(e){let t=(0,Ao.record)(e,"historical operation");if(typeof t.createdAt!="string")throw new Ao.AgentOperationContractError("invalid_window","historical operation creation time is missing");return jk(e,Date.parse(t.createdAt))}function jk(e,t=Date.now()){let r=(0,tK.parseAgentOperationStructure)(e,t);if(Kge(r.execution.payload)!==r.execution.payloadHash)throw new Ao.AgentOperationContractError("commitment_mismatch","execution payload does not match its commitment");if(Gge(r)!==r.intentHash)throw new Ao.AgentOperationContractError("intent_mismatch","intentHash does not bind the exact operation effect and execution commitment");return r}});var yJe,bJe=A(()=>{"use strict";yJe=ie(Wge())});var EJe,SJe=A(()=>{"use strict";$_();EJe=ie(Wge());bJe()});function TJe(e){return e?.code==="ENOENT"}function t6(e){let t=JSON.parse(e),r=!1;function n(i){if(!(!i||typeof i!="object"))for(let[o,s]of Object.entries(i)){if(["networkToken","cryptogramValue","card","privateJwk","private_jwk","seed","secretKey","secret_key","privateKey","d"].includes(o))throw new Error("native_metadata_contains_private_material");if(o==="runtimeKey"&&s&&typeof s=="object"){let a=s;r||=a.v===1&&typeof a.handle=="string"&&/^[0-9a-f]{64}$/.test(a.handle)&&typeof a.binding=="object"}n(s)}}if(n(t),!r)throw new Error("native_metadata_record_required")}function AJe(e,t=process.platform){if(t!=="win32")return Vc(e);try{let r=pi.lstatSync(e);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("native_metadata_directory_invalid");return!0}catch(r){if(TJe(r))return!1;throw r}}function qk(e,t=process.platform){return wJe(e,t,t6)}function wJe(e,t,r){if(t!=="win32")return Xl(e);if(!AJe(bS.dirname(e),t))return null;let n;try{let i=pi.lstatSync(e);if(!i.isFile()||i.isSymbolicLink()||i.size>$4)throw new Error("native_metadata_file_invalid");n=pi.openSync(e,pi.constants.O_RDONLY|(pi.constants.O_NOFOLLOW??0));let o=pi.fstatSync(n);if(!o.isFile()||o.dev!==i.dev||o.ino!==i.ino)throw new Error("native_metadata_file_changed");let s=Buffer.alloc($4+1),a=0;for(;a<s.length;){let u=pi.readSync(n,s,a,s.length-a,null);if(u===0)break;a+=u}if(a>$4)throw new Error("native_metadata_file_too_large");let c=new TextDecoder("utf-8",{fatal:!0}).decode(s.subarray(0,a));return r(c),c}catch(i){if(TJe(i))return null;throw i}finally{n!==void 0&&pi.closeSync(n)}}function Hk(e,t,r=process.platform){FEr(e,t,r,t6)}function FEr(e,t,r,n){if(r!=="win32")return Fc(e,t);if(n(t),Buffer.byteLength(t)>$4)throw new Error("native_metadata_file_too_large");if(!AJe(bS.dirname(e),r))throw new Error("native_metadata_directory_missing");let i=bS.join(bS.dirname(e),`.${bS.basename(e)}.${(0,vJe.randomUUID)()}.tmp`),o;try{if(o=pi.openSync(i,"wx",384),pi.writeFileSync(o,t,"utf8"),pi.fsyncSync(o),pi.closeSync(o),o=void 0,pi.renameSync(i,e),wJe(e,r,n)!==t)throw new Error("native_metadata_readback_failed")}finally{o!==void 0&&pi.closeSync(o),pi.rmSync(i,{force:!0})}}var pi,bS,vJe,rK=A(()=>{"use strict";pi=ie(require("node:fs")),bS=ie(require("node:path")),vJe=require("node:crypto");SJe();q_()});var Z4=_((GAi,$Er)=>{$Er.exports={name:"@visa/cli",version:"5.0.0-rc.355",description:"Visa CLI runtime for stable agent identity and separately authorized payment capabilities",bin:{"visa-cli":"./bin/visa-cli.js",visa:"./bin/visa-cli.js","visa-runtime-converge":"./dist/managed-runtime/resolve-and-update.mjs"},scripts:{"sync:server-json":"node scripts/sync-server-json.mjs","check:server-json":"node scripts/sync-server-json.mjs --check",prebuild:"node scripts/sync-server-json.mjs && pnpm --filter @visa/shared build && pnpm --filter @visa/observability build && pnpm --filter @visa/money build && pnpm --filter @visa/crypto build && pnpm --filter @visa-cli/tools build && pnpm --filter @visa/identity build && pnpm --filter @visa/wallet build && pnpm --filter @visa/agent-mail build && pnpm --filter @visa/wallet-tools build",build:"tsc --noEmit && node esbuild.config.js",prepack:"node scripts/sync-server-json.mjs --check",dev:"tsc --watch",pretest:"pnpm build",start:"node dist/mcp-server/index.js",test:"jest --config jest.config.js","test:unit":"jest --config jest.config.js","test:unit:watch":"jest --config jest.config.js --watch","test:unit:coverage":"jest --config jest.config.js --coverage","test:smoke":"VISA_AUTH_URL=https://auth.visacli.sh jest --config jest.smoke.config.js","test:packed":"node scripts/packed-cli-smoke.mjs","test:integration":"jest --config jest.integration.config.js","test:e2e":"jest --config jest.e2e.config.js","coinbase:onramp":"pnpm exec tsx tests/e2e/coinbase-onramp-harness/run.ts","test:all":"npm run test:unit && npm run test:integration && npm run test:e2e",prepublishOnly:"npm run build && npm test",lint:"eslint src/**/*.ts",format:'prettier --write "src/**/*.ts"',"format:check":'prettier --check "src/**/*.ts"'},keywords:["visa","checkout","mcp","ai-agent","payments","click-to-pay","usdc","stablecoin"],author:"Visa Crypto Labs",license:"SEE LICENSE IN LICENSE",dependencies:{"@modelcontextprotocol/ext-apps":"1.7.5","@modelcontextprotocol/server":"2.0.0","@ucp-js/sdk":"0.4.4",commander:"^12.1.0",punycode:"^2.3.1",toml:"^4.3.0",yaml:"^2.9.0",zod:"^3.25.76"},devDependencies:{"@types/express":"^5.0.0","@types/jest":"^30.0.0","@types/node":"^26.1.0","@typescript-eslint/eslint-plugin":"^8.68.0","@typescript-eslint/parser":"^8.68.0","@visa-cli/tools":"workspace:*","@visa/agent-mail":"workspace:*","@visa/crypto":"workspace:*","@visa/identity":"workspace:*","@visa/money":"workspace:*","@visa/observability":"workspace:*","@visa/shared":"workspace:*","@visa/wallet":"workspace:*","@visa/wallet-tools":"workspace:*",esbuild:"^0.28.1",eslint:"^10.0.2",express:"^4.21.0",jest:"^29.7.0",prettier:"^3.9.6","ts-jest":"^29.4.12",typescript:"^5.7.0"},engines:{node:">=20.0.0"},mcpName:"io.github.visa-crypto-labs/visa-cli",files:["bin/visa-cli.js","dist/","install.ps1","install.sh","native/visa-keychain.m","native/visa-keychain-win.cpp","native/build-win.bat","native/bin/win32-x64/visa-keychain-win.exe","server.json","README.md","native/bin/*/visa-runtime-signer*"]}});async function _Xe(e,t){let r=t?.timeoutMs??3e4,n=new AbortController,i=setTimeout(()=>n.abort(),r);try{let{timeoutMs:o,...s}=t??{};return await fetch(e,{...s,signal:n.signal})}finally{clearTimeout(i)}}var yXe=A(()=>{"use strict"});function WSr(){return Object.fromEntries(GSr.map(e=>[e,KSr]))}function a1e(e){if(!e||typeof e!="object")return null;let t=e,n=(t.cause&&typeof t.cause=="object"?t.cause.code:void 0)??(typeof t.code=="string"?t.code:void 0);return typeof n=="string"&&n.length>0?n:null}function c1e(e){let t=e&&typeof e=="object"?e:{};if(t.name==="AbortError"||typeof t.message=="string"&&t.message.includes("aborted"))return"The request timed out. The server may be under heavy load. Please try again.";let r=a1e(e);return r&&bXe[r]?bXe[r]:`Network error contacting the Visa CLI server (${r?`${r}: ${typeof t.message=="string"?t.message:"unknown"}`:typeof t.message=="string"&&t.message.length>0?t.message:"unknown error"}). Check https://visacli.sh for status.`}var GSr,KSr,bXe,u1e=A(()=>{"use strict";GSr=["UNABLE_TO_GET_ISSUER_CERT","UNABLE_TO_GET_ISSUER_CERT_LOCALLY","UNABLE_TO_VERIFY_LEAF_SIGNATURE","SELF_SIGNED_CERT_IN_CHAIN","DEPTH_ZERO_SELF_SIGNED_CERT","CERT_UNTRUSTED"],KSr="This machine does not trust the certificate offered for the Visa CLI server, so the request never left it. The server is not down, and neither retrying nor signing in again can help. A network that inspects TLS traffic does this: point Node at its root certificate with NODE_EXTRA_CA_CERTS=/path/to/root.pem, or use a network that does not inspect. Do not disable certificate verification.";bXe={ENOTFOUND:"Cannot resolve the Visa CLI server hostname (DNS error). Check your internet connection or the auth.serverUrl setting.",EAI_AGAIN:"DNS lookup for the Visa CLI server failed temporarily. Check your internet connection and try again.",ECONNREFUSED:"The Visa CLI server refused the connection. The service may be down \u2014 check https://visacli.sh for status.",ECONNRESET:"The connection to the Visa CLI server was reset mid-request. Try again in a moment.",EHOSTUNREACH:"The Visa CLI server is unreachable from this network. Check your internet connection.",ETIMEDOUT:"The connection to the Visa CLI server timed out. Try again or check https://visacli.sh for status.",CERT_HAS_EXPIRED:"The Visa CLI server's TLS certificate is expired. Check https://visacli.sh for status; do not bypass the cert.",...WSr(),ERR_TLS_CERT_ALTNAME_INVALID:"The certificate offered for the Visa CLI server is for a different hostname. Check the auth.serverUrl setting. Do not disable certificate verification.",UND_ERR_CONNECT_TIMEOUT:"The connection to the Visa CLI server timed out before it could be established. Try again in a moment.",UND_ERR_SOCKET:"The connection to the Visa CLI server was interrupted. Try again in a moment."}});function EXe(){return`Run ${YSr} or call ${JSr}, open the printed URL, enter the code at ${XSr}, approve the device and its limits, then pay with the pay tool. Do not retry the retired command; nothing was signed, paired, or paid.`}var YSr,JSr,XSr,m2i,h2i,g2i,SXe=A(()=>{"use strict";YSr="visa connect",JSr="agent_enroll",XSr="/agent/enroll/protected-agent",m2i=Object.freeze(["setup_start","setup_status","setup_resume","setup_cancel","setup_agent","enroll_agent","agent_pairing_cancel","agent_handoff_claim","agent_connect","agent_connect_cancel","agent_connect_poll"]),h2i=Object.freeze(["create","verify","enroll-claim","pair","claim","pairing-resume","cancel","handoff-claim","connect","grant-wallet","grant-card","grant-activate","grant-claim","grants","grant-cancel","grant-batch"]),g2i=Object.freeze(["setup","agent","wallet","find","inspect","receipt","connections","keys","security","checkout","mandate","logout","capabilities","feedback","status","pay","purchase","limits","fund","activity"])});var SK,d1e,vXe,EK,TXe=A(()=>{"use strict";SK=ie(require("fs")),d1e=ie(require("path")),vXe=ie(require("os")),EK=class{static ensureConfigDir(){let t=this.getConfigDir();SK.existsSync(t)||SK.mkdirSync(t,{recursive:!0,mode:448})}static getConfigDir(){let t=process.env.VISA_CLI_HOME;return typeof t=="string"&&t.trim().length>0?d1e.join(t,".visa-mcp"):d1e.join(vXe.homedir(),".visa-mcp")}}});function AXe(e){let t=IXe.homedir();return t&&e.startsWith(t)?`~${e.slice(t.length)}`:e}function evr(){return PXe.join(EK.getConfigDir(),ZSr)}function xXe(e){if((0,l1e.isIP)(e)!==4)return!1;let[t]=e.split(".").map(Number);return t===127}function tvr(e){let t=e.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);if(!t)return!1;let r=Number.parseInt(t[1],16),n=Number.parseInt(t[2],16);if(!Number.isFinite(r)||!Number.isFinite(n))return!1;let i=[r>>8&255,r&255,n>>8&255,n&255].join(".");return xXe(i)}function rvr(e){let t=e.toLowerCase().replace(/^\[(.*)\]$/,"$1");if(t==="localhost")return!0;let r=(0,l1e.isIP)(t);return r===4?xXe(t):r===6?t==="::1"||tvr(t):!1}function wXe(e,t="auth.serverUrl"){let r;try{r=new URL(e)}catch{throw new Error(`${t} must be a valid URL (got: ${JSON.stringify(e)})`)}if(r.username||r.password)throw new Error(`${t} must not include username or password credentials`);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&rvr(r.hostname)))throw new Error(`${t} ${QSr}`)}function OXe(){let e=evr();if(!tO.existsSync(e))return{};try{let t=tO.readFileSync(e,"utf-8"),r=JSON.parse(t);return!r||typeof r!="object"||Array.isArray(r)?(Wn.warn("settings:corrupt",{path:AXe(e),reason:"not_object"}),{}):r}catch(t){return Wn.warn("settings:corrupt",{path:AXe(e),error:t?.message||String(t)}),{}}}function p1e(e){let t=OXe()[e];return typeof t=="string"?t:void 0}function nvr(e){let t=OXe()[e];return typeof t=="boolean"?t:void 0}function ovr(e){return typeof e=="string"&&/-(?:rc|alpha|beta)\./i.test(e)}function svr(){try{let e=Z4();return ovr(e.version)}catch{return!1}}function avr(e){return e.envVar!==void 0&&e.envVar!==""?(wXe(e.envVar,"VISA_AUTH_URL"),e.envVar):e.settingValue!==void 0?(wXe(e.settingValue,"auth.serverUrl"),e.settingValue):e.isPrerelease?f1e:ivr}function i6(){return avr({envVar:process.env.VISA_AUTH_URL,settingValue:p1e("auth.serverUrl"),isPrerelease:svr()})}function RXe(e=process.env){let t=[e.VISA_SUPPRESS_BROWSER,e.VISA_CLI_NO_BROWSER,e.CHECKOUT_SKIP_BROWSER_OPEN];return t.some(r=>r==="true"||r==="1")?!0:t.some(r=>r!==void 0)?!1:nvr("ui.suppressBrowser")??!1}var tO,l1e,IXe,PXe,ZSr,QSr,ivr,f1e,o6=A(()=>{"use strict";tO=ie(require("fs")),l1e=require("node:net"),IXe=ie(require("os")),PXe=ie(require("path"));TXe();Zl();ZSr="settings.json",QSr="must use https unless it points at localhost/loopback for local development";ivr="https://auth.visacli.sh",f1e="https://auth-visa-code-preview.up.railway.app"});function vK(e){return m1e(e)!==null}function h1e(e,t){let r=m1e(e),n=m1e(t);if(!r||!n)return!1;for(let i=0;i<3;i++)if(r.main[i]!==n.main[i])return r.main[i]>n.main[i];return r.pre&&!n.pre?!1:!r.pre&&n.pre?!0:!r.pre&&!n.pre?!1:uvr(r.pre,n.pre)>0}function m1e(e){if(typeof e!="string")return null;let r=e.trim().replace(/^v/,"").match(cvr);return r?{main:[Number(r[1]),Number(r[2]),Number(r[3])],pre:r[4]??null}:null}function uvr(e,t){let r=e.split("."),n=t.split("."),i=Math.max(r.length,n.length);for(let o=0;o<i;o++){if(o>=r.length)return-1;if(o>=n.length)return 1;let s=r[o],a=n[o],c=/^\d+$/.test(s),u=/^\d+$/.test(a);if(c&&u){let d=Number(s)-Number(a);if(d!==0)return d}else{if(c)return-1;if(u)return 1;if(s<a)return-1;if(s>a)return 1}}return 0}var cvr,TK=A(()=>{"use strict";cvr=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/});function CXe(e){let t=e||i6();return process.env.VISA_ENVIRONMENT==="staging"||t.includes("staging")||t.includes("up.railway.app")||t.includes("preview")?"staging":process.env.VISA_ENVIRONMENT==="production"||t.includes("auth.visacli.sh")?"production":"development"}var NXe,AK,g1e=A(()=>{"use strict";o6();TK();NXe="4.1.0-rc.70",AK=class extends Error{code="update_required";errorCode="update_required";runningVersion;minCompatibleVersion;updateCommand;constructor(t,r,n){let i=`CLI/MCP update required${n?` for ${n}`:""}: running v${t}, minimum compatible version is v${r}. Run: npm install -g @visa/cli@rc`;super(i),this.name="UpdateRequiredError",this.runningVersion=t,this.minCompatibleVersion=r,this.updateCommand="npm install -g @visa/cli@rc"}toJSON(){return{success:!1,error_code:this.errorCode,error:this.message,runningVersion:this.runningVersion,minCompatibleVersion:this.minCompatibleVersion,updateCommand:this.updateCommand}}}});function rO(){return!!(MXe(process.env.VISA_CLI_NO_UPDATE_CHECK)||MXe(process.env.CI)||process.env.NODE_ENV==="test")}function MXe(e){if(e===void 0)return!1;let t=e.trim().toLowerCase();return!(t===""||t==="0"||t==="false"||t==="no"||t==="off")}var wK=A(()=>{"use strict"});function dvr(){return y1e||(y1e=`ms_${(0,DXe.randomUUID)().replace(/-/g,"")}`),y1e}function lvr(){return _1e?kXe?`${_1e}/${kXe}`.slice(0,96):_1e:null}function Yk(){let e={"X-Visa-MCP-Session":dvr()},t=lvr();return t&&(e["X-Visa-MCP-Client"]=t),e}var DXe,_1e,kXe,y1e,IK=A(()=>{"use strict";DXe=require("node:crypto"),_1e=null,kXe=null,y1e=null});function LXe(e){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("runtime service returned an invalid runtime");let t=e;if(typeof t.runtimeId!="string"||typeof t.agentId!="string"||!pvr.has(String(t.kind))||typeof t.label!="string"||!fvr.has(String(t.status))||typeof t.credentialAudience!="string"||typeof t.credentialPurpose!="string"||typeof t.createdAt!="string"||!(t.lastSeenAt===null||typeof t.lastSeenAt=="string")||!(t.revokedAt===null||typeof t.revokedAt=="string"))throw new Error("runtime service returned an invalid runtime");return t}function _vr(e){if(e===null||!/^\d{1,4}$/.test(e))return 3;let t=Number(e);return Number.isSafeInteger(t)&&t>=1&&t<=3600?t:3}function yvr(e,t){if(e===410&&(t?.code==="route_retired"||t?.error==="route_retired"))return new $c(typeof t?.message=="string"&&t.message.length>0?t.message:"This legacy agent setup route was removed.","legacy_door_removed",{nextAction:EXe(),details:{stage:"retired_door",...typeof t?.replacement=="string"?{replacement:t.replacement}:{}}});if(t?.error==="capability_attach_state_conflict"&&t?.attachId){let c=t.expiresAt?` (expires ${t.expiresAt})`:"",u=t.state?` in state '${t.state}'`:"";return new Ld(`A pending capability-attach ceremony (${t.attachId}) is already${u}${c}. Cancel it in the Visa Console, or wait for it to expire.`,e,"capability_attach_state_conflict",void 0,!1)}if((t?.reason==="policy_step_up_required"||t?.error==="spend_policy_step_up_required")&&typeof t?.stepUp?.reviewUrl=="string")return new Ld(`Owner confirmation required before this payment. Ask the owner to review and approve it at ${t.stepUp.reviewUrl} \u2014 approving shows them a one-time code. Retry the SAME payment passing that code as stepUpToken.`,e,typeof t?.error=="string"?t.error:void 0,"policy_step_up_required",!1);let r=typeof t?.error=="string"?t.error:void 0,n=typeof t?.reason=="string"?t.reason:void 0,i=typeof t?.retryable=="boolean"?t.retryable:void 0,o=typeof t?.message=="string"&&t.message||n||r||"";if(o)return new Ld(o,e,r,n,i);let s=e>=500||e===408||e===425||e===429;return i??s?new Ld(`Request failed (${e}). Try again.`,e,void 0,void 0,i):e===404?new Ld(`Request failed (${e}) \u2014 not found; check the identifier or slug.`,e,void 0,void 0,i):new Ld(`Request failed (${e}).`,e,void 0,void 0,i)}function nh(e){return typeof e=="string"?e.trim():""}function Evr(e){let t=nh(e.error_code)||nh(e.error);return t?t==="SURFACE_DISABLED"||/(_disabled|_not_configured)$/.test(t):!1}function Svr(e){let t=e&&typeof e=="object"?e:{},r=nh(t.error)||nh(t.message);if(!r)return bvr;let n=nh(t.error_code),i=[["surface",nh(t.disabled_surface)],["flag",nh(t.flag)],["correlation_id",nh(t.correlation_id)]].filter(([,s])=>s).map(([s,a])=>`${s}=${a}`),o=i.length?` (${i.join(" ")})`:"";return n?`503 [${n}] ${r}${o}`:`503 ${r}${o}`}function vvr(e=process.env,t=process.stdin.isTTY){let r=["Not logged in. No local Visa CLI session credentials were found."],n=e.VISA_CLI_API_KEY?.trim();return n&&(hvr.test(n)?(r.push("VISA_CLI_API_KEY is set, but this operation requires an enrolled device session."),r.push("Use the Visa Key with X-Api-Key on the /v2/harness/* surface.")):r.push("VISA_CLI_API_KEY is set but has invalid format (expected vk_live_<...> or vk_test_<...>).")),r.push("Run `visa connect` to sign in and connect this device session."),t===!1&&r.push("Complete sign-in in a normal terminal with `visa connect`, then restart the MCP client."),r.join(`
-`)}function J_(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function W_(e){return e===null||typeof e=="string"}function Y_(e,t){let r=e[t];return typeof r=="string"&&r.length>0?r:void 0}function Tvr(e){if(!J_(e))throw new Error("account activity returned a malformed entry");let t=e.rail;if(t!=="card"&&t!=="x402")throw new Error("account activity entry is missing a valid rail label");let r=e.amountUsd,n={id:e.id,operationId:e.operationId,merchant:e.merchant,description:e.description,currency:e.currency,status:e.status,createdAt:e.createdAt};for(let[i,o]of Object.entries(n))if(typeof o!="string"||o.length===0)throw new Error(`account activity entry is missing ${i}`);if(typeof r!="number"||!Number.isFinite(r))throw new Error("account activity entry is missing a numeric amount");return{id:n.id,operationId:n.operationId,merchant:n.merchant,description:n.description,amountUsd:r,currency:n.currency,status:n.status,rail:t,createdAt:n.createdAt,...Y_(e,"failurePhase")?{failurePhase:e.failurePhase}:{},...Y_(e,"finalizesBy")?{finalizesBy:e.finalizesBy}:{},...Y_(e,"agentId")?{agentId:e.agentId}:{},...Y_(e,"agentName")?{agentName:e.agentName}:{},...Y_(e,"grantId")?{grantId:e.grantId}:{},...Y_(e,"mandateId")?{mandateId:e.mandateId}:{},...Y_(e,"drawId")?{drawId:e.drawId}:{},...Y_(e,"transactionHash")?{transactionHash:e.transactionHash}:{},...Y_(e,"transactionNetwork")?{transactionNetwork:e.transactionNetwork}:{}}}function Avr(e){if(!J_(e))return null;let{payment:t,route:r,party:n,authority:i,outcome:o}=e;return e.schemaVersion!==1||typeof e.operationId!="string"||typeof e.activityId!="string"||!J_(t)||typeof t.amountAtomic!="string"||typeof t.decimals!="number"||!Number.isSafeInteger(t.decimals)||t.decimals<0||typeof t.currency!="string"||typeof t.merchant!="string"||typeof t.description!="string"||typeof t.createdAt!="string"||!J_(r)||r.rail!=="wallet"&&r.rail!=="card"||!W_(r.protocol)||!W_(r.network)||!W_(r.cardLast4)||!J_(n)||!W_(n.agentId)||!W_(n.agentName)||!J_(i)||!W_(i.grantId)||!W_(i.mandateId)||!W_(i.drawId)||!J_(o)||typeof o.status!="string"||typeof o.proofLevel!="string"||typeof o.final!="boolean"||typeof o.updatedAt!="string"||!W_(o.finalizesBy)||!Array.isArray(e.evidence)||!e.evidence.every(J_)||!Array.isArray(e.timeline)||!e.timeline.every(J_)||e.dataCompleteness!=="complete"&&e.dataCompleteness!=="partial"?null:e}var pvr,fvr,Jk,mvr,hvr,gvr,Ld,PK,bvr,ff,SS=A(()=>{"use strict";yXe();Dge();u1e();$_();SXe();g1e();TK();wK();o6();IK();pvr=new Set(["local_cli","remote_mcp","mobile","automation","compatibility"]),fvr=new Set(["pending","active","revoked"]);Jk="5.0.0-rc.355",mvr="1",hvr=/^vk_(?:live|test)_[A-Za-z0-9_-]{16,128}$/,gvr=5e3,Ld=class extends Error{constructor(r,n,i,o,s){super(r);this.status=n;this.code=i;this.detail=o;this.serverRetryable=s;this.name="ApiHttpError"}status;code;detail;serverRetryable;get retryable(){return this.serverRetryable??(this.status>=500||this.status===408||this.status===425||this.status===429)}};PK=class extends Error{constructor(r){super("Failed to retrieve task: Task not found");this.taskId=r;this.name="McpTaskNotFoundError"}taskId;rpcCode=-32602};bvr="Visa CLI is temporarily unavailable. Try again, or report at https://github.com/Visa-Crypto-Labs/Visa-mono/issues if it persists.";ff=class{constructor(t){this.getSessionToken=t;this.baseUrl=i6()}getSessionToken;baseUrl;lastSignals={};parseServerSignals(t){if(this.lastSignals={},!rO()){let n=t.headers.get("X-Latest-Version");n&&h1e(n,Jk)&&(this.lastSignals.updateAvailable={currentVersion:Jk,latestVersion:n})}let r=t.headers.get("X-Feedback-Prompt");if(r)try{this.lastSignals.feedbackPrompt=JSON.parse(r)}catch{}}getClientVersion(){return Jk}getAuthServerOrigin(){return this.baseUrl}async signUcpRequest(t){let r=await this.request("POST","/v4/ucp/sign",t,15e3);if(!r||typeof r!="object"||Array.isArray(r)||!r.headers||typeof r.headers!="object"||Array.isArray(r.headers))throw new Error("UCP signing service returned a malformed response");let n=r.headers,i=Object.keys(n).sort(),o=["content-digest","signature","signature-input"];if(i.length!==o.length||i.some((s,a)=>s!==o[a])||o.some(s=>typeof n[s]!="string"||n[s].length===0||n[s].length>16384||/[\r\n]/.test(n[s])))throw new Error("UCP signing service returned invalid signature headers");return n}throwIfAttestationDrift(t){if(t?.error_code==="ATTESTATION_KEY_DRIFT")throw new Ck(t.error||"Your biometric key is out of sync with the server.",typeof t.hint=="string"?t.hint:void 0)}async throwServerUnavailable(t){let r=null;try{r=await t.json()}catch{}let n=Svr(r),i=r&&typeof r=="object"?r:{};throw Evr(i)?new $G(n,{status:t.status,disabledSurface:nh(i.disabled_surface)||void 0,flag:nh(i.flag)||void 0,correlationId:nh(i.correlation_id)||void 0}):new FG(n,t.status,typeof i.retryable=="boolean"?i.retryable:!0)}async getAgentSpendability(t){return this.request("GET",`/v1/admin/agents/${encodeURIComponent(t)}/spendability`)}async financialRuntimeRequest(t,r){return this.request("POST",`/v1/financial-runtime/${t}`,r,2e4)}async identityDeviceRequest(t,r){return this.request("POST",`/v1/identity-device/${t}`,r,2e4)}async request(t,r,n,i,o){let s=await this.getSessionToken();if(!s)throw new Mk(vvr());let a={Authorization:`Bearer ${s}`};o&&(t==="GET"?a["X-User-Context"]=encodeURIComponent(o.replace(/[\r\n\0]/g," ").slice(0,1e3)):n={...n||{},user_context:o}),n&&(a["Content-Type"]="application/json");let c;try{c=await _Xe(`${this.baseUrl}${r}`,{method:t,headers:{...a,"X-Visa-CLI-Version":Jk,"X-Visa-Agent-Operations-Version":mvr,"X-Source":"cli",...Yk()},body:n?JSON.stringify(n):void 0,timeoutMs:i})}catch(d){let l=new Error(c1e(d)),p=a1e(d);throw p&&(l.code=p),l}if(this.parseServerSignals(c),c.status===401)throw new Mk("Your device session has expired. Run `visa connect` to refresh it (the device is already enrolled).",c.status);if(c.status===429){let d=_vr(c.headers.get("Retry-After"));throw new zG(`Rate limited \u2014 wait ${d}s, then retry.`,d)}c.status===503&&await this.throwServerUnavailable(c);let u;try{u=await c.json()}catch{if(c.status===500)throw new Ld(`Server error on ${r}. Try again or check https://visacli.sh for status.`,c.status);if(!c.ok){let d=c.status>=500||c.status===429||t==="GET"&&(c.status===408||c.status===425);throw new Ld(d?`Unexpected response from ${r}. Try again.`:`Unexpected response from ${r} (${c.status}).`,c.status,void 0,void 0,d)}throw new Error(`Unexpected response from ${r}.`)}if(!c.ok){if(c.status===426||u?.error==="update_required"||u?.error_code==="update_required"||u?.errorCode==="update_required"){let d=typeof u?.runningVersion=="string"?u.runningVersion:Jk,l=typeof u?.minCompatibleVersion=="string"?u.minCompatibleVersion:NXe;throw new AK(d,l,r)}if(c.status===500){let d=typeof u?.retryable=="boolean"?u.retryable:void 0;throw new Ld(d===!1?`Server error on ${r}. Inspect the server error and reconcile the existing attempt.`:`Server error on ${r}. Try again or check https://visacli.sh for status.`,c.status,typeof u?.error=="string"?u.error:void 0,typeof u?.reason=="string"?u.reason:void 0,d)}throw this.throwIfAttestationDrift(u),yvr(c.status,u)}return u}async emitTelemetry(t){return this.request("POST","/v1/telemetry",{rows:t},gvr)}async merchantDirectorySearch(t,r){let n=new URLSearchParams;return t.provider&&n.set("provider",t.provider),t.q&&n.set("q",t.q),t.protocol&&n.set("protocol",t.protocol),t.maxPriceUsd&&n.set("max_price_usd",t.maxPriceUsd),t.verify&&n.set("verify",t.verify),n.set("limit",String(t.limit)),n.set("offset",String(t.offset)),this.request("GET",`/v1/merchant-directory/search?${n.toString()}`,void 0,void 0,r)}async merchantDirectoryCertified(t){return this.request("GET","/v1/merchant-directory/certified",void 0,void 0,t)}async reportSettlementReceipt(t,r){return this.request("POST","/v4/directory/settlement-receipt",t,void 0,r)}async getAccountActivity(t,r){let n=new URLSearchParams;t!==void 0&&n.set("limit",String(t)),r!==void 0&&n.set("agentId",r);let i=n.size>0?`?${n.toString()}`:"",o=await this.request("GET",`/v4/account/activity${i}`);if(!o||!Array.isArray(o.activity))throw new Error("account activity service returned an invalid response");return o.activity.map(Tvr)}async getAccountActivityReceipt(t){let r;try{r=await this.request("GET",`/v4/account/activity/${encodeURIComponent(t)}`)}catch(i){throw i instanceof Ld&&i.status===404?new $c(`account activity entry not found: ${t}`,"activity_entry_not_found"):i}let n=Avr(r);if(!n)throw new Error("account receipt service returned an invalid or unsupported response");return n}async getStatus(t){return this.request("GET","/v1/status",void 0,void 0,t)}async getAgentTapStatus(t){try{return await this.request("GET",`/v4/agent-bindings/${encodeURIComponent(t)}/tap-status`)}catch{return null}}async listAccountAgents(){try{let t=await this.request("GET","/v4/account/agents");return!t||!Array.isArray(t.agents)?null:t.agents.flatMap(r=>{if(!r||typeof r!="object")return[];let n=r;if(typeof n.agentJkt!="string")return[];let i=n.approvedAuthority,o=i&&typeof i=="object"&&typeof i.grantId=="string"&&typeof i.status=="string"&&typeof i.totalMicros=="string"&&typeof i.perTransactionMicros=="string"&&typeof i.spentMicros=="string"&&typeof i.reservedMicros=="string"&&Array.isArray(i.scopes)?(()=>{let l=i;return{grantId:l.grantId,status:l.status,totalMicros:l.totalMicros,perTransactionMicros:l.perTransactionMicros,spentMicros:l.spentMicros,reservedMicros:l.reservedMicros,scopes:l.scopes.filter(p=>typeof p=="string"),...typeof l.expiresAt=="string"?{expiresAt:l.expiresAt}:{}}})():void 0,s=l=>typeof n[l]=="string"&&n[l].length>0?n[l]:void 0,a=n.executionReadiness,c=a&&typeof a=="object"&&!Array.isArray(a)?(()=>{let l=a,p=["shared","card","wallet"];if(Object.keys(l).some(m=>!p.includes(m))||Object.values(l).some(m=>typeof m!="string"))return;let f=Object.fromEntries(p.filter(m=>m in l).map(m=>[m,l[m]]));return Object.keys(f).length>0?f:void 0})():void 0,u=n.wallet,d=u&&typeof u=="object"&&!Array.isArray(u)?(()=>{let l=u,p=h=>typeof l[h]=="string"?{[h]:l[h]}:{},f=h=>typeof l[h]=="number"&&Number.isFinite(l[h])?{[h]:l[h]}:{},m={...p("walletAddress"),...p("network"),...typeof l.provisioned=="boolean"?{provisioned:l.provisioned}:{},...f("dailyLimitCents"),...f("perTransactionLimitCents")};return Object.keys(m).length>0?m:void 0})():void 0;return[{agentId:typeof n.agentId=="string"?n.agentId:null,agentJkt:n.agentJkt,name:typeof n.name=="string"?n.name:"",revoked:n.revoked===!0,paused:n.paused===!0,...o?{approvedAuthority:o}:{},...s("executionStatus")?{executionStatus:s("executionStatus")}:{},...s("executionStatusReason")?{executionStatusReason:s("executionStatusReason")}:{},...c?{executionReadiness:c}:{},...s("identityKeyStatus")?{identityKeyStatus:s("identityKeyStatus")}:{},...s("tapStatus")?{tapStatus:s("tapStatus")}:{},...d?{wallet:d}:{}}]})}catch{return null}}async listAccountCardMandates(){try{let t=await this.request("GET","/v4/account/card-mandates?includeInactive=1&limit=200");return!t||!Array.isArray(t.mandates)?null:t.mandates.flatMap(r=>{if(!r||typeof r!="object")return[];let n=r;return typeof n.mandateId!="string"||n.mandateId.length===0?[]:[{mandateId:n.mandateId,revokedAt:typeof n.revokedAt=="string"?n.revokedAt:null,expiresAt:typeof n.expiresAt=="string"?n.expiresAt:null}]})}catch{return null}}async revokeAccountCardMandate(t){try{return await this.request("POST",`/v4/account/card-mandates/${encodeURIComponent(t)}/revoke`)}catch{return null}}async getFeatureFlags(){return this.request("GET","/v1/feature-flags")}async checkInternalAccess(t,r,n=!1){let i=await this.request("GET",`/v4/internal-access?feature=${encodeURIComponent(t)}${n?"&strict=1":""}`,void 0,void 0,r);if(typeof i?.allowed!="boolean")throw new Error("Internal access response did not include a boolean allowed field.");return i.allowed}async checkCheckoutAgentAccess(t){return this.checkInternalAccess("checkout-agent",t,!0)}async getAttestationChallenge(){return this.request("GET","/v1/attestation-challenge")}async registerAttestationKey(t,r){return this.request("POST","/v1/attestation-key",{publicKey:t,...r?{attestation:r}:{}})}async setBiometricPreference(t,r){return this.request("POST","/v1/biometric-preference",{...t,confirm:!0},void 0,r)}async logout(t,r){return this.request("POST","/v4/logout",t,void 0,r)}async getAccountSessions(t){return this.request("GET","/v4/account/sessions?redact=true",void 0,void 0,t)}async getSecurityHistory(t=50,r){return this.request("GET",`/v4/account/security-history?limit=${t}&redact=true`,void 0,void 0,r)}async feedback(t,r,n){return this.request("POST","/v1/feedback",{message:t,...r&&{transaction_id:r}},void 0,n)}async createAppApiKey(t){return this.request("POST","/v1/api/keys",t)}async listAppApiKeys(t){let r=new URLSearchParams;t?.limit!=null&&r.set("limit",String(t.limit)),t?.startingAfter!=null&&r.set("starting_after",String(t.startingAfter)),t?.endingBefore!=null&&r.set("ending_before",String(t.endingBefore));let n=r.toString();return this.request("GET",n?`/v1/api/keys?${n}`:"/v1/api/keys")}async listAllAppApiKeys(){let t=[],r=new Set,n,i=null,o=0;for(;;){let s=await this.listAppApiKeys({limit:100,...n!==void 0?{startingAfter:n}:{}});if(o+=1,i=s,t.push(...s.keys??[]),!s.has_more)break;if(s.next_cursor==null)throw new Error("API key pagination response did not include next_cursor.");if(r.has(s.next_cursor))throw new Error("API key pagination cursor did not advance.");r.add(s.next_cursor),n=s.next_cursor}return{...i??{success:!0,keys:[]},keys:t,limit:100,has_more:!1,next_cursor:null,previous_cursor:null,pages:o}}async revokeAppApiKey(t){return this.request("DELETE",`/v1/api/keys/${encodeURIComponent(String(t))}`)}async putMcpTask(t,r){return this.request("PUT",`/v1/mcp-tasks/${encodeURIComponent(t)}`,r)}async getMcpTask(t){try{return await this.request("GET",`/v1/mcp-tasks/${encodeURIComponent(t)}`)}catch(r){throw r instanceof PK?r:r instanceof Ld&&r.status===404?new PK(t):r}}async createCapabilityAttach(t,r){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/capability-attach`,{protocolVersion:2,capability:r.capability,...r.aggregateCeilingCents!==void 0?{aggregateCeilingCents:r.aggregateCeilingCents}:{},...r.perPurchaseCents!==void 0?{perPurchaseCents:r.perPurchaseCents}:{},...r.aggregateCeilingMicros!==void 0?{aggregateCeilingMicros:r.aggregateCeilingMicros}:{},...r.perTransactionMicros!==void 0?{perTransactionMicros:r.perTransactionMicros}:{},...r.termsMode?{termsMode:r.termsMode}:{},...r.deviceWalletPublicKey?{deviceWalletPublicKey:r.deviceWalletPublicKey}:{},...r.redelivery?{redelivery:!0}:{}})}async getCapabilityAttachStatus(t,r){return this.request("GET",`/v4/agents/${encodeURIComponent(t)}/capability-attach/${encodeURIComponent(r)}`)}async cancelCapabilityAttach(t,r){let n=await this.request("POST",`/v4/agents/${encodeURIComponent(t)}/capability-attach/${encodeURIComponent(r)}/reject`,{});return{cancelled:n?.rejected===!0,...typeof n?.state=="string"?{state:n.state}:{}}}async revokeSpendingAuthority(t){let r=await this.request("POST",`/v4/agents/${encodeURIComponent(t)}/spending-authority/revoke`,{});if(typeof r?.revoked!="boolean")throw new Error("spending authority revoke service returned an invalid response");return{revoked:r.revoked}}async pauseAgent(t){return{paused:(await this.request("POST",`/v4/account/agents/${encodeURIComponent(t)}/pause`,{}))?.paused===!0}}async renameAgent(t,r){let n=await this.request("PATCH",`/v4/account/agents/${encodeURIComponent(t)}/display-name`,{displayName:r});if(typeof n.displayName!="string")throw new Error("rename service returned an invalid display name");return{renamed:n?.renamed===!0,displayName:n.displayName}}async resumeAgent(t){return{resumed:(await this.request("POST",`/v4/account/agents/${encodeURIComponent(t)}/resume`,{}))?.resumed===!0}}async listAgentRuntimes(t){let r=await this.request("GET",`/v4/account/agents/${encodeURIComponent(t)}/runtimes`);if(!Array.isArray(r.runtimes))throw new Error("runtime service returned an invalid list");return r.runtimes.map(LXe)}async revokeAgentRuntime(t,r){let n=await this.request("POST",`/v4/account/agents/${encodeURIComponent(t)}/runtimes/${encodeURIComponent(r)}/revoke`,{});if(n.outcome!=="revoked"&&n.outcome!=="already_revoked")throw new Error("runtime service returned an invalid revoke result");return{outcome:n.outcome,runtime:LXe(n.runtime)}}async claimAgentForApp(t,r){return{claimed:(await this.request("POST","/v4/account/agent-apps",{agentId:t,harnessId:r}))?.claimed===!0}}async issueAgentEmailChannel(t,r){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/channels/email`,{},void 0,r)}async beginAgentMailRuntimeCredential(t,r){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/channels/email/runtime-credential`,{},void 0,r)}async claimAgentMailRuntimeCredential(t,r,n){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/channels/email/runtime-credentials/${encodeURIComponent(r)}/claim`,n)}async forgetAgentMailRuntimeCredential(t,r){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/channels/email/forget`,{},void 0,r)}async signTurnkeyTapPayload(t,r){let n=await this.request("POST",`/v4/account/agents/${encodeURIComponent(t)}/keychain/tap-sign`,{signatureBase:r});if(typeof n.signature!="string"||typeof n.keyId!="string")throw new Error("TAP signing service returned an invalid response");return{signature:n.signature,keyId:n.keyId}}}});function sO(e=process.env){return R1e.join(To(e),"session-recovery")}function iO(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function RK(e,t){let r=new Set(t);return Object.keys(e).every(n=>r.has(n))}function rTr(e){let t=e.toLowerCase().replace(/^\[(.*)\]$/,"$1");if(t==="localhost"||t==="::1")return!0;let r=t.split(".");return r.length===4&&r[0]==="127"&&r.every(n=>/^\d{1,3}$/.test(n)&&Number(n)<=255)}function X_(e){if(typeof e!="string"||e.length===0||e.length>tTr)throw new Error("v4 sign-in URL must be a bounded web origin");let t;try{t=new URL(e)}catch{throw new Error("v4 sign-in URL must be a bounded web origin")}if(t.username.length>0||t.password.length>0||t.search.length>0||t.hash.length>0||t.pathname!==""&&t.pathname!=="/"||t.protocol!=="https:"&&!(t.protocol==="http:"&&rTr(t.hostname)))throw new Error("v4 sign-in URL must use an HTTPS origin (or HTTP loopback)");return t.origin}function TS(e){let t=(0,oO.createHash)("sha256").update(`${e}:visa-cli-handoff-confirm`,"utf8").digest(),r="";for(let n=0;n<Qvr;n+=1)r+=tZe[t[n]%tZe.length];return r}function NK(e=sO()){return R1e.join(e,Zvr)}function nTr(e){vS.mkdirSync(e,{recursive:!0,mode:448});let t=vS.lstatSync(e);if(t.isSymbolicLink()||!t.isDirectory())throw new Error("login recovery directory must be a real directory, not a symlink");vS.chmodSync(e,448),Vc(e)}function iTr(e){if(!iO(e)||!RK(e,["verifier","challenge","baseUrl","createdAt","expiresAt","serverSkewMs"])||typeof e.verifier!="string"||!eZe.test(e.verifier)||typeof e.challenge!="string"||!eZe.test(e.challenge)||typeof e.baseUrl!="string"||!Number.isSafeInteger(e.createdAt)||e.createdAt<0||e.expiresAt!==void 0&&(!Number.isSafeInteger(e.expiresAt)||e.expiresAt<0)||e.serverSkewMs!==void 0&&!Number.isSafeInteger(e.serverSkewMs))return!1;try{return X_(e.baseUrl)===e.baseUrl&&(0,oO.createHash)("sha256").update(e.verifier,"utf8").digest("base64url")===e.challenge}catch{return!1}}function iZe(e=sO()){let t=Xl(NK(e),{maxBytes:8192});if(t===null)return null;let r;try{r=JSON.parse(t)}catch{throw new Error("local login recovery state contains invalid JSON")}if(!iTr(r))throw new Error("local login recovery state is invalid");return r}function N1e(e){return e.expiresAt!==void 0?{deadline:e.expiresAt,skewMs:e.serverSkewMs??0,source:"server"}:{deadline:e.createdAt+Xvr,skewMs:0,source:"local"}}function oZe(e=Date.now(),t=sO()){let r=iZe(t);if(!r)return null;let n=TS(r.verifier),{deadline:i,skewMs:o,source:s}=N1e(r),a=Math.max(0,i-(e+o)),c=Math.floor(a/1e3),u=aZe(r,e);return{verifier:r.verifier,challenge:r.challenge,confirmCode:n,baseUrl:r.baseUrl,createdAt:r.createdAt,expiresAt:new Date(i-o).toISOString(),remainingSeconds:c,likelyExpired:u,expirySource:s}}function rZe(e=sO()){Vc(e)&&vS.rmSync(NK(e),{force:!0})}async function sTr(e,t,r,n){try{let i=await r(`${e.baseUrl}${oTr}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({challenge:e.challenge}),signal:AbortSignal.timeout(n),redirect:"error"});if(!i.ok)return null;let o=await i.json().catch(()=>null);if(!iO(o)||o.ok!==!0)return null;let s=typeof o.serverTime=="string"?Date.parse(o.serverTime):NaN,a=o.ttlMs;return!Number.isSafeInteger(s)||s<0||typeof a!="number"||!Number.isSafeInteger(a)||a<=0||a>nZe?null:{expiresAt:s+a,skewMs:s-t}}catch{return null}}async function sZe(e,t=Date.now(),r=sO(),n={}){if(!Number.isSafeInteger(t)||t<0)throw new Error("login handoff time is invalid");let i=X_(e),o=Zk(n.requestTimeoutMs,5e3,"login announce timeout"),s=n.fetchImpl??fetch,a=(0,oO.randomBytes)(32).toString("base64url"),c=(0,oO.createHash)("sha256").update(a,"utf8").digest("base64url"),u={verifier:a,challenge:c,baseUrl:i,createdAt:t};nTr(r),Fc(NK(r),JSON.stringify(u,null,2));let d=await sTr(u,t,s,o);d&&(u.expiresAt=d.expiresAt,u.serverSkewMs=d.skewMs,Fc(NK(r),JSON.stringify(u,null,2)));let{deadline:l,skewMs:p,source:f}=N1e(u);return{challenge:c,confirmCode:TS(a),expiresAt:new Date(l-p).toISOString(),expirySource:f}}function Zk(e,t,r){let n=e??t;if(!Number.isSafeInteger(n)||n<=0||n>nZe)throw new Error(`${r} must be a positive integer within the supported range`);return n}function aZe(e,t=Date.now()){let{deadline:r,skewMs:n}=N1e(e);return t+n>r}function aTr(e){if(!iO(e)||!RK(e,["payload"])||!iO(e.payload)||!RK(e.payload,["cliSessionToken","ownerProfile"]))return null;let t=e.payload.cliSessionToken,r=e.payload.ownerProfile;return typeof t!="string"||!t.trim()||t.length>eTr||!iO(r)||!RK(r,["ownerPublicId","loginLabel","authOrigin"])||typeof r.ownerPublicId!="string"||typeof r.loginLabel!="string"||typeof r.authOrigin!="string"?null:{sessionToken:t,ownerProfile:{ownerPublicId:r.ownerPublicId,loginLabel:r.loginLabel,authOrigin:r.authOrigin}}}async function cZe(e,t={}){let r=t.loginDir??sO(),n;try{n=iZe(r)}catch(y){return{status:"error",message:y instanceof Error?y.message:String(y)}}if(!n)return{status:"no_pending"};if(e!==void 0){let y;try{y=X_(e)}catch(S){return{status:"error",message:S instanceof Error?S.message:String(S)}}if(y!==n.baseUrl)return{status:"error",message:"V4 sign-in origin does not match the pending handoff. Run agent login again."}}let i,o,s,a;try{i=Zk(t.attempts,1,"login claim attempts"),o=Zk(t.delayMs,1e3,"login claim interval"),s=Zk(t.requestTimeoutMs,1e4,"login claim request timeout"),a=t.overallTimeoutMs===void 0?void 0:Zk(t.overallTimeoutMs,1,"login claim overall timeout")}catch(y){return{status:"error",message:y instanceof Error?y.message:String(y)}}let c=t.fetchImpl??fetch,u=t.sleep??(y=>new Promise(S=>setTimeout(S,y))),d=t.now??Date.now,l=a===void 0?void 0:d()+a,p=`${n.baseUrl}/api/vgs/cli-handoff/claim`,f=null,m=n,h=m.expiresAt!==void 0,g=()=>f==="expired"||f==="unknown"&&h?{status:"not_ready",likelyExpired:!0,expirySource:"server"}:f==="pending"?{status:"not_ready",likelyExpired:!1,expirySource:"server"}:{status:"not_ready",likelyExpired:aZe(m,d()),expirySource:"local"};for(let y=0;y<i;y+=1){let S=l===void 0?s:l-d();if(S<=0)return g();let b,E=AbortSignal.timeout(Math.max(1,Math.min(s,S)));try{b=await c(p,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({verifier:n.verifier}),signal:E,redirect:"error"})}catch(w){if(E.aborted||iO(w)&&w.name==="TimeoutError"){if(l!==void 0&&d()>=l)return g();if(y+1<i){let I=l===void 0?o:l-d();if(I<=0)return g();await u(Math.min(o,I));continue}return{status:"error",message:"V4 sign-in claim request timed out."}}if(y+1<i){let I=l===void 0?o:l-d();if(I<=0)return g();await u(Math.min(o,I));continue}return{status:"error",message:`Could not reach the v4 sign-in service: ${w instanceof Error?w.message:String(w)}`}}if(b.ok){let w=await b.json().catch(()=>null),I=aTr(w);if(!I)return{status:"error",message:"Sign-in response was not a session-only handoff. Restart with visa agent login --restart."};try{let N=NYe(I.ownerProfile);await sn.saveProfileSessionToken(N,I.sessionToken,{preserveLegacy:!0}),CYe(N),await sn.retireLegacySessionToken()}catch{return{status:"error",message:"The session reached this device but could not be saved. Fix local credential storage, then restart with visa agent login --restart."}}return rZe(r),{status:"claimed"}}if(b.status===404){let w=await b.json().catch(()=>null),I=typeof w?.serverTime=="string"&&typeof w.error=="string"?w.error:null;if(I==="expired"?f="expired":I==="unknown_handoff"?f="unknown":I==="not_ready"&&(f="pending"),f==="expired"||f==="unknown"&&h)return g();if(y+1<i){let N=l===void 0?o:l-d();if(N<=0)return g();await u(Math.min(o,N))}continue}if(b.status===409)return{status:"confirm_mismatch",confirmCode:TS(n.verifier)};if(b.status===422)return rZe(r),{status:"error",message:"Sign-in pickup was not login-only. Run agent login again."};if(b.status===429)return g();let T=await b.json().catch(()=>null);return{status:"error",message:typeof T?.error=="string"&&T.error.length<=512?T.error:`V4 sign-in claim failed (${b.status}).`}}return g()}var oO,vS,R1e,Xvr,Zvr,eZe,tZe,Qvr,eTr,tTr,nZe,oTr,CK=A(()=>{"use strict";oO=require("node:crypto"),vS=ie(require("node:fs")),R1e=ie(require("node:path"));$0();mS();q_();kd();Xvr=15*6e4;Zvr="pending.json",eZe=/^[A-Za-z0-9_-]{43}$/,tZe="ABCDEFGHJKMNPQRSTUVWXYZ23456789",Qvr=6,eTr=512,tTr=2048,nZe=2147483647;oTr="/api/vgs/cli-handoff/announce"});function _Tr(e){return[["openclaw",tD.join(e,".openclaw")],["hermes",tD.join(e,".hermes")],["claude-code",tD.join(e,".claude")],["codex",tD.join(e,".codex")]]}function D1e(e=process.env,t={}){if(e.VISA_CLI_RUNTIME&&e.VISA_CLI_RUNTIME.trim().length>0)return e.VISA_CLI_RUNTIME.trim();if(e.AGENT_RUNTIME&&e.AGENT_RUNTIME.trim().length>0)return e.AGENT_RUNTIME.trim();let r=s=>Object.entries(e).some(([a,c])=>a.startsWith(s)&&typeof c=="string"&&c.trim()!==""),n=new Set;if(r("CODEX_")&&n.add("codex"),(typeof e.CLAUDECODE=="string"&&e.CLAUDECODE.trim()!==""||r("CLAUDE_CODE_")||typeof e.CLAUDE_PROJECT_DIR=="string"&&e.CLAUDE_PROJECT_DIR.trim()!=="")&&n.add("claude-code"),r("OPENCLAW_")&&n.add("openclaw"),r("HERMES_")&&n.add("hermes"),n.size>0)return n.size===1?n.values().next().value:void 0;let i=t.home??hZe.homedir(),o=_Tr(i).filter(([,s])=>mZe.existsSync(s));return o.length===1?o[0][0]:void 0}function kK(e=process.env,t={}){switch(D1e(e,t)){case"claude-code":return"claude";case"codex":return"codex";case"openclaw":return"openclaw";case"hermes":return"hermes";default:return"claude"}}var mZe,hZe,tD,L1e=A(()=>{"use strict";mZe=ie(require("fs")),hZe=ie(require("os")),tD=ie(require("path"))});var dD=_((cwi,WQe)=>{"use strict";var NTr=Object.create,ZK=Object.defineProperty,CTr=Object.getOwnPropertyDescriptor,zZe=Object.getOwnPropertyNames,MTr=Object.getPrototypeOf,kTr=Object.prototype.hasOwnProperty,DTr=(e,t)=>function(){try{return t||(0,e[zZe(e)[0]])((t={exports:{}}).exports,t),t.exports}catch(n){throw t=0,n}},LTr=(e,t)=>{for(var r in t)ZK(e,r,{get:t[r],enumerable:!0})},GZe=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of zZe(t))!kTr.call(e,i)&&i!==r&&ZK(e,i,{get:()=>t[i],enumerable:!(n=CTr(t,i))||n.enumerable});return e},KZe=(e,t,r)=>(r=e!=null?NTr(MTr(e)):{},GZe(t||!e||!e.__esModule?ZK(r,"default",{value:e,enumerable:!0}):r,e)),UTr=e=>GZe(ZK({},"__esModule",{value:!0}),e),BTr=DTr({"../shared/dist/canonical-contract.js"(e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.CANONICAL_OPAQUE_ID_MAX_BYTES=e.CANONICAL_OPAQUE_ID_RE=e.CANONICAL_OPAQUE_ID_PATTERN=void 0,e.utf8ByteLength=n,e.isCanonicalText=i,e.compareCanonicalKeys=o,e.isCanonicalOpaqueId=s,e.assertCanonicalOpaqueId=a,e.CANONICAL_OPAQUE_ID_PATTERN="^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",e.CANONICAL_OPAQUE_ID_RE=new RegExp(e.CANONICAL_OPAQUE_ID_PATTERN),e.CANONICAL_OPAQUE_ID_MAX_BYTES=128;var t=/[\u0000-\u001f\u007f\u2028\u2029]/,r=new TextEncoder;function n(c){return r.encode(c).length}function i(c,u){return typeof c=="string"&&c.length>0&&n(c)<=u&&c.trim()===c&&c.normalize("NFC")===c&&!t.test(c)}function o(c,u){let d=r.encode(c),l=r.encode(u),p=Math.min(d.length,l.length);for(let f=0;f<p;f+=1)if(d[f]!==l[f])return d[f]-l[f];return d.length-l.length}function s(c){return typeof c=="string"&&n(c)<=e.CANONICAL_OPAQUE_ID_MAX_BYTES&&e.CANONICAL_OPAQUE_ID_RE.test(c)}function a(c,u="value"){if(!s(c))throw new Error(`${u} must be a canonical opaque id (max 128 ASCII bytes)`)}}}),WZe={};LTr(WZe,{AGENT_AUTHORITY_VALUATION_POLICY:()=>FK,AGENT_AUTHORITY_VERSION:()=>Q_,AGENT_AUTHORIZATION_SCOPES:()=>ey,AGENT_BUDGET_EPOCH_MODES:()=>TQe,AGENT_CAPABILITY_ATTACH_CAPABILITIES:()=>YK,AGENT_CHANNEL_ASSURANCES:()=>RQe,AGENT_CHANNEL_KINDS:()=>xQe,AGENT_CHANNEL_STATUSES:()=>OQe,AGENT_EXECUTION_READINESS_REASONS:()=>$Ar,AGENT_HANDOFF_AUTHORITIES:()=>c2r,AGENT_HANDOFF_COMPOUND_AUTHORITY:()=>e_e,AGENT_KEY_CUSTODIES:()=>IQe,AGENT_KEY_PURPOSES:()=>wQe,AGENT_KEY_STATUSES:()=>PQe,AGENT_PAIRING_CODE_ALPHABET:()=>dO,AGENT_PAIRING_CODE_LENGTH:()=>sD,AGENT_PAIRING_PROTOCOL_VERSION:()=>d2r,AGENT_PAIRING_PROTOCOL_VERSION_V2:()=>JK,DOMAINS:()=>NAr,USD_MICROS_PER_CENT:()=>nW,VIC_PROCESSOR_ACTIONS:()=>AQe,VIC_SETTLEMENT_ENVELOPE_KIND:()=>VK,VIC_SETTLEMENT_ENVELOPE_VERSION:()=>HK,agentAuthorityGrantHash:()=>o2r,agentMailCredentialClaimMessageV2:()=>G2r,authorizationScopeFacts:()=>t2r,base64ToBytes:()=>yQe,base64UrlToBytes:()=>rW,bytesToBase64:()=>_Qe,bytesToBase64Url:()=>ry,bytesToHex:()=>gQe,canonicalAgentAuthorityGrant:()=>Z1e,canonicalAgentChannelDescriptor:()=>i2r,canonicalAgentKeyDescriptor:()=>r2r,canonicalFormAgent:()=>CAr,canonicalPairingDeliveryArtifactV2:()=>KQe,canonicalPairingTerms:()=>VQe,canonicalPairingTermsV2:()=>i_e,canonicalSpendAuthorizationIntent:()=>Q1e,canonicalVicSettlementEnvelope:()=>kQe,capabilityAttachActivationMessageV2:()=>K2r,capabilityAttachClaimHashV2:()=>$2r,capabilityAttachClaimMessageV2:()=>zQe,centsToUsdMicros:()=>QAr,concatBytes:()=>X1e,extractEd25519Seed:()=>FAr,formatPairingCode:()=>uD,generateKeyPair:()=>wAr,generateSeed:()=>mQe,getPublicKey:()=>tW,handoffAuthorityCapabilities:()=>u2r,hexToBytes:()=>J1e,isCanonicalBase64Url32:()=>oc,isValidPairingCode:()=>qQe,jwkToKeyPair:()=>LAr,jwkToPublicKey:()=>DAr,jwkToSeed:()=>SQe,keyPairFromSeed:()=>hQe,keyRotationClaimHashV2:()=>z2r,keyRotationClaimMessageV2:()=>GQe,normalizePairingCode:()=>aW,pairingActivationMessage:()=>H2r,pairingActivationMessageV2:()=>F2r,pairingArtifactHash:()=>Y2r,pairingClaimHashV2:()=>V2r,pairingClaimMessage:()=>q2r,pairingClaimMessageV2:()=>$Qe,pairingClaimTokenHash:()=>HQe,pairingCodeFromClaimToken:()=>L2r,pairingCodeHash:()=>k2r,pairingConfirmationCode:()=>U2r,pairingDeliveryArtifactV2Hash:()=>W2r,pairingInstrumentCommitment:()=>I2r,pairingSha256:()=>hf,pairingTermsHash:()=>j2r,pairingTermsV2Hash:()=>FQe,pairingVerifierChallenge:()=>C2r,pkcs8ToSeed:()=>HAr,publicKeyToJwk:()=>kAr,publicKeyToSpki:()=>qAr,randomAttachId:()=>x2r,randomHandoffId:()=>O2r,randomPairingClaimToken:()=>D2r,randomPairingCode:()=>M2r,randomPairingId:()=>P2r,randomPairingVerifier:()=>N2r,randomSetupOperationId:()=>R2r,seedToJwk:()=>MAr,seedToPkcs8:()=>jAr,setupConfirmationCode:()=>B2r,sign:()=>IAr,signAsync:()=>xAr,spendAuthorizationIntentHash:()=>DQe,spkiToPublicKey:()=>VAr,subwayAgentMsgV1:()=>bQe,usdcAtomicToUsdMicros:()=>e2r,verify:()=>PAr,verifyAsync:()=>OAr,vicSettlementEnvelopeHash:()=>s2r,walletAuthorizationRequestHash:()=>a2r});WQe.exports=UTr(WZe);var QK=Object.freeze,uO=0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn,$K=0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3edn,jK=0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3n,j1e=0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an,q1e=0x6666666666666666666666666666666666666666666666666666666666666658n,qK=uO-1n,jTr=QK({p:uO,n:$K,h:8n,a:qK,d:jK,Gx:j1e,Gy:q1e}),xS=32,PZe=e=>e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"&&e.BYTES_PER_ELEMENT===1,np=(e,t,r="")=>{if(PZe(e)&&(t===void 0||e.length===t))return e;let n=PZe(e),i=t!==void 0?` of length ${t}`:"",o=n?`length=${e.length}`:`type=${typeof e}`,s=(r?`"${r}" `:"")+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)},eW=(e,t="",r)=>Uint8Array.from(np(e,r,t)),YZe=(e,t)=>e.toString(16).padStart(t,"0"),F1e=e=>{let t="";for(let r of np(e))t+=YZe(r,2);return t},$1e=e=>{let t="hex invalid";if(typeof e!="string")throw new TypeError(t);if(e.length%2||!/^[\da-f]*$/i.test(e))throw new RangeError(t);let r=new Uint8Array(e.length/2);for(let n=0,i=0;n<r.length;n++,i+=2){let o=e.charCodeAt(i),s=e.charCodeAt(i+1);r[n]=((o&15)+(o>>6)*9)*16+(s&15)+(s>>6)*9}return r},u6=(...e)=>{let t=0;for(let i of e)t+=np(i).length;let r=new Uint8Array(t),n=0;for(let i of e)r.set(i,n),n+=i.length;return r},JZe=(e=xS)=>{let t=globalThis?.crypto;if(typeof t?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined, consider polyfill");return t.getRandomValues(new Uint8Array(e))},s6=(e,t,r,n="bad number: out of range")=>{if(typeof e!="bigint")throw new TypeError(n);if(t<=e&&e<r)return e;throw new RangeError(n)},fi=(e,t=uO)=>(e%=t)>=0n?e:t+e,xZe=(1n<<255n)-1n,Ye=e=>{if(e<0n)throw new RangeError("negative coordinate");let t=(e>>255n)*19n+(e&xZe);return t=(t>>255n)*19n+(t&xZe),t%uO},XZe=e=>fi(e,$K),ZZe=(e,t)=>{if(e===0n)throw new Error("invert: expected non-zero number");if(t<=1n)throw new Error("invert: expected modulus > 1, got "+t);let r=fi(e,t),n=t,i=0n,o=1n;for(;r!==0n;){let a=n/r,c=n-r*a,u=i-o*a;n=r,r=c,i=o,o=u}if(n!==1n)throw new Error("invert: does not exist");return fi(i,t)},QZe=e=>{let t=cQe[e];if(typeof t!="function")throw new Error("hashes."+e+" not set");return t},z1e=(e,...t)=>np(QZe(e)(u6(...t)),64,"digest"),G1e=async(e,...t)=>np(await QZe(e)(u6(...t)),64,"digest"),U1e=e=>{if(e instanceof d6)return e;throw new TypeError("Point expected")},eQe=2n**256n,d6=class a6{static BASE;static ZERO;X;Y;Z;T;constructor(t,r,n,i){let o=eQe;this.X=s6(t,0n,o),this.Y=s6(r,0n,o),this.Z=s6(n,1n,o),this.T=s6(i,0n,o),QK(this)}static CURVE(){return jTr}static fromAffine(t){return new a6(t.x,t.y,1n,Ye(t.x*t.y))}static fromBytes(t,r=!1){let n=eW(t,"point",xS),i=n[31];n[31]=i&-129;let o=K1e(n);r||s6(o,0n,uO);let s=Ye(o*o),a=fi(s-1n),c=Ye(jK*s+1n),{isValid:u,value:d}=HTr(a,c);if(!u)throw new Error("bad point: y not sqrt");let l=!!(i&128);if(!r&&d===0n&&l)throw new Error("bad point: x==0, isLastByteOdd");return l!==!!(d&1n)&&(d=fi(-d)),new a6(d,o,1n,Ye(d*o))}static fromHex(t,r){return a6.fromBytes($1e(t),r)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}assertValidity(){let t=qK,r=jK,n=this;if(n.is0())throw new Error("bad point: ZERO");let{X:i,Y:o,Z:s,T:a}=n,c=Ye(i*i),u=Ye(o*o),d=Ye(s*s),l=Ye(d*d),p=Ye(c*t),f=Ye(d*(p+u)),m=fi(l+Ye(r*Ye(c*u)));if(f!==m)throw new Error("bad point: equation left != right (1)");let h=Ye(i*o),g=Ye(s*a);if(h!==g)throw new Error("bad point: equation left != right (2)");return this}equals(t){let{X:r,Y:n,Z:i}=this,{X:o,Y:s,Z:a}=U1e(t);return Ye(r*a)===Ye(o*i)&&Ye(n*a)===Ye(s*i)}is0(){return this.equals(c6)}negate(){return new a6(fi(-this.X),this.Y,this.Z,fi(-this.T))}double(){let{X:t,Y:r,Z:n}=this,i=qK,o=Ye(t*t),s=Ye(r*r),a=Ye(2n*n*n),c=Ye(i*o),u=fi(t+r),d=fi(Ye(u*u)-o-s),l=fi(c+s),p=fi(l-a),f=fi(c-s),m=Ye(d*p),h=Ye(l*f),g=Ye(d*f),y=Ye(p*l);return new a6(m,h,y,g)}add(t){let{X:r,Y:n,Z:i,T:o}=this,{X:s,Y:a,Z:c,T:u}=U1e(t),d=qK,l=jK,p=Ye(r*s),f=Ye(n*a),m=Ye(Ye(o*l)*u),h=Ye(i*c),g=fi(Ye(fi(r+n)*fi(s+a))-p-f),y=fi(h-m),S=fi(h+m),b=fi(f-Ye(d*p)),E=Ye(g*y),T=Ye(S*b),w=Ye(g*b),I=Ye(y*S);return new a6(E,T,I,w)}subtract(t){return this.add(U1e(t).negate())}multiply(t,r=!0){if(!r&&t===0n||(s6(t,1n,$K),!r&&this.is0()))return c6;if(t===1n)return this;if(this.equals(CS))return XTr(t).p;let n=c6,i=CS,o=this;for(let s=0;r?s<256:t>0n;s++)t&1n?n=n.add(o):r&&(i=i.add(o)),o=o.double(),t>>=1n;return n}multiplyUnsafe(t){return this.multiply(t,!1)}toAffine(){let{X:t,Y:r,Z:n}=this;if(this.equals(c6))return{x:0n,y:1n};let i=ZZe(n,uO);if(Ye(n*i)!==1n)throw new Error("invalid inverse");return{x:Ye(t*i),y:Ye(r*i)}}toBytes(){let{x:t,y:r}=this.toAffine(),n=tQe(r);return n[31]|=t&1n?128:0,n}toHex(){return F1e(this.toBytes())}clearCofactor(){return this.multiply(8n,!1)}isSmallOrder(){return this.clearCofactor().is0()}isTorsionFree(){return this.multiply($K/2n,!1).double().add(this).is0()}},CS=new d6(j1e,q1e,1n,fi(j1e*q1e)),c6=new d6(0n,1n,1n,0n);d6.BASE=CS;d6.ZERO=c6;var tQe=e=>$1e(YZe(s6(e,0n,eQe),64)).reverse(),K1e=e=>BigInt("0x"+F1e(Uint8Array.from(np(e)).reverse())),X0=(e,t)=>{let r=e;for(;t-- >0;)r=Ye(r*r);return r},qTr=e=>{let t=Ye(e*e),r=Ye(t*e),n=Ye(X0(r,2)*r),i=Ye(X0(n,1)*e),o=Ye(X0(i,5)*i),s=Ye(X0(o,10)*o),a=Ye(X0(s,20)*s),c=Ye(X0(a,40)*a),u=Ye(X0(c,80)*c),d=Ye(X0(u,80)*c),l=Ye(X0(d,10)*o);return Ye(X0(l,2)*e)},OZe=0x2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0n,HTr=(e,t)=>{let r=Ye(t*Ye(t*t)),n=Ye(Ye(r*r)*t),i=qTr(Ye(e*n)),o=Ye(e*Ye(r*i)),s=Ye(t*Ye(o*o)),a=o,c=Ye(o*OZe),u=s===e,d=s===fi(-e),l=s===fi(-e*OZe);return u&&(o=a),(d||l)&&(o=c),(fi(o)&1n)===1n&&(o=fi(-o)),{isValid:u||d,value:o}},zK=e=>XZe(K1e(e)),rQe=e=>{let t=eW(e),r=t.slice(0,32);r[0]&=248,r[31]&=127,r[31]|=64;let n=t.slice(32),i=zK(r),o=CS.multiply(i),s=o.toBytes();return{head:r,prefix:n,scalar:i,point:o,pointBytes:s}},nQe=e=>G1e("sha512Async",np(e,xS,"secretKey")).then(rQe),W1e=e=>rQe(z1e("sha512",np(e,xS,"secretKey"))),VTr=e=>W1e(e).pointBytes,iQe=async e=>e[1](await G1e("sha512Async",e[0])),oQe=e=>e[1](z1e("sha512",e[0])),sQe=(e,t,r)=>{let{pointBytes:n,scalar:i}=e,o=zK(t),s=CS.multiply(o).toBytes();return[u6(s,n,r),u=>{let d=XZe(o+zK(u)*i);return np(u6(s,tQe(d)),64)}]},FTr=async(e,t)=>{let r=eW(e,"message"),n=await nQe(t);return iQe(sQe(n,await G1e("sha512Async",n.prefix,r),r))},$Tr=(e,t)=>{let r=eW(e,"message"),n=W1e(t);return oQe(sQe(n,z1e("sha512",n.prefix,r),r))},zTr=e=>{if(e===null||typeof e!="object")throw new TypeError("expected valid options object");return e.zip215??!0},aQe=(e,t,r,n)=>{e=np(e,64,"signature"),t=np(t,void 0,"message"),r=np(r,xS,"publicKey");let i=zTr(n),o=e.subarray(0,xS),s=K1e(e.subarray(xS,64)),a,c,u,d=Uint8Array.of(),l=!1;try{a=d6.fromBytes(r,i),c=d6.fromBytes(o,i),u=CS.multiply(s,!1),d=u6(o,r,t),l=!0}catch{}return[d,f=>{if(!l||!i&&a.isSmallOrder())return!1;let m=zK(f);return c.add(a.multiply(m,!1)).subtract(u).clearCofactor().is0()}]},GTr=async(e,t,r,n={})=>iQe(aQe(e,t,r,n)),KTr=(e,t,r,n={})=>oQe(aQe(e,t,r,n)),Y1e=QK({bytesToHex:F1e,hexToBytes:$1e,concatBytes:u6,mod:fi,invert:ZZe,randomBytes:JZe}),cQe={sha512Async:async e=>{let t=globalThis?.crypto?.subtle;if(!t)throw new Error("crypto.subtle must be defined, consider polyfill");return new Uint8Array(await t.digest("SHA-512",u6(e)))},sha512:void 0},WTr=e=>np(e===void 0?JZe():e,xS,"seed"),YTr=QK({getExtendedPublicKeyAsync:nQe,getExtendedPublicKey:W1e,randomSecretKey:WTr}),JTr=()=>{let e=[],t=CS,r;for(let n=0;n<33;n++){r=t,e.push(r);for(let i=1;i<128;i++)r=r.add(t),e.push(r);t=r.double()}return e},RZe=void 0,NZe=(e,t)=>{let r=t.negate();return e?r:t},XTr=e=>{let t=RZe||(RZe=JTr()),r=c6,n=CS;for(let i=0;i<33;i++){let o=Number(e&255n);e>>=8n,o>128&&(o-=256,e+=1n);let s=i*128,a=s+Math.abs(o)-1,c=i%2!==0,u=o<0;o===0?n=n.add(NZe(c,t[s])):r=r.add(NZe(u,t[a]))}if(e!==0n)throw new Error("invalid wnaf");return{p:r,f:n}},LK=BigInt(2**32-1),CZe=BigInt(32);function ZTr(e,t=!1){return t?{h:Number(e&LK),l:Number(e>>CZe&LK)}:{h:Number(e>>CZe&LK)|0,l:Number(e&LK)|0}}function QTr(e,t=!1){let r=e.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let o=0;o<r;o++){let{h:s,l:a}=ZTr(e[o],t);[n[o],i[o]]=[s,a]}return[n,i]}var eAr=e=>e/2**32|0,tAr=e=>e>>>0;function rAr(e,t,r,n){let i=eAr(r),o=tAr(r);e.setUint32(t,n?o:i,n),e.setUint32(t+4,n?i:o,n)}var MZe=(e,t,r)=>e>>>r,kZe=(e,t,r)=>e<<32-r|t>>>r,aO=(e,t,r)=>e>>>r|t<<32-r,cO=(e,t,r)=>e<<32-r|t>>>r,UK=(e,t,r)=>e<<64-r|t>>>r-32,BK=(e,t,r)=>e>>>r-32|t<<64-r;function Z_(e,t,r,n){let i=(t>>>0)+(n>>>0);return{h:e+r+(i/2**32|0)|0,l:i|0}}var nAr=(e,t,r)=>(e>>>0)+(t>>>0)+(r>>>0),iAr=(e,t,r,n)=>t+r+n+(e/2**32|0)|0,oAr=(e,t,r,n)=>(e>>>0)+(t>>>0)+(r>>>0)+(n>>>0),sAr=(e,t,r,n,i)=>t+r+n+i+(e/2**32|0)|0,aAr=(e,t,r,n,i)=>(e>>>0)+(t>>>0)+(r>>>0)+(n>>>0)+(i>>>0),cAr=(e,t,r,n,i,o)=>t+r+n+i+o+(e/2**32|0)|0;function DZe(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in e&&e.BYTES_PER_ELEMENT===1}var H1e=e=>e?`"${e}" `:"";function uAr(e,t=""){if(typeof e!="number")throw new TypeError(H1e(t)+"expected number, got "+typeof e);if(!Number.isSafeInteger(e)||e<0)throw new RangeError(H1e(t)+"expected integer >= 0, got "+e);return e}function uQe(e,t,r=""){if(DZe(e)&&(t===void 0||e.length===t))return e;t!==void 0&&uAr(t,"length");let n=DZe(e),i=t!==void 0?` of length ${t}`:"",o=n?`length=${e.length}`:`type=${typeof e}`,s=H1e(r)+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)}var dAr=(e,t)=>{if(e===null||typeof e!="object"||Array.isArray(e))throw new TypeError((t==="object"?"":`"${t}" `)+"expected object, got type="+typeof e)},LZe=(e,t)=>{dAr(e,t);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${t}" expected plain object`);if(Object.hasOwn(e,"__proto__"))throw new TypeError(`"${t}.__proto__" is not allowed`)};function UZe(e,t=!0){if(e.destroyed)throw new Error("hash was destroyed");if(t&&e.finished)throw new Error("digest() was already called")}function lAr(e,t){uQe(e,void 0,"output");let r=t.outputLen;if(!(e.length>=r))throw new RangeError('"output" expected length >= '+r)}function GK(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function B1e(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function Z0(e,t){return e<<32-t|e>>>t}function pAr(e,t,r="opts"){return LZe(e,"defaults"),t!==void 0&&LZe(t,r),Object.assign(Object.create(null),e,t)}function dQe(e,t={}){if(typeof e!="function")throw new TypeError('"hashCons" expected function, got type='+typeof e);t=pAr({},t,"info");let r=(i,o)=>e(o).update(i).digest(),n=e(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>e(i),Object.assign(r,t),Object.freeze(r)}var lQe=e=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,e])});function fAr(e,t,r){return e&t^~e&r}function mAr(e,t,r){return e&t^e&r^t&r}var pQe=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,t,r,n){this.blockLen=e,this.outputLen=t,this.padOffset=r,this.isLE=n,this.buffer=new Uint8Array(e),this.view=B1e(this.buffer)}update(e){UZe(this),uQe(e);let{view:t,buffer:r,blockLen:n}=this,i=e.length,o=!1;for(let s=0;s<i;){let a=Math.min(n-this.pos,i-s);if(a===n){let c=B1e(e);for(;n<=i-s;s+=n)this.process(c,s);o=!0;continue}r.set(s===0&&a===i?e:e.subarray(s,s+a),this.pos),this.pos+=a,s+=a,this.pos===n&&(this.process(t,0),this.pos=0,o=!0)}return this.length+=e.length,o&&this.roundClean(),this}digestInto(e){UZe(this),lAr(e,this),this.finished=!0;let{buffer:t,view:r,blockLen:n,isLE:i}=this,{pos:o}=this;t[o++]=128,t.fill(0,o),this.padOffset>n-o&&(this.process(r,0),t.fill(0)),rAr(r,n-8,this.length*8,i),this.process(r,0),this.roundClean();let s=e===t?r:B1e(e),a=this.outputLen,c=a/4,u=this.get();if(a%4||c>u.length)throw new Error("invalid outputLen");for(let d=0;d<c;d++)s.setUint32(4*d,u[d],i)}digest(){let{buffer:e,outputLen:t}=this;this.digestInto(e);let r=e.slice(0,t);return this.destroy(),r}_cloneIntoMeta(e){let{buffer:t,length:r,finished:n,destroyed:i,pos:o}=this;return e.destroyed=i,e.finished=n,e.length=r,e.pos=o,o&&e.buffer.set(t),e}clone(){return this._cloneInto()}},hAr=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),gAr=Uint32Array.from([1779033703,4089235720,3144134277,2227873595,1013904242,4271175723,2773480762,1595750129,1359893119,2917565137,2600822924,725511199,528734635,4215389547,1541459225,327033209]),_Ar=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),AS=new Uint32Array(64),yAr=class extends pQe{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,t){super(64,e,8,!1),this.A=t[0]|0,this.B=t[1]|0,this.C=t[2]|0,this.D=t[3]|0,this.E=t[4]|0,this.F=t[5]|0,this.G=t[6]|0,this.H=t[7]|0}get(){let{A:e,B:t,C:r,D:n,E:i,F:o,G:s,H:a}=this;return[e,t,r,n,i,o,s,a]}set(e,t,r,n,i,o,s,a){this.A=e|0,this.B=t|0,this.C=r|0,this.D=n|0,this.E=i|0,this.F=o|0,this.G=s|0,this.H=a|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,t){for(let d=0;d<16;d++,t+=4)AS[d]=e.getUint32(t,!1);for(let d=16;d<64;d++){let l=AS[d-15],p=AS[d-2],f=Z0(l,7)^Z0(l,18)^l>>>3,m=Z0(p,17)^Z0(p,19)^p>>>10;AS[d]=m+AS[d-7]+f+AS[d-16]|0}let{A:r,B:n,C:i,D:o,E:s,F:a,G:c,H:u}=this;for(let d=0;d<64;d++){let l=Z0(s,6)^Z0(s,11)^Z0(s,25),p=u+l+fAr(s,a,c)+_Ar[d]+AS[d]|0,m=(Z0(r,2)^Z0(r,13)^Z0(r,22))+mAr(r,n,i)|0;u=c,c=a,a=s,s=o+p|0,o=i,i=n,n=r,r=p+m|0}r=r+this.A|0,n=n+this.B|0,i=i+this.C|0,o=o+this.D|0,s=s+this.E|0,a=a+this.F|0,c=c+this.G|0,u=u+this.H|0,this.set(r,n,i,o,s,a,c,u)}roundClean(){GK(AS)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),GK(this.buffer)}},bAr=class extends yAr{constructor(){super(32,hAr)}},fQe=QTr(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(e=>BigInt(e))),EAr=fQe[0],SAr=fQe[1],wS=new Uint32Array(80),IS=new Uint32Array(80),vAr=class extends pQe{Ah=0;Al=0;Bh=0;Bl=0;Ch=0;Cl=0;Dh=0;Dl=0;Eh=0;El=0;Fh=0;Fl=0;Gh=0;Gl=0;Hh=0;Hl=0;constructor(e,t){super(128,e,16,!1),this.Ah=t[0]|0,this.Al=t[1]|0,this.Bh=t[2]|0,this.Bl=t[3]|0,this.Ch=t[4]|0,this.Cl=t[5]|0,this.Dh=t[6]|0,this.Dl=t[7]|0,this.Eh=t[8]|0,this.El=t[9]|0,this.Fh=t[10]|0,this.Fl=t[11]|0,this.Gh=t[12]|0,this.Gl=t[13]|0,this.Hh=t[14]|0,this.Hl=t[15]|0}get(){let{Ah:e,Al:t,Bh:r,Bl:n,Ch:i,Cl:o,Dh:s,Dl:a,Eh:c,El:u,Fh:d,Fl:l,Gh:p,Gl:f,Hh:m,Hl:h}=this;return[e,t,r,n,i,o,s,a,c,u,d,l,p,f,m,h]}set(e,t,r,n,i,o,s,a,c,u,d,l,p,f,m,h){this.Ah=e|0,this.Al=t|0,this.Bh=r|0,this.Bl=n|0,this.Ch=i|0,this.Cl=o|0,this.Dh=s|0,this.Dl=a|0,this.Eh=c|0,this.El=u|0,this.Fh=d|0,this.Fl=l|0,this.Gh=p|0,this.Gl=f|0,this.Hh=m|0,this.Hl=h|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,t){for(let S=0;S<16;S++,t+=4)wS[S]=e.getUint32(t),IS[S]=e.getUint32(t+=4);for(let S=16;S<80;S++){let b=wS[S-15]|0,E=IS[S-15]|0,T=aO(b,E,1)^aO(b,E,8)^MZe(b,E,7),w=cO(b,E,1)^cO(b,E,8)^kZe(b,E,7),I=wS[S-2]|0,N=IS[S-2]|0,O=aO(I,N,19)^UK(I,N,61)^MZe(I,N,6),P=cO(I,N,19)^BK(I,N,61)^kZe(I,N,6),x=oAr(w,P,IS[S-7],IS[S-16]),D=sAr(x,T,O,wS[S-7],wS[S-16]);wS[S]=D|0,IS[S]=x|0}let{Ah:r,Al:n,Bh:i,Bl:o,Ch:s,Cl:a,Dh:c,Dl:u,Eh:d,El:l,Fh:p,Fl:f,Gh:m,Gl:h,Hh:g,Hl:y}=this;for(let S=0;S<80;S++){let b=aO(d,l,14)^aO(d,l,18)^UK(d,l,41),E=cO(d,l,14)^cO(d,l,18)^BK(d,l,41),T=d&p^~d&m,w=l&f^~l&h,I=aAr(y,E,w,SAr[S],IS[S]),N=cAr(I,g,b,T,EAr[S],wS[S]),O=I|0,P=aO(r,n,28)^UK(r,n,34)^UK(r,n,39),x=cO(r,n,28)^BK(r,n,34)^BK(r,n,39),D=r&i^r&s^i&s,B=n&o^n&a^o&a;g=m|0,y=h|0,m=p|0,h=f|0,p=d|0,f=l|0,{h:d,l}=Z_(c|0,u|0,N|0,O|0),c=s|0,u=a|0,s=i|0,a=o|0,i=r|0,o=n|0;let M=nAr(O,x,B);r=iAr(M,N,P,D),n=M|0}({h:r,l:n}=Z_(this.Ah|0,this.Al|0,r|0,n|0)),{h:i,l:o}=Z_(this.Bh|0,this.Bl|0,i|0,o|0),{h:s,l:a}=Z_(this.Ch|0,this.Cl|0,s|0,a|0),{h:c,l:u}=Z_(this.Dh|0,this.Dl|0,c|0,u|0),{h:d,l}=Z_(this.Eh|0,this.El|0,d|0,l|0),{h:p,l:f}=Z_(this.Fh|0,this.Fl|0,p|0,f|0),{h:m,l:h}=Z_(this.Gh|0,this.Gl|0,m|0,h|0),{h:g,l:y}=Z_(this.Hh|0,this.Hl|0,g|0,y|0),this.set(r,n,i,o,s,a,c,u,d,l,p,f,m,h,g,y)}roundClean(){GK(wS,IS)}destroy(){this.destroyed=!0,GK(this.buffer),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}},TAr=class extends vAr{constructor(){super(64,gAr)}},aD=dQe(()=>new bAr,lQe(1)),AAr=dQe(()=>new TAr,lQe(3)),BZe=cQe;BZe.sha512||(BZe.sha512=e=>AAr(e));var jZe=32;function mQe(){return YTr.randomSecretKey()}function tW(e){return VTr(e)}function wAr(){let e=mQe();return{secretKey:e,publicKey:tW(e)}}function hQe(e){if(e.length!==jZe)throw new Error(`Ed25519 seed must be ${jZe} bytes, got ${e.length}`);return{secretKey:e,publicKey:tW(e)}}function IAr(e,t){return $Tr(t,e)}function PAr(e,t,r){return KTr(t,r,e)}function xAr(e,t){return FTr(t,e)}function OAr(e,t,r){return GTr(t,r,e)}var gQe=Y1e.bytesToHex,J1e=Y1e.hexToBytes,X1e=Y1e.concatBytes;function _Qe(e){let t="";for(let r=0;r<e.length;r++)t+=String.fromCharCode(e[r]);return btoa(t)}function yQe(e){let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function ry(e){return _Qe(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function rW(e){let t=e.length%4===0?0:4-e.length%4,r=e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat(t);return yQe(r)}var RAr=new TextEncoder,NAr={subwayAgentMsgV1:"message_id;sender_peer_id;sender_name;timestamp_ms;message_type;payload_hash;nonce"};function bQe(e){let t=gQe(aD(e.payload)),r=`${e.messageId}
+`),i=[],o=null,s=null;for(let a of n){a.includes("keychain:")&&(o===t&&s&&!i.includes(s)&&i.push(s),o=null,s=null);let c=a.match(/"svce"<blob>="([^"]+)"/);c&&(o=c[1]);let u=a.match(/"acct"<blob>="([^"]+)"/);u&&(s=u[1])}return o===t&&s&&!i.includes(s)&&i.push(s),i}catch{return[]}}static async listStoredCredentials(t={}){let r=t.env??process.env,n=[];if(process.platform==="darwin"&&await th())for(let s of["visa-cli","visa-mcp"]){let a=await this.listKeychainItems(s);for(let c of a)n.push({service:s,account:c,backend:"keychain"})}let i=z0(r);_a.existsSync(i)&&n.push({service:"visa-cli",account:F_,backend:"file",path:i});for(let s of H_(r)){let a=fS(s,r);_a.existsSync(a)&&n.push({service:"visa-cli",account:HG(s),backend:"file",path:a})}let o=G4(r);return _a.existsSync(o)&&n.push({service:"visa-cli",account:V_,backend:"file",path:o}),n}static async purgeAll(t={}){let r=t.env??process.env,n=[];if(process.platform==="darwin"&&await th())for(let s of["visa-cli","visa-mcp"]){let a=await this.listKeychainItems(s);for(let c of a)try{await ep("security",["delete-generic-password","-s",s,"-a",c],{timeout:5e3}),n.push({service:s,account:c,backend:"keychain"})}catch{}}let i=z0(r);if(_a.existsSync(i))try{_a.unlinkSync(i),n.push({service:"visa-cli",account:F_,backend:"file",path:i})}catch{}let o=G4(r);if(_a.existsSync(o))try{_a.unlinkSync(o),n.push({service:"visa-cli",account:V_,backend:"file",path:o})}catch{}for(let s of H_(r)){let a=fS(s,r);if(_a.existsSync(a))try{_a.unlinkSync(a),n.push({service:"visa-cli",account:HG(s),backend:"file",path:a})}catch{}}try{kYe(r)}catch{}return await zYe(),n}static async clearAll(t=process.env){for(let r of H_(t))await this.deleteProfileSessionToken(r,t);await this.deleteLegacySessionToken(t),await this.deleteRcAccessToken(t)}}});function JG(e){return typeof e=="string"&&Object.prototype.hasOwnProperty.call(jge,e)}function G0(e,t={}){let r=jge[e],n=t.fix!==void 0?t.fix:r.fix;if(r.kind==="platform"&&r.escalation!=="awaiting_human"&&n!==null)throw new Error(`agent-contract: ${r.escalation} code "${e}" cannot carry a fix \u2014 no command resolves it`);return{code:e,kind:r.kind,fix:n,nextAction:t.nextAction??r.nextAction}}function JYe(e){if(e instanceof $c)return e.diagnostic;if(e&&typeof e=="object"){let t=e.code??e.errorCode;if(JG(t))return G0(t);if(typeof t=="string"){let n=t.toLowerCase();if(JG(n))return G0(n)}let r=e.message;if(JG(r))return G0(r)}return G0("unspecified_error")}function XYe(e){if(!(e instanceof $c)||!e.details)return;let t=e.details,r={};return Number.isInteger(t.upstreamStatus)&&Number(t.upstreamStatus)>=100&&Number(t.upstreamStatus)<=599&&(r.upstreamStatus=t.upstreamStatus),JG(t.reason)&&t.reason===e.code&&(r.reason=t.reason),e.code==="terms_conflict"&&typeof t.purchaseId=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(t.purchaseId)&&(r.purchaseId=t.purchaseId),e.code==="purchase_transport_uncertain"&&(t.transportReason==="timeout"||t.transportReason==="network"||t.transportReason==="response")&&(r.transportReason=t.transportReason),Object.keys(r).length?r:void 0}var jge,xAi,$c,$_=A(()=>{"use strict";jge={update_required:{kind:"caller",fix:"npm install -g @visa/cli@rc",nextAction:"Upgrade Visa CLI to the minimum compatible version or newer, then retry the command."},session_required:{kind:"caller",fix:"agent_enroll",nextAction:"Run visa connect (shell) or call agent_enroll (MCP) and complete the browser sign-in. Both resume where they left off. Retry the original command after that."},identity_required:{kind:"caller",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"Call agent_enroll or run visa connect, open the printed URL, enter the code at /agent/enroll/protected-agent, and have the owner approve the device and its limits. Both entrances use the same protected enrollment implementation."},legacy_door_removed:{kind:"caller",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"Call agent_enroll or run visa connect, open the printed URL, enter the code at /agent/enroll/protected-agent, approve the device and its limits, then pay with the pay tool. Do not retry the retired command; nothing was signed, paired, or paid."},agent_selection_required:{kind:"caller",fix:null,nextAction:"Retry the command with one exact agent id from the executable choices in the error."},invalid_argument:{kind:"caller",fix:null,nextAction:"Correct the invalid argument named in the error, then retry the command once. Do not escalate this as a platform incident."},rate_limited:{kind:"caller",fix:"sleep <retry-after-seconds>",nextAction:"Wait the exact Retry-After duration named in the error, then retry the same request once. Do not retry sooner or switch agents to bypass the limit."},activity_entry_not_found:{kind:"caller",fix:"history",nextAction:'Call history for the same agent, select an exact activity id from that result, then read it with history { "id": "<activity-id>" }.'},x402_policy_refused:{kind:"caller",fix:null,nextAction:"Nothing was signed or paid. Do not retry unchanged; ask the owner to approve a higher ceiling or choose a payment that fits the existing policy."},managed_wallet_scheme_unsupported:{kind:"caller",fix:"discover",nextAction:"Nothing was reserved, signed, or paid. Choose an x402 endpoint advertising scheme exact with EIP-3009; managed upto/Permit2 support is intentionally deferred until the final measured TVC protocol."},wallet_network_mismatch:{kind:"caller",fix:"discover",nextAction:"The unpaid challenge offered no usable USDC payment on this wallet's configured network. Nothing was reserved, signed, or paid. Choose a discovered endpoint on the configured network; do not retry the same challenge unchanged."},agent_operations_cli_upgrade_required:{kind:"caller",fix:null,nextAction:"Use a reviewed CLI build at or above the minimum version named by the server, restart the agent session, and retry once. The payment was not sent."},agent_operation_forbidden:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This owner, agent, runtime, rail, or rollout state is not admitted to the universal payment route. Ask the owner to inspect the selected agent; do not retry through a legacy path."},runtime_context_not_found:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The server cannot find a current managed runtime contract for this exact agent and device. Ask the owner to inspect or renew that runtime before retrying."},product_policy_not_active:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The wallet setup did not install its server-owned spend policy. Resume the owner-approved wallet setup for this agent; do not retry the payment unchanged."},runtime_spend_session_not_active:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The wallet setup has no active runtime spend session. Resume the owner-approved wallet setup for this agent; do not retry the payment unchanged."},runtime_spend_attenuation_not_active:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The wallet runtime spend limits are not bound to the active owner policy. Resume the owner-approved wallet setup for this agent; do not retry the payment unchanged."},runtime_revoked:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This exact runtime has been revoked. Do not reuse it; ask the owner to certify a new runtime for the same agent if access should continue."},certified_runtime_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This payment requires an owner-certified runtime. Ask the owner to approve the wallet runtime certificate, then retry once."},runtime_certificate_invalid:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The wallet runtime certificate is invalid, expired, or no longer current. Ask the owner to renew it; do not retry unchanged."},runtime_delegation_missing:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This runtime has no active owner delegation for short signing leases. Ask the owner to finish secure wallet setup before retrying."},runtime_delegation_expired:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This runtime owner delegation has expired. Ask the owner to renew secure wallet authority before retrying."},runtime_authority_unavailable:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"The server could not verify runtime authority. Surface the outage to an operator and do not retry or fall back until authority health is restored."},universal_required_managed_only:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The universal route requires a fully managed TVC wallet for this agent. Ask the owner to finish managed wallet setup before retrying."},wallet_authority_cli_upgrade_required:{kind:"caller",fix:null,nextAction:"Upgrade the CLI to the minimum version named by the server, restart this agent session, and retry once. Nothing was signed or paid."},tap_signature_required:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"Escalate to a human. A TAP identity signer is available on this runtime, so an unsigned paid x402 request is a platform defect. Do not retry the payment unsigned. Probe remains unsigned."},wallet_payment_reconciling:{kind:"caller",fix:null,nextAction:"Do not submit this purchase again. Call history for the same agent and economic intent; only begin a fresh payment after the existing authorization is terminal."},attestation_key_drift:{kind:"caller",fix:"visa connect",nextAction:"This device holds a credential the server does not recognize (machine swap, keychain wipe, restored backup). Clear the stale local credential, enroll a fresh protected agent with visa connect, then retry."},rc_access_required:{kind:"platform",escalation:"awaiting_human",fix:"export VISA_RC_CODE=<access code>",nextAction:"This is a release-candidate build restricted to Visa employees. Set VISA_RC_CODE in this process, then retry. Ask your team lead or Visa Crypto Labs for the code \u2014 do not guess it."},early_access_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Escalate to a human: an admin must enable this tool for the account. Do not retry until they confirm."},capability_attach_pending_approval:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Ask the owner to finish the approval already open in their browser at /agent/enroll/protected-agent \u2014 the device and its limits are approved there. Do not start a second ceremony; wait for the owner, then retry the original command."},card_checkout_not_on_pay:{kind:"caller",fix:"purchase_create",nextAction:"Nothing was probed further, created or charged. This URL answered no x402 challenge, so it is an ordinary merchant checkout and `pay` cannot do it: `pay` spends from the agent wallet only. Card checkouts are the `purchase` resource (`purchase_create`, then `purchase_retrieve`), where Visa issues the credential and YOUR runtime drives the browser. Do not retry this target on `pay`."},card_draw_not_live:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Escalate to a human now. The card-draw surface is not live on this build (it is opt-in server-side), so no local configuration change makes this command work. Do not retry."},checkout_review_refused:{kind:"caller",fix:null,nextAction:"Nothing was charged. This checkout needs a supported card-field adapter. Choose another supported checkout, or give the merchant and adapter details to the product team; do not retry unchanged."},checkout_action_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Nothing was charged and no payment credential was requested. Ask the human to complete the named verification step, then retry the review once."},checkout_mandate_blocked:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Nothing was charged. Ask the owner to approve a mandate that covers the exact merchant, amount, and currency, then start a new review. Do not widen authority yourself."},card_mandate_activation_uncertain:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The owner approved the budget but the card network did not confirm its activation. No budget is usable and nothing was charged. Do not start another approval while this one is valid: ask the owner to review the budget in the Visa Console and, once the approval has expired or been revoked there, approve a fresh budget. Quote the request id when reporting it."},ucp_platform_profile_unavailable:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Do not retry this checkout. Escalate to the Visa deployment owner: the exact UCP platform profile advertised to merchants must serve a valid HTTPS JSON profile without redirects before checkout handoff can work."},wallet_capability_unavailable:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Escalate to a human now. The wallet (x402) capability is not served by this build. Do not retry."},surface_disabled:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Escalate to a human now. The server reports this surface disabled or not configured (kill switch or missing server config \u2014 see the flag and correlation_id in the error). No retry or local change resolves it."},wallet_grant_required:{kind:"platform",escalation:"awaiting_human",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"The Turnkey wallet is delegated by the human owner, not self-minted here. Call agent_enroll or ask the owner to run visa connect and approve the device and its limits at /agent/enroll/protected-agent, then retry."},wallet_credential_required:{kind:"platform",escalation:"awaiting_human",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"Call agent_enroll or ask the owner to run visa connect for the intended agent and approve the device and its limits at /agent/enroll/protected-agent, then retry. Identity alone does not grant spend authority."},managed_limits_owner_controlled:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Nothing was signed or paid. Managed wallet limits are owner-set on the server. Read them with get_status, then ask the owner to change them in the Visa Console at /agent/enroll/limits?agent=<agent-id>."},agent_paused:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Ask the owner to resume this exact agent in the Visa Console (Agents). Retry only after get_status reports it ready; do not create a replacement credential while the agent is paused."},agent_revoked:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This agent is permanently revoked. Do not retry or reuse its credentials; ask the owner whether to pair a new agent identity."},agent_stale:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The server cannot prove this agent is currently usable. Ask the owner to inspect its lifecycle and reauthorize it before retrying."},agent_lifecycle_unknown:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"The lifecycle state is unknown. Surface the full preflight result to a human and do not retry a money operation until the server reports active."},wallet_delivery_required:{kind:"platform",escalation:"awaiting_human",fix:"visa connect",nextAction:"The approved wallet runtime was not delivered completely. Ask the owner to re-run visa connect and re-approve the device and its limits before paying; do not self-mint a mainnet wallet."},wallet_authority_revoked:{kind:"caller",fix:"get_status",nextAction:"This wallet is preserved for recovery only. Inspect its balance and receipts with get_status or history; do not retry a payment or policy change until the owner approves a new wallet grant."},wallet_authority_replacement_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This compatibility error came from an older single-wallet runtime. Upgrade the CLI and re-run the wallet grant; current builds isolate wallet authority per agent."},wallet_policy_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Nothing was signed. Ask the owner to set per-purchase and daily spend caps in the Visa Console at /agent/enroll/limits?agent=<agent-id>, then retry once. Caps are enforced before anything is signed."},wallet_funding_required:{kind:"caller",fix:"get_status",nextAction:"Deposit USDC into this agent wallet address before paying. get_status carries the deposit address and the live on-chain balance; the owner can also read the address on their account page in the Visa Console."},wallet_unavailable:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Ask the owner to finish wallet setup in the Visa console (their account has no usable wallet yet), then re-run the grant. Do not keep polling: the ceremony cannot complete until the wallet exists."},checkout_agent_access_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Escalate to a human: this account is not enabled for agent checkout, so grant ceremonies are refused server-side. Do not retry until an admin confirms the account has access."},unknown_tool:{kind:"caller",fix:null,nextAction:"Call tools/list and dispatch one of the served names. The tool you asked for is not registered on this runtime."},handoff_not_found:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The Console claim code was not found or was mistyped. Ask the human for a fresh claim code from the Visa Console; do not retry this code."},handoff_expired:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This Console claim code has expired. Ask the human to create a new setup code in the Visa Console."},handoff_already_redeemed:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This Console claim code has already been redeemed. Ask the human to create a new setup code in the Visa Console."},no_paired_agent:{kind:"caller",fix:"agent_enroll (MCP) or visa connect (shell)",nextAction:"No protected agent on this device. Call agent_enroll or run visa connect and complete the owner ceremony at /agent/enroll/protected-agent first."},feedback_unconfirmed:{kind:"caller",fix:null,nextAction:"Show the user the exact feedback text and obtain explicit confirmation before calling feedback with confirmed: true."},agent_id_required:{kind:"caller",fix:null,nextAction:"Pass the agentId to identify which agent ceremony to operate on."},already_terminal:{kind:"caller",fix:null,nextAction:"This ceremony is already terminal or cancelled. No further action needed."},purchase_transport_uncertain:{kind:"caller",fix:null,nextAction:"Wait briefly, then repeat the identical Visa purchase call with the same arguments, request key and purchase ID. The original request may have succeeded; its journal recovers the same attempt. Do not cancel, create a replacement or submit Pay at the merchant again. Escalate repeated transport failures."},purchase_refused:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The authority refused this purchase request. Use the recorded upstream status and error to resolve the refusal before trying again. Preserve the original purchase and request key; a refusal is not permission to mint a replacement or repeat merchant payment."},recovery_required:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Inspect the original purchase and checkout with the owner or support. Preserve the purchase ID and request key. Do not create a replacement, release uncertain liability or submit Pay again."},card_recovery_unconfigured:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Card recovery is not configured. Ask support to restore the protected recovery worker before retrying the same Visa request. Preserve the purchase ID; do not create another purchase or click merchant Pay again."},card_recovery_original_not_expired:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The original credential attempt is still live. Retrieve the same purchase without include:card and follow its continuation; do not force recovery, create another purchase or click merchant Pay again."},card_recovery_liability_present:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The original attempt still has liability. Ask support to reconcile that attempt and inspect the existing checkout. Do not release funds, issue replacement credentials or click merchant Pay again."},card_recovery_issuance_conflict:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Recovery found conflicting issuance evidence. Stop and ask support to reconcile the original purchase and attempt. Do not create another purchase or click merchant Pay again."},card_recovery_proof_invalid:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The recovery proof could not be verified. Ask support to repair recovery for the existing device and purchase; do not replay the invalid proof, replace the identity or click merchant Pay again."},card_purchase_quarantined:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"This purchase is quarantined for reconciliation. Ask support to inspect its original attempt and the existing checkout. Do not create another purchase, release its liability or click merchant Pay again."},card_credential_not_available:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Credentials are not available for this purchase state. Retrieve the same purchase without include:card and follow its continuation. Do not recreate the purchase or click merchant Pay again."},purchase_submission_observed:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Submission was already reported for this purchase. Inspect the existing merchant checkout and report its current state on the same purchase. Do not request replacement credentials or click merchant Pay again."},protected_card_request_invalid:{kind:"caller",fix:null,nextAction:"The card executor refused the saved delivery request, usually because its admission has expired. Retrieve the same purchase and follow its continuation; if it reads expired, run purchase create again with the same request file. Do not create a replacement purchase by hand."},protected_card_delivery_conflict:{kind:"caller",fix:null,nextAction:"The saved delivery request differs from the one already in progress for this attempt. Retrieve the same purchase and follow its continuation; do not alter or replay edited request bytes."},protected_card_authority_unavailable:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The card authority did not answer the executor. Nothing was issued. Wait a moment and retrieve the same purchase; recovery continues server-side."},purchase_cancelled:{kind:"caller",fix:null,nextAction:"This purchase was cancelled; it accepts no new credential. Create a new purchase for a fresh checkout if the buyer still wants it. Do not click merchant Pay."},card_intent_unobserved:{kind:"caller",fix:null,nextAction:"The owner's card allowance for this agent is not active yet. Follow next.open_url so the owner finishes card setup, then retry the same checkout."},card_intent_mandate_exists:{kind:"caller",fix:null,nextAction:"The owner's current approval already has a card allowance in progress. Wait for it to finish (or ask the owner to check the limits page), then retry the same checkout."},card_intent_conflict:{kind:"caller",fix:null,nextAction:"A different card allowance request already exists under this id. Retrieve current status instead of resending edited request bytes."},card_vic_provider_refused:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The provider refused credential issuance. Ask the owner or support to inspect the original purchase and provider refusal before retrying; an HTTP error does not prove its reservation was released. Do not create a replacement purchase or click merchant Pay again."},terms_conflict:{kind:"caller",fix:null,nextAction:"The request conflicts with the existing checkout commitment or quote bound. Retrieve the original purchase and compare the exact final terms. Do not change the request key or checkout ID to bypass the conflict; resolve it under the checkout replacement rules."},card_checkout_expired:{kind:"caller",fix:null,nextAction:"The exact checkout quote expired. Inspect the original purchase before obtaining a new final quote. Do not reuse stale terms or bypass checkout replacement rules by changing the request key or checkout ID."},card_mandate_expired:{kind:"caller",fix:null,nextAction:"The owner's card allowance for this agent lapsed (the provider limits each one to 7 days) while the approval itself is still valid; Visa is issuing a replacement under that approval. Wait afterMs and run the same purchase create again. Do not involve the owner or create a replacement purchase."},card_allowance_preparing:{kind:"caller",fix:null,nextAction:"Visa is issuing this agent's card allowance under the owner's existing approval. Wait afterMs and run the same purchase create again; the wait loop does this for you. Do not involve the owner or create a replacement purchase."},card_reservation_expired:{kind:"caller",fix:null,nextAction:"Retrieve the same purchase to resolve its expired reservation. Follow its current continuation; do not replay stale admission bytes or create a replacement to hide an unresolved attempt."},card_merchant_country_mismatch:{kind:"caller",fix:null,nextAction:"Use the actual merchant country consistently in the signed checkout terms and settlement envelope. Preserve the existing purchase commitment; do not change keys to bypass a terms conflict."},protected_grant_proof_mismatch:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"Ask the owner or support to verify the current grant and runtime proof for this existing agent. Do not retry an unchanged invalid proof or create replacement authority."},purchase_resume_invalid:{kind:"caller",fix:null,nextAction:"Use the exact saved purchase resume reference by itself; do not combine it with a new request. Preserve the original purchase and merchant checkout."},purchase_draft_invalid:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The saved purchase request is damaged or changed. Stop and ask support to recover the original draft; do not overwrite it, invent new terms or click merchant Pay again."},purchase_draft_not_found:{kind:"caller",fix:null,nextAction:"Use the original device and exact saved resume reference. Locate the existing draft before continuing; do not recreate the request or click merchant Pay again."},purchase_draft_agent_invalid:{kind:"caller",fix:null,nextAction:"Select the existing protected agent by its exact UUID and resume the original draft. Do not create a replacement identity or purchase."},purchase_draft_agent_mismatch:{kind:"caller",fix:null,nextAction:"Resume this draft with the same protected agent it already selected. Do not switch agents, replace the draft or click merchant Pay again."},purchase_draft_owner_mismatch:{kind:"caller",fix:null,nextAction:"Sign in as the owner who started this draft on the original device, then resume that same draft. Do not transfer it to another owner or create a replacement purchase."},purchase_draft_owner_required:{kind:"caller",fix:null,nextAction:"Complete the returned owner sign-in step, then resume the same saved draft. Do not start another identity enrollment or purchase."},purchase_draft_busy:{kind:"caller",fix:null,nextAction:"Wait for the current Visa purchase call to finish, then repeat the same resume reference. Do not run concurrent purchase calls, create a replacement or click merchant Pay again."},purchase_not_found:{kind:"caller",fix:null,nextAction:"Check the original purchase ID and selected agent. Recover the existing purchase record; do not mint a replacement merely because a read could not find it."},invalid_contract:{kind:"caller",fix:null,nextAction:"Correct the request using the declared tool schema, then retry only with valid input. Never fabricate facts or change existing payment identifiers to bypass their commitment."},invalid_amount:{kind:"caller",fix:null,nextAction:"Supply a positive canonical amount in the units required by the selected tool. Follow its total and precision constraints; never change identifiers to bypass an existing payment commitment."},invalid_currency:{kind:"caller",fix:null,nextAction:"Use the currency required by the selected payment profile. Do not infer merchant country from currency."},unsupported_version:{kind:"caller",fix:null,nextAction:"Use a supported protocol version and profile. Check the current tool schema or update Visa CLI, then retry the same logical operation without bypassing its existing commitment."},native_runtime_signer_not_installed:{kind:"platform",escalation:"awaiting_human",fix:"npm i -g @visa/cli@rc",nextAction:"The Visa CLI install on this machine has no native signer for this platform, so no wallet key can be proven. Ask the owner to reinstall Visa CLI; do not retry."},native_runtime_signer_not_executable:{kind:"platform",escalation:"awaiting_human",fix:"npm i -g @visa/cli@rc",nextAction:"The native signer is present but this machine will not run it, and Visa CLI could not repair its file mode. Ask the owner to reinstall Visa CLI, or to run chmod 755 on the path in the error; do not retry."},native_runtime_platform_unsupported:{kind:"platform",escalation:"surface_dark",fix:null,nextAction:"Visa CLI ships no native signer for this operating system and CPU, so wallet keys cannot be held here. Surface this to the owner; do not retry."},native_runtime_unavailable:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The native signer could not be started. The error names why (EACCES is the executable bit; ENOENT is a missing binary). Surface it to the owner; do not retry."},native_runtime_closed:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The native signer exited before answering. The error carries its exit code and its last output. Surface it to the owner; do not retry."},native_runtime_response_invalid:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"The native signer answered with something Visa CLI could not read, which usually means the CLI and its signer are from different builds. Ask the owner to reinstall Visa CLI; do not retry."},keychain_locked_or_unavailable:{kind:"platform",escalation:"awaiting_human",fix:null,nextAction:"The operating-system keychain refused to open for the native signer, so the wallet key could not be read. On macOS this is the login keychain being locked or an Allow prompt being declined. Ask the owner to unlock the keychain and allow visa-runtime-signer; do not retry on your own."},unspecified_error:{kind:"platform",escalation:"unclassified",fix:null,nextAction:"This failure could not be classified, so it is reported as platform to avoid a silent retry loop. Surface the human-readable error to a human rather than retrying."}},xAi=Object.keys(jge);$c=class extends Error{diagnostic;details;constructor(t,r,n={}){super(t),this.name="AgentContractError",this.diagnostic=G0(r,n),this.details=n.details}get code(){return this.diagnostic.code}}});var Y4=_(zc=>{"use strict";Object.defineProperty(zc,"__esModule",{value:!0});zc.CANONICAL_OPAQUE_ID_MAX_BYTES=zc.CANONICAL_OPAQUE_ID_RE=zc.CANONICAL_OPAQUE_ID_PATTERN=void 0;zc.utf8ByteLength=Hge;zc.isCanonicalText=iEr;zc.compareCanonicalKeys=oEr;zc.isCanonicalOpaqueId=ZYe;zc.assertCanonicalOpaqueId=sEr;zc.CANONICAL_OPAQUE_ID_PATTERN="^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$";zc.CANONICAL_OPAQUE_ID_RE=new RegExp(zc.CANONICAL_OPAQUE_ID_PATTERN);zc.CANONICAL_OPAQUE_ID_MAX_BYTES=128;var nEr=/[\u0000-\u001f\u007f\u2028\u2029]/,qge=new TextEncoder;function Hge(e){return qge.encode(e).length}function iEr(e,t){return typeof e=="string"&&e.length>0&&Hge(e)<=t&&e.trim()===e&&e.normalize("NFC")===e&&!nEr.test(e)}function oEr(e,t){let r=qge.encode(e),n=qge.encode(t),i=Math.min(r.length,n.length);for(let o=0;o<i;o+=1)if(r[o]!==n[o])return r[o]-n[o];return r.length-n.length}function ZYe(e){return typeof e=="string"&&Hge(e)<=zc.CANONICAL_OPAQUE_ID_MAX_BYTES&&zc.CANONICAL_OPAQUE_ID_RE.test(e)}function sEr(e,t="value"){if(!ZYe(e))throw new Error(`${t} must be a canonical opaque id (max 128 ASCII bytes)`)}});var G_=_(rh=>{"use strict";Object.defineProperty(rh,"__esModule",{value:!0});rh.AgentOperationContractError=rh.AGENT_OPERATION_CONTRACT_ERROR_CODES=void 0;rh.record=eJe;rh.bounded=tJe;rh.canonicalJsonValue=rJe;rh.canonicalJson=aEr;rh.canonicalEnvelopeJson=cEr;var QYe=Y4();rh.AGENT_OPERATION_CONTRACT_ERROR_CODES=["commitment_mismatch","intent_mismatch","invalid_amount","invalid_contract","invalid_currency","invalid_effect","invalid_evidence","invalid_principal","invalid_window","settlement_amount_invalid","unsupported_version"];var z_=class extends Error{code;constructor(t,r){super(r),this.code=t,this.name="AgentOperationContractError"}};rh.AgentOperationContractError=z_;function eJe(e,t){if(typeof e!="object"||e===null||Array.isArray(e))throw new z_("invalid_contract",`${t} must be an object`);return e}function tJe(e,t,r=4096){if(!(0,QYe.isCanonicalText)(e,r))throw new z_("invalid_contract",`${t} is not bounded canonical text`);return e}function rJe(e,t=0){return XG(e,t,16)}function XG(e,t,r){if(t>r)throw new z_("invalid_contract","payload nesting is too deep");if(e===null||typeof e=="string"||typeof e=="boolean"||typeof e=="number"&&Number.isSafeInteger(e)&&!Object.is(e,-0))return e;if(typeof e=="number")throw new z_("invalid_contract","JSON numbers must be safe canonical integers; use strings for larger or decimal values");if(Array.isArray(e)){if(e.length>1024)throw new z_("invalid_contract","payload array is too large");return e.map(o=>XG(o,t+1,r))}let n=eJe(e,"payload"),i=Object.entries(n);if(i.length>512)throw new z_("invalid_contract","payload object is too large");return Object.fromEntries(i.sort(([o],[s])=>(0,QYe.compareCanonicalKeys)(o,s)).map(([o,s])=>[tJe(o,"payload key",128),XG(s,t+1,r)]))}function aEr(e){return JSON.stringify(rJe(e))}function cEr(e){return JSON.stringify(XG(e,0,64))}});var gS=_(Et=>{"use strict";Object.defineProperty(Et,"__esModule",{value:!0});Et.AGENT_OPERATION_TRANSITION_SQL_PREDICATE=Et.AGENT_OPERATION_TERMINAL_SQL_LIST=Et.AGENT_OPERATION_RESUMABLE_SQL_LIST=Et.AGENT_OPERATION_TERMINAL_STATES=Et.AGENT_OPERATION_EVIDENCE_ELIGIBLE_STATES=Et.AGENT_OPERATION_RESUMABLE_STATES=Et.AGENT_OPERATION_ALLOWED_TRANSITIONS=Et.AGENT_OPERATION_STATES=Et.EXECUTOR_BINDING_VERSION=Et.EXECUTION_EVIDENCE_VERSION=Et.AGENT_OPERATION_RESULT_VERSION=Et.AGENT_OPERATION_VERSION=Et.canonicalJsonValue=Et.canonicalJson=Et.AgentOperationContractError=Et.AGENT_OPERATION_CONTRACT_ERROR_CODES=Et.canonicalEnvelopeJson=void 0;Et.isAgentOperationTransitionAllowed=fEr;Et.agentOperationIntentPreimage=mEr;Et.parseAgentMoneyEconomics=oJe;Et.parseAgentOperationStructure=sJe;Et.parseExecutionEvidence=_Er;Et.parsePreparedAgentOperationStructure=yEr;Et.agentOperationPopSigningInput=bEr;var yt=G_(),Uk=G_();Object.defineProperty(Et,"canonicalEnvelopeJson",{enumerable:!0,get:function(){return Uk.canonicalEnvelopeJson}});Object.defineProperty(Et,"AGENT_OPERATION_CONTRACT_ERROR_CODES",{enumerable:!0,get:function(){return Uk.AGENT_OPERATION_CONTRACT_ERROR_CODES}});Object.defineProperty(Et,"AgentOperationContractError",{enumerable:!0,get:function(){return Uk.AgentOperationContractError}});Object.defineProperty(Et,"canonicalJson",{enumerable:!0,get:function(){return Uk.canonicalJson}});Object.defineProperty(Et,"canonicalJsonValue",{enumerable:!0,get:function(){return Uk.canonicalJsonValue}});Et.AGENT_OPERATION_VERSION=1;Et.AGENT_OPERATION_RESULT_VERSION=1;Et.EXECUTION_EVIDENCE_VERSION=1;Et.EXECUTOR_BINDING_VERSION=1;var uEr=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,dEr=/^[A-Za-z0-9_-]{43}$/,lEr=/^[a-z][a-z0-9]*(?:[._:-][a-z0-9]+)*$/,pEr=/^[A-Z][A-Z0-9]{2,11}$/,iJe=96*1024,Vge=9223372036854775807n;Et.AGENT_OPERATION_STATES=["claimed","reserved","dispatched","authorized","settling","committed","released","indeterminate","denied"];Et.AGENT_OPERATION_ALLOWED_TRANSITIONS={claimed:["reserved","denied"],reserved:["dispatched","released","indeterminate","settling"],dispatched:["authorized","released","indeterminate","settling"],authorized:["settling","indeterminate"],settling:["committed","released","indeterminate"],committed:[],released:[],indeterminate:["settling"],denied:[]};Et.AGENT_OPERATION_RESUMABLE_STATES=["claimed","reserved","dispatched"];Et.AGENT_OPERATION_EVIDENCE_ELIGIBLE_STATES=["reserved","dispatched","authorized","indeterminate"];Et.AGENT_OPERATION_TERMINAL_STATES=["committed","released","denied"];function fEr(e,t){return e===t||Et.AGENT_OPERATION_ALLOWED_TRANSITIONS[e].includes(t)}function Fge(e){return e.map(t=>`'${t}'`).join(", ")}Et.AGENT_OPERATION_RESUMABLE_SQL_LIST=Fge(Et.AGENT_OPERATION_RESUMABLE_STATES);Et.AGENT_OPERATION_TERMINAL_SQL_LIST=Fge(Et.AGENT_OPERATION_TERMINAL_STATES);Et.AGENT_OPERATION_TRANSITION_SQL_PREDICATE=["NEW.state = OLD.state",...Et.AGENT_OPERATION_STATES.filter(e=>Et.AGENT_OPERATION_ALLOWED_TRANSITIONS[e].length>0).map(e=>`(OLD.state = '${e}' AND NEW.state IN (${Fge(Et.AGENT_OPERATION_ALLOWED_TRANSITIONS[e])}))`)].join(`
+    OR `);function pf(e,t,r=[]){let n=new Set([...t,...r]);if(t.some(i=>!(i in e))||Object.keys(e).some(i=>!n.has(i)))throw new yt.AgentOperationContractError("invalid_contract","contract contains missing or unknown fields")}function J4(e,t){let r=(0,yt.bounded)(e,t,36).toLowerCase();if(!uEr.test(r))throw new yt.AgentOperationContractError("invalid_contract",`${t} must be a UUID`);return r}function K0(e,t){let r=(0,yt.bounded)(e,t,43);if(!dEr.test(r)||!/[AEIMQUYcgkosw048]$/.test(r))throw new yt.AgentOperationContractError("invalid_contract",`${t} must be a canonical 32-byte hash`);return r}function ZG(e,t){let r=(0,yt.bounded)(e,t,128);if(!lEr.test(r))throw new yt.AgentOperationContractError("invalid_contract",`${t} must be a stable lowercase token`);return r}function nJe(e,t){let r=(0,yt.bounded)(e,t,32),n=Date.parse(r);if(!Number.isFinite(n)||new Date(n).toISOString()!==r)throw new yt.AgentOperationContractError("invalid_contract",`${t} must be canonical ISO-8601`);return r}function mEr(e){let t={domain:"visa.agent-operation-intent.v1",operationId:e.operationId,idempotencyKey:e.idempotencyKey,agentId:e.agentId,runtimeId:e.runtimeId,rail:e.rail,effect:e.effect,execution:{adapter:e.execution.adapter,commitment:e.execution.commitment,payloadHash:e.execution.payloadHash},createdAt:e.createdAt,expiresAt:e.expiresAt};return(0,yt.canonicalJson)(t)}function hEr(e){let t=(0,yt.record)(e,"principal");if(t.kind==="identity_pop")return pf(t,["kind","popJwt","keyJkt"]),{kind:t.kind,popJwt:(0,yt.bounded)(t.popJwt,"popJwt",16384),keyJkt:K0(t.keyJkt,"keyJkt")};if(t.kind==="certified_runtime_pop")return pf(t,["kind","popJwt","runtimeCertificate","rootJkt","childJkt"]),{kind:t.kind,popJwt:(0,yt.bounded)(t.popJwt,"popJwt",16384),runtimeCertificate:(0,yt.bounded)(t.runtimeCertificate,"runtimeCertificate",32768),rootJkt:K0(t.rootJkt,"rootJkt"),childJkt:K0(t.childJkt,"childJkt")};if(t.kind==="delegated_runtime_lease_pop"){if(pf(t,["kind","v","popJwt","delegation","lease","rootJkt","runtimeJkt"]),t.v!==2)throw new yt.AgentOperationContractError("invalid_principal","delegated runtime lease principal must use version 2");return{kind:t.kind,v:t.v,popJwt:(0,yt.bounded)(t.popJwt,"popJwt",16384),delegation:(0,yt.bounded)(t.delegation,"delegation",32768),lease:(0,yt.bounded)(t.lease,"lease",32768),rootJkt:K0(t.rootJkt,"rootJkt"),runtimeJkt:K0(t.runtimeJkt,"runtimeJkt")}}if(t.kind==="tap_signature")return pf(t,["kind","signature","runtimeCertificate","signedPayload"]),{kind:t.kind,signature:(0,yt.bounded)(t.signature,"signature",2048),runtimeCertificate:(0,yt.bounded)(t.runtimeCertificate,"runtimeCertificate",32768),signedPayload:K0(t.signedPayload,"signedPayload")};throw new yt.AgentOperationContractError("invalid_principal","unsupported principal proof kind")}function oJe(e){let t=(0,yt.record)(e,"money economics");pf(t,["amountMicros","currency","merchant"]);let r=(0,yt.bounded)(t.amountMicros,"amountMicros",40);if(!/^[1-9][0-9]*$/.test(r)||BigInt(r)>Vge)throw new yt.AgentOperationContractError("invalid_amount","amountMicros must be positive and canonical");let n=(0,yt.bounded)(t.currency,"currency",12);if(!pEr.test(n))throw new yt.AgentOperationContractError("invalid_currency","currency must be canonical");let i=(0,yt.record)(t.merchant,"merchant");return pf(i,["id"],["name","url"]),{amountMicros:r,currency:n,merchant:{id:(0,yt.bounded)(i.id,"merchant.id",512),...i.name===void 0?{}:{name:(0,yt.bounded)(i.name,"merchant.name",255)},...i.url===void 0?{}:{url:(0,yt.bounded)(i.url,"merchant.url",2048)}}}}function gEr(e){let t=(0,yt.record)(e,"effect");if(t.kind==="money"){pf(t,["kind","amountMicros","currency","merchant","grantId","budgetEpochId"],["maxAmountMicros"]);let r=oJe({amountMicros:t.amountMicros,currency:t.currency,merchant:t.merchant}),n;if(t.maxAmountMicros!==void 0&&(n=(0,yt.bounded)(t.maxAmountMicros,"maxAmountMicros",40),!/^[1-9][0-9]*$/.test(n)||BigInt(n)>Vge))throw new yt.AgentOperationContractError("invalid_amount","maxAmountMicros must be positive and canonical");return{kind:t.kind,...r,grantId:J4(t.grantId,"grantId"),budgetEpochId:J4(t.budgetEpochId,"budgetEpochId"),...n===void 0?{}:{maxAmountMicros:n}}}if(t.kind==="resource")return pf(t,["kind","resource","action","audience"]),{kind:t.kind,resource:(0,yt.bounded)(t.resource,"resource",4096),action:ZG(t.action,"action"),audience:(0,yt.bounded)(t.audience,"audience",255)};throw new yt.AgentOperationContractError("invalid_effect","unsupported operation effect")}function sJe(e,t=Date.now()){let r=(0,yt.record)(e,"operation");if(pf(r,["v","operationId","idempotencyKey","agentId","runtimeId","rail","intentHash","principal","effect","execution","createdAt","expiresAt"]),r.v!==Et.AGENT_OPERATION_VERSION)throw new yt.AgentOperationContractError("unsupported_version","unsupported operation version");let n=(0,yt.record)(r.execution,"execution");pf(n,["adapter","commitment","payloadHash","payload"]);let i=(0,yt.canonicalJsonValue)(n.payload);if(new TextEncoder().encode(JSON.stringify(i)).length>iJe)throw new yt.AgentOperationContractError("invalid_contract","execution payload is too large");let o=K0(n.commitment,"execution.commitment"),s=K0(n.payloadHash,"execution.payloadHash"),a=nJe(r.createdAt,"createdAt"),c=nJe(r.expiresAt,"expiresAt");if(!Number.isFinite(t)||Date.parse(a)>t+3e4||Date.parse(a)<t-5*6e4||Date.parse(c)<=t||Date.parse(c)<=Date.parse(a)||Date.parse(c)-Date.parse(a)>10*6e4)throw new yt.AgentOperationContractError("invalid_window","operation validity window is not currently usable");let u={v:Et.AGENT_OPERATION_VERSION,operationId:J4(r.operationId,"operationId"),idempotencyKey:(0,yt.bounded)(r.idempotencyKey,"idempotencyKey",255),agentId:J4(r.agentId,"agentId"),runtimeId:J4(r.runtimeId,"runtimeId"),rail:ZG(r.rail,"rail"),intentHash:K0(r.intentHash,"intentHash"),principal:hEr(r.principal),effect:gEr(r.effect),execution:{adapter:ZG(n.adapter,"execution.adapter"),commitment:o,payloadHash:s,payload:i},createdAt:a,expiresAt:c};if(u.rail==="wallet:x402"&&u.effect.kind==="money"&&u.effect.merchant.url===void 0)throw new yt.AgentOperationContractError("invalid_contract","merchant.url is required for wallet:x402 operations");if(u.principal.kind==="tap_signature"&&u.principal.signedPayload!==u.intentHash)throw new yt.AgentOperationContractError("intent_mismatch","TAP signedPayload must equal the universal operation intentHash");return u}function _Er(e){let t=(0,yt.record)(e,"evidence");if(pf(t,["v","operationId","adapter","outcome","artifactHash","providerReference","proof"],["settledMicros"]),t.v!==Et.EXECUTION_EVIDENCE_VERSION||t.outcome!=="committed"&&t.outcome!=="released")throw new yt.AgentOperationContractError("invalid_evidence","unsupported evidence version or outcome");let r;if(t.settledMicros!==void 0){if(r=(0,yt.bounded)(t.settledMicros,"settledMicros",40),!/^(?:0|[1-9][0-9]*)$/.test(r)||BigInt(r)>Vge)throw new yt.AgentOperationContractError("invalid_evidence","settledMicros is not canonical");if(t.outcome==="released"&&r!=="0")throw new yt.AgentOperationContractError("settlement_amount_invalid","released evidence must settle zero")}let n=(0,yt.canonicalJsonValue)(t.proof);if(new TextEncoder().encode(JSON.stringify(n)).length>iJe)throw new yt.AgentOperationContractError("invalid_evidence","evidence proof is too large");return{v:Et.EXECUTION_EVIDENCE_VERSION,operationId:J4(t.operationId,"operationId"),adapter:ZG(t.adapter,"adapter"),outcome:t.outcome,artifactHash:K0(t.artifactHash,"artifactHash"),...r===void 0?{}:{settledMicros:r},providerReference:(0,yt.bounded)(t.providerReference,"providerReference",255),proof:n}}function yEr(e,t=Date.now()){let r=(0,yt.record)(e,"prepared operation");pf(r,["operationId","idempotencyKey","agentId","runtimeId","rail","intentHash","effect","execution","createdAt","expiresAt"]);let{v:n,principal:i,...o}=sJe({...r,v:1,principal:{kind:"identity_pop",popJwt:"unsigned",keyJkt:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}},t);return o}function bEr(e){let t=r=>btoa(String.fromCharCode(...new TextEncoder().encode(JSON.stringify(r)))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"");return`${t({alg:"EdDSA",kid:e.childJkt,typ:"visa-agent-pop+jwt"})}.${t({cnf:{jwk:{kty:e.childPublicJwk.kty,crv:e.childPublicJwk.crv,x:e.childPublicJwk.x}},nonce:e.operationId,aud:"visa-agent-operations:v1",iat:e.issuedAtSec,int:e.intentHash,...e.runtimeCertificate?{rkc:e.runtimeCertificate}:{}})}`}});var eK=_(QG=>{"use strict";Object.defineProperty(QG,"__esModule",{value:!0});QG.parsePurchaseTerms=aJe;QG.purchaseTermsPreimage=vEr;var an=G_(),EEr=gS();function X4(e,t){if(Object.keys(e).sort().join(",")!==[...t].sort().join(","))throw new an.AgentOperationContractError("invalid_contract","purchase terms fields are not canonical")}function aJe(e){let t=(0,an.record)(e,"purchase terms"),r=t.profile==="exact_card_checkout_v1";if(X4(t,["v","profile","alternatives",...r?["checkout","disclosureMode",...t.merchantCountryCode===void 0?[]:["merchantCountryCode"]]:[]]),t.v!==1||typeof t.profile!="string"||!["url_resource_v1","approved_x402_request_v1","exact_card_checkout_v1"].includes(String(t.profile)))throw new an.AgentOperationContractError("unsupported_version","unsupported purchase terms profile");if(!Array.isArray(t.alternatives)||t.alternatives.length<1||t.alternatives.length>2)throw new an.AgentOperationContractError("invalid_contract","purchase requires one or two exact rail alternatives");let n=t.profile==="approved_x402_request_v1";if(n&&t.alternatives.length!==1)throw new an.AgentOperationContractError("invalid_contract","request-bound purchase requires one wallet alternative");let i=t.alternatives.map(o=>{let s=(0,an.record)(o,"purchase alternative"),a=(0,EEr.parseAgentMoneyEconomics)(s.economics),c=(0,an.bounded)(a.merchant.url,"purchase resource URL",2048),u;try{u=new URL(c)}catch{throw new an.AgentOperationContractError("invalid_contract","purchase resource URL is invalid")}if(u.protocol!=="https:"||u.username||u.password||u.hash)throw new an.AgentOperationContractError("invalid_contract","purchase requires an HTTPS resource without credentials or fragment");if(s.rail==="wallet:x402"){X4(s,["rail","economics","network","asset","payee",...n?["requestHash"]:[]]);let d=n?(0,an.bounded)(s.requestHash,"request hash",43):void 0;if(d!==void 0&&!/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(d))throw new an.AgentOperationContractError("invalid_contract","invalid request hash");let l=(0,an.bounded)(s.network,"network",64),p=(0,an.bounded)(s.asset,"asset",128),f=(0,an.bounded)(s.payee,"payee",42);if(!/^eip155:[1-9][0-9]{0,15}$/.test(l)||!new RegExp(`^${l}/erc20:0x[0-9a-f]{40}$`).test(p)||!/^0x[0-9a-f]{40}$/.test(f)||a.currency!=="USDC")throw new an.AgentOperationContractError("invalid_contract","invalid exact wallet economic coordinates");return{rail:s.rail,economics:a,network:l,asset:p,payee:f,...d?{requestHash:d}:{}}}if(s.rail==="card:vic"&&!n){if(X4(s,["rail","economics","processorAction","captureMode"]),s.processorAction!=="charge_and_capture"||s.captureMode!=="exact"||a.currency!=="USD"||BigInt(a.amountMicros)%10000n!==0n)throw new an.AgentOperationContractError("invalid_contract","purchase card profile requires exact whole-cent capture");return{rail:s.rail,economics:a,processorAction:"charge_and_capture",captureMode:"exact"}}throw new an.AgentOperationContractError("invalid_contract","unsupported purchase rail")});if(new Set(i.map(o=>o.rail)).size!==i.length)throw new an.AgentOperationContractError("invalid_contract","purchase rail alternatives must be unique");if(i.sort((o,s)=>o.rail<s.rail?-1:o.rail>s.rail?1:0),r){if(i.length!==1||i[0].rail!=="card:vic"||!i[0].economics.merchant.name)throw new an.AgentOperationContractError("invalid_contract","exact checkout requires one card alternative");if(t.disclosureMode!=="private"&&t.disclosureMode!=="agent_history")throw new an.AgentOperationContractError("invalid_contract","unsupported card disclosure mode");if(t.merchantCountryCode!==void 0&&(typeof t.merchantCountryCode!="string"||!/^[A-Z]{2}$/.test(t.merchantCountryCode)))throw new an.AgentOperationContractError("invalid_contract","invalid merchant country");return{v:1,profile:"exact_card_checkout_v1",...t.merchantCountryCode===void 0?{}:{merchantCountryCode:t.merchantCountryCode},alternatives:i,checkout:SEr(t.checkout,i[0].economics.amountMicros),disclosureMode:t.disclosureMode}}return{v:1,profile:t.profile,alternatives:i}}function SEr(e,t){let r=(0,an.record)(e,"checkout");X4(r,["id","revision","source","expiresAt","items","taxMicros","shippingMicros","discountMicros","fulfillment","customerHash"]);let n=()=>{throw new an.AgentOperationContractError("invalid_contract","invalid exact card checkout")},i=l=>((typeof l!="string"||!/^(0|[1-9][0-9]{0,17})$/.test(l)||BigInt(l)%10000n!==0n)&&n(),l),o=l=>((typeof l!="string"||!/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/.test(l))&&n(),l);(r.source!=="runtime_observed"||typeof r.expiresAt!="string"||!Number.isFinite(Date.parse(r.expiresAt))||new Date(r.expiresAt).toISOString()!==r.expiresAt||!Array.isArray(r.items)||r.items.length<1||r.items.length>100)&&n();let s=r.items.map(l=>{let p=(0,an.record)(l,"checkout item");return X4(p,["id","name","quantity","totalMicros"]),(!Number.isSafeInteger(p.quantity)||Number(p.quantity)<1||Number(p.quantity)>1e6)&&n(),{id:(0,an.bounded)(p.id,"checkout item ID",256),name:(0,an.bounded)(p.name,"checkout item name",512),quantity:p.quantity,totalMicros:i(p.totalMicros)}});new Set(s.map(l=>l.id)).size!==s.length&&n();let a=i(r.taxMicros),c=i(r.shippingMicros),u=i(r.discountMicros);s.reduce((l,p)=>l+BigInt(p.totalMicros),0n)+BigInt(a)+BigInt(c)-BigInt(u)!==BigInt(t)&&n();let d=(0,an.record)(r.fulfillment,"checkout fulfillment");return X4(d,["method","detailsHash"]),{id:(0,an.bounded)(r.id,"checkout ID",256),revision:(0,an.bounded)(r.revision,"checkout revision",256),source:"runtime_observed",expiresAt:r.expiresAt,items:s,taxMicros:a,shippingMicros:c,discountMicros:u,fulfillment:{method:(0,an.bounded)(d.method,"fulfillment method",256),detailsHash:o(d.detailsHash)},customerHash:o(r.customerHash)}}function vEr(e){return(0,an.canonicalJson)({domain:"visa.purchase-terms.v1",terms:aJe(e)})}});var $ge=_(nc=>{"use strict";Object.defineProperty(nc,"__esModule",{value:!0});nc.ACCOUNT_OPERATION_EVIDENCE_TYPES=nc.ACCOUNT_OPERATION_PROOF_LEVELS=nc.ACCOUNT_OPERATION_OUTCOMES=nc.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION=void 0;nc.cardProofLevel=TEr;nc.cardStatusClaimsProcessorTruth=AEr;nc.parseAccountOperationReceipt=PEr;nc.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION=1;nc.ACCOUNT_OPERATION_OUTCOMES=["pending","completed","failed","uncertain","released","reversed","disputed"];nc.ACCOUNT_OPERATION_PROOF_LEVELS=["none","platform_observed","merchant_reported","owner_attested","processor_confirmed","network_verified","settled"];var cJe={sale_accepted:"merchant_reported",auth_held:"merchant_reported",capture_pending:"merchant_reported",captured:"processor_confirmed",voided:"processor_confirmed",refunded:"processor_confirmed",partially_refunded:"processor_confirmed",refund_pending:"processor_confirmed",chargeback_open:"processor_confirmed",chargeback_lost:"processor_confirmed",chargeback_won:"processor_confirmed",pending:"platform_observed",needs_reconciliation:"platform_observed"};function TEr(e,t){let r=cJe[e]??"platform_observed";return r==="processor_confirmed"&&!t?"merchant_reported":r}function AEr(e){return cJe[e]==="processor_confirmed"}nc.ACCOUNT_OPERATION_EVIDENCE_TYPES=["platform_activity","merchant_confirmation","card_lifecycle","onchain_transaction"];function _S(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function K_(e){return e===null||typeof e=="string"}function Bk(e){return typeof e=="string"&&e.length>0&&!Number.isNaN(Date.parse(e))}function yS(e,t){let r=Object.keys(e).sort(),n=[...t].sort();return r.length===n.length&&r.every((i,o)=>i===n[o])}function wEr(e){return _S(e)?yS(e,["type","source","observedAt","reference","url"])&&typeof e.type=="string"&&nc.ACCOUNT_OPERATION_EVIDENCE_TYPES.includes(e.type)&&typeof e.source=="string"&&Bk(e.observedAt)&&K_(e.reference)&&K_(e.url):!1}function IEr(e){return _S(e)?yS(e,["type","at"])&&typeof e.type=="string"&&e.type.length>0&&Bk(e.at):!1}function PEr(e){if(!_S(e)||!yS(e,["schemaVersion","operationId","activityId","payment","route","party","authority","outcome","evidence","timeline","dataCompleteness"])||e.schemaVersion!==nc.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION||typeof e.operationId!="string"||typeof e.activityId!="string"||e.dataCompleteness!=="complete"&&e.dataCompleteness!=="partial"||!Array.isArray(e.evidence)||!e.evidence.every(wEr)||!Array.isArray(e.timeline)||!e.timeline.every(IEr))return null;let t=e.payment,r=e.route,n=e.party,i=e.authority,o=e.outcome;return!_S(t)||!yS(t,["amountAtomic","decimals","currency","merchant","description","createdAt"])||typeof t.amountAtomic!="string"||!/^\d+$/.test(t.amountAtomic)||typeof t.decimals!="number"||!Number.isInteger(t.decimals)||t.decimals<0||t.decimals>18||typeof t.currency!="string"||typeof t.merchant!="string"||typeof t.description!="string"||!Bk(t.createdAt)||!_S(r)||!yS(r,["rail","protocol","network","cardLast4"])||r.rail!=="wallet"&&r.rail!=="card"||!(r.protocol===null||r.protocol==="x402"||r.protocol==="mpp"||r.protocol==="vic"||r.protocol==="virtual_card")||!K_(r.network)||!K_(r.cardLast4)||!_S(n)||!yS(n,["agentId","agentName"])||!K_(n.agentId)||!K_(n.agentName)||!_S(i)||!yS(i,["grantId","mandateId","drawId"])||!K_(i.grantId)||!K_(i.mandateId)||!K_(i.drawId)||!_S(o)||!yS(o,["status","proofLevel","final","updatedAt","finalizesBy"])||typeof o.status!="string"||!nc.ACCOUNT_OPERATION_OUTCOMES.includes(o.status)||typeof o.proofLevel!="string"||!nc.ACCOUNT_OPERATION_PROOF_LEVELS.includes(o.proofLevel)||typeof o.final!="boolean"||!Bk(o.updatedAt)||!(o.finalizesBy===null||Bk(o.finalizesBy))?null:e}});var lJe=_(rp=>{"use strict";Object.defineProperty(rp,"__esModule",{value:!0});rp.PURCHASE_RESOURCE_AUDIENCE=rp.PURCHASE_OBSERVATIONS=void 0;rp.parsePurchaseReceipt=REr;rp.parsePurchaseResourceRequest=dJe;rp.purchaseResourceRequestHash=NEr;var xEr=require("node:crypto"),W0=G_(),OEr=eK(),uJe=$ge();rp.PURCHASE_OBSERVATIONS=["credential_delivered","submission_started","buyer_action_required","order_reported","submission_failed"];function REr(e,t){let r=(0,W0.record)(e,"purchase receipt"),n=(0,W0.record)(r.outcome,"purchase outcome");if(!t||r.operationId!==t||typeof r.credentialIssued!="boolean"||!uJe.ACCOUNT_OPERATION_OUTCOMES.includes(n.status)||!uJe.ACCOUNT_OPERATION_PROOF_LEVELS.includes(n.proofLevel)||typeof n.final!="boolean"||!Array.isArray(r.observations)||r.observations.length>rp.PURCHASE_OBSERVATIONS.length||r.observations.some(o=>!rp.PURCHASE_OBSERVATIONS.includes(o))||new Set(r.observations).size!==r.observations.length)throw new W0.AgentOperationContractError("invalid_contract","invalid purchase receipt");let i=r.refusal===void 0?void 0:(0,W0.record)(r.refusal,"refusal");if(i!==void 0&&(!Number.isSafeInteger(i.providerStatus)||Number(i.providerStatus)<100||Number(i.providerStatus)>999||typeof i.providerCode!="string"||!/^[a-z0-9_]{1,64}$/.test(i.providerCode)||n.status!=="failed"||n.final!==!0||r.credentialIssued!==!1))throw new W0.AgentOperationContractError("invalid_contract","invalid purchase refusal");return{operationId:t,credentialIssued:r.credentialIssued,outcome:{status:n.status,proofLevel:n.proofLevel,final:n.final},observations:r.observations,...i?{refusal:{providerStatus:Number(i.providerStatus),providerCode:i.providerCode}}:{}}}rp.PURCHASE_RESOURCE_AUDIENCE="visa:purchase-resource:v1";function dJe(e){let t=(0,W0.record)(e,"purchase request"),r=()=>{throw new W0.AgentOperationContractError("invalid_contract","invalid purchase request")};(t.v!==1||typeof t.action!="string"||!["create","retrieve","cancel"].includes(t.action))&&r();let n=["v","action","requestId","agentId","runtimeId",...t.action==="create"?["requestKey","terms"]:["purchaseId"],...t.action==="retrieve"&&t.include!==void 0?["include"]:[],...t.action==="retrieve"&&t.observation!==void 0?["observation"]:[]];Object.keys(t).sort().join(",")!==n.sort().join(",")&&r(),t.include!==void 0&&t.include!=="card"&&r();let i;if(t.observation!==void 0){t.include!==void 0&&r();let s=(0,W0.record)(t.observation,"purchase observation");(Object.keys(s).sort().join(",")!=="attemptId,kind,termsHash"||!rp.PURCHASE_OBSERVATIONS.includes(s.kind)||typeof s.attemptId!="string"||!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(s.attemptId)||typeof s.termsHash!="string"||!/^[A-Za-z0-9_-]{43}$/.test(s.termsHash))&&r(),i=s}for(let s of["requestId","agentId","runtimeId",...t.action==="create"?[]:["purchaseId"]])(typeof t[s]!="string"||!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(t[s]))&&r();let o={v:1,requestId:t.requestId,agentId:t.agentId,runtimeId:t.runtimeId};if(t.action==="create"){let s=(0,OEr.parsePurchaseTerms)(t.terms);return(s.profile!=="exact_card_checkout_v1"||s.alternatives.length!==1||s.alternatives[0].rail!=="card:vic")&&r(),{...o,action:"create",requestKey:(0,W0.bounded)(t.requestKey,"purchase request key",256),terms:s}}return{...o,action:t.action,purchaseId:t.purchaseId,...t.action==="retrieve"&&t.include==="card"?{include:"card"}:{},...i?{observation:i}:{}}}function NEr(e){return(0,xEr.createHash)("sha256").update((0,W0.canonicalJson)({domain:rp.PURCHASE_RESOURCE_AUDIENCE,request:dJe(e)})).digest("base64url")}});var Wge=_(An=>{"use strict";var CEr=An&&An.__createBinding||(Object.create?(function(e,t,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(t,r);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[r]}}),Object.defineProperty(e,n,i)}):(function(e,t,r,n){n===void 0&&(n=r),e[n]=t[r]})),zge=An&&An.__exportStar||function(e,t){for(var r in e)r!=="default"&&!Object.prototype.hasOwnProperty.call(t,r)&&CEr(t,e,r)};Object.defineProperty(An,"__esModule",{value:!0});An.CARD_ADMISSION_RECOVERY_AUDIENCE=void 0;An.cardAdmissionRecoveryRequestHash=MEr;An.agentOperationIntentHash=Gge;An.agentExecutionCommitment=Kge;An.purchaseTermsHash=kEr;An.purchaseAlternativeFromOperation=DEr;An.x402ResourceCommitment=LEr;An.agentOperationIdempotencyKey=fJe;An.purchaseAttemptIdempotencyKey=UEr;An.agentOperationTermsFingerprint=mJe;An.legacyAgentOperationEnvelopeFingerprint=hJe;An.persistedAgentOperationMatchesTerms=BEr;An.artifactHash=jEr;An.prepareAgentOperationV1=gJe;An.finalizeAgentOperationV1=_Je;An.createAgentOperationV1=HEr;An.parseHistoricalAgentOperation=VEr;An.parseAgentOperation=jk;var Y0=require("node:crypto"),Ao=G_(),pJe=eK();zge(eK(),An);zge(lJe(),An);var tK=gS();zge(gS(),An);An.CARD_ADMISSION_RECOVERY_AUDIENCE="visa:card-admission-recovery:v1";function MEr(e,t){return(0,Y0.createHash)("sha256").update("visa:card-admission-recovery:v1\0","utf8").update((0,Ao.canonicalJson)({original:e,replacement:t}),"utf8").digest("base64url")}function Gge(e){return(0,Y0.createHash)("sha256").update((0,tK.agentOperationIntentPreimage)(e)).digest("base64url")}function Kge(e){return(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)(e)).digest("base64url")}function kEr(e){return(0,Y0.createHash)("sha256").update((0,pJe.purchaseTermsPreimage)(e)).digest("base64url")}function DEr(e,t=Date.now()){let r=jk(e,t);if(r.effect.kind!=="money")throw new Ao.AgentOperationContractError("invalid_effect","purchase requires financial economics");let{amountMicros:n,currency:i,merchant:o}=r.effect,s={amountMicros:n,currency:i,merchant:o},a=(0,Ao.record)(r.execution.payload,"purchase native payload"),c=r.rail==="wallet:x402"?["scheme","network","asset","payer","typedData","nonce","keyRef",...a.walletBinding===void 0?[]:["walletBinding"],...a.approvedRequest===void 0&&a.requestHash===void 0?[]:["approvedRequest","requestHash"]]:["mandateId","tokenId","processorIntentId","processorAction","captureMode"];if(Object.keys(a).sort().join(",")!==c.sort().join(","))throw new Ao.AgentOperationContractError("invalid_contract","purchase producer has unrepresented native fields");let u;if(r.rail==="wallet:x402"&&r.execution.adapter==="wallet.eip3009"){let d=(0,Ao.record)(a.typedData,"wallet typed data"),l=(0,Ao.record)(d.message,"wallet message");if(a.scheme!=="exact"||l.value!==n)throw new Ao.AgentOperationContractError("invalid_amount","wallet value differs from purchase amount");u={rail:r.rail,economics:s,network:a.network,asset:a.asset,payee:l.to,...a.approvedRequest===void 0&&a.requestHash===void 0?{}:{requestHash:a.requestHash}}}else if(r.rail==="card:vic"&&r.execution.adapter==="card.vic")u={rail:r.rail,economics:s,processorAction:a.processorAction,captureMode:a.captureMode};else throw new Ao.AgentOperationContractError("invalid_contract","unsupported purchase producer profile");if(a.requestHash!==void 0&&(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)(a.approvedRequest)).digest("base64url")!==a.requestHash)throw new Ao.AgentOperationContractError("invalid_contract","purchase request hash mismatch");return(0,pJe.parsePurchaseTerms)({v:1,profile:a.requestHash===void 0?"url_resource_v1":"approved_x402_request_v1",alternatives:[u]}).alternatives[0]}function LEr(e){let t=(0,Ao.bounded)(e,"x402 resource",2048);return(0,Y0.createHash)("sha256").update(`visa-x402-resource:v1:${t}`,"utf8").digest("base64url")}function fJe(e){return`economic:${(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)({domain:"visa.agent-operation-idempotency.v1",agentId:e.agentId,economicIntentId:e.economicIntentId})).digest("base64url")}`}function UEr(e){let t=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;for(let r of["agentId","purchaseId","attemptId"])if(typeof e[r]!="string"||!t.test(e[r]))throw new Ao.AgentOperationContractError("invalid_contract",`${r} must be a canonical UUID`);if(typeof e.termsHash!="string"||!/^[A-Za-z0-9_-]{43}$/.test(e.termsHash)||Buffer.from(e.termsHash,"base64url").toString("base64url")!==e.termsHash)throw new Ao.AgentOperationContractError("invalid_contract","termsHash must be canonical SHA-256");return fJe({agentId:e.agentId,economicIntentId:`purchase:${e.purchaseId}:attempt:${e.attemptId}:terms:${e.termsHash}`})}function mJe(e){return(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)({domain:"visa.agent-operation-terms.v1",operationId:e.operationId,idempotencyKey:e.idempotencyKey,agentId:e.agentId,runtimeId:e.runtimeId,rail:e.rail,effect:e.effect,execution:e.execution})).digest("base64url")}function hJe(e){return(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)(e)).digest("base64url")}function BEr(e,t,r){return t===r?!0:mJe(e)!==r?!1:t===hJe(e)}function jEr(e){return(0,Y0.createHash)("sha256").update((0,Ao.canonicalJson)(e)).digest("base64url")}var qEr={kind:"identity_pop",popJwt:"unsigned",keyJkt:Buffer.alloc(32).toString("base64url")};function gJe(e,t=Date.now()){let r={v:tK.AGENT_OPERATION_VERSION,...e,principal:qEr,intentHash:Buffer.alloc(32).toString("base64url"),execution:{...e.execution,payloadHash:Kge(e.execution.payload)}};r.intentHash=Gge(r);let n=jk(r,t),{v:i,principal:o,...s}=n;return s}function _Je(e,t,r=Date.now()){return jk({v:tK.AGENT_OPERATION_VERSION,...e,principal:t},r)}function HEr(e,t=Date.now()){let{principal:r,...n}=e;return _Je(gJe(n,t),r,t)}function VEr(e){let t=(0,Ao.record)(e,"historical operation");if(typeof t.createdAt!="string")throw new Ao.AgentOperationContractError("invalid_window","historical operation creation time is missing");return jk(e,Date.parse(t.createdAt))}function jk(e,t=Date.now()){let r=(0,tK.parseAgentOperationStructure)(e,t);if(Kge(r.execution.payload)!==r.execution.payloadHash)throw new Ao.AgentOperationContractError("commitment_mismatch","execution payload does not match its commitment");if(Gge(r)!==r.intentHash)throw new Ao.AgentOperationContractError("intent_mismatch","intentHash does not bind the exact operation effect and execution commitment");return r}});var yJe,bJe=A(()=>{"use strict";yJe=ie(Wge())});var EJe,SJe=A(()=>{"use strict";$_();EJe=ie(Wge());bJe()});function TJe(e){return e?.code==="ENOENT"}function t6(e){let t=JSON.parse(e),r=!1;function n(i){if(!(!i||typeof i!="object"))for(let[o,s]of Object.entries(i)){if(["networkToken","cryptogramValue","card","privateJwk","private_jwk","seed","secretKey","secret_key","privateKey","d"].includes(o))throw new Error("native_metadata_contains_private_material");if(o==="runtimeKey"&&s&&typeof s=="object"){let a=s;r||=a.v===1&&typeof a.handle=="string"&&/^[0-9a-f]{64}$/.test(a.handle)&&typeof a.binding=="object"}n(s)}}if(n(t),!r)throw new Error("native_metadata_record_required")}function AJe(e,t=process.platform){if(t!=="win32")return Vc(e);try{let r=pi.lstatSync(e);if(!r.isDirectory()||r.isSymbolicLink())throw new Error("native_metadata_directory_invalid");return!0}catch(r){if(TJe(r))return!1;throw r}}function qk(e,t=process.platform){return wJe(e,t,t6)}function wJe(e,t,r){if(t!=="win32")return Xl(e);if(!AJe(bS.dirname(e),t))return null;let n;try{let i=pi.lstatSync(e);if(!i.isFile()||i.isSymbolicLink()||i.size>$4)throw new Error("native_metadata_file_invalid");n=pi.openSync(e,pi.constants.O_RDONLY|(pi.constants.O_NOFOLLOW??0));let o=pi.fstatSync(n);if(!o.isFile()||o.dev!==i.dev||o.ino!==i.ino)throw new Error("native_metadata_file_changed");let s=Buffer.alloc($4+1),a=0;for(;a<s.length;){let u=pi.readSync(n,s,a,s.length-a,null);if(u===0)break;a+=u}if(a>$4)throw new Error("native_metadata_file_too_large");let c=new TextDecoder("utf-8",{fatal:!0}).decode(s.subarray(0,a));return r(c),c}catch(i){if(TJe(i))return null;throw i}finally{n!==void 0&&pi.closeSync(n)}}function Hk(e,t,r=process.platform){FEr(e,t,r,t6)}function FEr(e,t,r,n){if(r!=="win32")return Fc(e,t);if(n(t),Buffer.byteLength(t)>$4)throw new Error("native_metadata_file_too_large");if(!AJe(bS.dirname(e),r))throw new Error("native_metadata_directory_missing");let i=bS.join(bS.dirname(e),`.${bS.basename(e)}.${(0,vJe.randomUUID)()}.tmp`),o;try{if(o=pi.openSync(i,"wx",384),pi.writeFileSync(o,t,"utf8"),pi.fsyncSync(o),pi.closeSync(o),o=void 0,pi.renameSync(i,e),wJe(e,r,n)!==t)throw new Error("native_metadata_readback_failed")}finally{o!==void 0&&pi.closeSync(o),pi.rmSync(i,{force:!0})}}var pi,bS,vJe,rK=A(()=>{"use strict";pi=ie(require("node:fs")),bS=ie(require("node:path")),vJe=require("node:crypto");SJe();q_()});var Z4=_((GAi,$Er)=>{$Er.exports={name:"@visa/cli",version:"5.0.0-rc.356",description:"Visa CLI runtime for stable agent identity and separately authorized payment capabilities",bin:{"visa-cli":"./bin/visa-cli.js",visa:"./bin/visa-cli.js","visa-runtime-converge":"./dist/managed-runtime/resolve-and-update.mjs"},scripts:{"sync:server-json":"node scripts/sync-server-json.mjs","check:server-json":"node scripts/sync-server-json.mjs --check",prebuild:"node scripts/sync-server-json.mjs && pnpm --filter @visa/shared build && pnpm --filter @visa/observability build && pnpm --filter @visa/money build && pnpm --filter @visa/crypto build && pnpm --filter @visa-cli/tools build && pnpm --filter @visa/identity build && pnpm --filter @visa/wallet build && pnpm --filter @visa/agent-mail build && pnpm --filter @visa/wallet-tools build",build:"tsc --noEmit && node esbuild.config.js",prepack:"node scripts/sync-server-json.mjs --check",dev:"tsc --watch",pretest:"pnpm build",start:"node dist/mcp-server/index.js",test:"jest --config jest.config.js","test:unit":"jest --config jest.config.js","test:unit:watch":"jest --config jest.config.js --watch","test:unit:coverage":"jest --config jest.config.js --coverage","test:smoke":"VISA_AUTH_URL=https://auth.visacli.sh jest --config jest.smoke.config.js","test:packed":"node scripts/packed-cli-smoke.mjs","test:integration":"jest --config jest.integration.config.js","test:e2e":"jest --config jest.e2e.config.js","coinbase:onramp":"pnpm exec tsx tests/e2e/coinbase-onramp-harness/run.ts","test:all":"npm run test:unit && npm run test:integration && npm run test:e2e",prepublishOnly:"npm run build && npm test",lint:"eslint src/**/*.ts",format:'prettier --write "src/**/*.ts"',"format:check":'prettier --check "src/**/*.ts"'},keywords:["visa","checkout","mcp","ai-agent","payments","click-to-pay","usdc","stablecoin"],author:"Visa Crypto Labs",license:"SEE LICENSE IN LICENSE",dependencies:{"@modelcontextprotocol/ext-apps":"1.7.5","@modelcontextprotocol/server":"2.0.0","@ucp-js/sdk":"0.4.4",commander:"^12.1.0",punycode:"^2.3.1",toml:"^4.3.0",yaml:"^2.9.0",zod:"^3.25.76"},devDependencies:{"@types/express":"^5.0.0","@types/jest":"^30.0.0","@types/node":"^26.1.0","@typescript-eslint/eslint-plugin":"^8.68.0","@typescript-eslint/parser":"^8.68.0","@visa-cli/tools":"workspace:*","@visa/agent-mail":"workspace:*","@visa/crypto":"workspace:*","@visa/identity":"workspace:*","@visa/money":"workspace:*","@visa/observability":"workspace:*","@visa/shared":"workspace:*","@visa/wallet":"workspace:*","@visa/wallet-tools":"workspace:*",esbuild:"^0.28.1",eslint:"^10.0.2",express:"^4.21.0",jest:"^29.7.0",prettier:"^3.9.6","ts-jest":"^29.4.12",typescript:"^5.7.0"},engines:{node:">=20.0.0"},mcpName:"io.github.visa-crypto-labs/visa-cli",files:["bin/visa-cli.js","dist/","install.ps1","install.sh","native/visa-keychain.m","native/visa-keychain-win.cpp","native/build-win.bat","native/bin/win32-x64/visa-keychain-win.exe","server.json","README.md","native/bin/*/visa-runtime-signer*"]}});async function _Xe(e,t){let r=t?.timeoutMs??3e4,n=new AbortController,i=setTimeout(()=>n.abort(),r);try{let{timeoutMs:o,...s}=t??{};return await fetch(e,{...s,signal:n.signal})}finally{clearTimeout(i)}}var yXe=A(()=>{"use strict"});function WSr(){return Object.fromEntries(GSr.map(e=>[e,KSr]))}function a1e(e){if(!e||typeof e!="object")return null;let t=e,n=(t.cause&&typeof t.cause=="object"?t.cause.code:void 0)??(typeof t.code=="string"?t.code:void 0);return typeof n=="string"&&n.length>0?n:null}function c1e(e){let t=e&&typeof e=="object"?e:{};if(t.name==="AbortError"||typeof t.message=="string"&&t.message.includes("aborted"))return"The request timed out. The server may be under heavy load. Please try again.";let r=a1e(e);return r&&bXe[r]?bXe[r]:`Network error contacting the Visa CLI server (${r?`${r}: ${typeof t.message=="string"?t.message:"unknown"}`:typeof t.message=="string"&&t.message.length>0?t.message:"unknown error"}). Check https://visacli.sh for status.`}var GSr,KSr,bXe,u1e=A(()=>{"use strict";GSr=["UNABLE_TO_GET_ISSUER_CERT","UNABLE_TO_GET_ISSUER_CERT_LOCALLY","UNABLE_TO_VERIFY_LEAF_SIGNATURE","SELF_SIGNED_CERT_IN_CHAIN","DEPTH_ZERO_SELF_SIGNED_CERT","CERT_UNTRUSTED"],KSr="This machine does not trust the certificate offered for the Visa CLI server, so the request never left it. The server is not down, and neither retrying nor signing in again can help. A network that inspects TLS traffic does this: point Node at its root certificate with NODE_EXTRA_CA_CERTS=/path/to/root.pem, or use a network that does not inspect. Do not disable certificate verification.";bXe={ENOTFOUND:"Cannot resolve the Visa CLI server hostname (DNS error). Check your internet connection or the auth.serverUrl setting.",EAI_AGAIN:"DNS lookup for the Visa CLI server failed temporarily. Check your internet connection and try again.",ECONNREFUSED:"The Visa CLI server refused the connection. The service may be down \u2014 check https://visacli.sh for status.",ECONNRESET:"The connection to the Visa CLI server was reset mid-request. Try again in a moment.",EHOSTUNREACH:"The Visa CLI server is unreachable from this network. Check your internet connection.",ETIMEDOUT:"The connection to the Visa CLI server timed out. Try again or check https://visacli.sh for status.",CERT_HAS_EXPIRED:"The Visa CLI server's TLS certificate is expired. Check https://visacli.sh for status; do not bypass the cert.",...WSr(),ERR_TLS_CERT_ALTNAME_INVALID:"The certificate offered for the Visa CLI server is for a different hostname. Check the auth.serverUrl setting. Do not disable certificate verification.",UND_ERR_CONNECT_TIMEOUT:"The connection to the Visa CLI server timed out before it could be established. Try again in a moment.",UND_ERR_SOCKET:"The connection to the Visa CLI server was interrupted. Try again in a moment."}});function EXe(){return`Run ${YSr} or call ${JSr}, open the printed URL, enter the code at ${XSr}, approve the device and its limits, then pay with the pay tool. Do not retry the retired command; nothing was signed, paired, or paid.`}var YSr,JSr,XSr,m2i,h2i,g2i,SXe=A(()=>{"use strict";YSr="visa connect",JSr="agent_enroll",XSr="/agent/enroll/protected-agent",m2i=Object.freeze(["setup_start","setup_status","setup_resume","setup_cancel","setup_agent","enroll_agent","agent_pairing_cancel","agent_handoff_claim","agent_connect","agent_connect_cancel","agent_connect_poll"]),h2i=Object.freeze(["create","verify","enroll-claim","pair","claim","pairing-resume","cancel","handoff-claim","connect","grant-wallet","grant-card","grant-activate","grant-claim","grants","grant-cancel","grant-batch"]),g2i=Object.freeze(["setup","agent","wallet","find","inspect","receipt","connections","keys","security","checkout","mandate","logout","capabilities","feedback","status","pay","purchase","limits","fund","activity"])});var SK,d1e,vXe,EK,TXe=A(()=>{"use strict";SK=ie(require("fs")),d1e=ie(require("path")),vXe=ie(require("os")),EK=class{static ensureConfigDir(){let t=this.getConfigDir();SK.existsSync(t)||SK.mkdirSync(t,{recursive:!0,mode:448})}static getConfigDir(){let t=process.env.VISA_CLI_HOME;return typeof t=="string"&&t.trim().length>0?d1e.join(t,".visa-mcp"):d1e.join(vXe.homedir(),".visa-mcp")}}});function AXe(e){let t=IXe.homedir();return t&&e.startsWith(t)?`~${e.slice(t.length)}`:e}function evr(){return PXe.join(EK.getConfigDir(),ZSr)}function xXe(e){if((0,l1e.isIP)(e)!==4)return!1;let[t]=e.split(".").map(Number);return t===127}function tvr(e){let t=e.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);if(!t)return!1;let r=Number.parseInt(t[1],16),n=Number.parseInt(t[2],16);if(!Number.isFinite(r)||!Number.isFinite(n))return!1;let i=[r>>8&255,r&255,n>>8&255,n&255].join(".");return xXe(i)}function rvr(e){let t=e.toLowerCase().replace(/^\[(.*)\]$/,"$1");if(t==="localhost")return!0;let r=(0,l1e.isIP)(t);return r===4?xXe(t):r===6?t==="::1"||tvr(t):!1}function wXe(e,t="auth.serverUrl"){let r;try{r=new URL(e)}catch{throw new Error(`${t} must be a valid URL (got: ${JSON.stringify(e)})`)}if(r.username||r.password)throw new Error(`${t} must not include username or password credentials`);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&rvr(r.hostname)))throw new Error(`${t} ${QSr}`)}function OXe(){let e=evr();if(!tO.existsSync(e))return{};try{let t=tO.readFileSync(e,"utf-8"),r=JSON.parse(t);return!r||typeof r!="object"||Array.isArray(r)?(Wn.warn("settings:corrupt",{path:AXe(e),reason:"not_object"}),{}):r}catch(t){return Wn.warn("settings:corrupt",{path:AXe(e),error:t?.message||String(t)}),{}}}function p1e(e){let t=OXe()[e];return typeof t=="string"?t:void 0}function nvr(e){let t=OXe()[e];return typeof t=="boolean"?t:void 0}function ovr(e){return typeof e=="string"&&/-(?:rc|alpha|beta)\./i.test(e)}function svr(){try{let e=Z4();return ovr(e.version)}catch{return!1}}function avr(e){return e.envVar!==void 0&&e.envVar!==""?(wXe(e.envVar,"VISA_AUTH_URL"),e.envVar):e.settingValue!==void 0?(wXe(e.settingValue,"auth.serverUrl"),e.settingValue):e.isPrerelease?f1e:ivr}function i6(){return avr({envVar:process.env.VISA_AUTH_URL,settingValue:p1e("auth.serverUrl"),isPrerelease:svr()})}function RXe(e=process.env){let t=[e.VISA_SUPPRESS_BROWSER,e.VISA_CLI_NO_BROWSER,e.CHECKOUT_SKIP_BROWSER_OPEN];return t.some(r=>r==="true"||r==="1")?!0:t.some(r=>r!==void 0)?!1:nvr("ui.suppressBrowser")??!1}var tO,l1e,IXe,PXe,ZSr,QSr,ivr,f1e,o6=A(()=>{"use strict";tO=ie(require("fs")),l1e=require("node:net"),IXe=ie(require("os")),PXe=ie(require("path"));TXe();Zl();ZSr="settings.json",QSr="must use https unless it points at localhost/loopback for local development";ivr="https://auth.visacli.sh",f1e="https://auth-visa-code-preview.up.railway.app"});function vK(e){return m1e(e)!==null}function h1e(e,t){let r=m1e(e),n=m1e(t);if(!r||!n)return!1;for(let i=0;i<3;i++)if(r.main[i]!==n.main[i])return r.main[i]>n.main[i];return r.pre&&!n.pre?!1:!r.pre&&n.pre?!0:!r.pre&&!n.pre?!1:uvr(r.pre,n.pre)>0}function m1e(e){if(typeof e!="string")return null;let r=e.trim().replace(/^v/,"").match(cvr);return r?{main:[Number(r[1]),Number(r[2]),Number(r[3])],pre:r[4]??null}:null}function uvr(e,t){let r=e.split("."),n=t.split("."),i=Math.max(r.length,n.length);for(let o=0;o<i;o++){if(o>=r.length)return-1;if(o>=n.length)return 1;let s=r[o],a=n[o],c=/^\d+$/.test(s),u=/^\d+$/.test(a);if(c&&u){let d=Number(s)-Number(a);if(d!==0)return d}else{if(c)return-1;if(u)return 1;if(s<a)return-1;if(s>a)return 1}}return 0}var cvr,TK=A(()=>{"use strict";cvr=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/});function CXe(e){let t=e||i6();return process.env.VISA_ENVIRONMENT==="staging"||t.includes("staging")||t.includes("up.railway.app")||t.includes("preview")?"staging":process.env.VISA_ENVIRONMENT==="production"||t.includes("auth.visacli.sh")?"production":"development"}var NXe,AK,g1e=A(()=>{"use strict";o6();TK();NXe="4.1.0-rc.70",AK=class extends Error{code="update_required";errorCode="update_required";runningVersion;minCompatibleVersion;updateCommand;constructor(t,r,n){let i=`CLI/MCP update required${n?` for ${n}`:""}: running v${t}, minimum compatible version is v${r}. Run: npm install -g @visa/cli@rc`;super(i),this.name="UpdateRequiredError",this.runningVersion=t,this.minCompatibleVersion=r,this.updateCommand="npm install -g @visa/cli@rc"}toJSON(){return{success:!1,error_code:this.errorCode,error:this.message,runningVersion:this.runningVersion,minCompatibleVersion:this.minCompatibleVersion,updateCommand:this.updateCommand}}}});function rO(){return!!(MXe(process.env.VISA_CLI_NO_UPDATE_CHECK)||MXe(process.env.CI)||process.env.NODE_ENV==="test")}function MXe(e){if(e===void 0)return!1;let t=e.trim().toLowerCase();return!(t===""||t==="0"||t==="false"||t==="no"||t==="off")}var wK=A(()=>{"use strict"});function dvr(){return y1e||(y1e=`ms_${(0,DXe.randomUUID)().replace(/-/g,"")}`),y1e}function lvr(){return _1e?kXe?`${_1e}/${kXe}`.slice(0,96):_1e:null}function Yk(){let e={"X-Visa-MCP-Session":dvr()},t=lvr();return t&&(e["X-Visa-MCP-Client"]=t),e}var DXe,_1e,kXe,y1e,IK=A(()=>{"use strict";DXe=require("node:crypto"),_1e=null,kXe=null,y1e=null});function LXe(e){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("runtime service returned an invalid runtime");let t=e;if(typeof t.runtimeId!="string"||typeof t.agentId!="string"||!pvr.has(String(t.kind))||typeof t.label!="string"||!fvr.has(String(t.status))||typeof t.credentialAudience!="string"||typeof t.credentialPurpose!="string"||typeof t.createdAt!="string"||!(t.lastSeenAt===null||typeof t.lastSeenAt=="string")||!(t.revokedAt===null||typeof t.revokedAt=="string"))throw new Error("runtime service returned an invalid runtime");return t}function _vr(e){if(e===null||!/^\d{1,4}$/.test(e))return 3;let t=Number(e);return Number.isSafeInteger(t)&&t>=1&&t<=3600?t:3}function yvr(e,t){if(e===410&&(t?.code==="route_retired"||t?.error==="route_retired"))return new $c(typeof t?.message=="string"&&t.message.length>0?t.message:"This legacy agent setup route was removed.","legacy_door_removed",{nextAction:EXe(),details:{stage:"retired_door",...typeof t?.replacement=="string"?{replacement:t.replacement}:{}}});if(t?.error==="capability_attach_state_conflict"&&t?.attachId){let c=t.expiresAt?` (expires ${t.expiresAt})`:"",u=t.state?` in state '${t.state}'`:"";return new Ld(`A pending capability-attach ceremony (${t.attachId}) is already${u}${c}. Cancel it in the Visa Console, or wait for it to expire.`,e,"capability_attach_state_conflict",void 0,!1)}if((t?.reason==="policy_step_up_required"||t?.error==="spend_policy_step_up_required")&&typeof t?.stepUp?.reviewUrl=="string")return new Ld(`Owner confirmation required before this payment. Ask the owner to review and approve it at ${t.stepUp.reviewUrl} \u2014 approving shows them a one-time code. Retry the SAME payment passing that code as stepUpToken.`,e,typeof t?.error=="string"?t.error:void 0,"policy_step_up_required",!1);let r=typeof t?.error=="string"?t.error:void 0,n=typeof t?.reason=="string"?t.reason:void 0,i=typeof t?.retryable=="boolean"?t.retryable:void 0,o=typeof t?.message=="string"&&t.message||n||r||"";if(o)return new Ld(o,e,r,n,i);let s=e>=500||e===408||e===425||e===429;return i??s?new Ld(`Request failed (${e}). Try again.`,e,void 0,void 0,i):e===404?new Ld(`Request failed (${e}) \u2014 not found; check the identifier or slug.`,e,void 0,void 0,i):new Ld(`Request failed (${e}).`,e,void 0,void 0,i)}function nh(e){return typeof e=="string"?e.trim():""}function Evr(e){let t=nh(e.error_code)||nh(e.error);return t?t==="SURFACE_DISABLED"||/(_disabled|_not_configured)$/.test(t):!1}function Svr(e){let t=e&&typeof e=="object"?e:{},r=nh(t.error)||nh(t.message);if(!r)return bvr;let n=nh(t.error_code),i=[["surface",nh(t.disabled_surface)],["flag",nh(t.flag)],["correlation_id",nh(t.correlation_id)]].filter(([,s])=>s).map(([s,a])=>`${s}=${a}`),o=i.length?` (${i.join(" ")})`:"";return n?`503 [${n}] ${r}${o}`:`503 ${r}${o}`}function vvr(e=process.env,t=process.stdin.isTTY){let r=["Not logged in. No local Visa CLI session credentials were found."],n=e.VISA_CLI_API_KEY?.trim();return n&&(hvr.test(n)?(r.push("VISA_CLI_API_KEY is set, but this operation requires an enrolled device session."),r.push("Use the Visa Key with X-Api-Key on the /v2/harness/* surface.")):r.push("VISA_CLI_API_KEY is set but has invalid format (expected vk_live_<...> or vk_test_<...>).")),r.push("Run `visa connect` to sign in and connect this device session."),t===!1&&r.push("Complete sign-in in a normal terminal with `visa connect`, then restart the MCP client."),r.join(`
+`)}function J_(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function W_(e){return e===null||typeof e=="string"}function Y_(e,t){let r=e[t];return typeof r=="string"&&r.length>0?r:void 0}function Tvr(e){if(!J_(e))throw new Error("account activity returned a malformed entry");let t=e.rail;if(t!=="card"&&t!=="x402")throw new Error("account activity entry is missing a valid rail label");let r=e.amountUsd,n={id:e.id,operationId:e.operationId,merchant:e.merchant,description:e.description,currency:e.currency,status:e.status,createdAt:e.createdAt};for(let[i,o]of Object.entries(n))if(typeof o!="string"||o.length===0)throw new Error(`account activity entry is missing ${i}`);if(typeof r!="number"||!Number.isFinite(r))throw new Error("account activity entry is missing a numeric amount");return{id:n.id,operationId:n.operationId,merchant:n.merchant,description:n.description,amountUsd:r,currency:n.currency,status:n.status,rail:t,createdAt:n.createdAt,...Y_(e,"failurePhase")?{failurePhase:e.failurePhase}:{},...Y_(e,"finalizesBy")?{finalizesBy:e.finalizesBy}:{},...Y_(e,"agentId")?{agentId:e.agentId}:{},...Y_(e,"agentName")?{agentName:e.agentName}:{},...Y_(e,"grantId")?{grantId:e.grantId}:{},...Y_(e,"mandateId")?{mandateId:e.mandateId}:{},...Y_(e,"drawId")?{drawId:e.drawId}:{},...Y_(e,"transactionHash")?{transactionHash:e.transactionHash}:{},...Y_(e,"transactionNetwork")?{transactionNetwork:e.transactionNetwork}:{}}}function Avr(e){if(!J_(e))return null;let{payment:t,route:r,party:n,authority:i,outcome:o}=e;return e.schemaVersion!==1||typeof e.operationId!="string"||typeof e.activityId!="string"||!J_(t)||typeof t.amountAtomic!="string"||typeof t.decimals!="number"||!Number.isSafeInteger(t.decimals)||t.decimals<0||typeof t.currency!="string"||typeof t.merchant!="string"||typeof t.description!="string"||typeof t.createdAt!="string"||!J_(r)||r.rail!=="wallet"&&r.rail!=="card"||!W_(r.protocol)||!W_(r.network)||!W_(r.cardLast4)||!J_(n)||!W_(n.agentId)||!W_(n.agentName)||!J_(i)||!W_(i.grantId)||!W_(i.mandateId)||!W_(i.drawId)||!J_(o)||typeof o.status!="string"||typeof o.proofLevel!="string"||typeof o.final!="boolean"||typeof o.updatedAt!="string"||!W_(o.finalizesBy)||!Array.isArray(e.evidence)||!e.evidence.every(J_)||!Array.isArray(e.timeline)||!e.timeline.every(J_)||e.dataCompleteness!=="complete"&&e.dataCompleteness!=="partial"?null:e}var pvr,fvr,Jk,mvr,hvr,gvr,Ld,PK,bvr,ff,SS=A(()=>{"use strict";yXe();Dge();u1e();$_();SXe();g1e();TK();wK();o6();IK();pvr=new Set(["local_cli","remote_mcp","mobile","automation","compatibility"]),fvr=new Set(["pending","active","revoked"]);Jk="5.0.0-rc.356",mvr="1",hvr=/^vk_(?:live|test)_[A-Za-z0-9_-]{16,128}$/,gvr=5e3,Ld=class extends Error{constructor(r,n,i,o,s){super(r);this.status=n;this.code=i;this.detail=o;this.serverRetryable=s;this.name="ApiHttpError"}status;code;detail;serverRetryable;get retryable(){return this.serverRetryable??(this.status>=500||this.status===408||this.status===425||this.status===429)}};PK=class extends Error{constructor(r){super("Failed to retrieve task: Task not found");this.taskId=r;this.name="McpTaskNotFoundError"}taskId;rpcCode=-32602};bvr="Visa CLI is temporarily unavailable. Try again, or report at https://github.com/Visa-Crypto-Labs/Visa-mono/issues if it persists.";ff=class{constructor(t){this.getSessionToken=t;this.baseUrl=i6()}getSessionToken;baseUrl;lastSignals={};parseServerSignals(t){if(this.lastSignals={},!rO()){let n=t.headers.get("X-Latest-Version");n&&h1e(n,Jk)&&(this.lastSignals.updateAvailable={currentVersion:Jk,latestVersion:n})}let r=t.headers.get("X-Feedback-Prompt");if(r)try{this.lastSignals.feedbackPrompt=JSON.parse(r)}catch{}}getClientVersion(){return Jk}getAuthServerOrigin(){return this.baseUrl}async signUcpRequest(t){let r=await this.request("POST","/v4/ucp/sign",t,15e3);if(!r||typeof r!="object"||Array.isArray(r)||!r.headers||typeof r.headers!="object"||Array.isArray(r.headers))throw new Error("UCP signing service returned a malformed response");let n=r.headers,i=Object.keys(n).sort(),o=["content-digest","signature","signature-input"];if(i.length!==o.length||i.some((s,a)=>s!==o[a])||o.some(s=>typeof n[s]!="string"||n[s].length===0||n[s].length>16384||/[\r\n]/.test(n[s])))throw new Error("UCP signing service returned invalid signature headers");return n}throwIfAttestationDrift(t){if(t?.error_code==="ATTESTATION_KEY_DRIFT")throw new Ck(t.error||"Your biometric key is out of sync with the server.",typeof t.hint=="string"?t.hint:void 0)}async throwServerUnavailable(t){let r=null;try{r=await t.json()}catch{}let n=Svr(r),i=r&&typeof r=="object"?r:{};throw Evr(i)?new $G(n,{status:t.status,disabledSurface:nh(i.disabled_surface)||void 0,flag:nh(i.flag)||void 0,correlationId:nh(i.correlation_id)||void 0}):new FG(n,t.status,typeof i.retryable=="boolean"?i.retryable:!0)}async getAgentSpendability(t){return this.request("GET",`/v1/admin/agents/${encodeURIComponent(t)}/spendability`)}async financialRuntimeRequest(t,r){return this.request("POST",`/v1/financial-runtime/${t}`,r,2e4)}async identityDeviceRequest(t,r){return this.request("POST",`/v1/identity-device/${t}`,r,2e4)}async request(t,r,n,i,o){let s=await this.getSessionToken();if(!s)throw new Mk(vvr());let a={Authorization:`Bearer ${s}`};o&&(t==="GET"?a["X-User-Context"]=encodeURIComponent(o.replace(/[\r\n\0]/g," ").slice(0,1e3)):n={...n||{},user_context:o}),n&&(a["Content-Type"]="application/json");let c;try{c=await _Xe(`${this.baseUrl}${r}`,{method:t,headers:{...a,"X-Visa-CLI-Version":Jk,"X-Visa-Agent-Operations-Version":mvr,"X-Source":"cli",...Yk()},body:n?JSON.stringify(n):void 0,timeoutMs:i})}catch(d){let l=new Error(c1e(d)),p=a1e(d);throw p&&(l.code=p),l}if(this.parseServerSignals(c),c.status===401)throw new Mk("Your device session has expired. Run `visa connect` to refresh it (the device is already enrolled).",c.status);if(c.status===429){let d=_vr(c.headers.get("Retry-After"));throw new zG(`Rate limited \u2014 wait ${d}s, then retry.`,d)}c.status===503&&await this.throwServerUnavailable(c);let u;try{u=await c.json()}catch{if(c.status===500)throw new Ld(`Server error on ${r}. Try again or check https://visacli.sh for status.`,c.status);if(!c.ok){let d=c.status>=500||c.status===429||t==="GET"&&(c.status===408||c.status===425);throw new Ld(d?`Unexpected response from ${r}. Try again.`:`Unexpected response from ${r} (${c.status}).`,c.status,void 0,void 0,d)}throw new Error(`Unexpected response from ${r}.`)}if(!c.ok){if(c.status===426||u?.error==="update_required"||u?.error_code==="update_required"||u?.errorCode==="update_required"){let d=typeof u?.runningVersion=="string"?u.runningVersion:Jk,l=typeof u?.minCompatibleVersion=="string"?u.minCompatibleVersion:NXe;throw new AK(d,l,r)}if(c.status===500){let d=typeof u?.retryable=="boolean"?u.retryable:void 0;throw new Ld(d===!1?`Server error on ${r}. Inspect the server error and reconcile the existing attempt.`:`Server error on ${r}. Try again or check https://visacli.sh for status.`,c.status,typeof u?.error=="string"?u.error:void 0,typeof u?.reason=="string"?u.reason:void 0,d)}throw this.throwIfAttestationDrift(u),yvr(c.status,u)}return u}async emitTelemetry(t){return this.request("POST","/v1/telemetry",{rows:t},gvr)}async merchantDirectorySearch(t,r){let n=new URLSearchParams;return t.provider&&n.set("provider",t.provider),t.q&&n.set("q",t.q),t.protocol&&n.set("protocol",t.protocol),t.maxPriceUsd&&n.set("max_price_usd",t.maxPriceUsd),t.verify&&n.set("verify",t.verify),n.set("limit",String(t.limit)),n.set("offset",String(t.offset)),this.request("GET",`/v1/merchant-directory/search?${n.toString()}`,void 0,void 0,r)}async merchantDirectoryCertified(t){return this.request("GET","/v1/merchant-directory/certified",void 0,void 0,t)}async reportSettlementReceipt(t,r){return this.request("POST","/v4/directory/settlement-receipt",t,void 0,r)}async getAccountActivity(t,r){let n=new URLSearchParams;t!==void 0&&n.set("limit",String(t)),r!==void 0&&n.set("agentId",r);let i=n.size>0?`?${n.toString()}`:"",o=await this.request("GET",`/v4/account/activity${i}`);if(!o||!Array.isArray(o.activity))throw new Error("account activity service returned an invalid response");return o.activity.map(Tvr)}async getAccountActivityReceipt(t){let r;try{r=await this.request("GET",`/v4/account/activity/${encodeURIComponent(t)}`)}catch(i){throw i instanceof Ld&&i.status===404?new $c(`account activity entry not found: ${t}`,"activity_entry_not_found"):i}let n=Avr(r);if(!n)throw new Error("account receipt service returned an invalid or unsupported response");return n}async getStatus(t){return this.request("GET","/v1/status",void 0,void 0,t)}async getAgentTapStatus(t){try{return await this.request("GET",`/v4/agent-bindings/${encodeURIComponent(t)}/tap-status`)}catch{return null}}async listAccountAgents(){try{let t=await this.request("GET","/v4/account/agents");return!t||!Array.isArray(t.agents)?null:t.agents.flatMap(r=>{if(!r||typeof r!="object")return[];let n=r;if(typeof n.agentJkt!="string")return[];let i=n.approvedAuthority,o=i&&typeof i=="object"&&typeof i.grantId=="string"&&typeof i.status=="string"&&typeof i.totalMicros=="string"&&typeof i.perTransactionMicros=="string"&&typeof i.spentMicros=="string"&&typeof i.reservedMicros=="string"&&Array.isArray(i.scopes)?(()=>{let l=i;return{grantId:l.grantId,status:l.status,totalMicros:l.totalMicros,perTransactionMicros:l.perTransactionMicros,spentMicros:l.spentMicros,reservedMicros:l.reservedMicros,scopes:l.scopes.filter(p=>typeof p=="string"),...typeof l.expiresAt=="string"?{expiresAt:l.expiresAt}:{}}})():void 0,s=l=>typeof n[l]=="string"&&n[l].length>0?n[l]:void 0,a=n.executionReadiness,c=a&&typeof a=="object"&&!Array.isArray(a)?(()=>{let l=a,p=["shared","card","wallet"];if(Object.keys(l).some(m=>!p.includes(m))||Object.values(l).some(m=>typeof m!="string"))return;let f=Object.fromEntries(p.filter(m=>m in l).map(m=>[m,l[m]]));return Object.keys(f).length>0?f:void 0})():void 0,u=n.wallet,d=u&&typeof u=="object"&&!Array.isArray(u)?(()=>{let l=u,p=h=>typeof l[h]=="string"?{[h]:l[h]}:{},f=h=>typeof l[h]=="number"&&Number.isFinite(l[h])?{[h]:l[h]}:{},m={...p("walletAddress"),...p("network"),...typeof l.provisioned=="boolean"?{provisioned:l.provisioned}:{},...f("dailyLimitCents"),...f("perTransactionLimitCents")};return Object.keys(m).length>0?m:void 0})():void 0;return[{agentId:typeof n.agentId=="string"?n.agentId:null,agentJkt:n.agentJkt,name:typeof n.name=="string"?n.name:"",revoked:n.revoked===!0,paused:n.paused===!0,...o?{approvedAuthority:o}:{},...s("executionStatus")?{executionStatus:s("executionStatus")}:{},...s("executionStatusReason")?{executionStatusReason:s("executionStatusReason")}:{},...c?{executionReadiness:c}:{},...s("identityKeyStatus")?{identityKeyStatus:s("identityKeyStatus")}:{},...s("tapStatus")?{tapStatus:s("tapStatus")}:{},...d?{wallet:d}:{}}]})}catch{return null}}async listAccountCardMandates(){try{let t=await this.request("GET","/v4/account/card-mandates?includeInactive=1&limit=200");return!t||!Array.isArray(t.mandates)?null:t.mandates.flatMap(r=>{if(!r||typeof r!="object")return[];let n=r;return typeof n.mandateId!="string"||n.mandateId.length===0?[]:[{mandateId:n.mandateId,revokedAt:typeof n.revokedAt=="string"?n.revokedAt:null,expiresAt:typeof n.expiresAt=="string"?n.expiresAt:null}]})}catch{return null}}async revokeAccountCardMandate(t){try{return await this.request("POST",`/v4/account/card-mandates/${encodeURIComponent(t)}/revoke`)}catch{return null}}async getFeatureFlags(){return this.request("GET","/v1/feature-flags")}async checkInternalAccess(t,r,n=!1){let i=await this.request("GET",`/v4/internal-access?feature=${encodeURIComponent(t)}${n?"&strict=1":""}`,void 0,void 0,r);if(typeof i?.allowed!="boolean")throw new Error("Internal access response did not include a boolean allowed field.");return i.allowed}async checkCheckoutAgentAccess(t){return this.checkInternalAccess("checkout-agent",t,!0)}async getAttestationChallenge(){return this.request("GET","/v1/attestation-challenge")}async registerAttestationKey(t,r){return this.request("POST","/v1/attestation-key",{publicKey:t,...r?{attestation:r}:{}})}async setBiometricPreference(t,r){return this.request("POST","/v1/biometric-preference",{...t,confirm:!0},void 0,r)}async logout(t,r){return this.request("POST","/v4/logout",t,void 0,r)}async getAccountSessions(t){return this.request("GET","/v4/account/sessions?redact=true",void 0,void 0,t)}async getSecurityHistory(t=50,r){return this.request("GET",`/v4/account/security-history?limit=${t}&redact=true`,void 0,void 0,r)}async feedback(t,r,n){return this.request("POST","/v1/feedback",{message:t,...r&&{transaction_id:r}},void 0,n)}async createAppApiKey(t){return this.request("POST","/v1/api/keys",t)}async listAppApiKeys(t){let r=new URLSearchParams;t?.limit!=null&&r.set("limit",String(t.limit)),t?.startingAfter!=null&&r.set("starting_after",String(t.startingAfter)),t?.endingBefore!=null&&r.set("ending_before",String(t.endingBefore));let n=r.toString();return this.request("GET",n?`/v1/api/keys?${n}`:"/v1/api/keys")}async listAllAppApiKeys(){let t=[],r=new Set,n,i=null,o=0;for(;;){let s=await this.listAppApiKeys({limit:100,...n!==void 0?{startingAfter:n}:{}});if(o+=1,i=s,t.push(...s.keys??[]),!s.has_more)break;if(s.next_cursor==null)throw new Error("API key pagination response did not include next_cursor.");if(r.has(s.next_cursor))throw new Error("API key pagination cursor did not advance.");r.add(s.next_cursor),n=s.next_cursor}return{...i??{success:!0,keys:[]},keys:t,limit:100,has_more:!1,next_cursor:null,previous_cursor:null,pages:o}}async revokeAppApiKey(t){return this.request("DELETE",`/v1/api/keys/${encodeURIComponent(String(t))}`)}async putMcpTask(t,r){return this.request("PUT",`/v1/mcp-tasks/${encodeURIComponent(t)}`,r)}async getMcpTask(t){try{return await this.request("GET",`/v1/mcp-tasks/${encodeURIComponent(t)}`)}catch(r){throw r instanceof PK?r:r instanceof Ld&&r.status===404?new PK(t):r}}async createCapabilityAttach(t,r){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/capability-attach`,{protocolVersion:2,capability:r.capability,...r.aggregateCeilingCents!==void 0?{aggregateCeilingCents:r.aggregateCeilingCents}:{},...r.perPurchaseCents!==void 0?{perPurchaseCents:r.perPurchaseCents}:{},...r.aggregateCeilingMicros!==void 0?{aggregateCeilingMicros:r.aggregateCeilingMicros}:{},...r.perTransactionMicros!==void 0?{perTransactionMicros:r.perTransactionMicros}:{},...r.termsMode?{termsMode:r.termsMode}:{},...r.deviceWalletPublicKey?{deviceWalletPublicKey:r.deviceWalletPublicKey}:{},...r.redelivery?{redelivery:!0}:{}})}async getCapabilityAttachStatus(t,r){return this.request("GET",`/v4/agents/${encodeURIComponent(t)}/capability-attach/${encodeURIComponent(r)}`)}async cancelCapabilityAttach(t,r){let n=await this.request("POST",`/v4/agents/${encodeURIComponent(t)}/capability-attach/${encodeURIComponent(r)}/reject`,{});return{cancelled:n?.rejected===!0,...typeof n?.state=="string"?{state:n.state}:{}}}async revokeSpendingAuthority(t){let r=await this.request("POST",`/v4/agents/${encodeURIComponent(t)}/spending-authority/revoke`,{});if(typeof r?.revoked!="boolean")throw new Error("spending authority revoke service returned an invalid response");return{revoked:r.revoked}}async pauseAgent(t){return{paused:(await this.request("POST",`/v4/account/agents/${encodeURIComponent(t)}/pause`,{}))?.paused===!0}}async renameAgent(t,r){let n=await this.request("PATCH",`/v4/account/agents/${encodeURIComponent(t)}/display-name`,{displayName:r});if(typeof n.displayName!="string")throw new Error("rename service returned an invalid display name");return{renamed:n?.renamed===!0,displayName:n.displayName}}async resumeAgent(t){return{resumed:(await this.request("POST",`/v4/account/agents/${encodeURIComponent(t)}/resume`,{}))?.resumed===!0}}async listAgentRuntimes(t){let r=await this.request("GET",`/v4/account/agents/${encodeURIComponent(t)}/runtimes`);if(!Array.isArray(r.runtimes))throw new Error("runtime service returned an invalid list");return r.runtimes.map(LXe)}async revokeAgentRuntime(t,r){let n=await this.request("POST",`/v4/account/agents/${encodeURIComponent(t)}/runtimes/${encodeURIComponent(r)}/revoke`,{});if(n.outcome!=="revoked"&&n.outcome!=="already_revoked")throw new Error("runtime service returned an invalid revoke result");return{outcome:n.outcome,runtime:LXe(n.runtime)}}async claimAgentForApp(t,r){return{claimed:(await this.request("POST","/v4/account/agent-apps",{agentId:t,harnessId:r}))?.claimed===!0}}async issueAgentEmailChannel(t,r){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/channels/email`,{},void 0,r)}async beginAgentMailRuntimeCredential(t,r){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/channels/email/runtime-credential`,{},void 0,r)}async claimAgentMailRuntimeCredential(t,r,n){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/channels/email/runtime-credentials/${encodeURIComponent(r)}/claim`,n)}async forgetAgentMailRuntimeCredential(t,r){return this.request("POST",`/v4/agents/${encodeURIComponent(t)}/channels/email/forget`,{},void 0,r)}async signTurnkeyTapPayload(t,r){let n=await this.request("POST",`/v4/account/agents/${encodeURIComponent(t)}/keychain/tap-sign`,{signatureBase:r});if(typeof n.signature!="string"||typeof n.keyId!="string")throw new Error("TAP signing service returned an invalid response");return{signature:n.signature,keyId:n.keyId}}}});function sO(e=process.env){return R1e.join(To(e),"session-recovery")}function iO(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function RK(e,t){let r=new Set(t);return Object.keys(e).every(n=>r.has(n))}function rTr(e){let t=e.toLowerCase().replace(/^\[(.*)\]$/,"$1");if(t==="localhost"||t==="::1")return!0;let r=t.split(".");return r.length===4&&r[0]==="127"&&r.every(n=>/^\d{1,3}$/.test(n)&&Number(n)<=255)}function X_(e){if(typeof e!="string"||e.length===0||e.length>tTr)throw new Error("v4 sign-in URL must be a bounded web origin");let t;try{t=new URL(e)}catch{throw new Error("v4 sign-in URL must be a bounded web origin")}if(t.username.length>0||t.password.length>0||t.search.length>0||t.hash.length>0||t.pathname!==""&&t.pathname!=="/"||t.protocol!=="https:"&&!(t.protocol==="http:"&&rTr(t.hostname)))throw new Error("v4 sign-in URL must use an HTTPS origin (or HTTP loopback)");return t.origin}function TS(e){let t=(0,oO.createHash)("sha256").update(`${e}:visa-cli-handoff-confirm`,"utf8").digest(),r="";for(let n=0;n<Qvr;n+=1)r+=tZe[t[n]%tZe.length];return r}function NK(e=sO()){return R1e.join(e,Zvr)}function nTr(e){vS.mkdirSync(e,{recursive:!0,mode:448});let t=vS.lstatSync(e);if(t.isSymbolicLink()||!t.isDirectory())throw new Error("login recovery directory must be a real directory, not a symlink");vS.chmodSync(e,448),Vc(e)}function iTr(e){if(!iO(e)||!RK(e,["verifier","challenge","baseUrl","createdAt","expiresAt","serverSkewMs"])||typeof e.verifier!="string"||!eZe.test(e.verifier)||typeof e.challenge!="string"||!eZe.test(e.challenge)||typeof e.baseUrl!="string"||!Number.isSafeInteger(e.createdAt)||e.createdAt<0||e.expiresAt!==void 0&&(!Number.isSafeInteger(e.expiresAt)||e.expiresAt<0)||e.serverSkewMs!==void 0&&!Number.isSafeInteger(e.serverSkewMs))return!1;try{return X_(e.baseUrl)===e.baseUrl&&(0,oO.createHash)("sha256").update(e.verifier,"utf8").digest("base64url")===e.challenge}catch{return!1}}function iZe(e=sO()){let t=Xl(NK(e),{maxBytes:8192});if(t===null)return null;let r;try{r=JSON.parse(t)}catch{throw new Error("local login recovery state contains invalid JSON")}if(!iTr(r))throw new Error("local login recovery state is invalid");return r}function N1e(e){return e.expiresAt!==void 0?{deadline:e.expiresAt,skewMs:e.serverSkewMs??0,source:"server"}:{deadline:e.createdAt+Xvr,skewMs:0,source:"local"}}function oZe(e=Date.now(),t=sO()){let r=iZe(t);if(!r)return null;let n=TS(r.verifier),{deadline:i,skewMs:o,source:s}=N1e(r),a=Math.max(0,i-(e+o)),c=Math.floor(a/1e3),u=aZe(r,e);return{verifier:r.verifier,challenge:r.challenge,confirmCode:n,baseUrl:r.baseUrl,createdAt:r.createdAt,expiresAt:new Date(i-o).toISOString(),remainingSeconds:c,likelyExpired:u,expirySource:s}}function rZe(e=sO()){Vc(e)&&vS.rmSync(NK(e),{force:!0})}async function sTr(e,t,r,n){try{let i=await r(`${e.baseUrl}${oTr}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({challenge:e.challenge}),signal:AbortSignal.timeout(n),redirect:"error"});if(!i.ok)return null;let o=await i.json().catch(()=>null);if(!iO(o)||o.ok!==!0)return null;let s=typeof o.serverTime=="string"?Date.parse(o.serverTime):NaN,a=o.ttlMs;return!Number.isSafeInteger(s)||s<0||typeof a!="number"||!Number.isSafeInteger(a)||a<=0||a>nZe?null:{expiresAt:s+a,skewMs:s-t}}catch{return null}}async function sZe(e,t=Date.now(),r=sO(),n={}){if(!Number.isSafeInteger(t)||t<0)throw new Error("login handoff time is invalid");let i=X_(e),o=Zk(n.requestTimeoutMs,5e3,"login announce timeout"),s=n.fetchImpl??fetch,a=(0,oO.randomBytes)(32).toString("base64url"),c=(0,oO.createHash)("sha256").update(a,"utf8").digest("base64url"),u={verifier:a,challenge:c,baseUrl:i,createdAt:t};nTr(r),Fc(NK(r),JSON.stringify(u,null,2));let d=await sTr(u,t,s,o);d&&(u.expiresAt=d.expiresAt,u.serverSkewMs=d.skewMs,Fc(NK(r),JSON.stringify(u,null,2)));let{deadline:l,skewMs:p,source:f}=N1e(u);return{challenge:c,confirmCode:TS(a),expiresAt:new Date(l-p).toISOString(),expirySource:f}}function Zk(e,t,r){let n=e??t;if(!Number.isSafeInteger(n)||n<=0||n>nZe)throw new Error(`${r} must be a positive integer within the supported range`);return n}function aZe(e,t=Date.now()){let{deadline:r,skewMs:n}=N1e(e);return t+n>r}function aTr(e){if(!iO(e)||!RK(e,["payload"])||!iO(e.payload)||!RK(e.payload,["cliSessionToken","ownerProfile"]))return null;let t=e.payload.cliSessionToken,r=e.payload.ownerProfile;return typeof t!="string"||!t.trim()||t.length>eTr||!iO(r)||!RK(r,["ownerPublicId","loginLabel","authOrigin"])||typeof r.ownerPublicId!="string"||typeof r.loginLabel!="string"||typeof r.authOrigin!="string"?null:{sessionToken:t,ownerProfile:{ownerPublicId:r.ownerPublicId,loginLabel:r.loginLabel,authOrigin:r.authOrigin}}}async function cZe(e,t={}){let r=t.loginDir??sO(),n;try{n=iZe(r)}catch(y){return{status:"error",message:y instanceof Error?y.message:String(y)}}if(!n)return{status:"no_pending"};if(e!==void 0){let y;try{y=X_(e)}catch(S){return{status:"error",message:S instanceof Error?S.message:String(S)}}if(y!==n.baseUrl)return{status:"error",message:"V4 sign-in origin does not match the pending handoff. Run agent login again."}}let i,o,s,a;try{i=Zk(t.attempts,1,"login claim attempts"),o=Zk(t.delayMs,1e3,"login claim interval"),s=Zk(t.requestTimeoutMs,1e4,"login claim request timeout"),a=t.overallTimeoutMs===void 0?void 0:Zk(t.overallTimeoutMs,1,"login claim overall timeout")}catch(y){return{status:"error",message:y instanceof Error?y.message:String(y)}}let c=t.fetchImpl??fetch,u=t.sleep??(y=>new Promise(S=>setTimeout(S,y))),d=t.now??Date.now,l=a===void 0?void 0:d()+a,p=`${n.baseUrl}/api/vgs/cli-handoff/claim`,f=null,m=n,h=m.expiresAt!==void 0,g=()=>f==="expired"||f==="unknown"&&h?{status:"not_ready",likelyExpired:!0,expirySource:"server"}:f==="pending"?{status:"not_ready",likelyExpired:!1,expirySource:"server"}:{status:"not_ready",likelyExpired:aZe(m,d()),expirySource:"local"};for(let y=0;y<i;y+=1){let S=l===void 0?s:l-d();if(S<=0)return g();let b,E=AbortSignal.timeout(Math.max(1,Math.min(s,S)));try{b=await c(p,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({verifier:n.verifier}),signal:E,redirect:"error"})}catch(w){if(E.aborted||iO(w)&&w.name==="TimeoutError"){if(l!==void 0&&d()>=l)return g();if(y+1<i){let I=l===void 0?o:l-d();if(I<=0)return g();await u(Math.min(o,I));continue}return{status:"error",message:"V4 sign-in claim request timed out."}}if(y+1<i){let I=l===void 0?o:l-d();if(I<=0)return g();await u(Math.min(o,I));continue}return{status:"error",message:`Could not reach the v4 sign-in service: ${w instanceof Error?w.message:String(w)}`}}if(b.ok){let w=await b.json().catch(()=>null),I=aTr(w);if(!I)return{status:"error",message:"Sign-in response was not a session-only handoff. Restart with visa agent login --restart."};try{let N=NYe(I.ownerProfile);await sn.saveProfileSessionToken(N,I.sessionToken,{preserveLegacy:!0}),CYe(N),await sn.retireLegacySessionToken()}catch{return{status:"error",message:"The session reached this device but could not be saved. Fix local credential storage, then restart with visa agent login --restart."}}return rZe(r),{status:"claimed"}}if(b.status===404){let w=await b.json().catch(()=>null),I=typeof w?.serverTime=="string"&&typeof w.error=="string"?w.error:null;if(I==="expired"?f="expired":I==="unknown_handoff"?f="unknown":I==="not_ready"&&(f="pending"),f==="expired"||f==="unknown"&&h)return g();if(y+1<i){let N=l===void 0?o:l-d();if(N<=0)return g();await u(Math.min(o,N))}continue}if(b.status===409)return{status:"confirm_mismatch",confirmCode:TS(n.verifier)};if(b.status===422)return rZe(r),{status:"error",message:"Sign-in pickup was not login-only. Run agent login again."};if(b.status===429)return g();let T=await b.json().catch(()=>null);return{status:"error",message:typeof T?.error=="string"&&T.error.length<=512?T.error:`V4 sign-in claim failed (${b.status}).`}}return g()}var oO,vS,R1e,Xvr,Zvr,eZe,tZe,Qvr,eTr,tTr,nZe,oTr,CK=A(()=>{"use strict";oO=require("node:crypto"),vS=ie(require("node:fs")),R1e=ie(require("node:path"));$0();mS();q_();kd();Xvr=15*6e4;Zvr="pending.json",eZe=/^[A-Za-z0-9_-]{43}$/,tZe="ABCDEFGHJKMNPQRSTUVWXYZ23456789",Qvr=6,eTr=512,tTr=2048,nZe=2147483647;oTr="/api/vgs/cli-handoff/announce"});function _Tr(e){return[["openclaw",tD.join(e,".openclaw")],["hermes",tD.join(e,".hermes")],["claude-code",tD.join(e,".claude")],["codex",tD.join(e,".codex")]]}function D1e(e=process.env,t={}){if(e.VISA_CLI_RUNTIME&&e.VISA_CLI_RUNTIME.trim().length>0)return e.VISA_CLI_RUNTIME.trim();if(e.AGENT_RUNTIME&&e.AGENT_RUNTIME.trim().length>0)return e.AGENT_RUNTIME.trim();let r=s=>Object.entries(e).some(([a,c])=>a.startsWith(s)&&typeof c=="string"&&c.trim()!==""),n=new Set;if(r("CODEX_")&&n.add("codex"),(typeof e.CLAUDECODE=="string"&&e.CLAUDECODE.trim()!==""||r("CLAUDE_CODE_")||typeof e.CLAUDE_PROJECT_DIR=="string"&&e.CLAUDE_PROJECT_DIR.trim()!=="")&&n.add("claude-code"),r("OPENCLAW_")&&n.add("openclaw"),r("HERMES_")&&n.add("hermes"),n.size>0)return n.size===1?n.values().next().value:void 0;let i=t.home??hZe.homedir(),o=_Tr(i).filter(([,s])=>mZe.existsSync(s));return o.length===1?o[0][0]:void 0}function kK(e=process.env,t={}){switch(D1e(e,t)){case"claude-code":return"claude";case"codex":return"codex";case"openclaw":return"openclaw";case"hermes":return"hermes";default:return"claude"}}var mZe,hZe,tD,L1e=A(()=>{"use strict";mZe=ie(require("fs")),hZe=ie(require("os")),tD=ie(require("path"))});var dD=_((cwi,WQe)=>{"use strict";var NTr=Object.create,ZK=Object.defineProperty,CTr=Object.getOwnPropertyDescriptor,zZe=Object.getOwnPropertyNames,MTr=Object.getPrototypeOf,kTr=Object.prototype.hasOwnProperty,DTr=(e,t)=>function(){try{return t||(0,e[zZe(e)[0]])((t={exports:{}}).exports,t),t.exports}catch(n){throw t=0,n}},LTr=(e,t)=>{for(var r in t)ZK(e,r,{get:t[r],enumerable:!0})},GZe=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of zZe(t))!kTr.call(e,i)&&i!==r&&ZK(e,i,{get:()=>t[i],enumerable:!(n=CTr(t,i))||n.enumerable});return e},KZe=(e,t,r)=>(r=e!=null?NTr(MTr(e)):{},GZe(t||!e||!e.__esModule?ZK(r,"default",{value:e,enumerable:!0}):r,e)),UTr=e=>GZe(ZK({},"__esModule",{value:!0}),e),BTr=DTr({"../shared/dist/canonical-contract.js"(e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.CANONICAL_OPAQUE_ID_MAX_BYTES=e.CANONICAL_OPAQUE_ID_RE=e.CANONICAL_OPAQUE_ID_PATTERN=void 0,e.utf8ByteLength=n,e.isCanonicalText=i,e.compareCanonicalKeys=o,e.isCanonicalOpaqueId=s,e.assertCanonicalOpaqueId=a,e.CANONICAL_OPAQUE_ID_PATTERN="^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",e.CANONICAL_OPAQUE_ID_RE=new RegExp(e.CANONICAL_OPAQUE_ID_PATTERN),e.CANONICAL_OPAQUE_ID_MAX_BYTES=128;var t=/[\u0000-\u001f\u007f\u2028\u2029]/,r=new TextEncoder;function n(c){return r.encode(c).length}function i(c,u){return typeof c=="string"&&c.length>0&&n(c)<=u&&c.trim()===c&&c.normalize("NFC")===c&&!t.test(c)}function o(c,u){let d=r.encode(c),l=r.encode(u),p=Math.min(d.length,l.length);for(let f=0;f<p;f+=1)if(d[f]!==l[f])return d[f]-l[f];return d.length-l.length}function s(c){return typeof c=="string"&&n(c)<=e.CANONICAL_OPAQUE_ID_MAX_BYTES&&e.CANONICAL_OPAQUE_ID_RE.test(c)}function a(c,u="value"){if(!s(c))throw new Error(`${u} must be a canonical opaque id (max 128 ASCII bytes)`)}}}),WZe={};LTr(WZe,{AGENT_AUTHORITY_VALUATION_POLICY:()=>FK,AGENT_AUTHORITY_VERSION:()=>Q_,AGENT_AUTHORIZATION_SCOPES:()=>ey,AGENT_BUDGET_EPOCH_MODES:()=>TQe,AGENT_CAPABILITY_ATTACH_CAPABILITIES:()=>YK,AGENT_CHANNEL_ASSURANCES:()=>RQe,AGENT_CHANNEL_KINDS:()=>xQe,AGENT_CHANNEL_STATUSES:()=>OQe,AGENT_EXECUTION_READINESS_REASONS:()=>$Ar,AGENT_HANDOFF_AUTHORITIES:()=>c2r,AGENT_HANDOFF_COMPOUND_AUTHORITY:()=>e_e,AGENT_KEY_CUSTODIES:()=>IQe,AGENT_KEY_PURPOSES:()=>wQe,AGENT_KEY_STATUSES:()=>PQe,AGENT_PAIRING_CODE_ALPHABET:()=>dO,AGENT_PAIRING_CODE_LENGTH:()=>sD,AGENT_PAIRING_PROTOCOL_VERSION:()=>d2r,AGENT_PAIRING_PROTOCOL_VERSION_V2:()=>JK,DOMAINS:()=>NAr,USD_MICROS_PER_CENT:()=>nW,VIC_PROCESSOR_ACTIONS:()=>AQe,VIC_SETTLEMENT_ENVELOPE_KIND:()=>VK,VIC_SETTLEMENT_ENVELOPE_VERSION:()=>HK,agentAuthorityGrantHash:()=>o2r,agentMailCredentialClaimMessageV2:()=>G2r,authorizationScopeFacts:()=>t2r,base64ToBytes:()=>yQe,base64UrlToBytes:()=>rW,bytesToBase64:()=>_Qe,bytesToBase64Url:()=>ry,bytesToHex:()=>gQe,canonicalAgentAuthorityGrant:()=>Z1e,canonicalAgentChannelDescriptor:()=>i2r,canonicalAgentKeyDescriptor:()=>r2r,canonicalFormAgent:()=>CAr,canonicalPairingDeliveryArtifactV2:()=>KQe,canonicalPairingTerms:()=>VQe,canonicalPairingTermsV2:()=>i_e,canonicalSpendAuthorizationIntent:()=>Q1e,canonicalVicSettlementEnvelope:()=>kQe,capabilityAttachActivationMessageV2:()=>K2r,capabilityAttachClaimHashV2:()=>$2r,capabilityAttachClaimMessageV2:()=>zQe,centsToUsdMicros:()=>QAr,concatBytes:()=>X1e,extractEd25519Seed:()=>FAr,formatPairingCode:()=>uD,generateKeyPair:()=>wAr,generateSeed:()=>mQe,getPublicKey:()=>tW,handoffAuthorityCapabilities:()=>u2r,hexToBytes:()=>J1e,isCanonicalBase64Url32:()=>oc,isValidPairingCode:()=>qQe,jwkToKeyPair:()=>LAr,jwkToPublicKey:()=>DAr,jwkToSeed:()=>SQe,keyPairFromSeed:()=>hQe,keyRotationClaimHashV2:()=>z2r,keyRotationClaimMessageV2:()=>GQe,normalizePairingCode:()=>aW,pairingActivationMessage:()=>H2r,pairingActivationMessageV2:()=>F2r,pairingArtifactHash:()=>Y2r,pairingClaimHashV2:()=>V2r,pairingClaimMessage:()=>q2r,pairingClaimMessageV2:()=>$Qe,pairingClaimTokenHash:()=>HQe,pairingCodeFromClaimToken:()=>L2r,pairingCodeHash:()=>k2r,pairingConfirmationCode:()=>U2r,pairingDeliveryArtifactV2Hash:()=>W2r,pairingInstrumentCommitment:()=>I2r,pairingSha256:()=>hf,pairingTermsHash:()=>j2r,pairingTermsV2Hash:()=>FQe,pairingVerifierChallenge:()=>C2r,pkcs8ToSeed:()=>HAr,publicKeyToJwk:()=>kAr,publicKeyToSpki:()=>qAr,randomAttachId:()=>x2r,randomHandoffId:()=>O2r,randomPairingClaimToken:()=>D2r,randomPairingCode:()=>M2r,randomPairingId:()=>P2r,randomPairingVerifier:()=>N2r,randomSetupOperationId:()=>R2r,seedToJwk:()=>MAr,seedToPkcs8:()=>jAr,setupConfirmationCode:()=>B2r,sign:()=>IAr,signAsync:()=>xAr,spendAuthorizationIntentHash:()=>DQe,spkiToPublicKey:()=>VAr,subwayAgentMsgV1:()=>bQe,usdcAtomicToUsdMicros:()=>e2r,verify:()=>PAr,verifyAsync:()=>OAr,vicSettlementEnvelopeHash:()=>s2r,walletAuthorizationRequestHash:()=>a2r});WQe.exports=UTr(WZe);var QK=Object.freeze,uO=0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn,$K=0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3edn,jK=0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3n,j1e=0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an,q1e=0x6666666666666666666666666666666666666666666666666666666666666658n,qK=uO-1n,jTr=QK({p:uO,n:$K,h:8n,a:qK,d:jK,Gx:j1e,Gy:q1e}),xS=32,PZe=e=>e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"&&e.BYTES_PER_ELEMENT===1,np=(e,t,r="")=>{if(PZe(e)&&(t===void 0||e.length===t))return e;let n=PZe(e),i=t!==void 0?` of length ${t}`:"",o=n?`length=${e.length}`:`type=${typeof e}`,s=(r?`"${r}" `:"")+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)},eW=(e,t="",r)=>Uint8Array.from(np(e,r,t)),YZe=(e,t)=>e.toString(16).padStart(t,"0"),F1e=e=>{let t="";for(let r of np(e))t+=YZe(r,2);return t},$1e=e=>{let t="hex invalid";if(typeof e!="string")throw new TypeError(t);if(e.length%2||!/^[\da-f]*$/i.test(e))throw new RangeError(t);let r=new Uint8Array(e.length/2);for(let n=0,i=0;n<r.length;n++,i+=2){let o=e.charCodeAt(i),s=e.charCodeAt(i+1);r[n]=((o&15)+(o>>6)*9)*16+(s&15)+(s>>6)*9}return r},u6=(...e)=>{let t=0;for(let i of e)t+=np(i).length;let r=new Uint8Array(t),n=0;for(let i of e)r.set(i,n),n+=i.length;return r},JZe=(e=xS)=>{let t=globalThis?.crypto;if(typeof t?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined, consider polyfill");return t.getRandomValues(new Uint8Array(e))},s6=(e,t,r,n="bad number: out of range")=>{if(typeof e!="bigint")throw new TypeError(n);if(t<=e&&e<r)return e;throw new RangeError(n)},fi=(e,t=uO)=>(e%=t)>=0n?e:t+e,xZe=(1n<<255n)-1n,Ye=e=>{if(e<0n)throw new RangeError("negative coordinate");let t=(e>>255n)*19n+(e&xZe);return t=(t>>255n)*19n+(t&xZe),t%uO},XZe=e=>fi(e,$K),ZZe=(e,t)=>{if(e===0n)throw new Error("invert: expected non-zero number");if(t<=1n)throw new Error("invert: expected modulus > 1, got "+t);let r=fi(e,t),n=t,i=0n,o=1n;for(;r!==0n;){let a=n/r,c=n-r*a,u=i-o*a;n=r,r=c,i=o,o=u}if(n!==1n)throw new Error("invert: does not exist");return fi(i,t)},QZe=e=>{let t=cQe[e];if(typeof t!="function")throw new Error("hashes."+e+" not set");return t},z1e=(e,...t)=>np(QZe(e)(u6(...t)),64,"digest"),G1e=async(e,...t)=>np(await QZe(e)(u6(...t)),64,"digest"),U1e=e=>{if(e instanceof d6)return e;throw new TypeError("Point expected")},eQe=2n**256n,d6=class a6{static BASE;static ZERO;X;Y;Z;T;constructor(t,r,n,i){let o=eQe;this.X=s6(t,0n,o),this.Y=s6(r,0n,o),this.Z=s6(n,1n,o),this.T=s6(i,0n,o),QK(this)}static CURVE(){return jTr}static fromAffine(t){return new a6(t.x,t.y,1n,Ye(t.x*t.y))}static fromBytes(t,r=!1){let n=eW(t,"point",xS),i=n[31];n[31]=i&-129;let o=K1e(n);r||s6(o,0n,uO);let s=Ye(o*o),a=fi(s-1n),c=Ye(jK*s+1n),{isValid:u,value:d}=HTr(a,c);if(!u)throw new Error("bad point: y not sqrt");let l=!!(i&128);if(!r&&d===0n&&l)throw new Error("bad point: x==0, isLastByteOdd");return l!==!!(d&1n)&&(d=fi(-d)),new a6(d,o,1n,Ye(d*o))}static fromHex(t,r){return a6.fromBytes($1e(t),r)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}assertValidity(){let t=qK,r=jK,n=this;if(n.is0())throw new Error("bad point: ZERO");let{X:i,Y:o,Z:s,T:a}=n,c=Ye(i*i),u=Ye(o*o),d=Ye(s*s),l=Ye(d*d),p=Ye(c*t),f=Ye(d*(p+u)),m=fi(l+Ye(r*Ye(c*u)));if(f!==m)throw new Error("bad point: equation left != right (1)");let h=Ye(i*o),g=Ye(s*a);if(h!==g)throw new Error("bad point: equation left != right (2)");return this}equals(t){let{X:r,Y:n,Z:i}=this,{X:o,Y:s,Z:a}=U1e(t);return Ye(r*a)===Ye(o*i)&&Ye(n*a)===Ye(s*i)}is0(){return this.equals(c6)}negate(){return new a6(fi(-this.X),this.Y,this.Z,fi(-this.T))}double(){let{X:t,Y:r,Z:n}=this,i=qK,o=Ye(t*t),s=Ye(r*r),a=Ye(2n*n*n),c=Ye(i*o),u=fi(t+r),d=fi(Ye(u*u)-o-s),l=fi(c+s),p=fi(l-a),f=fi(c-s),m=Ye(d*p),h=Ye(l*f),g=Ye(d*f),y=Ye(p*l);return new a6(m,h,y,g)}add(t){let{X:r,Y:n,Z:i,T:o}=this,{X:s,Y:a,Z:c,T:u}=U1e(t),d=qK,l=jK,p=Ye(r*s),f=Ye(n*a),m=Ye(Ye(o*l)*u),h=Ye(i*c),g=fi(Ye(fi(r+n)*fi(s+a))-p-f),y=fi(h-m),S=fi(h+m),b=fi(f-Ye(d*p)),E=Ye(g*y),T=Ye(S*b),w=Ye(g*b),I=Ye(y*S);return new a6(E,T,I,w)}subtract(t){return this.add(U1e(t).negate())}multiply(t,r=!0){if(!r&&t===0n||(s6(t,1n,$K),!r&&this.is0()))return c6;if(t===1n)return this;if(this.equals(CS))return XTr(t).p;let n=c6,i=CS,o=this;for(let s=0;r?s<256:t>0n;s++)t&1n?n=n.add(o):r&&(i=i.add(o)),o=o.double(),t>>=1n;return n}multiplyUnsafe(t){return this.multiply(t,!1)}toAffine(){let{X:t,Y:r,Z:n}=this;if(this.equals(c6))return{x:0n,y:1n};let i=ZZe(n,uO);if(Ye(n*i)!==1n)throw new Error("invalid inverse");return{x:Ye(t*i),y:Ye(r*i)}}toBytes(){let{x:t,y:r}=this.toAffine(),n=tQe(r);return n[31]|=t&1n?128:0,n}toHex(){return F1e(this.toBytes())}clearCofactor(){return this.multiply(8n,!1)}isSmallOrder(){return this.clearCofactor().is0()}isTorsionFree(){return this.multiply($K/2n,!1).double().add(this).is0()}},CS=new d6(j1e,q1e,1n,fi(j1e*q1e)),c6=new d6(0n,1n,1n,0n);d6.BASE=CS;d6.ZERO=c6;var tQe=e=>$1e(YZe(s6(e,0n,eQe),64)).reverse(),K1e=e=>BigInt("0x"+F1e(Uint8Array.from(np(e)).reverse())),X0=(e,t)=>{let r=e;for(;t-- >0;)r=Ye(r*r);return r},qTr=e=>{let t=Ye(e*e),r=Ye(t*e),n=Ye(X0(r,2)*r),i=Ye(X0(n,1)*e),o=Ye(X0(i,5)*i),s=Ye(X0(o,10)*o),a=Ye(X0(s,20)*s),c=Ye(X0(a,40)*a),u=Ye(X0(c,80)*c),d=Ye(X0(u,80)*c),l=Ye(X0(d,10)*o);return Ye(X0(l,2)*e)},OZe=0x2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0n,HTr=(e,t)=>{let r=Ye(t*Ye(t*t)),n=Ye(Ye(r*r)*t),i=qTr(Ye(e*n)),o=Ye(e*Ye(r*i)),s=Ye(t*Ye(o*o)),a=o,c=Ye(o*OZe),u=s===e,d=s===fi(-e),l=s===fi(-e*OZe);return u&&(o=a),(d||l)&&(o=c),(fi(o)&1n)===1n&&(o=fi(-o)),{isValid:u||d,value:o}},zK=e=>XZe(K1e(e)),rQe=e=>{let t=eW(e),r=t.slice(0,32);r[0]&=248,r[31]&=127,r[31]|=64;let n=t.slice(32),i=zK(r),o=CS.multiply(i),s=o.toBytes();return{head:r,prefix:n,scalar:i,point:o,pointBytes:s}},nQe=e=>G1e("sha512Async",np(e,xS,"secretKey")).then(rQe),W1e=e=>rQe(z1e("sha512",np(e,xS,"secretKey"))),VTr=e=>W1e(e).pointBytes,iQe=async e=>e[1](await G1e("sha512Async",e[0])),oQe=e=>e[1](z1e("sha512",e[0])),sQe=(e,t,r)=>{let{pointBytes:n,scalar:i}=e,o=zK(t),s=CS.multiply(o).toBytes();return[u6(s,n,r),u=>{let d=XZe(o+zK(u)*i);return np(u6(s,tQe(d)),64)}]},FTr=async(e,t)=>{let r=eW(e,"message"),n=await nQe(t);return iQe(sQe(n,await G1e("sha512Async",n.prefix,r),r))},$Tr=(e,t)=>{let r=eW(e,"message"),n=W1e(t);return oQe(sQe(n,z1e("sha512",n.prefix,r),r))},zTr=e=>{if(e===null||typeof e!="object")throw new TypeError("expected valid options object");return e.zip215??!0},aQe=(e,t,r,n)=>{e=np(e,64,"signature"),t=np(t,void 0,"message"),r=np(r,xS,"publicKey");let i=zTr(n),o=e.subarray(0,xS),s=K1e(e.subarray(xS,64)),a,c,u,d=Uint8Array.of(),l=!1;try{a=d6.fromBytes(r,i),c=d6.fromBytes(o,i),u=CS.multiply(s,!1),d=u6(o,r,t),l=!0}catch{}return[d,f=>{if(!l||!i&&a.isSmallOrder())return!1;let m=zK(f);return c.add(a.multiply(m,!1)).subtract(u).clearCofactor().is0()}]},GTr=async(e,t,r,n={})=>iQe(aQe(e,t,r,n)),KTr=(e,t,r,n={})=>oQe(aQe(e,t,r,n)),Y1e=QK({bytesToHex:F1e,hexToBytes:$1e,concatBytes:u6,mod:fi,invert:ZZe,randomBytes:JZe}),cQe={sha512Async:async e=>{let t=globalThis?.crypto?.subtle;if(!t)throw new Error("crypto.subtle must be defined, consider polyfill");return new Uint8Array(await t.digest("SHA-512",u6(e)))},sha512:void 0},WTr=e=>np(e===void 0?JZe():e,xS,"seed"),YTr=QK({getExtendedPublicKeyAsync:nQe,getExtendedPublicKey:W1e,randomSecretKey:WTr}),JTr=()=>{let e=[],t=CS,r;for(let n=0;n<33;n++){r=t,e.push(r);for(let i=1;i<128;i++)r=r.add(t),e.push(r);t=r.double()}return e},RZe=void 0,NZe=(e,t)=>{let r=t.negate();return e?r:t},XTr=e=>{let t=RZe||(RZe=JTr()),r=c6,n=CS;for(let i=0;i<33;i++){let o=Number(e&255n);e>>=8n,o>128&&(o-=256,e+=1n);let s=i*128,a=s+Math.abs(o)-1,c=i%2!==0,u=o<0;o===0?n=n.add(NZe(c,t[s])):r=r.add(NZe(u,t[a]))}if(e!==0n)throw new Error("invalid wnaf");return{p:r,f:n}},LK=BigInt(2**32-1),CZe=BigInt(32);function ZTr(e,t=!1){return t?{h:Number(e&LK),l:Number(e>>CZe&LK)}:{h:Number(e>>CZe&LK)|0,l:Number(e&LK)|0}}function QTr(e,t=!1){let r=e.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let o=0;o<r;o++){let{h:s,l:a}=ZTr(e[o],t);[n[o],i[o]]=[s,a]}return[n,i]}var eAr=e=>e/2**32|0,tAr=e=>e>>>0;function rAr(e,t,r,n){let i=eAr(r),o=tAr(r);e.setUint32(t,n?o:i,n),e.setUint32(t+4,n?i:o,n)}var MZe=(e,t,r)=>e>>>r,kZe=(e,t,r)=>e<<32-r|t>>>r,aO=(e,t,r)=>e>>>r|t<<32-r,cO=(e,t,r)=>e<<32-r|t>>>r,UK=(e,t,r)=>e<<64-r|t>>>r-32,BK=(e,t,r)=>e>>>r-32|t<<64-r;function Z_(e,t,r,n){let i=(t>>>0)+(n>>>0);return{h:e+r+(i/2**32|0)|0,l:i|0}}var nAr=(e,t,r)=>(e>>>0)+(t>>>0)+(r>>>0),iAr=(e,t,r,n)=>t+r+n+(e/2**32|0)|0,oAr=(e,t,r,n)=>(e>>>0)+(t>>>0)+(r>>>0)+(n>>>0),sAr=(e,t,r,n,i)=>t+r+n+i+(e/2**32|0)|0,aAr=(e,t,r,n,i)=>(e>>>0)+(t>>>0)+(r>>>0)+(n>>>0)+(i>>>0),cAr=(e,t,r,n,i,o)=>t+r+n+i+o+(e/2**32|0)|0;function DZe(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in e&&e.BYTES_PER_ELEMENT===1}var H1e=e=>e?`"${e}" `:"";function uAr(e,t=""){if(typeof e!="number")throw new TypeError(H1e(t)+"expected number, got "+typeof e);if(!Number.isSafeInteger(e)||e<0)throw new RangeError(H1e(t)+"expected integer >= 0, got "+e);return e}function uQe(e,t,r=""){if(DZe(e)&&(t===void 0||e.length===t))return e;t!==void 0&&uAr(t,"length");let n=DZe(e),i=t!==void 0?` of length ${t}`:"",o=n?`length=${e.length}`:`type=${typeof e}`,s=H1e(r)+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)}var dAr=(e,t)=>{if(e===null||typeof e!="object"||Array.isArray(e))throw new TypeError((t==="object"?"":`"${t}" `)+"expected object, got type="+typeof e)},LZe=(e,t)=>{dAr(e,t);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${t}" expected plain object`);if(Object.hasOwn(e,"__proto__"))throw new TypeError(`"${t}.__proto__" is not allowed`)};function UZe(e,t=!0){if(e.destroyed)throw new Error("hash was destroyed");if(t&&e.finished)throw new Error("digest() was already called")}function lAr(e,t){uQe(e,void 0,"output");let r=t.outputLen;if(!(e.length>=r))throw new RangeError('"output" expected length >= '+r)}function GK(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function B1e(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function Z0(e,t){return e<<32-t|e>>>t}function pAr(e,t,r="opts"){return LZe(e,"defaults"),t!==void 0&&LZe(t,r),Object.assign(Object.create(null),e,t)}function dQe(e,t={}){if(typeof e!="function")throw new TypeError('"hashCons" expected function, got type='+typeof e);t=pAr({},t,"info");let r=(i,o)=>e(o).update(i).digest(),n=e(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>e(i),Object.assign(r,t),Object.freeze(r)}var lQe=e=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,e])});function fAr(e,t,r){return e&t^~e&r}function mAr(e,t,r){return e&t^e&r^t&r}var pQe=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,t,r,n){this.blockLen=e,this.outputLen=t,this.padOffset=r,this.isLE=n,this.buffer=new Uint8Array(e),this.view=B1e(this.buffer)}update(e){UZe(this),uQe(e);let{view:t,buffer:r,blockLen:n}=this,i=e.length,o=!1;for(let s=0;s<i;){let a=Math.min(n-this.pos,i-s);if(a===n){let c=B1e(e);for(;n<=i-s;s+=n)this.process(c,s);o=!0;continue}r.set(s===0&&a===i?e:e.subarray(s,s+a),this.pos),this.pos+=a,s+=a,this.pos===n&&(this.process(t,0),this.pos=0,o=!0)}return this.length+=e.length,o&&this.roundClean(),this}digestInto(e){UZe(this),lAr(e,this),this.finished=!0;let{buffer:t,view:r,blockLen:n,isLE:i}=this,{pos:o}=this;t[o++]=128,t.fill(0,o),this.padOffset>n-o&&(this.process(r,0),t.fill(0)),rAr(r,n-8,this.length*8,i),this.process(r,0),this.roundClean();let s=e===t?r:B1e(e),a=this.outputLen,c=a/4,u=this.get();if(a%4||c>u.length)throw new Error("invalid outputLen");for(let d=0;d<c;d++)s.setUint32(4*d,u[d],i)}digest(){let{buffer:e,outputLen:t}=this;this.digestInto(e);let r=e.slice(0,t);return this.destroy(),r}_cloneIntoMeta(e){let{buffer:t,length:r,finished:n,destroyed:i,pos:o}=this;return e.destroyed=i,e.finished=n,e.length=r,e.pos=o,o&&e.buffer.set(t),e}clone(){return this._cloneInto()}},hAr=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),gAr=Uint32Array.from([1779033703,4089235720,3144134277,2227873595,1013904242,4271175723,2773480762,1595750129,1359893119,2917565137,2600822924,725511199,528734635,4215389547,1541459225,327033209]),_Ar=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),AS=new Uint32Array(64),yAr=class extends pQe{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,t){super(64,e,8,!1),this.A=t[0]|0,this.B=t[1]|0,this.C=t[2]|0,this.D=t[3]|0,this.E=t[4]|0,this.F=t[5]|0,this.G=t[6]|0,this.H=t[7]|0}get(){let{A:e,B:t,C:r,D:n,E:i,F:o,G:s,H:a}=this;return[e,t,r,n,i,o,s,a]}set(e,t,r,n,i,o,s,a){this.A=e|0,this.B=t|0,this.C=r|0,this.D=n|0,this.E=i|0,this.F=o|0,this.G=s|0,this.H=a|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,t){for(let d=0;d<16;d++,t+=4)AS[d]=e.getUint32(t,!1);for(let d=16;d<64;d++){let l=AS[d-15],p=AS[d-2],f=Z0(l,7)^Z0(l,18)^l>>>3,m=Z0(p,17)^Z0(p,19)^p>>>10;AS[d]=m+AS[d-7]+f+AS[d-16]|0}let{A:r,B:n,C:i,D:o,E:s,F:a,G:c,H:u}=this;for(let d=0;d<64;d++){let l=Z0(s,6)^Z0(s,11)^Z0(s,25),p=u+l+fAr(s,a,c)+_Ar[d]+AS[d]|0,m=(Z0(r,2)^Z0(r,13)^Z0(r,22))+mAr(r,n,i)|0;u=c,c=a,a=s,s=o+p|0,o=i,i=n,n=r,r=p+m|0}r=r+this.A|0,n=n+this.B|0,i=i+this.C|0,o=o+this.D|0,s=s+this.E|0,a=a+this.F|0,c=c+this.G|0,u=u+this.H|0,this.set(r,n,i,o,s,a,c,u)}roundClean(){GK(AS)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),GK(this.buffer)}},bAr=class extends yAr{constructor(){super(32,hAr)}},fQe=QTr(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(e=>BigInt(e))),EAr=fQe[0],SAr=fQe[1],wS=new Uint32Array(80),IS=new Uint32Array(80),vAr=class extends pQe{Ah=0;Al=0;Bh=0;Bl=0;Ch=0;Cl=0;Dh=0;Dl=0;Eh=0;El=0;Fh=0;Fl=0;Gh=0;Gl=0;Hh=0;Hl=0;constructor(e,t){super(128,e,16,!1),this.Ah=t[0]|0,this.Al=t[1]|0,this.Bh=t[2]|0,this.Bl=t[3]|0,this.Ch=t[4]|0,this.Cl=t[5]|0,this.Dh=t[6]|0,this.Dl=t[7]|0,this.Eh=t[8]|0,this.El=t[9]|0,this.Fh=t[10]|0,this.Fl=t[11]|0,this.Gh=t[12]|0,this.Gl=t[13]|0,this.Hh=t[14]|0,this.Hl=t[15]|0}get(){let{Ah:e,Al:t,Bh:r,Bl:n,Ch:i,Cl:o,Dh:s,Dl:a,Eh:c,El:u,Fh:d,Fl:l,Gh:p,Gl:f,Hh:m,Hl:h}=this;return[e,t,r,n,i,o,s,a,c,u,d,l,p,f,m,h]}set(e,t,r,n,i,o,s,a,c,u,d,l,p,f,m,h){this.Ah=e|0,this.Al=t|0,this.Bh=r|0,this.Bl=n|0,this.Ch=i|0,this.Cl=o|0,this.Dh=s|0,this.Dl=a|0,this.Eh=c|0,this.El=u|0,this.Fh=d|0,this.Fl=l|0,this.Gh=p|0,this.Gl=f|0,this.Hh=m|0,this.Hl=h|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,t){for(let S=0;S<16;S++,t+=4)wS[S]=e.getUint32(t),IS[S]=e.getUint32(t+=4);for(let S=16;S<80;S++){let b=wS[S-15]|0,E=IS[S-15]|0,T=aO(b,E,1)^aO(b,E,8)^MZe(b,E,7),w=cO(b,E,1)^cO(b,E,8)^kZe(b,E,7),I=wS[S-2]|0,N=IS[S-2]|0,O=aO(I,N,19)^UK(I,N,61)^MZe(I,N,6),P=cO(I,N,19)^BK(I,N,61)^kZe(I,N,6),x=oAr(w,P,IS[S-7],IS[S-16]),D=sAr(x,T,O,wS[S-7],wS[S-16]);wS[S]=D|0,IS[S]=x|0}let{Ah:r,Al:n,Bh:i,Bl:o,Ch:s,Cl:a,Dh:c,Dl:u,Eh:d,El:l,Fh:p,Fl:f,Gh:m,Gl:h,Hh:g,Hl:y}=this;for(let S=0;S<80;S++){let b=aO(d,l,14)^aO(d,l,18)^UK(d,l,41),E=cO(d,l,14)^cO(d,l,18)^BK(d,l,41),T=d&p^~d&m,w=l&f^~l&h,I=aAr(y,E,w,SAr[S],IS[S]),N=cAr(I,g,b,T,EAr[S],wS[S]),O=I|0,P=aO(r,n,28)^UK(r,n,34)^UK(r,n,39),x=cO(r,n,28)^BK(r,n,34)^BK(r,n,39),D=r&i^r&s^i&s,B=n&o^n&a^o&a;g=m|0,y=h|0,m=p|0,h=f|0,p=d|0,f=l|0,{h:d,l}=Z_(c|0,u|0,N|0,O|0),c=s|0,u=a|0,s=i|0,a=o|0,i=r|0,o=n|0;let M=nAr(O,x,B);r=iAr(M,N,P,D),n=M|0}({h:r,l:n}=Z_(this.Ah|0,this.Al|0,r|0,n|0)),{h:i,l:o}=Z_(this.Bh|0,this.Bl|0,i|0,o|0),{h:s,l:a}=Z_(this.Ch|0,this.Cl|0,s|0,a|0),{h:c,l:u}=Z_(this.Dh|0,this.Dl|0,c|0,u|0),{h:d,l}=Z_(this.Eh|0,this.El|0,d|0,l|0),{h:p,l:f}=Z_(this.Fh|0,this.Fl|0,p|0,f|0),{h:m,l:h}=Z_(this.Gh|0,this.Gl|0,m|0,h|0),{h:g,l:y}=Z_(this.Hh|0,this.Hl|0,g|0,y|0),this.set(r,n,i,o,s,a,c,u,d,l,p,f,m,h,g,y)}roundClean(){GK(wS,IS)}destroy(){this.destroyed=!0,GK(this.buffer),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}},TAr=class extends vAr{constructor(){super(64,gAr)}},aD=dQe(()=>new bAr,lQe(1)),AAr=dQe(()=>new TAr,lQe(3)),BZe=cQe;BZe.sha512||(BZe.sha512=e=>AAr(e));var jZe=32;function mQe(){return YTr.randomSecretKey()}function tW(e){return VTr(e)}function wAr(){let e=mQe();return{secretKey:e,publicKey:tW(e)}}function hQe(e){if(e.length!==jZe)throw new Error(`Ed25519 seed must be ${jZe} bytes, got ${e.length}`);return{secretKey:e,publicKey:tW(e)}}function IAr(e,t){return $Tr(t,e)}function PAr(e,t,r){return KTr(t,r,e)}function xAr(e,t){return FTr(t,e)}function OAr(e,t,r){return GTr(t,r,e)}var gQe=Y1e.bytesToHex,J1e=Y1e.hexToBytes,X1e=Y1e.concatBytes;function _Qe(e){let t="";for(let r=0;r<e.length;r++)t+=String.fromCharCode(e[r]);return btoa(t)}function yQe(e){let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function ry(e){return _Qe(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function rW(e){let t=e.length%4===0?0:4-e.length%4,r=e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat(t);return yQe(r)}var RAr=new TextEncoder,NAr={subwayAgentMsgV1:"message_id;sender_peer_id;sender_name;timestamp_ms;message_type;payload_hash;nonce"};function bQe(e){let t=gQe(aD(e.payload)),r=`${e.messageId}
 ${e.senderPeerId}
 ${e.senderName}
 ${e.timestampMs}
@@ -97,9 +97,9 @@ ${(0,Hxr.prettyStateOverride)(f)}`),super(t.shortMessage,{cause:t,docsPath:n,met
      DO NOTHING`,[r.event_type,r.processor_event_id,r.processor_transaction_id,r.amount_micros,r.currency,r.payload])).rowCount??0)>0}});var h0t=_(gh=>{"use strict";Object.defineProperty(gh,"__esModule",{value:!0});gh.normalizeRailEnvironmentValue=l0t;gh.isLiveVgsEnvironment=ecn;gh.isExplicitProductionRailEnvironment=Vee;gh.isPublicPreviewRailEnvironment=Z4e;gh.clickhouseDatabaseHasStagingMarker=f0t;gh.resolveClickhouseEnvBinding=ncn;gh.resolveDeploymentEnvClass=m0t;gh.detectDeploymentEnvNodeEnvMismatch=icn;gh.isExplicitPreviewPaymentRailOptIn=ocn;var Zan=new Set(["visacli.sh","app.visacli.sh","auth.visacli.sh","mpp.visacli.sh","api.visacli.sh"]),Y4e="visa-code-preview",Qan=new Set(["mpp-visa-code-preview.up.railway.app"]);function Tg(e){return(e||"").trim().toLowerCase()}function X4e(e){let t=Tg(e),r=t;(t.startsWith("http://")||t.startsWith("https://"))&&(r=t.slice(t.indexOf("://")+3));let n=r.indexOf("/");n!==-1&&(r=r.slice(0,n));let i=r.indexOf(":");return i!==-1&&(r=r.slice(0,i)),r.startsWith("www.")?r.slice(4):r}function J4e(e,t){let r="";for(let n of Tg(e)){if(n>="a"&&n<="z"||n>="0"&&n<="9"){r+=n;continue}if(r&&t.has(r))return!0;r=""}return r?t.has(r):!1}function l0t(e){return Tg(e)}function p0t(e){return(e||"").trim()}function ecn(e){return new Set(["live","prod","production"]).has(l0t(e))}function tcn(e){return typeof e=="boolean"?e:p0t(e)==="true"}function Vee(e){let t=X4e(e.railwayPublicDomain),r=Tg(e.railwayEnvironment),n=Tg(e.railwayEnvironmentName),i=Tg(e.railwayGitBranch);return Zan.has(t)||r==="production"||n==="production"||i==="main"||i==="production"}function Z4e(e){if(Vee(e))return!1;let t=X4e(e.railwayPublicDomain),r=new Set(["preview","staging","stage"]),n=new Set(["preview"]),i=Tg(e.railwayGitBranch);return J4e(t,n)||J4e(e.railwayEnvironment,r)||J4e(e.railwayEnvironmentName,r)||i==="staging"||i==="preview"||t.endsWith(".up.railway.app")||t.endsWith(".railway.app")}var rcn=new Set(["staging","stage","preview"]);function f0t(e){let t=Tg(e);if(!t)return!1;for(let r of t.split(/[^a-z0-9]+/))if(rcn.has(r))return!0;return!1}function ncn(e){let t=(e.clickhouseDatabase||"").trim(),r=f0t(t);return Vee(e)?r?{status:"mismatch",environment:"production",database:t,message:`production deploy is pointed at a non-production ClickHouse database (${t||"<empty>"}); production must use an unmarked database such as visa_mcp`}:{status:"ok",environment:"production",database:t}:Z4e(e)?r?{status:"ok",environment:"preview",database:t}:{status:"mismatch",environment:"preview",database:t,message:`staging/preview deploy is pointed at the production ClickHouse database (${t||"<empty>"}); staging must use a marked database such as visa_mcp_staging`}:{status:"indeterminate"}}function m0t(e){return Vee(e)?"production":Z4e(e)?"preview":"unknown"}function icn(e,t){let r=m0t(e),n=(t||"").trim().toLowerCase();return r==="unknown"?{status:"indeterminate",deploymentEnv:r,nodeEnv:n,message:null}:r==="production"?n===""||n==="production"?{status:"ok",deploymentEnv:r,nodeEnv:n,message:null}:{status:"mismatch",deploymentEnv:r,nodeEnv:n,message:`Railway signals classify this deploy as production, but NODE_ENV=${n||"<empty>"}. Dev-only guards keyed on NODE_ENV!=='production' would silently activate. Set NODE_ENV=production on this Railway service.`}:new Set(["","development","test","preview","staging","production"]).has(n)?{status:"ok",deploymentEnv:r,nodeEnv:n,message:null}:{status:"mismatch",deploymentEnv:r,nodeEnv:n,message:`Railway signals classify this deploy as preview/staging, but NODE_ENV=${n||"<empty>"}. Set NODE_ENV=production on deployed Railway preview services.`}}function ocn(e){if(!tcn(e.allowPreviewLivePaymentRails)||p0t(e.previewPaymentRailProfile)!==Y4e)return!1;let t=Tg(e.railwayEnvironment),r=Tg(e.railwayEnvironmentName);if(t!==Y4e||r!==Y4e)return!1;let n=X4e(e.railwayPublicDomain);return Qan.has(n)}});var _0t=_(xI=>{"use strict";Object.defineProperty(xI,"__esModule",{value:!0});xI.PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE=void 0;xI.matchesPreviewLegacyBalanceDrift=scn;var Q4e=[{ownerIdentityDigest:"7b9d6737bc901bb6dcf5048c314c3b0702605228346c6c470583df69bf8de9f5",balanceMicros:"4910228",ledgerSumMicros:"4850228",driftMicros:"60000"},{ownerIdentityDigest:"e057a8228dbc8a550e70c98d79ada53df841020b68f59f6a448ba585b38dd126",balanceMicros:"5608536",ledgerSumMicros:"5528536",driftMicros:"80000"},{ownerIdentityDigest:"05410c30d7fe5ee48859106ee484aa6e5b35637a986545a743497455decc3925",balanceMicros:"6242951",ledgerSumMicros:"-10959519",driftMicros:"17202470"},{ownerIdentityDigest:"c1999d183182d21b750b9b45f82dddc93beeb6aa930a3299bcf54c3d7a36963f",balanceMicros:"4",ledgerSumMicros:"-19999996",driftMicros:"20000000"},{ownerIdentityDigest:"41bc90e14117747ab05a516c582e1956d8dd11571875f86af5e2a128b35346e4",balanceMicros:"20000000",ledgerSumMicros:"0",driftMicros:"20000000"}];xI.PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE=Object.freeze({issue:8009,count:Q4e.length,absoluteMicros:"57342470"});function Fee(e){try{return BigInt(e).toString()}catch{return null}}function g0t(e,t){let r=BigInt(e),n=BigInt(t);return r<n?-1:r>n?1:0}function scn(e){if(e.deploymentEnvironment!=="preview"||e.totalCount!==xI.PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE.count||Fee(e.totalAbsoluteMicros)!==xI.PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE.absoluteMicros||e.rows.length!==Q4e.length)return!1;let t=e.rows.map(r=>({ownerIdentityDigest:r.ownerIdentityDigest?.toLowerCase()??null,balanceMicros:Fee(r.balanceMicros),ledgerSumMicros:Fee(r.ledgerSumMicros),driftMicros:Fee(r.driftMicros)}));return t.some(r=>r.ownerIdentityDigest===null||!/^[a-f0-9]{64}$/.test(r.ownerIdentityDigest)||r.balanceMicros===null||r.ledgerSumMicros===null||r.driftMicros===null)?!1:(t.sort((r,n)=>{let i=g0t(r.driftMicros,n.driftMicros);return i!==0?i:g0t(r.balanceMicros,n.balanceMicros)}),t.every((r,n)=>{let i=Q4e[n];return r.ownerIdentityDigest===i?.ownerIdentityDigest&&r.balanceMicros===i?.balanceMicros&&r.ledgerSumMicros===i.ledgerSumMicros&&r.driftMicros===i.driftMicros}))}});var y0t=_(l8=>{"use strict";Object.defineProperty(l8,"__esModule",{value:!0});l8.DEFAULT_FETCH_TIMEOUT_MS=void 0;l8.fetchWithTimeout=acn;l8.DEFAULT_FETCH_TIMEOUT_MS=15e3;function acn(e,t={},r=l8.DEFAULT_FETCH_TIMEOUT_MS){return fetch(e,{...t,signal:t.signal??AbortSignal.timeout(r)})}});var E0t=_(iB=>{"use strict";Object.defineProperty(iB,"__esModule",{value:!0});iB.normalizeAgentName=tOe;iB.parseAgentSelector=b0t;iB.computeAgentSelection=ccn;function tOe(e){return e.replace(/\.visa$/i,"").toLowerCase()}function b0t(e){if(e!==void 0){if(typeof e!="string"||e.trim().length===0)throw new Error("Invalid agent selector. Pass a non-empty agent name or stable id.");return e.trim()}}function eOe(e,t){return t?` Available: ${e.map(t).join(", ")}.`:""}function ccn(e){let t=b0t(e.requested);if(t){let r=tOe(t),n=e.candidates.filter(i=>i.exactSelectors.includes(t)||i.names?.some(o=>tOe(o)===r));return n.length>1?{kind:"ambiguous",message:`more than one ${e.duplicateAuthorityLabel??e.authorityLabel} is named "${t}".${eOe(n,e.describeCandidate)} Select the exact ${e.exactSelectorLabel??"stable id"}. `+e.selectorGuidance,matches:n.map(i=>i.value)}:n.length===1?{kind:"selected",value:n[0].value}:{kind:"not_found",requested:t,message:`no ${e.authorityLabel} matched ${JSON.stringify(t)}.`+eOe(e.candidates,e.describeCandidate)+` ${e.selectorGuidance}`}}return e.candidates.length>1?{kind:"ambiguous",message:`more than one ${e.authorityLabel} is available.${eOe(e.candidates,e.describeCandidate)} ${e.selectorGuidance}`,matches:e.candidates.map(r=>r.value)}:e.candidates.length===1?{kind:"selected",value:e.candidates[0].value}:{kind:"none"}}});var T0t=_(ei=>{"use strict";Object.defineProperty(ei,"__esModule",{value:!0});ei.PgDecryptionFailedError=ei.PgEncryptionWireFormatError=ei.PgEncryptionKeyMissingError=ei.PgEncryptionError=ei.PG_ENCRYPTION_WIRE_VERSIONS=ei.ENCRYPTION_KEY_MIN_BYTES=void 0;ei.isPgcryptoIntegrityError=lcn;ei.validateEncryptionKey=fcn;ei.encodeWireFormat=S0t;ei.decodeWireFormat=v0t;ei.encrypt=mcn;ei.decrypt=hcn;ei.encryptSqlFragment=gcn;ei.decryptSqlFragment=_cn;ei.ENCRYPTION_KEY_MIN_BYTES=32;ei.PG_ENCRYPTION_WIRE_VERSIONS=["v1"];var ucn=/^(v[0-9]+):([A-Za-z0-9+/]+={0,2})$/,jf=class extends Error{constructor(t){super(`[pg-encryption] ${t}`),this.name="PgEncryptionError"}};ei.PgEncryptionError=jf;var p8=class extends jf{constructor(t){super(`${t} is missing or shorter than ${ei.ENCRYPTION_KEY_MIN_BYTES} bytes; merchant credential encryption is disabled`),this.name="PgEncryptionKeyMissingError"}};ei.PgEncryptionKeyMissingError=p8;var jv=class extends jf{constructor(t){super(`malformed ciphertext: ${t}`),this.name="PgEncryptionWireFormatError"}};ei.PgEncryptionWireFormatError=jv;var oB=class extends jf{constructor(t){super(`decryption failed: ${t}`),this.name="PgDecryptionFailedError"}};ei.PgDecryptionFailedError=oB;var dcn=new Set(["39000","22023","22P02"]);function lcn(e){return typeof e!="object"||e===null||!("code"in e)?!1:typeof e.code=="string"&&dcn.has(e.code)}var pcn=/^[A-Za-z0-9+/]+={0,2}$/;function fcn(e,t){if(!e||e.trim()==="")throw new p8(t);let r=e.trim();if(!pcn.test(r))throw new p8(t);if(Buffer.from(r,"base64").length<ei.ENCRYPTION_KEY_MIN_BYTES)throw new p8(t);return r}function S0t(e,t){if(!ei.PG_ENCRYPTION_WIRE_VERSIONS.includes(e))throw new jv(`unsupported version "${e}"`);if(!/^[A-Za-z0-9+/]+={0,2}$/.test(t)||t.length===0)throw new jv("cipher payload is not base64");return`${e}:${t}`}function v0t(e){if(typeof e!="string"||e.length===0)throw new jv("value is empty");let t=ucn.exec(e);if(!t)throw new jv("does not match v<N>:<base64>");let r=t[1];if(!ei.PG_ENCRYPTION_WIRE_VERSIONS.includes(r))throw new jv(`unsupported version "${r}"`);return{version:r,cipherBase64:t[2]}}async function mcn(e,t,r){if(typeof t!="string"||t.length===0)throw new jf("plaintext must be a non-empty string");if(typeof r!="string"||r.length===0)throw new jf("key must be a non-empty string");let i=(await e.query("SELECT encode(pgp_sym_encrypt($1, $2, 'cipher-algo=aes256, compress-algo=2'), 'base64') AS ct",[t,r])).rows[0]?.ct;if(typeof i!="string"||i.length===0)throw new jf("pgp_sym_encrypt returned no ciphertext");return S0t("v1",i.replace(/\s+/g,""))}async function hcn(e,t,r){if(typeof r!="string"||r.length===0)throw new jf("key must be a non-empty string");let n=v0t(t),i;try{i=await e.query("SELECT pgp_sym_decrypt(decode($1, 'base64'), $2) AS pt",[n.cipherBase64,r])}catch(s){let a=s instanceof Error?s.message:String(s);throw new oB(a)}let o=i.rows[0]?.pt;if(typeof o!="string")throw new oB("decrypt returned no plaintext");return o}function gcn(e,t){return rOe(e,"plaintext"),rOe(t,"key"),`('v1:' || translate(encode(pgp_sym_encrypt(${e}, ${t}, 'cipher-algo=aes256, compress-algo=2'), 'base64'), E'\\n\\r', ''))`}function _cn(e,t){return ycn(e),rOe(t,"key"),`CASE WHEN ${e} IS NULL THEN NULL
               WHEN SUBSTRING(${e} FROM 1 FOR 3) = 'v1:'
                 THEN pgp_sym_decrypt(decode(translate(SUBSTRING(${e} FROM 4), E'\\n\\r ', ''), 'base64'), ${t})
-              ELSE NULL END`}function rOe(e,t){if(!/^\$[1-9][0-9]*$/.test(e))throw new jf(`${t} param ref must look like "$N", got "${e}"`)}function ycn(e){if(!/^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*){0,2}$/.test(e))throw new jf(`column ref must be a simple identifier, got "${e}"`)}});var x0t=_(Ot=>{"use strict";Object.defineProperty(Ot,"__esModule",{value:!0});Ot.UNBOUND_AWAITING_RUNTIME_LABEL=Ot.TARGETED_AWAITING_RUNTIME_LABEL=Ot.SETUP_POLL_MS=Ot.SETUP_STEP_STATUSES=Ot.SETUP_IDENTITY_STEPS=Ot.SETUP_RAIL_STEPS=Ot.SETUP_STEPS=Ot.SETUP_TERMINAL_STATES=Ot.SETUP_STATES=Ot.SETUP_RAILS=Ot.PROTECTED_CARD_MAX_DRAWS=Ot.SETUP_DEFAULT_PER_PURCHASE_CENTS=Ot.SETUP_DEFAULT_AGGREGATE_CENTS=Ot.SETUP_CONTRACT_VERSION=void 0;Ot.setupPlanSteps=A0t;Ot.computeSetupReadiness=nOe;Ot.computeSetupNextAction=w0t;Ot.isTerminal=I0t;Ot.computeSetupStatus=wcn;Ot.computeSetupStepTargets=Icn;Ot.isSetupPlanSettled=Ocn;Ot.progressLadder=P0t;Ot.setupProgressSteps=Ccn;Ot.SETUP_CONTRACT_VERSION=4;Ot.SETUP_DEFAULT_AGGREGATE_CENTS=1e4;Ot.SETUP_DEFAULT_PER_PURCHASE_CENTS=2500;Ot.PROTECTED_CARD_MAX_DRAWS=3;Ot.SETUP_RAILS=["card","wallet"];Ot.SETUP_STATES=["awaiting_runtime","awaiting_owner","approved","completed","failed","denied","cancelled","expired","merged"];Ot.SETUP_TERMINAL_STATES=["completed","failed","denied","cancelled","expired","merged"];Ot.SETUP_STEPS=["identity.authorize","identity.activate","card.attach","card.mandate","wallet.provision_owner","wallet.attach","wallet.signer"];Ot.SETUP_RAIL_STEPS={card:["card.attach","card.mandate"],wallet:["wallet.provision_owner","wallet.attach","wallet.signer"]};Ot.SETUP_IDENTITY_STEPS=["identity.authorize","identity.activate"];function A0t(e){let t=new Set,r=[];for(let n of[...Ot.SETUP_IDENTITY_STEPS,...e.flatMap(i=>Ot.SETUP_RAIL_STEPS[i]??[])])t.has(n)||(t.add(n),r.push(n));return r}Ot.SETUP_STEP_STATUSES=["pending","running","awaiting_human","awaiting_runtime","succeeded","failed","skipped","abandoned"];Ot.SETUP_POLL_MS={afterHumanAction:1e3,provisioning:3e3,idle:5e3,completedNeedsHuman:3e4,slowDown:1e4};function bcn(e,t){return!t||!t.grantActivated&&!t.ownerPrerequisiteMissing?{rail:e,ready:!1,blocker:"not_provisioned"}:t.ownerPrerequisiteMissing?{rail:e,ready:!1,blocker:"blocked"}:t.instrumentResolves?e==="wallet"&&t.fundedForOnePurchase===!1?{rail:e,ready:!1,blocker:"unfunded"}:e==="card"?{rail:e,ready:!0,tapFree:t.liveMandateWithDrawsLeft===!0}:{rail:e,ready:!0}:{rail:e,ready:!1,blocker:"not_provisioned"}}function nOe(e){let t=e.identity.activated,r=e.operation.requestedRails.map(n=>{let i=bcn(n,e.rails[n]);return n==="wallet"&&i.ready&&e.identity.runtimeDelegation?{rail:n,ready:!1,blocker:"runtime_approval"}:i});return{kind:t&&r.every(n=>n.ready)?"ready":"needs_action",identityReady:t,rails:r}}function Ag(e,t){return t===void 0?{}:{[e]:t}}var Ecn={completed:"Setup finished.",failed:"Setup could not finish.",denied:"You said this was not your agent.",cancelled:"Setup was cancelled.",expired:"This setup request expired.",merged:"This agent joined the setup you started in the Console."},Scn=["enroll_card","card_verification","provision_wallet","wallet_signature"],vcn={enroll_card:"Add a card to pay with.",card_verification:"Verify your card with your bank.",provision_wallet:"Create your wallet.",wallet_signature:"Approve the wallet signer in your browser."};Ot.TARGETED_AWAITING_RUNTIME_LABEL="Waiting for your agent to pick this up. If it doesn't, tell it: connect Visa.";Ot.UNBOUND_AWAITING_RUNTIME_LABEL="This request is not picked up automatically. On the runtime you want, say: connect Visa. You review that runtime\u2019s fingerprint before it holds any authority.";function Tcn(e){return e.claimBindingMode?e.claimBindingMode==="unbound":e.source==="console"}function w0t(e){let{operation:t,identity:r,viewer:n,steps:i}=e,o=nOe(e);if(n.kind==="owner"&&n.signedInAs&&t.ownerUserLogin&&n.signedInAs!==t.ownerUserLogin)return{actor:"human",kind:"switch_account",label:"Sign out, then sign back in as the account that started this.",safeToRetry:!0,afterAction:"stop",expectedLogin:t.ownerUserLogin,signedInAs:n.signedInAs};if(I0t(t.state)&&!(t.state==="completed"&&o.kind==="ready")&&t.state!=="completed")return{actor:"none",kind:"terminal",label:Ecn[t.state],safeToRetry:!1,afterAction:"stop",outcome:t.state,...t.failureReason?{reason:t.failureReason}:{},canRestart:t.state==="expired"||t.state==="cancelled",...t.successorOperationId?{successorOperationId:t.successorOperationId}:{}};if(t.state==="awaiting_runtime"&&r.shortCode&&r.deepLink)return{actor:"human",kind:"give_code",label:"Tell your agent to connect, and give it this code if it asks.",safeToRetry:!0,afterAction:"poll",shortCode:r.shortCode,deepLink:r.deepLink,...Ag("expiresAt",r.credentialExpiresAt??t.expiresAt)};if(t.state==="awaiting_owner"&&r.reviewUrl)return{actor:"human",kind:"open_url",label:"Review and connect this agent.",safeToRetry:!0,afterAction:"open_url_again",channel:"browser",url:r.reviewUrl,...r.openedFromThisDevice===!0?{provenance:"same_device"}:Ag("code",r.compareCode),...Ag("expiresAt",t.expiresAt)};if(r.pendingRuntimeAction)return{actor:"agent",kind:"activate",label:"Finishing setup.",safeToRetry:!0,afterAction:"poll",endpoint:r.pendingRuntimeAction.endpoint};for(let c of Scn)for(let u of t.requestedRails){let d=e.rails[u]?.humanAction;if(d?.kind!==c)continue;let l={actor:"human",label:vcn[c],safeToRetry:!0,afterAction:"open_url_again",url:d.url};return c==="wallet_signature"?{...l,kind:c,...Ag("expiresAt",d.expiresAt),...Ag("attachId",d.attachId),...Ag("agentId",d.agentId)}:c==="card_verification"?{...l,kind:c,...Ag("expiresAt",d.expiresAt)}:{...l,kind:c}}let s=i.find(c=>c.status==="failed");if(s)return s.retryable?{actor:"agent",kind:"retry",label:"Retrying a step that did not finish.",safeToRetry:!0,afterAction:"poll",step:s.step,endpoint:e.endpoints.retry(t.operationId,s.step),...Ag("notBefore",s.nextAttemptAt)}:{actor:"human",kind:"contact_support",label:"This needs a hand from support.",safeToRetry:!1,afterAction:"stop",supportRef:t.operationId,stepFailed:s.step};if(t.state==="completed"&&r.runtimeDelegation?.state==="pending")return{actor:"human",kind:"runtime_delegation",label:"Approve secure wallet access for this runtime.",safeToRetry:!0,afterAction:"poll",url:r.runtimeDelegation.url,agentId:r.runtimeDelegation.agentId,runtimeId:r.runtimeDelegation.runtimeId};if(o.rails.find(c=>c.blocker==="unfunded")){let c=e.rails.wallet;return{actor:"human",kind:"fund_wallet",label:"Add USDC so your agent has something to spend.",safeToRetry:!0,afterAction:"poll",...Ag("address",c?.depositAddress),network:"base",...Ag("minimumMicros",c?.minimumMicros)}}return n.keyMismatchOnLiveAgent&&t.agentId?{actor:"agent",kind:"rotate_key",label:"Rotating this agent to a new key.",safeToRetry:!0,afterAction:"poll",agentId:t.agentId,endpoint:e.endpoints.rotateKey(t.agentId)}:n.throttled?{actor:"agent",kind:"slow_down",label:"Checking less often.",safeToRetry:!0,afterAction:"poll",pollAfterMs:Ot.SETUP_POLL_MS.slowDown}:t.state==="completed"&&o.kind==="ready"?{actor:"none",kind:"done",label:"Your agent is ready to pay.",safeToRetry:!1,afterAction:"stop"}:{actor:"agent",kind:"poll",label:t.state==="awaiting_runtime"?Tcn(t)?Ot.UNBOUND_AWAITING_RUNTIME_LABEL:Ot.TARGETED_AWAITING_RUNTIME_LABEL:"Setting up.",safeToRetry:!0,afterAction:"poll",pollAfterMs:Acn(t.state,o)}}function I0t(e){return Ot.SETUP_TERMINAL_STATES.includes(e)}function Acn(e,t){return e==="approved"?Ot.SETUP_POLL_MS.provisioning:e==="completed"&&t.kind==="needs_action"?Ot.SETUP_POLL_MS.completedNeedsHuman:Ot.SETUP_POLL_MS.idle}function wcn(e){let t=nOe(e),r=w0t(e);return{contractVersion:Ot.SETUP_CONTRACT_VERSION,operationId:e.operation.operationId,state:e.operation.state,readiness:t,nextAction:r,pollAfterMs:"pollAfterMs"in r?r.pollAfterMs:r.afterAction==="stop"?0:r.afterAction==="open_url_again"?Ot.SETUP_POLL_MS.idle:Ot.SETUP_POLL_MS.afterHumanAction}}function Icn(e){let{identity:t,rails:r}=e;return A0t(e.requestedRails).map(n=>({step:n,status:Pcn(n,t.activated,r)}))}function Pcn(e,t,r){switch(e){case"identity.authorize":return"succeeded";case"identity.activate":return t?"succeeded":"awaiting_runtime";default:return xcn(e,t,r)}}function xcn(e,t,r){if(!t)return"pending";let n=r.card,i=r.wallet;switch(e){case"card.attach":return n?.ownerPrerequisiteMissing?"awaiting_human":n?.grantActivated&&n.instrumentResolves?"succeeded":"pending";case"card.mandate":return n?.liveMandateWithDrawsLeft===!0?"succeeded":n?.grantActivated&&n.instrumentResolves?"skipped":"pending";case"wallet.provision_owner":return i===void 0?"pending":i.ownerPrerequisiteMissing?"awaiting_human":"succeeded";case"wallet.attach":return i?.grantActivated?"succeeded":"pending";case"wallet.signer":return i?.grantActivated&&i.instrumentResolves?"succeeded":"pending";default:return"pending"}}function Ocn(e){return e.every(t=>t.status==="succeeded"||t.status==="skipped")}var Rcn={card:"Card ready to pay",wallet:"USDC wallet ready to pay"},Ncn=new Set(["failed","denied","cancelled","expired"]);function P0t(e,t){let r=!0;return e.map(({key:n,label:i,done:o})=>o?{key:n,label:i,state:"done"}:r?(r=!1,{key:n,label:i,state:t?"stopped":"active"}):{key:n,label:i,state:"pending"})}function Ccn(e){let t=String(e.state),r=Array.isArray(e.readiness?.rails)?e.readiness.rails:[],n=!!(e.agent?.runtime||e.agent?.device)||e.readiness?.identityReady===!0||t==="awaiting_owner"||t==="approved"||t==="completed",i=[{key:"created",label:"Request created",done:!0},{key:"picked-up",label:"Agent picked it up",done:n},{key:"approved",label:"Limits approved",done:t==="approved"||t==="completed"},{key:"identity",label:"Agent identity verified",done:e.readiness?.identityReady===!0},...r.map(o=>({key:`rail-${o.rail}`,label:Rcn[o.rail]??`${o.rail} ready to pay`,done:o.ready===!0}))];return P0t(i,Ncn.has(t))}});var O0t=_(OI=>{"use strict";Object.defineProperty(OI,"__esModule",{value:!0});OI.runtimeLabel=kcn;OI.canonicalRuntimeId=$ee;OI.runtimeMatchAliases=Dcn;OI.runtimesMatch=Lcn;OI.claimBindingMode=Ucn;var Mcn={"claude-code":"Claude Code",claude:"Claude Code",codex:"Codex",openclaw:"OpenClaw",hermes:"Hermes",cursor:"Cursor","custom-mcp":"Custom (MCP)",mcp:"Custom (MCP)",custom:"Custom (MCP)"};function kcn(e){let t=e.trim();return Mcn[t.toLowerCase()]??t}function $ee(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();if(t.length!==0)return t==="claude"||t==="claude-code"?"claude-code":t==="codex"?"codex":t==="openclaw"?"openclaw":t==="hermes"?"hermes":t==="cursor"?"cursor":t==="custom-mcp"||t==="mcp"||t==="custom"?"custom-mcp":t}function Dcn(e){let t=$ee(e);return t?t==="claude-code"?["claude","claude-code"]:t==="custom-mcp"?["custom","custom-mcp","mcp"]:[t]:[]}function Lcn(e,t){return!e||e.trim().length===0?!0:!t||t.trim().length===0?!1:$ee(e)===$ee(t)}function Ucn(e){return e&&e.trim().length>0?"targeted":"unbound"}});var R0t=_(Xu=>{"use strict";Object.defineProperty(Xu,"__esModule",{value:!0});Xu.ReleaseManifestValidationError=Xu.PROVIDER_CONFIGURATION_VARIABLE_KEYS=Xu.ACTIVE_RAILWAY_SERVICES=Xu.RELEASE_MANIFEST_SCHEMA_VERSION=void 0;Xu.validateReleaseManifest=jcn;var Bcn=G_();Xu.RELEASE_MANIFEST_SCHEMA_VERSION="1.0.0";Xu.ACTIVE_RAILWAY_SERVICES=["auth","web","mpp","admin","worker"];Xu.PROVIDER_CONFIGURATION_VARIABLE_KEYS=["name","sensitivity","owners","consumer"];var ht=class extends Error{field;constructor(t,r){super(`ReleaseManifest validation error: ${t}${r?` (field: ${r})`:""}`),this.field=r,this.name="ReleaseManifestValidationError"}};Xu.ReleaseManifestValidationError=ht;function jcn(e){if(!e||typeof e!="object"||Array.isArray(e))throw new ht("Manifest must be a non-null object");let t=e;if(t.schemaVersion!==Xu.RELEASE_MANIFEST_SCHEMA_VERSION)throw new ht(`Unsupported schemaVersion "${t.schemaVersion}"; expected "${Xu.RELEASE_MANIFEST_SCHEMA_VERSION}"`,"schemaVersion");if(typeof t.candidateId!="string"||!t.candidateId.trim())throw new ht("candidateId must be a non-empty string","candidateId");if(typeof t.sourceCommit!="string"||!/^[0-9a-f]{7,40}$/i.test(t.sourceCommit))throw new ht("sourceCommit must be a valid git commit SHA","sourceCommit");if(typeof t.generatedAt!="string"||!t.generatedAt.trim())throw new ht("generatedAt must be a valid timestamp","generatedAt");if(t.environment!=="staging"&&t.environment!=="production")throw new ht('environment must be "staging" or "production"',"environment");if(!t.services||typeof t.services!="object"||Array.isArray(t.services))throw new ht("services must be an object","services");let r=t.services;for(let m of Xu.ACTIVE_RAILWAY_SERVICES){if(!r[m]||typeof r[m]!="object")throw new ht(`Missing required active Railway service "${m}"`,`services.${m}`);let h=r[m];if(h.serviceId!==m)throw new ht(`Service ID mismatch for "${m}"`,`services.${m}.serviceId`);if(typeof h.rootPath!="string"||!h.rootPath.trim())throw new ht(`Invalid rootPath for service "${m}"`,`services.${m}.rootPath`);if(!Array.isArray(h.watchPaths)||h.watchPaths.length===0)throw new ht(`watchPaths must be a non-empty array for service "${m}"`,`services.${m}.watchPaths`);if(!Array.isArray(h.healthEndpoints)||h.healthEndpoints.length===0)throw new ht(`healthEndpoints must be a non-empty array for service "${m}"`,`services.${m}.healthEndpoints`)}if(!t.cli||typeof t.cli!="object"||Array.isArray(t.cli))throw new ht("cli must be an object","cli");let n=t.cli;if(n.packageName!=="@visa/cli")throw new ht('cli.packageName must be "@visa/cli"',"cli.packageName");if(typeof n.version!="string"||!n.version.trim())throw new ht("cli.version must be a valid string","cli.version");if(n.channel!=="rc"&&n.channel!=="latest")throw new ht('cli.channel must be "rc" or "latest"',"cli.channel");if(typeof n.tarballIntegrity!="string"||!n.tarballIntegrity.trim())throw new ht("cli.tarballIntegrity must be a non-empty string","cli.tarballIntegrity");if(typeof n.minimumCompatibleVersion!="string"||!n.minimumCompatibleVersion.trim())throw new ht("cli.minimumCompatibleVersion must be a non-empty string","cli.minimumCompatibleVersion");if(!n.capabilityFloors||typeof n.capabilityFloors!="object")throw new ht("cli.capabilityFloors must be an object","cli.capabilityFloors");if(!t.database||typeof t.database!="object")throw new ht("database must be an object","database");let i=t.database;if(!i.postgres||typeof i.postgres!="object")throw new ht("database.postgres must be an object","database.postgres");let o=i.postgres;if(typeof o.schemaChecksum!="string"||!o.schemaChecksum.trim())throw new ht("database.postgres.schemaChecksum must be a non-empty string","database.postgres.schemaChecksum");if(!Array.isArray(o.tables)||o.tables.length===0)throw new ht("database.postgres.tables must be a non-empty array","database.postgres.tables");if(!i.clickhouse||typeof i.clickhouse!="object")throw new ht("database.clickhouse must be an object","database.clickhouse");let s=i.clickhouse;if(typeof s.schemaChecksum!="string"||!s.schemaChecksum.trim())throw new ht("database.clickhouse.schemaChecksum must be a non-empty string","database.clickhouse.schemaChecksum");if(!Array.isArray(s.tables)||s.tables.length===0)throw new ht("database.clickhouse.tables must be a non-empty array","database.clickhouse.tables");if(!t.capabilities||typeof t.capabilities!="object")throw new ht("capabilities must be an object","capabilities");let a=t.capabilities;if(!Array.isArray(a.publicTools)||a.publicTools.length===0)throw new ht("capabilities.publicTools must be a non-empty array","capabilities.publicTools");if(!Array.isArray(a.paymentRails)||a.paymentRails.length===0)throw new ht("capabilities.paymentRails must be a non-empty array","capabilities.paymentRails");if(!Array.isArray(a.protocols)||a.protocols.length===0)throw new ht("capabilities.protocols must be a non-empty array","capabilities.protocols");if(!Array.isArray(a.rolloutFlags)||a.rolloutFlags.length===0)throw new ht("capabilities.rolloutFlags must be a non-empty array","capabilities.rolloutFlags");if(!t.providers||typeof t.providers!="object"||Array.isArray(t.providers))throw new ht("providers must be an object","providers");let c=t.providers,u=["turnkey","postgres","clickhouse","redis","sentry"];for(let m of u)if(!c[m]||typeof c[m]!="object")throw new ht(`Missing required provider assertion "${m}"`,`providers.${m}`);for(let[m,h]of Object.entries(c)){let g=h;if(g.configuration!==void 0){if(!Array.isArray(g.configuration))throw new ht(`providers.${m}.configuration must be an array`,`providers.${m}.configuration`);g.configuration.forEach((y,S)=>{let b=`providers.${m}.configuration[${S}]`;if(!y||typeof y!="object"||Array.isArray(y))throw new ht(`${b} must be an object`,b);let E=y;for(let T of Object.keys(E))if(!Xu.PROVIDER_CONFIGURATION_VARIABLE_KEYS.includes(T))throw new ht(`${b} carries unexpected key "${T}"; only variable names and registry metadata belong in the manifest`,b);if(typeof E.name!="string"||!/^[A-Z][A-Z0-9_]*$/.test(E.name))throw new ht(`${b}.name must be an environment variable name`,`${b}.name`);if(typeof E.sensitivity!="string"||!E.sensitivity.trim())throw new ht(`${b}.sensitivity must be a non-empty string`,`${b}.sensitivity`);if(!Array.isArray(E.owners)||E.owners.some(T=>typeof T!="string"))throw new ht(`${b}.owners must be an array of service names`,`${b}.owners`);if(typeof E.consumer!="string"||!E.consumer.trim())throw new ht(`${b}.consumer must be a non-empty string`,`${b}.consumer`)})}}if(!t.canaries||typeof t.canaries!="object"||Array.isArray(t.canaries))throw new ht("canaries must be an object","canaries");let d=t.canaries;if(!d.ceremonyCanary7590||typeof d.ceremonyCanary7590!="object")throw new ht('Missing required canary "ceremonyCanary7590"',"canaries.ceremonyCanary7590");if(!d.serviceHealthProbes||typeof d.serviceHealthProbes!="object")throw new ht('Missing required canary "serviceHealthProbes"',"canaries.serviceHealthProbes");if(!t.docs||typeof t.docs!="object")throw new ht("docs must be an object","docs");let l=t.docs;if(typeof l.canonicalDocsVersion!="string"||!l.canonicalDocsVersion.trim())throw new ht("docs.canonicalDocsVersion must be a non-empty string","docs.canonicalDocsVersion");if(!Array.isArray(t.rollbackClassification)||t.rollbackClassification.length===0)throw new ht("rollbackClassification must be a non-empty array","rollbackClassification");let p=new Set(["schema","credentials","provider_effects","money_state"]),f=new Set;for(let m of t.rollbackClassification){if(!m||typeof m!="object")throw new ht("rollbackClassification item must be an object","rollbackClassification");let h=m;if(h.classification!=="safe_rollback"&&h.classification!=="forward_fix_required")throw new ht(`Invalid classification "${h.classification}" for step "${h.step}"`,"rollbackClassification");typeof h.category=="string"&&f.add(h.category)}for(let m of p)if(!f.has(m))throw new ht(`rollbackClassification must cover category "${m}"`,"rollbackClassification");return iOe(t),(0,Bcn.canonicalJsonValue)(e)}function iOe(e,t=""){if(e!=null){if(typeof e=="string"){if(/Bearer\s+[A-Za-z0-9_-]{20,}/i.test(e))throw new ht(`Bearer token detected in manifest at ${t}`);if(/-----BEGIN\s+(?:RSA|EC|PRIVATE)\s+KEY-----/i.test(e))throw new ht(`Private key detected in manifest at ${t}`);if(/^(?:postgres|postgresql|redis|mongodb):\/\/[^:]+:[^@]+@/i.test(e))throw new ht(`Credential-bearing connection URL detected in manifest at ${t}`);return}if(Array.isArray(e)){for(let r=0;r<e.length;r++)iOe(e[r],`${t}[${r}]`);return}if(typeof e=="object")for(let[r,n]of Object.entries(e))iOe(n,t?`${t}.${r}`:r)}}});var qf=_(z=>{"use strict";Object.defineProperty(z,"__esModule",{value:!0});z.clickhouseDatabaseHasStagingMarker=z.validateCardPaymentUnmatchedEventInsertRow=z.validateCardPaymentEventInsertRow=z.refreshCardPaymentAttemptProjection=z.insertCardPaymentUnmatchedEvent=z.insertCardPaymentLifecycleEventWithId=z.insertCardPaymentLifecycleEvent=z.assertValidCardPaymentAttemptStatus=z.CardPaymentDbValidationError=z.requiresProviderProvenance=z.requiredProvenanceFor=z.reduceCardPaymentEvents=z.provenanceOfSource=z.isOwnerAttestationVerdict=z.OWNER_ATTESTATION_VERDICTS=z.CARD_PAYMENT_EVENT_REQUIRED_PROVENANCE=z.CARD_PAYMENT_SOURCE_PROVENANCE=z.CARD_PAYMENT_PROVENANCES=z.CARD_PAYMENT_PROCESSOR_TRUTH_EVENT_TYPES=z.CARD_PAYMENT_UNMATCHED_SOURCES=z.CARD_PAYMENT_UNMATCHED_EVENT_TYPES=z.CARD_PAYMENT_SOURCES=z.CARD_PAYMENT_UNMATCHED_PROCESSORS=z.CARD_PAYMENT_PROCESSORS=z.CARD_PAYMENT_INTENTS=z.CARD_PAYMENT_EVENT_TYPES=z.CARD_PAYMENT_ATTEMPT_STATUSES=z.parseAccountOperationReceipt=z.cardStatusClaimsProcessorTruth=z.cardProofLevel=z.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION=z.ACCOUNT_OPERATION_PROOF_LEVELS=z.ACCOUNT_OPERATION_OUTCOMES=z.ACCOUNT_OPERATION_EVIDENCE_TYPES=z.checkTvcPinParity=z.TVC_SIGNER_POLICY_CONTRACT_VERSION=z.tvcCredentialLifecycleEvidence=z.parseTvcCredentialLifecycleEvidence=z.assertTvcCredentialRebindWindow=z.TVC_CREDENTIAL_REBIND_LEAD_SECONDS=z.TVC_CREDENTIAL_CONTRACT_SOURCES=z.tvcProviderCapacityEvidence=z.TVC_PROVIDER_WARN_THRESHOLD=z.parseTvcProviderCapacityEvidence=z.TURNKEY_SUBORG_RESOURCE_LIMITS=z.renderAgentOutcome=z.projectAgentOutcome=z.createAgentOutcomeProjector=z.AGENT_OUTCOME_LABELS=z.GenerationStatus=void 0;z.TARGETED_AWAITING_RUNTIME_LABEL=z.SETUP_TERMINAL_STATES=z.SETUP_STEP_STATUSES=z.SETUP_STEPS=z.SETUP_STATES=z.SETUP_RAIL_STEPS=z.SETUP_RAILS=z.SETUP_POLL_MS=z.SETUP_IDENTITY_STEPS=z.SETUP_DEFAULT_PER_PURCHASE_CENTS=z.SETUP_DEFAULT_AGGREGATE_CENTS=z.PROTECTED_CARD_MAX_DRAWS=z.SETUP_CONTRACT_VERSION=z.validateEncryptionKey=z.isPgcryptoIntegrityError=z.encryptSqlFragment=z.encrypt=z.encodeWireFormat=z.decryptSqlFragment=z.decrypt=z.decodeWireFormat=z.PgEncryptionWireFormatError=z.PgEncryptionKeyMissingError=z.PgEncryptionError=z.PgDecryptionFailedError=z.PG_ENCRYPTION_WIRE_VERSIONS=z.ENCRYPTION_KEY_MIN_BYTES=z.utf8ByteLength=z.isCanonicalText=z.isCanonicalOpaqueId=z.compareCanonicalKeys=z.assertCanonicalOpaqueId=z.CANONICAL_OPAQUE_ID_PATTERN=z.CANONICAL_OPAQUE_ID_MAX_BYTES=z.canonicalJson=z.parseAgentSelector=z.normalizeAgentName=z.computeAgentSelection=z.fetchWithTimeout=z.DEFAULT_FETCH_TIMEOUT_MS=z.PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE=z.matchesPreviewLegacyBalanceDrift=z.resolveDeploymentEnvClass=z.resolveClickhouseEnvBinding=z.normalizeRailEnvironmentValue=z.isPublicPreviewRailEnvironment=z.isLiveVgsEnvironment=z.isExplicitProductionRailEnvironment=z.isExplicitPreviewPaymentRailOptIn=z.detectDeploymentEnvNodeEnvMismatch=void 0;z.validateReleaseManifest=z.ReleaseManifestValidationError=z.RELEASE_MANIFEST_SCHEMA_VERSION=z.PROVIDER_CONFIGURATION_VARIABLE_KEYS=z.ACTIVE_RAILWAY_SERVICES=z.claimBindingMode=z.runtimesMatch=z.runtimeMatchAliases=z.canonicalRuntimeId=z.runtimeLabel=z.setupProgressSteps=z.setupPlanSteps=z.progressLadder=z.isTerminal=z.isSetupPlanSettled=z.computeSetupStepTargets=z.computeSetupStatus=z.computeSetupReadiness=z.computeSetupNextAction=z.UNBOUND_AWAITING_RUNTIME_LABEL=void 0;var N0t;(function(e){e.pending="pending",e.processing="processing",e.completed="completed",e.failed="failed"})(N0t||(z.GenerationStatus=N0t={}));var zee=G4e();Object.defineProperty(z,"AGENT_OUTCOME_LABELS",{enumerable:!0,get:function(){return zee.AGENT_OUTCOME_LABELS}});Object.defineProperty(z,"createAgentOutcomeProjector",{enumerable:!0,get:function(){return zee.createAgentOutcomeProjector}});Object.defineProperty(z,"projectAgentOutcome",{enumerable:!0,get:function(){return zee.projectAgentOutcome}});Object.defineProperty(z,"renderAgentOutcome",{enumerable:!0,get:function(){return zee.renderAgentOutcome}});var Gee=qht();Object.defineProperty(z,"TURNKEY_SUBORG_RESOURCE_LIMITS",{enumerable:!0,get:function(){return Gee.TURNKEY_SUBORG_RESOURCE_LIMITS}});Object.defineProperty(z,"parseTvcProviderCapacityEvidence",{enumerable:!0,get:function(){return Gee.parseTvcProviderCapacityEvidence}});Object.defineProperty(z,"TVC_PROVIDER_WARN_THRESHOLD",{enumerable:!0,get:function(){return Gee.TVC_PROVIDER_WARN_THRESHOLD}});Object.defineProperty(z,"tvcProviderCapacityEvidence",{enumerable:!0,get:function(){return Gee.tvcProviderCapacityEvidence}});var sB=$ht();Object.defineProperty(z,"TVC_CREDENTIAL_CONTRACT_SOURCES",{enumerable:!0,get:function(){return sB.TVC_CREDENTIAL_CONTRACT_SOURCES}});Object.defineProperty(z,"TVC_CREDENTIAL_REBIND_LEAD_SECONDS",{enumerable:!0,get:function(){return sB.TVC_CREDENTIAL_REBIND_LEAD_SECONDS}});Object.defineProperty(z,"assertTvcCredentialRebindWindow",{enumerable:!0,get:function(){return sB.assertTvcCredentialRebindWindow}});Object.defineProperty(z,"parseTvcCredentialLifecycleEvidence",{enumerable:!0,get:function(){return sB.parseTvcCredentialLifecycleEvidence}});Object.defineProperty(z,"tvcCredentialLifecycleEvidence",{enumerable:!0,get:function(){return sB.tvcCredentialLifecycleEvidence}});var qcn=zht();Object.defineProperty(z,"TVC_SIGNER_POLICY_CONTRACT_VERSION",{enumerable:!0,get:function(){return qcn.TVC_SIGNER_POLICY_CONTRACT_VERSION}});var Hcn=Kht();Object.defineProperty(z,"checkTvcPinParity",{enumerable:!0,get:function(){return Hcn.checkTvcPinParity}});var RI=$ge();Object.defineProperty(z,"ACCOUNT_OPERATION_EVIDENCE_TYPES",{enumerable:!0,get:function(){return RI.ACCOUNT_OPERATION_EVIDENCE_TYPES}});Object.defineProperty(z,"ACCOUNT_OPERATION_OUTCOMES",{enumerable:!0,get:function(){return RI.ACCOUNT_OPERATION_OUTCOMES}});Object.defineProperty(z,"ACCOUNT_OPERATION_PROOF_LEVELS",{enumerable:!0,get:function(){return RI.ACCOUNT_OPERATION_PROOF_LEVELS}});Object.defineProperty(z,"ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION",{enumerable:!0,get:function(){return RI.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION}});Object.defineProperty(z,"cardProofLevel",{enumerable:!0,get:function(){return RI.cardProofLevel}});Object.defineProperty(z,"cardStatusClaimsProcessorTruth",{enumerable:!0,get:function(){return RI.cardStatusClaimsProcessorTruth}});Object.defineProperty(z,"parseAccountOperationReceipt",{enumerable:!0,get:function(){return RI.parseAccountOperationReceipt}});var xa=W4e();Object.defineProperty(z,"CARD_PAYMENT_ATTEMPT_STATUSES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_ATTEMPT_STATUSES}});Object.defineProperty(z,"CARD_PAYMENT_EVENT_TYPES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_EVENT_TYPES}});Object.defineProperty(z,"CARD_PAYMENT_INTENTS",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_INTENTS}});Object.defineProperty(z,"CARD_PAYMENT_PROCESSORS",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_PROCESSORS}});Object.defineProperty(z,"CARD_PAYMENT_UNMATCHED_PROCESSORS",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_UNMATCHED_PROCESSORS}});Object.defineProperty(z,"CARD_PAYMENT_SOURCES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_SOURCES}});Object.defineProperty(z,"CARD_PAYMENT_UNMATCHED_EVENT_TYPES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_UNMATCHED_EVENT_TYPES}});Object.defineProperty(z,"CARD_PAYMENT_UNMATCHED_SOURCES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_UNMATCHED_SOURCES}});Object.defineProperty(z,"CARD_PAYMENT_PROCESSOR_TRUTH_EVENT_TYPES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_PROCESSOR_TRUTH_EVENT_TYPES}});Object.defineProperty(z,"CARD_PAYMENT_PROVENANCES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_PROVENANCES}});Object.defineProperty(z,"CARD_PAYMENT_SOURCE_PROVENANCE",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_SOURCE_PROVENANCE}});Object.defineProperty(z,"CARD_PAYMENT_EVENT_REQUIRED_PROVENANCE",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_EVENT_REQUIRED_PROVENANCE}});Object.defineProperty(z,"OWNER_ATTESTATION_VERDICTS",{enumerable:!0,get:function(){return xa.OWNER_ATTESTATION_VERDICTS}});Object.defineProperty(z,"isOwnerAttestationVerdict",{enumerable:!0,get:function(){return xa.isOwnerAttestationVerdict}});Object.defineProperty(z,"provenanceOfSource",{enumerable:!0,get:function(){return xa.provenanceOfSource}});Object.defineProperty(z,"reduceCardPaymentEvents",{enumerable:!0,get:function(){return xa.reduceCardPaymentEvents}});Object.defineProperty(z,"requiredProvenanceFor",{enumerable:!0,get:function(){return xa.requiredProvenanceFor}});Object.defineProperty(z,"requiresProviderProvenance",{enumerable:!0,get:function(){return xa.requiresProviderProvenance}});var qv=d0t();Object.defineProperty(z,"CardPaymentDbValidationError",{enumerable:!0,get:function(){return qv.CardPaymentDbValidationError}});Object.defineProperty(z,"assertValidCardPaymentAttemptStatus",{enumerable:!0,get:function(){return qv.assertValidCardPaymentAttemptStatus}});Object.defineProperty(z,"insertCardPaymentLifecycleEvent",{enumerable:!0,get:function(){return qv.insertCardPaymentLifecycleEvent}});Object.defineProperty(z,"insertCardPaymentLifecycleEventWithId",{enumerable:!0,get:function(){return qv.insertCardPaymentLifecycleEventWithId}});Object.defineProperty(z,"insertCardPaymentUnmatchedEvent",{enumerable:!0,get:function(){return qv.insertCardPaymentUnmatchedEvent}});Object.defineProperty(z,"refreshCardPaymentAttemptProjection",{enumerable:!0,get:function(){return qv.refreshCardPaymentAttemptProjection}});Object.defineProperty(z,"validateCardPaymentEventInsertRow",{enumerable:!0,get:function(){return qv.validateCardPaymentEventInsertRow}});Object.defineProperty(z,"validateCardPaymentUnmatchedEventInsertRow",{enumerable:!0,get:function(){return qv.validateCardPaymentUnmatchedEventInsertRow}});var Uy=h0t();Object.defineProperty(z,"clickhouseDatabaseHasStagingMarker",{enumerable:!0,get:function(){return Uy.clickhouseDatabaseHasStagingMarker}});Object.defineProperty(z,"detectDeploymentEnvNodeEnvMismatch",{enumerable:!0,get:function(){return Uy.detectDeploymentEnvNodeEnvMismatch}});Object.defineProperty(z,"isExplicitPreviewPaymentRailOptIn",{enumerable:!0,get:function(){return Uy.isExplicitPreviewPaymentRailOptIn}});Object.defineProperty(z,"isExplicitProductionRailEnvironment",{enumerable:!0,get:function(){return Uy.isExplicitProductionRailEnvironment}});Object.defineProperty(z,"isLiveVgsEnvironment",{enumerable:!0,get:function(){return Uy.isLiveVgsEnvironment}});Object.defineProperty(z,"isPublicPreviewRailEnvironment",{enumerable:!0,get:function(){return Uy.isPublicPreviewRailEnvironment}});Object.defineProperty(z,"normalizeRailEnvironmentValue",{enumerable:!0,get:function(){return Uy.normalizeRailEnvironmentValue}});Object.defineProperty(z,"resolveClickhouseEnvBinding",{enumerable:!0,get:function(){return Uy.resolveClickhouseEnvBinding}});Object.defineProperty(z,"resolveDeploymentEnvClass",{enumerable:!0,get:function(){return Uy.resolveDeploymentEnvClass}});var C0t=_0t();Object.defineProperty(z,"matchesPreviewLegacyBalanceDrift",{enumerable:!0,get:function(){return C0t.matchesPreviewLegacyBalanceDrift}});Object.defineProperty(z,"PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE",{enumerable:!0,get:function(){return C0t.PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE}});var M0t=y0t();Object.defineProperty(z,"DEFAULT_FETCH_TIMEOUT_MS",{enumerable:!0,get:function(){return M0t.DEFAULT_FETCH_TIMEOUT_MS}});Object.defineProperty(z,"fetchWithTimeout",{enumerable:!0,get:function(){return M0t.fetchWithTimeout}});var oOe=E0t();Object.defineProperty(z,"computeAgentSelection",{enumerable:!0,get:function(){return oOe.computeAgentSelection}});Object.defineProperty(z,"normalizeAgentName",{enumerable:!0,get:function(){return oOe.normalizeAgentName}});Object.defineProperty(z,"parseAgentSelector",{enumerable:!0,get:function(){return oOe.parseAgentSelector}});var Vcn=G_();Object.defineProperty(z,"canonicalJson",{enumerable:!0,get:function(){return Vcn.canonicalJson}});var NI=Y4();Object.defineProperty(z,"CANONICAL_OPAQUE_ID_MAX_BYTES",{enumerable:!0,get:function(){return NI.CANONICAL_OPAQUE_ID_MAX_BYTES}});Object.defineProperty(z,"CANONICAL_OPAQUE_ID_PATTERN",{enumerable:!0,get:function(){return NI.CANONICAL_OPAQUE_ID_PATTERN}});Object.defineProperty(z,"assertCanonicalOpaqueId",{enumerable:!0,get:function(){return NI.assertCanonicalOpaqueId}});Object.defineProperty(z,"compareCanonicalKeys",{enumerable:!0,get:function(){return NI.compareCanonicalKeys}});Object.defineProperty(z,"isCanonicalOpaqueId",{enumerable:!0,get:function(){return NI.isCanonicalOpaqueId}});Object.defineProperty(z,"isCanonicalText",{enumerable:!0,get:function(){return NI.isCanonicalText}});Object.defineProperty(z,"utf8ByteLength",{enumerable:!0,get:function(){return NI.utf8ByteLength}});var Qd=T0t();Object.defineProperty(z,"ENCRYPTION_KEY_MIN_BYTES",{enumerable:!0,get:function(){return Qd.ENCRYPTION_KEY_MIN_BYTES}});Object.defineProperty(z,"PG_ENCRYPTION_WIRE_VERSIONS",{enumerable:!0,get:function(){return Qd.PG_ENCRYPTION_WIRE_VERSIONS}});Object.defineProperty(z,"PgDecryptionFailedError",{enumerable:!0,get:function(){return Qd.PgDecryptionFailedError}});Object.defineProperty(z,"PgEncryptionError",{enumerable:!0,get:function(){return Qd.PgEncryptionError}});Object.defineProperty(z,"PgEncryptionKeyMissingError",{enumerable:!0,get:function(){return Qd.PgEncryptionKeyMissingError}});Object.defineProperty(z,"PgEncryptionWireFormatError",{enumerable:!0,get:function(){return Qd.PgEncryptionWireFormatError}});Object.defineProperty(z,"decodeWireFormat",{enumerable:!0,get:function(){return Qd.decodeWireFormat}});Object.defineProperty(z,"decrypt",{enumerable:!0,get:function(){return Qd.decrypt}});Object.defineProperty(z,"decryptSqlFragment",{enumerable:!0,get:function(){return Qd.decryptSqlFragment}});Object.defineProperty(z,"encodeWireFormat",{enumerable:!0,get:function(){return Qd.encodeWireFormat}});Object.defineProperty(z,"encrypt",{enumerable:!0,get:function(){return Qd.encrypt}});Object.defineProperty(z,"encryptSqlFragment",{enumerable:!0,get:function(){return Qd.encryptSqlFragment}});Object.defineProperty(z,"isPgcryptoIntegrityError",{enumerable:!0,get:function(){return Qd.isPgcryptoIntegrityError}});Object.defineProperty(z,"validateEncryptionKey",{enumerable:!0,get:function(){return Qd.validateEncryptionKey}});var io=x0t();Object.defineProperty(z,"SETUP_CONTRACT_VERSION",{enumerable:!0,get:function(){return io.SETUP_CONTRACT_VERSION}});Object.defineProperty(z,"PROTECTED_CARD_MAX_DRAWS",{enumerable:!0,get:function(){return io.PROTECTED_CARD_MAX_DRAWS}});Object.defineProperty(z,"SETUP_DEFAULT_AGGREGATE_CENTS",{enumerable:!0,get:function(){return io.SETUP_DEFAULT_AGGREGATE_CENTS}});Object.defineProperty(z,"SETUP_DEFAULT_PER_PURCHASE_CENTS",{enumerable:!0,get:function(){return io.SETUP_DEFAULT_PER_PURCHASE_CENTS}});Object.defineProperty(z,"SETUP_IDENTITY_STEPS",{enumerable:!0,get:function(){return io.SETUP_IDENTITY_STEPS}});Object.defineProperty(z,"SETUP_POLL_MS",{enumerable:!0,get:function(){return io.SETUP_POLL_MS}});Object.defineProperty(z,"SETUP_RAILS",{enumerable:!0,get:function(){return io.SETUP_RAILS}});Object.defineProperty(z,"SETUP_RAIL_STEPS",{enumerable:!0,get:function(){return io.SETUP_RAIL_STEPS}});Object.defineProperty(z,"SETUP_STATES",{enumerable:!0,get:function(){return io.SETUP_STATES}});Object.defineProperty(z,"SETUP_STEPS",{enumerable:!0,get:function(){return io.SETUP_STEPS}});Object.defineProperty(z,"SETUP_STEP_STATUSES",{enumerable:!0,get:function(){return io.SETUP_STEP_STATUSES}});Object.defineProperty(z,"SETUP_TERMINAL_STATES",{enumerable:!0,get:function(){return io.SETUP_TERMINAL_STATES}});Object.defineProperty(z,"TARGETED_AWAITING_RUNTIME_LABEL",{enumerable:!0,get:function(){return io.TARGETED_AWAITING_RUNTIME_LABEL}});Object.defineProperty(z,"UNBOUND_AWAITING_RUNTIME_LABEL",{enumerable:!0,get:function(){return io.UNBOUND_AWAITING_RUNTIME_LABEL}});Object.defineProperty(z,"computeSetupNextAction",{enumerable:!0,get:function(){return io.computeSetupNextAction}});Object.defineProperty(z,"computeSetupReadiness",{enumerable:!0,get:function(){return io.computeSetupReadiness}});Object.defineProperty(z,"computeSetupStatus",{enumerable:!0,get:function(){return io.computeSetupStatus}});Object.defineProperty(z,"computeSetupStepTargets",{enumerable:!0,get:function(){return io.computeSetupStepTargets}});Object.defineProperty(z,"isSetupPlanSettled",{enumerable:!0,get:function(){return io.isSetupPlanSettled}});Object.defineProperty(z,"isTerminal",{enumerable:!0,get:function(){return io.isTerminal}});Object.defineProperty(z,"progressLadder",{enumerable:!0,get:function(){return io.progressLadder}});Object.defineProperty(z,"setupPlanSteps",{enumerable:!0,get:function(){return io.setupPlanSteps}});Object.defineProperty(z,"setupProgressSteps",{enumerable:!0,get:function(){return io.setupProgressSteps}});var aB=O0t();Object.defineProperty(z,"runtimeLabel",{enumerable:!0,get:function(){return aB.runtimeLabel}});Object.defineProperty(z,"canonicalRuntimeId",{enumerable:!0,get:function(){return aB.canonicalRuntimeId}});Object.defineProperty(z,"runtimeMatchAliases",{enumerable:!0,get:function(){return aB.runtimeMatchAliases}});Object.defineProperty(z,"runtimesMatch",{enumerable:!0,get:function(){return aB.runtimesMatch}});Object.defineProperty(z,"claimBindingMode",{enumerable:!0,get:function(){return aB.claimBindingMode}});var cB=R0t();Object.defineProperty(z,"ACTIVE_RAILWAY_SERVICES",{enumerable:!0,get:function(){return cB.ACTIVE_RAILWAY_SERVICES}});Object.defineProperty(z,"PROVIDER_CONFIGURATION_VARIABLE_KEYS",{enumerable:!0,get:function(){return cB.PROVIDER_CONFIGURATION_VARIABLE_KEYS}});Object.defineProperty(z,"RELEASE_MANIFEST_SCHEMA_VERSION",{enumerable:!0,get:function(){return cB.RELEASE_MANIFEST_SCHEMA_VERSION}});Object.defineProperty(z,"ReleaseManifestValidationError",{enumerable:!0,get:function(){return cB.ReleaseManifestValidationError}});Object.defineProperty(z,"validateReleaseManifest",{enumerable:!0,get:function(){return cB.validateReleaseManifest}})});var uOe=_(el=>{"use strict";Object.defineProperty(el,"__esModule",{value:!0});el.PRODUCT_SPEND_POLICY_VERSION=void 0;el.canonicalMerchantOriginPattern=V0t;el.canonicalMerchantPathPrefix=F0t;el.canonicalMerchantTarget=$0t;el.canonicalOwnerProductSpendPolicy=z0t;el.canonicalRuntimeProductSpendAttenuation=G0t;el.productSpendPolicyHash=K0t;el.isProductSpendPolicySubset=eun;el.evaluateProductSpendPolicy=tun;var Fcn=require("node:crypto"),$cn=qf();el.PRODUCT_SPEND_POLICY_VERSION=1;var zcn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,B0t=/^(?:0|[1-9][0-9]*)$/,j0t=/^eip155:[1-9][0-9]{0,15}$/,q0t=/^eip155:[1-9][0-9]{0,15}\/erc20:0x[0-9a-f]{40}$/,Gcn=128,Kcn=64;function aOe(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function cOe(e,t,r){let n=new Set(r);for(let i of Object.keys(t))if(!n.has(i))throw new Error(`${e} contains unknown key '${i}'`)}function Vv(e,t){if(typeof t!="string"||!zcn.test(t))throw new Error(`${e} must be a UUID`);return t.toLowerCase()}function Wee(e,t){if(!Number.isSafeInteger(t)||t<=0)throw new Error(`${e} must be a positive safe integer`);return t}function Kee(e,t,r=!1){if(typeof t!="string"||!B0t.test(t)||!r&&t==="0")throw new Error(`${e} must be a ${r?"non-negative":"positive"} canonical integer string`);let n=BigInt(t);if(n>9223372036854775807n)throw new Error(`${e} exceeds bigint storage`);return n.toString()}function Wcn(e,t){if(typeof t!="string")throw new Error(`${e} must be an ISO timestamp`);let r=Date.parse(t);if(!Number.isFinite(r))throw new Error(`${e} must be an ISO timestamp`);let n=new Date(r).toISOString();if(t!==n)throw new Error(`${e} must be canonical UTC ISO-8601`);return n}function k0t(e,t,r){if(!Array.isArray(t)||t.length===0||t.length>Kcn)throw new Error(`${e} must be a non-empty bounded array`);let n=t.map(i=>{if(typeof i!="string"||!r.test(i))throw new Error(`${e} contains a non-canonical value`);return i});if(new Set(n).size!==n.length)throw new Error(`${e} must not repeat`);return[...n].sort()}function Ycn(e){if(e.startsWith("https://*.")){let t=e.slice(10);if(t.includes("*"))throw new Error("merchant wildcard must be the left-most full label");return{wildcard:!0,parseable:`https://wildcard.${t}`}}if(e.includes("*"))throw new Error("merchant wildcard must be the left-most full label");return{wildcard:!1,parseable:e}}function H0t(e,t){if(t.length===0||t.length>253||t.endsWith(".")||t.includes(":")||/^\d+(?:\.\d+){3}$/.test(t))throw new Error(`${e} must use a canonical DNS hostname`);for(let r of t.split("."))if(r.length===0||r.length>63||!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(r))throw new Error(`${e} must use a canonical DNS hostname`)}function V0t(e){if(typeof e!="string"||e.length===0||e.length>512)throw new Error("merchant origin pattern must be a bounded string");let{wildcard:t,parseable:r}=Ycn(e),n;try{n=new URL(r)}catch{throw new Error("merchant origin pattern must be a valid URL")}if(n.protocol!=="https:"||n.username!==""||n.password!==""||n.search!==""||n.hash!==""||n.pathname!=="/")throw new Error("merchant origin pattern must be a credential-free HTTPS origin");let i=t?n.hostname.replace(/^wildcard\./,""):n.hostname;if(H0t("merchant origin pattern",i),t&&!i.includes("."))throw new Error("merchant wildcard must retain a registrable parent label");return`https://${t?"*.":""}${i}${n.port===""?"":`:${n.port}`}`}function F0t(e){if(typeof e!="string"||e.length===0||e.length>1024)throw new Error("merchant path prefix must be a bounded string");if(!e.startsWith("/")||e.includes("?")||e.includes("#")||e.includes("\\"))throw new Error("merchant path prefix must be an absolute URL path");if(new URL(e,"https://policy.invalid").pathname!==e)throw new Error("merchant path prefix must be canonical");return e!=="/"&&e.endsWith("/")?e.slice(0,-1):e}function $0t(e){if(typeof e!="string"||e.length===0||e.length>2048)throw new Error("merchant target must be a bounded URL");let t;try{t=new URL(e)}catch{throw new Error("merchant target must be a valid URL")}if(t.protocol!=="https:"||t.username!==""||t.password!==""||t.hash!=="")throw new Error("merchant target must be a credential-free HTTPS URL");return H0t("merchant target",t.hostname),{origin:t.origin,path:t.pathname}}function Jcn(e){if(!aOe(e))throw new Error("merchant rule must be an object");if(cOe("merchant rule",e,["effect","originPattern","pathPrefix"]),e.effect!=="allow"&&e.effect!=="deny")throw new Error("merchant rule effect must be allow or deny");return{effect:e.effect,originPattern:V0t(e.originPattern),pathPrefix:F0t(e.pathPrefix)}}function Xcn(e,t){let r=`${e.effect}\0${e.originPattern}\0${e.pathPrefix}`,n=`${t.effect}\0${t.originPattern}\0${t.pathPrefix}`;return r<n?-1:r>n?1:0}function Yee(e){if(e.v!==el.PRODUCT_SPEND_POLICY_VERSION)throw new Error("policy.v must be 1");let t=Kee("totalMicros",e.totalMicros),r=Kee("perTransactionMicros",e.perTransactionMicros,!0),n=e.dailyMicros===void 0?void 0:Kee("dailyMicros",e.dailyMicros,!0),i=e.sessionMicros===void 0?void 0:Kee("sessionMicros",e.sessionMicros,!0);for(let[u,d]of[["perTransactionMicros",r],["dailyMicros",n],["sessionMicros",i]])if(d!==void 0&&BigInt(d)>BigInt(t))throw new Error(`${u} cannot exceed totalMicros`);let o=k0t("networks",e.networks,j0t),s=k0t("assets",e.assets,q0t);for(let u of s)if(!o.includes(u.slice(0,u.indexOf("/"))))throw new Error("each allowed asset must belong to an allowed network");if(e.merchantDefault!=="allow"&&e.merchantDefault!=="deny")throw new Error("merchantDefault must be allow or deny");if(!Array.isArray(e.merchantRules)||e.merchantRules.length>Gcn)throw new Error("merchantRules must be a bounded array");let a=e.merchantRules.map(Jcn).sort(Xcn),c=a.map(u=>JSON.stringify(u));if(new Set(c).size!==c.length)throw new Error("merchantRules must not repeat");return{v:el.PRODUCT_SPEND_POLICY_VERSION,totalMicros:t,perTransactionMicros:r,...n===void 0?{}:{dailyMicros:n},...i===void 0?{}:{sessionMicros:i},networks:o,assets:s,merchantDefault:e.merchantDefault,merchantRules:a,expiresAt:Wcn("expiresAt",e.expiresAt)}}function z0t(e){if(!aOe(e))throw new Error("owner product spend policy must be an object");if(cOe("owner product spend policy",e,["v","policyId","agentId","version","status","grantId","grantVersion","totalMicros","perTransactionMicros","dailyMicros","sessionMicros","networks","assets","merchantDefault","merchantRules","expiresAt"]),e.status!=="active"&&e.status!=="superseded"&&e.status!=="revoked")throw new Error("invalid product spend policy status");return{...Yee(e),policyId:Vv("policyId",e.policyId),agentId:Vv("agentId",e.agentId),version:Wee("version",e.version),status:e.status,grantId:Vv("grantId",e.grantId),grantVersion:Wee("grantVersion",e.grantVersion)}}function G0t(e){if(!aOe(e))throw new Error("runtime product spend attenuation must be an object");return cOe("runtime product spend attenuation",e,["v","attenuationId","agentId","runtimeId","version","ownerPolicyId","ownerPolicyVersion","supersedesAttenuationId","totalMicros","perTransactionMicros","dailyMicros","sessionMicros","networks","assets","merchantDefault","merchantRules","expiresAt"]),{...Yee(e),attenuationId:Vv("attenuationId",e.attenuationId),agentId:Vv("agentId",e.agentId),runtimeId:Vv("runtimeId",e.runtimeId),version:Wee("version",e.version),ownerPolicyId:Vv("ownerPolicyId",e.ownerPolicyId),ownerPolicyVersion:Wee("ownerPolicyVersion",e.ownerPolicyVersion),...e.supersedesAttenuationId===void 0?{}:{supersedesAttenuationId:Vv("supersedesAttenuationId",e.supersedesAttenuationId)}}}function K0t(e){return(0,Fcn.createHash)("sha256").update((0,$cn.canonicalJson)(e)).digest("base64url")}function D0t(e,t){let r=new Set(t);return e.every(n=>r.has(n))}function sOe(e){let t=e.startsWith("https://*."),r=t?`https://wildcard.${e.slice(10)}`:e,n=new URL(r);return{wildcard:t,hostname:t?n.hostname.replace(/^wildcard\./,""):n.hostname,port:n.port}}function W0t(e,t){return t.wildcard?e.endsWith(`.${t.hostname}`)&&e!==t.hostname:e===t.hostname}function Y0t(e,t){return t==="/"||e===t||e.startsWith(`${t}/`)}function Zcn(e,t){let r=new URL(t.origin),n=sOe(e.originPattern);return r.port===n.port&&W0t(r.hostname,n)&&Y0t(t.path,e.pathPrefix)}function Qcn(e,t){let r=sOe(e),n=sOe(t);return r.port!==n.port?!1:n.wildcard?r.wildcard?r.hostname===n.hostname||r.hostname.endsWith(`.${n.hostname}`):W0t(r.hostname,n):!r.wildcard&&r.hostname===n.hostname}function L0t(e,t){return Qcn(e.originPattern,t.originPattern)&&Y0t(e.pathPrefix,t.pathPrefix)}function U0t(e,t){return t===void 0?!0:e!==void 0&&BigInt(e)<=BigInt(t)}function eun(e,t){let r,n;try{r=Yee(e),n=Yee(t)}catch{return!1}if(BigInt(r.totalMicros)>BigInt(n.totalMicros)||BigInt(r.perTransactionMicros)>BigInt(n.perTransactionMicros)||!U0t(r.dailyMicros,n.dailyMicros)||!U0t(r.sessionMicros,n.sessionMicros)||Date.parse(r.expiresAt)>Date.parse(n.expiresAt)||!D0t(r.networks,n.networks)||!D0t(r.assets,n.assets))return!1;let i=r.merchantRules.filter(({effect:u})=>u==="allow"),o=n.merchantRules.filter(({effect:u})=>u==="allow");if(n.merchantDefault==="deny"&&r.merchantDefault==="allow"||n.merchantDefault==="deny"&&!i.every(u=>o.some(d=>L0t(u,d))))return!1;let s=r.merchantRules.filter(({effect:u})=>u==="deny"),a=n.merchantRules.filter(({effect:u})=>u==="deny");return!(!(r.merchantDefault==="deny"&&i.length===0)&&!a.every(u=>s.some(d=>L0t(u,d))))}function Hv(e,t){if(typeof t!="string"||!B0t.test(t))throw new Error(`${e} must be a canonical non-negative integer string`);let r=BigInt(t);if(r>9223372036854775807n)throw new Error(`${e} exceeds bigint storage`);return r}function tun(e){let t,r,n,i,o,s,a;try{if(t="policyId"in e.policy?z0t(e.policy):G0t(e.policy),r=Hv("amountMicros",e.amountMicros),r===0n)throw new Error("amountMicros must be positive");if(n=e.hardMaximumMicros===void 0?void 0:Hv("hardMaximumMicros",e.hardMaximumMicros),!j0t.test(e.network)||!q0t.test(e.asset))throw new Error("network or asset is not canonical");i=$0t(e.merchantUrl),o=Hv("totalSpentMicros",e.usage.totalSpentMicros)+Hv("totalReservedMicros",e.usage.totalReservedMicros),s=Hv("dailySpentMicros",e.usage.dailySpentMicros)+Hv("dailyReservedMicros",e.usage.dailyReservedMicros),a=Hv("sessionSpentMicros",e.usage.sessionSpentMicros)+Hv("sessionReservedMicros",e.usage.sessionReservedMicros)}catch{return{ok:!1,reason:"invalid_state"}}if("status"in t&&t.status!=="active")return{ok:!1,reason:"policy_not_active"};if(!Number.isFinite(e.nowMs))return{ok:!1,reason:"invalid_state"};if(e.nowMs>=Date.parse(t.expiresAt))return{ok:!1,reason:"policy_expired"};if(!t.networks.includes(e.network))return{ok:!1,reason:"network_not_allowed"};if(!t.assets.includes(e.asset))return{ok:!1,reason:"asset_not_allowed"};let c=t.merchantRules.filter(p=>Zcn(p,i));if(c.some(({effect:p})=>p==="deny"))return{ok:!1,reason:"merchant_denied"};if(t.merchantDefault==="deny"&&!c.some(({effect:p})=>p==="allow"))return{ok:!1,reason:"merchant_not_allowed"};if(n!==void 0&&r>n)return{ok:!1,reason:"over_hard_maximum"};if(r>BigInt(t.perTransactionMicros))return{ok:!1,reason:"over_per_transaction"};let u=BigInt(t.totalMicros)-o;if(r>u)return{ok:!1,reason:"over_total"};let d=t.dailyMicros===void 0?null:BigInt(t.dailyMicros)-s;if(d!==null&&r>d)return{ok:!1,reason:"over_daily"};let l=t.sessionMicros===void 0?null:BigInt(t.sessionMicros)-a;return l!==null&&r>l?{ok:!1,reason:"over_session"}:{ok:!0,policyHash:K0t(t),totalRemainingMicros:(u-r).toString(),dailyRemainingMicros:d===null?null:(d-r).toString(),sessionRemainingMicros:l===null?null:(l-r).toString()}}});var rgt=_(Jee=>{"use strict";Object.defineProperty(Jee,"__esModule",{value:!0});Jee.canonicalLegacyWalletSpendPolicy=tgt;Jee.importLegacyWalletSpendPolicy=dun;var X0t=uOe(),Z0t=9223372036854775807n,Q0t=/^eip155:[1-9][0-9]{0,15}$/,run=/^eip155:[1-9][0-9]{0,15}\/erc20:0x[0-9a-f]{40}$/,nun=16,iun=128;function oun(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function sun(e){let t=new Set(["perTxCapUsd","dailyCapUsd","sessionBudgetUsd","allowedNetworks","merchantAllowlist","merchantDenylist","expiresAt"]);for(let r of Object.keys(e))if(!t.has(r))throw new Error(`legacy wallet policy contains unknown key '${r}'`)}function f8(e,t){if(typeof t!="string")throw new Error(`${e} must be a USD decimal string`);let r=/^(0|[1-9][0-9]*)(?:\.([0-9]{1,6}))?$/.exec(t);if(!r)throw new Error(`${e} must be a canonical USD amount with at most 6 decimals`);let n=BigInt(`${r[1]}${(r[2]??"").padEnd(6,"0")}`);if(n>Z0t)throw new Error(`${e} exceeds bigint storage`);return n.toString()}function egt(e,t){if(typeof t!="string")throw new Error(`${e} must be an ISO timestamp`);let r=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/.exec(t);if(!r)throw new Error(`${e} must be an ISO timestamp with an explicit timezone`);let[,n,i,o,s,a,c]=r,u=Number(n),d=Number(i),l=Number(o),p=Number(s),f=Number(a),m=Number(c),h=new Date(0);if(h.setUTCFullYear(u,d-1,l),h.setUTCHours(p,f,m,0),u===0||h.getUTCFullYear()!==u||h.getUTCMonth()!==d-1||h.getUTCDate()!==l||h.getUTCHours()!==p||h.getUTCMinutes()!==f||h.getUTCSeconds()!==m)throw new Error(`${e} must contain a valid calendar instant`);let g=Date.parse(t);if(!Number.isFinite(g))throw new Error(`${e} must be an ISO timestamp`);return new Date(g).toISOString()}function aun(e){if(!Array.isArray(e)||e.length===0||e.length>nun)throw new Error("allowedNetworks must be a non-empty bounded array");let t=e.map(r=>{if(typeof r!="string"||!Q0t.test(r))throw new Error("allowedNetworks contains a non-canonical network");return r});return[...new Set(t)].sort()}function cun(e){if(typeof e!="string"||e.length===0||e.length>255)throw new Error("legacy merchant host must be a bounded string");if(e.includes("/")||e.includes("@")||e.includes("*")||e.includes(":"))throw new Error("legacy merchant host must be an exact DNS host");let t;try{t=new URL(`https://${e}`)}catch{throw new Error("legacy merchant host must be a valid DNS host")}let r=t.host.toLowerCase();if(e.toLowerCase()!==r)throw new Error("legacy merchant host must already have canonical URL spelling");return(0,X0t.canonicalMerchantOriginPattern)(`https://${r}`),r}function J0t(e,t){if(t!==void 0){if(!Array.isArray(t)||t.length>iun)throw new Error(`${e} must be a bounded array`);return[...new Set(t.map(cun))].sort()}}function tgt(e){if(!oun(e))throw new Error("legacy wallet policy must be an object");sun(e);let t=J0t("merchantAllowlist",e.merchantAllowlist),r=J0t("merchantDenylist",e.merchantDenylist);return f8("perTxCapUsd",e.perTxCapUsd),f8("dailyCapUsd",e.dailyCapUsd),f8("sessionBudgetUsd",e.sessionBudgetUsd),{perTxCapUsd:e.perTxCapUsd,dailyCapUsd:e.dailyCapUsd,sessionBudgetUsd:e.sessionBudgetUsd,allowedNetworks:aun(e.allowedNetworks),...t===void 0?{}:{merchantAllowlist:t},...r===void 0?{}:{merchantDenylist:r},...e.expiresAt===void 0?{}:{expiresAt:egt("expiresAt",e.expiresAt)}}}function dOe(e,t){if(typeof t!="string"||!/^[1-9][0-9]*$/.test(t))throw new Error(`${e} must be a positive canonical micros string`);let r=BigInt(t);if(r>Z0t)throw new Error(`${e} exceeds bigint storage`);return r.toString()}function uB(e,t){return(BigInt(e)<=BigInt(t)?BigInt(e):BigInt(t)).toString()}function uun(e){let t=(e.merchantAllowlist??[]).map(n=>({effect:"allow",originPattern:`https://${n}`,pathPrefix:"/"})),r=(e.merchantDenylist??[]).map(n=>({effect:"deny",originPattern:`https://${n}`,pathPrefix:"/"}));return[...t,...r]}function dun(e){let t=tgt(e.policy),r=dOe("grantTotalMicros",e.context.grantTotalMicros),n=dOe("grantPerTransactionMicros",e.context.grantPerTransactionMicros),i=e.context.grantDailyMicros===void 0?r:dOe("grantDailyMicros",e.context.grantDailyMicros),o=egt("grantExpiresAt",e.context.grantExpiresAt);if(!Q0t.test(e.context.walletNetwork))throw new Error("walletNetwork must be a canonical CAIP-2 identifier");if(!run.test(e.context.walletAsset)||!e.context.walletAsset.startsWith(`${e.context.walletNetwork}/`))throw new Error("walletAsset must be the canonical asset on walletNetwork");if(!t.allowedNetworks.includes(e.context.walletNetwork))throw new Error("the legacy policy does not allow the active wallet network");let s=f8("perTxCapUsd",t.perTxCapUsd),a=f8("dailyCapUsd",t.dailyCapUsd),c=f8("sessionBudgetUsd",t.sessionBudgetUsd),u=t.expiresAt?new Date(Math.min(Date.parse(t.expiresAt),Date.parse(o))).toISOString():o;return{v:X0t.PRODUCT_SPEND_POLICY_VERSION,totalMicros:r,perTransactionMicros:uB(s,uB(n,r)),dailyMicros:uB(a,uB(i,r)),sessionMicros:uB(c,r),networks:[e.context.walletNetwork],assets:[e.context.walletAsset],merchantDefault:t.merchantAllowlist===void 0?"allow":"deny",merchantRules:uun(t),expiresAt:u}}});var Fv=_(Xee=>{"use strict";Object.defineProperty(Xee,"__esModule",{value:!0});Xee.prepareRootSignedJws=lun;Xee.completeRootSignedJws=pun;var lOe=jS();function lun(e,t,r){let n=(0,lOe.bytesToBase64Url)(new TextEncoder().encode(JSON.stringify({alg:"EdDSA",kid:t,typ:e}))),i=(0,lOe.bytesToBase64Url)(new TextEncoder().encode(JSON.stringify(r)));return{signingInput:`${n}.${i}`}}function pun(e,t,r){if(!(t instanceof Uint8Array)||t.length!==64)throw new Error(`${r} signature must be exactly 64 raw Ed25519 bytes`);return`${e}.${(0,lOe.bytesToBase64Url)(t)}`}});var Zee=_(oo=>{"use strict";Object.defineProperty(oo,"__esModule",{value:!0});oo.HOSTED_RUNTIME_CERTIFICATE_PURPOSES=oo.RUNTIME_CERTIFICATE_PURPOSES=oo.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=oo.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=oo.RUNTIME_CERTIFICATE_VERSION=oo.RUNTIME_CERTIFICATE_TYP=void 0;oo.runtimeCertificateMaxTtl=ogt;oo.isCanonicalBase64Url32=fOe;oo.prepareRuntimeCertificate=bun;var ngt=jS(),igt=SW(),fun=Fv();oo.RUNTIME_CERTIFICATE_TYP="visa-agent-runtime-cert+jwt";oo.RUNTIME_CERTIFICATE_VERSION=1;oo.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=1440*60;oo.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=366*24*60*60;function ogt(e){return e.length===1&&e[0]==="card:vic"?oo.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS:oo.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS}oo.RUNTIME_CERTIFICATE_PURPOSES=["tap","subway","card:vic","wallet:x402"];oo.HOSTED_RUNTIME_CERTIFICATE_PURPOSES=["card:vic","wallet:x402","tap"];var mun=new Set(oo.RUNTIME_CERTIFICATE_PURPOSES),pOe=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,hun=/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;function fOe(e){if(typeof e!="string"||!hun.test(e))return!1;let t=(0,ngt.base64UrlToBytes)(e);return t.length===32&&(0,ngt.bytesToBase64Url)(t)===e}function gun(e){return{kty:"OKP",crv:"Ed25519",x:e.x}}function _un(e){if(!Array.isArray(e)||e.length===0)throw new Error("runtime certificate requires at least one purpose");let t=[...new Set(e)];if(t.length!==e.length||t.some(r=>!mun.has(r)))throw new Error("runtime certificate purposes must be unique supported values");return t.sort()}function yun(e,t){if(!Number.isSafeInteger(t)||t<0)throw new Error(`${e} must be a non-negative unix-seconds integer`)}function bun(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=e.ttlSeconds??oo.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS,n=ogt(e.purposes),i=e.certificateId??globalThis.crypto.randomUUID();if(yun("nowSec",t),!Number.isSafeInteger(r)||r<=0||r>n)throw new Error(`runtime certificate ttlSeconds must be in (0, ${n}]`);if(!pOe.test(e.agentId)||!pOe.test(e.runtimeId))throw new Error("runtime certificate agentId/runtimeId must be canonical UUIDs");if(!pOe.test(i))throw new Error("runtime certificate certificateId must be a canonical UUID");if(!fOe(e.rootJkt))throw new Error("runtime certificate rootJkt must be a canonical RFC 7638 thumbprint");if(!e.rootKid||e.rootKid.length>256)throw new Error("runtime certificate rootKid must be a bounded non-empty identifier");if((0,igt.computeJkt)(e.rootPublicJwk)!==e.rootJkt)throw new Error("runtime certificate signer public key does not match rootJkt");let s=gun(e.runtimePublicJwk);if(!fOe(s.x))throw new Error("runtime certificate child key must be canonical Ed25519");let a=(0,igt.computeJkt)(s);if(a===e.rootJkt)throw new Error("runtime certificate child key must differ from the identity root");let c={v:oo.RUNTIME_CERTIFICATE_VERSION,iss:e.rootJkt,sub:e.agentId,jti:i,runtimeId:e.runtimeId,cnf:{jwk:s,jkt:a},purposes:_un(e.purposes),iat:t,nbf:t,exp:t+r};return{...(0,fun.prepareRootSignedJws)(oo.RUNTIME_CERTIFICATE_TYP,e.rootKid,c),claims:c}}});var hOe=_(_h=>{"use strict";var Eun=_h&&_h.__createBinding||(Object.create?(function(e,t,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(t,r);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[r]}}),Object.defineProperty(e,n,i)}):(function(e,t,r,n){n===void 0&&(n=r),e[n]=t[r]})),Sun=_h&&_h.__exportStar||function(e,t){for(var r in e)r!=="default"&&!Object.prototype.hasOwnProperty.call(t,r)&&Eun(t,e,r)};Object.defineProperty(_h,"__esModule",{value:!0});_h.completeRuntimeCertificate=agt;_h.issueRuntimeCertificate=Aun;_h.peekRuntimeCertificate=Pun;_h.verifyRuntimeCertificate=xun;var sgt=Hu(),mOe=Ju(),vun=Fv();Sun(Zee(),_h);var By=Zee(),Tun=new Set(By.RUNTIME_CERTIFICATE_PURPOSES),dB=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;function agt(e,t){return(0,vun.completeRootSignedJws)(e.signingInput,t,"runtime certificate")}async function Aun(e){let t=(0,By.prepareRuntimeCertificate)({rootKid:e.signer.kid,rootPublicJwk:e.signer.publicJwk,rootJkt:e.rootJkt,agentId:e.agentId,runtimeId:e.runtimeId,runtimePublicJwk:e.runtimePublicJwk,purposes:e.purposes,...e.ttlSeconds===void 0?{}:{ttlSeconds:e.ttlSeconds},...e.nowSec===void 0?{}:{nowSec:e.nowSec},...e.certificateId===void 0?{}:{certificateId:e.certificateId}}),r=await e.signer.sign(new TextEncoder().encode(t.signingInput));return agt(t,r)}function wun(e){if(typeof e!="object"||e===null||Array.isArray(e))return!1;let t=e;return Object.keys(t).length===3&&t.kty==="OKP"&&t.crv==="Ed25519"&&(0,By.isCanonicalBase64Url32)(t.x)}function Iun(e){return Array.isArray(e)&&e.length>0&&e.every(t=>typeof t=="string"?Tun.has(t):!1)&&new Set(e).size===e.length&&[...e].sort().every((t,r)=>t===e[r])}function Pun(e){let t=(0,mOe.decodeJwt)(e);return!t||t.header.typ!==By.RUNTIME_CERTIFICATE_TYP||typeof t.claims.sub!="string"||!dB.test(t.claims.sub)||typeof t.claims.iss!="string"||!(0,By.isCanonicalBase64Url32)(t.claims.iss)||typeof t.claims.runtimeId!="string"||!dB.test(t.claims.runtimeId)||typeof t.claims.jti!="string"||!dB.test(t.claims.jti)?null:{agentId:t.claims.sub,rootJkt:t.claims.iss,runtimeId:t.claims.runtimeId,certificateId:t.claims.jti}}async function xun(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)return{ok:!1,reason:"bad_verification_time"};let r=await(0,mOe.verifyJwtSignature)(e,t.jwks);if(!r.ok)return r;if(r.header.typ!==By.RUNTIME_CERTIFICATE_TYP)return{ok:!1,reason:"typ_mismatch"};let n=r.claims;if(n.v!==By.RUNTIME_CERTIFICATE_VERSION||n.iss!==t.expectedRootJkt||n.sub!==t.expectedAgentId||typeof n.jti!="string"||!dB.test(n.jti)||typeof n.runtimeId!="string"||!dB.test(n.runtimeId))return{ok:!1,reason:"claims_mismatch"};if(r.header.kid===void 0)return{ok:!1,reason:"kid_missing"};let i=t.jwks.keys.find(a=>a.kid===r.header.kid);if(!i||(0,sgt.computeJkt)(i)!==t.expectedRootJkt)return{ok:!1,reason:"root_key_mismatch"};if(t.expectedRuntimeId!==void 0&&n.runtimeId!==t.expectedRuntimeId)return{ok:!1,reason:"runtime_mismatch"};if(t.expectedCertificateId!==void 0&&n.jti!==t.expectedCertificateId)return{ok:!1,reason:"certificate_mismatch"};if(!n.cnf||!wun(n.cnf.jwk)||!(0,By.isCanonicalBase64Url32)(n.cnf.jkt))return{ok:!1,reason:"bad_cnf_key"};let o=(0,sgt.computeJkt)(n.cnf.jwk);if(n.cnf.jkt!==o||o!==t.expectedRuntimeJkt)return{ok:!1,reason:"runtime_key_mismatch"};if(!Iun(n.purposes)||!n.purposes.includes(t.requiredPurpose))return{ok:!1,reason:"purpose_denied"};let s=(0,mOe.temporalReason)(n,t.nowSec);return s?{ok:!1,reason:s}:typeof n.nbf!="number"||!Number.isSafeInteger(n.nbf)||n.nbf>t.nowSec||n.nbf!==n.iat?{ok:!1,reason:"not_yet_valid"}:typeof n.iat!="number"||typeof n.exp!="number"||!Number.isSafeInteger(n.iat)||!Number.isSafeInteger(n.exp)||n.exp-n.iat>(0,By.runtimeCertificateMaxTtl)(n.purposes)?{ok:!1,reason:"ttl_exceeded"}:{ok:!0,claims:n,rootJkt:t.expectedRootJkt,runtimeJkt:o}}});var CI=_(tl=>{"use strict";Object.defineProperty(tl,"__esModule",{value:!0});tl.WALLET_BINDING_TYP=tl.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS=tl.RUNTIME_LEASE_MAX_TTL_SECONDS=tl.RUNTIME_DELEGATION_MAX_TTL_SECONDS=tl.RUNTIME_LEASE_SIGNING_MODES=tl.RUNTIME_DELEGATION_TYP=void 0;tl.RUNTIME_DELEGATION_TYP="visa-agent-runtime-delegation+jwt";tl.RUNTIME_LEASE_SIGNING_MODES=["eip3009:exact","permit2:upto"];tl.RUNTIME_DELEGATION_MAX_TTL_SECONDS=366*24*60*60;tl.RUNTIME_LEASE_MAX_TTL_SECONDS=300;tl.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS=30;tl.WALLET_BINDING_TYP="visa-agent-wallet-binding+jwt"});var ite=_(ar=>{"use strict";Object.defineProperty(ar,"__esModule",{value:!0});ar.RUNTIME_LEASE_PURPOSE=ar.RUNTIME_LEASE_AUDIENCE=ar.RUNTIME_LEASE_VERSION=ar.RUNTIME_LEASE_TYP=ar.RUNTIME_DELEGATION_VERSION=ar.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS=ar.RUNTIME_LEASE_MAX_TTL_SECONDS=ar.RUNTIME_DELEGATION_MAX_TTL_SECONDS=ar.RUNTIME_LEASE_SIGNING_MODES=ar.RUNTIME_DELEGATION_TYP=void 0;ar.prepareRuntimeDelegation=lgt;ar.completeRuntimeDelegation=pgt;ar.issueRuntimeDelegation=Nun;ar.issueRuntimeLease=kun;ar.verifyRuntimeDelegation=bOe;ar.verifyRuntimeLeaseChain=Bun;var gOe=require("node:crypto"),tte=Hu(),cgt=Ju(),rte=Fv(),pB=CI();Object.defineProperty(ar,"RUNTIME_DELEGATION_TYP",{enumerable:!0,get:function(){return pB.RUNTIME_DELEGATION_TYP}});Object.defineProperty(ar,"RUNTIME_LEASE_SIGNING_MODES",{enumerable:!0,get:function(){return pB.RUNTIME_LEASE_SIGNING_MODES}});Object.defineProperty(ar,"RUNTIME_DELEGATION_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return pB.RUNTIME_DELEGATION_MAX_TTL_SECONDS}});Object.defineProperty(ar,"RUNTIME_LEASE_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return pB.RUNTIME_LEASE_MAX_TTL_SECONDS}});Object.defineProperty(ar,"RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS",{enumerable:!0,get:function(){return pB.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS}});var _c=CI();ar.RUNTIME_DELEGATION_VERSION=1;ar.RUNTIME_LEASE_TYP="visa-agent-runtime-lease+jwt";ar.RUNTIME_LEASE_VERSION=1;ar.RUNTIME_LEASE_AUDIENCE="urn:visa:tvc:slipgate";ar.RUNTIME_LEASE_PURPOSE="wallet:x402";var MI=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,Oun=/^[A-Za-z0-9_-]{43}$/,_Oe=/^eip155:[1-9][0-9]{0,15}$/,lB=/^[A-Za-z0-9._:@/-]{1,256}$/,Qee=new Map(_c.RUNTIME_LEASE_SIGNING_MODES.map((e,t)=>[e,t]));function rl(e){if(typeof e!="string"||!Oun.test(e))return!1;let t=Buffer.from(e,"base64url");return t.length===32&&t.toString("base64url")===e}function Run(e){let t=e.toLowerCase();if(!_Oe.test(t))throw new Error("runtime authority network is invalid");return t}function $v(e,t){if(!MI.test(t))throw new Error(`${e} must be a canonical UUID`)}function ugt(e,t){if(!lB.test(t))throw new Error(`${e} must be a bounded identifier`)}function ete(e,t){if(!Number.isSafeInteger(t)||t<0)throw new Error(`${e} must be a non-negative unix-seconds integer`)}function nte(e){if(!Array.isArray(e)||e.length===0)throw new Error("runtime authority requires at least one signing mode");let t=[...new Set(e)];if(t.length!==e.length||t.some(r=>!Qee.has(r)))throw new Error("runtime authority signing modes must be unique supported values");return t.sort((r,n)=>Qee.get(r)-Qee.get(n))}function yOe(e,t){let r=Object.keys(e).sort(),n=[...t].sort();return r.length===n.length&&r.every((i,o)=>i===n[o])}function dgt(e){if(!Array.isArray(e)||e.length===0||e.some(r=>typeof r!="string"||!Qee.has(r)))return!1;let t=e;return new Set(t).size===t.length&&nte(t).every((r,n)=>r===t[n])}function lgt(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=e.ttlSeconds??_c.RUNTIME_DELEGATION_MAX_TTL_SECONDS,n=e.maxLeaseTtlSeconds??_c.RUNTIME_LEASE_MAX_TTL_SECONDS,i=e.delegationId??(0,gOe.randomUUID)();if(ete("nowSec",t),!Number.isSafeInteger(r)||r<=0||r>_c.RUNTIME_DELEGATION_MAX_TTL_SECONDS)throw new Error(`runtime delegation ttlSeconds must be in (0, ${_c.RUNTIME_DELEGATION_MAX_TTL_SECONDS}]`);if(!Number.isSafeInteger(n)||n<=0||n>_c.RUNTIME_LEASE_MAX_TTL_SECONDS)throw new Error(`runtime delegation maxLeaseTtlSeconds must be in (0, ${_c.RUNTIME_LEASE_MAX_TTL_SECONDS}]`);if($v("agentId",e.agentId),$v("runtimeId",e.runtimeId),$v("delegationId",i),ugt("rootKid",e.rootKid),!rl(e.rootJkt)||(0,tte.computeJkt)(e.rootPublicJwk)!==e.rootJkt)throw new Error("runtime delegation root public key does not match rootJkt");if(!rl(e.runtimeJkt)||!rl(e.leaseIssuerJkt))throw new Error("runtime delegation runtime/issuer JKT is invalid");if(new Set([e.rootJkt,e.runtimeJkt,e.leaseIssuerJkt]).size!==3)throw new Error("runtime delegation root, runtime, and issuer keys must be distinct");let o=t+r;ete("runtime delegation expiration",o);let s={v:ar.RUNTIME_DELEGATION_VERSION,iss:e.rootJkt,sub:e.agentId,jti:i,runtimeId:e.runtimeId,runtimeJkt:e.runtimeJkt,leaseIssuerJkt:e.leaseIssuerJkt,purpose:ar.RUNTIME_LEASE_PURPOSE,network:Run(e.network),signingModes:nte(e.signingModes),maxLeaseTtlSeconds:n,iat:t,nbf:t,exp:o};return{...(0,rte.prepareRootSignedJws)(_c.RUNTIME_DELEGATION_TYP,e.rootKid,s),claims:s}}function pgt(e,t){return(0,rte.completeRootSignedJws)(e.signingInput,t,"runtime delegation")}async function Nun(e){let t=lgt({...e,rootKid:e.signer.kid,rootPublicJwk:e.signer.publicJwk}),r=await e.signer.sign(new TextEncoder().encode(t.signingInput));return pgt(t,r)}function Cun(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=e.ttlSeconds??e.delegation.maxLeaseTtlSeconds,n=t+r,i=e.leaseId??(0,gOe.randomUUID)();if(ete("nowSec",t),ete("delegationExpiresAt",e.delegation.exp),!Number.isSafeInteger(e.delegation.maxLeaseTtlSeconds)||e.delegation.maxLeaseTtlSeconds<=0||e.delegation.maxLeaseTtlSeconds>_c.RUNTIME_LEASE_MAX_TTL_SECONDS)throw new Error("runtime lease maximum TTL is invalid");if(!Number.isSafeInteger(r)||r<=0||r>e.delegation.maxLeaseTtlSeconds||!Number.isSafeInteger(n)||n>e.delegation.exp)throw new Error("runtime lease TTL exceeds its delegation");if($v("agentId",e.delegation.sub),$v("runtimeId",e.delegation.runtimeId),$v("delegationId",e.delegation.jti),$v("leaseId",i),$v("grantId",e.grantId),ugt("issuerKid",e.issuerKid),!rl(e.delegation.leaseIssuerJkt)||(0,tte.computeJkt)(e.issuerPublicJwk)!==e.delegation.leaseIssuerJkt)throw new Error("runtime lease issuer public key does not match leaseIssuerJkt");if(!rl(e.delegation.iss)||!rl(e.delegation.runtimeJkt))throw new Error("runtime lease root/runtime JKT is invalid");if(new Set([e.delegation.iss,e.delegation.runtimeJkt,e.delegation.leaseIssuerJkt]).size!==3)throw new Error("runtime lease root, runtime, and issuer keys must be distinct");if(!Number.isSafeInteger(e.generation)||e.generation<1)throw new Error("runtime lease generation must be a positive safe integer");if(!Number.isSafeInteger(e.grantVersion)||e.grantVersion<1)throw new Error("runtime lease grantVersion must be a positive safe integer");if(!rl(e.delegationHash))throw new Error("runtime lease delegationHash is invalid");let o=nte(e.signingModes);if(!o.every(a=>e.delegation.signingModes.includes(a)))throw new Error("runtime lease signing modes exceed the verified delegation");let s={v:ar.RUNTIME_LEASE_VERSION,iss:e.delegation.leaseIssuerJkt,sub:e.delegation.sub,aud:ar.RUNTIME_LEASE_AUDIENCE,jti:i,delegationId:e.delegation.jti,delegationHash:e.delegationHash,rootJkt:e.delegation.iss,runtimeId:e.delegation.runtimeId,runtimeJkt:e.delegation.runtimeJkt,purpose:ar.RUNTIME_LEASE_PURPOSE,network:e.delegation.network,signingModes:o,generation:e.generation,grantId:e.grantId,grantVersion:e.grantVersion,iat:t,nbf:t,exp:n};return{...(0,rte.prepareRootSignedJws)(ar.RUNTIME_LEASE_TYP,e.issuerKid,s),claims:s}}function Mun(e,t){return(0,rte.completeRootSignedJws)(e.signingInput,t,"runtime lease")}async function kun(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=await bOe(e.delegationToken,{...e.delegationVerification,nowSec:t});if(!r.ok)throw new Error(`runtime lease delegation refused: ${r.reason}`);let n=Cun({delegation:r.delegation,delegationHash:fgt(e.delegationToken),signingModes:e.signingModes,generation:e.generation,grantId:e.grantId,grantVersion:e.grantVersion,ttlSeconds:e.ttlSeconds,nowSec:t,leaseId:e.leaseId,issuerKid:e.signer.kid,issuerPublicJwk:e.signer.publicJwk}),i=await e.signer.sign(new TextEncoder().encode(n.signingInput));return Mun(n,i)}var Dun=["v","iss","sub","jti","runtimeId","runtimeJkt","leaseIssuerJkt","purpose","network","signingModes","maxLeaseTtlSeconds","iat","nbf","exp"],Lun=["v","iss","sub","aud","jti","delegationId","delegationHash","rootJkt","runtimeId","runtimeJkt","purpose","network","signingModes","generation","grantId","grantVersion","iat","nbf","exp"],Uun=["alg","kid","typ"];function fgt(e){return(0,gOe.createHash)("sha256").update(e,"utf8").digest("base64url")}function mgt(e){try{let t=Buffer.from(e,"base64url");if(t.toString("base64url")!==e)return null;let r=new TextDecoder("utf-8",{fatal:!0}).decode(t),n=JSON.parse(r);return typeof n!="object"||n===null||Array.isArray(n)||JSON.stringify(n)!==r?null:n}catch{return null}}function hgt(e){let t=e.split(".");return t.length===3&&mgt(t[1])!==null}function ggt(e){let t=e.split(".");if(t.length!==3)return!1;let r=mgt(t[0]),n=Buffer.from(t[2],"base64url");return r!==null&&n.length===64&&n.toString("base64url")===t[2]&&yOe(r,Uun)&&typeof r.alg=="string"&&typeof r.kid=="string"&&lB.test(r.kid)}function _gt(e,t,r){return typeof e.iat!="number"||typeof e.nbf!="number"||typeof e.exp!="number"||!Number.isSafeInteger(e.iat)||!Number.isSafeInteger(e.nbf)||!Number.isSafeInteger(e.exp)||e.iat<0||e.nbf!==e.iat||e.exp<=e.iat||e.exp-e.iat>r?"ttl_exceeded":e.iat>t+_c.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS||e.nbf>t+_c.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS?"not_yet_valid":t>=e.exp?"expired":null}async function bOe(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0||t.nowSec>Number.MAX_SAFE_INTEGER-_c.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS||!lB.test(t.expectedRootKid))return{ok:!1,reason:"bad_verification_context"};if(!ggt(e))return{ok:!1,reason:"delegation_header_invalid"};if(!hgt(e))return{ok:!1,reason:"delegation_shape_invalid"};let r=await(0,cgt.verifyJwtSignature)(e,t.ownerJwks);if(!r.ok)return r;if(r.header.typ!==_c.RUNTIME_DELEGATION_TYP)return{ok:!1,reason:"delegation_typ_mismatch"};let n=r.claims;if(!yOe(n,Dun))return{ok:!1,reason:"delegation_shape_invalid"};let i=t.ownerJwks.keys.find(s=>s.kid===t.expectedRootKid);if(r.header.kid!==t.expectedRootKid||!i||(0,tte.computeJkt)(i)!==t.expectedRootJkt)return{ok:!1,reason:"root_key_mismatch"};if(n.v!==ar.RUNTIME_DELEGATION_VERSION||n.iss!==t.expectedRootJkt||n.sub!==t.expectedAgentId||n.jti!==t.expectedDelegationId||n.runtimeId!==t.expectedRuntimeId||n.runtimeJkt!==t.expectedRuntimeJkt||n.leaseIssuerJkt!==t.expectedLeaseIssuerJkt||n.purpose!==ar.RUNTIME_LEASE_PURPOSE||n.network!==t.expectedNetwork.toLowerCase()||!MI.test(n.jti??"")||!MI.test(n.runtimeId??"")||!rl(n.iss)||!rl(n.runtimeJkt)||!rl(n.leaseIssuerJkt)||new Set([n.iss,n.runtimeJkt,n.leaseIssuerJkt]).size!==3||!_Oe.test(n.network??"")||!dgt(n.signingModes)||!Number.isSafeInteger(n.maxLeaseTtlSeconds)||n.maxLeaseTtlSeconds<=0||n.maxLeaseTtlSeconds>_c.RUNTIME_LEASE_MAX_TTL_SECONDS)return{ok:!1,reason:"delegation_claims_mismatch"};let o=_gt(n,t.nowSec,_c.RUNTIME_DELEGATION_MAX_TTL_SECONDS);return o?{ok:!1,reason:`delegation_${o}`}:{ok:!0,delegation:n}}async function Bun(e,t,r){if(!Number.isSafeInteger(r.nowSec)||r.nowSec<0||r.nowSec>Number.MAX_SAFE_INTEGER-_c.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS||!Number.isSafeInteger(r.expectedGeneration)||r.expectedGeneration<1||!Number.isSafeInteger(r.expectedGrantVersion)||r.expectedGrantVersion<1||!lB.test(r.expectedRootKid)||!lB.test(r.expectedLeaseIssuerKid))return{ok:!1,reason:"bad_verification_context"};let n;try{n=nte(r.allowedSigningModes)}catch{return{ok:!1,reason:"bad_verification_context"}}if(!n.includes(r.requiredSigningMode))return{ok:!1,reason:"current_policy_denied"};let i=await bOe(e,r);if(!i.ok)return i;let o=i.delegation;if(!ggt(t))return{ok:!1,reason:"lease_header_invalid"};if(!hgt(t))return{ok:!1,reason:"lease_shape_invalid"};let s=await(0,cgt.verifyJwtSignature)(t,r.issuerJwks);if(!s.ok)return s;if(s.header.typ!==ar.RUNTIME_LEASE_TYP)return{ok:!1,reason:"lease_typ_mismatch"};let a=s.claims;if(!yOe(a,Lun))return{ok:!1,reason:"lease_shape_invalid"};let c=r.issuerJwks.keys.find(d=>d.kid===r.expectedLeaseIssuerKid);if(s.header.kid!==r.expectedLeaseIssuerKid||!c||(0,tte.computeJkt)(c)!==r.expectedLeaseIssuerJkt)return{ok:!1,reason:"lease_issuer_mismatch"};if(a.v!==ar.RUNTIME_LEASE_VERSION||a.iss!==r.expectedLeaseIssuerJkt||a.sub!==r.expectedAgentId||a.aud!==ar.RUNTIME_LEASE_AUDIENCE||a.delegationId!==r.expectedDelegationId||a.delegationHash!==fgt(e)||a.rootJkt!==r.expectedRootJkt||a.runtimeId!==r.expectedRuntimeId||a.runtimeJkt!==r.expectedRuntimeJkt||a.purpose!==ar.RUNTIME_LEASE_PURPOSE||a.network!==r.expectedNetwork.toLowerCase()||a.generation!==r.expectedGeneration||a.grantId!==r.expectedGrantId||a.grantVersion!==r.expectedGrantVersion||!MI.test(a.jti??"")||!MI.test(a.delegationId??"")||!rl(a.delegationHash)||!MI.test(a.runtimeId??"")||!MI.test(a.grantId??"")||!rl(a.iss)||!rl(a.rootJkt)||!rl(a.runtimeJkt)||new Set([a.iss,a.rootJkt,a.runtimeJkt]).size!==3||!_Oe.test(a.network??"")||!dgt(a.signingModes)||!Number.isSafeInteger(a.generation)||a.generation<1||!Number.isSafeInteger(a.grantVersion)||a.grantVersion<1)return{ok:!1,reason:"lease_claims_mismatch"};let u=_gt(a,r.nowSec,Math.min(o.maxLeaseTtlSeconds,_c.RUNTIME_LEASE_MAX_TTL_SECONDS));return u?{ok:!1,reason:`lease_${u}`}:a.iat<o.iat||a.exp>o.exp||!a.signingModes.every(d=>o.signingModes.includes(d))||!a.signingModes.every(d=>n.includes(d))||!o.signingModes.includes(r.requiredSigningMode)||!a.signingModes.includes(r.requiredSigningMode)?{ok:!1,reason:"lease_scope_exceeded"}:{ok:!0,delegation:o,lease:a}}});var SOe=_(Hf=>{"use strict";Object.defineProperty(Hf,"__esModule",{value:!0});Hf.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS=Hf.RUNTIME_LEASE_REQUEST_AUDIENCE=Hf.RUNTIME_LEASE_REQUEST_VERSION=void 0;Hf.runtimeLeaseRequestIntentHash=ygt;Hf.createRuntimeLeaseRequestProofWithSigner=Gun;var jun=_W(),qun=jS(),Hun=Lee(),Vun=CI();Hf.RUNTIME_LEASE_REQUEST_VERSION=1;Hf.RUNTIME_LEASE_REQUEST_AUDIENCE="visa-runtime-lease-requests:v1";Hf.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS=60;var Fun=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,$un=new Set(Vun.RUNTIME_LEASE_SIGNING_MODES);function EOe(e,t){if(!Fun.test(t))throw new Error(`${e} must be a canonical UUID`)}function zun(e){if(EOe("agentId",e.agentId),EOe("runtimeId",e.runtimeId),EOe("requestId",e.requestId),!$un.has(e.signingMode))throw new Error("runtime lease request signingMode is unsupported");return{v:Hf.RUNTIME_LEASE_REQUEST_VERSION,agentId:e.agentId,runtimeId:e.runtimeId,requestId:e.requestId,signingMode:e.signingMode}}function ygt(e){return(0,qun.bytesToBase64Url)((0,jun.sha256)(new TextEncoder().encode(JSON.stringify(zun(e)))))}function Gun(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)throw new Error("runtime lease request nowSec must be a non-negative safe integer");return(0,Hun.createPopProofWithSigner)(e,{nonce:t.requestId,audience:Hf.RUNTIME_LEASE_REQUEST_AUDIENCE,nowSec:t.nowSec,intentHash:ygt(t)})}});var Egt=_(jy=>{"use strict";var Kun=jy&&jy.__createBinding||(Object.create?(function(e,t,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(t,r);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[r]}}),Object.defineProperty(e,n,i)}):(function(e,t,r,n){n===void 0&&(n=r),e[n]=t[r]})),Wun=jy&&jy.__exportStar||function(e,t){for(var r in e)r!=="default"&&!Object.prototype.hasOwnProperty.call(t,r)&&Kun(t,e,r)};Object.defineProperty(jy,"__esModule",{value:!0});jy.createRuntimeLeaseRequestProof=Jun;jy.verifyRuntimeLeaseRequestProof=Xun;var bgt=Dy();Wun(SOe(),jy);var m8=SOe(),Yun=/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;function Jun(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)throw new Error("runtime lease request nowSec must be a non-negative safe integer");return"createLeaseProof"in e&&e.createLeaseProof?((0,m8.runtimeLeaseRequestIntentHash)(t),e.createLeaseProof(t)):(0,bgt.createAgentOperationPopProof)(e,{operationId:t.requestId,audience:m8.RUNTIME_LEASE_REQUEST_AUDIENCE,nowSec:t.nowSec,intentHash:(0,m8.runtimeLeaseRequestIntentHash)(t)})}async function Xun(e,t){if(!Yun.test(t.expectedRuntimeJkt))return{ok:!1,reason:"runtime_jkt_invalid"};if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)return{ok:!1,reason:"verification_time_invalid"};let r;try{r=(0,m8.runtimeLeaseRequestIntentHash)(t)}catch{return{ok:!1,reason:"request_invalid"}}let n=await(0,bgt.verifyAgentOperationPopProof)(e,{operationId:t.requestId,audience:m8.RUNTIME_LEASE_REQUEST_AUDIENCE,nowSec:t.nowSec,expectedIntentHash:r,maxAgeSec:m8.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS});return n.ok?n.runtimeCertificate!==void 0?{ok:!1,reason:"unexpected_runtime_certificate"}:n.jkt!==t.expectedRuntimeJkt?{ok:!1,reason:"runtime_jkt_mismatch"}:{ok:!0,runtimeJkt:n.jkt,requestId:t.requestId}:n}});var Tgt=_(kI=>{"use strict";Object.defineProperty(kI,"__esModule",{value:!0});kI.TAP_RUNTIME_SIGNATURE_DOMAIN=void 0;kI.tapRuntimeSigningMessage=vgt;kI.verifyTapRuntimeSignature=edn;var Sgt=require("node:crypto"),Zun=hOe();kI.TAP_RUNTIME_SIGNATURE_DOMAIN="visa:tap:runtime-signature:v1";function vgt(e){if(!(e instanceof Uint8Array))throw new Error("TAP message must be bytes");let t=Buffer.from(kI.TAP_RUNTIME_SIGNATURE_DOMAIN,"utf8"),r=Buffer.alloc(8);return r.writeBigUInt64BE(BigInt(e.byteLength)),Buffer.concat([t,Buffer.from([0]),r,Buffer.from(e)])}function Qun(e){if(typeof e!="string"||e.length!==86)return null;try{let t=Buffer.from(e,"base64url");return t.length!==64||t.toString("base64url")!==e?null:t}catch{return null}}async function edn(e){if(!(e.message instanceof Uint8Array))return{ok:!1,reason:"malformed_message"};let t=Qun(e.signature);if(!t)return{ok:!1,reason:"malformed_signature"};let r=await(0,Zun.verifyRuntimeCertificate)(e.runtimeCertificate,{jwks:e.rootJwks,expectedAgentId:e.expectedAgentId,expectedRootJkt:e.expectedRootJkt,expectedRuntimeId:e.expectedRuntimeId,expectedRuntimeJkt:e.expectedRuntimeJkt,requiredPurpose:"tap",nowSec:e.nowSec});if(!r.ok)return{ok:!1,reason:`certificate_${r.reason}`};if(r.claims.purposes.length!==1||r.claims.purposes[0]!=="tap")return{ok:!1,reason:"certificate_purpose_not_singleton"};if(e.revokedCertificateIds?.has(r.claims.jti))return{ok:!1,reason:"certificate_revoked"};let n=!1;try{let i=(0,Sgt.createPublicKey)({key:r.claims.cnf.jwk,format:"jwk"});n=(0,Sgt.verify)(null,vgt(e.message),i,t)}catch{return{ok:!1,reason:"runtime_key_invalid"}}return n?{ok:!0,claims:r.claims,agentId:r.claims.sub,rootJkt:r.rootJkt,runtimeId:r.claims.runtimeId,runtimeJkt:r.runtimeJkt}:{ok:!1,reason:"invalid_signature"}}});var kgt=_(On=>{"use strict";Object.defineProperty(On,"__esModule",{value:!0});On.WALLET_BINDING_MAX_TTL_SECONDS=On.WALLET_BINDING_DERIVATION_VERSION=On.WALLET_BINDING_SIGNER_KIND=On.WALLET_BINDING_VERSION=On.WALLET_BINDING_TYP=void 0;On.prepareWalletBinding=Cgt;On.completeWalletBinding=Mgt;On.issueWalletBinding=odn;On.verifyWalletBinding=sdn;var tdn=require("node:crypto"),TOe=Y4(),wgt=Hu(),Agt=Ju(),Igt=Fv(),rdn=CI();Object.defineProperty(On,"WALLET_BINDING_TYP",{enumerable:!0,get:function(){return rdn.WALLET_BINDING_TYP}});var Pgt=CI();On.WALLET_BINDING_VERSION=2;On.WALLET_BINDING_SIGNER_KIND="turnkey_tvc_p256";On.WALLET_BINDING_DERIVATION_VERSION="visa-tvc-slipgate-v2";On.WALLET_BINDING_MAX_TTL_SECONDS=366*24*60*60;var AOe=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,ndn=/^[A-Za-z0-9_-]{43}$/,xgt=/^0x[0-9a-f]{40}$/,Ogt=/^eip155:[1-9][0-9]{0,15}$/,Rgt=/^(02|03)[0-9a-f]{64}$/;function Ngt(e){if(typeof e!="string"||!ndn.test(e))return!1;let t=Buffer.from(e,"base64url");return t.length===32&&t.toString("base64url")===e}function vOe(e,t){if(!(0,TOe.isCanonicalOpaqueId)(t))throw new Error(`${e} must be a bounded opaque identifier`)}function idn(e,t){if(!Number.isSafeInteger(t)||t<0)throw new Error(`${e} must be a non-negative unix-seconds integer`)}function Cgt(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=e.ttlSeconds??On.WALLET_BINDING_MAX_TTL_SECONDS,n=e.bindingId??(0,tdn.randomUUID)();if(idn("nowSec",t),!Number.isSafeInteger(r)||r<=0||r>On.WALLET_BINDING_MAX_TTL_SECONDS)throw new Error(`wallet binding ttlSeconds must be in (0, ${On.WALLET_BINDING_MAX_TTL_SECONDS}]`);if(!AOe.test(e.agentId)||!AOe.test(n))throw new Error("wallet binding agentId/bindingId must be canonical UUIDs");if(!Ngt(e.rootJkt)||(0,wgt.computeJkt)(e.rootPublicJwk)!==e.rootJkt)throw new Error("wallet binding root public key does not match rootJkt");vOe("rootKid",e.rootKid),vOe("subOrganizationId",e.subOrganizationId),vOe("walletId",e.walletId);let i=e.walletAddress.toLowerCase(),o=e.network.toLowerCase(),s=e.executor.publicKey.toLowerCase();if(!xgt.test(i))throw new Error("wallet binding address is invalid");if(!Ogt.test(o))throw new Error("wallet binding network is invalid");if(e.executor.kind!==On.WALLET_BINDING_SIGNER_KIND||e.executor.derivationVersion!==On.WALLET_BINDING_DERIVATION_VERSION||!Rgt.test(s))throw new Error("wallet binding signer descriptor is unsupported or invalid");let a={v:On.WALLET_BINDING_VERSION,iss:e.rootJkt,sub:e.agentId,jti:n,subOrganizationId:e.subOrganizationId,walletId:e.walletId,walletAddress:i,network:o,executor:{kind:On.WALLET_BINDING_SIGNER_KIND,publicKey:s,derivationVersion:On.WALLET_BINDING_DERIVATION_VERSION},iat:t,nbf:t,exp:t+r};return{...(0,Igt.prepareRootSignedJws)(Pgt.WALLET_BINDING_TYP,e.rootKid,a),claims:a}}function Mgt(e,t){return(0,Igt.completeRootSignedJws)(e.signingInput,t,"wallet binding")}async function odn(e){let t=Cgt({...e,rootKid:e.signer.kid,rootPublicJwk:e.signer.publicJwk});return Mgt(t,await e.signer.sign(new TextEncoder().encode(t.signingInput)))}async function sdn(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)return{ok:!1,reason:"bad_verification_time"};let r=await(0,Agt.verifyJwtSignature)(e,t.jwks);if(!r.ok)return r;if(r.header.typ!==Pgt.WALLET_BINDING_TYP)return{ok:!1,reason:"typ_mismatch"};let n=r.claims,i=t.expectedWalletAddress.toLowerCase(),o=t.expectedNetwork.toLowerCase(),s=t.expectedExecutor;if(n.v!==On.WALLET_BINDING_VERSION||n.iss!==t.expectedRootJkt||n.sub!==t.expectedAgentId||typeof n.jti!="string"||!AOe.test(n.jti)||n.subOrganizationId!==t.expectedSubOrganizationId||n.walletId!==t.expectedWalletId||n.walletAddress!==i||n.network!==o||typeof n.executor!="object"||n.executor===null||n.executor.kind!==On.WALLET_BINDING_SIGNER_KIND||typeof n.executor.publicKey!="string"||!Rgt.test(n.executor.publicKey)||n.executor.derivationVersion!==On.WALLET_BINDING_DERIVATION_VERSION||s!==void 0&&(n.executor.kind!==s.kind||n.executor.publicKey!==s.publicKey.toLowerCase()||n.executor.derivationVersion!==s.derivationVersion))return{ok:!1,reason:"claims_mismatch"};if(!(0,TOe.isCanonicalOpaqueId)(n.subOrganizationId)||!(0,TOe.isCanonicalOpaqueId)(n.walletId))return{ok:!1,reason:"identifier_invalid"};if(!Ngt(n.iss)||!xgt.test(n.walletAddress))return{ok:!1,reason:"binding_invalid"};if(!Ogt.test(n.network)||r.header.kid===void 0)return{ok:!1,reason:"binding_invalid"};let a=t.jwks.keys.find(u=>u.kid===r.header.kid);if(!a||(0,wgt.computeJkt)(a)!==t.expectedRootJkt)return{ok:!1,reason:"root_key_mismatch"};let c=(0,Agt.temporalReason)(n,t.nowSec);return c?{ok:!1,reason:c}:typeof n.iat!="number"||typeof n.nbf!="number"||typeof n.exp!="number"||!Number.isSafeInteger(n.iat)||!Number.isSafeInteger(n.nbf)||!Number.isSafeInteger(n.exp)||n.nbf!==n.iat||n.nbf>t.nowSec||n.exp-n.iat>On.WALLET_BINDING_MAX_TTL_SECONDS?{ok:!1,reason:"ttl_exceeded"}:{ok:!0,claims:n}}});var Dgt=_(h8=>{"use strict";Object.defineProperty(h8,"__esModule",{value:!0});h8.INTENT_HASH_VERSION=void 0;h8.canonicalIntentHash=ddn;var adn=require("node:crypto"),cdn=new Set(["USD","EUR","GBP","CAD","AUD","JPY","CHF","CNY","HKD","SGD","INR","MXN","BRL","NZD","SEK","NOK","DKK","ZAR","AED"]);h8.INTENT_HASH_VERSION=1;var udn=/^[A-Za-z0-9_-]{1,128}$/;function ddn(e){let{amount:t,currency:r,payee:n,intentId:i,settlementHash:o}=e;if(!Number.isSafeInteger(t)||t<=0)throw new Error(`intent.amount must be a positive safe integer in minor units (cents); got ${String(t)}`);let s=typeof r=="string"?r.toUpperCase():"";if(!cdn.has(s))throw new Error(`intent.currency must be a supported ISO 4217 code; got ${JSON.stringify(r)}`);if(typeof n!="string"||n.length===0)throw new Error("intent.payee must be a non-empty string");if(i!==void 0&&(typeof i!="string"||i.length===0))throw new Error("intent.intentId, when present, must be a non-empty string");if(o!==void 0&&!udn.test(o))throw new Error("intent.settlementHash, when present, must be a base64url token (1-128 chars)");let a=JSON.stringify({v:h8.INTENT_HASH_VERSION,amount:t,currency:s,payee:n,intentId:i??null,settlementHash:o??null});return(0,adn.createHash)("sha256").update(a,"utf8").digest().toString("base64url")}});var Vgt=_(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS=qi.WALLET_AUTHORIZATION_PERMIT_POLICY_ID=qi.WALLET_AUTHORIZATION_PERMIT_AUDIENCE=qi.WALLET_AUTHORIZATION_PERMIT_ISSUER=qi.WALLET_AUTHORIZATION_PERMIT_JWT_TYP=void 0;qi.issueWalletAuthorizationPermit=Pdn;qi.verifyWalletAuthorizationPermit=xdn;var wOe=dD(),ldn=Y4(),pdn=cPe(),Lgt=Ju(),fdn=Dy(),mdn=Lv();qi.WALLET_AUTHORIZATION_PERMIT_JWT_TYP="visa-wallet-authorization-permit+jwt";qi.WALLET_AUTHORIZATION_PERMIT_ISSUER="visa:wallet-authority";qi.WALLET_AUTHORIZATION_PERMIT_AUDIENCE="visa:wallet-signer";qi.WALLET_AUTHORIZATION_PERMIT_POLICY_ID="wallet-authority-v1";qi.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS=120;var hdn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,IOe=/^0x[0-9a-f]{40}$/,gdn=/^0x[0-9a-f]{64}$/,_dn=/^eip155:(0|[1-9][0-9]*)$/,Bgt=/^(0|[1-9][0-9]*)$/,ydn=9223372036854775807n,jgt=(1n<<256n)-1n,qgt=new Set(["v","authorizationId","agentId","keyJkt","walletApiKeyId","grantId","grantVersion","budgetEpochId","runtimeSessionId","executionChannel","scope","executionMode","x402Version","amountMicros","currency","payer","payee","network","asset","scheme","assetTransferMethod","eip3009Nonce","validAfter","validBefore","settlementHash","settlementExpiresAt","resourceCommitment","intentId","economicIntentId"]),bdn=new Set(["iss","aud","sub","cnf","iat","exp","jti","policy_id","v","authorization_id","agent_id","key_jkt","wallet_api_key_id","grant_id","grant_version","budget_epoch_id","runtime_session_id","execution_channel","scope","execution_mode","x402_version","amount_micros","currency","payer","payee","network","asset","scheme","asset_transfer_method","eip3009_nonce","valid_after","valid_before","settlement_hash","settlement_expires_at","resource_commitment","intent_id","economic_intent_id"]);function _8(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Hgt(e,t,r){let n=Object.keys(t).filter(o=>!r.has(o)),i=[...r].filter(o=>!Object.hasOwn(t,o));if(n.length>0||i.length>0)throw new Error(`${e} does not match the v1 wire shape`)}function g8(e,t){if(typeof t!="string"||!hdn.test(t))throw new Error(`${e} must be a UUID`)}function ste(e,t){if(!(0,ldn.isCanonicalOpaqueId)(t))throw new Error(`${e} must be a canonical opaque id`)}function Edn(e){if(typeof e!="string"||!Bgt.test(e)||e==="0")throw new Error("amountMicros must be a canonical positive integer string");if(BigInt(e)>ydn)throw new Error("amountMicros exceeds BIGINT")}function Ugt(e,t){if(typeof t!="string"||!Bgt.test(t))throw new Error(`${e} must be a canonical unsigned integer string`);if(t.length>78||BigInt(t)>jgt)throw new Error(`${e} exceeds uint256`)}function POe(e){return typeof e=="string"&&/^0x[0-9a-fA-F]{40}$/.test(e)?e.toLowerCase():null}function Sdn(e){return typeof e=="string"&&/^0x[0-9a-fA-F]{64}$/.test(e)?e.toLowerCase():null}function ote(e){let t;try{if(typeof e=="bigint")t=e;else if(typeof e=="number"&&Number.isSafeInteger(e))t=BigInt(e);else if(typeof e=="string"&&(/^(0|[1-9][0-9]*)$/.test(e)||/^0x[0-9a-fA-F]+$/.test(e))){let r=e.startsWith("0x")?e.slice(2):e,n=e.startsWith("0x")?64:78;if(r.length>n)return null;t=BigInt(e)}else return null}catch{return null}return t>=0n&&t<=jgt?t.toString(10):null}function vdn(e){if(typeof e!="string")throw new Error("settlementExpiresAt must be an ISO timestamp");let t=Date.parse(e);if(!Number.isFinite(t))throw new Error("settlementExpiresAt must be an ISO timestamp");let r=new Date(t).toISOString();if(r!==e)throw new Error("settlementExpiresAt must be canonical UTC ISO");return r}function xOe(e){if(!_8(e))throw new Error("wallet permit binding must be an object");if(Hgt("wallet permit binding",e,qgt),e.v!==1)throw new Error("wallet permit binding requires v=1");if(g8("authorizationId",e.authorizationId),g8("agentId",e.agentId),g8("walletApiKeyId",e.walletApiKeyId),g8("grantId",e.grantId),g8("budgetEpochId",e.budgetEpochId),g8("runtimeSessionId",e.runtimeSessionId),!(0,wOe.isCanonicalBase64Url32)(e.keyJkt))throw new Error("keyJkt must be canonical");if(!(0,wOe.isCanonicalBase64Url32)(e.settlementHash))throw new Error("settlementHash must be canonical");if(!(0,wOe.isCanonicalBase64Url32)(e.resourceCommitment))throw new Error("resourceCommitment must be canonical");if(typeof e.grantVersion!="number"||!Number.isSafeInteger(e.grantVersion)||e.grantVersion<=0)throw new Error("grantVersion must be a positive safe integer");if(typeof e.executionChannel!="string"||!["cli","mcp"].includes(e.executionChannel))throw new Error("executionChannel is invalid");if(e.scope!=="wallet:x402"||e.executionMode!=="direct_runtime")throw new Error("wallet permit v1 supports direct-runtime x402 only");if(e.x402Version!==1&&e.x402Version!==2)throw new Error("x402Version must be 1 or 2");if(Edn(e.amountMicros),e.currency!=="USD")throw new Error("currency must be USD");if(typeof e.payer!="string"||!IOe.test(e.payer))throw new Error("payer must be a canonical lower-case EVM address");if(typeof e.payee!="string"||!IOe.test(e.payee))throw new Error("payee must be a canonical lower-case EVM address");if(typeof e.network!="string"||e.network.length>64||!_dn.test(e.network))throw new Error("network must be a canonical EIP-155 CAIP-2 id");let t=`${e.network}/erc20:`;if(typeof e.asset!="string"||!e.asset.startsWith(t))throw new Error("asset must be canonical");let r=e.asset.slice(t.length);if(!r||!IOe.test(r))throw new Error("asset must name a canonical lower-case ERC-20 address");if(e.scheme!=="exact"||e.assetTransferMethod!=="eip3009")throw new Error("wallet permit v1 supports exact EIP-3009 only");if(typeof e.eip3009Nonce!="string"||!gdn.test(e.eip3009Nonce))throw new Error("eip3009Nonce must be canonical");if(Ugt("validAfter",e.validAfter),Ugt("validBefore",e.validBefore),BigInt(e.validBefore)<=BigInt(e.validAfter))throw new Error("validBefore must be after validAfter");let n=vdn(e.settlementExpiresAt);if(BigInt(e.validBefore)!==BigInt(Math.floor(Date.parse(n)/1e3)))throw new Error("validBefore must match settlementExpiresAt");return ste("intentId",e.intentId),ste("economicIntentId",e.economicIntentId),{v:1,authorizationId:e.authorizationId,agentId:e.agentId,keyJkt:e.keyJkt,walletApiKeyId:e.walletApiKeyId,grantId:e.grantId,grantVersion:e.grantVersion,budgetEpochId:e.budgetEpochId,runtimeSessionId:e.runtimeSessionId,executionChannel:e.executionChannel,scope:"wallet:x402",executionMode:"direct_runtime",x402Version:e.x402Version,amountMicros:e.amountMicros,currency:"USD",payer:e.payer,payee:e.payee,network:e.network,asset:e.asset,scheme:"exact",assetTransferMethod:"eip3009",eip3009Nonce:e.eip3009Nonce,validAfter:e.validAfter,validBefore:e.validBefore,settlementHash:e.settlementHash,settlementExpiresAt:n,resourceCommitment:e.resourceCommitment,intentId:e.intentId,economicIntentId:e.economicIntentId}}function Tdn(e,t){return{iss:qi.WALLET_AUTHORIZATION_PERMIT_ISSUER,aud:qi.WALLET_AUTHORIZATION_PERMIT_AUDIENCE,sub:e.agentId,cnf:{jkt:e.keyJkt},...t,policy_id:qi.WALLET_AUTHORIZATION_PERMIT_POLICY_ID,v:1,authorization_id:e.authorizationId,agent_id:e.agentId,key_jkt:e.keyJkt,wallet_api_key_id:e.walletApiKeyId,grant_id:e.grantId,grant_version:e.grantVersion,budget_epoch_id:e.budgetEpochId,runtime_session_id:e.runtimeSessionId,execution_channel:e.executionChannel,scope:e.scope,execution_mode:e.executionMode,x402_version:e.x402Version,amount_micros:e.amountMicros,currency:e.currency,payer:e.payer,payee:e.payee,network:e.network,asset:e.asset,scheme:e.scheme,asset_transfer_method:e.assetTransferMethod,eip3009_nonce:e.eip3009Nonce,valid_after:e.validAfter,valid_before:e.validBefore,settlement_hash:e.settlementHash,settlement_expires_at:e.settlementExpiresAt,resource_commitment:e.resourceCommitment,intent_id:e.intentId,economic_intent_id:e.economicIntentId}}function Adn(e){return xOe({v:e.v,authorizationId:e.authorization_id,agentId:e.agent_id,keyJkt:e.key_jkt,walletApiKeyId:e.wallet_api_key_id,grantId:e.grant_id,grantVersion:e.grant_version,budgetEpochId:e.budget_epoch_id,runtimeSessionId:e.runtime_session_id,executionChannel:e.execution_channel,scope:e.scope,executionMode:e.execution_mode,x402Version:e.x402_version,amountMicros:e.amount_micros,currency:e.currency,payer:e.payer,payee:e.payee,network:e.network,asset:e.asset,scheme:e.scheme,assetTransferMethod:e.asset_transfer_method,eip3009Nonce:e.eip3009_nonce,validAfter:e.valid_after,validBefore:e.valid_before,settlementHash:e.settlement_hash,settlementExpiresAt:e.settlement_expires_at,resourceCommitment:e.resource_commitment,intentId:e.intent_id,economicIntentId:e.economic_intent_id})}function wdn(e,t){return[...qgt].every(r=>e[r]===t[r])}function Idn(e,t){if(!_8(e)||!_8(e.domain)||!_8(e.message))return"typed_data_invalid";try{if((0,pdn.eip712DigestBase64Url)(e)!==t.settlementHash)return"typed_data_binding_mismatch"}catch{return"typed_data_invalid"}let r=`${t.network}/erc20:`,n=t.asset.slice(r.length),i=t.network.slice(7),o=e.message,s=e.domain;return e.primaryType!=="TransferWithAuthorization"||ote(s.chainId)!==i||POe(s.verifyingContract)!==n||POe(o.from)!==t.payer||POe(o.to)!==t.payee||ote(o.value)!==t.amountMicros||Sdn(o.nonce)!==t.eip3009Nonce||ote(o.validAfter)!==t.validAfter||ote(o.validBefore)!==t.validBefore?"typed_data_binding_mismatch":null}async function Pdn(e){if(e.signer.publicJwk.role!=="wallet-permit")throw new Error("wallet permits require a dedicated wallet-permit signing key");let t=xOe(e.binding),r=e.nowSec??Math.floor(Date.now()/1e3);if(!Number.isSafeInteger(r)||r<0)throw new Error("nowSec must be a non-negative safe integer");let n=Math.floor(Date.parse(t.settlementExpiresAt)/1e3),i=Math.min(r+qi.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS,n);if(!Number.isSafeInteger(i)||i<=r)throw new Error("settlement window must remain open while issuing a permit");if(BigInt(t.validAfter)+1n>=BigInt(i))throw new Error("settlement window must open before permit expiry");let o=e.jti??(0,fdn.randomPopNonce)();ste("jti",o);let s=Tdn(t,{iat:r,exp:i,jti:o});return(0,mdn.signJwtWithSigner)(e.signer,{typ:qi.WALLET_AUTHORIZATION_PERMIT_JWT_TYP},{...s})}async function xdn(e,t){let r=await(0,Lgt.verifyJwtSignature)(e,t.permitIssuerJwks,"wallet-permit",!0);if(!r.ok)return{valid:!1,reason:r.reason};if(r.header.typ!==qi.WALLET_AUTHORIZATION_PERMIT_JWT_TYP)return{valid:!1,reason:"typ_mismatch"};let n=r.claims;if(!_8(n))return{valid:!1,reason:"bad_claim_shape"};try{Hgt("wallet permit claims",n,bdn)}catch{return{valid:!1,reason:"bad_claim_shape"}}if(n.iss!==qi.WALLET_AUTHORIZATION_PERMIT_ISSUER||n.aud!==qi.WALLET_AUTHORIZATION_PERMIT_AUDIENCE)return{valid:!1,reason:"issuer_or_audience_mismatch"};if(n.policy_id!==qi.WALLET_AUTHORIZATION_PERMIT_POLICY_ID)return{valid:!1,reason:"policy_mismatch"};if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)return{valid:!1,reason:"bad_verification_time"};let i=(0,Lgt.temporalReason)(n,t.nowSec);if(i)return{valid:!1,reason:i};if(!Number.isSafeInteger(n.iat)||!Number.isSafeInteger(n.exp)||n.exp<=n.iat||n.exp-n.iat>qi.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS)return{valid:!1,reason:"bad_temporal_claims"};if(typeof n.jti!="string")return{valid:!1,reason:"bad_claim_shape"};try{ste("jti",n.jti)}catch{return{valid:!1,reason:"bad_claim_shape"}}let o;try{o=Adn(n)}catch{return{valid:!1,reason:"bad_claim_shape"}}let s;try{s=xOe(t.expected)}catch{return{valid:!1,reason:"expected_binding_invalid"}}if(n.sub!==o.agentId||!_8(n.cnf)||Object.keys(n.cnf).length!==1||n.cnf.jkt!==o.keyJkt)return{valid:!1,reason:"subject_mismatch"};if(n.exp>Math.floor(Date.parse(o.settlementExpiresAt)/1e3))return{valid:!1,reason:"permit_outlives_settlement"};let a=BigInt(o.validAfter),c=BigInt(o.validBefore),u=BigInt(t.nowSec);if(u<=a||u>=c)return{valid:!1,reason:"settlement_not_live"};if(!wdn(o,s))return{valid:!1,reason:"binding_mismatch"};let d=Idn(t.typedData,o);return d?{valid:!1,reason:d}:{valid:!0,claims:n}}});var zgt=_(yc=>{"use strict";Object.defineProperty(yc,"__esModule",{value:!0});yc.KillList=yc.KILL_SWITCH_JWT_TYP=yc.SUCCESSION_JWT_TYP=void 0;yc.issueSuccession=Rdn;yc.verifySuccession=Ndn;yc.issueKillSwitch=Cdn;yc.verifyKillSwitch=Mdn;yc.attestationIsVoid=$gt;var Odn=Hu(),ate=Ju();yc.SUCCESSION_JWT_TYP="agent-succession+jwt";yc.KILL_SWITCH_JWT_TYP="agent-kill+jwt";async function Rdn(e){let{principalKey:t,oldJkt:r,newJkt:n,agtId:i,nowSec:o=Math.floor(Date.now()/1e3)}=e,s={old_jkt:r,new_jkt:n,agt_id:i,iat:o};return(0,ate.signJwt)(t.privateJwk,{kid:t.kid,typ:yc.SUCCESSION_JWT_TYP},{...s})}function Fgt(e,t,r){let n=t.keys.find(i=>i.kid===e);return!n||(0,Odn.computeJkt)(n)!==r?"signer_not_owning_principal":null}async function Ndn(e,t){let r=await(0,ate.verifyJwtSignature)(e,t.principalJwks);if(!r.ok)return{valid:!1,reason:r.reason};if(r.header.typ!==yc.SUCCESSION_JWT_TYP)return{valid:!1,reason:"typ_mismatch"};let n=r.claims;if(typeof n.old_jkt!="string"||typeof n.new_jkt!="string"||typeof n.agt_id!="string"||typeof n.iat!="number")return{valid:!1,reason:"bad_claim_shape"};if(n.old_jkt===n.new_jkt)return{valid:!1,reason:"no_op_succession"};if(n.old_jkt!==t.registration.sub)return{valid:!1,reason:"agent_jkt_mismatch"};let i=Fgt(r.header.kid,t.principalJwks,t.owningPrincipalJkt);return i?{valid:!1,reason:i}:{valid:!0,record:n}}async function Cdn(e){let{principalKey:t,agentJkt:r,agtId:n,reason:i,nowSec:o=Math.floor(Date.now()/1e3)}=e,s={jkt:r,agt_id:n,iat:o,...i===void 0?{}:{reason:i}};return(0,ate.signJwt)(t.privateJwk,{kid:t.kid,typ:yc.KILL_SWITCH_JWT_TYP},{...s})}async function Mdn(e,t){let r=await(0,ate.verifyJwtSignature)(e,t.principalJwks);if(!r.ok)return{valid:!1,reason:r.reason};if(r.header.typ!==yc.KILL_SWITCH_JWT_TYP)return{valid:!1,reason:"typ_mismatch"};let n=r.claims;if(typeof n.jkt!="string"||typeof n.agt_id!="string"||typeof n.iat!="number")return{valid:!1,reason:"bad_claim_shape"};if(n.jkt!==t.registration.sub)return{valid:!1,reason:"agent_jkt_mismatch"};let i=Fgt(r.header.kid,t.principalJwks,t.owningPrincipalJkt);return i?{valid:!1,reason:i}:{valid:!0,record:n}}function $gt(e,t){return t.jkt===e.signerJkt&&e.signedAtSec>=t.iat}var OOe=class{byJkt;constructor(t=[]){this.byJkt=new Map;for(let r of t){let n=this.byJkt.get(r.jkt);(!n||r.iat<n.iat)&&this.byJkt.set(r.jkt,r)}}get size(){return this.byJkt.size}isKilled(t,r){let n=this.byJkt.get(t);return n&&n.iat<=r?{killed:!0,...n.reason!==void 0?{reason:n.reason}:{},killedAtSec:n.iat}:{killed:!1}}voidsAttestation(t,r){let n=this.byJkt.get(t);return n?$gt({signerJkt:t,signedAtSec:r},n):!1}};yc.KillList=OOe});var Jgt=_(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.GRANT_RAILS=Hi.MAX_TTL_GRANT_DAYS=Hi.TTL_GRANT_DAYS=Hi.GRANT_JWT_TYP=void 0;Hi.issueGrant=Udn;Hi.issueGrantWithSigner=Bdn;Hi.verifyGrant=Vdn;var kdn=Hu(),ROe=Ju(),Ddn=Lv(),Ggt=Dy();Hi.GRANT_JWT_TYP="visa-agent-spend-grant+jwt";Hi.TTL_GRANT_DAYS=30;Hi.MAX_TTL_GRANT_DAYS=90;Hi.GRANT_RAILS=["x402","vic"];var Kgt=86400;function DI(e){return typeof e=="number"&&Number.isSafeInteger(e)&&e>0}function Ldn(e){if(e!==void 0){if(!Array.isArray(e)||e.length===0)throw new Error("allowed_payees, when present, must be a non-empty array");for(let t of e)if(typeof t!="string"||t.length===0)throw new Error("allowed_payees entries must be non-empty strings");if(new Set(e).size!==e.length)throw new Error("allowed_payees must not repeat")}}function Wgt(e,t,r,n){if(!DI(e.per_tx))throw new Error("ceiling.per_tx must be a positive integer in minor units (cents)");if(e.daily!==void 0&&!DI(e.daily))throw new Error("ceiling.daily must be a positive integer in minor units (cents)");if(e.session!==void 0&&!DI(e.session))throw new Error("ceiling.session must be a positive integer in minor units (cents)");if(e.currency!=="USD")throw new Error("ceiling.currency must be 'USD' (P0 canonical unit)");if(!Array.isArray(t)||t.length===0)throw new Error("rails must be a non-empty array");for(let i of t)if(!Hi.GRANT_RAILS.includes(i))throw new Error(`unknown rail '${String(i)}' \u2014 must be one of ${Hi.GRANT_RAILS.join(", ")}`);if(new Set(t).size!==t.length)throw new Error("rails must not repeat");if(!Number.isFinite(r)||r<=0||r>Hi.MAX_TTL_GRANT_DAYS)throw new Error(`ttlDays must be in (0, ${Hi.MAX_TTL_GRANT_DAYS}]; got ${r}`);Ldn(n)}function Ygt(e){return{sub:e.agentJkt,cnf:{jkt:e.agentJkt},ceiling:e.ceiling,rails:e.rails,...e.allowedPayees!==void 0?{allowed_payees:e.allowedPayees}:{},iat:e.nowSec,exp:e.nowSec+e.ttlDays*Kgt,jti:e.jti}}async function Udn(e){let{principalKey:t,agentJkt:r,ceiling:n,rails:i,allowedPayees:o,jti:s=(0,Ggt.randomPopNonce)(),ttlDays:a=Hi.TTL_GRANT_DAYS,nowSec:c=Math.floor(Date.now()/1e3)}=e;Wgt(n,i,a,o);let u=Ygt({agentJkt:r,ceiling:n,rails:i,allowedPayees:o,jti:s,ttlDays:a,nowSec:c});return(0,ROe.signJwt)(t.privateJwk,{kid:t.kid,typ:Hi.GRANT_JWT_TYP},{...u})}async function Bdn(e){let{signer:t,agentJkt:r,ceiling:n,rails:i,allowedPayees:o,jti:s=(0,Ggt.randomPopNonce)(),ttlDays:a=Hi.TTL_GRANT_DAYS,nowSec:c=Math.floor(Date.now()/1e3)}=e;Wgt(n,i,a,o);let u=Ygt({agentJkt:r,ceiling:n,rails:i,allowedPayees:o,jti:s,ttlDays:a,nowSec:c});return(0,Ddn.signJwtWithSigner)(t,{typ:Hi.GRANT_JWT_TYP},{...u})}function jdn(e){if(typeof e!="object"||e===null)return!1;let t=e;return!DI(t.per_tx)||t.daily!==void 0&&!DI(t.daily)||t.session!==void 0&&!DI(t.session)?!1:t.currency==="USD"}function qdn(e){return Array.isArray(e)&&e.length>0&&e.every(t=>Hi.GRANT_RAILS.includes(t))&&new Set(e).size===e.length}function Hdn(e){return e===void 0?!0:Array.isArray(e)&&e.length>0&&e.every(t=>typeof t=="string"&&t.length>0)&&new Set(e).size===e.length}async function Vdn(e,t){let r=await(0,ROe.verifyJwtSignature)(e,t.principalJwks);if(!r.ok)return{valid:!1,reason:r.reason};if(r.header.typ!==Hi.GRANT_JWT_TYP)return{valid:!1,reason:"typ_mismatch"};let n=r.claims;if(typeof n.sub!="string"||typeof n.jti!="string"||n.jti.length===0||typeof n.cnf!="object"||n.cnf===null||n.cnf.jkt!==n.sub)return{valid:!1,reason:"bad_claim_shape"};if(!jdn(n.ceiling))return{valid:!1,reason:"bad_ceiling"};if(!qdn(n.rails))return{valid:!1,reason:"bad_rails"};if(!Hdn(n.allowed_payees))return{valid:!1,reason:"bad_allowed_payees"};let i=(0,ROe.temporalReason)(n,t.nowSec);if(i)return{valid:!1,reason:i};let o=n.iat,s=n.exp;if(!Number.isSafeInteger(o)||!Number.isSafeInteger(s)||s<=o)return{valid:!1,reason:"bad_temporal_claims"};if(s-o>Hi.MAX_TTL_GRANT_DAYS*Kgt)return{valid:!1,reason:"ttl_exceeds_max"};if(n.sub!==t.expectedAgentJkt)return{valid:!1,reason:"agent_jkt_mismatch"};let a=t.principalJwks.keys.find(c=>c.kid===r.header.kid);if(!a||(0,kdn.computeJkt)(a)!==t.owningPrincipalJkt)return{valid:!1,reason:"signer_not_owning_principal"};for(let c of t.killRecords??[])if(c.jkt===n.sub)return{valid:!1,reason:"agent_killed"};for(let c of t.revokedJtis??[])if(c===n.jti)return{valid:!1,reason:"grant_revoked"};if(!n.rails.includes(t.rail))return{valid:!1,reason:"rail_not_granted"};if(t.intent!==void 0){if(!DI(t.intent.amount))return{valid:!1,reason:"bad_intent_amount"};if(t.intent.amount>n.ceiling.per_tx)return{valid:!1,reason:"over_per_tx_ceiling"};let c=n.allowed_payees;if(c!==void 0){if(t.intent.payee===void 0)return{valid:!1,reason:"payee_required"};if(!c.includes(t.intent.payee))return{valid:!1,reason:"payee_not_allowed"}}}return{valid:!0,claims:n}}});var Zgt=_(ye=>{"use strict";Object.defineProperty(ye,"__esModule",{value:!0});ye.AGENT_PAIRING_TERMINAL_STATES=ye.AGENT_PAIRING_STATES=ye.AGENT_PAIRING_TTL_SECONDS=ye.sha256=ye.pairingInstrumentCommitment=ye.pairingDeliveryArtifactV2Hash=ye.canonicalPairingDeliveryArtifactV2=ye.pairingArtifactHash=ye.agentMailCredentialClaimMessageV2=ye.keyRotationClaimHashV2=ye.keyRotationClaimMessageV2=ye.capabilityAttachActivationMessageV2=ye.capabilityAttachClaimHashV2=ye.capabilityAttachClaimMessageV2=ye.handoffAuthorityCapabilities=ye.AGENT_HANDOFF_COMPOUND_AUTHORITY=ye.AGENT_HANDOFF_AUTHORITIES=ye.AGENT_CAPABILITY_ATTACH_CAPABILITIES=ye.pairingActivationMessageV2=ye.pairingActivationMessage=ye.pairingClaimHashV2=ye.pairingClaimMessageV2=ye.pairingClaimMessage=ye.pairingTermsV2Hash=ye.pairingTermsHash=ye.canonicalPairingTermsV2=ye.canonicalPairingTerms=ye.setupConfirmationCode=ye.pairingConfirmationCode=ye.pairingCodeFromClaimToken=ye.pairingClaimTokenHash=ye.randomPairingClaimToken=ye.pairingCodeHash=ye.isValidPairingCode=ye.formatPairingCode=ye.normalizePairingCode=ye.randomPairingCode=ye.pairingVerifierChallenge=ye.randomPairingVerifier=ye.randomSetupOperationId=ye.randomHandoffId=ye.randomAttachId=ye.randomPairingId=ye.AGENT_PAIRING_CODE_LENGTH=ye.AGENT_PAIRING_CODE_ALPHABET=ye.AGENT_PAIRING_PROTOCOL_VERSION_V2=ye.AGENT_PAIRING_PROTOCOL_VERSION=void 0;ye.isAgentPairingState=$dn;ye.canTransitionAgentPairing=Xgt;ye.assertAgentPairingTransition=zdn;var Wt=dD();Object.defineProperty(ye,"AGENT_PAIRING_PROTOCOL_VERSION",{enumerable:!0,get:function(){return Wt.AGENT_PAIRING_PROTOCOL_VERSION}});Object.defineProperty(ye,"AGENT_PAIRING_PROTOCOL_VERSION_V2",{enumerable:!0,get:function(){return Wt.AGENT_PAIRING_PROTOCOL_VERSION_V2}});Object.defineProperty(ye,"AGENT_PAIRING_CODE_ALPHABET",{enumerable:!0,get:function(){return Wt.AGENT_PAIRING_CODE_ALPHABET}});Object.defineProperty(ye,"AGENT_PAIRING_CODE_LENGTH",{enumerable:!0,get:function(){return Wt.AGENT_PAIRING_CODE_LENGTH}});Object.defineProperty(ye,"randomPairingId",{enumerable:!0,get:function(){return Wt.randomPairingId}});Object.defineProperty(ye,"randomAttachId",{enumerable:!0,get:function(){return Wt.randomAttachId}});Object.defineProperty(ye,"randomHandoffId",{enumerable:!0,get:function(){return Wt.randomHandoffId}});Object.defineProperty(ye,"randomSetupOperationId",{enumerable:!0,get:function(){return Wt.randomSetupOperationId}});Object.defineProperty(ye,"randomPairingVerifier",{enumerable:!0,get:function(){return Wt.randomPairingVerifier}});Object.defineProperty(ye,"pairingVerifierChallenge",{enumerable:!0,get:function(){return Wt.pairingVerifierChallenge}});Object.defineProperty(ye,"randomPairingCode",{enumerable:!0,get:function(){return Wt.randomPairingCode}});Object.defineProperty(ye,"normalizePairingCode",{enumerable:!0,get:function(){return Wt.normalizePairingCode}});Object.defineProperty(ye,"formatPairingCode",{enumerable:!0,get:function(){return Wt.formatPairingCode}});Object.defineProperty(ye,"isValidPairingCode",{enumerable:!0,get:function(){return Wt.isValidPairingCode}});Object.defineProperty(ye,"pairingCodeHash",{enumerable:!0,get:function(){return Wt.pairingCodeHash}});Object.defineProperty(ye,"randomPairingClaimToken",{enumerable:!0,get:function(){return Wt.randomPairingClaimToken}});Object.defineProperty(ye,"pairingClaimTokenHash",{enumerable:!0,get:function(){return Wt.pairingClaimTokenHash}});Object.defineProperty(ye,"pairingCodeFromClaimToken",{enumerable:!0,get:function(){return Wt.pairingCodeFromClaimToken}});Object.defineProperty(ye,"pairingConfirmationCode",{enumerable:!0,get:function(){return Wt.pairingConfirmationCode}});Object.defineProperty(ye,"setupConfirmationCode",{enumerable:!0,get:function(){return Wt.setupConfirmationCode}});Object.defineProperty(ye,"canonicalPairingTerms",{enumerable:!0,get:function(){return Wt.canonicalPairingTerms}});Object.defineProperty(ye,"canonicalPairingTermsV2",{enumerable:!0,get:function(){return Wt.canonicalPairingTermsV2}});Object.defineProperty(ye,"pairingTermsHash",{enumerable:!0,get:function(){return Wt.pairingTermsHash}});Object.defineProperty(ye,"pairingTermsV2Hash",{enumerable:!0,get:function(){return Wt.pairingTermsV2Hash}});Object.defineProperty(ye,"pairingClaimMessage",{enumerable:!0,get:function(){return Wt.pairingClaimMessage}});Object.defineProperty(ye,"pairingClaimMessageV2",{enumerable:!0,get:function(){return Wt.pairingClaimMessageV2}});Object.defineProperty(ye,"pairingClaimHashV2",{enumerable:!0,get:function(){return Wt.pairingClaimHashV2}});Object.defineProperty(ye,"pairingActivationMessage",{enumerable:!0,get:function(){return Wt.pairingActivationMessage}});Object.defineProperty(ye,"pairingActivationMessageV2",{enumerable:!0,get:function(){return Wt.pairingActivationMessageV2}});Object.defineProperty(ye,"AGENT_CAPABILITY_ATTACH_CAPABILITIES",{enumerable:!0,get:function(){return Wt.AGENT_CAPABILITY_ATTACH_CAPABILITIES}});Object.defineProperty(ye,"AGENT_HANDOFF_AUTHORITIES",{enumerable:!0,get:function(){return Wt.AGENT_HANDOFF_AUTHORITIES}});Object.defineProperty(ye,"AGENT_HANDOFF_COMPOUND_AUTHORITY",{enumerable:!0,get:function(){return Wt.AGENT_HANDOFF_COMPOUND_AUTHORITY}});Object.defineProperty(ye,"handoffAuthorityCapabilities",{enumerable:!0,get:function(){return Wt.handoffAuthorityCapabilities}});Object.defineProperty(ye,"capabilityAttachClaimMessageV2",{enumerable:!0,get:function(){return Wt.capabilityAttachClaimMessageV2}});Object.defineProperty(ye,"capabilityAttachClaimHashV2",{enumerable:!0,get:function(){return Wt.capabilityAttachClaimHashV2}});Object.defineProperty(ye,"capabilityAttachActivationMessageV2",{enumerable:!0,get:function(){return Wt.capabilityAttachActivationMessageV2}});Object.defineProperty(ye,"keyRotationClaimMessageV2",{enumerable:!0,get:function(){return Wt.keyRotationClaimMessageV2}});Object.defineProperty(ye,"keyRotationClaimHashV2",{enumerable:!0,get:function(){return Wt.keyRotationClaimHashV2}});Object.defineProperty(ye,"agentMailCredentialClaimMessageV2",{enumerable:!0,get:function(){return Wt.agentMailCredentialClaimMessageV2}});Object.defineProperty(ye,"pairingArtifactHash",{enumerable:!0,get:function(){return Wt.pairingArtifactHash}});Object.defineProperty(ye,"canonicalPairingDeliveryArtifactV2",{enumerable:!0,get:function(){return Wt.canonicalPairingDeliveryArtifactV2}});Object.defineProperty(ye,"pairingDeliveryArtifactV2Hash",{enumerable:!0,get:function(){return Wt.pairingDeliveryArtifactV2Hash}});Object.defineProperty(ye,"pairingInstrumentCommitment",{enumerable:!0,get:function(){return Wt.pairingInstrumentCommitment}});Object.defineProperty(ye,"sha256",{enumerable:!0,get:function(){return Wt.pairingSha256}});ye.AGENT_PAIRING_TTL_SECONDS=3600;ye.AGENT_PAIRING_STATES=["awaiting_agent","agent_claimed","code_verified","awaiting_human","authorized","delivered","activated","expired","cancelled","failed","revoked"];ye.AGENT_PAIRING_TERMINAL_STATES=new Set(["activated","expired","cancelled","failed","revoked"]);var Fdn={awaiting_agent:new Set(["agent_claimed","expired","cancelled","failed"]),agent_claimed:new Set(["code_verified","expired","cancelled","failed"]),code_verified:new Set(["awaiting_human","expired","cancelled","failed"]),awaiting_human:new Set(["authorized","expired","cancelled","failed"]),authorized:new Set(["delivered","expired","cancelled","failed"]),delivered:new Set(["activated","expired","cancelled","failed"]),activated:new Set(["revoked"]),expired:new Set,cancelled:new Set,failed:new Set,revoked:new Set};function $dn(e){return typeof e=="string"&&ye.AGENT_PAIRING_STATES.includes(e)}function Xgt(e,t){return Fdn[e].has(t)}function zdn(e,t){if(!Xgt(e,t))throw new Error(`invalid agent pairing transition: ${e} -> ${t}`)}});var Qgt=_(NOe=>{"use strict";Object.defineProperty(NOe,"__esModule",{value:!0});NOe.prepareIdentityPresenceDelegation=Wdn;var Gdn=ite(),Kdn=Fv();function Wdn(e){let r={...(0,Gdn.prepareRuntimeDelegation)({...e,signingModes:["eip3009:exact"]}).claims,purpose:"runtime_presence_pop",signingModes:["presence"]};return{...(0,Kdn.prepareRootSignedJws)("visa-agent-runtime-delegation+jwt",e.rootKid,r),claims:r}}});var DOe=_(Kr=>{"use strict";Object.defineProperty(Kr,"__esModule",{value:!0});Kr.HOSTED_CONNECTOR_PROOF_TTL_SECONDS=Kr.HOSTED_CONNECTOR_PROOF_TYP=Kr.IDENTITY_PRESENCE_LEASE_TYP=Kr.IDENTITY_PRESENCE_SIGNING_MODE=Kr.IDENTITY_PRESENCE_PURPOSE=Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE=void 0;Kr.issueHostedConnectorProof=Qdn;Kr.verifyHostedConnectorProof=eln;Kr.issueIdentityPresenceLease=tln;Kr.verifyIdentityPresenceLeaseChain=rln;var r1t=require("node:crypto"),e1t=qf(),COe=Hu(),MOe=Ju(),n1t=Lv(),LI=CI();Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE="urn:visa:tvc:identity-gate";Kr.IDENTITY_PRESENCE_PURPOSE="runtime_presence_pop";Kr.IDENTITY_PRESENCE_SIGNING_MODE="presence";Kr.IDENTITY_PRESENCE_LEASE_TYP="visa-agent-runtime-lease+jwt";Kr.HOSTED_CONNECTOR_PROOF_TYP="visa-hosted-connector-proof+jwt";Kr.HOSTED_CONNECTOR_PROOF_TTL_SECONDS=300;var y8=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,cte=/^[A-Za-z0-9_-]{43}$/,Ydn=/^eip155:[1-9][0-9]{0,15}$/,Jdn="exp,iat,iss,jti,leaseIssuerJkt,maxLeaseTtlSeconds,nbf,network,purpose,runtimeId,runtimeJkt,signingModes,sub,v",Xdn="aud,delegationHash,delegationId,exp,generation,grantId,grantVersion,iat,iss,jti,nbf,network,purpose,rootJkt,runtimeId,runtimeJkt,signingModes,sub,v",Zdn="agentId,aud,connectorKeyId,custody,exp,grantId,grantVersion,hostedAuthorityMode,iat,intentHash,iss,jti,operationId,requestId,runtimeId,v";function kOe(e,t){return Object.keys(e).sort().join(",")===t}function t1t(e,t,r){return Number.isSafeInteger(e.iat)&&Number.isSafeInteger(e.nbf)&&Number.isSafeInteger(e.exp)&&e.iat>=0&&e.nbf===e.iat&&e.exp>e.iat&&e.exp-e.iat<=r&&e.iat<=t+LI.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS&&t<e.exp}async function Qdn(e){let t={v:1,iss:"visa:auth",aud:Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE,jti:e.requestId,requestId:e.requestId,agentId:e.agentId,runtimeId:e.runtimeId,custody:"signer",hostedAuthorityMode:"standing",connectorKeyId:e.connectorKeyId,grantId:e.grantId,grantVersion:e.grantVersion,operationId:e.operationId,intentHash:e.intentHash,iat:e.issuedAtSec,exp:e.issuedAtSec+Kr.HOSTED_CONNECTOR_PROOF_TTL_SECONDS};if(!i1t(t))throw new Error("hosted_connector_proof_invalid");return(0,n1t.signJwtWithSigner)(e.signer,{typ:Kr.HOSTED_CONNECTOR_PROOF_TYP},{...t})}function i1t(e){return kOe(e,Zdn)&&e.v===1&&e.iss==="visa:auth"&&e.aud===Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE&&e.jti===e.requestId&&[e.jti,e.requestId,e.agentId,e.runtimeId,e.grantId,e.operationId].every(t=>y8.test(t))&&e.custody==="signer"&&e.hostedAuthorityMode==="standing"&&typeof e.connectorKeyId=="string"&&/^[A-Za-z0-9._:@/-]{1,256}$/.test(e.connectorKeyId)&&cte.test(e.intentHash)&&Number.isSafeInteger(e.grantVersion)&&e.grantVersion>0&&Number.isSafeInteger(e.iat)&&e.iat>=0&&Number.isSafeInteger(e.exp)&&e.exp>e.iat&&e.exp-e.iat<=Kr.HOSTED_CONNECTOR_PROOF_TTL_SECONDS}async function eln(e,t){let r=await(0,MOe.verifyJwtSignature)(e,t.issuerJwks);if(!r.ok)return r;let n=r.claims,i=t.issuerJwks.keys.filter(s=>typeof s.kid=="string"&&s.kid===r.header.kid),o=t.maxAgeSeconds??30;return r.header.typ!==Kr.HOSTED_CONNECTOR_PROOF_TYP||i.length!==1||(0,COe.computeJkt)(i[0])!==r.header.kid||!i1t(n)||!Number.isSafeInteger(t.nowSec)||!Number.isSafeInteger(o)||o<1||n.iat>t.nowSec+LI.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS||t.nowSec-n.iat>o||n.exp<=t.nowSec||n.requestId!==t.expectedRequestId||n.agentId!==t.expectedAgentId||n.runtimeId!==t.expectedRuntimeId||n.connectorKeyId!==t.expectedConnectorKeyId||n.grantId!==t.expectedGrantId||n.grantVersion!==t.expectedGrantVersion||n.operationId!==t.expectedOperationId||t.expectedIntentHash!==void 0&&n.intentHash!==t.expectedIntentHash?{ok:!1,reason:"hosted_connector_proof_invalid"}:{ok:!0,claims:n}}async function tln(e){if(!y8.test(e.leaseId)||!y8.test(e.grantId)||!Number.isSafeInteger(e.generation)||e.generation<1||!Number.isSafeInteger(e.grantVersion)||e.grantVersion<1||!Number.isSafeInteger(e.ttlSeconds)||e.ttlSeconds<1||e.ttlSeconds>LI.RUNTIME_LEASE_MAX_TTL_SECONDS||e.ttlSeconds>e.delegation.maxLeaseTtlSeconds||e.delegation.leaseIssuerJkt!==e.signer.kid)throw new Error("identity presence lease input invalid");let t={v:1,iss:e.signer.kid,sub:e.delegation.sub,aud:Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE,jti:e.leaseId,delegationId:e.delegation.jti,delegationHash:(0,r1t.createHash)("sha256").update(e.delegationToken).digest("base64url"),rootJkt:e.delegation.iss,runtimeId:e.delegation.runtimeId,runtimeJkt:e.delegation.runtimeJkt,purpose:Kr.IDENTITY_PRESENCE_PURPOSE,network:e.delegation.network,signingModes:[Kr.IDENTITY_PRESENCE_SIGNING_MODE],generation:e.generation,grantId:e.grantId,grantVersion:e.grantVersion,iat:e.nowSec,nbf:e.nowSec,exp:e.nowSec+e.ttlSeconds};return{lease:await(0,n1t.signJwtWithSigner)(e.signer,{typ:Kr.IDENTITY_PRESENCE_LEASE_TYP},{...t}),claims:t}}async function rln(e,t,r){if(!Number.isSafeInteger(r.nowSec)||r.nowSec<0)return{ok:!1,reason:"bad_verification_context"};let n=await(0,MOe.verifyJwtSignature)(e,r.ownerJwks),i=await(0,MOe.verifyJwtSignature)(t,r.issuerJwks);if(!n.ok)return n;if(!i.ok)return i;let o=n.claims,s=i.claims,a=r.ownerJwks.keys.find(u=>u.kid===r.expectedRootKid),c=r.issuerJwks.keys.find(u=>u.kid===r.expectedLeaseIssuerKid);return n.header.typ!==LI.RUNTIME_DELEGATION_TYP||n.header.kid!==r.expectedRootKid||i.header.typ!==Kr.IDENTITY_PRESENCE_LEASE_TYP||i.header.kid!==r.expectedLeaseIssuerKid||!a||!c||(0,COe.computeJkt)(a)!==r.expectedRootJkt||(0,COe.computeJkt)(c)!==r.expectedLeaseIssuerJkt||!kOe(o,Jdn)||!kOe(s,Xdn)||o.v!==1||o.iss!==r.expectedRootJkt||o.sub!==r.expectedAgentId||o.jti!==r.expectedDelegationId||o.runtimeId!==r.expectedRuntimeId||o.runtimeJkt!==r.expectedRuntimeJkt||o.leaseIssuerJkt!==r.expectedLeaseIssuerJkt||o.purpose!==Kr.IDENTITY_PRESENCE_PURPOSE||o.network!==r.expectedNetwork||(0,e1t.canonicalJson)(o.signingModes)!=='["presence"]'||!y8.test(o.jti)||!y8.test(o.runtimeId)||!cte.test(o.iss)||!cte.test(o.runtimeJkt)||!cte.test(o.leaseIssuerJkt)||!Ydn.test(o.network)||!Number.isSafeInteger(o.maxLeaseTtlSeconds)||o.maxLeaseTtlSeconds<1||o.maxLeaseTtlSeconds>LI.RUNTIME_LEASE_MAX_TTL_SECONDS||!t1t(o,r.nowSec,LI.RUNTIME_DELEGATION_MAX_TTL_SECONDS)||s.v!==1||s.iss!==r.expectedLeaseIssuerJkt||s.sub!==r.expectedAgentId||s.aud!==Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE||s.delegationId!==o.jti||s.delegationHash!==(0,r1t.createHash)("sha256").update(e).digest("base64url")||s.rootJkt!==r.expectedRootJkt||s.runtimeId!==r.expectedRuntimeId||s.runtimeJkt!==r.expectedRuntimeJkt||s.purpose!==Kr.IDENTITY_PRESENCE_PURPOSE||s.network!==r.expectedNetwork||(0,e1t.canonicalJson)(s.signingModes)!=='["presence"]'||s.generation!==r.expectedGeneration||s.grantId!==r.expectedGrantId||s.grantVersion!==r.expectedGrantVersion||!y8.test(s.jti)||!t1t(s,r.nowSec,LI.RUNTIME_LEASE_MAX_TTL_SECONDS)||s.exp>o.exp||s.exp-s.iat>o.maxLeaseTtlSeconds?{ok:!1,reason:"presence_chain_invalid"}:{ok:!0,delegation:o,lease:s}}});var jOe=_(Co=>{"use strict";Object.defineProperty(Co,"__esModule",{value:!0});Co.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE=Co.IDENTITY_TAP_LEASE_AUDIENCE=Co.IDENTITY_TAP_PURPOSE=Co.IDENTITY_TAP_PROFILE=void 0;Co.prepareIdentityTapDelegation=u1t;Co.verifyIdentityTapDelegation=d1t;Co.issueIdentityTapLease=aln;Co.identityTapLeaseRequestIntentHash=BOe;Co.createIdentityTapLeaseRequestProof=uln;Co.verifyIdentityTapLeaseRequestProof=dln;var o1t=require("node:crypto"),nln=qf(),iln=Hu(),s1t=Ju(),LOe=Fv(),a1t=Dy(),oln=ite();Co.IDENTITY_TAP_PROFILE="identity-tap-v1";Co.IDENTITY_TAP_PURPOSE="tap_signature_base";Co.IDENTITY_TAP_LEASE_AUDIENCE="urn:visa:tvc:identity-gate";Co.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE="visa-identity-lease-requests:v1";var UOe=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),ute=e=>Number.isSafeInteger(e)&&Number(e)>0,c1t=e=>(0,o1t.createHash)("sha256").update(e,"utf8").digest("base64url");function sln(e){if(typeof e!="string"||Buffer.byteLength(e)>32768)throw new Error("identity_tap_token_invalid");let t=e.split(".");if(t.length!==3||t.some(r=>!r||Buffer.from(r,"base64url").toString("base64url")!==r)||Buffer.from(t[2],"base64url").length!==64)throw new Error("identity_tap_token_invalid");return t}function u1t(e){let r={...(0,oln.prepareRuntimeDelegation)({...e,signingModes:["eip3009:exact"]}).claims,purpose:Co.IDENTITY_TAP_PURPOSE,signingModes:["tap"]};return{...(0,LOe.prepareRootSignedJws)("visa-agent-runtime-delegation+jwt",e.rootKid,r),claims:r}}async function d1t(e,t){let r=sln(e),n=await(0,s1t.verifyJwtSignature)(e,t.ownerJwks);if(!n.ok)throw new Error("identity_tap_delegation_signature_invalid");let i=n.claims,o=t.ownerJwks.keys.find(a=>a.kid===t.expectedRootKid);if(!o||n.header.kid!==t.expectedRootKid||!Number.isSafeInteger(t.nowSec)||t.nowSec<0||!Number.isSafeInteger(i.iat)||!Number.isSafeInteger(i.exp)||i.iat>t.nowSec+30||i.exp<=t.nowSec)throw new Error("identity_tap_delegation_invalid");let s=u1t({rootKid:t.expectedRootKid,rootPublicJwk:o,rootJkt:t.expectedRootJkt,agentId:t.expectedAgentId,runtimeId:t.expectedRuntimeId,runtimeJkt:t.expectedRuntimeJkt,leaseIssuerJkt:t.expectedLeaseIssuerJkt,network:t.expectedNetwork,delegationId:t.expectedDelegationId,nowSec:i.iat,ttlSeconds:i.exp-i.iat,maxLeaseTtlSeconds:i.maxLeaseTtlSeconds});if(r[0]+"."+r[1]!==s.signingInput)throw new Error("identity_tap_delegation_mismatch");return s.claims}async function aln(e){let t=await d1t(e.delegationToken,e.verification),r=e.verification.nowSec,n=e.ttlSeconds??120,i=e.leaseId??(0,o1t.randomUUID)();if(!ute(e.generation)||!ute(e.authorizationVersion)||!UOe(e.authorizationId)||!UOe(i)||!ute(n)||n>120||!Number.isSafeInteger(e.certificateExpiresAt)||(0,iln.computeJkt)(e.signer.publicJwk)!==t.leaseIssuerJkt)throw new Error("identity_tap_lease_context_invalid");let o=Math.min(r+n,r+t.maxLeaseTtlSeconds,t.exp,e.certificateExpiresAt);if(!Number.isSafeInteger(o)||o<=r)throw new Error("identity_tap_lease_expired");let s={v:1,iss:t.leaseIssuerJkt,sub:t.sub,aud:Co.IDENTITY_TAP_LEASE_AUDIENCE,jti:i,delegationId:t.jti,delegationHash:c1t(e.delegationToken),rootJkt:t.iss,runtimeId:t.runtimeId,runtimeJkt:t.runtimeJkt,purpose:Co.IDENTITY_TAP_PURPOSE,network:t.network,signingModes:["tap"],generation:e.generation,grantId:e.authorizationId,grantVersion:e.authorizationVersion,iat:r,nbf:r,exp:o},a=(0,LOe.prepareRootSignedJws)("visa-agent-runtime-lease+jwt",e.signer.kid,s),c=(0,LOe.completeRootSignedJws)(a.signingInput,await e.signer.sign(Buffer.from(a.signingInput)),"identity TAP lease");if(!(await(0,s1t.verifyJwtSignature)(c,{keys:[e.signer.publicJwk]})).ok)throw new Error("identity_tap_lease_signer_invalid");return{lease:c,claims:s}}var cln=["v","profile","associationId","associationVersion","agentId","runtimeId","generation","authorizationId","authorizationVersion","requestId","signingMode"].sort();function BOe(e){if(!e||typeof e!="object"||Object.keys(e).sort().join(",")!==cln.join(",")||e.v!==1||e.profile!==Co.IDENTITY_TAP_PROFILE||e.signingMode!=="tap"||![e.associationId,e.agentId,e.runtimeId,e.authorizationId,e.requestId].every(UOe)||![e.associationVersion,e.generation,e.authorizationVersion].every(ute))throw new Error("identity_tap_lease_request_invalid");return c1t((0,nln.canonicalJson)(e))}function uln(e,t,r){return(0,a1t.createPopProofWithSigner)(e,{nonce:t.requestId,audience:Co.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE,intentHash:BOe(t),nowSec:r})}async function dln(e,t,r,n){let i=await(0,a1t.verifyAgentOperationPopProof)(e,{operationId:t.requestId,audience:Co.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE,expectedIntentHash:BOe(t),nowSec:n,maxAgeSec:60});if(!i.ok||i.jkt!==r||i.runtimeCertificate!==void 0)throw new Error("identity_tap_lease_request_proof_invalid")}});var m1t=_(qy=>{"use strict";Object.defineProperty(qy,"__esModule",{value:!0});qy.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES=void 0;qy.identityDeviceEnrollmentPreimage=f1t;qy.verifyIdentityDeviceEnrollmentProof=hln;qy.prepareIdentityDeviceGateAuthorization=gln;qy.prepareIdentityHostedGateAuthorization=_ln;var l1t=require("node:crypto"),p1t=Fv(),lln=qf(),pln=Hu(),fln=jOe(),mln=["v","profile","associationId","associationVersion","agentId","runtimeId","generation","requestId","runtimePublicJwk","runtimeJkt","rootJkt","certificateSha256","delegationSha256","gateAuthorizationSha256","iat","exp"].sort().join(","),qOe=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),HOe=e=>Number.isSafeInteger(e)&&Number(e)>0,dte=e=>typeof e=="string"&&Buffer.from(e,"base64url").length===32&&Buffer.from(e,"base64url").toString("base64url")===e;function f1t(e){if(!e||Object.keys(e).sort().join(",")!==mln||e.v!==1||e.profile!==fln.IDENTITY_TAP_PROFILE||![e.associationId,e.agentId,e.runtimeId,e.requestId].every(qOe)||![e.associationVersion,e.generation].every(HOe)||![e.runtimeJkt,e.rootJkt,e.certificateSha256,e.delegationSha256,e.gateAuthorizationSha256].every(dte)||!e.runtimePublicJwk||Object.keys(e.runtimePublicJwk).sort().join(",")!=="crv,kty,x"||e.runtimePublicJwk.kty!=="OKP"||e.runtimePublicJwk.crv!=="Ed25519"||!dte(e.runtimePublicJwk.x)||(0,pln.computeJkt)(e.runtimePublicJwk)!==e.runtimeJkt||e.runtimeJkt===e.rootJkt||!Number.isSafeInteger(e.iat)||e.iat<0||!Number.isSafeInteger(e.exp)||e.exp<=e.iat||e.exp-e.iat>600)throw new Error("identity_device_challenge_invalid");return Buffer.from("visa:authority:external-runtime-enrollment:v1\0"+(0,lln.canonicalJson)(e),"utf8")}function hln(e,t,r){let n=f1t(e);if(!Number.isSafeInteger(r)||r<0||e.iat>r+5||e.exp<=r)throw new Error("identity_device_challenge_expired");if(typeof t!="string"||t.length!==86||Buffer.from(t,"base64url").toString("base64url")!==t||!(0,l1t.verify)(null,n,(0,l1t.createPublicKey)({key:e.runtimePublicJwk,format:"jwk"}),Buffer.from(t,"base64url")))throw new Error("identity_device_proof_invalid")}function gln(e){if(![e.rootJkt,e.identityPrincipalJkt].every(dte)||![e.agentId,e.authorizationId].every(qOe)||!HOe(e.generation)||!Number.isSafeInteger(e.nowSec)||e.nowSec<0||!Number.isSafeInteger(e.expiresAt)||e.expiresAt<=e.nowSec||e.expiresAt-e.nowSec>86400||![e.rootKid,e.ownerSuborganizationId].every(r=>typeof r=="string"&&/^[\x21-\x7e]{1,256}$/.test(r)))throw new Error("identity_device_standing_authorization_invalid");let t={v:1,iss:e.rootJkt,sub:e.agentId,aud:"urn:visa:tvc:identity-gate",jti:e.authorizationId,ownerSuborganizationId:e.ownerSuborganizationId,turnkeyRootKeyId:e.rootKid,identityPrincipalJkt:e.identityPrincipalJkt,purposes:["tap_signature_base"],generation:e.generation,maxTtlSecondsByPurpose:{tap_signature_base:480},iat:e.nowSec,nbf:e.nowSec,exp:e.expiresAt};return{...(0,p1t.prepareRootSignedJws)("visa-agent-identity-gate-authorization+jwt",e.rootKid,t),claims:t}}qy.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES=["runtime_presence_pop","tap_signature_base"];function _ln(e){if(![e.rootJkt,e.identityPrincipalJkt].every(dte)||![e.agentId,e.authorizationId].every(qOe)||!HOe(e.generation)||!Number.isSafeInteger(e.nowSec)||e.nowSec<0||!Number.isSafeInteger(e.expiresAt)||e.expiresAt<=e.nowSec||e.expiresAt-e.nowSec>366*86400||![e.rootKid,e.ownerSuborganizationId].every(r=>typeof r=="string"&&/^[\x21-\x7e]{1,256}$/.test(r)))throw new Error("identity_hosted_standing_authorization_invalid");let t={v:1,iss:e.rootJkt,sub:e.agentId,aud:"urn:visa:tvc:identity-gate",jti:e.authorizationId,ownerSuborganizationId:e.ownerSuborganizationId,turnkeyRootKeyId:e.rootKid,identityPrincipalJkt:e.identityPrincipalJkt,purposes:[...qy.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES],generation:e.generation,maxTtlSecondsByPurpose:{runtime_presence_pop:120,tap_signature_base:480},iat:e.nowSec,nbf:e.nowSec,exp:e.expiresAt};return{...(0,p1t.prepareRootSignedJws)("visa-agent-identity-gate-authorization+jwt",e.rootKid,t),claims:t}}});var lte=_(fB=>{"use strict";Object.defineProperty(fB,"__esModule",{value:!0});fB.identityTapSigningBytes=VOe;fB.identityTapPayloadSha256=bln;fB.parseIdentityTapSignatureBase=Eln;var yln=require("node:crypto");function VOe(e){let t=()=>{throw new Error("identity_tap_payload_invalid")};if(!e||typeof e!="object"||Array.isArray(e))return t();let r=e,n=["kind","method","authority","path","coveredComponents","paymentHeaderName","paymentHeaderValue","created","expires","keyId","nonce","tag","signatureBase"],i=["contentDigest","operationId","intentHash"];if(n.some(p=>!Object.hasOwn(r,p))||Object.keys(r).some(p=>!n.includes(p)&&!i.includes(p))||Object.hasOwn(r,"operationId")!==Object.hasOwn(r,"intentHash")||Object.hasOwn(r,"operationId")&&(typeof r.operationId!="string"||!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(r.operationId)||typeof r.intentHash!="string"||!/^[A-Za-z0-9_-]{43}$/.test(r.intentHash)||Buffer.from(r.intentHash,"base64url").toString("base64url")!==r.intentHash))return t();let o=p=>typeof p=="string"&&p.length>0&&Buffer.byteLength(p)<=8192&&!/[\n\r\0]/.test(p),s=p=>typeof p=="string"&&/^[A-Za-z0-9_-]{43}$/.test(p)&&Buffer.from(p,"base64url").toString("base64url")===p;if(r.kind!=="tap_signature_base"||typeof r.method!="string"||!/^[A-Z]{1,16}$/.test(r.method)||!o(r.authority)||!o(r.path)||!r.path.startsWith("/")||!o(r.paymentHeaderValue)||!["payment-signature","x-payment"].includes(r.paymentHeaderName)||r.tag!=="agent-payer-auth"||!s(r.keyId)||typeof r.nonce!="string"||!/^[A-Za-z0-9+/]{43}=$/.test(r.nonce)||Buffer.from(r.nonce,"base64").length!==32||Buffer.from(r.nonce,"base64").toString("base64")!==r.nonce||!Number.isSafeInteger(r.created)||r.created<0||!Number.isSafeInteger(r.expires)||r.expires<=r.created||typeof r.signatureBase!="string"||Buffer.byteLength(r.signatureBase)>65536||Object.hasOwn(r,"contentDigest")&&(!o(r.contentDigest)||!r.contentDigest.startsWith("sha-256=:"))||!Array.isArray(r.coveredComponents)||r.coveredComponents.length<1||r.coveredComponents.length>8)return t();let a={"@method":r.method,"@authority":r.authority,"@path":r.path,[r.paymentHeaderName]:r.paymentHeaderValue};Object.hasOwn(r,"contentDigest")&&(a["content-digest"]=r.contentDigest);let c=new Set,u=[];for(let p of r.coveredComponents){if(typeof p!="string"||!Object.hasOwn(a,p)||c.has(p))return t();c.add(p),u.push(`"${p}": ${a[p]}`)}if(["@method","@authority","@path",r.paymentHeaderName].some(p=>!c.has(p))||c.has("content-digest")!==Object.hasOwn(r,"contentDigest"))return t();let d=r.coveredComponents.map(p=>`"${p}"`).join(" ");u.push(`"@signature-params": (${d});created=${r.created};expires=${r.expires};keyid="${r.keyId}";alg="Ed25519";nonce="${r.nonce}";tag="agent-payer-auth"`);let l=u.join(`
+              ELSE NULL END`}function rOe(e,t){if(!/^\$[1-9][0-9]*$/.test(e))throw new jf(`${t} param ref must look like "$N", got "${e}"`)}function ycn(e){if(!/^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*){0,2}$/.test(e))throw new jf(`column ref must be a simple identifier, got "${e}"`)}});var x0t=_(Ot=>{"use strict";Object.defineProperty(Ot,"__esModule",{value:!0});Ot.UNBOUND_AWAITING_RUNTIME_LABEL=Ot.TARGETED_AWAITING_RUNTIME_LABEL=Ot.SETUP_POLL_MS=Ot.SETUP_STEP_STATUSES=Ot.SETUP_IDENTITY_STEPS=Ot.SETUP_RAIL_STEPS=Ot.SETUP_STEPS=Ot.SETUP_TERMINAL_STATES=Ot.SETUP_STATES=Ot.SETUP_RAILS=Ot.PROTECTED_CARD_MAX_DRAWS=Ot.SETUP_DEFAULT_PER_PURCHASE_CENTS=Ot.SETUP_DEFAULT_AGGREGATE_CENTS=Ot.SETUP_CONTRACT_VERSION=void 0;Ot.setupPlanSteps=A0t;Ot.computeSetupReadiness=nOe;Ot.computeSetupNextAction=w0t;Ot.isTerminal=I0t;Ot.computeSetupStatus=wcn;Ot.computeSetupStepTargets=Icn;Ot.isSetupPlanSettled=Ocn;Ot.progressLadder=P0t;Ot.setupProgressSteps=Ccn;Ot.SETUP_CONTRACT_VERSION=4;Ot.SETUP_DEFAULT_AGGREGATE_CENTS=1e4;Ot.SETUP_DEFAULT_PER_PURCHASE_CENTS=2500;Ot.PROTECTED_CARD_MAX_DRAWS=1e3;Ot.SETUP_RAILS=["card","wallet"];Ot.SETUP_STATES=["awaiting_runtime","awaiting_owner","approved","completed","failed","denied","cancelled","expired","merged"];Ot.SETUP_TERMINAL_STATES=["completed","failed","denied","cancelled","expired","merged"];Ot.SETUP_STEPS=["identity.authorize","identity.activate","card.attach","card.mandate","wallet.provision_owner","wallet.attach","wallet.signer"];Ot.SETUP_RAIL_STEPS={card:["card.attach","card.mandate"],wallet:["wallet.provision_owner","wallet.attach","wallet.signer"]};Ot.SETUP_IDENTITY_STEPS=["identity.authorize","identity.activate"];function A0t(e){let t=new Set,r=[];for(let n of[...Ot.SETUP_IDENTITY_STEPS,...e.flatMap(i=>Ot.SETUP_RAIL_STEPS[i]??[])])t.has(n)||(t.add(n),r.push(n));return r}Ot.SETUP_STEP_STATUSES=["pending","running","awaiting_human","awaiting_runtime","succeeded","failed","skipped","abandoned"];Ot.SETUP_POLL_MS={afterHumanAction:1e3,provisioning:3e3,idle:5e3,completedNeedsHuman:3e4,slowDown:1e4};function bcn(e,t){return!t||!t.grantActivated&&!t.ownerPrerequisiteMissing?{rail:e,ready:!1,blocker:"not_provisioned"}:t.ownerPrerequisiteMissing?{rail:e,ready:!1,blocker:"blocked"}:t.instrumentResolves?e==="wallet"&&t.fundedForOnePurchase===!1?{rail:e,ready:!1,blocker:"unfunded"}:e==="card"?{rail:e,ready:!0,tapFree:t.liveMandateWithDrawsLeft===!0}:{rail:e,ready:!0}:{rail:e,ready:!1,blocker:"not_provisioned"}}function nOe(e){let t=e.identity.activated,r=e.operation.requestedRails.map(n=>{let i=bcn(n,e.rails[n]);return n==="wallet"&&i.ready&&e.identity.runtimeDelegation?{rail:n,ready:!1,blocker:"runtime_approval"}:i});return{kind:t&&r.every(n=>n.ready)?"ready":"needs_action",identityReady:t,rails:r}}function Ag(e,t){return t===void 0?{}:{[e]:t}}var Ecn={completed:"Setup finished.",failed:"Setup could not finish.",denied:"You said this was not your agent.",cancelled:"Setup was cancelled.",expired:"This setup request expired.",merged:"This agent joined the setup you started in the Console."},Scn=["enroll_card","card_verification","provision_wallet","wallet_signature"],vcn={enroll_card:"Add a card to pay with.",card_verification:"Verify your card with your bank.",provision_wallet:"Create your wallet.",wallet_signature:"Approve the wallet signer in your browser."};Ot.TARGETED_AWAITING_RUNTIME_LABEL="Waiting for your agent to pick this up. If it doesn't, tell it: connect Visa.";Ot.UNBOUND_AWAITING_RUNTIME_LABEL="This request is not picked up automatically. On the runtime you want, say: connect Visa. You review that runtime\u2019s fingerprint before it holds any authority.";function Tcn(e){return e.claimBindingMode?e.claimBindingMode==="unbound":e.source==="console"}function w0t(e){let{operation:t,identity:r,viewer:n,steps:i}=e,o=nOe(e);if(n.kind==="owner"&&n.signedInAs&&t.ownerUserLogin&&n.signedInAs!==t.ownerUserLogin)return{actor:"human",kind:"switch_account",label:"Sign out, then sign back in as the account that started this.",safeToRetry:!0,afterAction:"stop",expectedLogin:t.ownerUserLogin,signedInAs:n.signedInAs};if(I0t(t.state)&&!(t.state==="completed"&&o.kind==="ready")&&t.state!=="completed")return{actor:"none",kind:"terminal",label:Ecn[t.state],safeToRetry:!1,afterAction:"stop",outcome:t.state,...t.failureReason?{reason:t.failureReason}:{},canRestart:t.state==="expired"||t.state==="cancelled",...t.successorOperationId?{successorOperationId:t.successorOperationId}:{}};if(t.state==="awaiting_runtime"&&r.shortCode&&r.deepLink)return{actor:"human",kind:"give_code",label:"Tell your agent to connect, and give it this code if it asks.",safeToRetry:!0,afterAction:"poll",shortCode:r.shortCode,deepLink:r.deepLink,...Ag("expiresAt",r.credentialExpiresAt??t.expiresAt)};if(t.state==="awaiting_owner"&&r.reviewUrl)return{actor:"human",kind:"open_url",label:"Review and connect this agent.",safeToRetry:!0,afterAction:"open_url_again",channel:"browser",url:r.reviewUrl,...r.openedFromThisDevice===!0?{provenance:"same_device"}:Ag("code",r.compareCode),...Ag("expiresAt",t.expiresAt)};if(r.pendingRuntimeAction)return{actor:"agent",kind:"activate",label:"Finishing setup.",safeToRetry:!0,afterAction:"poll",endpoint:r.pendingRuntimeAction.endpoint};for(let c of Scn)for(let u of t.requestedRails){let d=e.rails[u]?.humanAction;if(d?.kind!==c)continue;let l={actor:"human",label:vcn[c],safeToRetry:!0,afterAction:"open_url_again",url:d.url};return c==="wallet_signature"?{...l,kind:c,...Ag("expiresAt",d.expiresAt),...Ag("attachId",d.attachId),...Ag("agentId",d.agentId)}:c==="card_verification"?{...l,kind:c,...Ag("expiresAt",d.expiresAt)}:{...l,kind:c}}let s=i.find(c=>c.status==="failed");if(s)return s.retryable?{actor:"agent",kind:"retry",label:"Retrying a step that did not finish.",safeToRetry:!0,afterAction:"poll",step:s.step,endpoint:e.endpoints.retry(t.operationId,s.step),...Ag("notBefore",s.nextAttemptAt)}:{actor:"human",kind:"contact_support",label:"This needs a hand from support.",safeToRetry:!1,afterAction:"stop",supportRef:t.operationId,stepFailed:s.step};if(t.state==="completed"&&r.runtimeDelegation?.state==="pending")return{actor:"human",kind:"runtime_delegation",label:"Approve secure wallet access for this runtime.",safeToRetry:!0,afterAction:"poll",url:r.runtimeDelegation.url,agentId:r.runtimeDelegation.agentId,runtimeId:r.runtimeDelegation.runtimeId};if(o.rails.find(c=>c.blocker==="unfunded")){let c=e.rails.wallet;return{actor:"human",kind:"fund_wallet",label:"Add USDC so your agent has something to spend.",safeToRetry:!0,afterAction:"poll",...Ag("address",c?.depositAddress),network:"base",...Ag("minimumMicros",c?.minimumMicros)}}return n.keyMismatchOnLiveAgent&&t.agentId?{actor:"agent",kind:"rotate_key",label:"Rotating this agent to a new key.",safeToRetry:!0,afterAction:"poll",agentId:t.agentId,endpoint:e.endpoints.rotateKey(t.agentId)}:n.throttled?{actor:"agent",kind:"slow_down",label:"Checking less often.",safeToRetry:!0,afterAction:"poll",pollAfterMs:Ot.SETUP_POLL_MS.slowDown}:t.state==="completed"&&o.kind==="ready"?{actor:"none",kind:"done",label:"Your agent is ready to pay.",safeToRetry:!1,afterAction:"stop"}:{actor:"agent",kind:"poll",label:t.state==="awaiting_runtime"?Tcn(t)?Ot.UNBOUND_AWAITING_RUNTIME_LABEL:Ot.TARGETED_AWAITING_RUNTIME_LABEL:"Setting up.",safeToRetry:!0,afterAction:"poll",pollAfterMs:Acn(t.state,o)}}function I0t(e){return Ot.SETUP_TERMINAL_STATES.includes(e)}function Acn(e,t){return e==="approved"?Ot.SETUP_POLL_MS.provisioning:e==="completed"&&t.kind==="needs_action"?Ot.SETUP_POLL_MS.completedNeedsHuman:Ot.SETUP_POLL_MS.idle}function wcn(e){let t=nOe(e),r=w0t(e);return{contractVersion:Ot.SETUP_CONTRACT_VERSION,operationId:e.operation.operationId,state:e.operation.state,readiness:t,nextAction:r,pollAfterMs:"pollAfterMs"in r?r.pollAfterMs:r.afterAction==="stop"?0:r.afterAction==="open_url_again"?Ot.SETUP_POLL_MS.idle:Ot.SETUP_POLL_MS.afterHumanAction}}function Icn(e){let{identity:t,rails:r}=e;return A0t(e.requestedRails).map(n=>({step:n,status:Pcn(n,t.activated,r)}))}function Pcn(e,t,r){switch(e){case"identity.authorize":return"succeeded";case"identity.activate":return t?"succeeded":"awaiting_runtime";default:return xcn(e,t,r)}}function xcn(e,t,r){if(!t)return"pending";let n=r.card,i=r.wallet;switch(e){case"card.attach":return n?.ownerPrerequisiteMissing?"awaiting_human":n?.grantActivated&&n.instrumentResolves?"succeeded":"pending";case"card.mandate":return n?.liveMandateWithDrawsLeft===!0?"succeeded":n?.grantActivated&&n.instrumentResolves?"skipped":"pending";case"wallet.provision_owner":return i===void 0?"pending":i.ownerPrerequisiteMissing?"awaiting_human":"succeeded";case"wallet.attach":return i?.grantActivated?"succeeded":"pending";case"wallet.signer":return i?.grantActivated&&i.instrumentResolves?"succeeded":"pending";default:return"pending"}}function Ocn(e){return e.every(t=>t.status==="succeeded"||t.status==="skipped")}var Rcn={card:"Card ready to pay",wallet:"USDC wallet ready to pay"},Ncn=new Set(["failed","denied","cancelled","expired"]);function P0t(e,t){let r=!0;return e.map(({key:n,label:i,done:o})=>o?{key:n,label:i,state:"done"}:r?(r=!1,{key:n,label:i,state:t?"stopped":"active"}):{key:n,label:i,state:"pending"})}function Ccn(e){let t=String(e.state),r=Array.isArray(e.readiness?.rails)?e.readiness.rails:[],n=!!(e.agent?.runtime||e.agent?.device)||e.readiness?.identityReady===!0||t==="awaiting_owner"||t==="approved"||t==="completed",i=[{key:"created",label:"Request created",done:!0},{key:"picked-up",label:"Agent picked it up",done:n},{key:"approved",label:"Limits approved",done:t==="approved"||t==="completed"},{key:"identity",label:"Agent identity verified",done:e.readiness?.identityReady===!0},...r.map(o=>({key:`rail-${o.rail}`,label:Rcn[o.rail]??`${o.rail} ready to pay`,done:o.ready===!0}))];return P0t(i,Ncn.has(t))}});var O0t=_(OI=>{"use strict";Object.defineProperty(OI,"__esModule",{value:!0});OI.runtimeLabel=kcn;OI.canonicalRuntimeId=$ee;OI.runtimeMatchAliases=Dcn;OI.runtimesMatch=Lcn;OI.claimBindingMode=Ucn;var Mcn={"claude-code":"Claude Code",claude:"Claude Code",codex:"Codex",openclaw:"OpenClaw",hermes:"Hermes",cursor:"Cursor","custom-mcp":"Custom (MCP)",mcp:"Custom (MCP)",custom:"Custom (MCP)"};function kcn(e){let t=e.trim();return Mcn[t.toLowerCase()]??t}function $ee(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();if(t.length!==0)return t==="claude"||t==="claude-code"?"claude-code":t==="codex"?"codex":t==="openclaw"?"openclaw":t==="hermes"?"hermes":t==="cursor"?"cursor":t==="custom-mcp"||t==="mcp"||t==="custom"?"custom-mcp":t}function Dcn(e){let t=$ee(e);return t?t==="claude-code"?["claude","claude-code"]:t==="custom-mcp"?["custom","custom-mcp","mcp"]:[t]:[]}function Lcn(e,t){return!e||e.trim().length===0?!0:!t||t.trim().length===0?!1:$ee(e)===$ee(t)}function Ucn(e){return e&&e.trim().length>0?"targeted":"unbound"}});var R0t=_(Xu=>{"use strict";Object.defineProperty(Xu,"__esModule",{value:!0});Xu.ReleaseManifestValidationError=Xu.PROVIDER_CONFIGURATION_VARIABLE_KEYS=Xu.ACTIVE_RAILWAY_SERVICES=Xu.RELEASE_MANIFEST_SCHEMA_VERSION=void 0;Xu.validateReleaseManifest=jcn;var Bcn=G_();Xu.RELEASE_MANIFEST_SCHEMA_VERSION="1.0.0";Xu.ACTIVE_RAILWAY_SERVICES=["auth","web","mpp","admin","worker"];Xu.PROVIDER_CONFIGURATION_VARIABLE_KEYS=["name","sensitivity","owners","consumer"];var ht=class extends Error{field;constructor(t,r){super(`ReleaseManifest validation error: ${t}${r?` (field: ${r})`:""}`),this.field=r,this.name="ReleaseManifestValidationError"}};Xu.ReleaseManifestValidationError=ht;function jcn(e){if(!e||typeof e!="object"||Array.isArray(e))throw new ht("Manifest must be a non-null object");let t=e;if(t.schemaVersion!==Xu.RELEASE_MANIFEST_SCHEMA_VERSION)throw new ht(`Unsupported schemaVersion "${t.schemaVersion}"; expected "${Xu.RELEASE_MANIFEST_SCHEMA_VERSION}"`,"schemaVersion");if(typeof t.candidateId!="string"||!t.candidateId.trim())throw new ht("candidateId must be a non-empty string","candidateId");if(typeof t.sourceCommit!="string"||!/^[0-9a-f]{7,40}$/i.test(t.sourceCommit))throw new ht("sourceCommit must be a valid git commit SHA","sourceCommit");if(typeof t.generatedAt!="string"||!t.generatedAt.trim())throw new ht("generatedAt must be a valid timestamp","generatedAt");if(t.environment!=="staging"&&t.environment!=="production")throw new ht('environment must be "staging" or "production"',"environment");if(!t.services||typeof t.services!="object"||Array.isArray(t.services))throw new ht("services must be an object","services");let r=t.services;for(let m of Xu.ACTIVE_RAILWAY_SERVICES){if(!r[m]||typeof r[m]!="object")throw new ht(`Missing required active Railway service "${m}"`,`services.${m}`);let h=r[m];if(h.serviceId!==m)throw new ht(`Service ID mismatch for "${m}"`,`services.${m}.serviceId`);if(typeof h.rootPath!="string"||!h.rootPath.trim())throw new ht(`Invalid rootPath for service "${m}"`,`services.${m}.rootPath`);if(!Array.isArray(h.watchPaths)||h.watchPaths.length===0)throw new ht(`watchPaths must be a non-empty array for service "${m}"`,`services.${m}.watchPaths`);if(!Array.isArray(h.healthEndpoints)||h.healthEndpoints.length===0)throw new ht(`healthEndpoints must be a non-empty array for service "${m}"`,`services.${m}.healthEndpoints`)}if(!t.cli||typeof t.cli!="object"||Array.isArray(t.cli))throw new ht("cli must be an object","cli");let n=t.cli;if(n.packageName!=="@visa/cli")throw new ht('cli.packageName must be "@visa/cli"',"cli.packageName");if(typeof n.version!="string"||!n.version.trim())throw new ht("cli.version must be a valid string","cli.version");if(n.channel!=="rc"&&n.channel!=="latest")throw new ht('cli.channel must be "rc" or "latest"',"cli.channel");if(typeof n.tarballIntegrity!="string"||!n.tarballIntegrity.trim())throw new ht("cli.tarballIntegrity must be a non-empty string","cli.tarballIntegrity");if(typeof n.minimumCompatibleVersion!="string"||!n.minimumCompatibleVersion.trim())throw new ht("cli.minimumCompatibleVersion must be a non-empty string","cli.minimumCompatibleVersion");if(!n.capabilityFloors||typeof n.capabilityFloors!="object")throw new ht("cli.capabilityFloors must be an object","cli.capabilityFloors");if(!t.database||typeof t.database!="object")throw new ht("database must be an object","database");let i=t.database;if(!i.postgres||typeof i.postgres!="object")throw new ht("database.postgres must be an object","database.postgres");let o=i.postgres;if(typeof o.schemaChecksum!="string"||!o.schemaChecksum.trim())throw new ht("database.postgres.schemaChecksum must be a non-empty string","database.postgres.schemaChecksum");if(!Array.isArray(o.tables)||o.tables.length===0)throw new ht("database.postgres.tables must be a non-empty array","database.postgres.tables");if(!i.clickhouse||typeof i.clickhouse!="object")throw new ht("database.clickhouse must be an object","database.clickhouse");let s=i.clickhouse;if(typeof s.schemaChecksum!="string"||!s.schemaChecksum.trim())throw new ht("database.clickhouse.schemaChecksum must be a non-empty string","database.clickhouse.schemaChecksum");if(!Array.isArray(s.tables)||s.tables.length===0)throw new ht("database.clickhouse.tables must be a non-empty array","database.clickhouse.tables");if(!t.capabilities||typeof t.capabilities!="object")throw new ht("capabilities must be an object","capabilities");let a=t.capabilities;if(!Array.isArray(a.publicTools)||a.publicTools.length===0)throw new ht("capabilities.publicTools must be a non-empty array","capabilities.publicTools");if(!Array.isArray(a.paymentRails)||a.paymentRails.length===0)throw new ht("capabilities.paymentRails must be a non-empty array","capabilities.paymentRails");if(!Array.isArray(a.protocols)||a.protocols.length===0)throw new ht("capabilities.protocols must be a non-empty array","capabilities.protocols");if(!Array.isArray(a.rolloutFlags)||a.rolloutFlags.length===0)throw new ht("capabilities.rolloutFlags must be a non-empty array","capabilities.rolloutFlags");if(!t.providers||typeof t.providers!="object"||Array.isArray(t.providers))throw new ht("providers must be an object","providers");let c=t.providers,u=["turnkey","postgres","clickhouse","redis","sentry"];for(let m of u)if(!c[m]||typeof c[m]!="object")throw new ht(`Missing required provider assertion "${m}"`,`providers.${m}`);for(let[m,h]of Object.entries(c)){let g=h;if(g.configuration!==void 0){if(!Array.isArray(g.configuration))throw new ht(`providers.${m}.configuration must be an array`,`providers.${m}.configuration`);g.configuration.forEach((y,S)=>{let b=`providers.${m}.configuration[${S}]`;if(!y||typeof y!="object"||Array.isArray(y))throw new ht(`${b} must be an object`,b);let E=y;for(let T of Object.keys(E))if(!Xu.PROVIDER_CONFIGURATION_VARIABLE_KEYS.includes(T))throw new ht(`${b} carries unexpected key "${T}"; only variable names and registry metadata belong in the manifest`,b);if(typeof E.name!="string"||!/^[A-Z][A-Z0-9_]*$/.test(E.name))throw new ht(`${b}.name must be an environment variable name`,`${b}.name`);if(typeof E.sensitivity!="string"||!E.sensitivity.trim())throw new ht(`${b}.sensitivity must be a non-empty string`,`${b}.sensitivity`);if(!Array.isArray(E.owners)||E.owners.some(T=>typeof T!="string"))throw new ht(`${b}.owners must be an array of service names`,`${b}.owners`);if(typeof E.consumer!="string"||!E.consumer.trim())throw new ht(`${b}.consumer must be a non-empty string`,`${b}.consumer`)})}}if(!t.canaries||typeof t.canaries!="object"||Array.isArray(t.canaries))throw new ht("canaries must be an object","canaries");let d=t.canaries;if(!d.ceremonyCanary7590||typeof d.ceremonyCanary7590!="object")throw new ht('Missing required canary "ceremonyCanary7590"',"canaries.ceremonyCanary7590");if(!d.serviceHealthProbes||typeof d.serviceHealthProbes!="object")throw new ht('Missing required canary "serviceHealthProbes"',"canaries.serviceHealthProbes");if(!t.docs||typeof t.docs!="object")throw new ht("docs must be an object","docs");let l=t.docs;if(typeof l.canonicalDocsVersion!="string"||!l.canonicalDocsVersion.trim())throw new ht("docs.canonicalDocsVersion must be a non-empty string","docs.canonicalDocsVersion");if(!Array.isArray(t.rollbackClassification)||t.rollbackClassification.length===0)throw new ht("rollbackClassification must be a non-empty array","rollbackClassification");let p=new Set(["schema","credentials","provider_effects","money_state"]),f=new Set;for(let m of t.rollbackClassification){if(!m||typeof m!="object")throw new ht("rollbackClassification item must be an object","rollbackClassification");let h=m;if(h.classification!=="safe_rollback"&&h.classification!=="forward_fix_required")throw new ht(`Invalid classification "${h.classification}" for step "${h.step}"`,"rollbackClassification");typeof h.category=="string"&&f.add(h.category)}for(let m of p)if(!f.has(m))throw new ht(`rollbackClassification must cover category "${m}"`,"rollbackClassification");return iOe(t),(0,Bcn.canonicalJsonValue)(e)}function iOe(e,t=""){if(e!=null){if(typeof e=="string"){if(/Bearer\s+[A-Za-z0-9_-]{20,}/i.test(e))throw new ht(`Bearer token detected in manifest at ${t}`);if(/-----BEGIN\s+(?:RSA|EC|PRIVATE)\s+KEY-----/i.test(e))throw new ht(`Private key detected in manifest at ${t}`);if(/^(?:postgres|postgresql|redis|mongodb):\/\/[^:]+:[^@]+@/i.test(e))throw new ht(`Credential-bearing connection URL detected in manifest at ${t}`);return}if(Array.isArray(e)){for(let r=0;r<e.length;r++)iOe(e[r],`${t}[${r}]`);return}if(typeof e=="object")for(let[r,n]of Object.entries(e))iOe(n,t?`${t}.${r}`:r)}}});var qf=_(z=>{"use strict";Object.defineProperty(z,"__esModule",{value:!0});z.clickhouseDatabaseHasStagingMarker=z.validateCardPaymentUnmatchedEventInsertRow=z.validateCardPaymentEventInsertRow=z.refreshCardPaymentAttemptProjection=z.insertCardPaymentUnmatchedEvent=z.insertCardPaymentLifecycleEventWithId=z.insertCardPaymentLifecycleEvent=z.assertValidCardPaymentAttemptStatus=z.CardPaymentDbValidationError=z.requiresProviderProvenance=z.requiredProvenanceFor=z.reduceCardPaymentEvents=z.provenanceOfSource=z.isOwnerAttestationVerdict=z.OWNER_ATTESTATION_VERDICTS=z.CARD_PAYMENT_EVENT_REQUIRED_PROVENANCE=z.CARD_PAYMENT_SOURCE_PROVENANCE=z.CARD_PAYMENT_PROVENANCES=z.CARD_PAYMENT_PROCESSOR_TRUTH_EVENT_TYPES=z.CARD_PAYMENT_UNMATCHED_SOURCES=z.CARD_PAYMENT_UNMATCHED_EVENT_TYPES=z.CARD_PAYMENT_SOURCES=z.CARD_PAYMENT_UNMATCHED_PROCESSORS=z.CARD_PAYMENT_PROCESSORS=z.CARD_PAYMENT_INTENTS=z.CARD_PAYMENT_EVENT_TYPES=z.CARD_PAYMENT_ATTEMPT_STATUSES=z.parseAccountOperationReceipt=z.cardStatusClaimsProcessorTruth=z.cardProofLevel=z.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION=z.ACCOUNT_OPERATION_PROOF_LEVELS=z.ACCOUNT_OPERATION_OUTCOMES=z.ACCOUNT_OPERATION_EVIDENCE_TYPES=z.checkTvcPinParity=z.TVC_SIGNER_POLICY_CONTRACT_VERSION=z.tvcCredentialLifecycleEvidence=z.parseTvcCredentialLifecycleEvidence=z.assertTvcCredentialRebindWindow=z.TVC_CREDENTIAL_REBIND_LEAD_SECONDS=z.TVC_CREDENTIAL_CONTRACT_SOURCES=z.tvcProviderCapacityEvidence=z.TVC_PROVIDER_WARN_THRESHOLD=z.parseTvcProviderCapacityEvidence=z.TURNKEY_SUBORG_RESOURCE_LIMITS=z.renderAgentOutcome=z.projectAgentOutcome=z.createAgentOutcomeProjector=z.AGENT_OUTCOME_LABELS=z.GenerationStatus=void 0;z.TARGETED_AWAITING_RUNTIME_LABEL=z.SETUP_TERMINAL_STATES=z.SETUP_STEP_STATUSES=z.SETUP_STEPS=z.SETUP_STATES=z.SETUP_RAIL_STEPS=z.SETUP_RAILS=z.SETUP_POLL_MS=z.SETUP_IDENTITY_STEPS=z.SETUP_DEFAULT_PER_PURCHASE_CENTS=z.SETUP_DEFAULT_AGGREGATE_CENTS=z.PROTECTED_CARD_MAX_DRAWS=z.SETUP_CONTRACT_VERSION=z.validateEncryptionKey=z.isPgcryptoIntegrityError=z.encryptSqlFragment=z.encrypt=z.encodeWireFormat=z.decryptSqlFragment=z.decrypt=z.decodeWireFormat=z.PgEncryptionWireFormatError=z.PgEncryptionKeyMissingError=z.PgEncryptionError=z.PgDecryptionFailedError=z.PG_ENCRYPTION_WIRE_VERSIONS=z.ENCRYPTION_KEY_MIN_BYTES=z.utf8ByteLength=z.isCanonicalText=z.isCanonicalOpaqueId=z.compareCanonicalKeys=z.assertCanonicalOpaqueId=z.CANONICAL_OPAQUE_ID_PATTERN=z.CANONICAL_OPAQUE_ID_MAX_BYTES=z.canonicalJson=z.parseAgentSelector=z.normalizeAgentName=z.computeAgentSelection=z.fetchWithTimeout=z.DEFAULT_FETCH_TIMEOUT_MS=z.PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE=z.matchesPreviewLegacyBalanceDrift=z.resolveDeploymentEnvClass=z.resolveClickhouseEnvBinding=z.normalizeRailEnvironmentValue=z.isPublicPreviewRailEnvironment=z.isLiveVgsEnvironment=z.isExplicitProductionRailEnvironment=z.isExplicitPreviewPaymentRailOptIn=z.detectDeploymentEnvNodeEnvMismatch=void 0;z.validateReleaseManifest=z.ReleaseManifestValidationError=z.RELEASE_MANIFEST_SCHEMA_VERSION=z.PROVIDER_CONFIGURATION_VARIABLE_KEYS=z.ACTIVE_RAILWAY_SERVICES=z.claimBindingMode=z.runtimesMatch=z.runtimeMatchAliases=z.canonicalRuntimeId=z.runtimeLabel=z.setupProgressSteps=z.setupPlanSteps=z.progressLadder=z.isTerminal=z.isSetupPlanSettled=z.computeSetupStepTargets=z.computeSetupStatus=z.computeSetupReadiness=z.computeSetupNextAction=z.UNBOUND_AWAITING_RUNTIME_LABEL=void 0;var N0t;(function(e){e.pending="pending",e.processing="processing",e.completed="completed",e.failed="failed"})(N0t||(z.GenerationStatus=N0t={}));var zee=G4e();Object.defineProperty(z,"AGENT_OUTCOME_LABELS",{enumerable:!0,get:function(){return zee.AGENT_OUTCOME_LABELS}});Object.defineProperty(z,"createAgentOutcomeProjector",{enumerable:!0,get:function(){return zee.createAgentOutcomeProjector}});Object.defineProperty(z,"projectAgentOutcome",{enumerable:!0,get:function(){return zee.projectAgentOutcome}});Object.defineProperty(z,"renderAgentOutcome",{enumerable:!0,get:function(){return zee.renderAgentOutcome}});var Gee=qht();Object.defineProperty(z,"TURNKEY_SUBORG_RESOURCE_LIMITS",{enumerable:!0,get:function(){return Gee.TURNKEY_SUBORG_RESOURCE_LIMITS}});Object.defineProperty(z,"parseTvcProviderCapacityEvidence",{enumerable:!0,get:function(){return Gee.parseTvcProviderCapacityEvidence}});Object.defineProperty(z,"TVC_PROVIDER_WARN_THRESHOLD",{enumerable:!0,get:function(){return Gee.TVC_PROVIDER_WARN_THRESHOLD}});Object.defineProperty(z,"tvcProviderCapacityEvidence",{enumerable:!0,get:function(){return Gee.tvcProviderCapacityEvidence}});var sB=$ht();Object.defineProperty(z,"TVC_CREDENTIAL_CONTRACT_SOURCES",{enumerable:!0,get:function(){return sB.TVC_CREDENTIAL_CONTRACT_SOURCES}});Object.defineProperty(z,"TVC_CREDENTIAL_REBIND_LEAD_SECONDS",{enumerable:!0,get:function(){return sB.TVC_CREDENTIAL_REBIND_LEAD_SECONDS}});Object.defineProperty(z,"assertTvcCredentialRebindWindow",{enumerable:!0,get:function(){return sB.assertTvcCredentialRebindWindow}});Object.defineProperty(z,"parseTvcCredentialLifecycleEvidence",{enumerable:!0,get:function(){return sB.parseTvcCredentialLifecycleEvidence}});Object.defineProperty(z,"tvcCredentialLifecycleEvidence",{enumerable:!0,get:function(){return sB.tvcCredentialLifecycleEvidence}});var qcn=zht();Object.defineProperty(z,"TVC_SIGNER_POLICY_CONTRACT_VERSION",{enumerable:!0,get:function(){return qcn.TVC_SIGNER_POLICY_CONTRACT_VERSION}});var Hcn=Kht();Object.defineProperty(z,"checkTvcPinParity",{enumerable:!0,get:function(){return Hcn.checkTvcPinParity}});var RI=$ge();Object.defineProperty(z,"ACCOUNT_OPERATION_EVIDENCE_TYPES",{enumerable:!0,get:function(){return RI.ACCOUNT_OPERATION_EVIDENCE_TYPES}});Object.defineProperty(z,"ACCOUNT_OPERATION_OUTCOMES",{enumerable:!0,get:function(){return RI.ACCOUNT_OPERATION_OUTCOMES}});Object.defineProperty(z,"ACCOUNT_OPERATION_PROOF_LEVELS",{enumerable:!0,get:function(){return RI.ACCOUNT_OPERATION_PROOF_LEVELS}});Object.defineProperty(z,"ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION",{enumerable:!0,get:function(){return RI.ACCOUNT_OPERATION_RECEIPT_SCHEMA_VERSION}});Object.defineProperty(z,"cardProofLevel",{enumerable:!0,get:function(){return RI.cardProofLevel}});Object.defineProperty(z,"cardStatusClaimsProcessorTruth",{enumerable:!0,get:function(){return RI.cardStatusClaimsProcessorTruth}});Object.defineProperty(z,"parseAccountOperationReceipt",{enumerable:!0,get:function(){return RI.parseAccountOperationReceipt}});var xa=W4e();Object.defineProperty(z,"CARD_PAYMENT_ATTEMPT_STATUSES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_ATTEMPT_STATUSES}});Object.defineProperty(z,"CARD_PAYMENT_EVENT_TYPES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_EVENT_TYPES}});Object.defineProperty(z,"CARD_PAYMENT_INTENTS",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_INTENTS}});Object.defineProperty(z,"CARD_PAYMENT_PROCESSORS",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_PROCESSORS}});Object.defineProperty(z,"CARD_PAYMENT_UNMATCHED_PROCESSORS",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_UNMATCHED_PROCESSORS}});Object.defineProperty(z,"CARD_PAYMENT_SOURCES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_SOURCES}});Object.defineProperty(z,"CARD_PAYMENT_UNMATCHED_EVENT_TYPES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_UNMATCHED_EVENT_TYPES}});Object.defineProperty(z,"CARD_PAYMENT_UNMATCHED_SOURCES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_UNMATCHED_SOURCES}});Object.defineProperty(z,"CARD_PAYMENT_PROCESSOR_TRUTH_EVENT_TYPES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_PROCESSOR_TRUTH_EVENT_TYPES}});Object.defineProperty(z,"CARD_PAYMENT_PROVENANCES",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_PROVENANCES}});Object.defineProperty(z,"CARD_PAYMENT_SOURCE_PROVENANCE",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_SOURCE_PROVENANCE}});Object.defineProperty(z,"CARD_PAYMENT_EVENT_REQUIRED_PROVENANCE",{enumerable:!0,get:function(){return xa.CARD_PAYMENT_EVENT_REQUIRED_PROVENANCE}});Object.defineProperty(z,"OWNER_ATTESTATION_VERDICTS",{enumerable:!0,get:function(){return xa.OWNER_ATTESTATION_VERDICTS}});Object.defineProperty(z,"isOwnerAttestationVerdict",{enumerable:!0,get:function(){return xa.isOwnerAttestationVerdict}});Object.defineProperty(z,"provenanceOfSource",{enumerable:!0,get:function(){return xa.provenanceOfSource}});Object.defineProperty(z,"reduceCardPaymentEvents",{enumerable:!0,get:function(){return xa.reduceCardPaymentEvents}});Object.defineProperty(z,"requiredProvenanceFor",{enumerable:!0,get:function(){return xa.requiredProvenanceFor}});Object.defineProperty(z,"requiresProviderProvenance",{enumerable:!0,get:function(){return xa.requiresProviderProvenance}});var qv=d0t();Object.defineProperty(z,"CardPaymentDbValidationError",{enumerable:!0,get:function(){return qv.CardPaymentDbValidationError}});Object.defineProperty(z,"assertValidCardPaymentAttemptStatus",{enumerable:!0,get:function(){return qv.assertValidCardPaymentAttemptStatus}});Object.defineProperty(z,"insertCardPaymentLifecycleEvent",{enumerable:!0,get:function(){return qv.insertCardPaymentLifecycleEvent}});Object.defineProperty(z,"insertCardPaymentLifecycleEventWithId",{enumerable:!0,get:function(){return qv.insertCardPaymentLifecycleEventWithId}});Object.defineProperty(z,"insertCardPaymentUnmatchedEvent",{enumerable:!0,get:function(){return qv.insertCardPaymentUnmatchedEvent}});Object.defineProperty(z,"refreshCardPaymentAttemptProjection",{enumerable:!0,get:function(){return qv.refreshCardPaymentAttemptProjection}});Object.defineProperty(z,"validateCardPaymentEventInsertRow",{enumerable:!0,get:function(){return qv.validateCardPaymentEventInsertRow}});Object.defineProperty(z,"validateCardPaymentUnmatchedEventInsertRow",{enumerable:!0,get:function(){return qv.validateCardPaymentUnmatchedEventInsertRow}});var Uy=h0t();Object.defineProperty(z,"clickhouseDatabaseHasStagingMarker",{enumerable:!0,get:function(){return Uy.clickhouseDatabaseHasStagingMarker}});Object.defineProperty(z,"detectDeploymentEnvNodeEnvMismatch",{enumerable:!0,get:function(){return Uy.detectDeploymentEnvNodeEnvMismatch}});Object.defineProperty(z,"isExplicitPreviewPaymentRailOptIn",{enumerable:!0,get:function(){return Uy.isExplicitPreviewPaymentRailOptIn}});Object.defineProperty(z,"isExplicitProductionRailEnvironment",{enumerable:!0,get:function(){return Uy.isExplicitProductionRailEnvironment}});Object.defineProperty(z,"isLiveVgsEnvironment",{enumerable:!0,get:function(){return Uy.isLiveVgsEnvironment}});Object.defineProperty(z,"isPublicPreviewRailEnvironment",{enumerable:!0,get:function(){return Uy.isPublicPreviewRailEnvironment}});Object.defineProperty(z,"normalizeRailEnvironmentValue",{enumerable:!0,get:function(){return Uy.normalizeRailEnvironmentValue}});Object.defineProperty(z,"resolveClickhouseEnvBinding",{enumerable:!0,get:function(){return Uy.resolveClickhouseEnvBinding}});Object.defineProperty(z,"resolveDeploymentEnvClass",{enumerable:!0,get:function(){return Uy.resolveDeploymentEnvClass}});var C0t=_0t();Object.defineProperty(z,"matchesPreviewLegacyBalanceDrift",{enumerable:!0,get:function(){return C0t.matchesPreviewLegacyBalanceDrift}});Object.defineProperty(z,"PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE",{enumerable:!0,get:function(){return C0t.PREVIEW_LEGACY_BALANCE_DRIFT_BASELINE}});var M0t=y0t();Object.defineProperty(z,"DEFAULT_FETCH_TIMEOUT_MS",{enumerable:!0,get:function(){return M0t.DEFAULT_FETCH_TIMEOUT_MS}});Object.defineProperty(z,"fetchWithTimeout",{enumerable:!0,get:function(){return M0t.fetchWithTimeout}});var oOe=E0t();Object.defineProperty(z,"computeAgentSelection",{enumerable:!0,get:function(){return oOe.computeAgentSelection}});Object.defineProperty(z,"normalizeAgentName",{enumerable:!0,get:function(){return oOe.normalizeAgentName}});Object.defineProperty(z,"parseAgentSelector",{enumerable:!0,get:function(){return oOe.parseAgentSelector}});var Vcn=G_();Object.defineProperty(z,"canonicalJson",{enumerable:!0,get:function(){return Vcn.canonicalJson}});var NI=Y4();Object.defineProperty(z,"CANONICAL_OPAQUE_ID_MAX_BYTES",{enumerable:!0,get:function(){return NI.CANONICAL_OPAQUE_ID_MAX_BYTES}});Object.defineProperty(z,"CANONICAL_OPAQUE_ID_PATTERN",{enumerable:!0,get:function(){return NI.CANONICAL_OPAQUE_ID_PATTERN}});Object.defineProperty(z,"assertCanonicalOpaqueId",{enumerable:!0,get:function(){return NI.assertCanonicalOpaqueId}});Object.defineProperty(z,"compareCanonicalKeys",{enumerable:!0,get:function(){return NI.compareCanonicalKeys}});Object.defineProperty(z,"isCanonicalOpaqueId",{enumerable:!0,get:function(){return NI.isCanonicalOpaqueId}});Object.defineProperty(z,"isCanonicalText",{enumerable:!0,get:function(){return NI.isCanonicalText}});Object.defineProperty(z,"utf8ByteLength",{enumerable:!0,get:function(){return NI.utf8ByteLength}});var Qd=T0t();Object.defineProperty(z,"ENCRYPTION_KEY_MIN_BYTES",{enumerable:!0,get:function(){return Qd.ENCRYPTION_KEY_MIN_BYTES}});Object.defineProperty(z,"PG_ENCRYPTION_WIRE_VERSIONS",{enumerable:!0,get:function(){return Qd.PG_ENCRYPTION_WIRE_VERSIONS}});Object.defineProperty(z,"PgDecryptionFailedError",{enumerable:!0,get:function(){return Qd.PgDecryptionFailedError}});Object.defineProperty(z,"PgEncryptionError",{enumerable:!0,get:function(){return Qd.PgEncryptionError}});Object.defineProperty(z,"PgEncryptionKeyMissingError",{enumerable:!0,get:function(){return Qd.PgEncryptionKeyMissingError}});Object.defineProperty(z,"PgEncryptionWireFormatError",{enumerable:!0,get:function(){return Qd.PgEncryptionWireFormatError}});Object.defineProperty(z,"decodeWireFormat",{enumerable:!0,get:function(){return Qd.decodeWireFormat}});Object.defineProperty(z,"decrypt",{enumerable:!0,get:function(){return Qd.decrypt}});Object.defineProperty(z,"decryptSqlFragment",{enumerable:!0,get:function(){return Qd.decryptSqlFragment}});Object.defineProperty(z,"encodeWireFormat",{enumerable:!0,get:function(){return Qd.encodeWireFormat}});Object.defineProperty(z,"encrypt",{enumerable:!0,get:function(){return Qd.encrypt}});Object.defineProperty(z,"encryptSqlFragment",{enumerable:!0,get:function(){return Qd.encryptSqlFragment}});Object.defineProperty(z,"isPgcryptoIntegrityError",{enumerable:!0,get:function(){return Qd.isPgcryptoIntegrityError}});Object.defineProperty(z,"validateEncryptionKey",{enumerable:!0,get:function(){return Qd.validateEncryptionKey}});var io=x0t();Object.defineProperty(z,"SETUP_CONTRACT_VERSION",{enumerable:!0,get:function(){return io.SETUP_CONTRACT_VERSION}});Object.defineProperty(z,"PROTECTED_CARD_MAX_DRAWS",{enumerable:!0,get:function(){return io.PROTECTED_CARD_MAX_DRAWS}});Object.defineProperty(z,"SETUP_DEFAULT_AGGREGATE_CENTS",{enumerable:!0,get:function(){return io.SETUP_DEFAULT_AGGREGATE_CENTS}});Object.defineProperty(z,"SETUP_DEFAULT_PER_PURCHASE_CENTS",{enumerable:!0,get:function(){return io.SETUP_DEFAULT_PER_PURCHASE_CENTS}});Object.defineProperty(z,"SETUP_IDENTITY_STEPS",{enumerable:!0,get:function(){return io.SETUP_IDENTITY_STEPS}});Object.defineProperty(z,"SETUP_POLL_MS",{enumerable:!0,get:function(){return io.SETUP_POLL_MS}});Object.defineProperty(z,"SETUP_RAILS",{enumerable:!0,get:function(){return io.SETUP_RAILS}});Object.defineProperty(z,"SETUP_RAIL_STEPS",{enumerable:!0,get:function(){return io.SETUP_RAIL_STEPS}});Object.defineProperty(z,"SETUP_STATES",{enumerable:!0,get:function(){return io.SETUP_STATES}});Object.defineProperty(z,"SETUP_STEPS",{enumerable:!0,get:function(){return io.SETUP_STEPS}});Object.defineProperty(z,"SETUP_STEP_STATUSES",{enumerable:!0,get:function(){return io.SETUP_STEP_STATUSES}});Object.defineProperty(z,"SETUP_TERMINAL_STATES",{enumerable:!0,get:function(){return io.SETUP_TERMINAL_STATES}});Object.defineProperty(z,"TARGETED_AWAITING_RUNTIME_LABEL",{enumerable:!0,get:function(){return io.TARGETED_AWAITING_RUNTIME_LABEL}});Object.defineProperty(z,"UNBOUND_AWAITING_RUNTIME_LABEL",{enumerable:!0,get:function(){return io.UNBOUND_AWAITING_RUNTIME_LABEL}});Object.defineProperty(z,"computeSetupNextAction",{enumerable:!0,get:function(){return io.computeSetupNextAction}});Object.defineProperty(z,"computeSetupReadiness",{enumerable:!0,get:function(){return io.computeSetupReadiness}});Object.defineProperty(z,"computeSetupStatus",{enumerable:!0,get:function(){return io.computeSetupStatus}});Object.defineProperty(z,"computeSetupStepTargets",{enumerable:!0,get:function(){return io.computeSetupStepTargets}});Object.defineProperty(z,"isSetupPlanSettled",{enumerable:!0,get:function(){return io.isSetupPlanSettled}});Object.defineProperty(z,"isTerminal",{enumerable:!0,get:function(){return io.isTerminal}});Object.defineProperty(z,"progressLadder",{enumerable:!0,get:function(){return io.progressLadder}});Object.defineProperty(z,"setupPlanSteps",{enumerable:!0,get:function(){return io.setupPlanSteps}});Object.defineProperty(z,"setupProgressSteps",{enumerable:!0,get:function(){return io.setupProgressSteps}});var aB=O0t();Object.defineProperty(z,"runtimeLabel",{enumerable:!0,get:function(){return aB.runtimeLabel}});Object.defineProperty(z,"canonicalRuntimeId",{enumerable:!0,get:function(){return aB.canonicalRuntimeId}});Object.defineProperty(z,"runtimeMatchAliases",{enumerable:!0,get:function(){return aB.runtimeMatchAliases}});Object.defineProperty(z,"runtimesMatch",{enumerable:!0,get:function(){return aB.runtimesMatch}});Object.defineProperty(z,"claimBindingMode",{enumerable:!0,get:function(){return aB.claimBindingMode}});var cB=R0t();Object.defineProperty(z,"ACTIVE_RAILWAY_SERVICES",{enumerable:!0,get:function(){return cB.ACTIVE_RAILWAY_SERVICES}});Object.defineProperty(z,"PROVIDER_CONFIGURATION_VARIABLE_KEYS",{enumerable:!0,get:function(){return cB.PROVIDER_CONFIGURATION_VARIABLE_KEYS}});Object.defineProperty(z,"RELEASE_MANIFEST_SCHEMA_VERSION",{enumerable:!0,get:function(){return cB.RELEASE_MANIFEST_SCHEMA_VERSION}});Object.defineProperty(z,"ReleaseManifestValidationError",{enumerable:!0,get:function(){return cB.ReleaseManifestValidationError}});Object.defineProperty(z,"validateReleaseManifest",{enumerable:!0,get:function(){return cB.validateReleaseManifest}})});var uOe=_(el=>{"use strict";Object.defineProperty(el,"__esModule",{value:!0});el.PRODUCT_SPEND_POLICY_VERSION=void 0;el.canonicalMerchantOriginPattern=V0t;el.canonicalMerchantPathPrefix=F0t;el.canonicalMerchantTarget=$0t;el.canonicalOwnerProductSpendPolicy=z0t;el.canonicalRuntimeProductSpendAttenuation=G0t;el.productSpendPolicyHash=K0t;el.isProductSpendPolicySubset=eun;el.evaluateProductSpendPolicy=tun;var Fcn=require("node:crypto"),$cn=qf();el.PRODUCT_SPEND_POLICY_VERSION=1;var zcn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,B0t=/^(?:0|[1-9][0-9]*)$/,j0t=/^eip155:[1-9][0-9]{0,15}$/,q0t=/^eip155:[1-9][0-9]{0,15}\/erc20:0x[0-9a-f]{40}$/,Gcn=128,Kcn=64;function aOe(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function cOe(e,t,r){let n=new Set(r);for(let i of Object.keys(t))if(!n.has(i))throw new Error(`${e} contains unknown key '${i}'`)}function Vv(e,t){if(typeof t!="string"||!zcn.test(t))throw new Error(`${e} must be a UUID`);return t.toLowerCase()}function Wee(e,t){if(!Number.isSafeInteger(t)||t<=0)throw new Error(`${e} must be a positive safe integer`);return t}function Kee(e,t,r=!1){if(typeof t!="string"||!B0t.test(t)||!r&&t==="0")throw new Error(`${e} must be a ${r?"non-negative":"positive"} canonical integer string`);let n=BigInt(t);if(n>9223372036854775807n)throw new Error(`${e} exceeds bigint storage`);return n.toString()}function Wcn(e,t){if(typeof t!="string")throw new Error(`${e} must be an ISO timestamp`);let r=Date.parse(t);if(!Number.isFinite(r))throw new Error(`${e} must be an ISO timestamp`);let n=new Date(r).toISOString();if(t!==n)throw new Error(`${e} must be canonical UTC ISO-8601`);return n}function k0t(e,t,r){if(!Array.isArray(t)||t.length===0||t.length>Kcn)throw new Error(`${e} must be a non-empty bounded array`);let n=t.map(i=>{if(typeof i!="string"||!r.test(i))throw new Error(`${e} contains a non-canonical value`);return i});if(new Set(n).size!==n.length)throw new Error(`${e} must not repeat`);return[...n].sort()}function Ycn(e){if(e.startsWith("https://*.")){let t=e.slice(10);if(t.includes("*"))throw new Error("merchant wildcard must be the left-most full label");return{wildcard:!0,parseable:`https://wildcard.${t}`}}if(e.includes("*"))throw new Error("merchant wildcard must be the left-most full label");return{wildcard:!1,parseable:e}}function H0t(e,t){if(t.length===0||t.length>253||t.endsWith(".")||t.includes(":")||/^\d+(?:\.\d+){3}$/.test(t))throw new Error(`${e} must use a canonical DNS hostname`);for(let r of t.split("."))if(r.length===0||r.length>63||!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(r))throw new Error(`${e} must use a canonical DNS hostname`)}function V0t(e){if(typeof e!="string"||e.length===0||e.length>512)throw new Error("merchant origin pattern must be a bounded string");let{wildcard:t,parseable:r}=Ycn(e),n;try{n=new URL(r)}catch{throw new Error("merchant origin pattern must be a valid URL")}if(n.protocol!=="https:"||n.username!==""||n.password!==""||n.search!==""||n.hash!==""||n.pathname!=="/")throw new Error("merchant origin pattern must be a credential-free HTTPS origin");let i=t?n.hostname.replace(/^wildcard\./,""):n.hostname;if(H0t("merchant origin pattern",i),t&&!i.includes("."))throw new Error("merchant wildcard must retain a registrable parent label");return`https://${t?"*.":""}${i}${n.port===""?"":`:${n.port}`}`}function F0t(e){if(typeof e!="string"||e.length===0||e.length>1024)throw new Error("merchant path prefix must be a bounded string");if(!e.startsWith("/")||e.includes("?")||e.includes("#")||e.includes("\\"))throw new Error("merchant path prefix must be an absolute URL path");if(new URL(e,"https://policy.invalid").pathname!==e)throw new Error("merchant path prefix must be canonical");return e!=="/"&&e.endsWith("/")?e.slice(0,-1):e}function $0t(e){if(typeof e!="string"||e.length===0||e.length>2048)throw new Error("merchant target must be a bounded URL");let t;try{t=new URL(e)}catch{throw new Error("merchant target must be a valid URL")}if(t.protocol!=="https:"||t.username!==""||t.password!==""||t.hash!=="")throw new Error("merchant target must be a credential-free HTTPS URL");return H0t("merchant target",t.hostname),{origin:t.origin,path:t.pathname}}function Jcn(e){if(!aOe(e))throw new Error("merchant rule must be an object");if(cOe("merchant rule",e,["effect","originPattern","pathPrefix"]),e.effect!=="allow"&&e.effect!=="deny")throw new Error("merchant rule effect must be allow or deny");return{effect:e.effect,originPattern:V0t(e.originPattern),pathPrefix:F0t(e.pathPrefix)}}function Xcn(e,t){let r=`${e.effect}\0${e.originPattern}\0${e.pathPrefix}`,n=`${t.effect}\0${t.originPattern}\0${t.pathPrefix}`;return r<n?-1:r>n?1:0}function Yee(e){if(e.v!==el.PRODUCT_SPEND_POLICY_VERSION)throw new Error("policy.v must be 1");let t=Kee("totalMicros",e.totalMicros),r=Kee("perTransactionMicros",e.perTransactionMicros,!0),n=e.dailyMicros===void 0?void 0:Kee("dailyMicros",e.dailyMicros,!0),i=e.sessionMicros===void 0?void 0:Kee("sessionMicros",e.sessionMicros,!0);for(let[u,d]of[["perTransactionMicros",r],["dailyMicros",n],["sessionMicros",i]])if(d!==void 0&&BigInt(d)>BigInt(t))throw new Error(`${u} cannot exceed totalMicros`);let o=k0t("networks",e.networks,j0t),s=k0t("assets",e.assets,q0t);for(let u of s)if(!o.includes(u.slice(0,u.indexOf("/"))))throw new Error("each allowed asset must belong to an allowed network");if(e.merchantDefault!=="allow"&&e.merchantDefault!=="deny")throw new Error("merchantDefault must be allow or deny");if(!Array.isArray(e.merchantRules)||e.merchantRules.length>Gcn)throw new Error("merchantRules must be a bounded array");let a=e.merchantRules.map(Jcn).sort(Xcn),c=a.map(u=>JSON.stringify(u));if(new Set(c).size!==c.length)throw new Error("merchantRules must not repeat");return{v:el.PRODUCT_SPEND_POLICY_VERSION,totalMicros:t,perTransactionMicros:r,...n===void 0?{}:{dailyMicros:n},...i===void 0?{}:{sessionMicros:i},networks:o,assets:s,merchantDefault:e.merchantDefault,merchantRules:a,expiresAt:Wcn("expiresAt",e.expiresAt)}}function z0t(e){if(!aOe(e))throw new Error("owner product spend policy must be an object");if(cOe("owner product spend policy",e,["v","policyId","agentId","version","status","grantId","grantVersion","totalMicros","perTransactionMicros","dailyMicros","sessionMicros","networks","assets","merchantDefault","merchantRules","expiresAt"]),e.status!=="active"&&e.status!=="superseded"&&e.status!=="revoked")throw new Error("invalid product spend policy status");return{...Yee(e),policyId:Vv("policyId",e.policyId),agentId:Vv("agentId",e.agentId),version:Wee("version",e.version),status:e.status,grantId:Vv("grantId",e.grantId),grantVersion:Wee("grantVersion",e.grantVersion)}}function G0t(e){if(!aOe(e))throw new Error("runtime product spend attenuation must be an object");return cOe("runtime product spend attenuation",e,["v","attenuationId","agentId","runtimeId","version","ownerPolicyId","ownerPolicyVersion","supersedesAttenuationId","totalMicros","perTransactionMicros","dailyMicros","sessionMicros","networks","assets","merchantDefault","merchantRules","expiresAt"]),{...Yee(e),attenuationId:Vv("attenuationId",e.attenuationId),agentId:Vv("agentId",e.agentId),runtimeId:Vv("runtimeId",e.runtimeId),version:Wee("version",e.version),ownerPolicyId:Vv("ownerPolicyId",e.ownerPolicyId),ownerPolicyVersion:Wee("ownerPolicyVersion",e.ownerPolicyVersion),...e.supersedesAttenuationId===void 0?{}:{supersedesAttenuationId:Vv("supersedesAttenuationId",e.supersedesAttenuationId)}}}function K0t(e){return(0,Fcn.createHash)("sha256").update((0,$cn.canonicalJson)(e)).digest("base64url")}function D0t(e,t){let r=new Set(t);return e.every(n=>r.has(n))}function sOe(e){let t=e.startsWith("https://*."),r=t?`https://wildcard.${e.slice(10)}`:e,n=new URL(r);return{wildcard:t,hostname:t?n.hostname.replace(/^wildcard\./,""):n.hostname,port:n.port}}function W0t(e,t){return t.wildcard?e.endsWith(`.${t.hostname}`)&&e!==t.hostname:e===t.hostname}function Y0t(e,t){return t==="/"||e===t||e.startsWith(`${t}/`)}function Zcn(e,t){let r=new URL(t.origin),n=sOe(e.originPattern);return r.port===n.port&&W0t(r.hostname,n)&&Y0t(t.path,e.pathPrefix)}function Qcn(e,t){let r=sOe(e),n=sOe(t);return r.port!==n.port?!1:n.wildcard?r.wildcard?r.hostname===n.hostname||r.hostname.endsWith(`.${n.hostname}`):W0t(r.hostname,n):!r.wildcard&&r.hostname===n.hostname}function L0t(e,t){return Qcn(e.originPattern,t.originPattern)&&Y0t(e.pathPrefix,t.pathPrefix)}function U0t(e,t){return t===void 0?!0:e!==void 0&&BigInt(e)<=BigInt(t)}function eun(e,t){let r,n;try{r=Yee(e),n=Yee(t)}catch{return!1}if(BigInt(r.totalMicros)>BigInt(n.totalMicros)||BigInt(r.perTransactionMicros)>BigInt(n.perTransactionMicros)||!U0t(r.dailyMicros,n.dailyMicros)||!U0t(r.sessionMicros,n.sessionMicros)||Date.parse(r.expiresAt)>Date.parse(n.expiresAt)||!D0t(r.networks,n.networks)||!D0t(r.assets,n.assets))return!1;let i=r.merchantRules.filter(({effect:u})=>u==="allow"),o=n.merchantRules.filter(({effect:u})=>u==="allow");if(n.merchantDefault==="deny"&&r.merchantDefault==="allow"||n.merchantDefault==="deny"&&!i.every(u=>o.some(d=>L0t(u,d))))return!1;let s=r.merchantRules.filter(({effect:u})=>u==="deny"),a=n.merchantRules.filter(({effect:u})=>u==="deny");return!(!(r.merchantDefault==="deny"&&i.length===0)&&!a.every(u=>s.some(d=>L0t(u,d))))}function Hv(e,t){if(typeof t!="string"||!B0t.test(t))throw new Error(`${e} must be a canonical non-negative integer string`);let r=BigInt(t);if(r>9223372036854775807n)throw new Error(`${e} exceeds bigint storage`);return r}function tun(e){let t,r,n,i,o,s,a;try{if(t="policyId"in e.policy?z0t(e.policy):G0t(e.policy),r=Hv("amountMicros",e.amountMicros),r===0n)throw new Error("amountMicros must be positive");if(n=e.hardMaximumMicros===void 0?void 0:Hv("hardMaximumMicros",e.hardMaximumMicros),!j0t.test(e.network)||!q0t.test(e.asset))throw new Error("network or asset is not canonical");i=$0t(e.merchantUrl),o=Hv("totalSpentMicros",e.usage.totalSpentMicros)+Hv("totalReservedMicros",e.usage.totalReservedMicros),s=Hv("dailySpentMicros",e.usage.dailySpentMicros)+Hv("dailyReservedMicros",e.usage.dailyReservedMicros),a=Hv("sessionSpentMicros",e.usage.sessionSpentMicros)+Hv("sessionReservedMicros",e.usage.sessionReservedMicros)}catch{return{ok:!1,reason:"invalid_state"}}if("status"in t&&t.status!=="active")return{ok:!1,reason:"policy_not_active"};if(!Number.isFinite(e.nowMs))return{ok:!1,reason:"invalid_state"};if(e.nowMs>=Date.parse(t.expiresAt))return{ok:!1,reason:"policy_expired"};if(!t.networks.includes(e.network))return{ok:!1,reason:"network_not_allowed"};if(!t.assets.includes(e.asset))return{ok:!1,reason:"asset_not_allowed"};let c=t.merchantRules.filter(p=>Zcn(p,i));if(c.some(({effect:p})=>p==="deny"))return{ok:!1,reason:"merchant_denied"};if(t.merchantDefault==="deny"&&!c.some(({effect:p})=>p==="allow"))return{ok:!1,reason:"merchant_not_allowed"};if(n!==void 0&&r>n)return{ok:!1,reason:"over_hard_maximum"};if(r>BigInt(t.perTransactionMicros))return{ok:!1,reason:"over_per_transaction"};let u=BigInt(t.totalMicros)-o;if(r>u)return{ok:!1,reason:"over_total"};let d=t.dailyMicros===void 0?null:BigInt(t.dailyMicros)-s;if(d!==null&&r>d)return{ok:!1,reason:"over_daily"};let l=t.sessionMicros===void 0?null:BigInt(t.sessionMicros)-a;return l!==null&&r>l?{ok:!1,reason:"over_session"}:{ok:!0,policyHash:K0t(t),totalRemainingMicros:(u-r).toString(),dailyRemainingMicros:d===null?null:(d-r).toString(),sessionRemainingMicros:l===null?null:(l-r).toString()}}});var rgt=_(Jee=>{"use strict";Object.defineProperty(Jee,"__esModule",{value:!0});Jee.canonicalLegacyWalletSpendPolicy=tgt;Jee.importLegacyWalletSpendPolicy=dun;var X0t=uOe(),Z0t=9223372036854775807n,Q0t=/^eip155:[1-9][0-9]{0,15}$/,run=/^eip155:[1-9][0-9]{0,15}\/erc20:0x[0-9a-f]{40}$/,nun=16,iun=128;function oun(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function sun(e){let t=new Set(["perTxCapUsd","dailyCapUsd","sessionBudgetUsd","allowedNetworks","merchantAllowlist","merchantDenylist","expiresAt"]);for(let r of Object.keys(e))if(!t.has(r))throw new Error(`legacy wallet policy contains unknown key '${r}'`)}function f8(e,t){if(typeof t!="string")throw new Error(`${e} must be a USD decimal string`);let r=/^(0|[1-9][0-9]*)(?:\.([0-9]{1,6}))?$/.exec(t);if(!r)throw new Error(`${e} must be a canonical USD amount with at most 6 decimals`);let n=BigInt(`${r[1]}${(r[2]??"").padEnd(6,"0")}`);if(n>Z0t)throw new Error(`${e} exceeds bigint storage`);return n.toString()}function egt(e,t){if(typeof t!="string")throw new Error(`${e} must be an ISO timestamp`);let r=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/.exec(t);if(!r)throw new Error(`${e} must be an ISO timestamp with an explicit timezone`);let[,n,i,o,s,a,c]=r,u=Number(n),d=Number(i),l=Number(o),p=Number(s),f=Number(a),m=Number(c),h=new Date(0);if(h.setUTCFullYear(u,d-1,l),h.setUTCHours(p,f,m,0),u===0||h.getUTCFullYear()!==u||h.getUTCMonth()!==d-1||h.getUTCDate()!==l||h.getUTCHours()!==p||h.getUTCMinutes()!==f||h.getUTCSeconds()!==m)throw new Error(`${e} must contain a valid calendar instant`);let g=Date.parse(t);if(!Number.isFinite(g))throw new Error(`${e} must be an ISO timestamp`);return new Date(g).toISOString()}function aun(e){if(!Array.isArray(e)||e.length===0||e.length>nun)throw new Error("allowedNetworks must be a non-empty bounded array");let t=e.map(r=>{if(typeof r!="string"||!Q0t.test(r))throw new Error("allowedNetworks contains a non-canonical network");return r});return[...new Set(t)].sort()}function cun(e){if(typeof e!="string"||e.length===0||e.length>255)throw new Error("legacy merchant host must be a bounded string");if(e.includes("/")||e.includes("@")||e.includes("*")||e.includes(":"))throw new Error("legacy merchant host must be an exact DNS host");let t;try{t=new URL(`https://${e}`)}catch{throw new Error("legacy merchant host must be a valid DNS host")}let r=t.host.toLowerCase();if(e.toLowerCase()!==r)throw new Error("legacy merchant host must already have canonical URL spelling");return(0,X0t.canonicalMerchantOriginPattern)(`https://${r}`),r}function J0t(e,t){if(t!==void 0){if(!Array.isArray(t)||t.length>iun)throw new Error(`${e} must be a bounded array`);return[...new Set(t.map(cun))].sort()}}function tgt(e){if(!oun(e))throw new Error("legacy wallet policy must be an object");sun(e);let t=J0t("merchantAllowlist",e.merchantAllowlist),r=J0t("merchantDenylist",e.merchantDenylist);return f8("perTxCapUsd",e.perTxCapUsd),f8("dailyCapUsd",e.dailyCapUsd),f8("sessionBudgetUsd",e.sessionBudgetUsd),{perTxCapUsd:e.perTxCapUsd,dailyCapUsd:e.dailyCapUsd,sessionBudgetUsd:e.sessionBudgetUsd,allowedNetworks:aun(e.allowedNetworks),...t===void 0?{}:{merchantAllowlist:t},...r===void 0?{}:{merchantDenylist:r},...e.expiresAt===void 0?{}:{expiresAt:egt("expiresAt",e.expiresAt)}}}function dOe(e,t){if(typeof t!="string"||!/^[1-9][0-9]*$/.test(t))throw new Error(`${e} must be a positive canonical micros string`);let r=BigInt(t);if(r>Z0t)throw new Error(`${e} exceeds bigint storage`);return r.toString()}function uB(e,t){return(BigInt(e)<=BigInt(t)?BigInt(e):BigInt(t)).toString()}function uun(e){let t=(e.merchantAllowlist??[]).map(n=>({effect:"allow",originPattern:`https://${n}`,pathPrefix:"/"})),r=(e.merchantDenylist??[]).map(n=>({effect:"deny",originPattern:`https://${n}`,pathPrefix:"/"}));return[...t,...r]}function dun(e){let t=tgt(e.policy),r=dOe("grantTotalMicros",e.context.grantTotalMicros),n=dOe("grantPerTransactionMicros",e.context.grantPerTransactionMicros),i=e.context.grantDailyMicros===void 0?r:dOe("grantDailyMicros",e.context.grantDailyMicros),o=egt("grantExpiresAt",e.context.grantExpiresAt);if(!Q0t.test(e.context.walletNetwork))throw new Error("walletNetwork must be a canonical CAIP-2 identifier");if(!run.test(e.context.walletAsset)||!e.context.walletAsset.startsWith(`${e.context.walletNetwork}/`))throw new Error("walletAsset must be the canonical asset on walletNetwork");if(!t.allowedNetworks.includes(e.context.walletNetwork))throw new Error("the legacy policy does not allow the active wallet network");let s=f8("perTxCapUsd",t.perTxCapUsd),a=f8("dailyCapUsd",t.dailyCapUsd),c=f8("sessionBudgetUsd",t.sessionBudgetUsd),u=t.expiresAt?new Date(Math.min(Date.parse(t.expiresAt),Date.parse(o))).toISOString():o;return{v:X0t.PRODUCT_SPEND_POLICY_VERSION,totalMicros:r,perTransactionMicros:uB(s,uB(n,r)),dailyMicros:uB(a,uB(i,r)),sessionMicros:uB(c,r),networks:[e.context.walletNetwork],assets:[e.context.walletAsset],merchantDefault:t.merchantAllowlist===void 0?"allow":"deny",merchantRules:uun(t),expiresAt:u}}});var Fv=_(Xee=>{"use strict";Object.defineProperty(Xee,"__esModule",{value:!0});Xee.prepareRootSignedJws=lun;Xee.completeRootSignedJws=pun;var lOe=jS();function lun(e,t,r){let n=(0,lOe.bytesToBase64Url)(new TextEncoder().encode(JSON.stringify({alg:"EdDSA",kid:t,typ:e}))),i=(0,lOe.bytesToBase64Url)(new TextEncoder().encode(JSON.stringify(r)));return{signingInput:`${n}.${i}`}}function pun(e,t,r){if(!(t instanceof Uint8Array)||t.length!==64)throw new Error(`${r} signature must be exactly 64 raw Ed25519 bytes`);return`${e}.${(0,lOe.bytesToBase64Url)(t)}`}});var Zee=_(oo=>{"use strict";Object.defineProperty(oo,"__esModule",{value:!0});oo.HOSTED_RUNTIME_CERTIFICATE_PURPOSES=oo.RUNTIME_CERTIFICATE_PURPOSES=oo.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=oo.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=oo.RUNTIME_CERTIFICATE_VERSION=oo.RUNTIME_CERTIFICATE_TYP=void 0;oo.runtimeCertificateMaxTtl=ogt;oo.isCanonicalBase64Url32=fOe;oo.prepareRuntimeCertificate=bun;var ngt=jS(),igt=SW(),fun=Fv();oo.RUNTIME_CERTIFICATE_TYP="visa-agent-runtime-cert+jwt";oo.RUNTIME_CERTIFICATE_VERSION=1;oo.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=1440*60;oo.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=366*24*60*60;function ogt(e){return e.length===1&&e[0]==="card:vic"?oo.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS:oo.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS}oo.RUNTIME_CERTIFICATE_PURPOSES=["tap","subway","card:vic","wallet:x402"];oo.HOSTED_RUNTIME_CERTIFICATE_PURPOSES=["card:vic","wallet:x402","tap"];var mun=new Set(oo.RUNTIME_CERTIFICATE_PURPOSES),pOe=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,hun=/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;function fOe(e){if(typeof e!="string"||!hun.test(e))return!1;let t=(0,ngt.base64UrlToBytes)(e);return t.length===32&&(0,ngt.bytesToBase64Url)(t)===e}function gun(e){return{kty:"OKP",crv:"Ed25519",x:e.x}}function _un(e){if(!Array.isArray(e)||e.length===0)throw new Error("runtime certificate requires at least one purpose");let t=[...new Set(e)];if(t.length!==e.length||t.some(r=>!mun.has(r)))throw new Error("runtime certificate purposes must be unique supported values");return t.sort()}function yun(e,t){if(!Number.isSafeInteger(t)||t<0)throw new Error(`${e} must be a non-negative unix-seconds integer`)}function bun(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=e.ttlSeconds??oo.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS,n=ogt(e.purposes),i=e.certificateId??globalThis.crypto.randomUUID();if(yun("nowSec",t),!Number.isSafeInteger(r)||r<=0||r>n)throw new Error(`runtime certificate ttlSeconds must be in (0, ${n}]`);if(!pOe.test(e.agentId)||!pOe.test(e.runtimeId))throw new Error("runtime certificate agentId/runtimeId must be canonical UUIDs");if(!pOe.test(i))throw new Error("runtime certificate certificateId must be a canonical UUID");if(!fOe(e.rootJkt))throw new Error("runtime certificate rootJkt must be a canonical RFC 7638 thumbprint");if(!e.rootKid||e.rootKid.length>256)throw new Error("runtime certificate rootKid must be a bounded non-empty identifier");if((0,igt.computeJkt)(e.rootPublicJwk)!==e.rootJkt)throw new Error("runtime certificate signer public key does not match rootJkt");let s=gun(e.runtimePublicJwk);if(!fOe(s.x))throw new Error("runtime certificate child key must be canonical Ed25519");let a=(0,igt.computeJkt)(s);if(a===e.rootJkt)throw new Error("runtime certificate child key must differ from the identity root");let c={v:oo.RUNTIME_CERTIFICATE_VERSION,iss:e.rootJkt,sub:e.agentId,jti:i,runtimeId:e.runtimeId,cnf:{jwk:s,jkt:a},purposes:_un(e.purposes),iat:t,nbf:t,exp:t+r};return{...(0,fun.prepareRootSignedJws)(oo.RUNTIME_CERTIFICATE_TYP,e.rootKid,c),claims:c}}});var hOe=_(_h=>{"use strict";var Eun=_h&&_h.__createBinding||(Object.create?(function(e,t,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(t,r);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[r]}}),Object.defineProperty(e,n,i)}):(function(e,t,r,n){n===void 0&&(n=r),e[n]=t[r]})),Sun=_h&&_h.__exportStar||function(e,t){for(var r in e)r!=="default"&&!Object.prototype.hasOwnProperty.call(t,r)&&Eun(t,e,r)};Object.defineProperty(_h,"__esModule",{value:!0});_h.completeRuntimeCertificate=agt;_h.issueRuntimeCertificate=Aun;_h.peekRuntimeCertificate=Pun;_h.verifyRuntimeCertificate=xun;var sgt=Hu(),mOe=Ju(),vun=Fv();Sun(Zee(),_h);var By=Zee(),Tun=new Set(By.RUNTIME_CERTIFICATE_PURPOSES),dB=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;function agt(e,t){return(0,vun.completeRootSignedJws)(e.signingInput,t,"runtime certificate")}async function Aun(e){let t=(0,By.prepareRuntimeCertificate)({rootKid:e.signer.kid,rootPublicJwk:e.signer.publicJwk,rootJkt:e.rootJkt,agentId:e.agentId,runtimeId:e.runtimeId,runtimePublicJwk:e.runtimePublicJwk,purposes:e.purposes,...e.ttlSeconds===void 0?{}:{ttlSeconds:e.ttlSeconds},...e.nowSec===void 0?{}:{nowSec:e.nowSec},...e.certificateId===void 0?{}:{certificateId:e.certificateId}}),r=await e.signer.sign(new TextEncoder().encode(t.signingInput));return agt(t,r)}function wun(e){if(typeof e!="object"||e===null||Array.isArray(e))return!1;let t=e;return Object.keys(t).length===3&&t.kty==="OKP"&&t.crv==="Ed25519"&&(0,By.isCanonicalBase64Url32)(t.x)}function Iun(e){return Array.isArray(e)&&e.length>0&&e.every(t=>typeof t=="string"?Tun.has(t):!1)&&new Set(e).size===e.length&&[...e].sort().every((t,r)=>t===e[r])}function Pun(e){let t=(0,mOe.decodeJwt)(e);return!t||t.header.typ!==By.RUNTIME_CERTIFICATE_TYP||typeof t.claims.sub!="string"||!dB.test(t.claims.sub)||typeof t.claims.iss!="string"||!(0,By.isCanonicalBase64Url32)(t.claims.iss)||typeof t.claims.runtimeId!="string"||!dB.test(t.claims.runtimeId)||typeof t.claims.jti!="string"||!dB.test(t.claims.jti)?null:{agentId:t.claims.sub,rootJkt:t.claims.iss,runtimeId:t.claims.runtimeId,certificateId:t.claims.jti}}async function xun(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)return{ok:!1,reason:"bad_verification_time"};let r=await(0,mOe.verifyJwtSignature)(e,t.jwks);if(!r.ok)return r;if(r.header.typ!==By.RUNTIME_CERTIFICATE_TYP)return{ok:!1,reason:"typ_mismatch"};let n=r.claims;if(n.v!==By.RUNTIME_CERTIFICATE_VERSION||n.iss!==t.expectedRootJkt||n.sub!==t.expectedAgentId||typeof n.jti!="string"||!dB.test(n.jti)||typeof n.runtimeId!="string"||!dB.test(n.runtimeId))return{ok:!1,reason:"claims_mismatch"};if(r.header.kid===void 0)return{ok:!1,reason:"kid_missing"};let i=t.jwks.keys.find(a=>a.kid===r.header.kid);if(!i||(0,sgt.computeJkt)(i)!==t.expectedRootJkt)return{ok:!1,reason:"root_key_mismatch"};if(t.expectedRuntimeId!==void 0&&n.runtimeId!==t.expectedRuntimeId)return{ok:!1,reason:"runtime_mismatch"};if(t.expectedCertificateId!==void 0&&n.jti!==t.expectedCertificateId)return{ok:!1,reason:"certificate_mismatch"};if(!n.cnf||!wun(n.cnf.jwk)||!(0,By.isCanonicalBase64Url32)(n.cnf.jkt))return{ok:!1,reason:"bad_cnf_key"};let o=(0,sgt.computeJkt)(n.cnf.jwk);if(n.cnf.jkt!==o||o!==t.expectedRuntimeJkt)return{ok:!1,reason:"runtime_key_mismatch"};if(!Iun(n.purposes)||!n.purposes.includes(t.requiredPurpose))return{ok:!1,reason:"purpose_denied"};let s=(0,mOe.temporalReason)(n,t.nowSec);return s?{ok:!1,reason:s}:typeof n.nbf!="number"||!Number.isSafeInteger(n.nbf)||n.nbf>t.nowSec||n.nbf!==n.iat?{ok:!1,reason:"not_yet_valid"}:typeof n.iat!="number"||typeof n.exp!="number"||!Number.isSafeInteger(n.iat)||!Number.isSafeInteger(n.exp)||n.exp-n.iat>(0,By.runtimeCertificateMaxTtl)(n.purposes)?{ok:!1,reason:"ttl_exceeded"}:{ok:!0,claims:n,rootJkt:t.expectedRootJkt,runtimeJkt:o}}});var CI=_(tl=>{"use strict";Object.defineProperty(tl,"__esModule",{value:!0});tl.WALLET_BINDING_TYP=tl.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS=tl.RUNTIME_LEASE_MAX_TTL_SECONDS=tl.RUNTIME_DELEGATION_MAX_TTL_SECONDS=tl.RUNTIME_LEASE_SIGNING_MODES=tl.RUNTIME_DELEGATION_TYP=void 0;tl.RUNTIME_DELEGATION_TYP="visa-agent-runtime-delegation+jwt";tl.RUNTIME_LEASE_SIGNING_MODES=["eip3009:exact","permit2:upto"];tl.RUNTIME_DELEGATION_MAX_TTL_SECONDS=366*24*60*60;tl.RUNTIME_LEASE_MAX_TTL_SECONDS=300;tl.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS=30;tl.WALLET_BINDING_TYP="visa-agent-wallet-binding+jwt"});var ite=_(ar=>{"use strict";Object.defineProperty(ar,"__esModule",{value:!0});ar.RUNTIME_LEASE_PURPOSE=ar.RUNTIME_LEASE_AUDIENCE=ar.RUNTIME_LEASE_VERSION=ar.RUNTIME_LEASE_TYP=ar.RUNTIME_DELEGATION_VERSION=ar.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS=ar.RUNTIME_LEASE_MAX_TTL_SECONDS=ar.RUNTIME_DELEGATION_MAX_TTL_SECONDS=ar.RUNTIME_LEASE_SIGNING_MODES=ar.RUNTIME_DELEGATION_TYP=void 0;ar.prepareRuntimeDelegation=lgt;ar.completeRuntimeDelegation=pgt;ar.issueRuntimeDelegation=Nun;ar.issueRuntimeLease=kun;ar.verifyRuntimeDelegation=bOe;ar.verifyRuntimeLeaseChain=Bun;var gOe=require("node:crypto"),tte=Hu(),cgt=Ju(),rte=Fv(),pB=CI();Object.defineProperty(ar,"RUNTIME_DELEGATION_TYP",{enumerable:!0,get:function(){return pB.RUNTIME_DELEGATION_TYP}});Object.defineProperty(ar,"RUNTIME_LEASE_SIGNING_MODES",{enumerable:!0,get:function(){return pB.RUNTIME_LEASE_SIGNING_MODES}});Object.defineProperty(ar,"RUNTIME_DELEGATION_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return pB.RUNTIME_DELEGATION_MAX_TTL_SECONDS}});Object.defineProperty(ar,"RUNTIME_LEASE_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return pB.RUNTIME_LEASE_MAX_TTL_SECONDS}});Object.defineProperty(ar,"RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS",{enumerable:!0,get:function(){return pB.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS}});var _c=CI();ar.RUNTIME_DELEGATION_VERSION=1;ar.RUNTIME_LEASE_TYP="visa-agent-runtime-lease+jwt";ar.RUNTIME_LEASE_VERSION=1;ar.RUNTIME_LEASE_AUDIENCE="urn:visa:tvc:slipgate";ar.RUNTIME_LEASE_PURPOSE="wallet:x402";var MI=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,Oun=/^[A-Za-z0-9_-]{43}$/,_Oe=/^eip155:[1-9][0-9]{0,15}$/,lB=/^[A-Za-z0-9._:@/-]{1,256}$/,Qee=new Map(_c.RUNTIME_LEASE_SIGNING_MODES.map((e,t)=>[e,t]));function rl(e){if(typeof e!="string"||!Oun.test(e))return!1;let t=Buffer.from(e,"base64url");return t.length===32&&t.toString("base64url")===e}function Run(e){let t=e.toLowerCase();if(!_Oe.test(t))throw new Error("runtime authority network is invalid");return t}function $v(e,t){if(!MI.test(t))throw new Error(`${e} must be a canonical UUID`)}function ugt(e,t){if(!lB.test(t))throw new Error(`${e} must be a bounded identifier`)}function ete(e,t){if(!Number.isSafeInteger(t)||t<0)throw new Error(`${e} must be a non-negative unix-seconds integer`)}function nte(e){if(!Array.isArray(e)||e.length===0)throw new Error("runtime authority requires at least one signing mode");let t=[...new Set(e)];if(t.length!==e.length||t.some(r=>!Qee.has(r)))throw new Error("runtime authority signing modes must be unique supported values");return t.sort((r,n)=>Qee.get(r)-Qee.get(n))}function yOe(e,t){let r=Object.keys(e).sort(),n=[...t].sort();return r.length===n.length&&r.every((i,o)=>i===n[o])}function dgt(e){if(!Array.isArray(e)||e.length===0||e.some(r=>typeof r!="string"||!Qee.has(r)))return!1;let t=e;return new Set(t).size===t.length&&nte(t).every((r,n)=>r===t[n])}function lgt(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=e.ttlSeconds??_c.RUNTIME_DELEGATION_MAX_TTL_SECONDS,n=e.maxLeaseTtlSeconds??_c.RUNTIME_LEASE_MAX_TTL_SECONDS,i=e.delegationId??(0,gOe.randomUUID)();if(ete("nowSec",t),!Number.isSafeInteger(r)||r<=0||r>_c.RUNTIME_DELEGATION_MAX_TTL_SECONDS)throw new Error(`runtime delegation ttlSeconds must be in (0, ${_c.RUNTIME_DELEGATION_MAX_TTL_SECONDS}]`);if(!Number.isSafeInteger(n)||n<=0||n>_c.RUNTIME_LEASE_MAX_TTL_SECONDS)throw new Error(`runtime delegation maxLeaseTtlSeconds must be in (0, ${_c.RUNTIME_LEASE_MAX_TTL_SECONDS}]`);if($v("agentId",e.agentId),$v("runtimeId",e.runtimeId),$v("delegationId",i),ugt("rootKid",e.rootKid),!rl(e.rootJkt)||(0,tte.computeJkt)(e.rootPublicJwk)!==e.rootJkt)throw new Error("runtime delegation root public key does not match rootJkt");if(!rl(e.runtimeJkt)||!rl(e.leaseIssuerJkt))throw new Error("runtime delegation runtime/issuer JKT is invalid");if(new Set([e.rootJkt,e.runtimeJkt,e.leaseIssuerJkt]).size!==3)throw new Error("runtime delegation root, runtime, and issuer keys must be distinct");let o=t+r;ete("runtime delegation expiration",o);let s={v:ar.RUNTIME_DELEGATION_VERSION,iss:e.rootJkt,sub:e.agentId,jti:i,runtimeId:e.runtimeId,runtimeJkt:e.runtimeJkt,leaseIssuerJkt:e.leaseIssuerJkt,purpose:ar.RUNTIME_LEASE_PURPOSE,network:Run(e.network),signingModes:nte(e.signingModes),maxLeaseTtlSeconds:n,iat:t,nbf:t,exp:o};return{...(0,rte.prepareRootSignedJws)(_c.RUNTIME_DELEGATION_TYP,e.rootKid,s),claims:s}}function pgt(e,t){return(0,rte.completeRootSignedJws)(e.signingInput,t,"runtime delegation")}async function Nun(e){let t=lgt({...e,rootKid:e.signer.kid,rootPublicJwk:e.signer.publicJwk}),r=await e.signer.sign(new TextEncoder().encode(t.signingInput));return pgt(t,r)}function Cun(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=e.ttlSeconds??e.delegation.maxLeaseTtlSeconds,n=t+r,i=e.leaseId??(0,gOe.randomUUID)();if(ete("nowSec",t),ete("delegationExpiresAt",e.delegation.exp),!Number.isSafeInteger(e.delegation.maxLeaseTtlSeconds)||e.delegation.maxLeaseTtlSeconds<=0||e.delegation.maxLeaseTtlSeconds>_c.RUNTIME_LEASE_MAX_TTL_SECONDS)throw new Error("runtime lease maximum TTL is invalid");if(!Number.isSafeInteger(r)||r<=0||r>e.delegation.maxLeaseTtlSeconds||!Number.isSafeInteger(n)||n>e.delegation.exp)throw new Error("runtime lease TTL exceeds its delegation");if($v("agentId",e.delegation.sub),$v("runtimeId",e.delegation.runtimeId),$v("delegationId",e.delegation.jti),$v("leaseId",i),$v("grantId",e.grantId),ugt("issuerKid",e.issuerKid),!rl(e.delegation.leaseIssuerJkt)||(0,tte.computeJkt)(e.issuerPublicJwk)!==e.delegation.leaseIssuerJkt)throw new Error("runtime lease issuer public key does not match leaseIssuerJkt");if(!rl(e.delegation.iss)||!rl(e.delegation.runtimeJkt))throw new Error("runtime lease root/runtime JKT is invalid");if(new Set([e.delegation.iss,e.delegation.runtimeJkt,e.delegation.leaseIssuerJkt]).size!==3)throw new Error("runtime lease root, runtime, and issuer keys must be distinct");if(!Number.isSafeInteger(e.generation)||e.generation<1)throw new Error("runtime lease generation must be a positive safe integer");if(!Number.isSafeInteger(e.grantVersion)||e.grantVersion<1)throw new Error("runtime lease grantVersion must be a positive safe integer");if(!rl(e.delegationHash))throw new Error("runtime lease delegationHash is invalid");let o=nte(e.signingModes);if(!o.every(a=>e.delegation.signingModes.includes(a)))throw new Error("runtime lease signing modes exceed the verified delegation");let s={v:ar.RUNTIME_LEASE_VERSION,iss:e.delegation.leaseIssuerJkt,sub:e.delegation.sub,aud:ar.RUNTIME_LEASE_AUDIENCE,jti:i,delegationId:e.delegation.jti,delegationHash:e.delegationHash,rootJkt:e.delegation.iss,runtimeId:e.delegation.runtimeId,runtimeJkt:e.delegation.runtimeJkt,purpose:ar.RUNTIME_LEASE_PURPOSE,network:e.delegation.network,signingModes:o,generation:e.generation,grantId:e.grantId,grantVersion:e.grantVersion,iat:t,nbf:t,exp:n};return{...(0,rte.prepareRootSignedJws)(ar.RUNTIME_LEASE_TYP,e.issuerKid,s),claims:s}}function Mun(e,t){return(0,rte.completeRootSignedJws)(e.signingInput,t,"runtime lease")}async function kun(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=await bOe(e.delegationToken,{...e.delegationVerification,nowSec:t});if(!r.ok)throw new Error(`runtime lease delegation refused: ${r.reason}`);let n=Cun({delegation:r.delegation,delegationHash:fgt(e.delegationToken),signingModes:e.signingModes,generation:e.generation,grantId:e.grantId,grantVersion:e.grantVersion,ttlSeconds:e.ttlSeconds,nowSec:t,leaseId:e.leaseId,issuerKid:e.signer.kid,issuerPublicJwk:e.signer.publicJwk}),i=await e.signer.sign(new TextEncoder().encode(n.signingInput));return Mun(n,i)}var Dun=["v","iss","sub","jti","runtimeId","runtimeJkt","leaseIssuerJkt","purpose","network","signingModes","maxLeaseTtlSeconds","iat","nbf","exp"],Lun=["v","iss","sub","aud","jti","delegationId","delegationHash","rootJkt","runtimeId","runtimeJkt","purpose","network","signingModes","generation","grantId","grantVersion","iat","nbf","exp"],Uun=["alg","kid","typ"];function fgt(e){return(0,gOe.createHash)("sha256").update(e,"utf8").digest("base64url")}function mgt(e){try{let t=Buffer.from(e,"base64url");if(t.toString("base64url")!==e)return null;let r=new TextDecoder("utf-8",{fatal:!0}).decode(t),n=JSON.parse(r);return typeof n!="object"||n===null||Array.isArray(n)||JSON.stringify(n)!==r?null:n}catch{return null}}function hgt(e){let t=e.split(".");return t.length===3&&mgt(t[1])!==null}function ggt(e){let t=e.split(".");if(t.length!==3)return!1;let r=mgt(t[0]),n=Buffer.from(t[2],"base64url");return r!==null&&n.length===64&&n.toString("base64url")===t[2]&&yOe(r,Uun)&&typeof r.alg=="string"&&typeof r.kid=="string"&&lB.test(r.kid)}function _gt(e,t,r){return typeof e.iat!="number"||typeof e.nbf!="number"||typeof e.exp!="number"||!Number.isSafeInteger(e.iat)||!Number.isSafeInteger(e.nbf)||!Number.isSafeInteger(e.exp)||e.iat<0||e.nbf!==e.iat||e.exp<=e.iat||e.exp-e.iat>r?"ttl_exceeded":e.iat>t+_c.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS||e.nbf>t+_c.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS?"not_yet_valid":t>=e.exp?"expired":null}async function bOe(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0||t.nowSec>Number.MAX_SAFE_INTEGER-_c.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS||!lB.test(t.expectedRootKid))return{ok:!1,reason:"bad_verification_context"};if(!ggt(e))return{ok:!1,reason:"delegation_header_invalid"};if(!hgt(e))return{ok:!1,reason:"delegation_shape_invalid"};let r=await(0,cgt.verifyJwtSignature)(e,t.ownerJwks);if(!r.ok)return r;if(r.header.typ!==_c.RUNTIME_DELEGATION_TYP)return{ok:!1,reason:"delegation_typ_mismatch"};let n=r.claims;if(!yOe(n,Dun))return{ok:!1,reason:"delegation_shape_invalid"};let i=t.ownerJwks.keys.find(s=>s.kid===t.expectedRootKid);if(r.header.kid!==t.expectedRootKid||!i||(0,tte.computeJkt)(i)!==t.expectedRootJkt)return{ok:!1,reason:"root_key_mismatch"};if(n.v!==ar.RUNTIME_DELEGATION_VERSION||n.iss!==t.expectedRootJkt||n.sub!==t.expectedAgentId||n.jti!==t.expectedDelegationId||n.runtimeId!==t.expectedRuntimeId||n.runtimeJkt!==t.expectedRuntimeJkt||n.leaseIssuerJkt!==t.expectedLeaseIssuerJkt||n.purpose!==ar.RUNTIME_LEASE_PURPOSE||n.network!==t.expectedNetwork.toLowerCase()||!MI.test(n.jti??"")||!MI.test(n.runtimeId??"")||!rl(n.iss)||!rl(n.runtimeJkt)||!rl(n.leaseIssuerJkt)||new Set([n.iss,n.runtimeJkt,n.leaseIssuerJkt]).size!==3||!_Oe.test(n.network??"")||!dgt(n.signingModes)||!Number.isSafeInteger(n.maxLeaseTtlSeconds)||n.maxLeaseTtlSeconds<=0||n.maxLeaseTtlSeconds>_c.RUNTIME_LEASE_MAX_TTL_SECONDS)return{ok:!1,reason:"delegation_claims_mismatch"};let o=_gt(n,t.nowSec,_c.RUNTIME_DELEGATION_MAX_TTL_SECONDS);return o?{ok:!1,reason:`delegation_${o}`}:{ok:!0,delegation:n}}async function Bun(e,t,r){if(!Number.isSafeInteger(r.nowSec)||r.nowSec<0||r.nowSec>Number.MAX_SAFE_INTEGER-_c.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS||!Number.isSafeInteger(r.expectedGeneration)||r.expectedGeneration<1||!Number.isSafeInteger(r.expectedGrantVersion)||r.expectedGrantVersion<1||!lB.test(r.expectedRootKid)||!lB.test(r.expectedLeaseIssuerKid))return{ok:!1,reason:"bad_verification_context"};let n;try{n=nte(r.allowedSigningModes)}catch{return{ok:!1,reason:"bad_verification_context"}}if(!n.includes(r.requiredSigningMode))return{ok:!1,reason:"current_policy_denied"};let i=await bOe(e,r);if(!i.ok)return i;let o=i.delegation;if(!ggt(t))return{ok:!1,reason:"lease_header_invalid"};if(!hgt(t))return{ok:!1,reason:"lease_shape_invalid"};let s=await(0,cgt.verifyJwtSignature)(t,r.issuerJwks);if(!s.ok)return s;if(s.header.typ!==ar.RUNTIME_LEASE_TYP)return{ok:!1,reason:"lease_typ_mismatch"};let a=s.claims;if(!yOe(a,Lun))return{ok:!1,reason:"lease_shape_invalid"};let c=r.issuerJwks.keys.find(d=>d.kid===r.expectedLeaseIssuerKid);if(s.header.kid!==r.expectedLeaseIssuerKid||!c||(0,tte.computeJkt)(c)!==r.expectedLeaseIssuerJkt)return{ok:!1,reason:"lease_issuer_mismatch"};if(a.v!==ar.RUNTIME_LEASE_VERSION||a.iss!==r.expectedLeaseIssuerJkt||a.sub!==r.expectedAgentId||a.aud!==ar.RUNTIME_LEASE_AUDIENCE||a.delegationId!==r.expectedDelegationId||a.delegationHash!==fgt(e)||a.rootJkt!==r.expectedRootJkt||a.runtimeId!==r.expectedRuntimeId||a.runtimeJkt!==r.expectedRuntimeJkt||a.purpose!==ar.RUNTIME_LEASE_PURPOSE||a.network!==r.expectedNetwork.toLowerCase()||a.generation!==r.expectedGeneration||a.grantId!==r.expectedGrantId||a.grantVersion!==r.expectedGrantVersion||!MI.test(a.jti??"")||!MI.test(a.delegationId??"")||!rl(a.delegationHash)||!MI.test(a.runtimeId??"")||!MI.test(a.grantId??"")||!rl(a.iss)||!rl(a.rootJkt)||!rl(a.runtimeJkt)||new Set([a.iss,a.rootJkt,a.runtimeJkt]).size!==3||!_Oe.test(a.network??"")||!dgt(a.signingModes)||!Number.isSafeInteger(a.generation)||a.generation<1||!Number.isSafeInteger(a.grantVersion)||a.grantVersion<1)return{ok:!1,reason:"lease_claims_mismatch"};let u=_gt(a,r.nowSec,Math.min(o.maxLeaseTtlSeconds,_c.RUNTIME_LEASE_MAX_TTL_SECONDS));return u?{ok:!1,reason:`lease_${u}`}:a.iat<o.iat||a.exp>o.exp||!a.signingModes.every(d=>o.signingModes.includes(d))||!a.signingModes.every(d=>n.includes(d))||!o.signingModes.includes(r.requiredSigningMode)||!a.signingModes.includes(r.requiredSigningMode)?{ok:!1,reason:"lease_scope_exceeded"}:{ok:!0,delegation:o,lease:a}}});var SOe=_(Hf=>{"use strict";Object.defineProperty(Hf,"__esModule",{value:!0});Hf.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS=Hf.RUNTIME_LEASE_REQUEST_AUDIENCE=Hf.RUNTIME_LEASE_REQUEST_VERSION=void 0;Hf.runtimeLeaseRequestIntentHash=ygt;Hf.createRuntimeLeaseRequestProofWithSigner=Gun;var jun=_W(),qun=jS(),Hun=Lee(),Vun=CI();Hf.RUNTIME_LEASE_REQUEST_VERSION=1;Hf.RUNTIME_LEASE_REQUEST_AUDIENCE="visa-runtime-lease-requests:v1";Hf.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS=60;var Fun=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,$un=new Set(Vun.RUNTIME_LEASE_SIGNING_MODES);function EOe(e,t){if(!Fun.test(t))throw new Error(`${e} must be a canonical UUID`)}function zun(e){if(EOe("agentId",e.agentId),EOe("runtimeId",e.runtimeId),EOe("requestId",e.requestId),!$un.has(e.signingMode))throw new Error("runtime lease request signingMode is unsupported");return{v:Hf.RUNTIME_LEASE_REQUEST_VERSION,agentId:e.agentId,runtimeId:e.runtimeId,requestId:e.requestId,signingMode:e.signingMode}}function ygt(e){return(0,qun.bytesToBase64Url)((0,jun.sha256)(new TextEncoder().encode(JSON.stringify(zun(e)))))}function Gun(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)throw new Error("runtime lease request nowSec must be a non-negative safe integer");return(0,Hun.createPopProofWithSigner)(e,{nonce:t.requestId,audience:Hf.RUNTIME_LEASE_REQUEST_AUDIENCE,nowSec:t.nowSec,intentHash:ygt(t)})}});var Egt=_(jy=>{"use strict";var Kun=jy&&jy.__createBinding||(Object.create?(function(e,t,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(t,r);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[r]}}),Object.defineProperty(e,n,i)}):(function(e,t,r,n){n===void 0&&(n=r),e[n]=t[r]})),Wun=jy&&jy.__exportStar||function(e,t){for(var r in e)r!=="default"&&!Object.prototype.hasOwnProperty.call(t,r)&&Kun(t,e,r)};Object.defineProperty(jy,"__esModule",{value:!0});jy.createRuntimeLeaseRequestProof=Jun;jy.verifyRuntimeLeaseRequestProof=Xun;var bgt=Dy();Wun(SOe(),jy);var m8=SOe(),Yun=/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;function Jun(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)throw new Error("runtime lease request nowSec must be a non-negative safe integer");return"createLeaseProof"in e&&e.createLeaseProof?((0,m8.runtimeLeaseRequestIntentHash)(t),e.createLeaseProof(t)):(0,bgt.createAgentOperationPopProof)(e,{operationId:t.requestId,audience:m8.RUNTIME_LEASE_REQUEST_AUDIENCE,nowSec:t.nowSec,intentHash:(0,m8.runtimeLeaseRequestIntentHash)(t)})}async function Xun(e,t){if(!Yun.test(t.expectedRuntimeJkt))return{ok:!1,reason:"runtime_jkt_invalid"};if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)return{ok:!1,reason:"verification_time_invalid"};let r;try{r=(0,m8.runtimeLeaseRequestIntentHash)(t)}catch{return{ok:!1,reason:"request_invalid"}}let n=await(0,bgt.verifyAgentOperationPopProof)(e,{operationId:t.requestId,audience:m8.RUNTIME_LEASE_REQUEST_AUDIENCE,nowSec:t.nowSec,expectedIntentHash:r,maxAgeSec:m8.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS});return n.ok?n.runtimeCertificate!==void 0?{ok:!1,reason:"unexpected_runtime_certificate"}:n.jkt!==t.expectedRuntimeJkt?{ok:!1,reason:"runtime_jkt_mismatch"}:{ok:!0,runtimeJkt:n.jkt,requestId:t.requestId}:n}});var Tgt=_(kI=>{"use strict";Object.defineProperty(kI,"__esModule",{value:!0});kI.TAP_RUNTIME_SIGNATURE_DOMAIN=void 0;kI.tapRuntimeSigningMessage=vgt;kI.verifyTapRuntimeSignature=edn;var Sgt=require("node:crypto"),Zun=hOe();kI.TAP_RUNTIME_SIGNATURE_DOMAIN="visa:tap:runtime-signature:v1";function vgt(e){if(!(e instanceof Uint8Array))throw new Error("TAP message must be bytes");let t=Buffer.from(kI.TAP_RUNTIME_SIGNATURE_DOMAIN,"utf8"),r=Buffer.alloc(8);return r.writeBigUInt64BE(BigInt(e.byteLength)),Buffer.concat([t,Buffer.from([0]),r,Buffer.from(e)])}function Qun(e){if(typeof e!="string"||e.length!==86)return null;try{let t=Buffer.from(e,"base64url");return t.length!==64||t.toString("base64url")!==e?null:t}catch{return null}}async function edn(e){if(!(e.message instanceof Uint8Array))return{ok:!1,reason:"malformed_message"};let t=Qun(e.signature);if(!t)return{ok:!1,reason:"malformed_signature"};let r=await(0,Zun.verifyRuntimeCertificate)(e.runtimeCertificate,{jwks:e.rootJwks,expectedAgentId:e.expectedAgentId,expectedRootJkt:e.expectedRootJkt,expectedRuntimeId:e.expectedRuntimeId,expectedRuntimeJkt:e.expectedRuntimeJkt,requiredPurpose:"tap",nowSec:e.nowSec});if(!r.ok)return{ok:!1,reason:`certificate_${r.reason}`};if(r.claims.purposes.length!==1||r.claims.purposes[0]!=="tap")return{ok:!1,reason:"certificate_purpose_not_singleton"};if(e.revokedCertificateIds?.has(r.claims.jti))return{ok:!1,reason:"certificate_revoked"};let n=!1;try{let i=(0,Sgt.createPublicKey)({key:r.claims.cnf.jwk,format:"jwk"});n=(0,Sgt.verify)(null,vgt(e.message),i,t)}catch{return{ok:!1,reason:"runtime_key_invalid"}}return n?{ok:!0,claims:r.claims,agentId:r.claims.sub,rootJkt:r.rootJkt,runtimeId:r.claims.runtimeId,runtimeJkt:r.runtimeJkt}:{ok:!1,reason:"invalid_signature"}}});var kgt=_(On=>{"use strict";Object.defineProperty(On,"__esModule",{value:!0});On.WALLET_BINDING_MAX_TTL_SECONDS=On.WALLET_BINDING_DERIVATION_VERSION=On.WALLET_BINDING_SIGNER_KIND=On.WALLET_BINDING_VERSION=On.WALLET_BINDING_TYP=void 0;On.prepareWalletBinding=Cgt;On.completeWalletBinding=Mgt;On.issueWalletBinding=odn;On.verifyWalletBinding=sdn;var tdn=require("node:crypto"),TOe=Y4(),wgt=Hu(),Agt=Ju(),Igt=Fv(),rdn=CI();Object.defineProperty(On,"WALLET_BINDING_TYP",{enumerable:!0,get:function(){return rdn.WALLET_BINDING_TYP}});var Pgt=CI();On.WALLET_BINDING_VERSION=2;On.WALLET_BINDING_SIGNER_KIND="turnkey_tvc_p256";On.WALLET_BINDING_DERIVATION_VERSION="visa-tvc-slipgate-v2";On.WALLET_BINDING_MAX_TTL_SECONDS=366*24*60*60;var AOe=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,ndn=/^[A-Za-z0-9_-]{43}$/,xgt=/^0x[0-9a-f]{40}$/,Ogt=/^eip155:[1-9][0-9]{0,15}$/,Rgt=/^(02|03)[0-9a-f]{64}$/;function Ngt(e){if(typeof e!="string"||!ndn.test(e))return!1;let t=Buffer.from(e,"base64url");return t.length===32&&t.toString("base64url")===e}function vOe(e,t){if(!(0,TOe.isCanonicalOpaqueId)(t))throw new Error(`${e} must be a bounded opaque identifier`)}function idn(e,t){if(!Number.isSafeInteger(t)||t<0)throw new Error(`${e} must be a non-negative unix-seconds integer`)}function Cgt(e){let t=e.nowSec??Math.floor(Date.now()/1e3),r=e.ttlSeconds??On.WALLET_BINDING_MAX_TTL_SECONDS,n=e.bindingId??(0,tdn.randomUUID)();if(idn("nowSec",t),!Number.isSafeInteger(r)||r<=0||r>On.WALLET_BINDING_MAX_TTL_SECONDS)throw new Error(`wallet binding ttlSeconds must be in (0, ${On.WALLET_BINDING_MAX_TTL_SECONDS}]`);if(!AOe.test(e.agentId)||!AOe.test(n))throw new Error("wallet binding agentId/bindingId must be canonical UUIDs");if(!Ngt(e.rootJkt)||(0,wgt.computeJkt)(e.rootPublicJwk)!==e.rootJkt)throw new Error("wallet binding root public key does not match rootJkt");vOe("rootKid",e.rootKid),vOe("subOrganizationId",e.subOrganizationId),vOe("walletId",e.walletId);let i=e.walletAddress.toLowerCase(),o=e.network.toLowerCase(),s=e.executor.publicKey.toLowerCase();if(!xgt.test(i))throw new Error("wallet binding address is invalid");if(!Ogt.test(o))throw new Error("wallet binding network is invalid");if(e.executor.kind!==On.WALLET_BINDING_SIGNER_KIND||e.executor.derivationVersion!==On.WALLET_BINDING_DERIVATION_VERSION||!Rgt.test(s))throw new Error("wallet binding signer descriptor is unsupported or invalid");let a={v:On.WALLET_BINDING_VERSION,iss:e.rootJkt,sub:e.agentId,jti:n,subOrganizationId:e.subOrganizationId,walletId:e.walletId,walletAddress:i,network:o,executor:{kind:On.WALLET_BINDING_SIGNER_KIND,publicKey:s,derivationVersion:On.WALLET_BINDING_DERIVATION_VERSION},iat:t,nbf:t,exp:t+r};return{...(0,Igt.prepareRootSignedJws)(Pgt.WALLET_BINDING_TYP,e.rootKid,a),claims:a}}function Mgt(e,t){return(0,Igt.completeRootSignedJws)(e.signingInput,t,"wallet binding")}async function odn(e){let t=Cgt({...e,rootKid:e.signer.kid,rootPublicJwk:e.signer.publicJwk});return Mgt(t,await e.signer.sign(new TextEncoder().encode(t.signingInput)))}async function sdn(e,t){if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)return{ok:!1,reason:"bad_verification_time"};let r=await(0,Agt.verifyJwtSignature)(e,t.jwks);if(!r.ok)return r;if(r.header.typ!==Pgt.WALLET_BINDING_TYP)return{ok:!1,reason:"typ_mismatch"};let n=r.claims,i=t.expectedWalletAddress.toLowerCase(),o=t.expectedNetwork.toLowerCase(),s=t.expectedExecutor;if(n.v!==On.WALLET_BINDING_VERSION||n.iss!==t.expectedRootJkt||n.sub!==t.expectedAgentId||typeof n.jti!="string"||!AOe.test(n.jti)||n.subOrganizationId!==t.expectedSubOrganizationId||n.walletId!==t.expectedWalletId||n.walletAddress!==i||n.network!==o||typeof n.executor!="object"||n.executor===null||n.executor.kind!==On.WALLET_BINDING_SIGNER_KIND||typeof n.executor.publicKey!="string"||!Rgt.test(n.executor.publicKey)||n.executor.derivationVersion!==On.WALLET_BINDING_DERIVATION_VERSION||s!==void 0&&(n.executor.kind!==s.kind||n.executor.publicKey!==s.publicKey.toLowerCase()||n.executor.derivationVersion!==s.derivationVersion))return{ok:!1,reason:"claims_mismatch"};if(!(0,TOe.isCanonicalOpaqueId)(n.subOrganizationId)||!(0,TOe.isCanonicalOpaqueId)(n.walletId))return{ok:!1,reason:"identifier_invalid"};if(!Ngt(n.iss)||!xgt.test(n.walletAddress))return{ok:!1,reason:"binding_invalid"};if(!Ogt.test(n.network)||r.header.kid===void 0)return{ok:!1,reason:"binding_invalid"};let a=t.jwks.keys.find(u=>u.kid===r.header.kid);if(!a||(0,wgt.computeJkt)(a)!==t.expectedRootJkt)return{ok:!1,reason:"root_key_mismatch"};let c=(0,Agt.temporalReason)(n,t.nowSec);return c?{ok:!1,reason:c}:typeof n.iat!="number"||typeof n.nbf!="number"||typeof n.exp!="number"||!Number.isSafeInteger(n.iat)||!Number.isSafeInteger(n.nbf)||!Number.isSafeInteger(n.exp)||n.nbf!==n.iat||n.nbf>t.nowSec||n.exp-n.iat>On.WALLET_BINDING_MAX_TTL_SECONDS?{ok:!1,reason:"ttl_exceeded"}:{ok:!0,claims:n}}});var Dgt=_(h8=>{"use strict";Object.defineProperty(h8,"__esModule",{value:!0});h8.INTENT_HASH_VERSION=void 0;h8.canonicalIntentHash=ddn;var adn=require("node:crypto"),cdn=new Set(["USD","EUR","GBP","CAD","AUD","JPY","CHF","CNY","HKD","SGD","INR","MXN","BRL","NZD","SEK","NOK","DKK","ZAR","AED"]);h8.INTENT_HASH_VERSION=1;var udn=/^[A-Za-z0-9_-]{1,128}$/;function ddn(e){let{amount:t,currency:r,payee:n,intentId:i,settlementHash:o}=e;if(!Number.isSafeInteger(t)||t<=0)throw new Error(`intent.amount must be a positive safe integer in minor units (cents); got ${String(t)}`);let s=typeof r=="string"?r.toUpperCase():"";if(!cdn.has(s))throw new Error(`intent.currency must be a supported ISO 4217 code; got ${JSON.stringify(r)}`);if(typeof n!="string"||n.length===0)throw new Error("intent.payee must be a non-empty string");if(i!==void 0&&(typeof i!="string"||i.length===0))throw new Error("intent.intentId, when present, must be a non-empty string");if(o!==void 0&&!udn.test(o))throw new Error("intent.settlementHash, when present, must be a base64url token (1-128 chars)");let a=JSON.stringify({v:h8.INTENT_HASH_VERSION,amount:t,currency:s,payee:n,intentId:i??null,settlementHash:o??null});return(0,adn.createHash)("sha256").update(a,"utf8").digest().toString("base64url")}});var Vgt=_(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS=qi.WALLET_AUTHORIZATION_PERMIT_POLICY_ID=qi.WALLET_AUTHORIZATION_PERMIT_AUDIENCE=qi.WALLET_AUTHORIZATION_PERMIT_ISSUER=qi.WALLET_AUTHORIZATION_PERMIT_JWT_TYP=void 0;qi.issueWalletAuthorizationPermit=Pdn;qi.verifyWalletAuthorizationPermit=xdn;var wOe=dD(),ldn=Y4(),pdn=cPe(),Lgt=Ju(),fdn=Dy(),mdn=Lv();qi.WALLET_AUTHORIZATION_PERMIT_JWT_TYP="visa-wallet-authorization-permit+jwt";qi.WALLET_AUTHORIZATION_PERMIT_ISSUER="visa:wallet-authority";qi.WALLET_AUTHORIZATION_PERMIT_AUDIENCE="visa:wallet-signer";qi.WALLET_AUTHORIZATION_PERMIT_POLICY_ID="wallet-authority-v1";qi.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS=120;var hdn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,IOe=/^0x[0-9a-f]{40}$/,gdn=/^0x[0-9a-f]{64}$/,_dn=/^eip155:(0|[1-9][0-9]*)$/,Bgt=/^(0|[1-9][0-9]*)$/,ydn=9223372036854775807n,jgt=(1n<<256n)-1n,qgt=new Set(["v","authorizationId","agentId","keyJkt","walletApiKeyId","grantId","grantVersion","budgetEpochId","runtimeSessionId","executionChannel","scope","executionMode","x402Version","amountMicros","currency","payer","payee","network","asset","scheme","assetTransferMethod","eip3009Nonce","validAfter","validBefore","settlementHash","settlementExpiresAt","resourceCommitment","intentId","economicIntentId"]),bdn=new Set(["iss","aud","sub","cnf","iat","exp","jti","policy_id","v","authorization_id","agent_id","key_jkt","wallet_api_key_id","grant_id","grant_version","budget_epoch_id","runtime_session_id","execution_channel","scope","execution_mode","x402_version","amount_micros","currency","payer","payee","network","asset","scheme","asset_transfer_method","eip3009_nonce","valid_after","valid_before","settlement_hash","settlement_expires_at","resource_commitment","intent_id","economic_intent_id"]);function _8(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Hgt(e,t,r){let n=Object.keys(t).filter(o=>!r.has(o)),i=[...r].filter(o=>!Object.hasOwn(t,o));if(n.length>0||i.length>0)throw new Error(`${e} does not match the v1 wire shape`)}function g8(e,t){if(typeof t!="string"||!hdn.test(t))throw new Error(`${e} must be a UUID`)}function ste(e,t){if(!(0,ldn.isCanonicalOpaqueId)(t))throw new Error(`${e} must be a canonical opaque id`)}function Edn(e){if(typeof e!="string"||!Bgt.test(e)||e==="0")throw new Error("amountMicros must be a canonical positive integer string");if(BigInt(e)>ydn)throw new Error("amountMicros exceeds BIGINT")}function Ugt(e,t){if(typeof t!="string"||!Bgt.test(t))throw new Error(`${e} must be a canonical unsigned integer string`);if(t.length>78||BigInt(t)>jgt)throw new Error(`${e} exceeds uint256`)}function POe(e){return typeof e=="string"&&/^0x[0-9a-fA-F]{40}$/.test(e)?e.toLowerCase():null}function Sdn(e){return typeof e=="string"&&/^0x[0-9a-fA-F]{64}$/.test(e)?e.toLowerCase():null}function ote(e){let t;try{if(typeof e=="bigint")t=e;else if(typeof e=="number"&&Number.isSafeInteger(e))t=BigInt(e);else if(typeof e=="string"&&(/^(0|[1-9][0-9]*)$/.test(e)||/^0x[0-9a-fA-F]+$/.test(e))){let r=e.startsWith("0x")?e.slice(2):e,n=e.startsWith("0x")?64:78;if(r.length>n)return null;t=BigInt(e)}else return null}catch{return null}return t>=0n&&t<=jgt?t.toString(10):null}function vdn(e){if(typeof e!="string")throw new Error("settlementExpiresAt must be an ISO timestamp");let t=Date.parse(e);if(!Number.isFinite(t))throw new Error("settlementExpiresAt must be an ISO timestamp");let r=new Date(t).toISOString();if(r!==e)throw new Error("settlementExpiresAt must be canonical UTC ISO");return r}function xOe(e){if(!_8(e))throw new Error("wallet permit binding must be an object");if(Hgt("wallet permit binding",e,qgt),e.v!==1)throw new Error("wallet permit binding requires v=1");if(g8("authorizationId",e.authorizationId),g8("agentId",e.agentId),g8("walletApiKeyId",e.walletApiKeyId),g8("grantId",e.grantId),g8("budgetEpochId",e.budgetEpochId),g8("runtimeSessionId",e.runtimeSessionId),!(0,wOe.isCanonicalBase64Url32)(e.keyJkt))throw new Error("keyJkt must be canonical");if(!(0,wOe.isCanonicalBase64Url32)(e.settlementHash))throw new Error("settlementHash must be canonical");if(!(0,wOe.isCanonicalBase64Url32)(e.resourceCommitment))throw new Error("resourceCommitment must be canonical");if(typeof e.grantVersion!="number"||!Number.isSafeInteger(e.grantVersion)||e.grantVersion<=0)throw new Error("grantVersion must be a positive safe integer");if(typeof e.executionChannel!="string"||!["cli","mcp"].includes(e.executionChannel))throw new Error("executionChannel is invalid");if(e.scope!=="wallet:x402"||e.executionMode!=="direct_runtime")throw new Error("wallet permit v1 supports direct-runtime x402 only");if(e.x402Version!==1&&e.x402Version!==2)throw new Error("x402Version must be 1 or 2");if(Edn(e.amountMicros),e.currency!=="USD")throw new Error("currency must be USD");if(typeof e.payer!="string"||!IOe.test(e.payer))throw new Error("payer must be a canonical lower-case EVM address");if(typeof e.payee!="string"||!IOe.test(e.payee))throw new Error("payee must be a canonical lower-case EVM address");if(typeof e.network!="string"||e.network.length>64||!_dn.test(e.network))throw new Error("network must be a canonical EIP-155 CAIP-2 id");let t=`${e.network}/erc20:`;if(typeof e.asset!="string"||!e.asset.startsWith(t))throw new Error("asset must be canonical");let r=e.asset.slice(t.length);if(!r||!IOe.test(r))throw new Error("asset must name a canonical lower-case ERC-20 address");if(e.scheme!=="exact"||e.assetTransferMethod!=="eip3009")throw new Error("wallet permit v1 supports exact EIP-3009 only");if(typeof e.eip3009Nonce!="string"||!gdn.test(e.eip3009Nonce))throw new Error("eip3009Nonce must be canonical");if(Ugt("validAfter",e.validAfter),Ugt("validBefore",e.validBefore),BigInt(e.validBefore)<=BigInt(e.validAfter))throw new Error("validBefore must be after validAfter");let n=vdn(e.settlementExpiresAt);if(BigInt(e.validBefore)!==BigInt(Math.floor(Date.parse(n)/1e3)))throw new Error("validBefore must match settlementExpiresAt");return ste("intentId",e.intentId),ste("economicIntentId",e.economicIntentId),{v:1,authorizationId:e.authorizationId,agentId:e.agentId,keyJkt:e.keyJkt,walletApiKeyId:e.walletApiKeyId,grantId:e.grantId,grantVersion:e.grantVersion,budgetEpochId:e.budgetEpochId,runtimeSessionId:e.runtimeSessionId,executionChannel:e.executionChannel,scope:"wallet:x402",executionMode:"direct_runtime",x402Version:e.x402Version,amountMicros:e.amountMicros,currency:"USD",payer:e.payer,payee:e.payee,network:e.network,asset:e.asset,scheme:"exact",assetTransferMethod:"eip3009",eip3009Nonce:e.eip3009Nonce,validAfter:e.validAfter,validBefore:e.validBefore,settlementHash:e.settlementHash,settlementExpiresAt:n,resourceCommitment:e.resourceCommitment,intentId:e.intentId,economicIntentId:e.economicIntentId}}function Tdn(e,t){return{iss:qi.WALLET_AUTHORIZATION_PERMIT_ISSUER,aud:qi.WALLET_AUTHORIZATION_PERMIT_AUDIENCE,sub:e.agentId,cnf:{jkt:e.keyJkt},...t,policy_id:qi.WALLET_AUTHORIZATION_PERMIT_POLICY_ID,v:1,authorization_id:e.authorizationId,agent_id:e.agentId,key_jkt:e.keyJkt,wallet_api_key_id:e.walletApiKeyId,grant_id:e.grantId,grant_version:e.grantVersion,budget_epoch_id:e.budgetEpochId,runtime_session_id:e.runtimeSessionId,execution_channel:e.executionChannel,scope:e.scope,execution_mode:e.executionMode,x402_version:e.x402Version,amount_micros:e.amountMicros,currency:e.currency,payer:e.payer,payee:e.payee,network:e.network,asset:e.asset,scheme:e.scheme,asset_transfer_method:e.assetTransferMethod,eip3009_nonce:e.eip3009Nonce,valid_after:e.validAfter,valid_before:e.validBefore,settlement_hash:e.settlementHash,settlement_expires_at:e.settlementExpiresAt,resource_commitment:e.resourceCommitment,intent_id:e.intentId,economic_intent_id:e.economicIntentId}}function Adn(e){return xOe({v:e.v,authorizationId:e.authorization_id,agentId:e.agent_id,keyJkt:e.key_jkt,walletApiKeyId:e.wallet_api_key_id,grantId:e.grant_id,grantVersion:e.grant_version,budgetEpochId:e.budget_epoch_id,runtimeSessionId:e.runtime_session_id,executionChannel:e.execution_channel,scope:e.scope,executionMode:e.execution_mode,x402Version:e.x402_version,amountMicros:e.amount_micros,currency:e.currency,payer:e.payer,payee:e.payee,network:e.network,asset:e.asset,scheme:e.scheme,assetTransferMethod:e.asset_transfer_method,eip3009Nonce:e.eip3009_nonce,validAfter:e.valid_after,validBefore:e.valid_before,settlementHash:e.settlement_hash,settlementExpiresAt:e.settlement_expires_at,resourceCommitment:e.resource_commitment,intentId:e.intent_id,economicIntentId:e.economic_intent_id})}function wdn(e,t){return[...qgt].every(r=>e[r]===t[r])}function Idn(e,t){if(!_8(e)||!_8(e.domain)||!_8(e.message))return"typed_data_invalid";try{if((0,pdn.eip712DigestBase64Url)(e)!==t.settlementHash)return"typed_data_binding_mismatch"}catch{return"typed_data_invalid"}let r=`${t.network}/erc20:`,n=t.asset.slice(r.length),i=t.network.slice(7),o=e.message,s=e.domain;return e.primaryType!=="TransferWithAuthorization"||ote(s.chainId)!==i||POe(s.verifyingContract)!==n||POe(o.from)!==t.payer||POe(o.to)!==t.payee||ote(o.value)!==t.amountMicros||Sdn(o.nonce)!==t.eip3009Nonce||ote(o.validAfter)!==t.validAfter||ote(o.validBefore)!==t.validBefore?"typed_data_binding_mismatch":null}async function Pdn(e){if(e.signer.publicJwk.role!=="wallet-permit")throw new Error("wallet permits require a dedicated wallet-permit signing key");let t=xOe(e.binding),r=e.nowSec??Math.floor(Date.now()/1e3);if(!Number.isSafeInteger(r)||r<0)throw new Error("nowSec must be a non-negative safe integer");let n=Math.floor(Date.parse(t.settlementExpiresAt)/1e3),i=Math.min(r+qi.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS,n);if(!Number.isSafeInteger(i)||i<=r)throw new Error("settlement window must remain open while issuing a permit");if(BigInt(t.validAfter)+1n>=BigInt(i))throw new Error("settlement window must open before permit expiry");let o=e.jti??(0,fdn.randomPopNonce)();ste("jti",o);let s=Tdn(t,{iat:r,exp:i,jti:o});return(0,mdn.signJwtWithSigner)(e.signer,{typ:qi.WALLET_AUTHORIZATION_PERMIT_JWT_TYP},{...s})}async function xdn(e,t){let r=await(0,Lgt.verifyJwtSignature)(e,t.permitIssuerJwks,"wallet-permit",!0);if(!r.ok)return{valid:!1,reason:r.reason};if(r.header.typ!==qi.WALLET_AUTHORIZATION_PERMIT_JWT_TYP)return{valid:!1,reason:"typ_mismatch"};let n=r.claims;if(!_8(n))return{valid:!1,reason:"bad_claim_shape"};try{Hgt("wallet permit claims",n,bdn)}catch{return{valid:!1,reason:"bad_claim_shape"}}if(n.iss!==qi.WALLET_AUTHORIZATION_PERMIT_ISSUER||n.aud!==qi.WALLET_AUTHORIZATION_PERMIT_AUDIENCE)return{valid:!1,reason:"issuer_or_audience_mismatch"};if(n.policy_id!==qi.WALLET_AUTHORIZATION_PERMIT_POLICY_ID)return{valid:!1,reason:"policy_mismatch"};if(!Number.isSafeInteger(t.nowSec)||t.nowSec<0)return{valid:!1,reason:"bad_verification_time"};let i=(0,Lgt.temporalReason)(n,t.nowSec);if(i)return{valid:!1,reason:i};if(!Number.isSafeInteger(n.iat)||!Number.isSafeInteger(n.exp)||n.exp<=n.iat||n.exp-n.iat>qi.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS)return{valid:!1,reason:"bad_temporal_claims"};if(typeof n.jti!="string")return{valid:!1,reason:"bad_claim_shape"};try{ste("jti",n.jti)}catch{return{valid:!1,reason:"bad_claim_shape"}}let o;try{o=Adn(n)}catch{return{valid:!1,reason:"bad_claim_shape"}}let s;try{s=xOe(t.expected)}catch{return{valid:!1,reason:"expected_binding_invalid"}}if(n.sub!==o.agentId||!_8(n.cnf)||Object.keys(n.cnf).length!==1||n.cnf.jkt!==o.keyJkt)return{valid:!1,reason:"subject_mismatch"};if(n.exp>Math.floor(Date.parse(o.settlementExpiresAt)/1e3))return{valid:!1,reason:"permit_outlives_settlement"};let a=BigInt(o.validAfter),c=BigInt(o.validBefore),u=BigInt(t.nowSec);if(u<=a||u>=c)return{valid:!1,reason:"settlement_not_live"};if(!wdn(o,s))return{valid:!1,reason:"binding_mismatch"};let d=Idn(t.typedData,o);return d?{valid:!1,reason:d}:{valid:!0,claims:n}}});var zgt=_(yc=>{"use strict";Object.defineProperty(yc,"__esModule",{value:!0});yc.KillList=yc.KILL_SWITCH_JWT_TYP=yc.SUCCESSION_JWT_TYP=void 0;yc.issueSuccession=Rdn;yc.verifySuccession=Ndn;yc.issueKillSwitch=Cdn;yc.verifyKillSwitch=Mdn;yc.attestationIsVoid=$gt;var Odn=Hu(),ate=Ju();yc.SUCCESSION_JWT_TYP="agent-succession+jwt";yc.KILL_SWITCH_JWT_TYP="agent-kill+jwt";async function Rdn(e){let{principalKey:t,oldJkt:r,newJkt:n,agtId:i,nowSec:o=Math.floor(Date.now()/1e3)}=e,s={old_jkt:r,new_jkt:n,agt_id:i,iat:o};return(0,ate.signJwt)(t.privateJwk,{kid:t.kid,typ:yc.SUCCESSION_JWT_TYP},{...s})}function Fgt(e,t,r){let n=t.keys.find(i=>i.kid===e);return!n||(0,Odn.computeJkt)(n)!==r?"signer_not_owning_principal":null}async function Ndn(e,t){let r=await(0,ate.verifyJwtSignature)(e,t.principalJwks);if(!r.ok)return{valid:!1,reason:r.reason};if(r.header.typ!==yc.SUCCESSION_JWT_TYP)return{valid:!1,reason:"typ_mismatch"};let n=r.claims;if(typeof n.old_jkt!="string"||typeof n.new_jkt!="string"||typeof n.agt_id!="string"||typeof n.iat!="number")return{valid:!1,reason:"bad_claim_shape"};if(n.old_jkt===n.new_jkt)return{valid:!1,reason:"no_op_succession"};if(n.old_jkt!==t.registration.sub)return{valid:!1,reason:"agent_jkt_mismatch"};let i=Fgt(r.header.kid,t.principalJwks,t.owningPrincipalJkt);return i?{valid:!1,reason:i}:{valid:!0,record:n}}async function Cdn(e){let{principalKey:t,agentJkt:r,agtId:n,reason:i,nowSec:o=Math.floor(Date.now()/1e3)}=e,s={jkt:r,agt_id:n,iat:o,...i===void 0?{}:{reason:i}};return(0,ate.signJwt)(t.privateJwk,{kid:t.kid,typ:yc.KILL_SWITCH_JWT_TYP},{...s})}async function Mdn(e,t){let r=await(0,ate.verifyJwtSignature)(e,t.principalJwks);if(!r.ok)return{valid:!1,reason:r.reason};if(r.header.typ!==yc.KILL_SWITCH_JWT_TYP)return{valid:!1,reason:"typ_mismatch"};let n=r.claims;if(typeof n.jkt!="string"||typeof n.agt_id!="string"||typeof n.iat!="number")return{valid:!1,reason:"bad_claim_shape"};if(n.jkt!==t.registration.sub)return{valid:!1,reason:"agent_jkt_mismatch"};let i=Fgt(r.header.kid,t.principalJwks,t.owningPrincipalJkt);return i?{valid:!1,reason:i}:{valid:!0,record:n}}function $gt(e,t){return t.jkt===e.signerJkt&&e.signedAtSec>=t.iat}var OOe=class{byJkt;constructor(t=[]){this.byJkt=new Map;for(let r of t){let n=this.byJkt.get(r.jkt);(!n||r.iat<n.iat)&&this.byJkt.set(r.jkt,r)}}get size(){return this.byJkt.size}isKilled(t,r){let n=this.byJkt.get(t);return n&&n.iat<=r?{killed:!0,...n.reason!==void 0?{reason:n.reason}:{},killedAtSec:n.iat}:{killed:!1}}voidsAttestation(t,r){let n=this.byJkt.get(t);return n?$gt({signerJkt:t,signedAtSec:r},n):!1}};yc.KillList=OOe});var Jgt=_(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.GRANT_RAILS=Hi.MAX_TTL_GRANT_DAYS=Hi.TTL_GRANT_DAYS=Hi.GRANT_JWT_TYP=void 0;Hi.issueGrant=Udn;Hi.issueGrantWithSigner=Bdn;Hi.verifyGrant=Vdn;var kdn=Hu(),ROe=Ju(),Ddn=Lv(),Ggt=Dy();Hi.GRANT_JWT_TYP="visa-agent-spend-grant+jwt";Hi.TTL_GRANT_DAYS=30;Hi.MAX_TTL_GRANT_DAYS=90;Hi.GRANT_RAILS=["x402","vic"];var Kgt=86400;function DI(e){return typeof e=="number"&&Number.isSafeInteger(e)&&e>0}function Ldn(e){if(e!==void 0){if(!Array.isArray(e)||e.length===0)throw new Error("allowed_payees, when present, must be a non-empty array");for(let t of e)if(typeof t!="string"||t.length===0)throw new Error("allowed_payees entries must be non-empty strings");if(new Set(e).size!==e.length)throw new Error("allowed_payees must not repeat")}}function Wgt(e,t,r,n){if(!DI(e.per_tx))throw new Error("ceiling.per_tx must be a positive integer in minor units (cents)");if(e.daily!==void 0&&!DI(e.daily))throw new Error("ceiling.daily must be a positive integer in minor units (cents)");if(e.session!==void 0&&!DI(e.session))throw new Error("ceiling.session must be a positive integer in minor units (cents)");if(e.currency!=="USD")throw new Error("ceiling.currency must be 'USD' (P0 canonical unit)");if(!Array.isArray(t)||t.length===0)throw new Error("rails must be a non-empty array");for(let i of t)if(!Hi.GRANT_RAILS.includes(i))throw new Error(`unknown rail '${String(i)}' \u2014 must be one of ${Hi.GRANT_RAILS.join(", ")}`);if(new Set(t).size!==t.length)throw new Error("rails must not repeat");if(!Number.isFinite(r)||r<=0||r>Hi.MAX_TTL_GRANT_DAYS)throw new Error(`ttlDays must be in (0, ${Hi.MAX_TTL_GRANT_DAYS}]; got ${r}`);Ldn(n)}function Ygt(e){return{sub:e.agentJkt,cnf:{jkt:e.agentJkt},ceiling:e.ceiling,rails:e.rails,...e.allowedPayees!==void 0?{allowed_payees:e.allowedPayees}:{},iat:e.nowSec,exp:e.nowSec+e.ttlDays*Kgt,jti:e.jti}}async function Udn(e){let{principalKey:t,agentJkt:r,ceiling:n,rails:i,allowedPayees:o,jti:s=(0,Ggt.randomPopNonce)(),ttlDays:a=Hi.TTL_GRANT_DAYS,nowSec:c=Math.floor(Date.now()/1e3)}=e;Wgt(n,i,a,o);let u=Ygt({agentJkt:r,ceiling:n,rails:i,allowedPayees:o,jti:s,ttlDays:a,nowSec:c});return(0,ROe.signJwt)(t.privateJwk,{kid:t.kid,typ:Hi.GRANT_JWT_TYP},{...u})}async function Bdn(e){let{signer:t,agentJkt:r,ceiling:n,rails:i,allowedPayees:o,jti:s=(0,Ggt.randomPopNonce)(),ttlDays:a=Hi.TTL_GRANT_DAYS,nowSec:c=Math.floor(Date.now()/1e3)}=e;Wgt(n,i,a,o);let u=Ygt({agentJkt:r,ceiling:n,rails:i,allowedPayees:o,jti:s,ttlDays:a,nowSec:c});return(0,Ddn.signJwtWithSigner)(t,{typ:Hi.GRANT_JWT_TYP},{...u})}function jdn(e){if(typeof e!="object"||e===null)return!1;let t=e;return!DI(t.per_tx)||t.daily!==void 0&&!DI(t.daily)||t.session!==void 0&&!DI(t.session)?!1:t.currency==="USD"}function qdn(e){return Array.isArray(e)&&e.length>0&&e.every(t=>Hi.GRANT_RAILS.includes(t))&&new Set(e).size===e.length}function Hdn(e){return e===void 0?!0:Array.isArray(e)&&e.length>0&&e.every(t=>typeof t=="string"&&t.length>0)&&new Set(e).size===e.length}async function Vdn(e,t){let r=await(0,ROe.verifyJwtSignature)(e,t.principalJwks);if(!r.ok)return{valid:!1,reason:r.reason};if(r.header.typ!==Hi.GRANT_JWT_TYP)return{valid:!1,reason:"typ_mismatch"};let n=r.claims;if(typeof n.sub!="string"||typeof n.jti!="string"||n.jti.length===0||typeof n.cnf!="object"||n.cnf===null||n.cnf.jkt!==n.sub)return{valid:!1,reason:"bad_claim_shape"};if(!jdn(n.ceiling))return{valid:!1,reason:"bad_ceiling"};if(!qdn(n.rails))return{valid:!1,reason:"bad_rails"};if(!Hdn(n.allowed_payees))return{valid:!1,reason:"bad_allowed_payees"};let i=(0,ROe.temporalReason)(n,t.nowSec);if(i)return{valid:!1,reason:i};let o=n.iat,s=n.exp;if(!Number.isSafeInteger(o)||!Number.isSafeInteger(s)||s<=o)return{valid:!1,reason:"bad_temporal_claims"};if(s-o>Hi.MAX_TTL_GRANT_DAYS*Kgt)return{valid:!1,reason:"ttl_exceeds_max"};if(n.sub!==t.expectedAgentJkt)return{valid:!1,reason:"agent_jkt_mismatch"};let a=t.principalJwks.keys.find(c=>c.kid===r.header.kid);if(!a||(0,kdn.computeJkt)(a)!==t.owningPrincipalJkt)return{valid:!1,reason:"signer_not_owning_principal"};for(let c of t.killRecords??[])if(c.jkt===n.sub)return{valid:!1,reason:"agent_killed"};for(let c of t.revokedJtis??[])if(c===n.jti)return{valid:!1,reason:"grant_revoked"};if(!n.rails.includes(t.rail))return{valid:!1,reason:"rail_not_granted"};if(t.intent!==void 0){if(!DI(t.intent.amount))return{valid:!1,reason:"bad_intent_amount"};if(t.intent.amount>n.ceiling.per_tx)return{valid:!1,reason:"over_per_tx_ceiling"};let c=n.allowed_payees;if(c!==void 0){if(t.intent.payee===void 0)return{valid:!1,reason:"payee_required"};if(!c.includes(t.intent.payee))return{valid:!1,reason:"payee_not_allowed"}}}return{valid:!0,claims:n}}});var Zgt=_(ye=>{"use strict";Object.defineProperty(ye,"__esModule",{value:!0});ye.AGENT_PAIRING_TERMINAL_STATES=ye.AGENT_PAIRING_STATES=ye.AGENT_PAIRING_TTL_SECONDS=ye.sha256=ye.pairingInstrumentCommitment=ye.pairingDeliveryArtifactV2Hash=ye.canonicalPairingDeliveryArtifactV2=ye.pairingArtifactHash=ye.agentMailCredentialClaimMessageV2=ye.keyRotationClaimHashV2=ye.keyRotationClaimMessageV2=ye.capabilityAttachActivationMessageV2=ye.capabilityAttachClaimHashV2=ye.capabilityAttachClaimMessageV2=ye.handoffAuthorityCapabilities=ye.AGENT_HANDOFF_COMPOUND_AUTHORITY=ye.AGENT_HANDOFF_AUTHORITIES=ye.AGENT_CAPABILITY_ATTACH_CAPABILITIES=ye.pairingActivationMessageV2=ye.pairingActivationMessage=ye.pairingClaimHashV2=ye.pairingClaimMessageV2=ye.pairingClaimMessage=ye.pairingTermsV2Hash=ye.pairingTermsHash=ye.canonicalPairingTermsV2=ye.canonicalPairingTerms=ye.setupConfirmationCode=ye.pairingConfirmationCode=ye.pairingCodeFromClaimToken=ye.pairingClaimTokenHash=ye.randomPairingClaimToken=ye.pairingCodeHash=ye.isValidPairingCode=ye.formatPairingCode=ye.normalizePairingCode=ye.randomPairingCode=ye.pairingVerifierChallenge=ye.randomPairingVerifier=ye.randomSetupOperationId=ye.randomHandoffId=ye.randomAttachId=ye.randomPairingId=ye.AGENT_PAIRING_CODE_LENGTH=ye.AGENT_PAIRING_CODE_ALPHABET=ye.AGENT_PAIRING_PROTOCOL_VERSION_V2=ye.AGENT_PAIRING_PROTOCOL_VERSION=void 0;ye.isAgentPairingState=$dn;ye.canTransitionAgentPairing=Xgt;ye.assertAgentPairingTransition=zdn;var Wt=dD();Object.defineProperty(ye,"AGENT_PAIRING_PROTOCOL_VERSION",{enumerable:!0,get:function(){return Wt.AGENT_PAIRING_PROTOCOL_VERSION}});Object.defineProperty(ye,"AGENT_PAIRING_PROTOCOL_VERSION_V2",{enumerable:!0,get:function(){return Wt.AGENT_PAIRING_PROTOCOL_VERSION_V2}});Object.defineProperty(ye,"AGENT_PAIRING_CODE_ALPHABET",{enumerable:!0,get:function(){return Wt.AGENT_PAIRING_CODE_ALPHABET}});Object.defineProperty(ye,"AGENT_PAIRING_CODE_LENGTH",{enumerable:!0,get:function(){return Wt.AGENT_PAIRING_CODE_LENGTH}});Object.defineProperty(ye,"randomPairingId",{enumerable:!0,get:function(){return Wt.randomPairingId}});Object.defineProperty(ye,"randomAttachId",{enumerable:!0,get:function(){return Wt.randomAttachId}});Object.defineProperty(ye,"randomHandoffId",{enumerable:!0,get:function(){return Wt.randomHandoffId}});Object.defineProperty(ye,"randomSetupOperationId",{enumerable:!0,get:function(){return Wt.randomSetupOperationId}});Object.defineProperty(ye,"randomPairingVerifier",{enumerable:!0,get:function(){return Wt.randomPairingVerifier}});Object.defineProperty(ye,"pairingVerifierChallenge",{enumerable:!0,get:function(){return Wt.pairingVerifierChallenge}});Object.defineProperty(ye,"randomPairingCode",{enumerable:!0,get:function(){return Wt.randomPairingCode}});Object.defineProperty(ye,"normalizePairingCode",{enumerable:!0,get:function(){return Wt.normalizePairingCode}});Object.defineProperty(ye,"formatPairingCode",{enumerable:!0,get:function(){return Wt.formatPairingCode}});Object.defineProperty(ye,"isValidPairingCode",{enumerable:!0,get:function(){return Wt.isValidPairingCode}});Object.defineProperty(ye,"pairingCodeHash",{enumerable:!0,get:function(){return Wt.pairingCodeHash}});Object.defineProperty(ye,"randomPairingClaimToken",{enumerable:!0,get:function(){return Wt.randomPairingClaimToken}});Object.defineProperty(ye,"pairingClaimTokenHash",{enumerable:!0,get:function(){return Wt.pairingClaimTokenHash}});Object.defineProperty(ye,"pairingCodeFromClaimToken",{enumerable:!0,get:function(){return Wt.pairingCodeFromClaimToken}});Object.defineProperty(ye,"pairingConfirmationCode",{enumerable:!0,get:function(){return Wt.pairingConfirmationCode}});Object.defineProperty(ye,"setupConfirmationCode",{enumerable:!0,get:function(){return Wt.setupConfirmationCode}});Object.defineProperty(ye,"canonicalPairingTerms",{enumerable:!0,get:function(){return Wt.canonicalPairingTerms}});Object.defineProperty(ye,"canonicalPairingTermsV2",{enumerable:!0,get:function(){return Wt.canonicalPairingTermsV2}});Object.defineProperty(ye,"pairingTermsHash",{enumerable:!0,get:function(){return Wt.pairingTermsHash}});Object.defineProperty(ye,"pairingTermsV2Hash",{enumerable:!0,get:function(){return Wt.pairingTermsV2Hash}});Object.defineProperty(ye,"pairingClaimMessage",{enumerable:!0,get:function(){return Wt.pairingClaimMessage}});Object.defineProperty(ye,"pairingClaimMessageV2",{enumerable:!0,get:function(){return Wt.pairingClaimMessageV2}});Object.defineProperty(ye,"pairingClaimHashV2",{enumerable:!0,get:function(){return Wt.pairingClaimHashV2}});Object.defineProperty(ye,"pairingActivationMessage",{enumerable:!0,get:function(){return Wt.pairingActivationMessage}});Object.defineProperty(ye,"pairingActivationMessageV2",{enumerable:!0,get:function(){return Wt.pairingActivationMessageV2}});Object.defineProperty(ye,"AGENT_CAPABILITY_ATTACH_CAPABILITIES",{enumerable:!0,get:function(){return Wt.AGENT_CAPABILITY_ATTACH_CAPABILITIES}});Object.defineProperty(ye,"AGENT_HANDOFF_AUTHORITIES",{enumerable:!0,get:function(){return Wt.AGENT_HANDOFF_AUTHORITIES}});Object.defineProperty(ye,"AGENT_HANDOFF_COMPOUND_AUTHORITY",{enumerable:!0,get:function(){return Wt.AGENT_HANDOFF_COMPOUND_AUTHORITY}});Object.defineProperty(ye,"handoffAuthorityCapabilities",{enumerable:!0,get:function(){return Wt.handoffAuthorityCapabilities}});Object.defineProperty(ye,"capabilityAttachClaimMessageV2",{enumerable:!0,get:function(){return Wt.capabilityAttachClaimMessageV2}});Object.defineProperty(ye,"capabilityAttachClaimHashV2",{enumerable:!0,get:function(){return Wt.capabilityAttachClaimHashV2}});Object.defineProperty(ye,"capabilityAttachActivationMessageV2",{enumerable:!0,get:function(){return Wt.capabilityAttachActivationMessageV2}});Object.defineProperty(ye,"keyRotationClaimMessageV2",{enumerable:!0,get:function(){return Wt.keyRotationClaimMessageV2}});Object.defineProperty(ye,"keyRotationClaimHashV2",{enumerable:!0,get:function(){return Wt.keyRotationClaimHashV2}});Object.defineProperty(ye,"agentMailCredentialClaimMessageV2",{enumerable:!0,get:function(){return Wt.agentMailCredentialClaimMessageV2}});Object.defineProperty(ye,"pairingArtifactHash",{enumerable:!0,get:function(){return Wt.pairingArtifactHash}});Object.defineProperty(ye,"canonicalPairingDeliveryArtifactV2",{enumerable:!0,get:function(){return Wt.canonicalPairingDeliveryArtifactV2}});Object.defineProperty(ye,"pairingDeliveryArtifactV2Hash",{enumerable:!0,get:function(){return Wt.pairingDeliveryArtifactV2Hash}});Object.defineProperty(ye,"pairingInstrumentCommitment",{enumerable:!0,get:function(){return Wt.pairingInstrumentCommitment}});Object.defineProperty(ye,"sha256",{enumerable:!0,get:function(){return Wt.pairingSha256}});ye.AGENT_PAIRING_TTL_SECONDS=3600;ye.AGENT_PAIRING_STATES=["awaiting_agent","agent_claimed","code_verified","awaiting_human","authorized","delivered","activated","expired","cancelled","failed","revoked"];ye.AGENT_PAIRING_TERMINAL_STATES=new Set(["activated","expired","cancelled","failed","revoked"]);var Fdn={awaiting_agent:new Set(["agent_claimed","expired","cancelled","failed"]),agent_claimed:new Set(["code_verified","expired","cancelled","failed"]),code_verified:new Set(["awaiting_human","expired","cancelled","failed"]),awaiting_human:new Set(["authorized","expired","cancelled","failed"]),authorized:new Set(["delivered","expired","cancelled","failed"]),delivered:new Set(["activated","expired","cancelled","failed"]),activated:new Set(["revoked"]),expired:new Set,cancelled:new Set,failed:new Set,revoked:new Set};function $dn(e){return typeof e=="string"&&ye.AGENT_PAIRING_STATES.includes(e)}function Xgt(e,t){return Fdn[e].has(t)}function zdn(e,t){if(!Xgt(e,t))throw new Error(`invalid agent pairing transition: ${e} -> ${t}`)}});var Qgt=_(NOe=>{"use strict";Object.defineProperty(NOe,"__esModule",{value:!0});NOe.prepareIdentityPresenceDelegation=Wdn;var Gdn=ite(),Kdn=Fv();function Wdn(e){let r={...(0,Gdn.prepareRuntimeDelegation)({...e,signingModes:["eip3009:exact"]}).claims,purpose:"runtime_presence_pop",signingModes:["presence"]};return{...(0,Kdn.prepareRootSignedJws)("visa-agent-runtime-delegation+jwt",e.rootKid,r),claims:r}}});var DOe=_(Kr=>{"use strict";Object.defineProperty(Kr,"__esModule",{value:!0});Kr.HOSTED_CONNECTOR_PROOF_TTL_SECONDS=Kr.HOSTED_CONNECTOR_PROOF_TYP=Kr.IDENTITY_PRESENCE_LEASE_TYP=Kr.IDENTITY_PRESENCE_SIGNING_MODE=Kr.IDENTITY_PRESENCE_PURPOSE=Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE=void 0;Kr.issueHostedConnectorProof=Qdn;Kr.verifyHostedConnectorProof=eln;Kr.issueIdentityPresenceLease=tln;Kr.verifyIdentityPresenceLeaseChain=rln;var r1t=require("node:crypto"),e1t=qf(),COe=Hu(),MOe=Ju(),n1t=Lv(),LI=CI();Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE="urn:visa:tvc:identity-gate";Kr.IDENTITY_PRESENCE_PURPOSE="runtime_presence_pop";Kr.IDENTITY_PRESENCE_SIGNING_MODE="presence";Kr.IDENTITY_PRESENCE_LEASE_TYP="visa-agent-runtime-lease+jwt";Kr.HOSTED_CONNECTOR_PROOF_TYP="visa-hosted-connector-proof+jwt";Kr.HOSTED_CONNECTOR_PROOF_TTL_SECONDS=300;var y8=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,cte=/^[A-Za-z0-9_-]{43}$/,Ydn=/^eip155:[1-9][0-9]{0,15}$/,Jdn="exp,iat,iss,jti,leaseIssuerJkt,maxLeaseTtlSeconds,nbf,network,purpose,runtimeId,runtimeJkt,signingModes,sub,v",Xdn="aud,delegationHash,delegationId,exp,generation,grantId,grantVersion,iat,iss,jti,nbf,network,purpose,rootJkt,runtimeId,runtimeJkt,signingModes,sub,v",Zdn="agentId,aud,connectorKeyId,custody,exp,grantId,grantVersion,hostedAuthorityMode,iat,intentHash,iss,jti,operationId,requestId,runtimeId,v";function kOe(e,t){return Object.keys(e).sort().join(",")===t}function t1t(e,t,r){return Number.isSafeInteger(e.iat)&&Number.isSafeInteger(e.nbf)&&Number.isSafeInteger(e.exp)&&e.iat>=0&&e.nbf===e.iat&&e.exp>e.iat&&e.exp-e.iat<=r&&e.iat<=t+LI.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS&&t<e.exp}async function Qdn(e){let t={v:1,iss:"visa:auth",aud:Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE,jti:e.requestId,requestId:e.requestId,agentId:e.agentId,runtimeId:e.runtimeId,custody:"signer",hostedAuthorityMode:"standing",connectorKeyId:e.connectorKeyId,grantId:e.grantId,grantVersion:e.grantVersion,operationId:e.operationId,intentHash:e.intentHash,iat:e.issuedAtSec,exp:e.issuedAtSec+Kr.HOSTED_CONNECTOR_PROOF_TTL_SECONDS};if(!i1t(t))throw new Error("hosted_connector_proof_invalid");return(0,n1t.signJwtWithSigner)(e.signer,{typ:Kr.HOSTED_CONNECTOR_PROOF_TYP},{...t})}function i1t(e){return kOe(e,Zdn)&&e.v===1&&e.iss==="visa:auth"&&e.aud===Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE&&e.jti===e.requestId&&[e.jti,e.requestId,e.agentId,e.runtimeId,e.grantId,e.operationId].every(t=>y8.test(t))&&e.custody==="signer"&&e.hostedAuthorityMode==="standing"&&typeof e.connectorKeyId=="string"&&/^[A-Za-z0-9._:@/-]{1,256}$/.test(e.connectorKeyId)&&cte.test(e.intentHash)&&Number.isSafeInteger(e.grantVersion)&&e.grantVersion>0&&Number.isSafeInteger(e.iat)&&e.iat>=0&&Number.isSafeInteger(e.exp)&&e.exp>e.iat&&e.exp-e.iat<=Kr.HOSTED_CONNECTOR_PROOF_TTL_SECONDS}async function eln(e,t){let r=await(0,MOe.verifyJwtSignature)(e,t.issuerJwks);if(!r.ok)return r;let n=r.claims,i=t.issuerJwks.keys.filter(s=>typeof s.kid=="string"&&s.kid===r.header.kid),o=t.maxAgeSeconds??30;return r.header.typ!==Kr.HOSTED_CONNECTOR_PROOF_TYP||i.length!==1||(0,COe.computeJkt)(i[0])!==r.header.kid||!i1t(n)||!Number.isSafeInteger(t.nowSec)||!Number.isSafeInteger(o)||o<1||n.iat>t.nowSec+LI.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS||t.nowSec-n.iat>o||n.exp<=t.nowSec||n.requestId!==t.expectedRequestId||n.agentId!==t.expectedAgentId||n.runtimeId!==t.expectedRuntimeId||n.connectorKeyId!==t.expectedConnectorKeyId||n.grantId!==t.expectedGrantId||n.grantVersion!==t.expectedGrantVersion||n.operationId!==t.expectedOperationId||t.expectedIntentHash!==void 0&&n.intentHash!==t.expectedIntentHash?{ok:!1,reason:"hosted_connector_proof_invalid"}:{ok:!0,claims:n}}async function tln(e){if(!y8.test(e.leaseId)||!y8.test(e.grantId)||!Number.isSafeInteger(e.generation)||e.generation<1||!Number.isSafeInteger(e.grantVersion)||e.grantVersion<1||!Number.isSafeInteger(e.ttlSeconds)||e.ttlSeconds<1||e.ttlSeconds>LI.RUNTIME_LEASE_MAX_TTL_SECONDS||e.ttlSeconds>e.delegation.maxLeaseTtlSeconds||e.delegation.leaseIssuerJkt!==e.signer.kid)throw new Error("identity presence lease input invalid");let t={v:1,iss:e.signer.kid,sub:e.delegation.sub,aud:Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE,jti:e.leaseId,delegationId:e.delegation.jti,delegationHash:(0,r1t.createHash)("sha256").update(e.delegationToken).digest("base64url"),rootJkt:e.delegation.iss,runtimeId:e.delegation.runtimeId,runtimeJkt:e.delegation.runtimeJkt,purpose:Kr.IDENTITY_PRESENCE_PURPOSE,network:e.delegation.network,signingModes:[Kr.IDENTITY_PRESENCE_SIGNING_MODE],generation:e.generation,grantId:e.grantId,grantVersion:e.grantVersion,iat:e.nowSec,nbf:e.nowSec,exp:e.nowSec+e.ttlSeconds};return{lease:await(0,n1t.signJwtWithSigner)(e.signer,{typ:Kr.IDENTITY_PRESENCE_LEASE_TYP},{...t}),claims:t}}async function rln(e,t,r){if(!Number.isSafeInteger(r.nowSec)||r.nowSec<0)return{ok:!1,reason:"bad_verification_context"};let n=await(0,MOe.verifyJwtSignature)(e,r.ownerJwks),i=await(0,MOe.verifyJwtSignature)(t,r.issuerJwks);if(!n.ok)return n;if(!i.ok)return i;let o=n.claims,s=i.claims,a=r.ownerJwks.keys.find(u=>u.kid===r.expectedRootKid),c=r.issuerJwks.keys.find(u=>u.kid===r.expectedLeaseIssuerKid);return n.header.typ!==LI.RUNTIME_DELEGATION_TYP||n.header.kid!==r.expectedRootKid||i.header.typ!==Kr.IDENTITY_PRESENCE_LEASE_TYP||i.header.kid!==r.expectedLeaseIssuerKid||!a||!c||(0,COe.computeJkt)(a)!==r.expectedRootJkt||(0,COe.computeJkt)(c)!==r.expectedLeaseIssuerJkt||!kOe(o,Jdn)||!kOe(s,Xdn)||o.v!==1||o.iss!==r.expectedRootJkt||o.sub!==r.expectedAgentId||o.jti!==r.expectedDelegationId||o.runtimeId!==r.expectedRuntimeId||o.runtimeJkt!==r.expectedRuntimeJkt||o.leaseIssuerJkt!==r.expectedLeaseIssuerJkt||o.purpose!==Kr.IDENTITY_PRESENCE_PURPOSE||o.network!==r.expectedNetwork||(0,e1t.canonicalJson)(o.signingModes)!=='["presence"]'||!y8.test(o.jti)||!y8.test(o.runtimeId)||!cte.test(o.iss)||!cte.test(o.runtimeJkt)||!cte.test(o.leaseIssuerJkt)||!Ydn.test(o.network)||!Number.isSafeInteger(o.maxLeaseTtlSeconds)||o.maxLeaseTtlSeconds<1||o.maxLeaseTtlSeconds>LI.RUNTIME_LEASE_MAX_TTL_SECONDS||!t1t(o,r.nowSec,LI.RUNTIME_DELEGATION_MAX_TTL_SECONDS)||s.v!==1||s.iss!==r.expectedLeaseIssuerJkt||s.sub!==r.expectedAgentId||s.aud!==Kr.IDENTITY_PRESENCE_LEASE_AUDIENCE||s.delegationId!==o.jti||s.delegationHash!==(0,r1t.createHash)("sha256").update(e).digest("base64url")||s.rootJkt!==r.expectedRootJkt||s.runtimeId!==r.expectedRuntimeId||s.runtimeJkt!==r.expectedRuntimeJkt||s.purpose!==Kr.IDENTITY_PRESENCE_PURPOSE||s.network!==r.expectedNetwork||(0,e1t.canonicalJson)(s.signingModes)!=='["presence"]'||s.generation!==r.expectedGeneration||s.grantId!==r.expectedGrantId||s.grantVersion!==r.expectedGrantVersion||!y8.test(s.jti)||!t1t(s,r.nowSec,LI.RUNTIME_LEASE_MAX_TTL_SECONDS)||s.exp>o.exp||s.exp-s.iat>o.maxLeaseTtlSeconds?{ok:!1,reason:"presence_chain_invalid"}:{ok:!0,delegation:o,lease:s}}});var jOe=_(Co=>{"use strict";Object.defineProperty(Co,"__esModule",{value:!0});Co.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE=Co.IDENTITY_TAP_LEASE_AUDIENCE=Co.IDENTITY_TAP_PURPOSE=Co.IDENTITY_TAP_PROFILE=void 0;Co.prepareIdentityTapDelegation=u1t;Co.verifyIdentityTapDelegation=d1t;Co.issueIdentityTapLease=aln;Co.identityTapLeaseRequestIntentHash=BOe;Co.createIdentityTapLeaseRequestProof=uln;Co.verifyIdentityTapLeaseRequestProof=dln;var o1t=require("node:crypto"),nln=qf(),iln=Hu(),s1t=Ju(),LOe=Fv(),a1t=Dy(),oln=ite();Co.IDENTITY_TAP_PROFILE="identity-tap-v1";Co.IDENTITY_TAP_PURPOSE="tap_signature_base";Co.IDENTITY_TAP_LEASE_AUDIENCE="urn:visa:tvc:identity-gate";Co.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE="visa-identity-lease-requests:v1";var UOe=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),ute=e=>Number.isSafeInteger(e)&&Number(e)>0,c1t=e=>(0,o1t.createHash)("sha256").update(e,"utf8").digest("base64url");function sln(e){if(typeof e!="string"||Buffer.byteLength(e)>32768)throw new Error("identity_tap_token_invalid");let t=e.split(".");if(t.length!==3||t.some(r=>!r||Buffer.from(r,"base64url").toString("base64url")!==r)||Buffer.from(t[2],"base64url").length!==64)throw new Error("identity_tap_token_invalid");return t}function u1t(e){let r={...(0,oln.prepareRuntimeDelegation)({...e,signingModes:["eip3009:exact"]}).claims,purpose:Co.IDENTITY_TAP_PURPOSE,signingModes:["tap"]};return{...(0,LOe.prepareRootSignedJws)("visa-agent-runtime-delegation+jwt",e.rootKid,r),claims:r}}async function d1t(e,t){let r=sln(e),n=await(0,s1t.verifyJwtSignature)(e,t.ownerJwks);if(!n.ok)throw new Error("identity_tap_delegation_signature_invalid");let i=n.claims,o=t.ownerJwks.keys.find(a=>a.kid===t.expectedRootKid);if(!o||n.header.kid!==t.expectedRootKid||!Number.isSafeInteger(t.nowSec)||t.nowSec<0||!Number.isSafeInteger(i.iat)||!Number.isSafeInteger(i.exp)||i.iat>t.nowSec+30||i.exp<=t.nowSec)throw new Error("identity_tap_delegation_invalid");let s=u1t({rootKid:t.expectedRootKid,rootPublicJwk:o,rootJkt:t.expectedRootJkt,agentId:t.expectedAgentId,runtimeId:t.expectedRuntimeId,runtimeJkt:t.expectedRuntimeJkt,leaseIssuerJkt:t.expectedLeaseIssuerJkt,network:t.expectedNetwork,delegationId:t.expectedDelegationId,nowSec:i.iat,ttlSeconds:i.exp-i.iat,maxLeaseTtlSeconds:i.maxLeaseTtlSeconds});if(r[0]+"."+r[1]!==s.signingInput)throw new Error("identity_tap_delegation_mismatch");return s.claims}async function aln(e){let t=await d1t(e.delegationToken,e.verification),r=e.verification.nowSec,n=e.ttlSeconds??120,i=e.leaseId??(0,o1t.randomUUID)();if(!ute(e.generation)||!ute(e.authorizationVersion)||!UOe(e.authorizationId)||!UOe(i)||!ute(n)||n>120||!Number.isSafeInteger(e.certificateExpiresAt)||(0,iln.computeJkt)(e.signer.publicJwk)!==t.leaseIssuerJkt)throw new Error("identity_tap_lease_context_invalid");let o=Math.min(r+n,r+t.maxLeaseTtlSeconds,t.exp,e.certificateExpiresAt);if(!Number.isSafeInteger(o)||o<=r)throw new Error("identity_tap_lease_expired");let s={v:1,iss:t.leaseIssuerJkt,sub:t.sub,aud:Co.IDENTITY_TAP_LEASE_AUDIENCE,jti:i,delegationId:t.jti,delegationHash:c1t(e.delegationToken),rootJkt:t.iss,runtimeId:t.runtimeId,runtimeJkt:t.runtimeJkt,purpose:Co.IDENTITY_TAP_PURPOSE,network:t.network,signingModes:["tap"],generation:e.generation,grantId:e.authorizationId,grantVersion:e.authorizationVersion,iat:r,nbf:r,exp:o},a=(0,LOe.prepareRootSignedJws)("visa-agent-runtime-lease+jwt",e.signer.kid,s),c=(0,LOe.completeRootSignedJws)(a.signingInput,await e.signer.sign(Buffer.from(a.signingInput)),"identity TAP lease");if(!(await(0,s1t.verifyJwtSignature)(c,{keys:[e.signer.publicJwk]})).ok)throw new Error("identity_tap_lease_signer_invalid");return{lease:c,claims:s}}var cln=["v","profile","associationId","associationVersion","agentId","runtimeId","generation","authorizationId","authorizationVersion","requestId","signingMode"].sort();function BOe(e){if(!e||typeof e!="object"||Object.keys(e).sort().join(",")!==cln.join(",")||e.v!==1||e.profile!==Co.IDENTITY_TAP_PROFILE||e.signingMode!=="tap"||![e.associationId,e.agentId,e.runtimeId,e.authorizationId,e.requestId].every(UOe)||![e.associationVersion,e.generation,e.authorizationVersion].every(ute))throw new Error("identity_tap_lease_request_invalid");return c1t((0,nln.canonicalJson)(e))}function uln(e,t,r){return(0,a1t.createPopProofWithSigner)(e,{nonce:t.requestId,audience:Co.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE,intentHash:BOe(t),nowSec:r})}async function dln(e,t,r,n){let i=await(0,a1t.verifyAgentOperationPopProof)(e,{operationId:t.requestId,audience:Co.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE,expectedIntentHash:BOe(t),nowSec:n,maxAgeSec:60});if(!i.ok||i.jkt!==r||i.runtimeCertificate!==void 0)throw new Error("identity_tap_lease_request_proof_invalid")}});var m1t=_(qy=>{"use strict";Object.defineProperty(qy,"__esModule",{value:!0});qy.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES=void 0;qy.identityDeviceEnrollmentPreimage=f1t;qy.verifyIdentityDeviceEnrollmentProof=hln;qy.prepareIdentityDeviceGateAuthorization=gln;qy.prepareIdentityHostedGateAuthorization=_ln;var l1t=require("node:crypto"),p1t=Fv(),lln=qf(),pln=Hu(),fln=jOe(),mln=["v","profile","associationId","associationVersion","agentId","runtimeId","generation","requestId","runtimePublicJwk","runtimeJkt","rootJkt","certificateSha256","delegationSha256","gateAuthorizationSha256","iat","exp"].sort().join(","),qOe=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),HOe=e=>Number.isSafeInteger(e)&&Number(e)>0,dte=e=>typeof e=="string"&&Buffer.from(e,"base64url").length===32&&Buffer.from(e,"base64url").toString("base64url")===e;function f1t(e){if(!e||Object.keys(e).sort().join(",")!==mln||e.v!==1||e.profile!==fln.IDENTITY_TAP_PROFILE||![e.associationId,e.agentId,e.runtimeId,e.requestId].every(qOe)||![e.associationVersion,e.generation].every(HOe)||![e.runtimeJkt,e.rootJkt,e.certificateSha256,e.delegationSha256,e.gateAuthorizationSha256].every(dte)||!e.runtimePublicJwk||Object.keys(e.runtimePublicJwk).sort().join(",")!=="crv,kty,x"||e.runtimePublicJwk.kty!=="OKP"||e.runtimePublicJwk.crv!=="Ed25519"||!dte(e.runtimePublicJwk.x)||(0,pln.computeJkt)(e.runtimePublicJwk)!==e.runtimeJkt||e.runtimeJkt===e.rootJkt||!Number.isSafeInteger(e.iat)||e.iat<0||!Number.isSafeInteger(e.exp)||e.exp<=e.iat||e.exp-e.iat>600)throw new Error("identity_device_challenge_invalid");return Buffer.from("visa:authority:external-runtime-enrollment:v1\0"+(0,lln.canonicalJson)(e),"utf8")}function hln(e,t,r){let n=f1t(e);if(!Number.isSafeInteger(r)||r<0||e.iat>r+5||e.exp<=r)throw new Error("identity_device_challenge_expired");if(typeof t!="string"||t.length!==86||Buffer.from(t,"base64url").toString("base64url")!==t||!(0,l1t.verify)(null,n,(0,l1t.createPublicKey)({key:e.runtimePublicJwk,format:"jwk"}),Buffer.from(t,"base64url")))throw new Error("identity_device_proof_invalid")}function gln(e){if(![e.rootJkt,e.identityPrincipalJkt].every(dte)||![e.agentId,e.authorizationId].every(qOe)||!HOe(e.generation)||!Number.isSafeInteger(e.nowSec)||e.nowSec<0||!Number.isSafeInteger(e.expiresAt)||e.expiresAt<=e.nowSec||e.expiresAt-e.nowSec>86400||![e.rootKid,e.ownerSuborganizationId].every(r=>typeof r=="string"&&/^[\x21-\x7e]{1,256}$/.test(r)))throw new Error("identity_device_standing_authorization_invalid");let t={v:1,iss:e.rootJkt,sub:e.agentId,aud:"urn:visa:tvc:identity-gate",jti:e.authorizationId,ownerSuborganizationId:e.ownerSuborganizationId,turnkeyRootKeyId:e.rootKid,identityPrincipalJkt:e.identityPrincipalJkt,purposes:["tap_signature_base"],generation:e.generation,maxTtlSecondsByPurpose:{tap_signature_base:480},iat:e.nowSec,nbf:e.nowSec,exp:e.expiresAt};return{...(0,p1t.prepareRootSignedJws)("visa-agent-identity-gate-authorization+jwt",e.rootKid,t),claims:t}}qy.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES=["runtime_presence_pop","tap_signature_base"];function _ln(e){if(![e.rootJkt,e.identityPrincipalJkt].every(dte)||![e.agentId,e.authorizationId].every(qOe)||!HOe(e.generation)||!Number.isSafeInteger(e.nowSec)||e.nowSec<0||!Number.isSafeInteger(e.expiresAt)||e.expiresAt<=e.nowSec||e.expiresAt-e.nowSec>366*86400||![e.rootKid,e.ownerSuborganizationId].every(r=>typeof r=="string"&&/^[\x21-\x7e]{1,256}$/.test(r)))throw new Error("identity_hosted_standing_authorization_invalid");let t={v:1,iss:e.rootJkt,sub:e.agentId,aud:"urn:visa:tvc:identity-gate",jti:e.authorizationId,ownerSuborganizationId:e.ownerSuborganizationId,turnkeyRootKeyId:e.rootKid,identityPrincipalJkt:e.identityPrincipalJkt,purposes:[...qy.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES],generation:e.generation,maxTtlSecondsByPurpose:{runtime_presence_pop:120,tap_signature_base:480},iat:e.nowSec,nbf:e.nowSec,exp:e.expiresAt};return{...(0,p1t.prepareRootSignedJws)("visa-agent-identity-gate-authorization+jwt",e.rootKid,t),claims:t}}});var lte=_(fB=>{"use strict";Object.defineProperty(fB,"__esModule",{value:!0});fB.identityTapSigningBytes=VOe;fB.identityTapPayloadSha256=bln;fB.parseIdentityTapSignatureBase=Eln;var yln=require("node:crypto");function VOe(e){let t=()=>{throw new Error("identity_tap_payload_invalid")};if(!e||typeof e!="object"||Array.isArray(e))return t();let r=e,n=["kind","method","authority","path","coveredComponents","paymentHeaderName","paymentHeaderValue","created","expires","keyId","nonce","tag","signatureBase"],i=["contentDigest","operationId","intentHash"];if(n.some(p=>!Object.hasOwn(r,p))||Object.keys(r).some(p=>!n.includes(p)&&!i.includes(p))||Object.hasOwn(r,"operationId")!==Object.hasOwn(r,"intentHash")||Object.hasOwn(r,"operationId")&&(typeof r.operationId!="string"||!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(r.operationId)||typeof r.intentHash!="string"||!/^[A-Za-z0-9_-]{43}$/.test(r.intentHash)||Buffer.from(r.intentHash,"base64url").toString("base64url")!==r.intentHash))return t();let o=p=>typeof p=="string"&&p.length>0&&Buffer.byteLength(p)<=8192&&!/[\n\r\0]/.test(p),s=p=>typeof p=="string"&&/^[A-Za-z0-9_-]{43}$/.test(p)&&Buffer.from(p,"base64url").toString("base64url")===p;if(r.kind!=="tap_signature_base"||typeof r.method!="string"||!/^[A-Z]{1,16}$/.test(r.method)||!o(r.authority)||!o(r.path)||!r.path.startsWith("/")||!o(r.paymentHeaderValue)||!["payment-signature","x-payment"].includes(r.paymentHeaderName)||r.tag!=="agent-payer-auth"||!s(r.keyId)||typeof r.nonce!="string"||!/^[A-Za-z0-9+/]{43}=$/.test(r.nonce)||Buffer.from(r.nonce,"base64").length!==32||Buffer.from(r.nonce,"base64").toString("base64")!==r.nonce||!Number.isSafeInteger(r.created)||r.created<0||!Number.isSafeInteger(r.expires)||r.expires<=r.created||typeof r.signatureBase!="string"||Buffer.byteLength(r.signatureBase)>65536||Object.hasOwn(r,"contentDigest")&&(!o(r.contentDigest)||!r.contentDigest.startsWith("sha-256=:"))||!Array.isArray(r.coveredComponents)||r.coveredComponents.length<1||r.coveredComponents.length>8)return t();let a={"@method":r.method,"@authority":r.authority,"@path":r.path,[r.paymentHeaderName]:r.paymentHeaderValue};Object.hasOwn(r,"contentDigest")&&(a["content-digest"]=r.contentDigest);let c=new Set,u=[];for(let p of r.coveredComponents){if(typeof p!="string"||!Object.hasOwn(a,p)||c.has(p))return t();c.add(p),u.push(`"${p}": ${a[p]}`)}if(["@method","@authority","@path",r.paymentHeaderName].some(p=>!c.has(p))||c.has("content-digest")!==Object.hasOwn(r,"contentDigest"))return t();let d=r.coveredComponents.map(p=>`"${p}"`).join(" ");u.push(`"@signature-params": (${d});created=${r.created};expires=${r.expires};keyid="${r.keyId}";alg="Ed25519";nonce="${r.nonce}";tag="agent-payer-auth"`);let l=u.join(`
 `);return r.signatureBase!==l?t():Buffer.from(l,"utf8")}function bln(e){return(0,yln.createHash)("sha256").update(VOe(e)).digest("base64url")}function Eln(e){if(e.byteLength>65536)throw new Error("identity_tap_payload_invalid");let t=new TextDecoder("utf-8",{fatal:!0}).decode(e),r=t.split(`
-`),n=/^"@signature-params": \(([^)]+)\);created=(\d+);expires=(\d+);keyid="([A-Za-z0-9_-]{43})";alg="Ed25519";nonce="([A-Za-z0-9+/]{43}=)";tag="agent-payer-auth"$/.exec(r.pop()??"");if(!n)throw new Error("identity_tap_payload_invalid");let i={};for(let a of r){let c=/^"([^"\n]+)": (.+)$/.exec(a);if(!c||Object.hasOwn(i,c[1]))throw new Error("identity_tap_payload_invalid");i[c[1]]=c[2]}let o=Object.hasOwn(i,"payment-signature")?"payment-signature":"x-payment",s={kind:"tap_signature_base",method:i["@method"]??"",authority:i["@authority"]??"",path:i["@path"]??"",coveredComponents:n[1].split(" ").map(a=>a.slice(1,-1)),paymentHeaderName:o,paymentHeaderValue:i[o]??"",...i["content-digest"]===void 0?{}:{contentDigest:i["content-digest"]},created:Number(n[2]),expires:Number(n[3]),keyId:n[4],nonce:n[5],tag:"agent-payer-auth",signatureBase:t};return VOe(s),s}});var _1t=_(UI=>{"use strict";Object.defineProperty(UI,"__esModule",{value:!0});UI.IDENTITY_TAP_SLIP_REQUEST_TYP=void 0;UI.validateIdentityTapSlipRequest=g1t;UI.issueIdentityTapSlip=Oln;var Sln=lte(),vln=qf(),h1t=Hu(),Tln=Ju(),Aln=Lv(),wln=Dy();UI.IDENTITY_TAP_SLIP_REQUEST_TYP="visa-agent-identity-tap-slip-request+jwt";var Iln=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),Pln=e=>typeof e=="string"&&Buffer.from(e,"base64url").length===32&&Buffer.from(e,"base64url").toString("base64url")===e,xln="v,iss,aud,jti,requestId,associationId,associationVersion,agentId,rootJkt,ownerSuborganizationId,runtimeId,runtimeJkt,generation,network,payloadSha256,leaseSha256,iat,exp".split(",").sort().join(",");function g1t(e){if(!e||Object.keys(e).sort().join(",")!==xln||e.v!==1||e.iss!=="urn:visa:authority:identity"||e.aud!=="visa:auth:identity-tap-slip"||![e.jti,e.requestId,e.associationId,e.agentId,e.runtimeId].every(Iln)||![e.rootJkt,e.runtimeJkt,e.payloadSha256,e.leaseSha256].every(Pln)||![e.associationVersion,e.generation].every(t=>Number.isSafeInteger(t)&&t>0)||!Number.isSafeInteger(e.iat)||e.iat<0||!Number.isSafeInteger(e.exp)||e.exp<=e.iat||e.exp-e.iat>60||typeof e.ownerSuborganizationId!="string"||!/^[\x21-\x7e]{1,256}$/.test(e.ownerSuborganizationId)||typeof e.network!="string"||!/^eip155:[1-9][0-9]{0,15}$/.test(e.network))throw new Error("identity_tap_slip_request_invalid")}async function Oln(e){if(typeof e.ticket!="string"||e.ticket.length>16384||typeof e.popJwt!="string"||e.popJwt.length>32768)throw new Error("identity_tap_slip_request_invalid");let t=(0,h1t.computeJkt)(e.authorityPublicJwk),r=await(0,Tln.verifyJwtSignature)(e.ticket,{keys:[{...e.authorityPublicJwk,kid:t}]});if(!r.ok||r.header.typ!==UI.IDENTITY_TAP_SLIP_REQUEST_TYP||r.header.kid!==t)throw new Error("identity_tap_slip_request_invalid");let n=r.claims;if(g1t(n),!Number.isSafeInteger(e.nowSec)||e.nowSec<0||n.iat>e.nowSec+5||n.exp<=e.nowSec)throw new Error("identity_tap_slip_request_expired");if(Buffer.from((0,vln.canonicalJson)(n)).toString("base64url")!==e.ticket.split(".")[1])throw new Error("identity_tap_slip_request_invalid");let i=(0,h1t.computeJkt)(e.signer.publicJwk);if([t,n.rootJkt,n.runtimeJkt].includes(i))throw new Error("identity_slip_issuer_not_independent");if(!e.payload||typeof e.payload!="object"||e.payload.kind!=="tap_signature_base"||(0,Sln.identityTapPayloadSha256)(e.payload)!==n.payloadSha256)throw new Error("identity_tap_slip_payload_mismatch");let o=await(0,wln.verifyAgentOperationPopProof)(e.popJwt,{operationId:n.requestId,audience:"urn:visa:tvc:identity-gate",expectedIntentHash:n.payloadSha256,nowSec:e.nowSec,maxAgeSec:60});if(!o.ok||o.jkt!==n.runtimeJkt||o.runtimeCertificate!==void 0)throw new Error("identity_tap_slip_proof_invalid");return(0,Aln.signJwtWithSigner)(e.signer,{typ:"visa-agent-identity-slip+jwt"},{v:1,iss:"visa:auth",aud:"urn:visa:tvc:identity-gate",jti:n.jti,requestId:n.requestId,iat:n.iat,exp:n.exp,purpose:"tap_signature_base",payloadSha256:n.payloadSha256,agentId:n.agentId,rootJkt:n.rootJkt,ownerSuborganizationId:n.ownerSuborganizationId,runtimeId:n.runtimeId,runtimeJkt:n.runtimeJkt,generation:n.generation,network:n.network})}});var FOe=_(yh=>{"use strict";Object.defineProperty(yh,"__esModule",{value:!0});yh.IDENTITY_HOSTED_TAP_SLIP_PURPOSE=yh.IDENTITY_PRESENCE_SLIP_PURPOSE=void 0;yh.hostedPresenceAttemptId=Mln;yh.issueHostedPresenceIdentitySlip=kln;yh.issueHostedTapIdentitySlip=Dln;var Rln=require("node:crypto"),Nln=Hu(),Cln=Lv();yh.IDENTITY_PRESENCE_SLIP_PURPOSE="runtime_presence_pop";yh.IDENTITY_HOSTED_TAP_SLIP_PURPOSE="tap_signature_base";function Mln(e,t){if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e)||!Number.isSafeInteger(t)||t<0)throw new Error("hosted_presence_attempt_invalid");let r=(0,Rln.createHash)("sha256").update(`visa:hosted-presence-attempt:v1\0${e}\0${t}`,"utf8").digest().subarray(0,16);r[6]=r[6]&15|128,r[8]=r[8]&63|128;let n=r.toString("hex");return`${n.slice(0,8)}-${n.slice(8,12)}-${n.slice(12,16)}-${n.slice(16,20)}-${n.slice(20)}`}function kln(e){return y1t(yh.IDENTITY_PRESENCE_SLIP_PURPOSE,e)}function Dln(e){return y1t(yh.IDENTITY_HOSTED_TAP_SLIP_PURPOSE,e)}async function y1t(e,t){let r=(0,Nln.computeJkt)(t.signer.publicJwk);if([t.rootJkt,t.runtimeJkt].includes(r))throw new Error("identity_slip_issuer_not_independent");if(!Number.isSafeInteger(t.iat)||!Number.isSafeInteger(t.exp)||t.iat<0||t.exp<=t.iat||!Number.isSafeInteger(t.generation)||t.generation<1||!/^eip155:[1-9][0-9]{0,15}$/.test(t.network)||!/^[A-Za-z0-9_-]{43}$/.test(t.payloadSha256)||!/^[A-Za-z0-9_-]{43}$/.test(t.rootJkt)||!/^[A-Za-z0-9_-]{43}$/.test(t.runtimeJkt)||!/^[\x21-\x7e]{1,256}$/.test(t.ownerSuborganizationId))throw new Error("identity_presence_slip_request_invalid");return(0,Cln.signJwtWithSigner)(t.signer,{typ:"visa-agent-identity-slip+jwt"},{v:1,iss:"visa:auth",aud:"urn:visa:tvc:identity-gate",jti:t.jti,requestId:t.requestId,iat:t.iat,exp:t.exp,purpose:e,payloadSha256:t.payloadSha256,agentId:t.agentId,rootJkt:t.rootJkt,ownerSuborganizationId:t.ownerSuborganizationId,runtimeId:t.runtimeId,runtimeJkt:t.runtimeJkt,generation:t.generation,network:t.network})}});var T1t=_(zv=>{"use strict";Object.defineProperty(zv,"__esModule",{value:!0});zv.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP=void 0;zv.validateIdentityHostedTapSlipRequest=S1t;zv.hostedTapPayloadNamesMerchantRequest=v1t;zv.issueHostedTapSlipFromTicket=$ln;var Lln=qf(),b1t=Hu(),Uln=Ju(),Bln=lte(),jln=DOe(),qln=FOe();zv.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP="visa-agent-identity-hosted-tap-slip-request+jwt";var Hln=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),E1t=e=>typeof e=="string"&&Buffer.from(e,"base64url").length===32&&Buffer.from(e,"base64url").toString("base64url")===e,Vln=e=>Number.isSafeInteger(e)&&e>0,Fln="v,iss,aud,jti,requestId,associationId,associationVersion,agentId,rootJkt,ownerSuborganizationId,runtimeId,runtimeJkt,generation,network,custody,connectorKeyId,grantId,grantVersion,operationId,intentHash,payloadSha256,iat,exp".split(",").sort().join(",");function S1t(e){if(!e||typeof e!="object"||Object.keys(e).sort().join(",")!==Fln||e.v!==1||e.iss!=="urn:visa:authority:identity"||e.aud!=="visa:auth:identity-tap-slip"||![e.jti,e.requestId,e.associationId,e.agentId,e.runtimeId,e.grantId,e.operationId].every(Hln)||![e.rootJkt,e.runtimeJkt,e.intentHash,e.payloadSha256].every(E1t)||![e.associationVersion,e.generation,e.grantVersion].every(Vln)||e.custody!=="signer"||typeof e.connectorKeyId!="string"||!/^[A-Za-z0-9._:@/-]{1,256}$/.test(e.connectorKeyId)||!Number.isSafeInteger(e.iat)||e.iat<0||!Number.isSafeInteger(e.exp)||e.exp<=e.iat||e.exp-e.iat>60||typeof e.ownerSuborganizationId!="string"||!/^[\x21-\x7e]{1,256}$/.test(e.ownerSuborganizationId)||typeof e.network!="string"||!/^eip155:[1-9][0-9]{0,15}$/.test(e.network))throw new Error("identity_hosted_tap_slip_request_invalid")}function v1t(e,t){let r;try{r=new URL(t.url)}catch{return!1}return r.protocol!=="https:"&&r.protocol!=="http:"||typeof t.method!="string"||e.method!==t.method.toUpperCase()||e.authority!==r.host||e.path!==(r.pathname||"/")?!1:e.contentDigest===void 0?t.bodySha256===void 0||t.bodySha256==="47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU":typeof t.bodySha256!="string"||!E1t(t.bodySha256)?!1:e.contentDigest===`sha-256=:${Buffer.from(t.bodySha256,"base64url").toString("base64")}:`}async function $ln(e){if(typeof e.ticket!="string"||e.ticket.length>16384)throw new Error("identity_hosted_tap_slip_request_invalid");let t=(0,b1t.computeJkt)(e.authorityPublicJwk),r=await(0,Uln.verifyJwtSignature)(e.ticket,{keys:[{...e.authorityPublicJwk,kid:t}]});if(!r.ok||r.header.typ!==zv.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP||r.header.kid!==t)throw new Error("identity_hosted_tap_slip_request_invalid");let n=r.claims;if(S1t(n),!Number.isSafeInteger(e.nowSec)||e.nowSec<0||n.iat>e.nowSec+30||n.exp<=e.nowSec)throw new Error("identity_hosted_tap_slip_request_expired");if(Buffer.from((0,Lln.canonicalJson)(n)).toString("base64url")!==e.ticket.split(".")[1])throw new Error("identity_hosted_tap_slip_request_invalid");let i=(0,b1t.computeJkt)(e.signer.publicJwk);if([t,n.rootJkt,n.runtimeJkt].includes(i))throw new Error("identity_slip_issuer_not_independent");let o=e.payload;if(!o||typeof o!="object"||o.kind!=="tap_signature_base"||(0,Bln.identityTapPayloadSha256)(o)!==n.payloadSha256||o.operationId!==n.operationId||o.intentHash!==n.intentHash)throw new Error("identity_hosted_tap_slip_payload_mismatch");let s=e.presence;if(!s||s.agentId!==n.agentId||s.runtimeId!==n.runtimeId||s.connectorKeyId!==n.connectorKeyId||s.operationId!==n.operationId||s.intentHash!==n.intentHash)throw new Error("identity_hosted_tap_connector_absent");if(!s.merchant||!v1t(o,s.merchant))throw new Error("identity_hosted_tap_merchant_mismatch");let a=await(0,qln.issueHostedTapIdentitySlip)({signer:e.signer,jti:n.jti,requestId:n.requestId,iat:n.iat,exp:n.exp,payloadSha256:n.payloadSha256,agentId:n.agentId,rootJkt:n.rootJkt,ownerSuborganizationId:n.ownerSuborganizationId,runtimeId:n.runtimeId,runtimeJkt:n.runtimeJkt,generation:n.generation,network:n.network}),c=await(0,jln.issueHostedConnectorProof)({signer:e.signer,requestId:n.requestId,agentId:n.agentId,runtimeId:n.runtimeId,connectorKeyId:n.connectorKeyId,grantId:n.grantId,grantVersion:n.grantVersion,operationId:n.operationId,intentHash:n.intentHash,issuedAtSec:e.nowSec});return{identitySlip:a,connectorProof:c,claims:n}}});var P1t=_(Gv=>{"use strict";Object.defineProperty(Gv,"__esModule",{value:!0});Gv.IDENTITY_DEVICE_HANDOFF_AUDIENCE=void 0;Gv.identityDeviceProposalSha256=w1t;Gv.identityDeviceHandoffIntentHash=I1t;Gv.verifyIdentityDeviceHandoffProof=Yln;var zln=require("node:crypto"),Gln=qf(),Kln=Hu(),Wln=Dy();Gv.IDENTITY_DEVICE_HANDOFF_AUDIENCE="visa-device-handoff:v1";var mB=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),A1t=e=>typeof e=="string"&&Buffer.from(e,"base64url").length===32&&Buffer.from(e,"base64url").toString("base64url")===e,BI=(e,t)=>e!==null&&typeof e=="object"&&!Array.isArray(e)&&Object.keys(e).sort().join(",")===t.sort().join(","),$Oe=e=>(0,zln.createHash)("sha256").update((0,Gln.canonicalJson)(e)).digest("base64url");function w1t(e){if(!BI(e,["associationId","associationVersion","agentId","rootJkt","runtimeId","runtimePublicJwk","runtimeJkt"])||![e.associationId,e.agentId,e.runtimeId].every(mB)||!Number.isSafeInteger(e.associationVersion)||e.associationVersion<1||![e.rootJkt,e.runtimeJkt].every(A1t)||e.rootJkt===e.runtimeJkt||!BI(e.runtimePublicJwk,["kty","crv","x"])||e.runtimePublicJwk.kty!=="OKP"||e.runtimePublicJwk.crv!=="Ed25519"||!A1t(e.runtimePublicJwk.x)||(0,Kln.computeJkt)(e.runtimePublicJwk)!==e.runtimeJkt)throw new Error("identity_device_proposal_invalid");return $Oe(e)}function I1t(e){if(!BI(e,["v","operation","requestId","handoffId","proposal","body"])||e.v!==1||!mB(e.requestId)||!mB(e.handoffId))throw new Error("identity_device_handoff_invalid");let t=w1t(e.proposal);if(e.operation==="create"){if(e.requestId!==e.handoffId||!BI(e.body,[]))throw new Error("identity_device_handoff_invalid")}else if(e.operation==="read"){if(!BI(e.body,[]))throw new Error("identity_device_handoff_invalid")}else if(e.operation==="cancel"){if(!BI(e.body,["enrollmentRequestId","generation"])||!(e.body.enrollmentRequestId===null&&e.body.generation===null)&&(!mB(e.body.enrollmentRequestId)||!Number.isSafeInteger(e.body.generation)||e.body.generation<1))throw new Error("identity_device_handoff_invalid")}else if(e.operation==="proof"){if(!BI(e.body,["enrollmentRequestId","runtimeProof"])||!mB(e.body.enrollmentRequestId)||typeof e.body.runtimeProof!="string"||e.body.runtimeProof.length!==86||Buffer.from(e.body.runtimeProof,"base64url").length!==64||Buffer.from(e.body.runtimeProof,"base64url").toString("base64url")!==e.body.runtimeProof)throw new Error("identity_device_handoff_invalid")}else throw new Error("identity_device_handoff_invalid");return $Oe({v:1,operation:e.operation,handoffId:e.handoffId,proposalSha256:t,bodySha256:$Oe(e.body)})}async function Yln(e,t,r){let n=await(0,Wln.verifyAgentOperationPopProof)(e,{operationId:t.requestId,audience:Gv.IDENTITY_DEVICE_HANDOFF_AUDIENCE,expectedIntentHash:I1t(t),nowSec:r,maxAgeSec:60});if(!n.ok||n.jkt!==t.proposal.runtimeJkt||n.runtimeCertificate!==void 0)throw new Error("identity_device_handoff_proof_invalid")}});var Eh=_(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=C.RUNTIME_CERTIFICATE_VERSION=C.RUNTIME_CERTIFICATE_TYP=C.verifyAgentOperationPopProof=C.verifyPopProof=C.createAgentOperationPopProof=C.createPopProofWithSigner=C.createPopProof=C.randomPopNonce=C.DEFAULT_POP_MAX_AGE_SEC=C.UNIVERSAL_AGENT_OPERATION_AUDIENCE=C.POP_JWT_TYP=C.importLegacyWalletSpendPolicy=C.canonicalLegacyWalletSpendPolicy=C.productSpendPolicyHash=C.isProductSpendPolicySubset=C.evaluateProductSpendPolicy=C.canonicalRuntimeProductSpendAttenuation=C.canonicalOwnerProductSpendPolicy=C.canonicalMerchantTarget=C.canonicalMerchantPathPrefix=C.canonicalMerchantOriginPattern=C.PRODUCT_SPEND_POLICY_VERSION=C.evaluateEconomic=C.verifyBindingChain=C.DEFAULT_MAX_STALENESS_SECONDS=C.InMemoryFreshnessStore=C.FreshnessService=C.verifyFreshness=C.issueFreshness=C.FRESHNESS_JWT_TYP=C.MAX_TTL_FRESH_HOURS=C.TTL_FRESH_HOURS=C.verifyRegistration=C.issueRegistration=C.registrationHash=C.derivePairwiseRef=C.REGISTRATION_JWT_TYP=C.TTL_REG_DAYS=C.isCanonicalEvmProviderAddress=C.canonicalEvmProviderAddress=C.turnkeyOwnerIdentityKey=C.verifyEip712TypedDataSignature=C.eip712DigestBase64Url=C.buildJwks=C.anchorKeyFromSeed=C.generateAnchorKey=C.agentKeyFromSeed=C.generateAgentKey=C.computeJkt=void 0;C.CHALLENGE_MAX_AGE_SEC=C.MAX_TTL_OWNERSHIP_HOURS=C.TTL_OWNERSHIP_HOURS=C.OWNERSHIP_PROOF_JWT_TYP=C.OWNERSHIP_CHALLENGE_DOMAIN_V1=C.canonicalIntentHash=C.INTENT_HASH_VERSION=C.verifyWalletBinding=C.issueWalletBinding=C.completeWalletBinding=C.prepareWalletBinding=C.WALLET_BINDING_DERIVATION_VERSION=C.WALLET_BINDING_SIGNER_KIND=C.WALLET_BINDING_MAX_TTL_SECONDS=C.WALLET_BINDING_VERSION=C.WALLET_BINDING_TYP=C.verifyTapRuntimeSignature=C.tapRuntimeSigningMessage=C.TAP_RUNTIME_SIGNATURE_DOMAIN=C.verifyRuntimeLeaseRequestProof=C.createRuntimeLeaseRequestProofWithSigner=C.createRuntimeLeaseRequestProof=C.runtimeLeaseRequestIntentHash=C.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS=C.RUNTIME_LEASE_REQUEST_AUDIENCE=C.RUNTIME_LEASE_REQUEST_VERSION=C.verifyRuntimeLeaseChain=C.verifyRuntimeDelegation=C.issueRuntimeLease=C.issueRuntimeDelegation=C.completeRuntimeDelegation=C.prepareRuntimeDelegation=C.RUNTIME_LEASE_SIGNING_MODES=C.RUNTIME_LEASE_PURPOSE=C.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS=C.RUNTIME_LEASE_MAX_TTL_SECONDS=C.RUNTIME_LEASE_AUDIENCE=C.RUNTIME_LEASE_VERSION=C.RUNTIME_LEASE_TYP=C.RUNTIME_DELEGATION_MAX_TTL_SECONDS=C.RUNTIME_DELEGATION_VERSION=C.RUNTIME_DELEGATION_TYP=C.verifyRuntimeCertificate=C.prepareRuntimeCertificate=C.peekRuntimeCertificate=C.issueRuntimeCertificate=C.completeRuntimeCertificate=C.HOSTED_RUNTIME_CERTIFICATE_PURPOSES=C.RUNTIME_CERTIFICATE_PURPOSES=C.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=void 0;C.pairingVerifierChallenge=C.randomPairingVerifier=C.randomSetupOperationId=C.randomHandoffId=C.randomAttachId=C.randomPairingId=C.assertAgentPairingTransition=C.canTransitionAgentPairing=C.isAgentPairingState=C.AGENT_PAIRING_TERMINAL_STATES=C.AGENT_PAIRING_STATES=C.AGENT_PAIRING_CODE_LENGTH=C.AGENT_PAIRING_CODE_ALPHABET=C.AGENT_PAIRING_TTL_SECONDS=C.AGENT_PAIRING_PROTOCOL_VERSION_V2=C.AGENT_PAIRING_PROTOCOL_VERSION=C.verifyGrant=C.issueGrantWithSigner=C.issueGrant=C.GRANT_RAILS=C.MAX_TTL_GRANT_DAYS=C.TTL_GRANT_DAYS=C.GRANT_JWT_TYP=C.KillList=C.attestationIsVoid=C.verifyKillSwitch=C.issueKillSwitch=C.verifySuccession=C.issueSuccession=C.KILL_SWITCH_JWT_TYP=C.SUCCESSION_JWT_TYP=C.verifyWalletAuthorizationPermit=C.issueWalletAuthorizationPermit=C.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS=C.WALLET_AUTHORIZATION_PERMIT_POLICY_ID=C.WALLET_AUTHORIZATION_PERMIT_AUDIENCE=C.WALLET_AUTHORIZATION_PERMIT_ISSUER=C.WALLET_AUTHORIZATION_PERMIT_JWT_TYP=C.issueRegistrationWithSigner=C.signerFromSignFn=C.signerFromAnchorKey=C.LocalSigner=C.signJwtWithSigner=C.walletVerifiedFromProof=C.verifyOwnershipProof=C.attestWalletOwnership=C.issueOwnershipProofWithSigner=C.issueOwnershipProof=C.verifyOwnershipSignature=C.buildOwnershipChallenge=void 0;C.authorizationScopeFacts=C.VIC_SETTLEMENT_ENVELOPE_VERSION=C.VIC_SETTLEMENT_ENVELOPE_KIND=C.VIC_PROCESSOR_ACTIONS=C.USD_MICROS_PER_CENT=C.AGENT_KEY_STATUSES=C.AGENT_KEY_PURPOSES=C.AGENT_KEY_CUSTODIES=C.AGENT_CHANNEL_STATUSES=C.AGENT_CHANNEL_ASSURANCES=C.AGENT_CHANNEL_KINDS=C.AGENT_EXECUTION_READINESS_REASONS=C.AGENT_AUTHORIZATION_SCOPES=C.AGENT_AUTHORITY_VALUATION_POLICY=C.AGENT_BUDGET_EPOCH_MODES=C.AGENT_AUTHORITY_VERSION=C.sha256=C.pairingInstrumentCommitment=C.pairingDeliveryArtifactV2Hash=C.canonicalPairingDeliveryArtifactV2=C.pairingArtifactHash=C.agentMailCredentialClaimMessageV2=C.keyRotationClaimHashV2=C.keyRotationClaimMessageV2=C.capabilityAttachActivationMessageV2=C.capabilityAttachClaimHashV2=C.capabilityAttachClaimMessageV2=C.handoffAuthorityCapabilities=C.AGENT_HANDOFF_COMPOUND_AUTHORITY=C.AGENT_HANDOFF_AUTHORITIES=C.AGENT_CAPABILITY_ATTACH_CAPABILITIES=C.pairingActivationMessageV2=C.pairingActivationMessage=C.pairingClaimHashV2=C.pairingClaimMessageV2=C.pairingClaimMessage=C.pairingTermsV2Hash=C.pairingTermsHash=C.canonicalPairingTermsV2=C.canonicalPairingTerms=C.setupConfirmationCode=C.pairingConfirmationCode=C.pairingCodeFromClaimToken=C.pairingClaimTokenHash=C.randomPairingClaimToken=C.pairingCodeHash=C.isValidPairingCode=C.formatPairingCode=C.normalizePairingCode=C.randomPairingCode=void 0;C.identityTapSigningBytes=C.hostedTapPayloadNamesMerchantRequest=C.issueHostedTapSlipFromTicket=C.validateIdentityHostedTapSlipRequest=C.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP=C.hostedPresenceAttemptId=C.issueHostedTapIdentitySlip=C.issueHostedPresenceIdentitySlip=C.IDENTITY_HOSTED_TAP_SLIP_PURPOSE=C.IDENTITY_PRESENCE_SLIP_PURPOSE=C.issueIdentityTapSlip=C.validateIdentityTapSlipRequest=C.IDENTITY_TAP_SLIP_REQUEST_TYP=C.verifyIdentityDeviceEnrollmentProof=C.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES=C.prepareIdentityHostedGateAuthorization=C.prepareIdentityDeviceGateAuthorization=C.identityDeviceEnrollmentPreimage=C.verifyIdentityTapLeaseRequestProof=C.createIdentityTapLeaseRequestProof=C.identityTapLeaseRequestIntentHash=C.issueIdentityTapLease=C.verifyIdentityTapDelegation=C.prepareIdentityTapDelegation=C.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE=C.IDENTITY_TAP_LEASE_AUDIENCE=C.IDENTITY_TAP_PURPOSE=C.IDENTITY_TAP_PROFILE=C.verifyIdentityPresenceLeaseChain=C.verifyHostedConnectorProof=C.issueIdentityPresenceLease=C.issueHostedConnectorProof=C.HOSTED_CONNECTOR_PROOF_TTL_SECONDS=C.HOSTED_CONNECTOR_PROOF_TYP=C.IDENTITY_PRESENCE_SIGNING_MODE=C.IDENTITY_PRESENCE_PURPOSE=C.IDENTITY_PRESENCE_LEASE_AUDIENCE=C.prepareIdentityPresenceDelegation=C.vicSettlementEnvelopeHash=C.usdcAtomicToUsdMicros=C.walletAuthorizationRequestHash=C.spendAuthorizationIntentHash=C.agentAuthorityGrantHash=C.isCanonicalBase64Url32=C.centsToUsdMicros=C.canonicalVicSettlementEnvelope=C.canonicalSpendAuthorizationIntent=C.canonicalAgentKeyDescriptor=C.canonicalAgentChannelDescriptor=C.canonicalAgentAuthorityGrant=void 0;C.verifyIdentityDeviceHandoffProof=C.identityDeviceHandoffIntentHash=C.identityDeviceProposalSha256=C.IDENTITY_DEVICE_HANDOFF_AUDIENCE=C.parseIdentityTapSignatureBase=C.identityTapPayloadSha256=void 0;var b8=Hu();Object.defineProperty(C,"computeJkt",{enumerable:!0,get:function(){return b8.computeJkt}});Object.defineProperty(C,"generateAgentKey",{enumerable:!0,get:function(){return b8.generateAgentKey}});Object.defineProperty(C,"agentKeyFromSeed",{enumerable:!0,get:function(){return b8.agentKeyFromSeed}});Object.defineProperty(C,"generateAnchorKey",{enumerable:!0,get:function(){return b8.generateAnchorKey}});Object.defineProperty(C,"anchorKeyFromSeed",{enumerable:!0,get:function(){return b8.anchorKeyFromSeed}});Object.defineProperty(C,"buildJwks",{enumerable:!0,get:function(){return b8.buildJwks}});var x1t=cPe();Object.defineProperty(C,"eip712DigestBase64Url",{enumerable:!0,get:function(){return x1t.eip712DigestBase64Url}});Object.defineProperty(C,"verifyEip712TypedDataSignature",{enumerable:!0,get:function(){return x1t.verifyEip712TypedDataSignature}});var Jln=Sft();Object.defineProperty(C,"turnkeyOwnerIdentityKey",{enumerable:!0,get:function(){return Jln.turnkeyOwnerIdentityKey}});var O1t=dPe();Object.defineProperty(C,"canonicalEvmProviderAddress",{enumerable:!0,get:function(){return O1t.canonicalEvmProviderAddress}});Object.defineProperty(C,"isCanonicalEvmProviderAddress",{enumerable:!0,get:function(){return O1t.isCanonicalEvmProviderAddress}});var E8=rB();Object.defineProperty(C,"TTL_REG_DAYS",{enumerable:!0,get:function(){return E8.TTL_REG_DAYS}});Object.defineProperty(C,"REGISTRATION_JWT_TYP",{enumerable:!0,get:function(){return E8.REGISTRATION_JWT_TYP}});Object.defineProperty(C,"derivePairwiseRef",{enumerable:!0,get:function(){return E8.derivePairwiseRef}});Object.defineProperty(C,"registrationHash",{enumerable:!0,get:function(){return E8.registrationHash}});Object.defineProperty(C,"issueRegistration",{enumerable:!0,get:function(){return E8.issueRegistration}});Object.defineProperty(C,"verifyRegistration",{enumerable:!0,get:function(){return E8.verifyRegistration}});var jI=j4e();Object.defineProperty(C,"TTL_FRESH_HOURS",{enumerable:!0,get:function(){return jI.TTL_FRESH_HOURS}});Object.defineProperty(C,"MAX_TTL_FRESH_HOURS",{enumerable:!0,get:function(){return jI.MAX_TTL_FRESH_HOURS}});Object.defineProperty(C,"FRESHNESS_JWT_TYP",{enumerable:!0,get:function(){return jI.FRESHNESS_JWT_TYP}});Object.defineProperty(C,"issueFreshness",{enumerable:!0,get:function(){return jI.issueFreshness}});Object.defineProperty(C,"verifyFreshness",{enumerable:!0,get:function(){return jI.verifyFreshness}});Object.defineProperty(C,"FreshnessService",{enumerable:!0,get:function(){return jI.FreshnessService}});Object.defineProperty(C,"InMemoryFreshnessStore",{enumerable:!0,get:function(){return jI.InMemoryFreshnessStore}});var R1t=q4e();Object.defineProperty(C,"DEFAULT_MAX_STALENESS_SECONDS",{enumerable:!0,get:function(){return R1t.DEFAULT_MAX_STALENESS_SECONDS}});Object.defineProperty(C,"verifyBindingChain",{enumerable:!0,get:function(){return R1t.verifyBindingChain}});var Xln=Lht();Object.defineProperty(C,"evaluateEconomic",{enumerable:!0,get:function(){return Xln.evaluateEconomic}});var Hy=uOe();Object.defineProperty(C,"PRODUCT_SPEND_POLICY_VERSION",{enumerable:!0,get:function(){return Hy.PRODUCT_SPEND_POLICY_VERSION}});Object.defineProperty(C,"canonicalMerchantOriginPattern",{enumerable:!0,get:function(){return Hy.canonicalMerchantOriginPattern}});Object.defineProperty(C,"canonicalMerchantPathPrefix",{enumerable:!0,get:function(){return Hy.canonicalMerchantPathPrefix}});Object.defineProperty(C,"canonicalMerchantTarget",{enumerable:!0,get:function(){return Hy.canonicalMerchantTarget}});Object.defineProperty(C,"canonicalOwnerProductSpendPolicy",{enumerable:!0,get:function(){return Hy.canonicalOwnerProductSpendPolicy}});Object.defineProperty(C,"canonicalRuntimeProductSpendAttenuation",{enumerable:!0,get:function(){return Hy.canonicalRuntimeProductSpendAttenuation}});Object.defineProperty(C,"evaluateProductSpendPolicy",{enumerable:!0,get:function(){return Hy.evaluateProductSpendPolicy}});Object.defineProperty(C,"isProductSpendPolicySubset",{enumerable:!0,get:function(){return Hy.isProductSpendPolicySubset}});Object.defineProperty(C,"productSpendPolicyHash",{enumerable:!0,get:function(){return Hy.productSpendPolicyHash}});var N1t=rgt();Object.defineProperty(C,"canonicalLegacyWalletSpendPolicy",{enumerable:!0,get:function(){return N1t.canonicalLegacyWalletSpendPolicy}});Object.defineProperty(C,"importLegacyWalletSpendPolicy",{enumerable:!0,get:function(){return N1t.importLegacyWalletSpendPolicy}});var Vy=Dy();Object.defineProperty(C,"POP_JWT_TYP",{enumerable:!0,get:function(){return Vy.POP_JWT_TYP}});Object.defineProperty(C,"UNIVERSAL_AGENT_OPERATION_AUDIENCE",{enumerable:!0,get:function(){return Vy.UNIVERSAL_AGENT_OPERATION_AUDIENCE}});Object.defineProperty(C,"DEFAULT_POP_MAX_AGE_SEC",{enumerable:!0,get:function(){return Vy.DEFAULT_POP_MAX_AGE_SEC}});Object.defineProperty(C,"randomPopNonce",{enumerable:!0,get:function(){return Vy.randomPopNonce}});Object.defineProperty(C,"createPopProof",{enumerable:!0,get:function(){return Vy.createPopProof}});Object.defineProperty(C,"createPopProofWithSigner",{enumerable:!0,get:function(){return Vy.createPopProofWithSigner}});Object.defineProperty(C,"createAgentOperationPopProof",{enumerable:!0,get:function(){return Vy.createAgentOperationPopProof}});Object.defineProperty(C,"verifyPopProof",{enumerable:!0,get:function(){return Vy.verifyPopProof}});Object.defineProperty(C,"verifyAgentOperationPopProof",{enumerable:!0,get:function(){return Vy.verifyAgentOperationPopProof}});var bh=hOe();Object.defineProperty(C,"RUNTIME_CERTIFICATE_TYP",{enumerable:!0,get:function(){return bh.RUNTIME_CERTIFICATE_TYP}});Object.defineProperty(C,"RUNTIME_CERTIFICATE_VERSION",{enumerable:!0,get:function(){return bh.RUNTIME_CERTIFICATE_VERSION}});Object.defineProperty(C,"RUNTIME_CERTIFICATE_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return bh.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS}});Object.defineProperty(C,"CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return bh.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS}});Object.defineProperty(C,"RUNTIME_CERTIFICATE_PURPOSES",{enumerable:!0,get:function(){return bh.RUNTIME_CERTIFICATE_PURPOSES}});Object.defineProperty(C,"HOSTED_RUNTIME_CERTIFICATE_PURPOSES",{enumerable:!0,get:function(){return bh.HOSTED_RUNTIME_CERTIFICATE_PURPOSES}});Object.defineProperty(C,"completeRuntimeCertificate",{enumerable:!0,get:function(){return bh.completeRuntimeCertificate}});Object.defineProperty(C,"issueRuntimeCertificate",{enumerable:!0,get:function(){return bh.issueRuntimeCertificate}});Object.defineProperty(C,"peekRuntimeCertificate",{enumerable:!0,get:function(){return bh.peekRuntimeCertificate}});Object.defineProperty(C,"prepareRuntimeCertificate",{enumerable:!0,get:function(){return bh.prepareRuntimeCertificate}});Object.defineProperty(C,"verifyRuntimeCertificate",{enumerable:!0,get:function(){return bh.verifyRuntimeCertificate}});var cu=ite();Object.defineProperty(C,"RUNTIME_DELEGATION_TYP",{enumerable:!0,get:function(){return cu.RUNTIME_DELEGATION_TYP}});Object.defineProperty(C,"RUNTIME_DELEGATION_VERSION",{enumerable:!0,get:function(){return cu.RUNTIME_DELEGATION_VERSION}});Object.defineProperty(C,"RUNTIME_DELEGATION_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return cu.RUNTIME_DELEGATION_MAX_TTL_SECONDS}});Object.defineProperty(C,"RUNTIME_LEASE_TYP",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_TYP}});Object.defineProperty(C,"RUNTIME_LEASE_VERSION",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_VERSION}});Object.defineProperty(C,"RUNTIME_LEASE_AUDIENCE",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_AUDIENCE}});Object.defineProperty(C,"RUNTIME_LEASE_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_MAX_TTL_SECONDS}});Object.defineProperty(C,"RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS",{enumerable:!0,get:function(){return cu.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS}});Object.defineProperty(C,"RUNTIME_LEASE_PURPOSE",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_PURPOSE}});Object.defineProperty(C,"RUNTIME_LEASE_SIGNING_MODES",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_SIGNING_MODES}});Object.defineProperty(C,"prepareRuntimeDelegation",{enumerable:!0,get:function(){return cu.prepareRuntimeDelegation}});Object.defineProperty(C,"completeRuntimeDelegation",{enumerable:!0,get:function(){return cu.completeRuntimeDelegation}});Object.defineProperty(C,"issueRuntimeDelegation",{enumerable:!0,get:function(){return cu.issueRuntimeDelegation}});Object.defineProperty(C,"issueRuntimeLease",{enumerable:!0,get:function(){return cu.issueRuntimeLease}});Object.defineProperty(C,"verifyRuntimeDelegation",{enumerable:!0,get:function(){return cu.verifyRuntimeDelegation}});Object.defineProperty(C,"verifyRuntimeLeaseChain",{enumerable:!0,get:function(){return cu.verifyRuntimeLeaseChain}});var qI=Egt();Object.defineProperty(C,"RUNTIME_LEASE_REQUEST_VERSION",{enumerable:!0,get:function(){return qI.RUNTIME_LEASE_REQUEST_VERSION}});Object.defineProperty(C,"RUNTIME_LEASE_REQUEST_AUDIENCE",{enumerable:!0,get:function(){return qI.RUNTIME_LEASE_REQUEST_AUDIENCE}});Object.defineProperty(C,"RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS",{enumerable:!0,get:function(){return qI.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS}});Object.defineProperty(C,"runtimeLeaseRequestIntentHash",{enumerable:!0,get:function(){return qI.runtimeLeaseRequestIntentHash}});Object.defineProperty(C,"createRuntimeLeaseRequestProof",{enumerable:!0,get:function(){return qI.createRuntimeLeaseRequestProof}});Object.defineProperty(C,"createRuntimeLeaseRequestProofWithSigner",{enumerable:!0,get:function(){return qI.createRuntimeLeaseRequestProofWithSigner}});Object.defineProperty(C,"verifyRuntimeLeaseRequestProof",{enumerable:!0,get:function(){return qI.verifyRuntimeLeaseRequestProof}});var zOe=Tgt();Object.defineProperty(C,"TAP_RUNTIME_SIGNATURE_DOMAIN",{enumerable:!0,get:function(){return zOe.TAP_RUNTIME_SIGNATURE_DOMAIN}});Object.defineProperty(C,"tapRuntimeSigningMessage",{enumerable:!0,get:function(){return zOe.tapRuntimeSigningMessage}});Object.defineProperty(C,"verifyTapRuntimeSignature",{enumerable:!0,get:function(){return zOe.verifyTapRuntimeSignature}});var Fy=kgt();Object.defineProperty(C,"WALLET_BINDING_TYP",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_TYP}});Object.defineProperty(C,"WALLET_BINDING_VERSION",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_VERSION}});Object.defineProperty(C,"WALLET_BINDING_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_MAX_TTL_SECONDS}});Object.defineProperty(C,"WALLET_BINDING_SIGNER_KIND",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_SIGNER_KIND}});Object.defineProperty(C,"WALLET_BINDING_DERIVATION_VERSION",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_DERIVATION_VERSION}});Object.defineProperty(C,"prepareWalletBinding",{enumerable:!0,get:function(){return Fy.prepareWalletBinding}});Object.defineProperty(C,"completeWalletBinding",{enumerable:!0,get:function(){return Fy.completeWalletBinding}});Object.defineProperty(C,"issueWalletBinding",{enumerable:!0,get:function(){return Fy.issueWalletBinding}});Object.defineProperty(C,"verifyWalletBinding",{enumerable:!0,get:function(){return Fy.verifyWalletBinding}});var C1t=Dgt();Object.defineProperty(C,"INTENT_HASH_VERSION",{enumerable:!0,get:function(){return C1t.INTENT_HASH_VERSION}});Object.defineProperty(C,"canonicalIntentHash",{enumerable:!0,get:function(){return C1t.canonicalIntentHash}});var Vf=$4e();Object.defineProperty(C,"OWNERSHIP_CHALLENGE_DOMAIN_V1",{enumerable:!0,get:function(){return Vf.OWNERSHIP_CHALLENGE_DOMAIN_V1}});Object.defineProperty(C,"OWNERSHIP_PROOF_JWT_TYP",{enumerable:!0,get:function(){return Vf.OWNERSHIP_PROOF_JWT_TYP}});Object.defineProperty(C,"TTL_OWNERSHIP_HOURS",{enumerable:!0,get:function(){return Vf.TTL_OWNERSHIP_HOURS}});Object.defineProperty(C,"MAX_TTL_OWNERSHIP_HOURS",{enumerable:!0,get:function(){return Vf.MAX_TTL_OWNERSHIP_HOURS}});Object.defineProperty(C,"CHALLENGE_MAX_AGE_SEC",{enumerable:!0,get:function(){return Vf.CHALLENGE_MAX_AGE_SEC}});Object.defineProperty(C,"buildOwnershipChallenge",{enumerable:!0,get:function(){return Vf.buildOwnershipChallenge}});Object.defineProperty(C,"verifyOwnershipSignature",{enumerable:!0,get:function(){return Vf.verifyOwnershipSignature}});Object.defineProperty(C,"issueOwnershipProof",{enumerable:!0,get:function(){return Vf.issueOwnershipProof}});Object.defineProperty(C,"issueOwnershipProofWithSigner",{enumerable:!0,get:function(){return Vf.issueOwnershipProofWithSigner}});Object.defineProperty(C,"attestWalletOwnership",{enumerable:!0,get:function(){return Vf.attestWalletOwnership}});Object.defineProperty(C,"verifyOwnershipProof",{enumerable:!0,get:function(){return Vf.verifyOwnershipProof}});Object.defineProperty(C,"walletVerifiedFromProof",{enumerable:!0,get:function(){return Vf.walletVerifiedFromProof}});var hB=Lv();Object.defineProperty(C,"signJwtWithSigner",{enumerable:!0,get:function(){return hB.signJwtWithSigner}});Object.defineProperty(C,"LocalSigner",{enumerable:!0,get:function(){return hB.LocalSigner}});Object.defineProperty(C,"signerFromAnchorKey",{enumerable:!0,get:function(){return hB.signerFromAnchorKey}});Object.defineProperty(C,"signerFromSignFn",{enumerable:!0,get:function(){return hB.signerFromSignFn}});Object.defineProperty(C,"issueRegistrationWithSigner",{enumerable:!0,get:function(){return hB.issueRegistrationWithSigner}});var HI=Vgt();Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_JWT_TYP",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_JWT_TYP}});Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_ISSUER",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_ISSUER}});Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_AUDIENCE",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_AUDIENCE}});Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_POLICY_ID",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_POLICY_ID}});Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS}});Object.defineProperty(C,"issueWalletAuthorizationPermit",{enumerable:!0,get:function(){return HI.issueWalletAuthorizationPermit}});Object.defineProperty(C,"verifyWalletAuthorizationPermit",{enumerable:!0,get:function(){return HI.verifyWalletAuthorizationPermit}});var Kv=zgt();Object.defineProperty(C,"SUCCESSION_JWT_TYP",{enumerable:!0,get:function(){return Kv.SUCCESSION_JWT_TYP}});Object.defineProperty(C,"KILL_SWITCH_JWT_TYP",{enumerable:!0,get:function(){return Kv.KILL_SWITCH_JWT_TYP}});Object.defineProperty(C,"issueSuccession",{enumerable:!0,get:function(){return Kv.issueSuccession}});Object.defineProperty(C,"verifySuccession",{enumerable:!0,get:function(){return Kv.verifySuccession}});Object.defineProperty(C,"issueKillSwitch",{enumerable:!0,get:function(){return Kv.issueKillSwitch}});Object.defineProperty(C,"verifyKillSwitch",{enumerable:!0,get:function(){return Kv.verifyKillSwitch}});Object.defineProperty(C,"attestationIsVoid",{enumerable:!0,get:function(){return Kv.attestationIsVoid}});Object.defineProperty(C,"KillList",{enumerable:!0,get:function(){return Kv.KillList}});var VI=Jgt();Object.defineProperty(C,"GRANT_JWT_TYP",{enumerable:!0,get:function(){return VI.GRANT_JWT_TYP}});Object.defineProperty(C,"TTL_GRANT_DAYS",{enumerable:!0,get:function(){return VI.TTL_GRANT_DAYS}});Object.defineProperty(C,"MAX_TTL_GRANT_DAYS",{enumerable:!0,get:function(){return VI.MAX_TTL_GRANT_DAYS}});Object.defineProperty(C,"GRANT_RAILS",{enumerable:!0,get:function(){return VI.GRANT_RAILS}});Object.defineProperty(C,"issueGrant",{enumerable:!0,get:function(){return VI.issueGrant}});Object.defineProperty(C,"issueGrantWithSigner",{enumerable:!0,get:function(){return VI.issueGrantWithSigner}});Object.defineProperty(C,"verifyGrant",{enumerable:!0,get:function(){return VI.verifyGrant}});var Nt=Zgt();Object.defineProperty(C,"AGENT_PAIRING_PROTOCOL_VERSION",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_PROTOCOL_VERSION}});Object.defineProperty(C,"AGENT_PAIRING_PROTOCOL_VERSION_V2",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_PROTOCOL_VERSION_V2}});Object.defineProperty(C,"AGENT_PAIRING_TTL_SECONDS",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_TTL_SECONDS}});Object.defineProperty(C,"AGENT_PAIRING_CODE_ALPHABET",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_CODE_ALPHABET}});Object.defineProperty(C,"AGENT_PAIRING_CODE_LENGTH",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_CODE_LENGTH}});Object.defineProperty(C,"AGENT_PAIRING_STATES",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_STATES}});Object.defineProperty(C,"AGENT_PAIRING_TERMINAL_STATES",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_TERMINAL_STATES}});Object.defineProperty(C,"isAgentPairingState",{enumerable:!0,get:function(){return Nt.isAgentPairingState}});Object.defineProperty(C,"canTransitionAgentPairing",{enumerable:!0,get:function(){return Nt.canTransitionAgentPairing}});Object.defineProperty(C,"assertAgentPairingTransition",{enumerable:!0,get:function(){return Nt.assertAgentPairingTransition}});Object.defineProperty(C,"randomPairingId",{enumerable:!0,get:function(){return Nt.randomPairingId}});Object.defineProperty(C,"randomAttachId",{enumerable:!0,get:function(){return Nt.randomAttachId}});Object.defineProperty(C,"randomHandoffId",{enumerable:!0,get:function(){return Nt.randomHandoffId}});Object.defineProperty(C,"randomSetupOperationId",{enumerable:!0,get:function(){return Nt.randomSetupOperationId}});Object.defineProperty(C,"randomPairingVerifier",{enumerable:!0,get:function(){return Nt.randomPairingVerifier}});Object.defineProperty(C,"pairingVerifierChallenge",{enumerable:!0,get:function(){return Nt.pairingVerifierChallenge}});Object.defineProperty(C,"randomPairingCode",{enumerable:!0,get:function(){return Nt.randomPairingCode}});Object.defineProperty(C,"normalizePairingCode",{enumerable:!0,get:function(){return Nt.normalizePairingCode}});Object.defineProperty(C,"formatPairingCode",{enumerable:!0,get:function(){return Nt.formatPairingCode}});Object.defineProperty(C,"isValidPairingCode",{enumerable:!0,get:function(){return Nt.isValidPairingCode}});Object.defineProperty(C,"pairingCodeHash",{enumerable:!0,get:function(){return Nt.pairingCodeHash}});Object.defineProperty(C,"randomPairingClaimToken",{enumerable:!0,get:function(){return Nt.randomPairingClaimToken}});Object.defineProperty(C,"pairingClaimTokenHash",{enumerable:!0,get:function(){return Nt.pairingClaimTokenHash}});Object.defineProperty(C,"pairingCodeFromClaimToken",{enumerable:!0,get:function(){return Nt.pairingCodeFromClaimToken}});Object.defineProperty(C,"pairingConfirmationCode",{enumerable:!0,get:function(){return Nt.pairingConfirmationCode}});Object.defineProperty(C,"setupConfirmationCode",{enumerable:!0,get:function(){return Nt.setupConfirmationCode}});Object.defineProperty(C,"canonicalPairingTerms",{enumerable:!0,get:function(){return Nt.canonicalPairingTerms}});Object.defineProperty(C,"canonicalPairingTermsV2",{enumerable:!0,get:function(){return Nt.canonicalPairingTermsV2}});Object.defineProperty(C,"pairingTermsHash",{enumerable:!0,get:function(){return Nt.pairingTermsHash}});Object.defineProperty(C,"pairingTermsV2Hash",{enumerable:!0,get:function(){return Nt.pairingTermsV2Hash}});Object.defineProperty(C,"pairingClaimMessage",{enumerable:!0,get:function(){return Nt.pairingClaimMessage}});Object.defineProperty(C,"pairingClaimMessageV2",{enumerable:!0,get:function(){return Nt.pairingClaimMessageV2}});Object.defineProperty(C,"pairingClaimHashV2",{enumerable:!0,get:function(){return Nt.pairingClaimHashV2}});Object.defineProperty(C,"pairingActivationMessage",{enumerable:!0,get:function(){return Nt.pairingActivationMessage}});Object.defineProperty(C,"pairingActivationMessageV2",{enumerable:!0,get:function(){return Nt.pairingActivationMessageV2}});Object.defineProperty(C,"AGENT_CAPABILITY_ATTACH_CAPABILITIES",{enumerable:!0,get:function(){return Nt.AGENT_CAPABILITY_ATTACH_CAPABILITIES}});Object.defineProperty(C,"AGENT_HANDOFF_AUTHORITIES",{enumerable:!0,get:function(){return Nt.AGENT_HANDOFF_AUTHORITIES}});Object.defineProperty(C,"AGENT_HANDOFF_COMPOUND_AUTHORITY",{enumerable:!0,get:function(){return Nt.AGENT_HANDOFF_COMPOUND_AUTHORITY}});Object.defineProperty(C,"handoffAuthorityCapabilities",{enumerable:!0,get:function(){return Nt.handoffAuthorityCapabilities}});Object.defineProperty(C,"capabilityAttachClaimMessageV2",{enumerable:!0,get:function(){return Nt.capabilityAttachClaimMessageV2}});Object.defineProperty(C,"capabilityAttachClaimHashV2",{enumerable:!0,get:function(){return Nt.capabilityAttachClaimHashV2}});Object.defineProperty(C,"capabilityAttachActivationMessageV2",{enumerable:!0,get:function(){return Nt.capabilityAttachActivationMessageV2}});Object.defineProperty(C,"keyRotationClaimMessageV2",{enumerable:!0,get:function(){return Nt.keyRotationClaimMessageV2}});Object.defineProperty(C,"keyRotationClaimHashV2",{enumerable:!0,get:function(){return Nt.keyRotationClaimHashV2}});Object.defineProperty(C,"agentMailCredentialClaimMessageV2",{enumerable:!0,get:function(){return Nt.agentMailCredentialClaimMessageV2}});Object.defineProperty(C,"pairingArtifactHash",{enumerable:!0,get:function(){return Nt.pairingArtifactHash}});Object.defineProperty(C,"canonicalPairingDeliveryArtifactV2",{enumerable:!0,get:function(){return Nt.canonicalPairingDeliveryArtifactV2}});Object.defineProperty(C,"pairingDeliveryArtifactV2Hash",{enumerable:!0,get:function(){return Nt.pairingDeliveryArtifactV2Hash}});Object.defineProperty(C,"pairingInstrumentCommitment",{enumerable:!0,get:function(){return Nt.pairingInstrumentCommitment}});Object.defineProperty(C,"sha256",{enumerable:!0,get:function(){return Nt.sha256}});var Rn=dD();Object.defineProperty(C,"AGENT_AUTHORITY_VERSION",{enumerable:!0,get:function(){return Rn.AGENT_AUTHORITY_VERSION}});Object.defineProperty(C,"AGENT_BUDGET_EPOCH_MODES",{enumerable:!0,get:function(){return Rn.AGENT_BUDGET_EPOCH_MODES}});Object.defineProperty(C,"AGENT_AUTHORITY_VALUATION_POLICY",{enumerable:!0,get:function(){return Rn.AGENT_AUTHORITY_VALUATION_POLICY}});Object.defineProperty(C,"AGENT_AUTHORIZATION_SCOPES",{enumerable:!0,get:function(){return Rn.AGENT_AUTHORIZATION_SCOPES}});Object.defineProperty(C,"AGENT_EXECUTION_READINESS_REASONS",{enumerable:!0,get:function(){return Rn.AGENT_EXECUTION_READINESS_REASONS}});Object.defineProperty(C,"AGENT_CHANNEL_KINDS",{enumerable:!0,get:function(){return Rn.AGENT_CHANNEL_KINDS}});Object.defineProperty(C,"AGENT_CHANNEL_ASSURANCES",{enumerable:!0,get:function(){return Rn.AGENT_CHANNEL_ASSURANCES}});Object.defineProperty(C,"AGENT_CHANNEL_STATUSES",{enumerable:!0,get:function(){return Rn.AGENT_CHANNEL_STATUSES}});Object.defineProperty(C,"AGENT_KEY_CUSTODIES",{enumerable:!0,get:function(){return Rn.AGENT_KEY_CUSTODIES}});Object.defineProperty(C,"AGENT_KEY_PURPOSES",{enumerable:!0,get:function(){return Rn.AGENT_KEY_PURPOSES}});Object.defineProperty(C,"AGENT_KEY_STATUSES",{enumerable:!0,get:function(){return Rn.AGENT_KEY_STATUSES}});Object.defineProperty(C,"USD_MICROS_PER_CENT",{enumerable:!0,get:function(){return Rn.USD_MICROS_PER_CENT}});Object.defineProperty(C,"VIC_PROCESSOR_ACTIONS",{enumerable:!0,get:function(){return Rn.VIC_PROCESSOR_ACTIONS}});Object.defineProperty(C,"VIC_SETTLEMENT_ENVELOPE_KIND",{enumerable:!0,get:function(){return Rn.VIC_SETTLEMENT_ENVELOPE_KIND}});Object.defineProperty(C,"VIC_SETTLEMENT_ENVELOPE_VERSION",{enumerable:!0,get:function(){return Rn.VIC_SETTLEMENT_ENVELOPE_VERSION}});Object.defineProperty(C,"authorizationScopeFacts",{enumerable:!0,get:function(){return Rn.authorizationScopeFacts}});Object.defineProperty(C,"canonicalAgentAuthorityGrant",{enumerable:!0,get:function(){return Rn.canonicalAgentAuthorityGrant}});Object.defineProperty(C,"canonicalAgentChannelDescriptor",{enumerable:!0,get:function(){return Rn.canonicalAgentChannelDescriptor}});Object.defineProperty(C,"canonicalAgentKeyDescriptor",{enumerable:!0,get:function(){return Rn.canonicalAgentKeyDescriptor}});Object.defineProperty(C,"canonicalSpendAuthorizationIntent",{enumerable:!0,get:function(){return Rn.canonicalSpendAuthorizationIntent}});Object.defineProperty(C,"canonicalVicSettlementEnvelope",{enumerable:!0,get:function(){return Rn.canonicalVicSettlementEnvelope}});Object.defineProperty(C,"centsToUsdMicros",{enumerable:!0,get:function(){return Rn.centsToUsdMicros}});Object.defineProperty(C,"isCanonicalBase64Url32",{enumerable:!0,get:function(){return Rn.isCanonicalBase64Url32}});Object.defineProperty(C,"agentAuthorityGrantHash",{enumerable:!0,get:function(){return Rn.agentAuthorityGrantHash}});Object.defineProperty(C,"spendAuthorizationIntentHash",{enumerable:!0,get:function(){return Rn.spendAuthorizationIntentHash}});Object.defineProperty(C,"walletAuthorizationRequestHash",{enumerable:!0,get:function(){return Rn.walletAuthorizationRequestHash}});Object.defineProperty(C,"usdcAtomicToUsdMicros",{enumerable:!0,get:function(){return Rn.usdcAtomicToUsdMicros}});Object.defineProperty(C,"vicSettlementEnvelopeHash",{enumerable:!0,get:function(){return Rn.vicSettlementEnvelopeHash}});var Zln=Qgt();Object.defineProperty(C,"prepareIdentityPresenceDelegation",{enumerable:!0,get:function(){return Zln.prepareIdentityPresenceDelegation}});var $y=DOe();Object.defineProperty(C,"IDENTITY_PRESENCE_LEASE_AUDIENCE",{enumerable:!0,get:function(){return $y.IDENTITY_PRESENCE_LEASE_AUDIENCE}});Object.defineProperty(C,"IDENTITY_PRESENCE_PURPOSE",{enumerable:!0,get:function(){return $y.IDENTITY_PRESENCE_PURPOSE}});Object.defineProperty(C,"IDENTITY_PRESENCE_SIGNING_MODE",{enumerable:!0,get:function(){return $y.IDENTITY_PRESENCE_SIGNING_MODE}});Object.defineProperty(C,"HOSTED_CONNECTOR_PROOF_TYP",{enumerable:!0,get:function(){return $y.HOSTED_CONNECTOR_PROOF_TYP}});Object.defineProperty(C,"HOSTED_CONNECTOR_PROOF_TTL_SECONDS",{enumerable:!0,get:function(){return $y.HOSTED_CONNECTOR_PROOF_TTL_SECONDS}});Object.defineProperty(C,"issueHostedConnectorProof",{enumerable:!0,get:function(){return $y.issueHostedConnectorProof}});Object.defineProperty(C,"issueIdentityPresenceLease",{enumerable:!0,get:function(){return $y.issueIdentityPresenceLease}});Object.defineProperty(C,"verifyHostedConnectorProof",{enumerable:!0,get:function(){return $y.verifyHostedConnectorProof}});Object.defineProperty(C,"verifyIdentityPresenceLeaseChain",{enumerable:!0,get:function(){return $y.verifyIdentityPresenceLeaseChain}});var wg=jOe();Object.defineProperty(C,"IDENTITY_TAP_PROFILE",{enumerable:!0,get:function(){return wg.IDENTITY_TAP_PROFILE}});Object.defineProperty(C,"IDENTITY_TAP_PURPOSE",{enumerable:!0,get:function(){return wg.IDENTITY_TAP_PURPOSE}});Object.defineProperty(C,"IDENTITY_TAP_LEASE_AUDIENCE",{enumerable:!0,get:function(){return wg.IDENTITY_TAP_LEASE_AUDIENCE}});Object.defineProperty(C,"IDENTITY_TAP_LEASE_REQUEST_AUDIENCE",{enumerable:!0,get:function(){return wg.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE}});Object.defineProperty(C,"prepareIdentityTapDelegation",{enumerable:!0,get:function(){return wg.prepareIdentityTapDelegation}});Object.defineProperty(C,"verifyIdentityTapDelegation",{enumerable:!0,get:function(){return wg.verifyIdentityTapDelegation}});Object.defineProperty(C,"issueIdentityTapLease",{enumerable:!0,get:function(){return wg.issueIdentityTapLease}});Object.defineProperty(C,"identityTapLeaseRequestIntentHash",{enumerable:!0,get:function(){return wg.identityTapLeaseRequestIntentHash}});Object.defineProperty(C,"createIdentityTapLeaseRequestProof",{enumerable:!0,get:function(){return wg.createIdentityTapLeaseRequestProof}});Object.defineProperty(C,"verifyIdentityTapLeaseRequestProof",{enumerable:!0,get:function(){return wg.verifyIdentityTapLeaseRequestProof}});var gB=m1t();Object.defineProperty(C,"identityDeviceEnrollmentPreimage",{enumerable:!0,get:function(){return gB.identityDeviceEnrollmentPreimage}});Object.defineProperty(C,"prepareIdentityDeviceGateAuthorization",{enumerable:!0,get:function(){return gB.prepareIdentityDeviceGateAuthorization}});Object.defineProperty(C,"prepareIdentityHostedGateAuthorization",{enumerable:!0,get:function(){return gB.prepareIdentityHostedGateAuthorization}});Object.defineProperty(C,"IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES",{enumerable:!0,get:function(){return gB.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES}});Object.defineProperty(C,"verifyIdentityDeviceEnrollmentProof",{enumerable:!0,get:function(){return gB.verifyIdentityDeviceEnrollmentProof}});var GOe=_1t();Object.defineProperty(C,"IDENTITY_TAP_SLIP_REQUEST_TYP",{enumerable:!0,get:function(){return GOe.IDENTITY_TAP_SLIP_REQUEST_TYP}});Object.defineProperty(C,"validateIdentityTapSlipRequest",{enumerable:!0,get:function(){return GOe.validateIdentityTapSlipRequest}});Object.defineProperty(C,"issueIdentityTapSlip",{enumerable:!0,get:function(){return GOe.issueIdentityTapSlip}});var _B=FOe();Object.defineProperty(C,"IDENTITY_PRESENCE_SLIP_PURPOSE",{enumerable:!0,get:function(){return _B.IDENTITY_PRESENCE_SLIP_PURPOSE}});Object.defineProperty(C,"IDENTITY_HOSTED_TAP_SLIP_PURPOSE",{enumerable:!0,get:function(){return _B.IDENTITY_HOSTED_TAP_SLIP_PURPOSE}});Object.defineProperty(C,"issueHostedPresenceIdentitySlip",{enumerable:!0,get:function(){return _B.issueHostedPresenceIdentitySlip}});Object.defineProperty(C,"issueHostedTapIdentitySlip",{enumerable:!0,get:function(){return _B.issueHostedTapIdentitySlip}});Object.defineProperty(C,"hostedPresenceAttemptId",{enumerable:!0,get:function(){return _B.hostedPresenceAttemptId}});var pte=T1t();Object.defineProperty(C,"IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP",{enumerable:!0,get:function(){return pte.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP}});Object.defineProperty(C,"validateIdentityHostedTapSlipRequest",{enumerable:!0,get:function(){return pte.validateIdentityHostedTapSlipRequest}});Object.defineProperty(C,"issueHostedTapSlipFromTicket",{enumerable:!0,get:function(){return pte.issueHostedTapSlipFromTicket}});Object.defineProperty(C,"hostedTapPayloadNamesMerchantRequest",{enumerable:!0,get:function(){return pte.hostedTapPayloadNamesMerchantRequest}});var KOe=lte();Object.defineProperty(C,"identityTapSigningBytes",{enumerable:!0,get:function(){return KOe.identityTapSigningBytes}});Object.defineProperty(C,"identityTapPayloadSha256",{enumerable:!0,get:function(){return KOe.identityTapPayloadSha256}});Object.defineProperty(C,"parseIdentityTapSignatureBase",{enumerable:!0,get:function(){return KOe.parseIdentityTapSignatureBase}});var fte=P1t();Object.defineProperty(C,"IDENTITY_DEVICE_HANDOFF_AUDIENCE",{enumerable:!0,get:function(){return fte.IDENTITY_DEVICE_HANDOFF_AUDIENCE}});Object.defineProperty(C,"identityDeviceProposalSha256",{enumerable:!0,get:function(){return fte.identityDeviceProposalSha256}});Object.defineProperty(C,"identityDeviceHandoffIntentHash",{enumerable:!0,get:function(){return fte.identityDeviceHandoffIntentHash}});Object.defineProperty(C,"verifyIdentityDeviceHandoffProof",{enumerable:!0,get:function(){return fte.verifyIdentityDeviceHandoffProof}})});var m_t=_((wNi,f_t)=>{"use strict";var Qln=Object.create,Ste=Object.defineProperty,epn=Object.getOwnPropertyDescriptor,$1t=Object.getOwnPropertyNames,tpn=Object.getPrototypeOf,rpn=Object.prototype.hasOwnProperty,npn=(e,t)=>function(){try{return t||(0,e[$1t(e)[0]])((t={exports:{}}).exports,t),t.exports}catch(n){throw t=0,n}},ipn=(e,t)=>{for(var r in t)Ste(e,r,{get:t[r],enumerable:!0})},z1t=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of $1t(t))!rpn.call(e,i)&&i!==r&&Ste(e,i,{get:()=>t[i],enumerable:!(n=epn(t,i))||n.enumerable});return e},opn=(e,t,r)=>(r=e!=null?Qln(tpn(e)):{},z1t(t||!e||!e.__esModule?Ste(r,"default",{value:e,enumerable:!0}):r,e)),spn=e=>z1t(Ste({},"__esModule",{value:!0}),e),apn=npn({"../shared/dist/canonical-contract.js"(e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.CANONICAL_OPAQUE_ID_MAX_BYTES=e.CANONICAL_OPAQUE_ID_RE=e.CANONICAL_OPAQUE_ID_PATTERN=void 0,e.utf8ByteLength=n,e.isCanonicalText=i,e.compareCanonicalKeys=o,e.isCanonicalOpaqueId=s,e.assertCanonicalOpaqueId=a,e.CANONICAL_OPAQUE_ID_PATTERN="^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",e.CANONICAL_OPAQUE_ID_RE=new RegExp(e.CANONICAL_OPAQUE_ID_PATTERN),e.CANONICAL_OPAQUE_ID_MAX_BYTES=128;var t=/[\u0000-\u001f\u007f\u2028\u2029]/,r=new TextEncoder;function n(c){return r.encode(c).length}function i(c,u){return typeof c=="string"&&c.length>0&&n(c)<=u&&c.trim()===c&&c.normalize("NFC")===c&&!t.test(c)}function o(c,u){let d=r.encode(c),l=r.encode(u),p=Math.min(d.length,l.length);for(let f=0;f<p;f+=1)if(d[f]!==l[f])return d[f]-l[f];return d.length-l.length}function s(c){return typeof c=="string"&&n(c)<=e.CANONICAL_OPAQUE_ID_MAX_BYTES&&e.CANONICAL_OPAQUE_ID_RE.test(c)}function a(c,u="value"){if(!s(c))throw new Error(`${u} must be a canonical opaque id (max 128 ASCII bytes)`)}}}),G1t={};ipn(G1t,{AGENT_AUTHORITY_VALUATION_POLICY:()=>yte,AGENT_AUTHORITY_VERSION:()=>bB,AGENT_AUTHORIZATION_SCOPES:()=>oRe,AGENT_BUDGET_EPOCH_MODES:()=>Q1t,AGENT_CHANNEL_ASSURANCES:()=>s_t,AGENT_CHANNEL_KINDS:()=>i_t,AGENT_CHANNEL_STATUSES:()=>o_t,AGENT_EXECUTION_READINESS_REASONS:()=>Upn,AGENT_KEY_CUSTODIES:()=>r_t,AGENT_KEY_PURPOSES:()=>t_t,AGENT_KEY_STATUSES:()=>n_t,USD_MICROS_PER_CENT:()=>Ate,VIC_PROCESSOR_ACTIONS:()=>e_t,VIC_SETTLEMENT_ENVELOPE_KIND:()=>_te,VIC_SETTLEMENT_ENVELOPE_VERSION:()=>gte,agentAuthorityGrantHash:()=>Zpn,authorizationScopeFacts:()=>Wpn,canonicalAgentAuthorityGrant:()=>d_t,canonicalAgentChannelDescriptor:()=>Xpn,canonicalAgentKeyDescriptor:()=>Ypn,canonicalSpendAuthorizationIntent:()=>sRe,canonicalVicSettlementEnvelope:()=>l_t,centsToUsdMicros:()=>Gpn,isCanonicalBase64Url32:()=>Qv,spendAuthorizationIntentHash:()=>p_t,usdcAtomicToUsdMicros:()=>Kpn,vicSettlementEnvelopeHash:()=>Qpn,walletAuthorizationRequestHash:()=>efn});f_t.exports=spn(G1t);var cpn=e=>e/2**32|0,upn=e=>e>>>0;function dpn(e,t,r,n){let i=cpn(r),o=upn(r);e.setUint32(t,n?o:i,n),e.setUint32(t+4,n?i:o,n)}function M1t(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in e&&e.BYTES_PER_ELEMENT===1}var JOe=e=>e?`"${e}" `:"";function lpn(e,t=""){if(typeof e!="number")throw new TypeError(JOe(t)+"expected number, got "+typeof e);if(!Number.isSafeInteger(e)||e<0)throw new RangeError(JOe(t)+"expected integer >= 0, got "+e);return e}function K1t(e,t,r=""){if(M1t(e)&&(t===void 0||e.length===t))return e;t!==void 0&&lpn(t,"length");let n=M1t(e),i=t!==void 0?` of length ${t}`:"",o=n?`length=${e.length}`:`type=${typeof e}`,s=JOe(r)+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)}var ppn=(e,t)=>{if(e===null||typeof e!="object"||Array.isArray(e))throw new TypeError((t==="object"?"":`"${t}" `)+"expected object, got type="+typeof e)},k1t=(e,t)=>{ppn(e,t);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${t}" expected plain object`);if(Object.hasOwn(e,"__proto__"))throw new TypeError(`"${t}.__proto__" is not allowed`)};function D1t(e,t=!0){if(e.destroyed)throw new Error("hash was destroyed");if(t&&e.finished)throw new Error("digest() was already called")}function fpn(e,t){K1t(e,void 0,"output");let r=t.outputLen;if(!(e.length>=r))throw new RangeError('"output" expected length >= '+r)}function L1t(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function WOe(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function Ig(e,t){return e<<32-t|e>>>t}function mpn(e,t,r="opts"){return k1t(e,"defaults"),t!==void 0&&k1t(t,r),Object.assign(Object.create(null),e,t)}function hpn(e,t={}){if(typeof e!="function")throw new TypeError('"hashCons" expected function, got type='+typeof e);t=mpn({},t,"info");let r=(i,o)=>e(o).update(i).digest(),n=e(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>e(i),Object.assign(r,t),Object.freeze(r)}var gpn=e=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,e])});function _pn(e,t,r){return e&t^~e&r}function ypn(e,t,r){return e&t^e&r^t&r}var bpn=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,t,r,n){this.blockLen=e,this.outputLen=t,this.padOffset=r,this.isLE=n,this.buffer=new Uint8Array(e),this.view=WOe(this.buffer)}update(e){D1t(this),K1t(e);let{view:t,buffer:r,blockLen:n}=this,i=e.length,o=!1;for(let s=0;s<i;){let a=Math.min(n-this.pos,i-s);if(a===n){let c=WOe(e);for(;n<=i-s;s+=n)this.process(c,s);o=!0;continue}r.set(s===0&&a===i?e:e.subarray(s,s+a),this.pos),this.pos+=a,s+=a,this.pos===n&&(this.process(t,0),this.pos=0,o=!0)}return this.length+=e.length,o&&this.roundClean(),this}digestInto(e){D1t(this),fpn(e,this),this.finished=!0;let{buffer:t,view:r,blockLen:n,isLE:i}=this,{pos:o}=this;t[o++]=128,t.fill(0,o),this.padOffset>n-o&&(this.process(r,0),t.fill(0)),dpn(r,n-8,this.length*8,i),this.process(r,0),this.roundClean();let s=e===t?r:WOe(e),a=this.outputLen,c=a/4,u=this.get();if(a%4||c>u.length)throw new Error("invalid outputLen");for(let d=0;d<c;d++)s.setUint32(4*d,u[d],i)}digest(){let{buffer:e,outputLen:t}=this;this.digestInto(e);let r=e.slice(0,t);return this.destroy(),r}_cloneIntoMeta(e){let{buffer:t,length:r,finished:n,destroyed:i,pos:o}=this;return e.destroyed=i,e.finished=n,e.length=r,e.pos=o,o&&e.buffer.set(t),e}clone(){return this._cloneInto()}},Epn=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),Spn=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Wv=new Uint32Array(64),vpn=class extends bpn{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,t){super(64,e,8,!1),this.A=t[0]|0,this.B=t[1]|0,this.C=t[2]|0,this.D=t[3]|0,this.E=t[4]|0,this.F=t[5]|0,this.G=t[6]|0,this.H=t[7]|0}get(){let{A:e,B:t,C:r,D:n,E:i,F:o,G:s,H:a}=this;return[e,t,r,n,i,o,s,a]}set(e,t,r,n,i,o,s,a){this.A=e|0,this.B=t|0,this.C=r|0,this.D=n|0,this.E=i|0,this.F=o|0,this.G=s|0,this.H=a|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,t){for(let d=0;d<16;d++,t+=4)Wv[d]=e.getUint32(t,!1);for(let d=16;d<64;d++){let l=Wv[d-15],p=Wv[d-2],f=Ig(l,7)^Ig(l,18)^l>>>3,m=Ig(p,17)^Ig(p,19)^p>>>10;Wv[d]=m+Wv[d-7]+f+Wv[d-16]|0}let{A:r,B:n,C:i,D:o,E:s,F:a,G:c,H:u}=this;for(let d=0;d<64;d++){let l=Ig(s,6)^Ig(s,11)^Ig(s,25),p=u+l+_pn(s,a,c)+Spn[d]+Wv[d]|0,m=(Ig(r,2)^Ig(r,13)^Ig(r,22))+ypn(r,n,i)|0;u=c,c=a,a=s,s=o+p|0,o=i,i=n,n=r,r=p+m|0}r=r+this.A|0,n=n+this.B|0,i=i+this.C|0,o=o+this.D|0,s=s+this.E|0,a=a+this.F|0,c=c+this.G|0,u=u+this.H|0,this.set(r,n,i,o,s,a,c,u)}roundClean(){L1t(Wv)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),L1t(this.buffer)}},Tpn=class extends vpn{constructor(){super(32,Epn)}},vte=hpn(()=>new Tpn,gpn(1)),W1t=opn(apn()),tRe=Object.freeze,S8=0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn,XOe=0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3edn,mte=0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3n,ZOe=0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an,QOe=0x6666666666666666666666666666666666666666666666666666666666666658n,hte=S8-1n,Apn=tRe({p:S8,n:XOe,h:8n,a:hte,d:mte,Gx:ZOe,Gy:QOe}),Y1t=32,U1t=e=>e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"&&e.BYTES_PER_ELEMENT===1,Tte=(e,t,r="")=>{if(U1t(e)&&(t===void 0||e.length===t))return e;let n=U1t(e),i=t!==void 0?` of length ${t}`:"",o=n?`length=${e.length}`:`type=${typeof e}`,s=(r?`"${r}" `:"")+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)},wpn=(e,t="",r)=>Uint8Array.from(Tte(e,r,t)),J1t=(e,t)=>e.toString(16).padStart(t,"0"),rRe=e=>{let t="";for(let r of Tte(e))t+=J1t(r,2);return t},nRe=e=>{let t="hex invalid";if(typeof e!="string")throw new TypeError(t);if(e.length%2||!/^[\da-f]*$/i.test(e))throw new RangeError(t);let r=new Uint8Array(e.length/2);for(let n=0,i=0;n<r.length;n++,i+=2){let o=e.charCodeAt(i),s=e.charCodeAt(i+1);r[n]=((o&15)+(o>>6)*9)*16+(s&15)+(s>>6)*9}return r},Ipn=(...e)=>{let t=0;for(let i of e)t+=Tte(i).length;let r=new Uint8Array(t),n=0;for(let i of e)r.set(i,n),n+=i.length;return r},Ppn=(e=Y1t)=>{let t=globalThis?.crypto;if(typeof t?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined, consider polyfill");return t.getRandomValues(new Uint8Array(e))},FI=(e,t,r,n="bad number: out of range")=>{if(typeof e!="bigint")throw new TypeError(n);if(t<=e&&e<r)return e;throw new RangeError(n)},Vi=(e,t=S8)=>(e%=t)>=0n?e:t+e,B1t=(1n<<255n)-1n,Ze=e=>{if(e<0n)throw new RangeError("negative coordinate");let t=(e>>255n)*19n+(e&B1t);return t=(t>>255n)*19n+(t&B1t),t%S8},X1t=(e,t)=>{if(e===0n)throw new Error("invert: expected non-zero number");if(t<=1n)throw new Error("invert: expected modulus > 1, got "+t);let r=Vi(e,t),n=t,i=0n,o=1n;for(;r!==0n;){let a=n/r,c=n-r*a,u=i-o*a;n=r,r=c,i=o,o=u}if(n!==1n)throw new Error("invert: does not exist");return Vi(i,t)},YOe=e=>{if(e instanceof SB)return e;throw new TypeError("Point expected")},Z1t=2n**256n,SB=class $I{static BASE;static ZERO;X;Y;Z;T;constructor(t,r,n,i){let o=Z1t;this.X=FI(t,0n,o),this.Y=FI(r,0n,o),this.Z=FI(n,1n,o),this.T=FI(i,0n,o),tRe(this)}static CURVE(){return Apn}static fromAffine(t){return new $I(t.x,t.y,1n,Ze(t.x*t.y))}static fromBytes(t,r=!1){let n=wpn(t,"point",Y1t),i=n[31];n[31]=i&-129;let o=Opn(n);r||FI(o,0n,S8);let s=Ze(o*o),a=Vi(s-1n),c=Ze(mte*s+1n),{isValid:u,value:d}=Npn(a,c);if(!u)throw new Error("bad point: y not sqrt");let l=!!(i&128);if(!r&&d===0n&&l)throw new Error("bad point: x==0, isLastByteOdd");return l!==!!(d&1n)&&(d=Vi(-d)),new $I(d,o,1n,Ze(d*o))}static fromHex(t,r){return $I.fromBytes(nRe(t),r)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}assertValidity(){let t=hte,r=mte,n=this;if(n.is0())throw new Error("bad point: ZERO");let{X:i,Y:o,Z:s,T:a}=n,c=Ze(i*i),u=Ze(o*o),d=Ze(s*s),l=Ze(d*d),p=Ze(c*t),f=Ze(d*(p+u)),m=Vi(l+Ze(r*Ze(c*u)));if(f!==m)throw new Error("bad point: equation left != right (1)");let h=Ze(i*o),g=Ze(s*a);if(h!==g)throw new Error("bad point: equation left != right (2)");return this}equals(t){let{X:r,Y:n,Z:i}=this,{X:o,Y:s,Z:a}=YOe(t);return Ze(r*a)===Ze(o*i)&&Ze(n*a)===Ze(s*i)}is0(){return this.equals(zI)}negate(){return new $I(Vi(-this.X),this.Y,this.Z,Vi(-this.T))}double(){let{X:t,Y:r,Z:n}=this,i=hte,o=Ze(t*t),s=Ze(r*r),a=Ze(2n*n*n),c=Ze(i*o),u=Vi(t+r),d=Vi(Ze(u*u)-o-s),l=Vi(c+s),p=Vi(l-a),f=Vi(c-s),m=Ze(d*p),h=Ze(l*f),g=Ze(d*f),y=Ze(p*l);return new $I(m,h,y,g)}add(t){let{X:r,Y:n,Z:i,T:o}=this,{X:s,Y:a,Z:c,T:u}=YOe(t),d=hte,l=mte,p=Ze(r*s),f=Ze(n*a),m=Ze(Ze(o*l)*u),h=Ze(i*c),g=Vi(Ze(Vi(r+n)*Vi(s+a))-p-f),y=Vi(h-m),S=Vi(h+m),b=Vi(f-Ze(d*p)),E=Ze(g*y),T=Ze(S*b),w=Ze(g*b),I=Ze(y*S);return new $I(E,T,I,w)}subtract(t){return this.add(YOe(t).negate())}multiply(t,r=!0){if(!r&&t===0n||(FI(t,1n,XOe),!r&&this.is0()))return zI;if(t===1n)return this;if(this.equals(yB))return Mpn(t).p;let n=zI,i=yB,o=this;for(let s=0;r?s<256:t>0n;s++)t&1n?n=n.add(o):r&&(i=i.add(o)),o=o.double(),t>>=1n;return n}multiplyUnsafe(t){return this.multiply(t,!1)}toAffine(){let{X:t,Y:r,Z:n}=this;if(this.equals(zI))return{x:0n,y:1n};let i=X1t(n,S8);if(Ze(n*i)!==1n)throw new Error("invalid inverse");return{x:Ze(t*i),y:Ze(r*i)}}toBytes(){let{x:t,y:r}=this.toAffine(),n=xpn(r);return n[31]|=t&1n?128:0,n}toHex(){return rRe(this.toBytes())}clearCofactor(){return this.multiply(8n,!1)}isSmallOrder(){return this.clearCofactor().is0()}isTorsionFree(){return this.multiply(XOe/2n,!1).double().add(this).is0()}},yB=new SB(ZOe,QOe,1n,Vi(ZOe*QOe)),zI=new SB(0n,1n,1n,0n);SB.BASE=yB;SB.ZERO=zI;var xpn=e=>nRe(J1t(FI(e,0n,Z1t),64)).reverse(),Opn=e=>BigInt("0x"+rRe(Uint8Array.from(Tte(e)).reverse())),Pg=(e,t)=>{let r=e;for(;t-- >0;)r=Ze(r*r);return r},Rpn=e=>{let t=Ze(e*e),r=Ze(t*e),n=Ze(Pg(r,2)*r),i=Ze(Pg(n,1)*e),o=Ze(Pg(i,5)*i),s=Ze(Pg(o,10)*o),a=Ze(Pg(s,20)*s),c=Ze(Pg(a,40)*a),u=Ze(Pg(c,80)*c),d=Ze(Pg(u,80)*c),l=Ze(Pg(d,10)*o);return Ze(Pg(l,2)*e)},j1t=0x2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0n,Npn=(e,t)=>{let r=Ze(t*Ze(t*t)),n=Ze(Ze(r*r)*t),i=Rpn(Ze(e*n)),o=Ze(e*Ze(r*i)),s=Ze(t*Ze(o*o)),a=o,c=Ze(o*j1t),u=s===e,d=s===Vi(-e),l=s===Vi(-e*j1t);return u&&(o=a),(d||l)&&(o=c),(Vi(o)&1n)===1n&&(o=Vi(-o)),{isValid:u||d,value:o}},iRe=tRe({bytesToHex:rRe,hexToBytes:nRe,concatBytes:Ipn,mod:Vi,invert:X1t,randomBytes:Ppn}),Cpn=()=>{let e=[],t=yB,r;for(let n=0;n<33;n++){r=t,e.push(r);for(let i=1;i<128;i++)r=r.add(t),e.push(r);t=r.double()}return e},q1t=void 0,H1t=(e,t)=>{let r=t.negate();return e?r:t},Mpn=e=>{let t=q1t||(q1t=Cpn()),r=zI,n=yB;for(let i=0;i<33;i++){let o=Number(e&255n);e>>=8n,o>128&&(o-=256,e+=1n);let s=i*128,a=s+Math.abs(o)-1,c=i%2!==0,u=o<0;o===0?n=n.add(H1t(c,t[s])):r=r.add(H1t(u,t[a]))}if(e!==0n)throw new Error("invalid wnaf");return{p:r,f:n}},vNi=iRe.bytesToHex,TNi=iRe.hexToBytes,ANi=iRe.concatBytes;function kpn(e){let t="";for(let r=0;r<e.length;r++)t+=String.fromCharCode(e[r]);return btoa(t)}function Dpn(e){let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function vB(e){return kpn(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Lpn(e){let t=e.length%4===0?0:4-e.length%4,r=e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat(t);return Dpn(r)}var bB=2,Q1t=["new","continue"],gte=1,_te="vic_draw",e_t=["charge_and_capture","authorize_only"],Ate=10000n,yte="nominal_usd_usdc_parity",oRe=["card:vic","wallet:x402"],Upn=["hosted_identity_key_migration_required","identity_key_expired","identity_key_rotated","identity_key_lost","identity_key_inactive","agent_inactive","current_grant_missing","current_grant_replaced","current_grant_expired","current_grant_inactive","required_scope_missing","managed_wallet_authority_unverified","authority_projection_unknown","authorization_version_unsupported","identity_key_custody_unsupported"],t_t=["identity","wallet_api","wallet_signing","email_signing","chain_identity"],r_t=["runtime","turnkey","server_encrypted","server_kms","external"],n_t=["pending","active","retired","revoked","lost"],i_t=["dotvisa","tap","email","messaging"],o_t=["provisioning","active","needs_attention","suspended","disabled"],s_t=["routing_only","provider_verified","agent_key_bound"],Bpn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,jpn=/^[A-Za-z0-9_-]{43}$/,qpn=/^(?:0|[1-9][0-9]*)$/,Hpn=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,6})?(?:Z|[+-]\d{2}:\d{2})$/,a_t=/[\u0000-\u001f\u007f]/,Vpn=2147483647,c_t=9223372036854775807n,V1t=100,Fpn=512,F1t=32,$pn=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.visa$/,bte=/^0x[0-9a-f]{40}$/,wte=new TextEncoder;function eRe(e,t){return(0,W1t.compareCanonicalKeys)(e,t)}function Jv(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Qv(e){if(typeof e!="string"||!jpn.test(e))return!1;try{let t=Lpn(e);return t.byteLength===32&&vB(t)===e}catch{return!1}}function Xv(e,t,r){let n=Object.keys(t).filter(i=>!r.has(i));if(n.length>0)throw new Error(`${e} contains unknown field(s): ${n.sort().join(", ")}`)}function zpn(e,t){if(typeof t!="string"||!Bpn.test(t))throw new Error(`${e} must be a UUID`)}function uu(e,t){return zpn(e,t),t.toLowerCase()}function EB(e,t){if(!(0,W1t.isCanonicalOpaqueId)(t))throw new Error(`${e} must be a non-empty opaque id (max 128 chars)`)}function zy(e,t){if(typeof t!="string")throw new Error(`${e} must be an ISO timestamp with an explicit time-zone offset`);let r=Hpn.exec(t);if(!r)throw new Error(`${e} must be an ISO timestamp with an explicit time-zone offset`);let[,n,i,o,s,a,c]=r,u=Number(n),d=Number(i),l=Number(o),p=Number(s),f=Number(a),m=Number(c),h=new Date(0);if(h.setUTCFullYear(u,d-1,l),h.setUTCHours(p,f,m,0),u===0||h.getUTCFullYear()!==u||h.getUTCMonth()!==d-1||h.getUTCDate()!==l||h.getUTCHours()!==p||h.getUTCMinutes()!==f||h.getUTCSeconds()!==m)throw new Error(`${e} must be a valid calendar timestamp`);let g=Date.parse(t);if(!Number.isFinite(g))throw new Error(`${e} must be a valid ISO timestamp`);return new Date(g).toISOString()}function Yv(e,t,r=!1){if(typeof t!="string"||!qpn.test(t))throw new Error(`${e} must be a canonical non-negative integer micros string`);if(!r&&t==="0")throw new Error(`${e} must be positive`);if(BigInt(t)>c_t)throw new Error(`${e} exceeds the PostgreSQL BIGINT range`);return t}function u_t(e,t){if(typeof t!="number"||!Number.isInteger(t)||t<=0||t>Vpn)throw new Error(`${e} must be a positive PostgreSQL INTEGER`);return t}function Ete(e,t){if(typeof t!="string")throw new Error(`${e} must be a string`);if(a_t.test(t))throw new Error(`${e} must be a bounded non-empty payee without control characters`);let r=t.normalize("NFC").trim();if(r.length===0||r.length>Fpn)throw new Error(`${e} must be a bounded non-empty payee without control characters`);return r}function Zv(e,t,r){if(typeof t!="string")throw new Error(`${e} must be a string`);if(a_t.test(t))throw new Error(`${e} must be bounded, non-empty text without control characters`);let n=t.normalize("NFC").trim();if(n.length===0||n.length>r)throw new Error(`${e} must be bounded, non-empty text without control characters`);return n}function nl(e,t){return typeof e=="string"&&t.includes(e)}function Gpn(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("cents must be a non-negative safe integer");let t=BigInt(e)*Ate;if(t>c_t)throw new Error("cents exceed the PostgreSQL BIGINT micros range");return t.toString()}function Kpn(e){return Yv("amountAtomic",e,!0)}function Wpn(e){if(e==="card:vic")return{scope:e,paymentRail:"card",protocol:null,instrumentKind:"vic_card"};if(e==="wallet:x402")return{scope:e,paymentRail:"stablecoin",protocol:"x402",instrumentKind:"turnkey_wallet"};throw new Error(`unknown authorization scope: ${String(e)}`)}function Ypn(e){if(!Jv(e))throw new Error("agent key descriptor must be an object");Xv("agent key descriptor",e,new Set(["keyId","agentId","purpose","algorithm","custody","fingerprint","status","createdAt","expiresAt"]));let t=uu("keyId",e.keyId),r=uu("agentId",e.agentId);if(!nl(e.purpose,t_t))throw new Error("invalid key purpose");if(!nl(e.algorithm,["Ed25519","P-256","secp256k1"]))throw new Error("invalid key algorithm");if(!nl(e.custody,r_t))throw new Error("invalid key custody");let n=Zv("fingerprint",e.fingerprint,255);if(e.purpose==="identity"){if(e.algorithm!=="Ed25519")throw new Error("identity keys must use Ed25519");if(!Qv(n))throw new Error("identity key fingerprint must be a 43-char RFC 7638 JKT")}if(e.purpose==="wallet_api"&&(e.algorithm!=="P-256"||e.custody!=="runtime"&&e.custody!=="server_kms"))throw new Error("wallet_api keys must be P-256 credentials held by an advisory runtime or the managed authority KMS");if(e.purpose==="wallet_signing"&&(e.algorithm!=="secp256k1"||e.custody!=="turnkey"))throw new Error("wallet_signing keys must be Turnkey-custodied secp256k1 money signers");if(e.purpose==="wallet_signing"&&(n=n.toLowerCase(),!bte.test(n)))throw new Error("wallet_signing fingerprint must be a canonical EVM address");if(e.purpose==="chain_identity"&&(e.algorithm!=="secp256k1"||e.custody!=="turnkey"))throw new Error("chain_identity keys must be Turnkey-custodied secp256k1 addresses");if(e.purpose==="chain_identity"&&(n=n.toLowerCase(),!bte.test(n)))throw new Error("chain_identity fingerprint must be a canonical EVM address");if(e.purpose==="email_signing"){if(e.algorithm!=="Ed25519")throw new Error("email_signing keys must use Ed25519");if(!Qv(n))throw new Error("email_signing key fingerprint must be a 43-char RFC 7638 JKT")}if(!nl(e.status,n_t))throw new Error("invalid key status");let i=zy("createdAt",e.createdAt),o=e.expiresAt===void 0?void 0:zy("expiresAt",e.expiresAt);if(o!==void 0&&Date.parse(o)<=Date.parse(i))throw new Error("expiresAt must be after createdAt");return{keyId:t,agentId:r,purpose:e.purpose,algorithm:e.algorithm,custody:e.custody,fingerprint:n,status:e.status,createdAt:i,...o!==void 0?{expiresAt:o}:{}}}function Jpn(e,t,r){if(!Jv(e))throw new Error("keyLink must be an object");Xv("channel keyLink",e,new Set(["keyId","agentId","purpose","fingerprint"]));let n=uu("keyLink.keyId",e.keyId),i=uu("keyLink.agentId",e.agentId);if(i!==t)throw new Error("keyLink.agentId must match the channel agentId");if(!nl(e.purpose,["identity","email_signing"]))throw new Error("channel keyLink cannot use a wallet-signing key");if(r==="email"&&e.purpose!=="email_signing")throw new Error("an agent-key-bound email channel requires an email_signing key");if((r==="tap"||r==="dotvisa")&&e.purpose!=="identity")throw new Error(`${r} requires an identity key`);let o=Zv("keyLink.fingerprint",e.fingerprint,255);if(!Qv(o))throw new Error(`an ${e.purpose} key link fingerprint must be a 43-char RFC 7638 JKT`);return{keyId:n,agentId:i,purpose:e.purpose,fingerprint:o}}function Xpn(e){if(!Jv(e))throw new Error("agent channel descriptor must be an object");Xv("agent channel descriptor",e,new Set(["channelId","agentId","kind","status","assurance","address","providerRef","keyLink","capabilities","createdAt","verifiedAt","disabledAt"])),EB("channelId",e.channelId);let t=uu("agentId",e.agentId);if(!nl(e.kind,i_t))throw new Error("invalid channel kind");if(!nl(e.status,o_t))throw new Error("invalid channel status");if(!nl(e.assurance,s_t))throw new Error("invalid channel assurance");let r=e.address===void 0?void 0:Zv("address",e.address,320),n=e.kind==="dotvisa"?r?.toLowerCase():r;if((e.kind==="email"||e.kind==="dotvisa")&&n===void 0)throw new Error(`${e.kind} channels require an address`);if(e.kind==="dotvisa"&&n!==void 0&&!$pn.test(n))throw new Error("dotvisa channel address must be a canonical lowercase .visa address");if(e.kind==="tap"&&n!==void 0)throw new Error("tap channels use providerRef and cannot claim a public address");let i=e.providerRef===void 0?void 0:Zv("providerRef",e.providerRef,255);if(!Array.isArray(e.capabilities)||e.capabilities.length===0||e.capabilities.length>F1t)throw new Error(`capabilities must contain between 1 and ${F1t} entries`);let o=e.capabilities.map(l=>Zv("capability",l,64));if(new Set(o).size!==o.length)throw new Error("capabilities must not repeat");let s=zy("createdAt",e.createdAt),a=e.verifiedAt===void 0?void 0:zy("verifiedAt",e.verifiedAt),c=e.disabledAt===void 0?void 0:zy("disabledAt",e.disabledAt);if(a!==void 0&&Date.parse(a)<Date.parse(s))throw new Error("verifiedAt cannot be before createdAt");if(c!==void 0&&Date.parse(c)<Date.parse(s))throw new Error("disabledAt cannot be before createdAt");if(c!==void 0&&a!==void 0&&Date.parse(c)<Date.parse(a))throw new Error("disabledAt cannot be before verifiedAt");if(e.status==="disabled"!=(c!==void 0))throw new Error("status='disabled' and disabledAt must be set together");let u={channelId:e.channelId,agentId:t,kind:e.kind,status:e.status,...n!==void 0?{address:n}:{},...i!==void 0?{providerRef:i}:{},capabilities:[...o].sort(eRe),createdAt:s,...c!==void 0?{disabledAt:c}:{}};if(e.assurance==="routing_only"){if(a!==void 0||e.keyLink!==void 0)throw new Error("routing_only channels cannot claim verification or an agent key link");return{...u,assurance:"routing_only"}}if(i===void 0||a===void 0)throw new Error(`${e.assurance} channels require providerRef and verifiedAt`);if(e.assurance==="provider_verified"){if(e.keyLink!==void 0)throw new Error("provider_verified channels cannot claim an agent key link");return{...u,assurance:"provider_verified",providerRef:i,verifiedAt:a}}let d=Jpn(e.keyLink,t,e.kind);return{...u,assurance:"agent_key_bound",providerRef:i,verifiedAt:a,keyLink:d}}function d_t(e){if(!Jv(e))throw new Error("agent authority grant must be an object");if(Xv("agent authority grant",e,new Set(["v","grantId","agentId","version","budgetEpochId","budgetEpochMode","status","currency","valuationPolicy","totalMicros","perTransactionMicros","dailyMicros","scopes","payeeConstraints","effectiveAt","expiresAt","supersedesGrantId"])),e.v!==bB)throw new Error("grant.v must be 2");let t=uu("grantId",e.grantId),r=uu("agentId",e.agentId),n=u_t("version",e.version),i=uu("budgetEpochId",e.budgetEpochId);if(!nl(e.budgetEpochMode,Q1t))throw new Error("budgetEpochMode must be new or continue");if(!nl(e.status,["active","superseded","revoked"]))throw new Error("invalid grant status");if(e.currency!=="USD")throw new Error("currency must be 'USD'");if(e.valuationPolicy!==yte)throw new Error(`valuationPolicy must be '${yte}'`);let o=Yv("totalMicros",e.totalMicros),s=Yv("perTransactionMicros",e.perTransactionMicros);if(BigInt(s)>BigInt(o))throw new Error("perTransactionMicros cannot exceed totalMicros");let a=e.dailyMicros===void 0?void 0:Yv("dailyMicros",e.dailyMicros);if(a!==void 0){if(BigInt(a)>BigInt(o))throw new Error("dailyMicros cannot exceed totalMicros");if(BigInt(s)>BigInt(a))throw new Error("perTransactionMicros cannot exceed dailyMicros")}if(!Array.isArray(e.scopes)||e.scopes.length===0)throw new Error("scopes must be a non-empty array");let c=e.scopes.map(p=>{if(!Jv(p))throw new Error("grant scope must be an object");if(Xv("grant scope",p,new Set(["scope","totalMicros","perTransactionMicros","instrumentRef"])),!nl(p.scope,oRe))throw new Error("invalid authorization scope");let f=p.totalMicros===void 0?void 0:Yv("scope.totalMicros",p.totalMicros),m=p.perTransactionMicros===void 0?void 0:Yv("scope.perTransactionMicros",p.perTransactionMicros);if(f!==void 0&&BigInt(f)>BigInt(o))throw new Error("scope.totalMicros cannot exceed the aggregate totalMicros");if(m!==void 0&&BigInt(m)>BigInt(s))throw new Error("scope.perTransactionMicros cannot exceed the aggregate perTransactionMicros");if(f!==void 0&&m!==void 0&&BigInt(m)>BigInt(f))throw new Error("scope.perTransactionMicros cannot exceed scope.totalMicros");let h=Zv("scope.instrumentRef",p.instrumentRef,255);return{scope:p.scope,...f!==void 0?{totalMicros:f}:{},...m!==void 0?{perTransactionMicros:m}:{},instrumentRef:h}});if(new Set(c.map(({scope:p})=>p)).size!==c.length)throw new Error("scopes must not repeat");let u;if(e.payeeConstraints!==void 0){if(!Array.isArray(e.payeeConstraints)||e.payeeConstraints.length===0||e.payeeConstraints.length>V1t)throw new Error(`payeeConstraints must contain between 1 and ${V1t} entries`);if(u=e.payeeConstraints.map(f=>{if(!Jv(f))throw new Error("payee constraint must be an object");if(Xv("payee constraint",f,new Set(["scope","kind","canonicalId"])),f.scope==="card:vic"&&f.kind==="processor_merchant_id")return{scope:f.scope,kind:f.kind,canonicalId:Ete("payee constraint canonicalId",f.canonicalId)};if(f.scope==="wallet:x402"&&f.kind==="evm_address"){let m=Ete("payee constraint canonicalId",f.canonicalId).toLowerCase();if(!bte.test(m))throw new Error("wallet payee constraint canonicalId must be an EVM address");return{scope:f.scope,kind:f.kind,canonicalId:m}}throw new Error("payee constraint scope/kind combination is invalid")}),u.some(f=>!c.some(({scope:m})=>m===f.scope)))throw new Error("payee constraint scope must be present in grant scopes");let p=u.map(({scope:f,kind:m,canonicalId:h})=>`${f}:${m}:${h}`);if(new Set(p).size!==p.length)throw new Error("payeeConstraints must not repeat after normalization")}let d=zy("effectiveAt",e.effectiveAt),l=zy("expiresAt",e.expiresAt);if(Date.parse(l)<=Date.parse(d))throw new Error("expiresAt must be after effectiveAt");if(e.supersedesGrantId!==void 0&&uu("supersedesGrantId",e.supersedesGrantId)===t)throw new Error("a grant cannot supersede itself");return{v:bB,grantId:t,agentId:r,version:n,budgetEpochId:i,budgetEpochMode:e.budgetEpochMode,status:e.status,currency:"USD",valuationPolicy:yte,totalMicros:o,perTransactionMicros:s,...a!==void 0?{dailyMicros:a}:{},scopes:[...c].sort((p,f)=>eRe(p.scope,f.scope)),...u!==void 0?{payeeConstraints:[...u].sort((p,f)=>eRe(`${p.scope}:${p.kind}:${p.canonicalId}`,`${f.scope}:${f.kind}:${f.canonicalId}`))}:{},effectiveAt:d,expiresAt:l,...e.supersedesGrantId!==void 0?{supersedesGrantId:uu("supersedesGrantId",e.supersedesGrantId)}:{}}}function Zpn(e){let t=d_t(e),{status:r,...n}=t;return vB(vte(wte.encode(`visa-agent-authority-grant:v2:${JSON.stringify(n)}`)))}function l_t(e){if(!Jv(e))throw new Error("VIC settlement envelope must be an object");if(Xv("VIC settlement envelope",e,new Set(["v","kind","acquirerId","processorMerchantId","processorIntentId","instrumentRef","instrumentCommitment","payee","amountMicros","currency","processorAction","captureMode","settlementExpiresAt"])),e.v!==gte)throw new Error(`VIC settlement envelope.v must be ${gte}`);if(e.kind!==_te)throw new Error(`VIC settlement envelope.kind must be '${_te}'`);EB("acquirerId",e.acquirerId);let t=Zv("processorMerchantId",e.processorMerchantId,128);EB("processorIntentId",e.processorIntentId);let r=Object.prototype.hasOwnProperty.call(e,"instrumentRef"),n=Object.prototype.hasOwnProperty.call(e,"instrumentCommitment");if(r===n)throw new Error("VIC settlement envelope requires exactly one of instrumentRef or instrumentCommitment");let i=r?Zv("instrumentRef",e.instrumentRef,255):void 0,o=n?e.instrumentCommitment:void 0;if(o!==void 0&&!Qv(o))throw new Error("instrumentCommitment must be a 32-byte base64url commitment");let s=Ete("payee",e.payee),a=Yv("amountMicros",e.amountMicros);if(BigInt(a)%Ate!==0n)throw new Error("VIC amountMicros must represent a whole number of card cents");if(e.currency!=="USD")throw new Error("currency must be 'USD'");if(!nl(e.processorAction,e_t))throw new Error("processorAction must be 'charge_and_capture' or 'authorize_only'");if(!nl(e.captureMode,["exact","up_to"]))throw new Error("captureMode must be 'exact' or 'up_to'");if(e.processorAction==="charge_and_capture"&&e.captureMode!=="exact")throw new Error("charge_and_capture requires captureMode 'exact'");let c=zy("settlementExpiresAt",e.settlementExpiresAt),u={v:gte,kind:_te,acquirerId:e.acquirerId,processorMerchantId:t,processorIntentId:e.processorIntentId,payee:s,amountMicros:a,currency:"USD",processorAction:e.processorAction,captureMode:e.captureMode,settlementExpiresAt:c};return i!==void 0?{...u,instrumentRef:i}:{...u,instrumentCommitment:o}}function Qpn(e){let t=l_t(e),r=JSON.stringify({v:t.v,kind:t.kind,acquirerId:t.acquirerId,processorMerchantId:t.processorMerchantId,processorIntentId:t.processorIntentId,..."instrumentRef"in t?{instrumentRef:t.instrumentRef}:{instrumentCommitment:t.instrumentCommitment},payee:t.payee,amountMicros:t.amountMicros,currency:t.currency,processorAction:t.processorAction,captureMode:t.captureMode,settlementExpiresAt:t.settlementExpiresAt});return vB(vte(wte.encode(`visa-vic-settlement-envelope:v1:${r}`)))}function sRe(e){if(!Jv(e))throw new Error("spend authorization intent must be an object");if(Xv("spend authorization intent",e,new Set(["v","authorizationId","agentId","keyJkt","grantId","grantVersion","budgetEpochId","scope","amountMicros","currency","payee","intentId","economicIntentId","settlementHash","settlementExpiresAt"])),e.v!==bB)throw new Error("intent.v must be 2");let t=uu("authorizationId",e.authorizationId),r=uu("agentId",e.agentId);if(!Qv(e.keyJkt))throw new Error("keyJkt must be a 43-char RFC 7638 thumbprint");let n=uu("grantId",e.grantId),i=u_t("grantVersion",e.grantVersion),o=uu("budgetEpochId",e.budgetEpochId);if(!nl(e.scope,oRe))throw new Error("invalid authorization scope");let s=Yv("amountMicros",e.amountMicros);if(e.scope==="card:vic"&&BigInt(s)%Ate!==0n)throw new Error("card:vic amountMicros must represent a whole number of card cents");if(e.currency!=="USD")throw new Error("currency must be 'USD'");let a=Ete("payee",e.payee),c=e.scope==="wallet:x402"?a.toLowerCase():a;if(e.scope==="wallet:x402"&&!bte.test(c))throw new Error("wallet:x402 payee must be an EVM address");if(EB("intentId",e.intentId),EB("economicIntentId",e.economicIntentId),!Qv(e.settlementHash))throw new Error("settlementHash is required and must be a 32-byte base64url commitment");let u=zy("settlementExpiresAt",e.settlementExpiresAt);return{v:bB,authorizationId:t,agentId:r,keyJkt:e.keyJkt,grantId:n,grantVersion:i,budgetEpochId:o,scope:e.scope,amountMicros:s,currency:"USD",payee:c,intentId:e.intentId,economicIntentId:e.economicIntentId,settlementHash:e.settlementHash,settlementExpiresAt:u}}function p_t(e){let t=sRe(e),r=JSON.stringify({v:t.v,authorizationId:t.authorizationId,agentId:t.agentId,keyJkt:t.keyJkt,grantId:t.grantId,grantVersion:t.grantVersion,budgetEpochId:t.budgetEpochId,scope:t.scope,amountMicros:t.amountMicros,currency:t.currency,payee:t.payee,intentId:t.intentId,economicIntentId:t.economicIntentId,settlementHash:t.settlementHash,settlementExpiresAt:t.settlementExpiresAt});return vB(vte(wte.encode(`visa-agent-spend-authorization:v2:${r}`)))}function efn(e){let t=sRe(e.intent),r=uu("walletApiKeyId",e.walletApiKeyId),n=uu("runtimeSessionId",e.runtimeSessionId);if(e.executionChannel!=="cli"&&e.executionChannel!=="mcp")throw new Error("executionChannel must be cli or mcp");if(!Qv(e.resourceCommitment))throw new Error("resourceCommitment must be a 32-byte base64url commitment");let i=JSON.stringify({v:1,intentHash:p_t(t),walletApiKeyId:r,runtimeSessionId:n,executionChannel:e.executionChannel,resourceCommitment:e.resourceCommitment});return vB(vte(wte.encode(`visa-wallet-authorization-request:v1:${i}`)))}});var E_t=_(lr=>{"use strict";Object.defineProperty(lr,"__esModule",{value:!0});lr.FINANCIAL_REVOCATION_TYPE=lr.FinancialProofError=lr.FINANCIAL_REQUEST_MAX_BYTES=lr.FINANCIAL_JWS_MAX_BYTES=lr.FINANCIAL_APPROVAL_TYPE=lr.FINANCIAL_APPROVAL_AUDIENCE=void 0;lr.parseFinancialCanonicalJson=AB;lr.parseCardDisclosureConsent=g_t;lr.parseFinancialOwnerApproval=aRe;lr.financialRootJkt=Ote;lr.prepareFinancialOwnerApproval=cRe;lr.verifyFinancialOwnerApproval=__t;lr.completeFinancialOwnerApproval=nfn;lr.parseFinancialOwnerChallengeView=ifn;lr.parseFinancialOwnerRevocation=uRe;lr.prepareFinancialOwnerRevocation=y_t;lr.verifyFinancialOwnerRevocation=b_t;lr.completeFinancialOwnerRevocation=ofn;var h_t=m_t(),Ky=jS(),v8=gS();lr.FINANCIAL_APPROVAL_AUDIENCE="urn:visa:authority:financial";lr.FINANCIAL_APPROVAL_TYPE="visa-financial-grant-approval+jwt";lr.FINANCIAL_JWS_MAX_BYTES=16384;lr.FINANCIAL_REQUEST_MAX_BYTES=262144;var tfn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,Og=new TextEncoder,Pte=new TextDecoder("utf-8",{fatal:!0}),rfn=["v","purpose","audience","approvalId","challenge","ownerPrincipalId","associationId","associationVersion","agentId","rootJkt","grantHash","previousGrantId","previousGrantVersion","iat","exp"],xte=class extends Error{constructor(t){super(t),this.name="FinancialProofError"}};lr.FinancialProofError=xte;function Sr(e){throw new xte(e)}function Gy(e,t){if(!e||typeof e!="object"||Array.isArray(e))return Sr("Expected a closed object");let r=e;return Object.keys(r).length!==t.length||t.some(n=>!Object.hasOwn(r,n))?Sr("Unexpected or missing field"):r}function xg(e){return typeof e=="number"&&Number.isSafeInteger(e)&&e>0}function TB(e){return typeof e=="string"&&tfn.test(e)}function Sh(e,t){if(typeof e!="string"||!/^[A-Za-z0-9_-]+$/.test(e))return Sr("Invalid base64url");let r=new Uint8Array((0,Ky.base64UrlToBytes)(e));return(0,Ky.bytesToBase64Url)(r)!==e||t!==void 0&&r.length!==t?Sr("Noncanonical base64url"):r}function Ite(e){if(typeof e=="string")for(let t=0;t<e.length;t++){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(++t);n>=56320&&n<=57343||Sr("Invalid Unicode")}else r>=56320&&r<=57343&&Sr("Invalid Unicode")}else if(Array.isArray(e))for(let t of e)Ite(t);else if(e&&typeof e=="object")for(let[t,r]of Object.entries(e))Ite(t),Ite(r)}function AB(e,t=lr.FINANCIAL_REQUEST_MAX_BYTES){if(Og.encode(e).length>t)return Sr("Financial input too large");let r;try{r=JSON.parse(e)}catch{return Sr("Invalid JSON")}return Ite(r),(0,v8.canonicalEnvelopeJson)(r)!==e?Sr("Noncanonical JSON"):r}function g_t(e){let t=Gy(e,["v","runtimeId","mode"]);return t.v!==1||!TB(t.runtimeId)||t.mode!=="private"&&t.mode!=="agent_history"?Sr("Invalid card disclosure consent"):{v:1,runtimeId:t.runtimeId,mode:t.mode}}function aRe(e){let t=e?.v,r=Gy(e,[...rfn,...t===2?["cardDisclosure"]:[]]);if(r.v!==1&&r.v!==2||r.purpose!=="financial.grant.approve"||r.audience!==lr.FINANCIAL_APPROVAL_AUDIENCE)return Sr("Wrong financial approval profile");for(let n of["approvalId","ownerPrincipalId","associationId","agentId"])if(!TB(r[n]))return Sr("Invalid approval identity");for(let n of["challenge","rootJkt","grantHash"])Sh(r[n],32);return!xg(r.associationVersion)||!xg(r.iat)||!xg(r.exp)||r.exp<=r.iat||r.exp-r.iat>300?Sr("Invalid approval version or window"):(r.previousGrantId===null?r.previousGrantVersion!==null:!TB(r.previousGrantId)||!xg(r.previousGrantVersion))?Sr("Invalid grant predecessor"):{...r,...r.v===2?{cardDisclosure:g_t(r.cardDisclosure)}:{}}}async function Ote(e){let t=Gy(e,["kty","crv","x"]);return t.kty!=="OKP"||t.crv!=="Ed25519"?Sr("Expected owner Ed25519 root"):(Sh(t.x,32),(0,Ky.bytesToBase64Url)(new Uint8Array(await crypto.subtle.digest("SHA-256",Og.encode((0,v8.canonicalJson)(t))))))}function cRe(e,t){let r=aRe(e),n=(0,h_t.canonicalAgentAuthorityGrant)(t);if(n.status!=="active"||n.agentId!==r.agentId||(0,h_t.agentAuthorityGrantHash)(n)!==r.grantHash)return Sr("Displayed grant does not match approval");if(r.v===2&&!n.scopes.some(s=>s.scope==="card:vic"))return Sr("Card disclosure requires a card spending scope");let i={alg:"EdDSA",typ:lr.FINANCIAL_APPROVAL_TYPE,kid:r.rootJkt},o=`${(0,Ky.bytesToBase64Url)(Og.encode((0,v8.canonicalJson)(i)))}.${(0,Ky.bytesToBase64Url)(Og.encode((0,v8.canonicalJson)(r)))}`;return{statement:r,grant:n,signingInput:o}}async function __t(e,t,r){if(typeof e!="string"||Og.encode(e).length>lr.FINANCIAL_JWS_MAX_BYTES)return Sr("Financial proof too large");let n=e.split(".");if(n.length!==3)return Sr("Invalid compact JWS");let i=Gy(AB(Pte.decode(Sh(n[0])),lr.FINANCIAL_JWS_MAX_BYTES),["alg","typ","kid"]),o=aRe(AB(Pte.decode(Sh(n[1])),lr.FINANCIAL_JWS_MAX_BYTES));if(i.alg!=="EdDSA"||i.typ!==lr.FINANCIAL_APPROVAL_TYPE||i.kid!==o.rootJkt||await Ote(t)!==o.rootJkt)return Sr("Wrong owner approval key or purpose");if(!xg(r)||o.iat>r+5||r>=o.exp)return Sr("Owner approval expired or not yet valid");let s=await crypto.subtle.importKey("raw",Sh(t.x,32),{name:"Ed25519"},!1,["verify"]);return await crypto.subtle.verify("Ed25519",s,Sh(n[2],64),Og.encode(`${n[0]}.${n[1]}`))?o:Sr("Invalid owner signature")}async function nfn(e,t,r,n,i){if(n.length!==64)return Sr("Invalid owner signature length");let{signingInput:o}=cRe(e,t),s=`${o}.${(0,Ky.bytesToBase64Url)(n)}`;return await __t(s,r,i),s}async function ifn(e){let t=Gy(e,["v","statement","grant","root","projection"]);if(t.v!==1)return Sr("Unknown owner review version");let{statement:r,grant:n}=cRe(t.statement,t.grant),i=Gy(t.root,["organizationId","rootKeyId","publicJwk"]);for(let s of["organizationId","rootKeyId"])if(typeof i[s]!="string"||!/^[-_A-Za-z0-9]{1,256}$/.test(i[s]))return Sr("Invalid protected root coordinates");if(await Ote(i.publicJwk)!==r.rootJkt)return Sr("Protected root does not match owner approval");let o=Gy(t.projection,["agentId","ownerPublicId"]);return o.agentId!==r.agentId||!TB(o.ownerPublicId)||o.ownerPublicId===r.ownerPrincipalId?Sr("Invalid protected owner projection"):{v:1,statement:r,grant:n,root:{organizationId:i.organizationId,rootKeyId:i.rootKeyId,publicJwk:{...i.publicJwk}},projection:{agentId:r.agentId,ownerPublicId:o.ownerPublicId}}}lr.FINANCIAL_REVOCATION_TYPE="visa-financial-grant-revocation+jwt";function uRe(e){let t=Gy(e,["v","purpose","audience","approvalId","ownerPrincipalId","associationId","associationVersion","agentId","rootJkt","grantId","grantVersion","grantHash","iat","exp"]);if(t.v!==1||t.purpose!=="financial.grant.revoke"||t.audience!==lr.FINANCIAL_APPROVAL_AUDIENCE)return Sr("Wrong financial revocation profile");for(let r of["approvalId","ownerPrincipalId","associationId","agentId","grantId"])if(!TB(t[r]))return Sr("Invalid revocation identity");for(let r of["rootJkt","grantHash"])Sh(t[r],32);return!xg(t.associationVersion)||!xg(t.grantVersion)||!xg(t.iat)||!xg(t.exp)||t.exp<=t.iat||t.exp-t.iat>300?Sr("Invalid revocation version or window"):{...t}}function y_t(e){let t=uRe(e),r={alg:"EdDSA",typ:lr.FINANCIAL_REVOCATION_TYPE,kid:t.rootJkt};return{statement:t,signingInput:`${(0,Ky.bytesToBase64Url)(Og.encode((0,v8.canonicalJson)(r)))}.${(0,Ky.bytesToBase64Url)(Og.encode((0,v8.canonicalJson)(t)))}`}}async function b_t(e,t,r){if(typeof e!="string"||Og.encode(e).length>lr.FINANCIAL_JWS_MAX_BYTES)return Sr("Financial proof too large");let n=e.split(".");if(n.length!==3)return Sr("Invalid compact JWS");let i=Gy(AB(Pte.decode(Sh(n[0])),lr.FINANCIAL_JWS_MAX_BYTES),["alg","typ","kid"]),o=uRe(AB(Pte.decode(Sh(n[1])),lr.FINANCIAL_JWS_MAX_BYTES));if(i.alg!=="EdDSA"||i.typ!==lr.FINANCIAL_REVOCATION_TYPE||i.kid!==o.rootJkt||await Ote(t)!==o.rootJkt)return Sr("Wrong owner revocation key or purpose");if(!xg(r)||o.iat>r+5||r>=o.exp)return Sr("Owner revocation expired or not yet valid");let s=await crypto.subtle.importKey("raw",Sh(t.x,32),{name:"Ed25519"},!1,["verify"]);return await crypto.subtle.verify("Ed25519",s,Sh(n[2],64),Og.encode(`${n[0]}.${n[1]}`))?o:Sr("Invalid owner signature")}async function ofn(e,t,r,n){if(r.length!==64)return Sr("Invalid owner signature length");let i=`${y_t(e).signingInput}.${(0,Ky.bytesToBase64Url)(r)}`;return await b_t(i,t,n),i}});var v_t=_(_p=>{"use strict";Object.defineProperty(_p,"__esModule",{value:!0});_p.FINANCIAL_DEVICE_OPERATIONS_AUDIENCE=_p.FINANCIAL_DEVICE_ENROLLMENT_AUDIENCE=_p.WALLET_DEVICE_HANDOFF_AUDIENCE=_p.CARD_DEVICE_HANDOFF_AUDIENCE=void 0;_p.financialDeviceProposalHash=afn;_p.financialDeviceOperationsRequestHash=cfn;_p.financialDeviceEnrollmentChallengeHash=ufn;var lRe=_W(),pRe=jS(),Rte=gS(),sfn=E_t(),dRe=Zee();_p.CARD_DEVICE_HANDOFF_AUDIENCE="visa:financial:card-device-handoff:v1";_p.WALLET_DEVICE_HANDOFF_AUDIENCE="visa:financial:wallet-device-handoff:v1";function afn(e){let t=["v","purpose","requestId","associationId","associationVersion","agentId","runtimeId","rootJkt","publicJwk"];if(e?.v===2&&t.push("rail"),!e||Object.keys(e).sort().join(",")!==t.sort().join(",")||!(e.v===1||e.v===2&&e.rail==="card:vic")||e.purpose!=="financial.runtime.device.proposal"||![e.requestId,e.associationId,e.runtimeId].every(r=>typeof r=="string"&&fRe.test(r))||typeof e.agentId!="string"||!e.agentId||e.agentId.length>256||!Number.isSafeInteger(e.associationVersion)||e.associationVersion<1||!(0,dRe.isCanonicalBase64Url32)(e.rootJkt)||!e.publicJwk||Object.keys(e.publicJwk).sort().join(",")!=="crv,kty,x"||e.publicJwk.crv!=="Ed25519"||e.publicJwk.kty!=="OKP"||!(0,dRe.isCanonicalBase64Url32)(e.publicJwk.x))throw new Error("financial_device_proposal_invalid");return(0,pRe.bytesToBase64Url)((0,lRe.sha256)(new TextEncoder().encode((0,Rte.canonicalJson)(e))))}_p.FINANCIAL_DEVICE_ENROLLMENT_AUDIENCE="visa:financial:device-enrollment:v1";_p.FINANCIAL_DEVICE_OPERATIONS_AUDIENCE="visa:financial:device-operations:v1";function cfn(e){let t=["v","purpose","requestId","agentId","runtimeId","limit"];if(!e||typeof e!="object"||Object.keys(e).sort().join(",")!==t.sort().join(",")||e.v!==1||e.purpose!=="financial.wallet.operations.read"||![e.requestId,e.agentId,e.runtimeId].every(r=>typeof r=="string"&&fRe.test(r))||!Number.isSafeInteger(e.limit)||e.limit<1||e.limit>50)throw new Error("financial_device_operations_request_invalid");return(0,pRe.bytesToBase64Url)((0,lRe.sha256)(new TextEncoder().encode((0,Rte.canonicalJson)(e))))}var S_t=["v","purpose","requestId","associationId","associationVersion","runtimeId","runtimeGeneration","childJkt","preparedCertificate","preparedDelegation","expiresAt"],fRe=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;function ufn(e){let t=(0,sfn.parseFinancialCanonicalJson)((0,Rte.canonicalJson)(e));if(!t||Array.isArray(t)||Object.keys(t).length!==S_t.length||S_t.some(r=>!Object.hasOwn(t,r))||t.v!==1||t.purpose!=="financial.runtime.device.enroll"||!["requestId","associationId","runtimeId"].every(r=>typeof t[r]=="string"&&fRe.test(t[r]))||!["associationVersion","runtimeGeneration","expiresAt"].every(r=>Number.isSafeInteger(t[r])&&t[r]>0)||!(0,dRe.isCanonicalBase64Url32)(t.childJkt))throw new Error("financial_device_challenge_invalid");for(let r of["preparedCertificate","preparedDelegation"]){let n=t[r];if(!n||Array.isArray(n)||Object.keys(n).sort().join(",")!=="claims,signingInput"||typeof n.signingInput!="string"||n.signingInput.length>16384||!n.claims||typeof n.claims!="object"||Array.isArray(n.claims))throw new Error("financial_device_challenge_invalid")}return(0,pRe.bytesToBase64Url)((0,lRe.sha256)(new TextEncoder().encode((0,Rte.canonicalJson)(t))))}});async function mRe(e){let{key:t,approved:r,result:n}=e;if(!n.certificate.startsWith(r.preparedCertificate.signingInput+".")||!n.delegation.startsWith(r.preparedDelegation.signingInput+"."))throw new Error("financial_device_owner_result_invalid");let i={keys:[{...e.rootPublicJwk,kid:e.rootKid}]},o=Math.floor(Date.now()/1e3),s=await(0,Nte.verifyRuntimeCertificate)(n.certificate,{jwks:i,nowSec:o,expectedAgentId:t.binding.agentId,expectedRootJkt:t.binding.rootJkt,expectedRuntimeId:t.runtimeId,expectedRuntimeJkt:t.jkt,requiredPurpose:"wallet:x402"}),a=await(0,Nte.verifyRuntimeDelegation)(n.delegation,{ownerJwks:i,nowSec:o,expectedRootKid:e.rootKid,expectedRootJkt:t.binding.rootJkt,expectedAgentId:t.binding.agentId,expectedRuntimeId:t.runtimeId,expectedRuntimeJkt:t.jkt,expectedNetwork:"eip155:8453",expectedLeaseIssuerJkt:r.preparedDelegation.claims.leaseIssuerJkt,expectedDelegationId:r.preparedDelegation.claims.jti});if(n.v!==1||n.runtimeId!==t.runtimeId||n.childJkt!==t.jkt||!s.ok||!a.ok)throw new Error("financial_device_owner_result_invalid");return n}var Nte,T_t=A(()=>{"use strict";Nte=ie(Eh())});function IB(e,t){if(!/^[0-9a-f-]{36}$/.test(e))throw new Error("financial_device_agent_invalid");let r=(0,wB.join)(To(t),"financial-device");return(0,Cte.mkdirSync)(r,{recursive:!0,mode:448}),(0,wB.join)(r,e+".pending.json")}function dfn(e,t){let r=qk(IB(e,t));if(r===null)return null;t6(r);let n=JSON.parse(r);if((0,_Re.financialDeviceProposalHash)(n.proposal),n.v===1&&!Object.prototype.hasOwnProperty.call(n,"ceremony")){let i=IB(e,t),o=i.replace(".pending.json",`.outdated.${n.proposal.requestId}.json`);throw(0,Cte.renameSync)(i,o),new Error(`financial_device_record_outdated: this device's wallet approval was started by an older Visa CLI and cannot be resumed (kept as ${(0,wB.basename)(o)}). Re-enroll: run \`visa connect\` again.`)}if(n.v!==1||!n.ceremony||typeof n.ceremony!="object"||!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(n.ceremony.ceremonyId)||!/^[A-Za-z0-9_-]{43}$/.test(n.ceremony.challenge)||!/^[A-Za-z0-9_-]{43}$/.test(n.ceremony.verifier)||(0,GI.createHash)("sha256").update(n.ceremony.verifier).digest("base64url")!==n.ceremony.challenge||n.proposal.agentId!==e||n.runtimeKey.binding.agentId!==e||n.runtimeKey.runtimeId!==n.proposal.runtimeId||n.runtimeKey.binding.rootJkt!==n.proposal.rootJkt||(0,gRe.computeJkt)(n.rootPublicJwk)!==n.proposal.rootJkt)throw new Error("financial_device_record_invalid");return n}function hRe(e,t){let r=JSON.stringify(e);t6(r),Hk(IB(e.proposal.agentId,t),r)}async function Mte(e){let t=dfn(e.agentId,e.env);if(t){if((0,Wy.canonicalJson)(t.ceremony)!==(0,Wy.canonicalJson)(e.ceremony))throw new Error("financial_device_ceremony_changed");let s=await e.api.financialRuntimeRequest("device-handoff-create",{requestId:t.proposal.requestId,proposal:t.proposal,ceremony:t.ceremony}),a=Math.floor(Date.now()/1e3),c=s.evidence?.wallet_receipt,u=f=>{if(typeof f!="string")throw new Error("financial_device_record_invalid");let m=JSON.parse(Buffer.from(f.split(".")[1]??"","base64url").toString()).exp;if(!Number.isSafeInteger(m))throw new Error("financial_device_record_invalid");return m>a},d=c&&u(s.prepared?.certificate)&&u(s.prepared?.delegation)&&u(c.walletBinding),l=!s.prepared||s.prepared.status==="active"||s.prepared.status==="pending"&&s.prepared.challenge.expiresAt>a;if(d||!c&&!s.expired&&l)return t;Hk(IB(e.agentId,e.env).replace(".pending.json",`.expired.${t.proposal.requestId}.json`),JSON.stringify(t));let p={v:1,ceremony:t.ceremony,proposal:{...t.proposal,requestId:(0,GI.randomUUID)()},runtimeKey:t.runtimeKey,rootKid:t.rootKid,rootPublicJwk:t.rootPublicJwk};return hRe(p,e.env),p}let r=await e.api.financialRuntimeRequest("device-context",{requestId:(0,GI.randomUUID)(),agentId:e.agentId});if(r.agentId!==e.agentId||(0,gRe.computeJkt)(r.rootPublicJwk)!==r.rootJkt)throw new Error("financial_device_context_invalid");if(e.ownerPublicId!==void 0&&typeof r.ownerPublicId=="string"&&r.ownerPublicId!==e.ownerPublicId)throw new Error("Protected wallet owner differs from the active profile");let n=await e.signer.create({profile:"legacy-root-certified-v1",purpose:"wallet:x402",agentId:e.agentId,rootJkt:r.rootJkt}),i={v:1,purpose:"financial.runtime.device.proposal",requestId:(0,GI.randomUUID)(),associationId:r.associationId,associationVersion:r.associationVersion,agentId:e.agentId,runtimeId:n.runtimeId,rootJkt:r.rootJkt,publicJwk:n.publicJwk};(0,_Re.financialDeviceProposalHash)(i);let o={v:1,ceremony:e.ceremony,proposal:i,runtimeKey:n,rootKid:r.rootKid,rootPublicJwk:r.rootPublicJwk};return hRe(o,e.env),o}async function PB(e){let t=e.pending,r=t.proposal,n=await e.signer.describe(t.runtimeKey.handle);if((0,Wy.canonicalJson)(n)!==(0,Wy.canonicalJson)(t.runtimeKey)||n.binding.profile!=="legacy-root-certified-v1"||n.binding.purpose!=="wallet:x402")throw new Error("financial_device_handle_changed");let i=async(c,u={})=>e.api.financialRuntimeRequest(c,{requestId:r.requestId,proposal:r,...c==="device-handoff-create"?{ceremony:t.ceremony}:{},...u}),o=await i("device-handoff-create");if(o.expired&&!o.evidence?.wallet_receipt)throw new Error("This enrollment ceremony expired. Start a fresh enrollment; this expired proposal cannot be approved.");if((0,Wy.canonicalJson)(o.proposal)!==(0,Wy.canonicalJson)(r))throw new Error("financial_device_proposal_mismatch");let s=o.evidence?.owner_signatures,a=o.prepared;if(s&&a&&!o.evidence?.device_proof){if(await mRe({key:n,rootKid:t.rootKid,rootPublicJwk:t.rootPublicJwk,approved:a.challenge,result:{v:1,runtimeId:r.runtimeId,childJkt:n.jkt,...s}}),t.challenge&&(0,Wy.canonicalJson)(t.challenge)!==(0,Wy.canonicalJson)(a.challenge))throw new Error("financial_device_challenge_changed");t.childPop||(t.challenge=a.challenge,t.childPop=await e.signer.financialEnrollmentProof(n.handle,a.challenge),hRe(t,e.env)),o=await i("device-handoff-proof",{childPop:t.childPop})}return o}async function yRe(e){let t=e.pending,r=t.proposal,n=await PB(e),i=n.evidence?.wallet_receipt;if(n.prepared?.status!=="active"||!i)return null;let o=await e.signer.describe(t.runtimeKey.handle),s=await mRe({key:o,rootKid:t.rootKid,rootPublicJwk:t.rootPublicJwk,approved:n.prepared.challenge,result:{v:1,runtimeId:r.runtimeId,childJkt:o.jkt,certificate:n.prepared.certificate,delegation:n.prepared.delegation}}),{verifyWalletBinding:a}=await Promise.resolve().then(()=>ie(Eh())),c=await e.api.financialRuntimeRequest("device-context",{requestId:(0,GI.randomUUID)(),agentId:r.agentId});if(c.associationId!==r.associationId||c.associationVersion!==r.associationVersion||c.rootJkt!==r.rootJkt||i.agentId!==r.agentId||i.runtimeId!==r.runtimeId||i.runtimeCertificate!==s.certificate||typeof c.grantId!="string"||!Number.isSafeInteger(c.grantVersion)||c.grantVersion<1||typeof c.ownerPublicId!="string")throw new Error("financial_device_activation_changed");if(!(await a(i.walletBinding,{jwks:{keys:[{...t.rootPublicJwk,kid:t.rootKid}]},nowSec:Math.floor(Date.now()/1e3),expectedAgentId:r.agentId,expectedRootJkt:r.rootJkt,expectedSubOrganizationId:c.organizationId,expectedWalletId:i.walletId,expectedWalletAddress:i.walletAddress,expectedNetwork:"eip155:8453",expectedExecutor:{kind:"turnkey_tvc_p256",publicKey:i.credentialPublicKey,derivationVersion:"visa-tvc-slipgate-v2"}})).ok)throw new Error("financial_device_wallet_binding_invalid");let d={...t,challenge:n.prepared.challenge,certificate:s.certificate,delegation:s.delegation,walletBinding:i.walletBinding,wallet:{walletId:i.walletId,walletAddress:i.walletAddress,credentialPublicKey:i.credentialPublicKey},organizationId:c.organizationId,ownerPublicId:c.ownerPublicId,grantId:c.grantId,grantVersion:c.grantVersion},l=JSON.stringify(d);return t6(l),Hk(IB(r.agentId,e.env).replace(".pending.json",".active.json"),l),d}var Cte,wB,GI,gRe,Wy,_Re,T8=A(()=>{"use strict";Cte=require("node:fs"),wB=require("node:path"),GI=require("node:crypto"),gRe=ie(Eh()),Wy=ie(gS()),_Re=ie(v_t());rK();kd();T_t()});function KI(e){let t=X_(e);if(new URL(t).protocol!=="https:")throw new Error("Protected enrollment requires the HTTPS Auth origin");return t}function OB(e){let t=(0,WI.join)(To(e),"protected-enrollment");return(0,kte.mkdirSync)(t,{recursive:!0,mode:448}),Vc(t),t}function ERe(e,t,r){if(!e||e.status!=="active"||e.v!==1||!A8.test(e.ceremonyId)||e.challenge!==t||e.confirmCode!==r||!P_t.test(t)||!/^[ABCDEFGHJKMNPQRSTUVWXYZ23456789]{6}$/.test(r)||!A8.test(e.agentId)||!A8.test(e.ownerPublicId)||!A8.test(e.associationId)||!Number.isSafeInteger(e.associationVersion)||e.associationVersion<1||typeof e.rootKid!="string"||!e.rootKid||typeof e.organizationId!="string"||!e.organizationId||(0,I_t.computeJkt)(e.rootPublicJwk)!==e.rootJkt)throw new Error("Protected enrollment result does not match this terminal")}function pfn(e){let t=Xl((0,WI.join)(OB(e),"pending.json"));if(t===null)return null;let r=JSON.parse(t);if(r.v!==1||!P_t.test(r.verifier)||x_t(r.verifier)!==r.challenge||KI(r.authorityOrigin)!==r.authorityOrigin||KI(r.executionOrigin)!==r.executionOrigin||X_(r.webOrigin)!==r.webOrigin||!Number.isSafeInteger(r.createdAt)||!(/^(?:ca_[A-Za-z0-9_-]{24})$/.test(r.ceremonyId)||A8.test(r.ceremonyId))||r.transportProfileId!==(Bu(e)?.profileId??null))throw new Error("Protected enrollment pending state or transport profile changed");if(r.binding&&(ERe(r.binding,r.challenge,TS(r.verifier)),r.ceremonyId!==r.binding.ceremonyId))throw new Error("Protected enrollment ceremony changed");return r}function mfn(e){try{return pfn(e)}catch(t){return Wn.warn("agent:protected_enrollment_pending_replaced",{reason:t instanceof Error?t.message:"pending record could not be read"}),null}}function O_t(e){let t=KI(i6()),r=X_(e.webOrigin),n=mfn(e.env),i=n!==null&&Date.now()-n.createdAt<ffn;if(n&&i&&!e.restart){if(n.authorityOrigin!==t||n.webOrigin!==r||n.executionOrigin!==t)throw new Error("Resume requires the original protected authority and browser origins");return n}if(n?.binding&&i&&e.restart)throw new Error("This enrollment is already bound. Resume its device approval before starting another agent.");let o=(0,xB.randomBytes)(32).toString("base64url"),s={v:1,verifier:o,challenge:x_t(o),authorityOrigin:t,executionOrigin:t,webOrigin:r,transportProfileId:Bu(e.env)?.profileId??null,createdAt:Date.now(),ceremonyId:"ca_"+(0,xB.randomBytes)(18).toString("base64url")};return Fc((0,WI.join)(OB(e.env),"pending.json"),JSON.stringify(s)),s}function SRe(e=process.env,t){let r=(t??"").trim().toLowerCase().replace(/[\s_]+/g,"-");if(r&&bRe[r])return bRe[r];let n=D1e(e);return n&&bRe[n]||null}function R_t(e,t){let r=new URL("/agent/enroll/protected-agent",e.webOrigin);return r.searchParams.set("cliChallenge",e.challenge),t&&r.searchParams.set("app",t),r.toString()}function vRe(e){let t=e&&typeof e=="object"?e.name:void 0;return typeof t=="string"?t:""}function yfn(e){try{let t=JSON.parse(e),r=t&&typeof t=="object"&&!Array.isArray(t)?t:{},n=i=>typeof i=="string"&&_fn.test(i)?i:null;return{code:n(r.code),reason:n(r.reason),purchaseId:r.reason==="terms_conflict"&&typeof r.purchaseId=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(r.purchaseId)?r.purchaseId:null}}catch{return{code:null,reason:null}}}async function TRe(e,t,r,n,i="Protected authority",o=hfn,s={}){let a;try{a=await n(KI(e)+t,{method:"POST",headers:{...s,"content-type":"application/json","X-Source":"cli","X-Visa-CLI-Version":lfn,...Yk()},body:(0,w8.canonicalJson)(JSON.parse(JSON.stringify(r))),redirect:"error",signal:AbortSignal.timeout(o)})}catch(u){let d=vRe(u);throw new Yy(i,d==="TimeoutError"||d==="AbortError"?"timeout":"network",o)}if(!a.ok){let u={code:null,reason:null};try{let d=await a.text();d.length<=262144&&(u=yfn(d))}catch{}throw new I8(i,a.status,u.code,u.reason,u.purchaseId)}let c;try{c=await a.text()}catch{throw new Yy(i,"response",o)}if(c.length>262144)throw new Yy(i,"response",o);try{return JSON.parse(c)}catch{throw new Yy(i,"response",o)}}function bfn(e,t=fetch){return KI(e),{financialRuntimeRequest:(r,n)=>TRe(e,`/v1/financial-runtime/${r}`,n,t)}}async function N_t(e,t,r=fetch){if(e.transportProfileId!==(Bu(t)?.profileId??null))throw new Error("Protected enrollment transport profile changed");if(e.binding)return A_t(e,e.binding,t),e.binding;let n=await TRe(e.executionOrigin,"/v1/enrollment/cli-claim",{verifier:e.verifier},r);if(n?.ok!==!0)throw new Error("Protected authority refused enrollment pickup");if(n.result?.status==="pending")return null;let i=n.result;return ERe(i,e.challenge,TS(e.verifier)),e.ceremonyId=i.ceremonyId,e.binding=i,Fc((0,WI.join)(OB(t),"pending.json"),JSON.stringify(e)),A_t(e,i,t),i}function A_t(e,t,r){let n={v:1,authorityOrigin:e.authorityOrigin,executionOrigin:e.executionOrigin,transportProfileId:e.transportProfileId,binding:t},i=(0,WI.join)(OB(r),`${t.agentId}.json`),o=Xl(i);if(o!==null&&(0,w8.canonicalJson)(JSON.parse(o))!==(0,w8.canonicalJson)(n))throw new Error("Protected agent selection changed");Fc(i,JSON.stringify(n))}function C_t(e,t=fetch){let r=bfn(e.executionOrigin,t);return{financialRuntimeRequest:async(n,i)=>{let o=n==="execute"?await TRe(e.executionOrigin,"/v1/financial-runtime/execute",i,t,"Protected policy transport",gfn):await r.financialRuntimeRequest(n,i);if(n==="device-context"){let s=e.binding;if(o.agentId!==s.agentId||o.ownerPublicId!==s.ownerPublicId||o.associationId!==s.associationId||o.associationVersion!==s.associationVersion||o.rootJkt!==s.rootJkt||o.rootKid!==s.rootKid||o.organizationId!==s.organizationId||(0,w8.canonicalJson)(o.rootPublicJwk)!==(0,w8.canonicalJson)(s.rootPublicJwk))throw new Error("Protected device context differs from the independently claimed owner")}return o}}}function Efn(e){let t=OB(e);return(0,kte.readdirSync)(t).filter(r=>A8.test(r.replace(/\.json$/,""))&&r.endsWith(".json")).flatMap(r=>{let n=Xl((0,WI.join)(t,r));if(n===null)return[];let i=JSON.parse(n);if(i.v!==1||KI(i.authorityOrigin)!==i.authorityOrigin||KI(i.executionOrigin)!==i.executionOrigin||i.binding.agentId+".json"!==r)throw new Error("Protected selection is invalid");return ERe(i.binding,i.binding.challenge,i.binding.confirmCode),[i]})}function RB(e){let t=Bu(e)?.profileId??null;return Efn(e).filter(r=>r.transportProfileId===t)}var xB,kte,WI,I_t,w8,lfn,A8,P_t,x_t,ffn,bRe,hfn,gfn,Yy,I8,_fn,NB=A(()=>{"use strict";T8();xB=require("node:crypto"),kte=require("node:fs"),WI=require("node:path"),I_t=ie(Eh()),w8=ie(gS());CK();L1e();mS();q_();o6();Zl();kd();IK();lfn="5.0.0-rc.355",A8=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,P_t=/^[A-Za-z0-9_-]{43}$/,x_t=e=>(0,xB.createHash)("sha256").update(e).digest("base64url");ffn=9e5;bRe={"claude-code":"claude",codex:"codex",openclaw:"openclaw",hermes:"hermes"};hfn=2e4,gfn=12e4,Yy=class extends Error{constructor(r,n,i){super(n==="timeout"?`${r} timed out after ${Math.round(i/1e3)} s`:n==="response"?`${r} answered, but the answer could not be read`:`${r} could not be reached`);this.reason=n;this.name="ProtectedAuthorityTransportError"}reason},I8=class extends Error{constructor(r,n,i,o=null,s=null){super(`${r} refused this request (HTTP ${n}${i?`, ${i}`:""})`);this.status=n;this.code=i;this.reason=o;this.purchaseId=s;this.name="ProtectedAuthorityRefusedError"}status;code;reason;purchaseId};_fn=/^[a-z][a-z0-9_]{0,63}$/});var q_t=_(Pe=>{"use strict";Object.defineProperty(Pe,"__esModule",{value:!0});Pe.JOURNAL_ENVELOPE_V3_ENV=Pe.INTENT_NARRATIVE_USER_REQUEST_MAX=Pe.VALID_JOURNAL_CURRENCIES=Pe.TransactionIntentJournalError=Pe.INTENT_NARRATIVE_SCHEMA=Pe.INTENT_ALTERNATIVES_MAX=Pe.VALID_INTENT_DISCOVERY_SOURCES=Pe.INTENT_DISCOVERY_SOURCES=Pe.VALID_INTENT_INITIATORS=Pe.INTENT_INITIATORS=Pe.VALID_INTENT_CATEGORIES=Pe.INTENT_CATEGORIES=Pe.SUPPORTED_TRANSACTION_INTENT_JOURNAL_VERSIONS=Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED=Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED=Pe.TRANSACTION_INTENT_JOURNAL_VERSION=void 0;Pe.findNarrativePersonalData=L_t;Pe.validateIntentNarrative=U_t;Pe.journalEnvelopeV3Enabled=Afn;Pe.journalEnvelopeSalted=wfn;Pe.userIntentHash=Ifn;Pe.newUserIntentSalt=Pfn;Pe.saltedUserIntentHash=B_t;Pe.transactionIntentJournalHash=xfn;Pe.parseTransactionIntentJournalV1=j_t;Pe.buildTransactionIntentJournal=Ofn;var Lte=require("node:crypto"),Sfn=G_();Pe.TRANSACTION_INTENT_JOURNAL_VERSION=1;Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED=2;Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED=3;Pe.SUPPORTED_TRANSACTION_INTENT_JOURNAL_VERSIONS=[Pe.TRANSACTION_INTENT_JOURNAL_VERSION,Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED,Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED];Pe.INTENT_CATEGORIES=["api_inference","api_data","compute_storage","media_content","software_subscription","digital_goods","physical_goods","service_booking","donation_tip","other"];Pe.VALID_INTENT_CATEGORIES=new Set(Pe.INTENT_CATEGORIES);Pe.INTENT_INITIATORS=["user_explicit","agent_derived"];Pe.VALID_INTENT_INITIATORS=new Set(Pe.INTENT_INITIATORS);Pe.INTENT_DISCOVERY_SOURCES=["user_supplied","wallet_discover","wallet_directory","merchant_challenge","ucp","other"];Pe.VALID_INTENT_DISCOVERY_SOURCES=new Set(Pe.INTENT_DISCOVERY_SOURCES);Pe.INTENT_ALTERNATIVES_MAX=1e3;Pe.INTENT_NARRATIVE_SCHEMA={type:"object",description:"REQUIRED. What the user asked for, and what this purchase buys. Recorded as audit evidence and checked by the policy engine against the payment that follows \u2014 drift between what you state here and what you pay is refused. Write the way a human would want this to read on a statement six months from now: name the thing, not the transaction. Keep personal details \u2014 names, addresses, email addresses, account numbers, order numbers \u2014 OUT of product, purpose and expectedResult; those three are stored as written.",properties:{userRequest:{type:"string",description:"The user's own request that this purchase fulfils, verbatim or tightly summarized. It never leaves this machine: only a salted hash of it is sent."},product:{type:"string",description:'What is being bought, in plain words a human would recognize \u2014 "four hours of GPU time", "one stock photo licence", "50k tokens of image captioning". Not the URL, and not "API call".'},category:{type:"string",enum:[...Pe.INTENT_CATEGORIES],description:"Which kind of purchase this is. Pick the closest one; use other only when none of the others fits, not when the choice is merely hard."},purpose:{type:"string",description:"Why this purchase advances the user's goal \u2014 the reason for it, not a restatement of the product."},quantity:{type:"integer",description:"How many units are being bought. Defaults to 1 when omitted."},expectedResult:{type:"string",description:"What you expect to receive for the money: the artifact, the access, or the outcome."},recurring:{type:"boolean",description:"true when this purchase repeats on a schedule, such as a subscription. false for a one-off."},initiator:{type:"string",enum:[...Pe.INTENT_INITIATORS],description:"user_explicit when the user asked for this purchase; agent_derived when you concluded it was needed. Answer honestly \u2014 this records who decided, and neither answer is better than the other."},discoveredVia:{type:"string",enum:[...Pe.INTENT_DISCOVERY_SOURCES],description:"How you found this merchant: user_supplied when the user named it, wallet_discover or wallet_directory when a Visa CLI search found it, merchant_challenge when you already had the 402, ucp for a UCP handoff, otherwise other."},alternativesConsidered:{type:"integer",description:`How many other options you weighed before choosing this one. 0 is a real answer, not a missing one. At most ${Pe.INTENT_ALTERNATIVES_MAX}.`}},required:["userRequest","product","category"],additionalProperties:!1};var P8=class extends Error{code;constructor(t,r){super(r),this.code=t,this.name="TransactionIntentJournalError"}};Pe.TransactionIntentJournalError=P8;var M_t=/^[A-Za-z0-9_-]{43}$/,k_t=/^[1-9][0-9]*$/;Pe.VALID_JOURNAL_CURRENCIES=new Set(["USD","USDC"]);function Ps(e,t){throw new P8(e,t)}function CB(e,t){return(!e||typeof e!="object"||Array.isArray(e))&&Ps("invalid_journal",`${t} must be an object`),e}function MB(e,t,r=[]){for(let n of Object.keys(e))!t.includes(n)&&!r.includes(n)&&Ps("invalid_journal",`unknown journal field: ${n}`);for(let n of t)e[n]===void 0&&Ps("invalid_journal",`missing journal field: ${n}`)}function D_t(e,t){let r=Js(e,t,2048),n;try{n=new URL(r)}catch{Ps("invalid_journal",`${t} must be an absolute http(s) URL`)}return n.protocol!=="https:"&&n.protocol!=="http:"&&Ps("invalid_journal",`${t} must be an absolute http(s) URL`),r}function Js(e,t,r){return(typeof e!="string"||e.length===0||e.length>r)&&Ps("invalid_journal",`${t} must be a non-empty string of at most ${r} characters`),/[\u0000-\u001f\u007f]/.test(e)&&Ps("invalid_journal",`${t} must not contain control characters`),e}Pe.INTENT_NARRATIVE_USER_REQUEST_MAX=2e3;var vfn=[[/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/,"an email address"],[/\b(?:\+?1[\s.-]?)?\(?\d{3}\)?[\s.-]?\d{3}[\s.-]?\d{4}\b/,"a phone number"],[/\b\d{1,5}\s+[A-Za-z][A-Za-z.'-]*(?:\s+[A-Za-z][A-Za-z.'-]*)*\s+(?:Street|St|Avenue|Ave|Road|Rd|Lane|Ln|Drive|Dr|Boulevard|Blvd|Court|Ct|Way|Terrace|Place|Pl)\b\.?/i,"a street address"]];function Tfn(e){for(let t of e.match(/\b(?:\d[ -]?){13,19}\b/g)??[]){let r=t.replace(/\D/g,"");if(r.length<13||r.length>19)continue;let n=0,i=!1;for(let o=r.length-1;o>=0;o--){let s=r.charCodeAt(o)-48;i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}if(n%10===0)return!0}return!1}function L_t(e){let t=vfn.filter(([r])=>r.test(e)).map(([,r])=>r);return Tfn(e)&&t.push("a card or account number"),t}function Dte(e,t,r,{stored:n=!1}={}){if(typeof e!="string"||e.length===0)return{ok:!1,message:`intent.${t} must be a non-empty string.`};if(e.length>r)return{ok:!1,message:`intent.${t} must be at most ${r} characters.`};if(/[\u0000-\u001f\u007f]/.test(e))return{ok:!1,message:`intent.${t} must not contain control characters.`};if(n){let i=L_t(e);if(i.length>0)return{ok:!1,message:`intent.${t} contains ${i.join(" and ")}. product, purpose and expectedResult are stored as written \u2014 describe what was bought and leave the person's details in userRequest, which is committed by a hash and never leaves this machine.`}}return{ok:!0,value:e}}function U_t(e){if(!e||typeof e!="object"||Array.isArray(e))return{ok:!1,message:"intent must be an object with userRequest and product."};let t=e;for(let o of Object.keys(t))if(!["userRequest","product","purpose","quantity","expectedResult","recurring","category","initiator","discoveredVia","alternativesConsidered"].includes(o))return{ok:!1,message:`intent.${o} is not a recognized field.`};let r=Dte(t.userRequest,"userRequest",Pe.INTENT_NARRATIVE_USER_REQUEST_MAX);if(!r.ok)return r;let n=Dte(t.product,"product",512,{stored:!0});if(!n.ok)return n;if(typeof t.category!="string"||!Pe.VALID_INTENT_CATEGORIES.has(t.category))return{ok:!1,message:`intent.category is required and must be one of: ${Pe.INTENT_CATEGORIES.join(", ")}.`};let i={userRequest:r.value,product:n.value,category:t.category};if(t.purpose!==void 0){let o=Dte(t.purpose,"purpose",512,{stored:!0});if(!o.ok)return o;i.purpose=o.value}if(t.expectedResult!==void 0){let o=Dte(t.expectedResult,"expectedResult",512,{stored:!0});if(!o.ok)return o;i.expectedResult=o.value}if(t.quantity!==void 0){let o=t.quantity;if(typeof o!="number"||!Number.isSafeInteger(o)||o<1||o>1e6)return{ok:!1,message:"intent.quantity must be a whole number from 1 to 1000000."};i.quantity=o}if(t.initiator!==void 0){if(typeof t.initiator!="string"||!Pe.VALID_INTENT_INITIATORS.has(t.initiator))return{ok:!1,message:`intent.initiator must be one of: ${Pe.INTENT_INITIATORS.join(", ")}.`};i.initiator=t.initiator}if(t.discoveredVia!==void 0){if(typeof t.discoveredVia!="string"||!Pe.VALID_INTENT_DISCOVERY_SOURCES.has(t.discoveredVia))return{ok:!1,message:`intent.discoveredVia must be one of: ${Pe.INTENT_DISCOVERY_SOURCES.join(", ")}.`};i.discoveredVia=t.discoveredVia}if(t.alternativesConsidered!==void 0){let o=t.alternativesConsidered;if(typeof o!="number"||!Number.isSafeInteger(o)||o<0||o>Pe.INTENT_ALTERNATIVES_MAX)return{ok:!1,message:`intent.alternativesConsidered must be a whole number from 0 to ${Pe.INTENT_ALTERNATIVES_MAX}.`};i.alternativesConsidered=o}if(t.recurring!==void 0){if(typeof t.recurring!="boolean")return{ok:!1,message:"intent.recurring must be true or false."};i.recurring=t.recurring}return{ok:!0,narrative:i}}Pe.JOURNAL_ENVELOPE_V3_ENV="VISA_JOURNAL_V3";function Afn(e=process.env){return e[Pe.JOURNAL_ENVELOPE_V3_ENV]!=="false"}function wfn(e=process.env){return!0}function Ifn(e){return(0,Lte.createHash)("sha256").update(e,"utf8").digest("base64url")}function Pfn(){return(0,Lte.randomBytes)(32).toString("base64url")}function B_t(e,t){return(0,Lte.createHash)("sha256").update(`visa-user-intent:v2:${e}:${t}`,"utf8").digest("base64url")}function xfn(e){return(0,Lte.createHash)("sha256").update((0,Sfn.canonicalJson)(e),"utf8").digest("base64url")}function j_t(e){let t=CB(e,"journal");t.v!==Pe.TRANSACTION_INTENT_JOURNAL_VERSION&&t.v!==Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED&&t.v!==Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED&&Ps("invalid_journal","unsupported journal version");let r=t.v===Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED,n=t.v===Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED||r;MB(t,["v","userIntent","product","quantity","merchant","amountMicros","recurrence","endpoint","economicIntentId","executionPayloadHash",...n?["currency"]:[],...r?["category"]:[]],["purpose","maxPriceMicros","payee","expectedResult",...r?["initiator","discoveredVia","alternativesConsidered"]:[]]);let i=CB(t.userIntent,"userIntent");MB(i,["kind","hash"]),i.kind!=="agent_attested"&&Ps("invalid_journal","userIntent.kind must be agent_attested");let o=Js(i.hash,"userIntent.hash",43);M_t.test(o)||Ps("invalid_journal","userIntent.hash must be sha256 base64url");let s;n&&(s=Js(t.currency,"currency",10),Pe.VALID_JOURNAL_CURRENCIES.has(s)||Ps("invalid_journal","currency must be one of USD, USDC"));let a,c,u,d;if(r){let E=Js(t.category,"category",64);if(Pe.VALID_INTENT_CATEGORIES.has(E)||Ps("invalid_journal",`category must be one of ${Pe.INTENT_CATEGORIES.join(", ")}`),a=E,t.initiator!==void 0){let T=Js(t.initiator,"initiator",64);Pe.VALID_INTENT_INITIATORS.has(T)||Ps("invalid_journal",`initiator must be one of ${Pe.INTENT_INITIATORS.join(", ")}`),c=T}if(t.discoveredVia!==void 0){let T=Js(t.discoveredVia,"discoveredVia",64);Pe.VALID_INTENT_DISCOVERY_SOURCES.has(T)||Ps("invalid_journal",`discoveredVia must be one of ${Pe.INTENT_DISCOVERY_SOURCES.join(", ")}`),u=T}if(t.alternativesConsidered!==void 0){let T=t.alternativesConsidered;(typeof T!="number"||!Number.isSafeInteger(T)||T<0||T>Pe.INTENT_ALTERNATIVES_MAX)&&Ps("invalid_journal",`alternativesConsidered must be an integer from 0 to ${Pe.INTENT_ALTERNATIVES_MAX}`),d=T}}let l=Js(t.product,"product",512);(typeof t.quantity!="number"||!Number.isSafeInteger(t.quantity)||t.quantity<1||t.quantity>1e6)&&Ps("invalid_journal","quantity must be a positive integer");let p=CB(t.merchant,"merchant");MB(p,["url"],["id","name"]);let f=D_t(p.url,"merchant.url"),m=Js(t.amountMicros,"amountMicros",40);k_t.test(m)||Ps("invalid_journal","amountMicros must be a canonical positive integer string");let h;t.maxPriceMicros!==void 0&&(h=Js(t.maxPriceMicros,"maxPriceMicros",40),k_t.test(h)||Ps("invalid_journal","maxPriceMicros must be a canonical positive integer string")),t.recurrence!=="one_time"&&t.recurrence!=="recurring"&&Ps("invalid_journal","recurrence must be one_time or recurring");let g=CB(t.endpoint,"endpoint");MB(g,["tool"],["url"]);let y=Js(g.tool,"endpoint.tool",128),S;if(t.payee!==void 0){let E=CB(t.payee,"payee");MB(E,["address","network"],["asset"]),S={address:Js(E.address,"payee.address",256),network:Js(E.network,"payee.network",64),...E.asset===void 0?{}:{asset:Js(E.asset,"payee.asset",256)}}}let b=Js(t.executionPayloadHash,"executionPayloadHash",43);return M_t.test(b)||Ps("invalid_journal","executionPayloadHash must be sha256 base64url"),{v:t.v,userIntent:{kind:"agent_attested",hash:o},product:l,quantity:t.quantity,merchant:{url:f,...p.id===void 0?{}:{id:Js(p.id,"merchant.id",512)},...p.name===void 0?{}:{name:Js(p.name,"merchant.name",255)}},...t.purpose===void 0?{}:{purpose:Js(t.purpose,"purpose",512)},amountMicros:m,...s===void 0?{}:{currency:s},...h===void 0?{}:{maxPriceMicros:h},recurrence:t.recurrence,endpoint:{tool:y,...g.url===void 0?{}:{url:D_t(g.url,"endpoint.url")}},...S===void 0?{}:{payee:S},...t.expectedResult===void 0?{}:{expectedResult:Js(t.expectedResult,"expectedResult",512)},...a===void 0?{}:{category:a},...c===void 0?{}:{initiator:c},...u===void 0?{}:{discoveredVia:u},...d===void 0?{}:{alternativesConsidered:d},economicIntentId:Js(t.economicIntentId,"economicIntentId",256),executionPayloadHash:b}}function Ofn(e,t){let{userIntentSalt:r,userIntentHash:n,...i}=e,o=U_t(n?{...i,userRequest:"committed"}:i);if(!o.ok)throw new P8("invalid_journal",o.message);let s=t.categorized!==!1,a;if(n)a=n;else if(r)a=B_t(r,o.narrative.userRequest);else throw new P8("invalid_journal","a journal needs either a client-held userIntentSalt or a precomputed userIntentHash; the tool boundary mints one and keeps it");let c={v:s?Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED:Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED,userIntent:{kind:"agent_attested",hash:a},product:o.narrative.product,quantity:o.narrative.quantity??1,merchant:{url:t.merchantUrl,...t.merchantId?{id:t.merchantId}:{},...t.merchantName?{name:t.merchantName}:{}},...o.narrative.purpose?{purpose:o.narrative.purpose}:{},amountMicros:t.amountMicros,...t.currency?{currency:t.currency}:{},...t.maxPriceMicros?{maxPriceMicros:t.maxPriceMicros}:{},recurrence:o.narrative.recurring?"recurring":"one_time",endpoint:{tool:t.endpointTool,...t.endpointUrl?{url:t.endpointUrl}:{}},...t.payee?{payee:t.payee}:{},...o.narrative.expectedResult?{expectedResult:o.narrative.expectedResult}:{},...s?{category:o.narrative.category,...o.narrative.initiator?{initiator:o.narrative.initiator}:{},...o.narrative.discoveredVia?{discoveredVia:o.narrative.discoveredVia}:{},...o.narrative.alternativesConsidered!==void 0?{alternativesConsidered:o.narrative.alternativesConsidered}:{}}:{},economicIntentId:t.economicIntentId,executionPayloadHash:t.executionPayloadHash};return j_t(c)}});var ARe=_(vh=>{"use strict";Object.defineProperty(vh,"__esModule",{value:!0});vh.formatCents=V_t;vh.formatUsd=Nfn;vh.formatMicros=Ute;vh.formatMicrosWire=Cfn;vh.formatTxAmount=Mfn;vh.formatDate=kfn;vh.formatRelativeTime=Dfn;vh.formatTime=Lfn;vh.formatAge=Ufn;var H_t=1e6,Rfn=100;function V_t(e,t={}){let r=t.fallback??"\u2014";if(e==null||!Number.isFinite(e))return r;let i=(e/Rfn).toLocaleString("en-US",{style:"currency",currency:"USD",minimumFractionDigits:t.minimumFractionDigits??2,maximumFractionDigits:t.maximumFractionDigits??2});return t.showPlusSign&&e>0?`+${i}`:i}function Nfn(e,t={}){let r=t.fallback??"\u2014";if(e==null||!Number.isFinite(e))return r;let n=e.toLocaleString("en-US",{style:"currency",currency:"USD",minimumFractionDigits:t.minimumFractionDigits??2,maximumFractionDigits:t.maximumFractionDigits??2});return t.showPlusSign&&e>0?`+${n}`:n}function Ute(e,t={}){let r=t.fallback??"\u2014",n=typeof e=="string"?e===""?null:Number(e):e;if(n==null||!Number.isFinite(n))return r;let o=(n/H_t).toLocaleString("en-US",{style:"currency",currency:"USD",minimumFractionDigits:t.minimumFractionDigits??2,maximumFractionDigits:t.maximumFractionDigits??6});return t.showPlusSign&&n>0?`+${o}`:o}function Cfn(e,t,r={}){return e&&/^-?\d+$/.test(e)?Ute(e,r):t!=null&&Number.isFinite(t)?V_t(t,r):r.fallback??"\u2014"}function Mfn(e,t={}){let r=Number(e.amount_micros);if(Number.isFinite(r)&&e.amount_micros!=null&&e.amount_micros!=="")return Ute(r,t);let n=Number(String(e.amount).replace(/^\$/,""));return Number.isFinite(n)?Ute(n*H_t,t):t.fallback??"\u2014"}function kfn(e,t={}){let r=t.fallback??"\u2014";if(!e)return r;let n=new Date(e);return Number.isNaN(n.getTime())?r:n.toLocaleDateString("en-US",{month:"short",day:"numeric",year:"numeric",timeZone:t.timeZone??"UTC"})}function Dfn(e,t=Date.now()){if(!e)return"\u2014";let r=Date.parse(e);if(Number.isNaN(r))return"\u2014";let n=t-r,i=n>=0,o=Math.abs(n),s=Math.floor(o/1e3),a=Math.floor(s/60),c=Math.floor(a/60),u=Math.floor(c/24),d=Math.floor(u/7),l=Math.floor(u/30),p=Math.floor(u/365);return s<45?"just now":a<1?i?"a minute ago":"in a minute":a<60?x8(n,i,a,"minute"):c<24?x8(n,i,c,"hour"):u===1?i?"yesterday":"tomorrow":u<7?x8(n,i,u,"day"):d<4?x8(n,i,d,"week"):l<12?x8(n,i,l,"month"):x8(n,i,p,"year")}function x8(e,t,r,n){let i=r!==1?"s":"";return t?`${r} ${n}${i} ago`:`in ${r} ${n}${i}`}function Lfn(e,t={}){let r=t.fallback??"\u2014";if(!e)return r;let n=new Date(e);return Number.isNaN(n.getTime())?r:n.toLocaleString("en-US",{month:"short",day:"numeric",year:"numeric",hour:"2-digit",minute:"2-digit",timeZone:t.timeZone??"UTC"})}function Ufn(e,t){if(!e)return"";let r=Date.parse(e);if(Number.isNaN(r))return"";let n=Math.max(0,t-r),i=Math.floor(n/1e3);if(i<45)return"just now";let o=Math.floor(i/60);if(o<60)return`${o}m ago`;let s=Math.floor(o/60);if(s<24)return`${s}h ago`;let a=Math.floor(s/24);if(a<30)return`${a}d ago`;let c=Math.floor(a/30);return c<12?`${c}mo ago`:`${Math.floor(a/365)}y ago`}});var wRe=_(Wr=>{"use strict";Object.defineProperty(Wr,"__esModule",{value:!0});Wr.AGENT_GRANT_MAX_PER_PURCHASE_CENTS=Wr.AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS=Wr.AGENT_GRANT_MIN_LIMIT_MICROS=Wr.AGENT_GRANT_MAX_PER_PURCHASE_MICROS=Wr.AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS=Wr.MPP_PAYMENT_MAX_MICROS=Wr.MPP_PAYMENT_MIN_MICROS=Wr.DEFAULT_SESSION_CAP_MICROS=Wr.MAX_MERCHANT_PRICE_MICROS=Wr.MIN_MERCHANT_PRICE_MICROS=Wr.DEFAULT_AUTOTOPUP_THRESHOLD_MICROS=Wr.DEFAULT_DAILY_CAP_MICROS=Wr.MIN_TOPUP_RETRY_FLOOR_MICROS=Wr.MIN_TOPUP_MICROS=Wr.MIN_SETTLEMENT_MICROS=void 0;var yp=Rg();Wr.MIN_SETTLEMENT_MICROS=(0,yp.micros)(10000000n);Wr.MIN_TOPUP_MICROS=(0,yp.micros)(1000000n);Wr.MIN_TOPUP_RETRY_FLOOR_MICROS=(0,yp.micros)(1000000n);Wr.DEFAULT_DAILY_CAP_MICROS=(0,yp.micros)(5000000n);Wr.DEFAULT_AUTOTOPUP_THRESHOLD_MICROS=(0,yp.micros)(5000000n);Wr.MIN_MERCHANT_PRICE_MICROS=(0,yp.micros)(0n);Wr.MAX_MERCHANT_PRICE_MICROS=(0,yp.micros)(10000000000n);Wr.DEFAULT_SESSION_CAP_MICROS=(0,yp.micros)(5000000n);Wr.MPP_PAYMENT_MIN_MICROS=(0,yp.micros)(10000n);Wr.MPP_PAYMENT_MAX_MICROS=(0,yp.micros)(1000000000n);Wr.AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS=(0,yp.micros)(1000000000n);Wr.AGENT_GRANT_MAX_PER_PURCHASE_MICROS=(0,yp.micros)(50000000n);Wr.AGENT_GRANT_MIN_LIMIT_MICROS=(0,yp.micros)(1000n);Wr.AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS=1e5;Wr.AGENT_GRANT_MAX_PER_PURCHASE_CENTS=5e3});var K_t=_(bp=>{"use strict";Object.defineProperty(bp,"__esModule",{value:!0});bp.MAX_BUDGET_DRAWS=void 0;bp.derivePurchaseCountDetail=$_t;bp.derivePurchaseCountDetailMicros=z_t;bp.derivePurchaseCount=G_t;bp.describePurchaseCount=Hfn;bp.describePurchaseCountMicros=Vfn;var O8=ARe(),Bfn=wRe();bp.MAX_BUDGET_DRAWS=20;function F_t(e,t){if(!Number.isSafeInteger(t)||t<=0)throw new TypeError(`${e}: expected a positive safe integer of cents, got ${t}`)}function $_t(e,t){F_t("aggregateCeilingCents",e),F_t("perPurchaseCents",t);let r=Math.ceil(e/t),n=Math.max(1,Math.min(bp.MAX_BUDGET_DRAWS,r)),i=r>bp.MAX_BUDGET_DRAWS;return{count:n,clamped:i,unreachableCents:i?e-n*t:0}}function kB(e,t){if(!/^[1-9]\d{0,18}$/.test(t))throw new TypeError(`${e}: expected canonical positive integer micros, got ${t}`);return BigInt(t)}function z_t(e,t){let r=kB("aggregateCeilingMicros",e),n=kB("perPurchaseMicros",t),i=(r+n-1n)/n,o=Math.max(1,Math.min(bp.MAX_BUDGET_DRAWS,Number(i))),s=i>BigInt(bp.MAX_BUDGET_DRAWS);return{count:o,clamped:s,unreachableMicros:s?(r-BigInt(o)*n).toString():"0"}}function G_t(e,t){return $_t(e,t).count}function jfn(e){let t=[Math.floor(e/5),Math.floor(e/4),Math.floor(e/2)].filter(r=>r>=1);for(let r of t){let n=G_t(e,r);if(n>=2)return{perCents:r,count:n}}return null}function qfn(e){let t=kB("aggregateCeilingMicros",e),r=[t/5n,t/4n,t/2n].filter(n=>n>=Bfn.AGENT_GRANT_MIN_LIMIT_MICROS);for(let n of r){let i=z_t(e,n.toString()).count;if(i>=2)return{perMicros:n.toString(),count:i}}return null}function Hfn(e,t,r){let n=(0,O8.formatCents)(t);if(e.clamped)return`This budget covers ${e.count} purchases \u2014 the most one budget allows. Each can be up to ${n}. ${(0,O8.formatCents)(e.unreachableCents)} of the total can never be spent. Raise the per-purchase amount to use all of it.`;if(e.count===1){let i=jfn(r),o=i?` Lower the per-purchase amount to allow more purchases \u2014 ${(0,O8.formatCents)(i.perCents)} allows ${i.count}.`:" Lower the per-purchase amount to allow more purchases.";return`This budget covers 1 purchase of up to ${n}. A smaller charge still uses that one purchase, and leftover budget sits unused.${o}`}return`This budget covers ${e.count} purchases. Each can be up to ${n}. Smaller charges are fine \u2014 each one still counts as a purchase.`}function Vfn(e,t,r){kB("perPurchaseMicros",t),kB("aggregateCeilingMicros",r);let n=(0,O8.formatMicros)(t);if(e.clamped)return`This budget covers ${e.count} purchases \u2014 the most one budget allows. Each can be up to ${n}. ${(0,O8.formatMicros)(e.unreachableMicros)} of the total can never be spent. Raise the per-purchase amount to use all of it.`;if(e.count===1){let i=qfn(r),o=i?` Lower the per-purchase amount to allow more purchases \u2014 ${(0,O8.formatMicros)(i.perMicros)} allows ${i.count}.`:" Lower the per-purchase amount to allow more purchases.";return`This budget covers 1 purchase of up to ${n}. A smaller charge still uses that one purchase, and leftover budget sits unused.${o}`}return`This budget covers ${e.count} purchases. Each can be up to ${n}. Smaller charges are fine \u2014 each one still counts as a purchase.`}});var Rg=_(ut=>{"use strict";Object.defineProperty(ut,"__esModule",{value:!0});ut.describePurchaseCountMicros=ut.describePurchaseCount=ut.derivePurchaseCountDetailMicros=ut.derivePurchaseCountDetail=ut.derivePurchaseCount=ut.MAX_BUDGET_DRAWS=ut.AGENT_GRANT_MAX_PER_PURCHASE_CENTS=ut.AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS=ut.AGENT_GRANT_MIN_LIMIT_MICROS=ut.AGENT_GRANT_MAX_PER_PURCHASE_MICROS=ut.AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS=ut.formatAge=ut.formatTime=ut.formatRelativeTime=ut.formatDate=ut.formatTxAmount=ut.formatMicrosWire=ut.formatMicros=ut.formatUsd=ut.formatCents=void 0;ut.micros=Ffn;ut.fromCents=$fn;ut.fromUsdc=zfn;ut.fromUsd=Gfn;ut.toCents=Kfn;ut.toCentsForAcquirer=Wfn;ut.toUsdc=Yfn;ut.toWire=Jfn;ut.fromWire=Xfn;ut.toDisplay=Zfn;ut.toUsdRounded2dp=Qfn;ut.add=emn;ut.sub=tmn;ut.clampNonNegative=rmn;ut.isNonNegative=nmn;ut.max=imn;ut.min=omn;var Jy=10000n,W_t=1000000n;function Ffn(e){return e}function $fn(e){if(!Number.isFinite(e)||!Number.isInteger(e)||!Number.isSafeInteger(e))throw new TypeError(`fromCents: expected safe integer, got ${e}`);return BigInt(e)*Jy}function zfn(e){return e}function Gfn(e){if(!Number.isFinite(e))throw new TypeError(`fromUsd: expected finite number, got ${e}`);return BigInt(Math.round(e*1e6))}function Kfn(e){if(e>=0n)return Number(e/Jy);let t=e/Jy,r=e%Jy;return Number(r===0n?t:t-1n)}function Wfn(e){if(e<0n)throw new RangeError(`toCentsForAcquirer: refusing negative micros (${e}); card charges are non-negative`);return Number(e/Jy)}function Yfn(e){return e}function Jfn(e){return e.toString()}function Xfn(e){if(typeof e!="string"||e.length===0)throw new TypeError(`fromWire: expected non-empty string, got ${typeof e} ${JSON.stringify(e)}`);if(!/^-?\d+$/.test(e))throw new TypeError(`fromWire: not a valid micros integer: ${JSON.stringify(e)}`);return BigInt(e)}function Zfn(e,t={}){let r=t.decimals??2,n=t.symbol??"$",i=e<0n,o=i?-e:e,s=o/W_t,a=o%W_t,c=i?"-":"";if(r===0)return`${c}${n}${s.toString()}`;let u=a.toString().padStart(6,"0").slice(0,r);return`${c}${n}${s.toString()}.${u}`}function Qfn(e){let t=e<0n,r=t?-e:e,n=r/Jy,o=r%Jy*2n,s;o<Jy?s=n:o>Jy?s=n+1n:s=n%2n===0n?n:n+1n;let a=Number(s)/100;return t?-a:a}function emn(e,t){return e+t}function tmn(e,t){return e-t}function rmn(e){return e<0n?0n:e}function nmn(e){return e>=0n}function imn(e,t){return e>t?e:t}function omn(e,t){return e<t?e:t}var Xy=ARe();Object.defineProperty(ut,"formatCents",{enumerable:!0,get:function(){return Xy.formatCents}});Object.defineProperty(ut,"formatUsd",{enumerable:!0,get:function(){return Xy.formatUsd}});Object.defineProperty(ut,"formatMicros",{enumerable:!0,get:function(){return Xy.formatMicros}});Object.defineProperty(ut,"formatMicrosWire",{enumerable:!0,get:function(){return Xy.formatMicrosWire}});Object.defineProperty(ut,"formatTxAmount",{enumerable:!0,get:function(){return Xy.formatTxAmount}});Object.defineProperty(ut,"formatDate",{enumerable:!0,get:function(){return Xy.formatDate}});Object.defineProperty(ut,"formatRelativeTime",{enumerable:!0,get:function(){return Xy.formatRelativeTime}});Object.defineProperty(ut,"formatTime",{enumerable:!0,get:function(){return Xy.formatTime}});Object.defineProperty(ut,"formatAge",{enumerable:!0,get:function(){return Xy.formatAge}});var DB=wRe();Object.defineProperty(ut,"AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS}});Object.defineProperty(ut,"AGENT_GRANT_MAX_PER_PURCHASE_MICROS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MAX_PER_PURCHASE_MICROS}});Object.defineProperty(ut,"AGENT_GRANT_MIN_LIMIT_MICROS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MIN_LIMIT_MICROS}});Object.defineProperty(ut,"AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS}});Object.defineProperty(ut,"AGENT_GRANT_MAX_PER_PURCHASE_CENTS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MAX_PER_PURCHASE_CENTS}});var R8=K_t();Object.defineProperty(ut,"MAX_BUDGET_DRAWS",{enumerable:!0,get:function(){return R8.MAX_BUDGET_DRAWS}});Object.defineProperty(ut,"derivePurchaseCount",{enumerable:!0,get:function(){return R8.derivePurchaseCount}});Object.defineProperty(ut,"derivePurchaseCountDetail",{enumerable:!0,get:function(){return R8.derivePurchaseCountDetail}});Object.defineProperty(ut,"derivePurchaseCountDetailMicros",{enumerable:!0,get:function(){return R8.derivePurchaseCountDetailMicros}});Object.defineProperty(ut,"describePurchaseCount",{enumerable:!0,get:function(){return R8.describePurchaseCount}});Object.defineProperty(ut,"describePurchaseCountMicros",{enumerable:!0,get:function(){return R8.describePurchaseCountMicros}})});var MRe=_(Zu=>{"use strict";var smn=Zu&&Zu.__createBinding||(Object.create?(function(e,t,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(t,r);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[r]}}),Object.defineProperty(e,n,i)}):(function(e,t,r,n){n===void 0&&(n=r),e[n]=t[r]})),amn=Zu&&Zu.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),X_t=Zu&&Zu.__importStar||(function(){var e=function(t){return e=Object.getOwnPropertyNames||function(r){var n=[];for(var i in r)Object.prototype.hasOwnProperty.call(r,i)&&(n[n.length]=i);return n},e(t)};return function(t){if(t&&t.__esModule)return t;var r={};if(t!=null)for(var n=e(t),i=0;i<n.length;i++)n[i]!=="default"&&smn(r,t,n[i]);return amn(r,t),r}})();Object.defineProperty(Zu,"__esModule",{value:!0});Zu.pruneResponsesDir=BB;Zu.isTextualContentType=Bte;Zu.isValidUtf8=ORe;Zu.spillFilename=eyt;Zu.extractPaidImageArtifact=bmn;Zu.describePaidBody=xRe;Zu.capturePaidResponse=Emn;var il=X_t(require("fs")),LB=X_t(require("path")),IRe=require("node:crypto"),Z_t=16*1024,PRe=2*1024,cmn=64*1024*1024,Q_t=32*1024*1024,Y_t=24*1024*1024,umn=2e3,dmn=12,lmn=3e4,UB=256*1024*1024;function BB(e,t=UB,r){try{let n=new Set((typeof r=="string"?[r]:r??[]).map(s=>LB.basename(s))),i=il.readdirSync(e).map(s=>{if(s.includes(".part-"))return null;try{let a=il.statSync(LB.join(e,s));return a.isFile()?{name:s,size:a.size,mtime:a.mtimeMs}:null}catch{return null}}).filter(s=>s!==null).sort((s,a)=>n.has(s.name)&&!n.has(a.name)?-1:n.has(a.name)&&!n.has(s.name)?1:a.mtime-s.mtime),o=0;for(let s of i)if(o+=s.size,o>t&&!n.has(s.name))try{il.rmSync(LB.join(e,s.name),{force:!0})}catch{}}catch{}}var pmn=new Set(["application/json","application/xml","application/javascript","application/x-www-form-urlencoded","application/csv"]);function Bte(e){if(!e)return!1;let t=e.split(";",1)[0].trim().toLowerCase();return t.startsWith("text/")||t.endsWith("+json")||t.endsWith("+xml")||pmn.has(t)}function ORe(e){try{return new TextDecoder("utf-8",{fatal:!0}).decode(e),!0}catch{return!1}}var fmn={"application/json":".json","application/pdf":".pdf","audio/mpeg":".mp3","image/gif":".gif","image/jpeg":".jpg","image/png":".png","image/svg+xml":".svg","image/webp":".webp","text/csv":".csv","text/html":".html","text/plain":".txt","video/mp4":".mp4"};function eyt(e,t,r){let n="unknown-host";try{n=new URL(e).hostname.toLowerCase()}catch{}let i=n.replace(/[^a-z0-9.-]/g,"_").slice(0,80),o=(t??"").split(";",1)[0].trim().toLowerCase(),s=fmn[o]??(Bte(t)?".txt":".bin");return`${r.toISOString().replace(/[:.]/g,"-")}-${i}${s}`}function RRe(e,t,r){let n=eyt(t,r,new Date),i=LB.extname(n),o=n.slice(0,n.length-i.length);return LB.join(e,`${o}-${(0,IRe.randomBytes)(8).toString("hex")}${i}`)}function NRe(e){il.mkdirSync(e,{recursive:!0,mode:448})}var mmn=new Set(["image/gif","image/jpeg","image/png","image/webp"]);function hmn(e){let t=(e??"").split(";",1)[0].trim().toLowerCase();return t==="application/json"||t.endsWith("+json")}function gmn(e,t){if(t==="image/png")return e.length>=8&&e.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]));if(t==="image/jpeg")return e.length>=3&&e[0]===255&&e[1]===216&&e[2]===255;if(t==="image/gif"){if(e.length<6)return!1;let r=e.subarray(0,6).toString("ascii");return r==="GIF87a"||r==="GIF89a"}return e.length>=12&&e.subarray(0,4).toString("ascii")==="RIFF"&&e.subarray(8,12).toString("ascii")==="WEBP"}function _mn(e){if(!e.startsWith("data:image/"))return null;let t=e.indexOf(";base64,");if(t<=5)return null;let r=e.slice(5,t).toLowerCase();if(!mmn.has(r))return null;let n=e.slice(t+8);if(n.length===0||n.length%4!==0||n.length>Math.ceil(Y_t/3)*4)return null;let i=Buffer.from(n,"base64");if(i.length===0||i.length>Y_t||i.toString("base64")!==n)return null;let o=r;return gmn(i,o)?{body:i,mimeType:o}:null}function ymn(e){let t=[{depth:0,value:e}],r=0;for(;t.length>0&&r<umn;){let n=t.pop();if(r+=1,typeof n.value=="string"){let o=_mn(n.value);if(o)return o;continue}if(n.depth>=dmn||!n.value||typeof n.value!="object")continue;let i=Array.isArray(n.value)?n.value:Object.values(n.value);for(let o=i.length-1;o>=0;o-=1)t.push({depth:n.depth+1,value:i[o]})}return null}function bmn(e,t,r,n){let i=CRe(e,t,r,n);return i&&BB(n,UB,[i.path]),i}function CRe(e,t,r,n){if(!hmn(t)||r.length===0||r.length>Q_t||!ORe(r))return null;let i;try{i=JSON.parse(r.toString("utf8"))}catch{return null}let o=ymn(i);if(!o)return null;let s=null;try{NRe(n);let a=RRe(n,e,o.mimeType);return s=`${a}.part-${process.pid}-${(0,IRe.randomBytes)(8).toString("hex")}`,il.writeFileSync(s,o.body,{flag:"wx",mode:384}),il.renameSync(s,a),s=null,{kind:"image",path:a,mimeType:o.mimeType,sha256:(0,IRe.createHash)("sha256").update(o.body).digest("hex"),bytes:o.body.length}}catch{if(s)try{il.rmSync(s,{force:!0})}catch{}return null}}function J_t(e,t){let r=0;for(;r<t.length;){let n=il.writeSync(e,t,r,t.length-r,null);if(n<=0)throw new Error("Paid response file write made no progress.");r+=n}}function xRe(e,t,r,n,i){let o=r?Bte(r):ORe(n),s={status:t,contentType:r??"unknown",bodyBytes:n.length};if(n.length===0)return{...s,body:""};let a=CRe(e,r,n,i);if(o&&n.length<=Z_t)return a&&BB(i,UB,[a.path]),{...s,body:n.toString("utf-8"),...a?{imageArtifact:a}:{}};NRe(i);let c=RRe(i,e,r);return il.writeFileSync(c,n,{flag:"wx",mode:384}),BB(i,UB,a?[c,a.path]:[c]),{...s,bodyFile:c,...a?{imageArtifact:a}:{},...o?{bodyPreview:n.subarray(0,PRe).toString("utf-8")}:{},note:"Body too large or binary to inline \u2014 full paid response written to bodyFile."}}async function Emn(e,t,r,n={}){let i=n.maxBytes??cmn,o=n.timeoutMs??lmn;if(!Number.isSafeInteger(i)||i<=0)throw new Error("Paid response capture maxBytes must be a positive safe integer.");if(!Number.isFinite(o)||o<=0)throw new Error("Paid response capture timeoutMs must be positive.");let s=t.headers.get("content-length");if(s&&/^\d+$/.test(s.trim())){let b=Number(s);if(Number.isSafeInteger(b)&&b>i)throw t.body?.cancel("paid response exceeds capture limit").catch(()=>{}),new Error(`Merchant response body exceeds the ${i}-byte capture limit (declared ${b} bytes).`)}if(!t.body)return xRe(e,t.status,t.headers.get("content-type"),Buffer.alloc(0),r);let a=t.body.getReader(),c=Date.now(),u=[],d=0,l=0,p=null,f=null,m=null,h=[],g=0,y=()=>{p!==null&&(il.closeSync(p),p=null)},S=()=>{if(y(),m)try{il.rmSync(m,{force:!0})}catch{}};try{for(;;){let w=o-(Date.now()-c);if(w<=0)throw new Error(`Merchant response body timed out after ${o}ms.`);let I,N=new Promise((x,D)=>{I=setTimeout(()=>D(new Error(`Merchant response body timed out after ${o}ms.`)),w)}),O;try{O=await Promise.race([a.read(),N])}finally{I&&clearTimeout(I)}if(O.done)break;let P=Buffer.from(O.value);if(l+=P.length,l>i)throw new Error(`Merchant response body exceeded the ${i}-byte capture limit.`);if(g<PRe){let x=P.subarray(0,Math.min(P.length,PRe-g));h.push(Buffer.from(x)),g+=x.length}if(p===null){if(u.push(P),d+=P.length,d<=Z_t)continue;NRe(r),f=RRe(r,e,t.headers.get("content-type")),m=`${f}.part-${process.pid}-${Math.random().toString(16).slice(2)}`,p=il.openSync(m,"wx",384);for(let x of u)J_t(p,x);u.length=0,d=0}else J_t(p,P)}if(p===null){let w=Buffer.concat(u,d);return xRe(e,t.status,t.headers.get("content-type"),w,r)}y(),il.renameSync(m,f),m=null;let b=t.headers.get("content-type"),E=b?Bte(b):!1,T=l<=Q_t?CRe(e,b,il.readFileSync(f),r):null;return BB(r,UB,T?[f,T.path]:[f]),{status:t.status,contentType:b??"unknown",bodyBytes:l,bodyFile:f,...T?{imageArtifact:T}:{},...E?{bodyPreview:Buffer.concat(h).toString("utf-8")}:{},note:"Body too large or binary to inline \u2014 full paid response written to bodyFile."}}catch(b){throw a.cancel("paid response capture failed").catch(()=>{}),S(),b}finally{try{a.releaseLock()}catch{}}}});var N8=_(Ng=>{"use strict";Object.defineProperty(Ng,"__esModule",{value:!0});Ng.hashTypedData=Ng.EIP3009_TYPES=Ng.MAX_DEADLINE_SECONDS=Ng.NETWORKS=void 0;Ng.NETWORKS={"base-mainnet":{id:"base-mainnet",caip2:"eip155:8453",chainId:8453,usdc:{address:"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",eip712Domain:{name:"USD Coin",version:"2"}},rpcUrl:"https://mainnet.base.org",explorerBaseUrl:"https://basescan.org",isTestnet:!1},"base-sepolia":{id:"base-sepolia",caip2:"eip155:84532",chainId:84532,usdc:{address:"0x036CbD53842c5426634e7929541eC2318f3dCF7e",eip712Domain:{name:"USDC",version:"2"}},rpcUrl:"https://sepolia.base.org",explorerBaseUrl:"https://sepolia.basescan.org",isTestnet:!0}};Ng.MAX_DEADLINE_SECONDS=600;Ng.EIP3009_TYPES={TransferWithAuthorization:[{name:"from",type:"address"},{name:"to",type:"address"},{name:"value",type:"uint256"},{name:"validAfter",type:"uint256"},{name:"validBefore",type:"uint256"},{name:"nonce",type:"bytes32"}]};var Smn=ph();Object.defineProperty(Ng,"hashTypedData",{enumerable:!0,get:function(){return Smn.hashTypedData}})});var eT=_(bc=>{"use strict";Object.defineProperty(bc,"__esModule",{value:!0});bc.TURNKEY_API_BASE_URL_ENV=bc.CIRCLE_TESTNET_FAUCET_URL=bc.NETWORK_ENV=bc.NETWORKS=void 0;bc.resolveNetwork=Tmn;bc.turnkeyApiBaseUrl=wmn;bc.explorerTxUrl=Imn;bc.explorerAddressUrl=Pmn;var tyt=N8(),vmn=N8();Object.defineProperty(bc,"NETWORKS",{enumerable:!0,get:function(){return vmn.NETWORKS}});bc.NETWORK_ENV="VISA_V4_NETWORK";bc.CIRCLE_TESTNET_FAUCET_URL="https://faucet.circle.com";var ryt={"base-mainnet":"base-mainnet","base-sepolia":"base-sepolia","eip155:8453":"base-mainnet","eip155:84532":"base-sepolia"};function Tmn(e=process.env){let t=(e[bc.NETWORK_ENV]??"").trim();if(t==="")return tyt.NETWORKS["base-mainnet"];let r=ryt[t.toLowerCase()];if(!r)throw new Error(`unknown ${bc.NETWORK_ENV} value ${JSON.stringify(t)} \u2014 valid values: `+Object.keys(ryt).join(", "));return tyt.NETWORKS[r]}bc.TURNKEY_API_BASE_URL_ENV="TURNKEY_API_BASE_URL";var Amn="https://api.turnkey.com";function wmn(e=process.env){let t=(e[bc.TURNKEY_API_BASE_URL_ENV]??"").trim();return t===""?Amn:t}function Imn(e,t){return`${e.explorerBaseUrl}/tx/${t}`}function Pmn(e,t){return`${e.explorerBaseUrl}/address/${t}`}});var C8=_(Lt=>{"use strict";Object.defineProperty(Lt,"__esModule",{value:!0});Lt.notImplemented=Lt.bitMask=Lt.utf8ToBytes=Lt.randomBytes=Lt.isBytes=Lt.hexToBytes=Lt.concatBytes=Lt.bytesToUtf8=Lt.bytesToHex=Lt.anumber=Lt.abytes=void 0;Lt.abool=xmn;Lt._abool2=Omn;Lt._abytes2=Rmn;Lt.numberToHexUnpadded=nyt;Lt.hexToNumber=DRe;Lt.bytesToNumberBE=Nmn;Lt.bytesToNumberLE=Cmn;Lt.numberToBytesBE=iyt;Lt.numberToBytesLE=Mmn;Lt.numberToVarBytesBE=kmn;Lt.ensureBytes=Dmn;Lt.equalBytes=Lmn;Lt.copyBytes=Umn;Lt.asciiToBytes=Bmn;Lt.inRange=oyt;Lt.aInRange=jmn;Lt.bitLen=qmn;Lt.bitGet=Hmn;Lt.bitSet=Vmn;Lt.createHmacDrbg=$mn;Lt.validateObject=Gmn;Lt.isHash=Kmn;Lt._validateObject=Wmn;Lt.memoized=Jmn;var Cg=Zo(),Zy=Zo();Object.defineProperty(Lt,"abytes",{enumerable:!0,get:function(){return Zy.abytes}});Object.defineProperty(Lt,"anumber",{enumerable:!0,get:function(){return Zy.anumber}});Object.defineProperty(Lt,"bytesToHex",{enumerable:!0,get:function(){return Zy.bytesToHex}});Object.defineProperty(Lt,"bytesToUtf8",{enumerable:!0,get:function(){return Zy.bytesToUtf8}});Object.defineProperty(Lt,"concatBytes",{enumerable:!0,get:function(){return Zy.concatBytes}});Object.defineProperty(Lt,"hexToBytes",{enumerable:!0,get:function(){return Zy.hexToBytes}});Object.defineProperty(Lt,"isBytes",{enumerable:!0,get:function(){return Zy.isBytes}});Object.defineProperty(Lt,"randomBytes",{enumerable:!0,get:function(){return Zy.randomBytes}});Object.defineProperty(Lt,"utf8ToBytes",{enumerable:!0,get:function(){return Zy.utf8ToBytes}});var jte=BigInt(0),jB=BigInt(1);function xmn(e,t){if(typeof t!="boolean")throw new Error(e+" boolean expected, got "+t)}function Omn(e,t=""){if(typeof e!="boolean"){let r=t&&`"${t}"`;throw new Error(r+"expected boolean, got type="+typeof e)}return e}function Rmn(e,t,r=""){let n=(0,Cg.isBytes)(e),i=e?.length,o=t!==void 0;if(!n||o&&i!==t){let s=r&&`"${r}" `,a=o?` of length ${t}`:"",c=n?`length=${i}`:`type=${typeof e}`;throw new Error(s+"expected Uint8Array"+a+", got "+c)}return e}function nyt(e){let t=e.toString(16);return t.length&1?"0"+t:t}function DRe(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?jte:BigInt("0x"+e)}function Nmn(e){return DRe((0,Cg.bytesToHex)(e))}function Cmn(e){return(0,Cg.abytes)(e),DRe((0,Cg.bytesToHex)(Uint8Array.from(e).reverse()))}function iyt(e,t){return(0,Cg.hexToBytes)(e.toString(16).padStart(t*2,"0"))}function Mmn(e,t){return iyt(e,t).reverse()}function kmn(e){return(0,Cg.hexToBytes)(nyt(e))}function Dmn(e,t,r){let n;if(typeof t=="string")try{n=(0,Cg.hexToBytes)(t)}catch(o){throw new Error(e+" must be hex string or Uint8Array, cause: "+o)}else if((0,Cg.isBytes)(t))n=Uint8Array.from(t);else throw new Error(e+" must be hex string or Uint8Array");let i=n.length;if(typeof r=="number"&&i!==r)throw new Error(e+" of length "+r+" expected, got "+i);return n}function Lmn(e,t){if(e.length!==t.length)return!1;let r=0;for(let n=0;n<e.length;n++)r|=e[n]^t[n];return r===0}function Umn(e){return Uint8Array.from(e)}function Bmn(e){return Uint8Array.from(e,(t,r)=>{let n=t.charCodeAt(0);if(t.length!==1||n>127)throw new Error(`string contains non-ASCII character "${e[r]}" with code ${n} at position ${r}`);return n})}var kRe=e=>typeof e=="bigint"&&jte<=e;function oyt(e,t,r){return kRe(e)&&kRe(t)&&kRe(r)&&t<=e&&e<r}function jmn(e,t,r,n){if(!oyt(t,r,n))throw new Error("expected valid "+e+": "+r+" <= n < "+n+", got "+t)}function qmn(e){let t;for(t=0;e>jte;e>>=jB,t+=1);return t}function Hmn(e,t){return e>>BigInt(t)&jB}function Vmn(e,t,r){return e|(r?jB:jte)<<BigInt(t)}var Fmn=e=>(jB<<BigInt(e))-jB;Lt.bitMask=Fmn;function $mn(e,t,r){if(typeof e!="number"||e<2)throw new Error("hashLen must be a number");if(typeof t!="number"||t<2)throw new Error("qByteLen must be a number");if(typeof r!="function")throw new Error("hmacFn must be a function");let n=f=>new Uint8Array(f),i=f=>Uint8Array.of(f),o=n(e),s=n(e),a=0,c=()=>{o.fill(1),s.fill(0),a=0},u=(...f)=>r(s,o,...f),d=(f=n(0))=>{s=u(i(0),f),o=u(),f.length!==0&&(s=u(i(1),f),o=u())},l=()=>{if(a++>=1e3)throw new Error("drbg: tried 1000 values");let f=0,m=[];for(;f<t;){o=u();let h=o.slice();m.push(h),f+=o.length}return(0,Cg.concatBytes)(...m)};return(f,m)=>{c(),d(f);let h;for(;!(h=m(l()));)d();return c(),h}}var zmn={bigint:e=>typeof e=="bigint",function:e=>typeof e=="function",boolean:e=>typeof e=="boolean",string:e=>typeof e=="string",stringOrUint8Array:e=>typeof e=="string"||(0,Cg.isBytes)(e),isSafeInteger:e=>Number.isSafeInteger(e),array:e=>Array.isArray(e),field:(e,t)=>t.Fp.isValid(e),hash:e=>typeof e=="function"&&Number.isSafeInteger(e.outputLen)};function Gmn(e,t,r={}){let n=(i,o,s)=>{let a=zmn[o];if(typeof a!="function")throw new Error("invalid validator function");let c=e[i];if(!(s&&c===void 0)&&!a(c,e))throw new Error("param "+String(i)+" is invalid. Expected "+o+", got "+c)};for(let[i,o]of Object.entries(t))n(i,o,!1);for(let[i,o]of Object.entries(r))n(i,o,!0);return e}function Kmn(e){return typeof e=="function"&&Number.isSafeInteger(e.outputLen)}function Wmn(e,t,r={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function n(i,o,s){let a=e[i];if(s&&a===void 0)return;let c=typeof a;if(c!==o||a===null)throw new Error(`param "${i}" is invalid: expected ${o}, got ${c}`)}Object.entries(t).forEach(([i,o])=>n(i,o,!1)),Object.entries(r).forEach(([i,o])=>n(i,o,!0))}var Ymn=()=>{throw new Error("not implemented")};Lt.notImplemented=Ymn;function Jmn(e){let t=new WeakMap;return(r,...n)=>{let i=t.get(r);if(i!==void 0)return i;let o=e(r,...n);return t.set(r,o),o}}});var JI=_(Fi=>{"use strict";Object.defineProperty(Fi,"__esModule",{value:!0});Fi.isNegativeLE=void 0;Fi.mod=ol;Fi.pow=Qmn;Fi.pow2=ehn;Fi.invert=qte;Fi.tonelliShanks=URe;Fi.FpSqrt=pyt;Fi.validateField=ohn;Fi.FpPow=BRe;Fi.FpInvertBatch=fyt;Fi.FpDiv=shn;Fi.FpLegendre=Hte;Fi.FpIsSquare=ahn;Fi.nLength=jRe;Fi.Field=Vte;Fi.FpSqrtOdd=chn;Fi.FpSqrtEven=uhn;Fi.hashToPrivateScalar=dhn;Fi.getFieldBytesLength=qRe;Fi.getMinHashLength=myt;Fi.mapHashToField=lhn;var sl=C8(),Qu=BigInt(0),xs=BigInt(1),YI=BigInt(2),syt=BigInt(3),ayt=BigInt(4),cyt=BigInt(5),Xmn=BigInt(7),uyt=BigInt(8),Zmn=BigInt(9),dyt=BigInt(16);function ol(e,t){let r=e%t;return r>=Qu?r:t+r}function Qmn(e,t,r){return BRe(Vte(r),e,t)}function ehn(e,t,r){let n=e;for(;t-- >Qu;)n*=n,n%=r;return n}function qte(e,t){if(e===Qu)throw new Error("invert: expected non-zero number");if(t<=Qu)throw new Error("invert: expected positive modulus, got "+t);let r=ol(e,t),n=t,i=Qu,o=xs,s=xs,a=Qu;for(;r!==Qu;){let u=n/r,d=n%r,l=i-s*u,p=o-a*u;n=r,r=d,i=s,o=a,s=l,a=p}if(n!==xs)throw new Error("invert: does not exist");return ol(i,t)}function LRe(e,t,r){if(!e.eql(e.sqr(t),r))throw new Error("Cannot find square root")}function lyt(e,t){let r=(e.ORDER+xs)/ayt,n=e.pow(t,r);return LRe(e,n,t),n}function thn(e,t){let r=(e.ORDER-cyt)/uyt,n=e.mul(t,YI),i=e.pow(n,r),o=e.mul(t,i),s=e.mul(e.mul(o,YI),i),a=e.mul(o,e.sub(s,e.ONE));return LRe(e,a,t),a}function rhn(e){let t=Vte(e),r=URe(e),n=r(t,t.neg(t.ONE)),i=r(t,n),o=r(t,t.neg(n)),s=(e+Xmn)/dyt;return(a,c)=>{let u=a.pow(c,s),d=a.mul(u,n),l=a.mul(u,i),p=a.mul(u,o),f=a.eql(a.sqr(d),c),m=a.eql(a.sqr(l),c);u=a.cmov(u,d,f),d=a.cmov(p,l,m);let h=a.eql(a.sqr(d),c),g=a.cmov(u,d,h);return LRe(a,g,c),g}}function URe(e){if(e<syt)throw new Error("sqrt is not defined for small field");let t=e-xs,r=0;for(;t%YI===Qu;)t/=YI,r++;let n=YI,i=Vte(e);for(;Hte(i,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return lyt;let o=i.pow(n,t),s=(t+xs)/YI;return function(c,u){if(c.is0(u))return u;if(Hte(c,u)!==1)throw new Error("Cannot find square root");let d=r,l=c.mul(c.ONE,o),p=c.pow(u,t),f=c.pow(u,s);for(;!c.eql(p,c.ONE);){if(c.is0(p))return c.ZERO;let m=1,h=c.sqr(p);for(;!c.eql(h,c.ONE);)if(m++,h=c.sqr(h),m===d)throw new Error("Cannot find square root");let g=xs<<BigInt(d-m-1),y=c.pow(l,g);d=m,l=c.sqr(y),p=c.mul(p,l),f=c.mul(f,y)}return f}}function pyt(e){return e%ayt===syt?lyt:e%uyt===cyt?thn:e%dyt===Zmn?rhn(e):URe(e)}var nhn=(e,t)=>(ol(e,t)&xs)===xs;Fi.isNegativeLE=nhn;var ihn=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function ohn(e){let t={ORDER:"bigint",MASK:"bigint",BYTES:"number",BITS:"number"},r=ihn.reduce((n,i)=>(n[i]="function",n),t);return(0,sl._validateObject)(e,r),e}function BRe(e,t,r){if(r<Qu)throw new Error("invalid exponent, negatives unsupported");if(r===Qu)return e.ONE;if(r===xs)return t;let n=e.ONE,i=t;for(;r>Qu;)r&xs&&(n=e.mul(n,i)),i=e.sqr(i),r>>=xs;return n}function fyt(e,t,r=!1){let n=new Array(t.length).fill(r?e.ZERO:void 0),i=t.reduce((s,a,c)=>e.is0(a)?s:(n[c]=s,e.mul(s,a)),e.ONE),o=e.inv(i);return t.reduceRight((s,a,c)=>e.is0(a)?s:(n[c]=e.mul(s,n[c]),e.mul(s,a)),o),n}function shn(e,t,r){return e.mul(t,typeof r=="bigint"?qte(r,e.ORDER):e.inv(r))}function Hte(e,t){let r=(e.ORDER-xs)/YI,n=e.pow(t,r),i=e.eql(n,e.ONE),o=e.eql(n,e.ZERO),s=e.eql(n,e.neg(e.ONE));if(!i&&!o&&!s)throw new Error("invalid Legendre symbol result");return i?1:o?0:-1}function ahn(e,t){return Hte(e,t)===1}function jRe(e,t){t!==void 0&&(0,sl.anumber)(t);let r=t!==void 0?t:e.toString(2).length,n=Math.ceil(r/8);return{nBitLength:r,nByteLength:n}}function Vte(e,t,r=!1,n={}){if(e<=Qu)throw new Error("invalid field: expected ORDER > 0, got "+e);let i,o,s=!1,a;if(typeof t=="object"&&t!=null){if(n.sqrt||r)throw new Error("cannot specify opts in two arguments");let p=t;p.BITS&&(i=p.BITS),p.sqrt&&(o=p.sqrt),typeof p.isLE=="boolean"&&(r=p.isLE),typeof p.modFromBytes=="boolean"&&(s=p.modFromBytes),a=p.allowedLengths}else typeof t=="number"&&(i=t),n.sqrt&&(o=n.sqrt);let{nBitLength:c,nByteLength:u}=jRe(e,i);if(u>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");let d,l=Object.freeze({ORDER:e,isLE:r,BITS:c,BYTES:u,MASK:(0,sl.bitMask)(c),ZERO:Qu,ONE:xs,allowedLengths:a,create:p=>ol(p,e),isValid:p=>{if(typeof p!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof p);return Qu<=p&&p<e},is0:p=>p===Qu,isValidNot0:p=>!l.is0(p)&&l.isValid(p),isOdd:p=>(p&xs)===xs,neg:p=>ol(-p,e),eql:(p,f)=>p===f,sqr:p=>ol(p*p,e),add:(p,f)=>ol(p+f,e),sub:(p,f)=>ol(p-f,e),mul:(p,f)=>ol(p*f,e),pow:(p,f)=>BRe(l,p,f),div:(p,f)=>ol(p*qte(f,e),e),sqrN:p=>p*p,addN:(p,f)=>p+f,subN:(p,f)=>p-f,mulN:(p,f)=>p*f,inv:p=>qte(p,e),sqrt:o||(p=>(d||(d=pyt(e)),d(l,p))),toBytes:p=>r?(0,sl.numberToBytesLE)(p,u):(0,sl.numberToBytesBE)(p,u),fromBytes:(p,f=!0)=>{if(a){if(!a.includes(p.length)||p.length>u)throw new Error("Field.fromBytes: expected "+a+" bytes, got "+p.length);let h=new Uint8Array(u);h.set(p,r?0:h.length-p.length),p=h}if(p.length!==u)throw new Error("Field.fromBytes: expected "+u+" bytes, got "+p.length);let m=r?(0,sl.bytesToNumberLE)(p):(0,sl.bytesToNumberBE)(p);if(s&&(m=ol(m,e)),!f&&!l.isValid(m))throw new Error("invalid field element: outside of range 0..ORDER");return m},invertBatch:p=>fyt(l,p),cmov:(p,f,m)=>m?f:p});return Object.freeze(l)}function chn(e,t){if(!e.isOdd)throw new Error("Field doesn't have isOdd");let r=e.sqrt(t);return e.isOdd(r)?r:e.neg(r)}function uhn(e,t){if(!e.isOdd)throw new Error("Field doesn't have isOdd");let r=e.sqrt(t);return e.isOdd(r)?e.neg(r):r}function dhn(e,t,r=!1){e=(0,sl.ensureBytes)("privateHash",e);let n=e.length,i=jRe(t).nByteLength+8;if(i<24||n<i||n>1024)throw new Error("hashToPrivateScalar: expected "+i+"-1024 bytes of input, got "+n);let o=r?(0,sl.bytesToNumberLE)(e):(0,sl.bytesToNumberBE)(e);return ol(o,t-xs)+xs}function qRe(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function myt(e){let t=qRe(e);return t+Math.ceil(t/2)}function lhn(e,t,r=!1){let n=e.length,i=qRe(t),o=myt(t);if(n<16||n<o||n>1024)throw new Error("expected "+o+"-1024 bytes of input, got "+n);let s=r?(0,sl.bytesToNumberLE)(e):(0,sl.bytesToNumberBE)(e),a=ol(s,t-xs)+xs;return r?(0,sl.numberToBytesLE)(a,i):(0,sl.numberToBytesBE)(a,i)}});var Syt=_(Th=>{"use strict";Object.defineProperty(Th,"__esModule",{value:!0});Th.wNAF=void 0;Th.negateCt=$Re;Th.normalizeZ=phn;Th.mulEndoUnsafe=fhn;Th.pippenger=mhn;Th.precomputeMSMUnsafe=hhn;Th.validateBasic=ghn;Th._createCurveFields=_hn;var qB=C8(),HB=JI(),M8=BigInt(0),XI=BigInt(1);function $Re(e,t){let r=t.negate();return e?r:t}function phn(e,t){let r=(0,HB.FpInvertBatch)(e.Fp,t.map(n=>n.Z));return t.map((n,i)=>e.fromAffine(n.toAffine(r[i])))}function GRe(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function HRe(e,t){GRe(e,t);let r=Math.ceil(t/e)+1,n=2**(e-1),i=2**e,o=(0,qB.bitMask)(e),s=BigInt(e);return{windows:r,windowSize:n,mask:o,maxNumber:i,shiftBy:s}}function hyt(e,t,r){let{windowSize:n,mask:i,maxNumber:o,shiftBy:s}=r,a=Number(e&i),c=e>>s;a>n&&(a-=o,c+=XI);let u=t*n,d=u+Math.abs(a)-1,l=a===0,p=a<0,f=t%2!==0;return{nextN:c,offset:d,isZero:l,isNeg:p,isNegF:f,offsetF:u}}function yyt(e,t){if(!Array.isArray(e))throw new Error("array expected");e.forEach((r,n)=>{if(!(r instanceof t))throw new Error("invalid point at index "+n)})}function byt(e,t){if(!Array.isArray(e))throw new Error("array of scalars expected");e.forEach((r,n)=>{if(!t.isValid(r))throw new Error("invalid scalar at index "+n)})}var VRe=new WeakMap,Eyt=new WeakMap;function FRe(e){return Eyt.get(e)||1}function gyt(e){if(e!==M8)throw new Error("invalid wNAF")}var zRe=class{constructor(t,r){this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=r}_unsafeLadder(t,r,n=this.ZERO){let i=t;for(;r>M8;)r&XI&&(n=n.add(i)),i=i.double(),r>>=XI;return n}precomputeWindow(t,r){let{windows:n,windowSize:i}=HRe(r,this.bits),o=[],s=t,a=s;for(let c=0;c<n;c++){a=s,o.push(a);for(let u=1;u<i;u++)a=a.add(s),o.push(a);s=a.double()}return o}wNAF(t,r,n){if(!this.Fn.isValid(n))throw new Error("invalid scalar");let i=this.ZERO,o=this.BASE,s=HRe(t,this.bits);for(let a=0;a<s.windows;a++){let{nextN:c,offset:u,isZero:d,isNeg:l,isNegF:p,offsetF:f}=hyt(n,a,s);n=c,d?o=o.add($Re(p,r[f])):i=i.add($Re(l,r[u]))}return gyt(n),{p:i,f:o}}wNAFUnsafe(t,r,n,i=this.ZERO){let o=HRe(t,this.bits);for(let s=0;s<o.windows&&n!==M8;s++){let{nextN:a,offset:c,isZero:u,isNeg:d}=hyt(n,s,o);if(n=a,!u){let l=r[c];i=i.add(d?l.negate():l)}}return gyt(n),i}getPrecomputes(t,r,n){let i=VRe.get(r);return i||(i=this.precomputeWindow(r,t),t!==1&&(typeof n=="function"&&(i=n(i)),VRe.set(r,i))),i}cached(t,r,n){let i=FRe(t);return this.wNAF(i,this.getPrecomputes(i,t,n),r)}unsafe(t,r,n,i){let o=FRe(t);return o===1?this._unsafeLadder(t,r,i):this.wNAFUnsafe(o,this.getPrecomputes(o,t,n),r,i)}createCache(t,r){GRe(r,this.bits),Eyt.set(t,r),VRe.delete(t)}hasCache(t){return FRe(t)!==1}};Th.wNAF=zRe;function fhn(e,t,r,n){let i=t,o=e.ZERO,s=e.ZERO;for(;r>M8||n>M8;)r&XI&&(o=o.add(i)),n&XI&&(s=s.add(i)),i=i.double(),r>>=XI,n>>=XI;return{p1:o,p2:s}}function mhn(e,t,r,n){yyt(r,e),byt(n,t);let i=r.length,o=n.length;if(i!==o)throw new Error("arrays of points and scalars must have equal length");let s=e.ZERO,a=(0,qB.bitLen)(BigInt(i)),c=1;a>12?c=a-3:a>4?c=a-2:a>0&&(c=2);let u=(0,qB.bitMask)(c),d=new Array(Number(u)+1).fill(s),l=Math.floor((t.BITS-1)/c)*c,p=s;for(let f=l;f>=0;f-=c){d.fill(s);for(let h=0;h<o;h++){let g=n[h],y=Number(g>>BigInt(f)&u);d[y]=d[y].add(r[h])}let m=s;for(let h=d.length-1,g=s;h>0;h--)g=g.add(d[h]),m=m.add(g);if(p=p.add(m),f!==0)for(let h=0;h<c;h++)p=p.double()}return p}function hhn(e,t,r,n){GRe(n,t.BITS),yyt(r,e);let i=e.ZERO,o=2**n-1,s=Math.ceil(t.BITS/n),a=(0,qB.bitMask)(n),c=r.map(u=>{let d=[];for(let l=0,p=u;l<o;l++)d.push(p),p=p.add(u);return d});return u=>{if(byt(u,t),u.length>r.length)throw new Error("array of scalars must be smaller than array of points");let d=i;for(let l=0;l<s;l++){if(d!==i)for(let f=0;f<n;f++)d=d.double();let p=BigInt(s*n-(l+1)*n);for(let f=0;f<u.length;f++){let m=u[f],h=Number(m>>p&a);h&&(d=d.add(c[f][h-1]))}}return d}}function ghn(e){return(0,HB.validateField)(e.Fp),(0,qB.validateObject)(e,{n:"bigint",h:"bigint",Gx:"field",Gy:"field"},{nBitLength:"isSafeInteger",nByteLength:"isSafeInteger"}),Object.freeze({...(0,HB.nLength)(e.n,e.nBitLength),...e,p:e.Fp.ORDER})}function _yt(e,t,r){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return(0,HB.validateField)(t),t}else return(0,HB.Field)(e,{isLE:r})}function _hn(e,t,r={},n){if(n===void 0&&(n=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let c of["p","n","h"]){let u=t[c];if(!(typeof u=="bigint"&&u>M8))throw new Error(`CURVE.${c} must be positive bigint`)}let i=_yt(t.p,r.Fp,n),o=_yt(t.n,r.Fn,n),a=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let c of a)if(!i.isValid(t[c]))throw new Error(`CURVE.${c} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:i,Fn:o}}});var $te=_(_i=>{"use strict";Object.defineProperty(_i,"__esModule",{value:!0});_i.DER=_i.DERErr=void 0;_i._splitEndoScalar=Tyt;_i._normFnElement=tT;_i.weierstrassN=JRe;_i.SWUFpSqrtRatio=wyt;_i.mapToCurveSimpleSWU=Ehn;_i.ecdh=Pyt;_i.ecdsa=xyt;_i.weierstrassPoints=Shn;_i._legacyHelperEquat=Ryt;_i.weierstrass=whn;var yhn=cv(),bhn=Zo(),pt=C8(),Qy=Syt(),D8=JI(),vyt=(e,t)=>(e+(e>=0?t:-t)/Mg)/t;function Tyt(e,t,r){let[[n,i],[o,s]]=t,a=vyt(s*e,r),c=vyt(-i*e,r),u=e-a*n-c*o,d=-a*i-c*s,l=u<Ah,p=d<Ah;l&&(u=-u),p&&(d=-d);let f=(0,pt.bitMask)(Math.ceil((0,pt.bitLen)(r)/2))+Ec;if(u<Ah||u>=f||d<Ah||d>=f)throw new Error("splitScalar (endomorphism): failed, k="+e);return{k1neg:l,k1:u,k2neg:p,k2:d}}function WRe(e){if(!["compact","recovered","der"].includes(e))throw new Error('Signature format must be "compact", "recovered", or "der"');return e}function KRe(e,t){let r={};for(let n of Object.keys(t))r[n]=e[n]===void 0?t[n]:e[n];return(0,pt._abool2)(r.lowS,"lowS"),(0,pt._abool2)(r.prehash,"prehash"),r.format!==void 0&&WRe(r.format),r}var Fte=class extends Error{constructor(t=""){super(t)}};_i.DERErr=Fte;_i.DER={Err:Fte,_tlv:{encode:(e,t)=>{let{Err:r}=_i.DER;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length&1)throw new r("tlv.encode: unpadded data");let n=t.length/2,i=(0,pt.numberToHexUnpadded)(n);if(i.length/2&128)throw new r("tlv.encode: long form length too big");let o=n>127?(0,pt.numberToHexUnpadded)(i.length/2|128):"";return(0,pt.numberToHexUnpadded)(e)+o+i+t},decode(e,t){let{Err:r}=_i.DER,n=0;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length<2||t[n++]!==e)throw new r("tlv.decode: wrong tlv");let i=t[n++],o=!!(i&128),s=0;if(!o)s=i;else{let c=i&127;if(!c)throw new r("tlv.decode(long): indefinite length not supported");if(c>4)throw new r("tlv.decode(long): byte length is too big");let u=t.subarray(n,n+c);if(u.length!==c)throw new r("tlv.decode: length bytes not complete");if(u[0]===0)throw new r("tlv.decode(long): zero leftmost byte");for(let d of u)s=s<<8|d;if(n+=c,s<128)throw new r("tlv.decode(long): not minimal encoding")}let a=t.subarray(n,n+s);if(a.length!==s)throw new r("tlv.decode: wrong value length");return{v:a,l:t.subarray(n+s)}}},_int:{encode(e){let{Err:t}=_i.DER;if(e<Ah)throw new t("integer: negative integers are not allowed");let r=(0,pt.numberToHexUnpadded)(e);if(Number.parseInt(r[0],16)&8&&(r="00"+r),r.length&1)throw new t("unexpected DER parsing assertion: unpadded hex");return r},decode(e){let{Err:t}=_i.DER;if(e[0]&128)throw new t("invalid signature integer: negative");if(e[0]===0&&!(e[1]&128))throw new t("invalid signature integer: unnecessary leading zero");return(0,pt.bytesToNumberBE)(e)}},toSig(e){let{Err:t,_int:r,_tlv:n}=_i.DER,i=(0,pt.ensureBytes)("signature",e),{v:o,l:s}=n.decode(48,i);if(s.length)throw new t("invalid signature: left bytes after parsing");let{v:a,l:c}=n.decode(2,o),{v:u,l:d}=n.decode(2,c);if(d.length)throw new t("invalid signature: left bytes after parsing");return{r:r.decode(a),s:r.decode(u)}},hexFromSig(e){let{_tlv:t,_int:r}=_i.DER,n=t.encode(2,r.encode(e.r)),i=t.encode(2,r.encode(e.s)),o=n+i;return t.encode(48,o)}};var Ah=BigInt(0),Ec=BigInt(1),Mg=BigInt(2),k8=BigInt(3),YRe=BigInt(4);function tT(e,t){let{BYTES:r}=e,n;if(typeof t=="bigint")n=t;else{let i=(0,pt.ensureBytes)("private key",t);try{n=e.fromBytes(i)}catch{throw new Error(`invalid private key: expected ui8a of size ${r}, got ${typeof t}`)}}if(!e.isValidNot0(n))throw new Error("invalid private key: out of range [1..N-1]");return n}function JRe(e,t={}){let r=(0,Qy._createCurveFields)("weierstrass",e,t),{Fp:n,Fn:i}=r,o=r.CURVE,{h:s,n:a}=o;(0,pt._validateObject)(t,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object",wrapPrivateKey:"boolean"});let{endo:c}=t;if(c&&(!n.is0(o.a)||typeof c.beta!="bigint"||!Array.isArray(c.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let u=Iyt(n,i);function d(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function l(D,B,M){let{x:R,y:k}=B.toAffine(),U=n.toBytes(R);if((0,pt._abool2)(M,"isCompressed"),M){d();let L=!n.isOdd(k);return(0,pt.concatBytes)(Ayt(L),U)}else return(0,pt.concatBytes)(Uint8Array.of(4),U,n.toBytes(k))}function p(D){(0,pt._abytes2)(D,void 0,"Point");let{publicKey:B,publicKeyUncompressed:M}=u,R=D.length,k=D[0],U=D.subarray(1);if(R===B&&(k===2||k===3)){let L=n.fromBytes(U);if(!n.isValid(L))throw new Error("bad point: is not on curve, wrong x");let q=h(L),j;try{j=n.sqrt(q)}catch(ee){let ne=ee instanceof Error?": "+ee.message:"";throw new Error("bad point: is not on curve, sqrt error"+ne)}d();let F=n.isOdd(j);return(k&1)===1!==F&&(j=n.neg(j)),{x:L,y:j}}else if(R===M&&k===4){let L=n.BYTES,q=n.fromBytes(U.subarray(0,L)),j=n.fromBytes(U.subarray(L,L*2));if(!g(q,j))throw new Error("bad point: is not on curve");return{x:q,y:j}}else throw new Error(`bad point: got length ${R}, expected compressed=${B} or uncompressed=${M}`)}let f=t.toBytes||l,m=t.fromBytes||p;function h(D){let B=n.sqr(D),M=n.mul(B,D);return n.add(n.add(M,n.mul(D,o.a)),o.b)}function g(D,B){let M=n.sqr(B),R=h(D);return n.eql(M,R)}if(!g(o.Gx,o.Gy))throw new Error("bad curve params: generator point");let y=n.mul(n.pow(o.a,k8),YRe),S=n.mul(n.sqr(o.b),BigInt(27));if(n.is0(n.add(y,S)))throw new Error("bad curve params: a or b");function b(D,B,M=!1){if(!n.isValid(B)||M&&n.is0(B))throw new Error(`bad point coordinate ${D}`);return B}function E(D){if(!(D instanceof O))throw new Error("ProjectivePoint expected")}function T(D){if(!c||!c.basises)throw new Error("no endo");return Tyt(D,c.basises,i.ORDER)}let w=(0,pt.memoized)((D,B)=>{let{X:M,Y:R,Z:k}=D;if(n.eql(k,n.ONE))return{x:M,y:R};let U=D.is0();B==null&&(B=U?n.ONE:n.inv(k));let L=n.mul(M,B),q=n.mul(R,B),j=n.mul(k,B);if(U)return{x:n.ZERO,y:n.ZERO};if(!n.eql(j,n.ONE))throw new Error("invZ was invalid");return{x:L,y:q}}),I=(0,pt.memoized)(D=>{if(D.is0()){if(t.allowInfinityPoint&&!n.is0(D.Y))return;throw new Error("bad point: ZERO")}let{x:B,y:M}=D.toAffine();if(!n.isValid(B)||!n.isValid(M))throw new Error("bad point: x or y not field elements");if(!g(B,M))throw new Error("bad point: equation left != right");if(!D.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");return!0});function N(D,B,M,R,k){return M=new O(n.mul(M.X,D),M.Y,M.Z),B=(0,Qy.negateCt)(R,B),M=(0,Qy.negateCt)(k,M),B.add(M)}class O{constructor(B,M,R){this.X=b("x",B),this.Y=b("y",M,!0),this.Z=b("z",R),Object.freeze(this)}static CURVE(){return o}static fromAffine(B){let{x:M,y:R}=B||{};if(!B||!n.isValid(M)||!n.isValid(R))throw new Error("invalid affine point");if(B instanceof O)throw new Error("projective point not allowed");return n.is0(M)&&n.is0(R)?O.ZERO:new O(M,R,n.ONE)}static fromBytes(B){let M=O.fromAffine(m((0,pt._abytes2)(B,void 0,"point")));return M.assertValidity(),M}static fromHex(B){return O.fromBytes((0,pt.ensureBytes)("pointHex",B))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(B=8,M=!0){return x.createCache(this,B),M||this.multiply(k8),this}assertValidity(){I(this)}hasEvenY(){let{y:B}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(B)}equals(B){E(B);let{X:M,Y:R,Z:k}=this,{X:U,Y:L,Z:q}=B,j=n.eql(n.mul(M,q),n.mul(U,k)),F=n.eql(n.mul(R,q),n.mul(L,k));return j&&F}negate(){return new O(this.X,n.neg(this.Y),this.Z)}double(){let{a:B,b:M}=o,R=n.mul(M,k8),{X:k,Y:U,Z:L}=this,q=n.ZERO,j=n.ZERO,F=n.ZERO,H=n.mul(k,k),ee=n.mul(U,U),ne=n.mul(L,L),Q=n.mul(k,U);return Q=n.add(Q,Q),F=n.mul(k,L),F=n.add(F,F),q=n.mul(B,F),j=n.mul(R,ne),j=n.add(q,j),q=n.sub(ee,j),j=n.add(ee,j),j=n.mul(q,j),q=n.mul(Q,q),F=n.mul(R,F),ne=n.mul(B,ne),Q=n.sub(H,ne),Q=n.mul(B,Q),Q=n.add(Q,F),F=n.add(H,H),H=n.add(F,H),H=n.add(H,ne),H=n.mul(H,Q),j=n.add(j,H),ne=n.mul(U,L),ne=n.add(ne,ne),H=n.mul(ne,Q),q=n.sub(q,H),F=n.mul(ne,ee),F=n.add(F,F),F=n.add(F,F),new O(q,j,F)}add(B){E(B);let{X:M,Y:R,Z:k}=this,{X:U,Y:L,Z:q}=B,j=n.ZERO,F=n.ZERO,H=n.ZERO,ee=o.a,ne=n.mul(o.b,k8),Q=n.mul(M,U),le=n.mul(R,L),_e=n.mul(k,q),we=n.add(M,R),Ee=n.add(U,L);we=n.mul(we,Ee),Ee=n.add(Q,le),we=n.sub(we,Ee),Ee=n.add(M,k);let Te=n.add(U,q);return Ee=n.mul(Ee,Te),Te=n.add(Q,_e),Ee=n.sub(Ee,Te),Te=n.add(R,k),j=n.add(L,q),Te=n.mul(Te,j),j=n.add(le,_e),Te=n.sub(Te,j),H=n.mul(ee,Ee),j=n.mul(ne,_e),H=n.add(j,H),j=n.sub(le,H),H=n.add(le,H),F=n.mul(j,H),le=n.add(Q,Q),le=n.add(le,Q),_e=n.mul(ee,_e),Ee=n.mul(ne,Ee),le=n.add(le,_e),_e=n.sub(Q,_e),_e=n.mul(ee,_e),Ee=n.add(Ee,_e),Q=n.mul(le,Ee),F=n.add(F,Q),Q=n.mul(Te,Ee),j=n.mul(we,j),j=n.sub(j,Q),Q=n.mul(we,le),H=n.mul(Te,H),H=n.add(H,Q),new O(j,F,H)}subtract(B){return this.add(B.negate())}is0(){return this.equals(O.ZERO)}multiply(B){let{endo:M}=t;if(!i.isValidNot0(B))throw new Error("invalid scalar: out of range");let R,k,U=L=>x.cached(this,L,q=>(0,Qy.normalizeZ)(O,q));if(M){let{k1neg:L,k1:q,k2neg:j,k2:F}=T(B),{p:H,f:ee}=U(q),{p:ne,f:Q}=U(F);k=ee.add(Q),R=N(M.beta,H,ne,L,j)}else{let{p:L,f:q}=U(B);R=L,k=q}return(0,Qy.normalizeZ)(O,[R,k])[0]}multiplyUnsafe(B){let{endo:M}=t,R=this;if(!i.isValid(B))throw new Error("invalid scalar: out of range");if(B===Ah||R.is0())return O.ZERO;if(B===Ec)return R;if(x.hasCache(this))return this.multiply(B);if(M){let{k1neg:k,k1:U,k2neg:L,k2:q}=T(B),{p1:j,p2:F}=(0,Qy.mulEndoUnsafe)(O,R,U,q);return N(M.beta,j,F,k,L)}else return x.unsafe(R,B)}multiplyAndAddUnsafe(B,M,R){let k=this.multiplyUnsafe(M).add(B.multiplyUnsafe(R));return k.is0()?void 0:k}toAffine(B){return w(this,B)}isTorsionFree(){let{isTorsionFree:B}=t;return s===Ec?!0:B?B(O,this):x.unsafe(this,a).is0()}clearCofactor(){let{clearCofactor:B}=t;return s===Ec?this:B?B(O,this):this.multiplyUnsafe(s)}isSmallOrder(){return this.multiplyUnsafe(s).is0()}toBytes(B=!0){return(0,pt._abool2)(B,"isCompressed"),this.assertValidity(),f(O,this,B)}toHex(B=!0){return(0,pt.bytesToHex)(this.toBytes(B))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}get px(){return this.X}get py(){return this.X}get pz(){return this.Z}toRawBytes(B=!0){return this.toBytes(B)}_setWindowSize(B){this.precompute(B)}static normalizeZ(B){return(0,Qy.normalizeZ)(O,B)}static msm(B,M){return(0,Qy.pippenger)(O,i,B,M)}static fromPrivateKey(B){return O.BASE.multiply(tT(i,B))}}O.BASE=new O(o.Gx,o.Gy,n.ONE),O.ZERO=new O(n.ZERO,n.ONE,n.ZERO),O.Fp=n,O.Fn=i;let P=i.BITS,x=new Qy.wNAF(O,t.endo?Math.ceil(P/2):P);return O.BASE.precompute(8),O}function Ayt(e){return Uint8Array.of(e?2:3)}function wyt(e,t){let r=e.ORDER,n=Ah;for(let m=r-Ec;m%Mg===Ah;m/=Mg)n+=Ec;let i=n,o=Mg<<i-Ec-Ec,s=o*Mg,a=(r-Ec)/s,c=(a-Ec)/Mg,u=s-Ec,d=o,l=e.pow(t,a),p=e.pow(t,(a+Ec)/Mg),f=(m,h)=>{let g=l,y=e.pow(h,u),S=e.sqr(y);S=e.mul(S,h);let b=e.mul(m,S);b=e.pow(b,c),b=e.mul(b,y),y=e.mul(b,h),S=e.mul(b,m);let E=e.mul(S,y);b=e.pow(E,d);let T=e.eql(b,e.ONE);y=e.mul(S,p),b=e.mul(E,g),S=e.cmov(y,S,T),E=e.cmov(b,E,T);for(let w=i;w>Ec;w--){let I=w-Mg;I=Mg<<I-Ec;let N=e.pow(E,I),O=e.eql(N,e.ONE);y=e.mul(S,g),g=e.mul(g,g),N=e.mul(E,g),S=e.cmov(y,S,O),E=e.cmov(N,E,O)}return{isValid:T,value:S}};if(e.ORDER%YRe===k8){let m=(e.ORDER-k8)/YRe,h=e.sqrt(e.neg(t));f=(g,y)=>{let S=e.sqr(y),b=e.mul(g,y);S=e.mul(S,b);let E=e.pow(S,m);E=e.mul(E,b);let T=e.mul(E,h),w=e.mul(e.sqr(E),y),I=e.eql(w,g),N=e.cmov(T,E,I);return{isValid:I,value:N}}}return f}function Ehn(e,t){(0,D8.validateField)(e);let{A:r,B:n,Z:i}=t;if(!e.isValid(r)||!e.isValid(n)||!e.isValid(i))throw new Error("mapToCurveSimpleSWU: invalid opts");let o=wyt(e,i);if(!e.isOdd)throw new Error("Field does not have .isOdd()");return s=>{let a,c,u,d,l,p,f,m;a=e.sqr(s),a=e.mul(a,i),c=e.sqr(a),c=e.add(c,a),u=e.add(c,e.ONE),u=e.mul(u,n),d=e.cmov(i,e.neg(c),!e.eql(c,e.ZERO)),d=e.mul(d,r),c=e.sqr(u),p=e.sqr(d),l=e.mul(p,r),c=e.add(c,l),c=e.mul(c,u),p=e.mul(p,d),l=e.mul(p,n),c=e.add(c,l),f=e.mul(a,u);let{isValid:h,value:g}=o(c,p);m=e.mul(a,s),m=e.mul(m,g),f=e.cmov(f,u,h),m=e.cmov(m,g,h);let y=e.isOdd(s)===e.isOdd(m);m=e.cmov(e.neg(m),m,y);let S=(0,D8.FpInvertBatch)(e,[d],!0)[0];return f=e.mul(f,S),{x:f,y:m}}}function Iyt(e,t){return{secretKey:t.BYTES,publicKey:1+e.BYTES,publicKeyUncompressed:1+2*e.BYTES,publicKeyHasPrefix:!0,signature:2*t.BYTES}}function Pyt(e,t={}){let{Fn:r}=e,n=t.randomBytes||pt.randomBytes,i=Object.assign(Iyt(e.Fp,r),{seed:(0,D8.getMinHashLength)(r.ORDER)});function o(f){try{return!!tT(r,f)}catch{return!1}}function s(f,m){let{publicKey:h,publicKeyUncompressed:g}=i;try{let y=f.length;return m===!0&&y!==h||m===!1&&y!==g?!1:!!e.fromBytes(f)}catch{return!1}}function a(f=n(i.seed)){return(0,D8.mapHashToField)((0,pt._abytes2)(f,i.seed,"seed"),r.ORDER)}function c(f,m=!0){return e.BASE.multiply(tT(r,f)).toBytes(m)}function u(f){let m=a(f);return{secretKey:m,publicKey:c(m)}}function d(f){if(typeof f=="bigint")return!1;if(f instanceof e)return!0;let{secretKey:m,publicKey:h,publicKeyUncompressed:g}=i;if(r.allowedLengths||m===h)return;let y=(0,pt.ensureBytes)("key",f).length;return y===h||y===g}function l(f,m,h=!0){if(d(f)===!0)throw new Error("first arg must be private key");if(d(m)===!1)throw new Error("second arg must be public key");let g=tT(r,f);return e.fromHex(m).multiply(g).toBytes(h)}return Object.freeze({getPublicKey:c,getSharedSecret:l,keygen:u,Point:e,utils:{isValidSecretKey:o,isValidPublicKey:s,randomSecretKey:a,isValidPrivateKey:o,randomPrivateKey:a,normPrivateKeyToScalar:f=>tT(r,f),precompute(f=8,m=e.BASE){return m.precompute(f,!1)}},lengths:i})}function xyt(e,t,r={}){(0,bhn.ahash)(t),(0,pt._validateObject)(r,{},{hmac:"function",lowS:"boolean",randomBytes:"function",bits2int:"function",bits2int_modN:"function"});let n=r.randomBytes||pt.randomBytes,i=r.hmac||((M,...R)=>(0,yhn.hmac)(t,M,(0,pt.concatBytes)(...R))),{Fp:o,Fn:s}=e,{ORDER:a,BITS:c}=s,{keygen:u,getPublicKey:d,getSharedSecret:l,utils:p,lengths:f}=Pyt(e,r),m={prehash:!1,lowS:typeof r.lowS=="boolean"?r.lowS:!1,format:void 0,extraEntropy:!1},h="compact";function g(M){let R=a>>Ec;return M>R}function y(M,R){if(!s.isValidNot0(R))throw new Error(`invalid signature ${M}: out of range 1..Point.Fn.ORDER`);return R}function S(M,R){WRe(R);let k=f.signature,U=R==="compact"?k:R==="recovered"?k+1:void 0;return(0,pt._abytes2)(M,U,`${R} signature`)}class b{constructor(R,k,U){this.r=y("r",R),this.s=y("s",k),U!=null&&(this.recovery=U),Object.freeze(this)}static fromBytes(R,k=h){S(R,k);let U;if(k==="der"){let{r:F,s:H}=_i.DER.toSig((0,pt._abytes2)(R));return new b(F,H)}k==="recovered"&&(U=R[0],k="compact",R=R.subarray(1));let L=s.BYTES,q=R.subarray(0,L),j=R.subarray(L,L*2);return new b(s.fromBytes(q),s.fromBytes(j),U)}static fromHex(R,k){return this.fromBytes((0,pt.hexToBytes)(R),k)}addRecoveryBit(R){return new b(this.r,this.s,R)}recoverPublicKey(R){let k=o.ORDER,{r:U,s:L,recovery:q}=this;if(q==null||![0,1,2,3].includes(q))throw new Error("recovery id invalid");if(a*Mg<k&&q>1)throw new Error("recovery id is ambiguous for h>1 curve");let F=q===2||q===3?U+a:U;if(!o.isValid(F))throw new Error("recovery id 2 or 3 invalid");let H=o.toBytes(F),ee=e.fromBytes((0,pt.concatBytes)(Ayt((q&1)===0),H)),ne=s.inv(F),Q=T((0,pt.ensureBytes)("msgHash",R)),le=s.create(-Q*ne),_e=s.create(L*ne),we=e.BASE.multiplyUnsafe(le).add(ee.multiplyUnsafe(_e));if(we.is0())throw new Error("point at infinify");return we.assertValidity(),we}hasHighS(){return g(this.s)}toBytes(R=h){if(WRe(R),R==="der")return(0,pt.hexToBytes)(_i.DER.hexFromSig(this));let k=s.toBytes(this.r),U=s.toBytes(this.s);if(R==="recovered"){if(this.recovery==null)throw new Error("recovery bit must be present");return(0,pt.concatBytes)(Uint8Array.of(this.recovery),k,U)}return(0,pt.concatBytes)(k,U)}toHex(R){return(0,pt.bytesToHex)(this.toBytes(R))}assertValidity(){}static fromCompact(R){return b.fromBytes((0,pt.ensureBytes)("sig",R),"compact")}static fromDER(R){return b.fromBytes((0,pt.ensureBytes)("sig",R),"der")}normalizeS(){return this.hasHighS()?new b(this.r,s.neg(this.s),this.recovery):this}toDERRawBytes(){return this.toBytes("der")}toDERHex(){return(0,pt.bytesToHex)(this.toBytes("der"))}toCompactRawBytes(){return this.toBytes("compact")}toCompactHex(){return(0,pt.bytesToHex)(this.toBytes("compact"))}}let E=r.bits2int||function(R){if(R.length>8192)throw new Error("input is too large");let k=(0,pt.bytesToNumberBE)(R),U=R.length*8-c;return U>0?k>>BigInt(U):k},T=r.bits2int_modN||function(R){return s.create(E(R))},w=(0,pt.bitMask)(c);function I(M){return(0,pt.aInRange)("num < 2^"+c,M,Ah,w),s.toBytes(M)}function N(M,R){return(0,pt._abytes2)(M,void 0,"message"),R?(0,pt._abytes2)(t(M),void 0,"prehashed message"):M}function O(M,R,k){if(["recovered","canonical"].some(le=>le in k))throw new Error("sign() legacy options not supported");let{lowS:U,prehash:L,extraEntropy:q}=KRe(k,m);M=N(M,L);let j=T(M),F=tT(s,R),H=[I(F),I(j)];if(q!=null&&q!==!1){let le=q===!0?n(f.secretKey):q;H.push((0,pt.ensureBytes)("extraEntropy",le))}let ee=(0,pt.concatBytes)(...H),ne=j;function Q(le){let _e=E(le);if(!s.isValidNot0(_e))return;let we=s.inv(_e),Ee=e.BASE.multiply(_e).toAffine(),Te=s.create(Ee.x);if(Te===Ah)return;let Ke=s.create(we*s.create(ne+Te*F));if(Ke===Ah)return;let We=(Ee.x===Te?0:2)|Number(Ee.y&Ec),gt=Ke;return U&&g(Ke)&&(gt=s.neg(Ke),We^=1),new b(Te,gt,We)}return{seed:ee,k2sig:Q}}function P(M,R,k={}){M=(0,pt.ensureBytes)("message",M);let{seed:U,k2sig:L}=O(M,R,k);return(0,pt.createHmacDrbg)(t.outputLen,s.BYTES,i)(U,L)}function x(M){let R,k=typeof M=="string"||(0,pt.isBytes)(M),U=!k&&M!==null&&typeof M=="object"&&typeof M.r=="bigint"&&typeof M.s=="bigint";if(!k&&!U)throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");if(U)R=new b(M.r,M.s);else if(k){try{R=b.fromBytes((0,pt.ensureBytes)("sig",M),"der")}catch(L){if(!(L instanceof _i.DER.Err))throw L}if(!R)try{R=b.fromBytes((0,pt.ensureBytes)("sig",M),"compact")}catch{return!1}}return R||!1}function D(M,R,k,U={}){let{lowS:L,prehash:q,format:j}=KRe(U,m);if(k=(0,pt.ensureBytes)("publicKey",k),R=N((0,pt.ensureBytes)("message",R),q),"strict"in U)throw new Error("options.strict was renamed to lowS");let F=j===void 0?x(M):b.fromBytes((0,pt.ensureBytes)("sig",M),j);if(F===!1)return!1;try{let H=e.fromBytes(k);if(L&&F.hasHighS())return!1;let{r:ee,s:ne}=F,Q=T(R),le=s.inv(ne),_e=s.create(Q*le),we=s.create(ee*le),Ee=e.BASE.multiplyUnsafe(_e).add(H.multiplyUnsafe(we));return Ee.is0()?!1:s.create(Ee.x)===ee}catch{return!1}}function B(M,R,k={}){let{prehash:U}=KRe(k,m);return R=N(R,U),b.fromBytes(M,"recovered").recoverPublicKey(R).toBytes()}return Object.freeze({keygen:u,getPublicKey:d,getSharedSecret:l,utils:p,lengths:f,Point:e,sign:P,verify:D,recoverPublicKey:B,Signature:b,hash:t})}function Shn(e){let{CURVE:t,curveOpts:r}=Oyt(e),n=JRe(t,r);return Thn(e,n)}function Oyt(e){let t={a:e.a,b:e.b,p:e.Fp.ORDER,n:e.n,h:e.h,Gx:e.Gx,Gy:e.Gy},r=e.Fp,n=e.allowedPrivateKeyLengths?Array.from(new Set(e.allowedPrivateKeyLengths.map(s=>Math.ceil(s/2)))):void 0,i=(0,D8.Field)(t.n,{BITS:e.nBitLength,allowedLengths:n,modFromBytes:e.wrapPrivateKey}),o={Fp:r,Fn:i,allowInfinityPoint:e.allowInfinityPoint,endo:e.endo,isTorsionFree:e.isTorsionFree,clearCofactor:e.clearCofactor,fromBytes:e.fromBytes,toBytes:e.toBytes};return{CURVE:t,curveOpts:o}}function vhn(e){let{CURVE:t,curveOpts:r}=Oyt(e),n={hmac:e.hmac,randomBytes:e.randomBytes,lowS:e.lowS,bits2int:e.bits2int,bits2int_modN:e.bits2int_modN};return{CURVE:t,curveOpts:r,hash:e.hash,ecdsaOpts:n}}function Ryt(e,t,r){function n(i){let o=e.sqr(i),s=e.mul(o,i);return e.add(e.add(s,e.mul(i,t)),r)}return n}function Thn(e,t){let{Fp:r,Fn:n}=t;function i(s){return(0,pt.inRange)(s,Ec,n.ORDER)}let o=Ryt(r,e.a,e.b);return Object.assign({},{CURVE:e,Point:t,ProjectivePoint:t,normPrivateKeyToScalar:s=>tT(n,s),weierstrassEquation:o,isWithinCurveOrder:i})}function Ahn(e,t){let r=t.Point;return Object.assign({},t,{ProjectivePoint:r,CURVE:Object.assign({},e,(0,D8.nLength)(r.Fn.ORDER,r.Fn.BITS))})}function whn(e){let{CURVE:t,curveOpts:r,hash:n,ecdsaOpts:i}=vhn(e),o=JRe(t,r),s=xyt(o,n,i);return Ahn(e,s)}});var XRe=_(zte=>{"use strict";Object.defineProperty(zte,"__esModule",{value:!0});zte.getHash=Phn;zte.createCurve=xhn;var Ihn=$te();function Phn(e){return{hash:e}}function xhn(e,t){let r=n=>(0,Ihn.weierstrass)({...e,hash:n});return{...r(t),create:r}}});var ZRe=_(kg=>{"use strict";Object.defineProperty(kg,"__esModule",{value:!0});kg._DST_scalar=void 0;kg.expand_message_xmd=Myt;kg.expand_message_xof=kyt;kg.hash_to_field=Gte;kg.isogenyMap=Nhn;kg.createHasher=Chn;var Sc=C8(),Nyt=JI(),Ohn=Sc.bytesToNumberBE;function rT(e,t){if(VB(e),VB(t),e<0||e>=1<<8*t)throw new Error("invalid I2OSP input: "+e);let r=Array.from({length:t}).fill(0);for(let n=t-1;n>=0;n--)r[n]=e&255,e>>>=8;return new Uint8Array(r)}function Rhn(e,t){let r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e[n]^t[n];return r}function VB(e){if(!Number.isSafeInteger(e))throw new Error("number expected")}function Cyt(e){if(!(0,Sc.isBytes)(e)&&typeof e!="string")throw new Error("DST must be Uint8Array or string");return typeof e=="string"?(0,Sc.utf8ToBytes)(e):e}function Myt(e,t,r,n){(0,Sc.abytes)(e),VB(r),t=Cyt(t),t.length>255&&(t=n((0,Sc.concatBytes)((0,Sc.utf8ToBytes)("H2C-OVERSIZE-DST-"),t)));let{outputLen:i,blockLen:o}=n,s=Math.ceil(r/i);if(r>65535||s>255)throw new Error("expand_message_xmd: invalid lenInBytes");let a=(0,Sc.concatBytes)(t,rT(t.length,1)),c=rT(0,o),u=rT(r,2),d=new Array(s),l=n((0,Sc.concatBytes)(c,e,u,rT(0,1),a));d[0]=n((0,Sc.concatBytes)(l,rT(1,1),a));for(let f=1;f<=s;f++){let m=[Rhn(l,d[f-1]),rT(f+1,1),a];d[f]=n((0,Sc.concatBytes)(...m))}return(0,Sc.concatBytes)(...d).slice(0,r)}function kyt(e,t,r,n,i){if((0,Sc.abytes)(e),VB(r),t=Cyt(t),t.length>255){let o=Math.ceil(2*n/8);t=i.create({dkLen:o}).update((0,Sc.utf8ToBytes)("H2C-OVERSIZE-DST-")).update(t).digest()}if(r>65535||t.length>255)throw new Error("expand_message_xof: invalid lenInBytes");return i.create({dkLen:r}).update(e).update(rT(r,2)).update(t).update(rT(t.length,1)).digest()}function Gte(e,t,r){(0,Sc._validateObject)(r,{p:"bigint",m:"number",k:"number",hash:"function"});let{p:n,k:i,m:o,hash:s,expand:a,DST:c}=r;if(!(0,Sc.isHash)(r.hash))throw new Error("expected valid hash");(0,Sc.abytes)(e),VB(t);let u=n.toString(2).length,d=Math.ceil((u+i)/8),l=t*o*d,p;if(a==="xmd")p=Myt(e,c,l,s);else if(a==="xof")p=kyt(e,c,l,i,s);else if(a==="_internal_pass")p=e;else throw new Error('expand must be "xmd" or "xof"');let f=new Array(t);for(let m=0;m<t;m++){let h=new Array(o);for(let g=0;g<o;g++){let y=d*(g+m*o),S=p.subarray(y,y+d);h[g]=(0,Nyt.mod)(Ohn(S),n)}f[m]=h}return f}function Nhn(e,t){let r=t.map(n=>Array.from(n).reverse());return(n,i)=>{let[o,s,a,c]=r.map(l=>l.reduce((p,f)=>e.add(e.mul(p,n),f))),[u,d]=(0,Nyt.FpInvertBatch)(e,[s,c],!0);return n=e.mul(o,u),i=e.mul(i,e.mul(a,d)),{x:n,y:i}}}kg._DST_scalar=(0,Sc.utf8ToBytes)("HashToScalar-");function Chn(e,t,r){if(typeof t!="function")throw new Error("mapToCurve() must be defined");function n(o){return e.fromAffine(t(o))}function i(o){let s=o.clearCofactor();return s.equals(e.ZERO)?e.ZERO:(s.assertValidity(),s)}return{defaults:r,hashToCurve(o,s){let a=Object.assign({},r,s),c=Gte(o,2,a),u=n(c[0]),d=n(c[1]);return i(u.add(d))},encodeToCurve(o,s){let a=r.encodeDST?{DST:r.encodeDST}:{},c=Object.assign({},r,a,s),u=Gte(o,1,c),d=n(u[0]);return i(d)},mapToCurve(o){if(!Array.isArray(o))throw new Error("expected array of bigints");for(let s of o)if(typeof s!="bigint")throw new Error("expected array of bigints");return i(n(o))},hashToScalar(o,s){let a=e.Fn.ORDER,c=Object.assign({},r,{p:a,m:1,DST:kg._DST_scalar},s);return Gte(o,1,c)[0][0]}}}});var $yt=_(vc=>{"use strict";Object.defineProperty(vc,"__esModule",{value:!0});vc.encodeToCurve=vc.hashToCurve=vc.secp256k1_hasher=vc.schnorr=vc.secp256k1=void 0;var Kte=ag(),Byt=Zo(),Mhn=XRe(),jyt=ZRe(),ed=JI(),qyt=$te(),Ep=C8(),L8={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},khn={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]},Dhn=BigInt(0),Dyt=BigInt(1),QRe=BigInt(2);function Lhn(e){let t=L8.p,r=BigInt(3),n=BigInt(6),i=BigInt(11),o=BigInt(22),s=BigInt(23),a=BigInt(44),c=BigInt(88),u=e*e*e%t,d=u*u*e%t,l=(0,ed.pow2)(d,r,t)*d%t,p=(0,ed.pow2)(l,r,t)*d%t,f=(0,ed.pow2)(p,QRe,t)*u%t,m=(0,ed.pow2)(f,i,t)*f%t,h=(0,ed.pow2)(m,o,t)*m%t,g=(0,ed.pow2)(h,a,t)*h%t,y=(0,ed.pow2)(g,c,t)*g%t,S=(0,ed.pow2)(y,a,t)*h%t,b=(0,ed.pow2)(S,r,t)*d%t,E=(0,ed.pow2)(b,s,t)*m%t,T=(0,ed.pow2)(E,n,t)*u%t,w=(0,ed.pow2)(T,QRe,t);if(!eb.eql(eb.sqr(w),e))throw new Error("Cannot find square root");return w}var eb=(0,ed.Field)(L8.p,{sqrt:Lhn});vc.secp256k1=(0,Mhn.createCurve)({...L8,Fp:eb,lowS:!0,endo:khn},Kte.sha256);var Lyt={};function Wte(e,...t){let r=Lyt[e];if(r===void 0){let n=(0,Kte.sha256)((0,Ep.utf8ToBytes)(e));r=(0,Ep.concatBytes)(n,n),Lyt[e]=r}return(0,Kte.sha256)((0,Ep.concatBytes)(r,...t))}var t8e=e=>e.toBytes(!0).slice(1),U8=vc.secp256k1.Point,r8e=e=>e%QRe===Dhn;function e8e(e){let{Fn:t,BASE:r}=U8,n=(0,qyt._normFnElement)(t,e),i=r.multiply(n);return{scalar:r8e(i.y)?n:t.neg(n),bytes:t8e(i)}}function Hyt(e){let t=eb;if(!t.isValidNot0(e))throw new Error("invalid x: Fail if x \u2265 p");let r=t.create(e*e),n=t.create(r*e+BigInt(7)),i=t.sqrt(n);r8e(i)||(i=t.neg(i));let o=U8.fromAffine({x:e,y:i});return o.assertValidity(),o}var FB=Ep.bytesToNumberBE;function Vyt(...e){return U8.Fn.create(FB(Wte("BIP0340/challenge",...e)))}function Uyt(e){return e8e(e).bytes}function Uhn(e,t,r=(0,Byt.randomBytes)(32)){let{Fn:n}=U8,i=(0,Ep.ensureBytes)("message",e),{bytes:o,scalar:s}=e8e(t),a=(0,Ep.ensureBytes)("auxRand",r,32),c=n.toBytes(s^FB(Wte("BIP0340/aux",a))),u=Wte("BIP0340/nonce",c,o,i),{bytes:d,scalar:l}=e8e(u),p=Vyt(d,o,i),f=new Uint8Array(64);if(f.set(d,0),f.set(n.toBytes(n.create(l+p*s)),32),!Fyt(f,i,o))throw new Error("sign: Invalid signature produced");return f}function Fyt(e,t,r){let{Fn:n,BASE:i}=U8,o=(0,Ep.ensureBytes)("signature",e,64),s=(0,Ep.ensureBytes)("message",t),a=(0,Ep.ensureBytes)("publicKey",r,32);try{let c=Hyt(FB(a)),u=FB(o.subarray(0,32));if(!(0,Ep.inRange)(u,Dyt,L8.p))return!1;let d=FB(o.subarray(32,64));if(!(0,Ep.inRange)(d,Dyt,L8.n))return!1;let l=Vyt(n.toBytes(u),t8e(c),s),p=i.multiplyUnsafe(d).add(c.multiplyUnsafe(n.neg(l))),{x:f,y:m}=p.toAffine();return!(p.is0()||!r8e(m)||f!==u)}catch{return!1}}vc.schnorr=(()=>{let r=(i=(0,Byt.randomBytes)(48))=>(0,ed.mapHashToField)(i,L8.n);vc.secp256k1.utils.randomSecretKey;function n(i){let o=r(i);return{secretKey:o,publicKey:Uyt(o)}}return{keygen:n,getPublicKey:Uyt,sign:Uhn,verify:Fyt,Point:U8,utils:{randomSecretKey:r,randomPrivateKey:r,taggedHash:Wte,lift_x:Hyt,pointToBytes:t8e,numberToBytesBE:Ep.numberToBytesBE,bytesToNumberBE:Ep.bytesToNumberBE,mod:ed.mod},lengths:{secretKey:32,publicKey:32,publicKeyHasPrefix:!1,signature:64,seed:48}}})();var Bhn=(0,jyt.isogenyMap)(eb,[["0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7","0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581","0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262","0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c"],["0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b","0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14","0x0000000000000000000000000000000000000000000000000000000000000001"],["0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c","0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3","0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931","0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84"],["0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b","0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573","0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f","0x0000000000000000000000000000000000000000000000000000000000000001"]].map(e=>e.map(t=>BigInt(t)))),jhn=(0,qyt.mapToCurveSimpleSWU)(eb,{A:BigInt("0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533"),B:BigInt("1771"),Z:eb.create(BigInt("-11"))});vc.secp256k1_hasher=(0,jyt.createHasher)(vc.secp256k1.Point,e=>{let{x:t,y:r}=jhn(eb.create(e[0]));return Bhn(t,r)},{DST:"secp256k1_XMD:SHA-256_SSWU_RO_",encodeDST:"secp256k1_XMD:SHA-256_SSWU_NU_",p:eb.ORDER,m:1,k:128,expand:"xmd",hash:Kte.sha256});vc.hashToCurve=vc.secp256k1_hasher.hashToCurve;vc.encodeToCurve=vc.secp256k1_hasher.encodeToCurve});var u8e=_(Fe=>{"use strict";Object.defineProperty(Fe,"__esModule",{value:!0});Fe.bytes=Fe.stringToBytes=Fe.str=Fe.bytesToString=Fe.hex=Fe.utf8=Fe.bech32m=Fe.bech32=Fe.base58check=Fe.createBase58check=Fe.base58xmr=Fe.base58xrp=Fe.base58flickr=Fe.base58=Fe.base64urlnopad=Fe.base64url=Fe.base64nopad=Fe.base64=Fe.base32crockford=Fe.base32hexnopad=Fe.base32hex=Fe.base32nopad=Fe.base32=Fe.base16=Fe.utils=void 0;function ZI(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function o8e(e,...t){if(!ZI(e))throw new Error("Uint8Array expected");if(t.length>0&&!t.includes(e.length))throw new Error("Uint8Array expected of length "+t+", got length="+e.length)}function Yyt(e,t){return Array.isArray(t)?t.length===0?!0:e?t.every(r=>typeof r=="string"):t.every(r=>Number.isSafeInteger(r)):!1}function s8e(e){if(typeof e!="function")throw new Error("function expected");return!0}function nT(e,t){if(typeof t!="string")throw new Error(`${e}: string expected`);return!0}function B8(e){if(!Number.isSafeInteger(e))throw new Error(`invalid integer: ${e}`)}function Jte(e){if(!Array.isArray(e))throw new Error("array expected")}function Xte(e,t){if(!Yyt(!0,t))throw new Error(`${e}: array of strings expected`)}function a8e(e,t){if(!Yyt(!1,t))throw new Error(`${e}: array of numbers expected`)}function td(...e){let t=o=>o,r=(o,s)=>a=>o(s(a)),n=e.map(o=>o.encode).reduceRight(r,t),i=e.map(o=>o.decode).reduce(r,t);return{encode:n,decode:i}}function al(e){let t=typeof e=="string"?e.split(""):e,r=t.length;Xte("alphabet",t);let n=new Map(t.map((i,o)=>[i,o]));return{encode:i=>(Jte(i),i.map(o=>{if(!Number.isSafeInteger(o)||o<0||o>=r)throw new Error(`alphabet.encode: digit index outside alphabet "${o}". Allowed: ${e}`);return t[o]})),decode:i=>(Jte(i),i.map(o=>{nT("alphabet.decode",o);let s=n.get(o);if(s===void 0)throw new Error(`Unknown letter: "${o}". Allowed: ${e}`);return s}))}}function cl(e=""){return nT("join",e),{encode:t=>(Xte("join.decode",t),t.join(e)),decode:t=>(nT("join.decode",t),t.split(e))}}function zB(e,t="="){return B8(e),nT("padding",t),{encode(r){for(Xte("padding.encode",r);r.length*e%8;)r.push(t);return r},decode(r){Xte("padding.decode",r);let n=r.length;if(n*e%8)throw new Error("padding: invalid, string should have whole number of bytes");for(;n>0&&r[n-1]===t;n--)if((n-1)*e%8===0)throw new Error("padding: invalid, string has too much padding");return r.slice(0,n)}}}function Jyt(e){return s8e(e),{encode:t=>t,decode:t=>e(t)}}function n8e(e,t,r){if(t<2)throw new Error(`convertRadix: invalid from=${t}, base cannot be less than 2`);if(r<2)throw new Error(`convertRadix: invalid to=${r}, base cannot be less than 2`);if(Jte(e),!e.length)return[];let n=0,i=[],o=Array.from(e,a=>{if(B8(a),a<0||a>=t)throw new Error(`invalid integer: ${a}`);return a}),s=o.length;for(;;){let a=0,c=!0;for(let u=n;u<s;u++){let d=o[u],l=t*a,p=l+d;if(!Number.isSafeInteger(p)||l/t!==a||p-d!==l)throw new Error("convertRadix: carry overflow");let f=p/r;a=p%r;let m=Math.floor(f);if(o[u]=m,!Number.isSafeInteger(m)||m*r+a!==p)throw new Error("convertRadix: carry overflow");if(c)m?c=!1:n=u;else continue}if(i.push(a),c)break}for(let a=0;a<e.length-1&&e[a]===0;a++)i.push(0);return i.reverse()}var Xyt=(e,t)=>t===0?e:Xyt(t,e%t),Zte=(e,t)=>e+(t-Xyt(e,t)),Yte=(()=>{let e=[];for(let t=0;t<40;t++)e.push(2**t);return e})();function Qte(e,t,r,n){if(Jte(e),t<=0||t>32)throw new Error(`convertRadix2: wrong from=${t}`);if(r<=0||r>32)throw new Error(`convertRadix2: wrong to=${r}`);if(Zte(t,r)>32)throw new Error(`convertRadix2: carry overflow from=${t} to=${r} carryBits=${Zte(t,r)}`);let i=0,o=0,s=Yte[t],a=Yte[r]-1,c=[];for(let u of e){if(B8(u),u>=s)throw new Error(`convertRadix2: invalid data word=${u} from=${t}`);if(i=i<<t|u,o+t>32)throw new Error(`convertRadix2: carry overflow pos=${o} from=${t}`);for(o+=t;o>=r;o-=r)c.push((i>>o-r&a)>>>0);let d=Yte[o];if(d===void 0)throw new Error("invalid carry");i&=d-1}if(i=i<<r-o&a,!n&&o>=t)throw new Error("Excess padding");if(!n&&i>0)throw new Error(`Non-zero padding: ${i}`);return n&&o>0&&c.push(i>>>0),c}function Zyt(e){B8(e);let t=2**8;return{encode:r=>{if(!ZI(r))throw new Error("radix.encode input should be Uint8Array");return n8e(Array.from(r),t,e)},decode:r=>(a8e("radix.decode",r),Uint8Array.from(n8e(r,e,t)))}}function Sp(e,t=!1){if(B8(e),e<=0||e>32)throw new Error("radix2: bits should be in (0..32]");if(Zte(8,e)>32||Zte(e,8)>32)throw new Error("radix2: carry overflow");return{encode:r=>{if(!ZI(r))throw new Error("radix2.encode input should be Uint8Array");return Qte(Array.from(r),8,e,!t)},decode:r=>(a8e("radix2.decode",r),Uint8Array.from(Qte(r,e,8,t)))}}function zyt(e){return s8e(e),function(...t){try{return e.apply(null,t)}catch{}}}function Qyt(e,t){return B8(e),s8e(t),{encode(r){if(!ZI(r))throw new Error("checksum.encode: input should be Uint8Array");let n=t(r).slice(0,e),i=new Uint8Array(r.length+e);return i.set(r),i.set(n,r.length),i},decode(r){if(!ZI(r))throw new Error("checksum.decode: input should be Uint8Array");let n=r.slice(0,-e),i=r.slice(-e),o=t(n).slice(0,e);for(let s=0;s<e;s++)if(o[s]!==i[s])throw new Error("Invalid checksum");return n}}}Fe.utils={alphabet:al,chain:td,checksum:Qyt,convertRadix:n8e,convertRadix2:Qte,radix:Zyt,radix2:Sp,join:cl,padding:zB};Fe.base16=td(Sp(4),al("0123456789ABCDEF"),cl(""));Fe.base32=td(Sp(5),al("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"),zB(5),cl(""));Fe.base32nopad=td(Sp(5),al("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"),cl(""));Fe.base32hex=td(Sp(5),al("0123456789ABCDEFGHIJKLMNOPQRSTUV"),zB(5),cl(""));Fe.base32hexnopad=td(Sp(5),al("0123456789ABCDEFGHIJKLMNOPQRSTUV"),cl(""));Fe.base32crockford=td(Sp(5),al("0123456789ABCDEFGHJKMNPQRSTVWXYZ"),cl(""),Jyt(e=>e.toUpperCase().replace(/O/g,"0").replace(/[IL]/g,"1")));var ebt=typeof Uint8Array.from([]).toBase64=="function"&&typeof Uint8Array.fromBase64=="function",tbt=(e,t)=>{nT("base64",e);let r=t?/^[A-Za-z0-9=_-]+$/:/^[A-Za-z0-9=+/]+$/,n=t?"base64url":"base64";if(e.length>0&&!r.test(e))throw new Error("invalid base64");return Uint8Array.fromBase64(e,{alphabet:n,lastChunkHandling:"strict"})};Fe.base64=ebt?{encode(e){return o8e(e),e.toBase64()},decode(e){return tbt(e,!1)}}:td(Sp(6),al("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),zB(6),cl(""));Fe.base64nopad=td(Sp(6),al("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),cl(""));Fe.base64url=ebt?{encode(e){return o8e(e),e.toBase64({alphabet:"base64url"})},decode(e){return tbt(e,!0)}}:td(Sp(6),al("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"),zB(6),cl(""));Fe.base64urlnopad=td(Sp(6),al("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"),cl(""));var c8e=e=>td(Zyt(58),al(e),cl(""));Fe.base58=c8e("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz");Fe.base58flickr=c8e("123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ");Fe.base58xrp=c8e("rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz");var Gyt=[0,2,3,5,6,7,9,10,11];Fe.base58xmr={encode(e){let t="";for(let r=0;r<e.length;r+=8){let n=e.subarray(r,r+8);t+=Fe.base58.encode(n).padStart(Gyt[n.length],"1")}return t},decode(e){let t=[];for(let r=0;r<e.length;r+=11){let n=e.slice(r,r+11),i=Gyt.indexOf(n.length),o=Fe.base58.decode(n);for(let s=0;s<o.length-i;s++)if(o[s]!==0)throw new Error("base58xmr: wrong padding");t=t.concat(Array.from(o.slice(o.length-i)))}return Uint8Array.from(t)}};var qhn=e=>td(Qyt(4,t=>e(e(t))),Fe.base58);Fe.createBase58check=qhn;Fe.base58check=Fe.createBase58check;var i8e=td(al("qpzry9x8gf2tvdw0s3jn54khce6mua7l"),cl("")),Kyt=[996825010,642813549,513874426,1027748829,705979059];function $B(e){let t=e>>25,r=(e&33554431)<<5;for(let n=0;n<Kyt.length;n++)(t>>n&1)===1&&(r^=Kyt[n]);return r}function Wyt(e,t,r=1){let n=e.length,i=1;for(let o=0;o<n;o++){let s=e.charCodeAt(o);if(s<33||s>126)throw new Error(`Invalid prefix (${e})`);i=$B(i)^s>>5}i=$B(i);for(let o=0;o<n;o++)i=$B(i)^e.charCodeAt(o)&31;for(let o of t)i=$B(i)^o;for(let o=0;o<6;o++)i=$B(i);return i^=r,i8e.encode(Qte([i%Yte[30]],30,5,!1))}function rbt(e){let t=e==="bech32"?1:734539939,r=Sp(5),n=r.decode,i=r.encode,o=zyt(n);function s(l,p,f=90){nT("bech32.encode prefix",l),ZI(p)&&(p=Array.from(p)),a8e("bech32.encode",p);let m=l.length;if(m===0)throw new TypeError(`Invalid prefix length ${m}`);let h=m+7+p.length;if(f!==!1&&h>f)throw new TypeError(`Length ${h} exceeds limit ${f}`);let g=l.toLowerCase(),y=Wyt(g,p,t);return`${g}1${i8e.encode(p)}${y}`}function a(l,p=90){nT("bech32.decode input",l);let f=l.length;if(f<8||p!==!1&&f>p)throw new TypeError(`invalid string length: ${f} (${l}). Expected (8..${p})`);let m=l.toLowerCase();if(l!==m&&l!==l.toUpperCase())throw new Error("String must be lowercase or uppercase");let h=m.lastIndexOf("1");if(h===0||h===-1)throw new Error('Letter "1" must be present between prefix and data only');let g=m.slice(0,h),y=m.slice(h+1);if(y.length<6)throw new Error("Data must be at least 6 characters long");let S=i8e.decode(y).slice(0,-6),b=Wyt(g,S,t);if(!y.endsWith(b))throw new Error(`Invalid checksum in ${l}: expected "${b}"`);return{prefix:g,words:S}}let c=zyt(a);function u(l){let{prefix:p,words:f}=a(l,!1);return{prefix:p,words:f,bytes:n(f)}}function d(l,p){return s(l,i(p))}return{encode:s,decode:a,encodeFromBytes:d,decodeToBytes:u,decodeUnsafe:c,fromWords:n,fromWordsUnsafe:o,toWords:i}}Fe.bech32=rbt("bech32");Fe.bech32m=rbt("bech32m");Fe.utf8={encode:e=>new TextDecoder().decode(e),decode:e=>new TextEncoder().encode(e)};var Hhn=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",Vhn={encode(e){return o8e(e),e.toHex()},decode(e){return nT("hex",e),Uint8Array.fromHex(e)}};Fe.hex=Hhn?Vhn:td(Sp(4),al("0123456789abcdef"),cl(""),Jyt(e=>{if(typeof e!="string"||e.length%2!==0)throw new TypeError(`hex.decode: expected string, got ${typeof e} with length ${e.length}`);return e.toLowerCase()}));var ere={utf8:Fe.utf8,hex:Fe.hex,base16:Fe.base16,base32:Fe.base32,base64:Fe.base64,base64url:Fe.base64url,base58:Fe.base58,base58xmr:Fe.base58xmr},nbt="Invalid encoding type. Available types: utf8, hex, base16, base32, base64, base64url, base58, base58xmr",Fhn=(e,t)=>{if(typeof e!="string"||!ere.hasOwnProperty(e))throw new TypeError(nbt);if(!ZI(t))throw new TypeError("bytesToString() expects Uint8Array");return ere[e].encode(t)};Fe.bytesToString=Fhn;Fe.str=Fe.bytesToString;var $hn=(e,t)=>{if(!ere.hasOwnProperty(e))throw new TypeError(nbt);if(typeof t!="string")throw new TypeError("stringToBytes() expects string");return ere[e].decode(t)};Fe.stringToBytes=$hn;Fe.bytes=Fe.stringToBytes});var f8e=_(rb=>{"use strict";Object.defineProperty(rb,"__esModule",{value:!0});rb.HDKey=rb.HARDENED_OFFSET=void 0;var zhn=JI(),tb=$yt(),ibt=cv(),Ghn=BAe(),nre=ag(),du=Zo(),Khn=u8e(),tre=tb.secp256k1.ProjectivePoint,d8e=(0,Khn.createBase58check)(nre.sha256);function obt(e){(0,du.abytes)(e);let t=e.length===0?"0":(0,du.bytesToHex)(e);return BigInt("0x"+t)}function Whn(e){if(typeof e!="bigint")throw new Error("bigint expected");return(0,du.hexToBytes)(e.toString(16).padStart(64,"0"))}var Yhn=(0,du.utf8ToBytes)("Bitcoin seed"),l8e={private:76066276,public:76067358};rb.HARDENED_OFFSET=2147483648;var Jhn=e=>(0,Ghn.ripemd160)((0,nre.sha256)(e)),Xhn=e=>(0,du.createView)(e).getUint32(0,!1),rre=e=>{if(!Number.isSafeInteger(e)||e<0||e>2**32-1)throw new Error("invalid number, should be from 0 to 2**32-1, got "+e);let t=new Uint8Array(4);return(0,du.createView)(t).setUint32(0,e,!1),t},p8e=class e{get fingerprint(){if(!this.pubHash)throw new Error("No publicKey set!");return Xhn(this.pubHash)}get identifier(){return this.pubHash}get pubKeyHash(){return this.pubHash}get privateKey(){return this.privKeyBytes||null}get publicKey(){return this.pubKey||null}get privateExtendedKey(){let t=this.privateKey;if(!t)throw new Error("No private key");return d8e.encode(this.serialize(this.versions.private,(0,du.concatBytes)(new Uint8Array([0]),t)))}get publicExtendedKey(){if(!this.pubKey)throw new Error("No public key");return d8e.encode(this.serialize(this.versions.public,this.pubKey))}static fromMasterSeed(t,r=l8e){if((0,du.abytes)(t),8*t.length<128||8*t.length>512)throw new Error("HDKey: seed length must be between 128 and 512 bits; 256 bits is advised, got "+t.length);let n=(0,ibt.hmac)(nre.sha512,Yhn,t);return new e({versions:r,chainCode:n.slice(32),privateKey:n.slice(0,32)})}static fromExtendedKey(t,r=l8e){let n=d8e.decode(t),i=(0,du.createView)(n),o=i.getUint32(0,!1),s={versions:r,depth:n[4],parentFingerprint:i.getUint32(5,!1),index:i.getUint32(9,!1),chainCode:n.slice(13,45)},a=n.slice(45),c=a[0]===0;if(o!==r[c?"private":"public"])throw new Error("Version mismatch");return c?new e({...s,privateKey:a.slice(1)}):new e({...s,publicKey:a})}static fromJSON(t){return e.fromExtendedKey(t.xpriv)}constructor(t){if(this.depth=0,this.index=0,this.chainCode=null,this.parentFingerprint=0,!t||typeof t!="object")throw new Error("HDKey.constructor must not be called directly");if(this.versions=t.versions||l8e,this.depth=t.depth||0,this.chainCode=t.chainCode||null,this.index=t.index||0,this.parentFingerprint=t.parentFingerprint||0,!this.depth&&(this.parentFingerprint||this.index))throw new Error("HDKey: zero depth with non-zero index/parent fingerprint");if(t.publicKey&&t.privateKey)throw new Error("HDKey: publicKey and privateKey at same time.");if(t.privateKey){if(!tb.secp256k1.utils.isValidPrivateKey(t.privateKey))throw new Error("Invalid private key");this.privKey=typeof t.privateKey=="bigint"?t.privateKey:obt(t.privateKey),this.privKeyBytes=Whn(this.privKey),this.pubKey=tb.secp256k1.getPublicKey(t.privateKey,!0)}else if(t.publicKey)this.pubKey=tre.fromHex(t.publicKey).toRawBytes(!0);else throw new Error("HDKey: no public or private key provided");this.pubHash=Jhn(this.pubKey)}derive(t){if(!/^[mM]'?/.test(t))throw new Error('Path must start with "m" or "M"');if(/^[mM]'?$/.test(t))return this;let r=t.replace(/^[mM]'?\//,"").split("/"),n=this;for(let i of r){let o=/^(\d+)('?)$/.exec(i),s=o&&o[1];if(!o||o.length!==3||typeof s!="string")throw new Error("invalid child index: "+i);let a=+s;if(!Number.isSafeInteger(a)||a>=rb.HARDENED_OFFSET)throw new Error("Invalid index");o[2]==="'"&&(a+=rb.HARDENED_OFFSET),n=n.deriveChild(a)}return n}deriveChild(t){if(!this.pubKey||!this.chainCode)throw new Error("No publicKey or chainCode set");let r=rre(t);if(t>=rb.HARDENED_OFFSET){let a=this.privateKey;if(!a)throw new Error("Could not derive hardened child key");r=(0,du.concatBytes)(new Uint8Array([0]),a,r)}else r=(0,du.concatBytes)(this.pubKey,r);let n=(0,ibt.hmac)(nre.sha512,this.chainCode,r),i=obt(n.slice(0,32)),o=n.slice(32);if(!tb.secp256k1.utils.isValidPrivateKey(i))throw new Error("Tweak bigger than curve order");let s={versions:this.versions,chainCode:o,depth:this.depth+1,parentFingerprint:this.fingerprint,index:t};try{if(this.privateKey){let a=(0,zhn.mod)(this.privKey+i,tb.secp256k1.CURVE.n);if(!tb.secp256k1.utils.isValidPrivateKey(a))throw new Error("The tweak was out of range or the resulted private key is invalid");s.privateKey=a}else{let a=tre.fromHex(this.pubKey).add(tre.fromPrivateKey(i));if(a.equals(tre.ZERO))throw new Error("The tweak was equal to negative P, which made the result key invalid");s.publicKey=a.toRawBytes(!0)}return new e(s)}catch{return this.deriveChild(t+1)}}sign(t){if(!this.privateKey)throw new Error("No privateKey set!");return(0,du.abytes)(t,32),tb.secp256k1.sign(t,this.privKey).toCompactRawBytes()}verify(t,r){if((0,du.abytes)(t,32),(0,du.abytes)(r,64),!this.publicKey)throw new Error("No publicKey set!");let n;try{n=tb.secp256k1.Signature.fromCompact(r)}catch{return!1}return tb.secp256k1.verify(n,t,this.publicKey)}wipePrivateData(){return this.privKey=void 0,this.privKeyBytes&&(this.privKeyBytes.fill(0),this.privKeyBytes=void 0),this}toJSON(){return{xpriv:this.privateExtendedKey,xpub:this.publicExtendedKey}}serialize(t,r){if(!this.chainCode)throw new Error("No chainCode set");return(0,du.abytes)(r,33),(0,du.concatBytes)(rre(t),new Uint8Array([this.depth]),rre(this.parentFingerprint),rre(this.index),this.chainCode,r)}};rb.HDKey=p8e});var cbt=_(ire=>{"use strict";Object.defineProperty(ire,"__esModule",{value:!0});ire.pbkdf2=Qhn;ire.pbkdf2Async=e0n;var Zhn=cv(),wh=Zo();function sbt(e,t,r,n){(0,wh.ahash)(e);let i=(0,wh.checkOpts)({dkLen:32,asyncTick:10},n),{c:o,dkLen:s,asyncTick:a}=i;if((0,wh.anumber)(o),(0,wh.anumber)(s),(0,wh.anumber)(a),o<1)throw new Error("iterations (c) should be >= 1");let c=(0,wh.kdfInputToBytes)(t),u=(0,wh.kdfInputToBytes)(r),d=new Uint8Array(s),l=Zhn.hmac.create(e,c),p=l._cloneInto().update(u);return{c:o,dkLen:s,asyncTick:a,DK:d,PRF:l,PRFSalt:p}}function abt(e,t,r,n,i){return e.destroy(),t.destroy(),n&&n.destroy(),(0,wh.clean)(i),r}function Qhn(e,t,r,n){let{c:i,dkLen:o,DK:s,PRF:a,PRFSalt:c}=sbt(e,t,r,n),u,d=new Uint8Array(4),l=(0,wh.createView)(d),p=new Uint8Array(a.outputLen);for(let f=1,m=0;m<o;f++,m+=a.outputLen){let h=s.subarray(m,m+a.outputLen);l.setInt32(0,f,!1),(u=c._cloneInto(u)).update(d).digestInto(p),h.set(p.subarray(0,h.length));for(let g=1;g<i;g++){a._cloneInto(u).update(p).digestInto(p);for(let y=0;y<h.length;y++)h[y]^=p[y]}}return abt(a,c,s,u,p)}async function e0n(e,t,r,n){let{c:i,dkLen:o,asyncTick:s,DK:a,PRF:c,PRFSalt:u}=sbt(e,t,r,n),d,l=new Uint8Array(4),p=(0,wh.createView)(l),f=new Uint8Array(c.outputLen);for(let m=1,h=0;h<o;m++,h+=c.outputLen){let g=a.subarray(h,h+c.outputLen);p.setInt32(0,m,!1),(d=u._cloneInto(d)).update(l).digestInto(f),g.set(f.subarray(0,g.length)),await(0,wh.asyncLoop)(i-1,s,()=>{c._cloneInto(d).update(f).digestInto(f);for(let y=0;y<g.length;y++)g[y]^=f[y]})}return abt(c,u,a,d,f)}});var _8e=_(iT=>{"use strict";Object.defineProperty(iT,"__esModule",{value:!0});iT.generateMnemonic=r0n;iT.mnemonicToEntropy=fbt;iT.entropyToMnemonic=mbt;iT.validateMnemonic=i0n;iT.mnemonicToSeed=o0n;iT.mnemonicToSeedSync=s0n;var ubt=cbt(),h8e=ag(),m8e=Zo(),ore=u8e(),t0n=e=>e[0]==="\u3042\u3044\u3053\u304F\u3057\u3093";function dbt(e){if(typeof e!="string")throw new TypeError("invalid mnemonic type: "+typeof e);return e.normalize("NFKD")}function g8e(e){let t=dbt(e),r=t.split(" ");if(![12,15,18,21,24].includes(r.length))throw new Error("Invalid mnemonic");return{nfkd:t,words:r}}function lbt(e){(0,m8e.abytes)(e,16,20,24,28,32)}function r0n(e,t=128){if((0,m8e.anumber)(t),t%32!==0||t>256)throw new TypeError("Invalid entropy");return mbt((0,m8e.randomBytes)(t/8),e)}var n0n=e=>{let t=8-e.length/4;return new Uint8Array([(0,h8e.sha256)(e)[0]>>t<<t])};function pbt(e){if(!Array.isArray(e)||e.length!==2048||typeof e[0]!="string")throw new Error("Wordlist: expected array of 2048 strings");return e.forEach(t=>{if(typeof t!="string")throw new Error("wordlist: non-string element: "+t)}),ore.utils.chain(ore.utils.checksum(1,n0n),ore.utils.radix2(11,!0),ore.utils.alphabet(e))}function fbt(e,t){let{words:r}=g8e(e),n=pbt(t).decode(r);return lbt(n),n}function mbt(e,t){return lbt(e),pbt(t).encode(e).join(t0n(t)?"\u3000":" ")}function i0n(e,t){try{fbt(e,t)}catch{return!1}return!0}var hbt=e=>dbt("mnemonic"+e);function o0n(e,t=""){return(0,ubt.pbkdf2Async)(h8e.sha512,g8e(e).nfkd,hbt(t),{c:2048,dkLen:64})}function s0n(e,t=""){return(0,ubt.pbkdf2)(h8e.sha512,g8e(e).nfkd,hbt(t),{c:2048,dkLen:64})}});var gbt=_(y8e=>{"use strict";Object.defineProperty(y8e,"__esModule",{value:!0});y8e.generateMnemonic=c0n;var a0n=_8e();function c0n(e,t){return(0,a0n.generateMnemonic)(e,t)}});var _bt=_(b8e=>{"use strict";Object.defineProperty(b8e,"__esModule",{value:!0});b8e.generatePrivateKey=l0n;var u0n=Ef(),d0n=De();function l0n(){return(0,d0n.toHex)(u0n.secp256k1.utils.randomPrivateKey())}});var S8e=_(E8e=>{"use strict";Object.defineProperty(E8e,"__esModule",{value:!0});E8e.toAccount=p0n;var ybt=sp(),bbt=cc();function p0n(e){if(typeof e=="string"){if(!(0,bbt.isAddress)(e,{strict:!1}))throw new ybt.InvalidAddressError({address:e});return{address:e,type:"json-rpc"}}if(!(0,bbt.isAddress)(e.address,{strict:!1}))throw new ybt.InvalidAddressError({address:e.address});return{address:e.address,nonceManager:e.nonceManager,sign:e.sign,signAuthorization:e.signAuthorization,signMessage:e.signMessage,signTransaction:e.signTransaction,signTypedData:e.signTypedData,source:"custom",type:"local"}}});var QI=_(are=>{"use strict";Object.defineProperty(are,"__esModule",{value:!0});are.setSignEntropy=_0n;are.sign=y0n;var f0n=Ef(),m0n=sc(),h0n=yn(),Ebt=De(),g0n=wU(),sre=!1;function _0n(e){if(!e)throw new Error("must be a `true` or a hex value.");sre=e}async function y0n({hash:e,privateKey:t,to:r="object"}){let{r:n,s:i,recovery:o}=f0n.secp256k1.sign(e.slice(2),t.slice(2),{lowS:!0,extraEntropy:(0,m0n.isHex)(sre,{strict:!1})?(0,h0n.hexToBytes)(sre):sre}),s={r:(0,Ebt.numberToHex)(n,{size:32}),s:(0,Ebt.numberToHex)(i,{size:32}),v:o?28n:27n,yParity:o};return r==="bytes"||r==="hex"?(0,g0n.serializeSignature)({...s,to:r}):s}});var T8e=_(v8e=>{"use strict";Object.defineProperty(v8e,"__esModule",{value:!0});v8e.signAuthorization=S0n;var b0n=WY(),E0n=QI();async function S0n(e){let{chainId:t,nonce:r,privateKey:n,to:i="object"}=e,o=e.contractAddress??e.address,s=await(0,E0n.sign)({hash:(0,b0n.hashAuthorization)({address:o,chainId:t,nonce:r}),privateKey:n,to:i});return i==="object"?{address:o,chainId:t,nonce:r,...s}:s}});var w8e=_(A8e=>{"use strict";Object.defineProperty(A8e,"__esModule",{value:!0});A8e.signMessage=A0n;var v0n=rI(),T0n=QI();async function A0n({message:e,privateKey:t}){return await(0,T0n.sign)({hash:(0,v0n.hashMessage)(e),privateKey:t,to:"hex"})}});var P8e=_(I8e=>{"use strict";Object.defineProperty(I8e,"__esModule",{value:!0});I8e.signTransaction=x0n;var w0n=Yc(),I0n=sR(),P0n=QI();async function x0n(e){let{privateKey:t,transaction:r,serializer:n=I0n.serializeTransaction}=e,i=r.type==="eip4844"?{...r,sidecars:!1}:r,o=await(0,P0n.sign)({hash:(0,w0n.keccak256)(await n(i)),privateKey:t});return await n(r,o)}});var O8e=_(x8e=>{"use strict";Object.defineProperty(x8e,"__esModule",{value:!0});x8e.signTypedData=N0n;var O0n=nI(),R0n=QI();async function N0n(e){let{privateKey:t,...r}=e;return await(0,R0n.sign)({hash:(0,O0n.hashTypedData)(r),privateKey:t,to:"hex"})}});var N8e=_(R8e=>{"use strict";Object.defineProperty(R8e,"__esModule",{value:!0});R8e.privateKeyToAccount=H0n;var C0n=Ef(),M0n=De(),k0n=S8e(),D0n=CO(),L0n=QI(),U0n=T8e(),B0n=w8e(),j0n=P8e(),q0n=O8e();function H0n(e,t={}){let{nonceManager:r}=t,n=(0,M0n.toHex)(C0n.secp256k1.getPublicKey(e.slice(2),!1)),i=(0,D0n.publicKeyToAddress)(n);return{...(0,k0n.toAccount)({address:i,nonceManager:r,async sign({hash:s}){return(0,L0n.sign)({hash:s,privateKey:e,to:"hex"})},async signAuthorization(s){return(0,U0n.signAuthorization)({...s,privateKey:e})},async signMessage({message:s}){return(0,B0n.signMessage)({message:s,privateKey:e})},async signTransaction(s,{serializer:a}={}){return(0,j0n.signTransaction)({privateKey:e,transaction:s,serializer:a})},async signTypedData(s){return(0,q0n.signTypedData)({...s,privateKey:e})}}),publicKey:n,source:"privateKey"}}});var M8e=_(C8e=>{"use strict";Object.defineProperty(C8e,"__esModule",{value:!0});C8e.hdKeyToAccount=$0n;var V0n=De(),F0n=N8e();function $0n(e,{accountIndex:t=0,addressIndex:r=0,changeIndex:n=0,path:i,...o}={}){let s=e.derive(i||`m/44'/60'/${t}'/${n}/${r}`);return{...(0,F0n.privateKeyToAccount)((0,V0n.toHex)(s.privateKey),o),getHdKey:()=>s,source:"hd"}}});var Sbt=_(k8e=>{"use strict";Object.defineProperty(k8e,"__esModule",{value:!0});k8e.mnemonicToAccount=W0n;var z0n=f8e(),G0n=_8e(),K0n=M8e();function W0n(e,{passphrase:t,...r}={}){let n=(0,G0n.mnemonicToSeedSync)(e,t);return(0,K0n.hdKeyToAccount)(z0n.HDKey.fromMasterSeed(n),r)}});var vbt=_(D8e=>{"use strict";Object.defineProperty(D8e,"__esModule",{value:!0});D8e.privateKeyToAddress=Z0n;var Y0n=Ef(),J0n=De(),X0n=CO();function Z0n(e){let t=(0,J0n.bytesToHex)(Y0n.secp256k1.getPublicKey(e.slice(2),!1));return(0,X0n.publicKeyToAddress)(t)}});var Tbt=_(cre=>{"use strict";Object.defineProperty(cre,"__esModule",{value:!0});cre.wordlist=void 0;cre.wordlist=`abdikace
+`),n=/^"@signature-params": \(([^)]+)\);created=(\d+);expires=(\d+);keyid="([A-Za-z0-9_-]{43})";alg="Ed25519";nonce="([A-Za-z0-9+/]{43}=)";tag="agent-payer-auth"$/.exec(r.pop()??"");if(!n)throw new Error("identity_tap_payload_invalid");let i={};for(let a of r){let c=/^"([^"\n]+)": (.+)$/.exec(a);if(!c||Object.hasOwn(i,c[1]))throw new Error("identity_tap_payload_invalid");i[c[1]]=c[2]}let o=Object.hasOwn(i,"payment-signature")?"payment-signature":"x-payment",s={kind:"tap_signature_base",method:i["@method"]??"",authority:i["@authority"]??"",path:i["@path"]??"",coveredComponents:n[1].split(" ").map(a=>a.slice(1,-1)),paymentHeaderName:o,paymentHeaderValue:i[o]??"",...i["content-digest"]===void 0?{}:{contentDigest:i["content-digest"]},created:Number(n[2]),expires:Number(n[3]),keyId:n[4],nonce:n[5],tag:"agent-payer-auth",signatureBase:t};return VOe(s),s}});var _1t=_(UI=>{"use strict";Object.defineProperty(UI,"__esModule",{value:!0});UI.IDENTITY_TAP_SLIP_REQUEST_TYP=void 0;UI.validateIdentityTapSlipRequest=g1t;UI.issueIdentityTapSlip=Oln;var Sln=lte(),vln=qf(),h1t=Hu(),Tln=Ju(),Aln=Lv(),wln=Dy();UI.IDENTITY_TAP_SLIP_REQUEST_TYP="visa-agent-identity-tap-slip-request+jwt";var Iln=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),Pln=e=>typeof e=="string"&&Buffer.from(e,"base64url").length===32&&Buffer.from(e,"base64url").toString("base64url")===e,xln="v,iss,aud,jti,requestId,associationId,associationVersion,agentId,rootJkt,ownerSuborganizationId,runtimeId,runtimeJkt,generation,network,payloadSha256,leaseSha256,iat,exp".split(",").sort().join(",");function g1t(e){if(!e||Object.keys(e).sort().join(",")!==xln||e.v!==1||e.iss!=="urn:visa:authority:identity"||e.aud!=="visa:auth:identity-tap-slip"||![e.jti,e.requestId,e.associationId,e.agentId,e.runtimeId].every(Iln)||![e.rootJkt,e.runtimeJkt,e.payloadSha256,e.leaseSha256].every(Pln)||![e.associationVersion,e.generation].every(t=>Number.isSafeInteger(t)&&t>0)||!Number.isSafeInteger(e.iat)||e.iat<0||!Number.isSafeInteger(e.exp)||e.exp<=e.iat||e.exp-e.iat>60||typeof e.ownerSuborganizationId!="string"||!/^[\x21-\x7e]{1,256}$/.test(e.ownerSuborganizationId)||typeof e.network!="string"||!/^eip155:[1-9][0-9]{0,15}$/.test(e.network))throw new Error("identity_tap_slip_request_invalid")}async function Oln(e){if(typeof e.ticket!="string"||e.ticket.length>16384||typeof e.popJwt!="string"||e.popJwt.length>32768)throw new Error("identity_tap_slip_request_invalid");let t=(0,h1t.computeJkt)(e.authorityPublicJwk),r=await(0,Tln.verifyJwtSignature)(e.ticket,{keys:[{...e.authorityPublicJwk,kid:t}]});if(!r.ok||r.header.typ!==UI.IDENTITY_TAP_SLIP_REQUEST_TYP||r.header.kid!==t)throw new Error("identity_tap_slip_request_invalid");let n=r.claims;if(g1t(n),!Number.isSafeInteger(e.nowSec)||e.nowSec<0||n.iat>e.nowSec+5||n.exp<=e.nowSec)throw new Error("identity_tap_slip_request_expired");if(Buffer.from((0,vln.canonicalJson)(n)).toString("base64url")!==e.ticket.split(".")[1])throw new Error("identity_tap_slip_request_invalid");let i=(0,h1t.computeJkt)(e.signer.publicJwk);if([t,n.rootJkt,n.runtimeJkt].includes(i))throw new Error("identity_slip_issuer_not_independent");if(!e.payload||typeof e.payload!="object"||e.payload.kind!=="tap_signature_base"||(0,Sln.identityTapPayloadSha256)(e.payload)!==n.payloadSha256)throw new Error("identity_tap_slip_payload_mismatch");let o=await(0,wln.verifyAgentOperationPopProof)(e.popJwt,{operationId:n.requestId,audience:"urn:visa:tvc:identity-gate",expectedIntentHash:n.payloadSha256,nowSec:e.nowSec,maxAgeSec:60});if(!o.ok||o.jkt!==n.runtimeJkt||o.runtimeCertificate!==void 0)throw new Error("identity_tap_slip_proof_invalid");return(0,Aln.signJwtWithSigner)(e.signer,{typ:"visa-agent-identity-slip+jwt"},{v:1,iss:"visa:auth",aud:"urn:visa:tvc:identity-gate",jti:n.jti,requestId:n.requestId,iat:n.iat,exp:n.exp,purpose:"tap_signature_base",payloadSha256:n.payloadSha256,agentId:n.agentId,rootJkt:n.rootJkt,ownerSuborganizationId:n.ownerSuborganizationId,runtimeId:n.runtimeId,runtimeJkt:n.runtimeJkt,generation:n.generation,network:n.network})}});var FOe=_(yh=>{"use strict";Object.defineProperty(yh,"__esModule",{value:!0});yh.IDENTITY_HOSTED_TAP_SLIP_PURPOSE=yh.IDENTITY_PRESENCE_SLIP_PURPOSE=void 0;yh.hostedPresenceAttemptId=Mln;yh.issueHostedPresenceIdentitySlip=kln;yh.issueHostedTapIdentitySlip=Dln;var Rln=require("node:crypto"),Nln=Hu(),Cln=Lv();yh.IDENTITY_PRESENCE_SLIP_PURPOSE="runtime_presence_pop";yh.IDENTITY_HOSTED_TAP_SLIP_PURPOSE="tap_signature_base";function Mln(e,t){if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e)||!Number.isSafeInteger(t)||t<0)throw new Error("hosted_presence_attempt_invalid");let r=(0,Rln.createHash)("sha256").update(`visa:hosted-presence-attempt:v1\0${e}\0${t}`,"utf8").digest().subarray(0,16);r[6]=r[6]&15|128,r[8]=r[8]&63|128;let n=r.toString("hex");return`${n.slice(0,8)}-${n.slice(8,12)}-${n.slice(12,16)}-${n.slice(16,20)}-${n.slice(20)}`}function kln(e){return y1t(yh.IDENTITY_PRESENCE_SLIP_PURPOSE,e)}function Dln(e){return y1t(yh.IDENTITY_HOSTED_TAP_SLIP_PURPOSE,e)}async function y1t(e,t){let r=(0,Nln.computeJkt)(t.signer.publicJwk);if([t.rootJkt,t.runtimeJkt].includes(r))throw new Error("identity_slip_issuer_not_independent");if(!Number.isSafeInteger(t.iat)||!Number.isSafeInteger(t.exp)||t.iat<0||t.exp<=t.iat||!Number.isSafeInteger(t.generation)||t.generation<1||!/^eip155:[1-9][0-9]{0,15}$/.test(t.network)||!/^[A-Za-z0-9_-]{43}$/.test(t.payloadSha256)||!/^[A-Za-z0-9_-]{43}$/.test(t.rootJkt)||!/^[A-Za-z0-9_-]{43}$/.test(t.runtimeJkt)||!/^[\x21-\x7e]{1,256}$/.test(t.ownerSuborganizationId))throw new Error("identity_presence_slip_request_invalid");return(0,Cln.signJwtWithSigner)(t.signer,{typ:"visa-agent-identity-slip+jwt"},{v:1,iss:"visa:auth",aud:"urn:visa:tvc:identity-gate",jti:t.jti,requestId:t.requestId,iat:t.iat,exp:t.exp,purpose:e,payloadSha256:t.payloadSha256,agentId:t.agentId,rootJkt:t.rootJkt,ownerSuborganizationId:t.ownerSuborganizationId,runtimeId:t.runtimeId,runtimeJkt:t.runtimeJkt,generation:t.generation,network:t.network})}});var T1t=_(zv=>{"use strict";Object.defineProperty(zv,"__esModule",{value:!0});zv.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP=void 0;zv.validateIdentityHostedTapSlipRequest=S1t;zv.hostedTapPayloadNamesMerchantRequest=v1t;zv.issueHostedTapSlipFromTicket=$ln;var Lln=qf(),b1t=Hu(),Uln=Ju(),Bln=lte(),jln=DOe(),qln=FOe();zv.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP="visa-agent-identity-hosted-tap-slip-request+jwt";var Hln=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),E1t=e=>typeof e=="string"&&Buffer.from(e,"base64url").length===32&&Buffer.from(e,"base64url").toString("base64url")===e,Vln=e=>Number.isSafeInteger(e)&&e>0,Fln="v,iss,aud,jti,requestId,associationId,associationVersion,agentId,rootJkt,ownerSuborganizationId,runtimeId,runtimeJkt,generation,network,custody,connectorKeyId,grantId,grantVersion,operationId,intentHash,payloadSha256,iat,exp".split(",").sort().join(",");function S1t(e){if(!e||typeof e!="object"||Object.keys(e).sort().join(",")!==Fln||e.v!==1||e.iss!=="urn:visa:authority:identity"||e.aud!=="visa:auth:identity-tap-slip"||![e.jti,e.requestId,e.associationId,e.agentId,e.runtimeId,e.grantId,e.operationId].every(Hln)||![e.rootJkt,e.runtimeJkt,e.intentHash,e.payloadSha256].every(E1t)||![e.associationVersion,e.generation,e.grantVersion].every(Vln)||e.custody!=="signer"||typeof e.connectorKeyId!="string"||!/^[A-Za-z0-9._:@/-]{1,256}$/.test(e.connectorKeyId)||!Number.isSafeInteger(e.iat)||e.iat<0||!Number.isSafeInteger(e.exp)||e.exp<=e.iat||e.exp-e.iat>60||typeof e.ownerSuborganizationId!="string"||!/^[\x21-\x7e]{1,256}$/.test(e.ownerSuborganizationId)||typeof e.network!="string"||!/^eip155:[1-9][0-9]{0,15}$/.test(e.network))throw new Error("identity_hosted_tap_slip_request_invalid")}function v1t(e,t){let r;try{r=new URL(t.url)}catch{return!1}return r.protocol!=="https:"&&r.protocol!=="http:"||typeof t.method!="string"||e.method!==t.method.toUpperCase()||e.authority!==r.host||e.path!==(r.pathname||"/")?!1:e.contentDigest===void 0?t.bodySha256===void 0||t.bodySha256==="47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU":typeof t.bodySha256!="string"||!E1t(t.bodySha256)?!1:e.contentDigest===`sha-256=:${Buffer.from(t.bodySha256,"base64url").toString("base64")}:`}async function $ln(e){if(typeof e.ticket!="string"||e.ticket.length>16384)throw new Error("identity_hosted_tap_slip_request_invalid");let t=(0,b1t.computeJkt)(e.authorityPublicJwk),r=await(0,Uln.verifyJwtSignature)(e.ticket,{keys:[{...e.authorityPublicJwk,kid:t}]});if(!r.ok||r.header.typ!==zv.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP||r.header.kid!==t)throw new Error("identity_hosted_tap_slip_request_invalid");let n=r.claims;if(S1t(n),!Number.isSafeInteger(e.nowSec)||e.nowSec<0||n.iat>e.nowSec+30||n.exp<=e.nowSec)throw new Error("identity_hosted_tap_slip_request_expired");if(Buffer.from((0,Lln.canonicalJson)(n)).toString("base64url")!==e.ticket.split(".")[1])throw new Error("identity_hosted_tap_slip_request_invalid");let i=(0,b1t.computeJkt)(e.signer.publicJwk);if([t,n.rootJkt,n.runtimeJkt].includes(i))throw new Error("identity_slip_issuer_not_independent");let o=e.payload;if(!o||typeof o!="object"||o.kind!=="tap_signature_base"||(0,Bln.identityTapPayloadSha256)(o)!==n.payloadSha256||o.operationId!==n.operationId||o.intentHash!==n.intentHash)throw new Error("identity_hosted_tap_slip_payload_mismatch");let s=e.presence;if(!s||s.agentId!==n.agentId||s.runtimeId!==n.runtimeId||s.connectorKeyId!==n.connectorKeyId||s.operationId!==n.operationId||s.intentHash!==n.intentHash)throw new Error("identity_hosted_tap_connector_absent");if(!s.merchant||!v1t(o,s.merchant))throw new Error("identity_hosted_tap_merchant_mismatch");let a=await(0,qln.issueHostedTapIdentitySlip)({signer:e.signer,jti:n.jti,requestId:n.requestId,iat:n.iat,exp:n.exp,payloadSha256:n.payloadSha256,agentId:n.agentId,rootJkt:n.rootJkt,ownerSuborganizationId:n.ownerSuborganizationId,runtimeId:n.runtimeId,runtimeJkt:n.runtimeJkt,generation:n.generation,network:n.network}),c=await(0,jln.issueHostedConnectorProof)({signer:e.signer,requestId:n.requestId,agentId:n.agentId,runtimeId:n.runtimeId,connectorKeyId:n.connectorKeyId,grantId:n.grantId,grantVersion:n.grantVersion,operationId:n.operationId,intentHash:n.intentHash,issuedAtSec:e.nowSec});return{identitySlip:a,connectorProof:c,claims:n}}});var P1t=_(Gv=>{"use strict";Object.defineProperty(Gv,"__esModule",{value:!0});Gv.IDENTITY_DEVICE_HANDOFF_AUDIENCE=void 0;Gv.identityDeviceProposalSha256=w1t;Gv.identityDeviceHandoffIntentHash=I1t;Gv.verifyIdentityDeviceHandoffProof=Yln;var zln=require("node:crypto"),Gln=qf(),Kln=Hu(),Wln=Dy();Gv.IDENTITY_DEVICE_HANDOFF_AUDIENCE="visa-device-handoff:v1";var mB=e=>typeof e=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(e),A1t=e=>typeof e=="string"&&Buffer.from(e,"base64url").length===32&&Buffer.from(e,"base64url").toString("base64url")===e,BI=(e,t)=>e!==null&&typeof e=="object"&&!Array.isArray(e)&&Object.keys(e).sort().join(",")===t.sort().join(","),$Oe=e=>(0,zln.createHash)("sha256").update((0,Gln.canonicalJson)(e)).digest("base64url");function w1t(e){if(!BI(e,["associationId","associationVersion","agentId","rootJkt","runtimeId","runtimePublicJwk","runtimeJkt"])||![e.associationId,e.agentId,e.runtimeId].every(mB)||!Number.isSafeInteger(e.associationVersion)||e.associationVersion<1||![e.rootJkt,e.runtimeJkt].every(A1t)||e.rootJkt===e.runtimeJkt||!BI(e.runtimePublicJwk,["kty","crv","x"])||e.runtimePublicJwk.kty!=="OKP"||e.runtimePublicJwk.crv!=="Ed25519"||!A1t(e.runtimePublicJwk.x)||(0,Kln.computeJkt)(e.runtimePublicJwk)!==e.runtimeJkt)throw new Error("identity_device_proposal_invalid");return $Oe(e)}function I1t(e){if(!BI(e,["v","operation","requestId","handoffId","proposal","body"])||e.v!==1||!mB(e.requestId)||!mB(e.handoffId))throw new Error("identity_device_handoff_invalid");let t=w1t(e.proposal);if(e.operation==="create"){if(e.requestId!==e.handoffId||!BI(e.body,[]))throw new Error("identity_device_handoff_invalid")}else if(e.operation==="read"){if(!BI(e.body,[]))throw new Error("identity_device_handoff_invalid")}else if(e.operation==="cancel"){if(!BI(e.body,["enrollmentRequestId","generation"])||!(e.body.enrollmentRequestId===null&&e.body.generation===null)&&(!mB(e.body.enrollmentRequestId)||!Number.isSafeInteger(e.body.generation)||e.body.generation<1))throw new Error("identity_device_handoff_invalid")}else if(e.operation==="proof"){if(!BI(e.body,["enrollmentRequestId","runtimeProof"])||!mB(e.body.enrollmentRequestId)||typeof e.body.runtimeProof!="string"||e.body.runtimeProof.length!==86||Buffer.from(e.body.runtimeProof,"base64url").length!==64||Buffer.from(e.body.runtimeProof,"base64url").toString("base64url")!==e.body.runtimeProof)throw new Error("identity_device_handoff_invalid")}else throw new Error("identity_device_handoff_invalid");return $Oe({v:1,operation:e.operation,handoffId:e.handoffId,proposalSha256:t,bodySha256:$Oe(e.body)})}async function Yln(e,t,r){let n=await(0,Wln.verifyAgentOperationPopProof)(e,{operationId:t.requestId,audience:Gv.IDENTITY_DEVICE_HANDOFF_AUDIENCE,expectedIntentHash:I1t(t),nowSec:r,maxAgeSec:60});if(!n.ok||n.jkt!==t.proposal.runtimeJkt||n.runtimeCertificate!==void 0)throw new Error("identity_device_handoff_proof_invalid")}});var Eh=_(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=C.RUNTIME_CERTIFICATE_VERSION=C.RUNTIME_CERTIFICATE_TYP=C.verifyAgentOperationPopProof=C.verifyPopProof=C.createAgentOperationPopProof=C.createPopProofWithSigner=C.createPopProof=C.randomPopNonce=C.DEFAULT_POP_MAX_AGE_SEC=C.UNIVERSAL_AGENT_OPERATION_AUDIENCE=C.POP_JWT_TYP=C.importLegacyWalletSpendPolicy=C.canonicalLegacyWalletSpendPolicy=C.productSpendPolicyHash=C.isProductSpendPolicySubset=C.evaluateProductSpendPolicy=C.canonicalRuntimeProductSpendAttenuation=C.canonicalOwnerProductSpendPolicy=C.canonicalMerchantTarget=C.canonicalMerchantPathPrefix=C.canonicalMerchantOriginPattern=C.PRODUCT_SPEND_POLICY_VERSION=C.evaluateEconomic=C.verifyBindingChain=C.DEFAULT_MAX_STALENESS_SECONDS=C.InMemoryFreshnessStore=C.FreshnessService=C.verifyFreshness=C.issueFreshness=C.FRESHNESS_JWT_TYP=C.MAX_TTL_FRESH_HOURS=C.TTL_FRESH_HOURS=C.verifyRegistration=C.issueRegistration=C.registrationHash=C.derivePairwiseRef=C.REGISTRATION_JWT_TYP=C.TTL_REG_DAYS=C.isCanonicalEvmProviderAddress=C.canonicalEvmProviderAddress=C.turnkeyOwnerIdentityKey=C.verifyEip712TypedDataSignature=C.eip712DigestBase64Url=C.buildJwks=C.anchorKeyFromSeed=C.generateAnchorKey=C.agentKeyFromSeed=C.generateAgentKey=C.computeJkt=void 0;C.CHALLENGE_MAX_AGE_SEC=C.MAX_TTL_OWNERSHIP_HOURS=C.TTL_OWNERSHIP_HOURS=C.OWNERSHIP_PROOF_JWT_TYP=C.OWNERSHIP_CHALLENGE_DOMAIN_V1=C.canonicalIntentHash=C.INTENT_HASH_VERSION=C.verifyWalletBinding=C.issueWalletBinding=C.completeWalletBinding=C.prepareWalletBinding=C.WALLET_BINDING_DERIVATION_VERSION=C.WALLET_BINDING_SIGNER_KIND=C.WALLET_BINDING_MAX_TTL_SECONDS=C.WALLET_BINDING_VERSION=C.WALLET_BINDING_TYP=C.verifyTapRuntimeSignature=C.tapRuntimeSigningMessage=C.TAP_RUNTIME_SIGNATURE_DOMAIN=C.verifyRuntimeLeaseRequestProof=C.createRuntimeLeaseRequestProofWithSigner=C.createRuntimeLeaseRequestProof=C.runtimeLeaseRequestIntentHash=C.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS=C.RUNTIME_LEASE_REQUEST_AUDIENCE=C.RUNTIME_LEASE_REQUEST_VERSION=C.verifyRuntimeLeaseChain=C.verifyRuntimeDelegation=C.issueRuntimeLease=C.issueRuntimeDelegation=C.completeRuntimeDelegation=C.prepareRuntimeDelegation=C.RUNTIME_LEASE_SIGNING_MODES=C.RUNTIME_LEASE_PURPOSE=C.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS=C.RUNTIME_LEASE_MAX_TTL_SECONDS=C.RUNTIME_LEASE_AUDIENCE=C.RUNTIME_LEASE_VERSION=C.RUNTIME_LEASE_TYP=C.RUNTIME_DELEGATION_MAX_TTL_SECONDS=C.RUNTIME_DELEGATION_VERSION=C.RUNTIME_DELEGATION_TYP=C.verifyRuntimeCertificate=C.prepareRuntimeCertificate=C.peekRuntimeCertificate=C.issueRuntimeCertificate=C.completeRuntimeCertificate=C.HOSTED_RUNTIME_CERTIFICATE_PURPOSES=C.RUNTIME_CERTIFICATE_PURPOSES=C.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS=void 0;C.pairingVerifierChallenge=C.randomPairingVerifier=C.randomSetupOperationId=C.randomHandoffId=C.randomAttachId=C.randomPairingId=C.assertAgentPairingTransition=C.canTransitionAgentPairing=C.isAgentPairingState=C.AGENT_PAIRING_TERMINAL_STATES=C.AGENT_PAIRING_STATES=C.AGENT_PAIRING_CODE_LENGTH=C.AGENT_PAIRING_CODE_ALPHABET=C.AGENT_PAIRING_TTL_SECONDS=C.AGENT_PAIRING_PROTOCOL_VERSION_V2=C.AGENT_PAIRING_PROTOCOL_VERSION=C.verifyGrant=C.issueGrantWithSigner=C.issueGrant=C.GRANT_RAILS=C.MAX_TTL_GRANT_DAYS=C.TTL_GRANT_DAYS=C.GRANT_JWT_TYP=C.KillList=C.attestationIsVoid=C.verifyKillSwitch=C.issueKillSwitch=C.verifySuccession=C.issueSuccession=C.KILL_SWITCH_JWT_TYP=C.SUCCESSION_JWT_TYP=C.verifyWalletAuthorizationPermit=C.issueWalletAuthorizationPermit=C.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS=C.WALLET_AUTHORIZATION_PERMIT_POLICY_ID=C.WALLET_AUTHORIZATION_PERMIT_AUDIENCE=C.WALLET_AUTHORIZATION_PERMIT_ISSUER=C.WALLET_AUTHORIZATION_PERMIT_JWT_TYP=C.issueRegistrationWithSigner=C.signerFromSignFn=C.signerFromAnchorKey=C.LocalSigner=C.signJwtWithSigner=C.walletVerifiedFromProof=C.verifyOwnershipProof=C.attestWalletOwnership=C.issueOwnershipProofWithSigner=C.issueOwnershipProof=C.verifyOwnershipSignature=C.buildOwnershipChallenge=void 0;C.authorizationScopeFacts=C.VIC_SETTLEMENT_ENVELOPE_VERSION=C.VIC_SETTLEMENT_ENVELOPE_KIND=C.VIC_PROCESSOR_ACTIONS=C.USD_MICROS_PER_CENT=C.AGENT_KEY_STATUSES=C.AGENT_KEY_PURPOSES=C.AGENT_KEY_CUSTODIES=C.AGENT_CHANNEL_STATUSES=C.AGENT_CHANNEL_ASSURANCES=C.AGENT_CHANNEL_KINDS=C.AGENT_EXECUTION_READINESS_REASONS=C.AGENT_AUTHORIZATION_SCOPES=C.AGENT_AUTHORITY_VALUATION_POLICY=C.AGENT_BUDGET_EPOCH_MODES=C.AGENT_AUTHORITY_VERSION=C.sha256=C.pairingInstrumentCommitment=C.pairingDeliveryArtifactV2Hash=C.canonicalPairingDeliveryArtifactV2=C.pairingArtifactHash=C.agentMailCredentialClaimMessageV2=C.keyRotationClaimHashV2=C.keyRotationClaimMessageV2=C.capabilityAttachActivationMessageV2=C.capabilityAttachClaimHashV2=C.capabilityAttachClaimMessageV2=C.handoffAuthorityCapabilities=C.AGENT_HANDOFF_COMPOUND_AUTHORITY=C.AGENT_HANDOFF_AUTHORITIES=C.AGENT_CAPABILITY_ATTACH_CAPABILITIES=C.pairingActivationMessageV2=C.pairingActivationMessage=C.pairingClaimHashV2=C.pairingClaimMessageV2=C.pairingClaimMessage=C.pairingTermsV2Hash=C.pairingTermsHash=C.canonicalPairingTermsV2=C.canonicalPairingTerms=C.setupConfirmationCode=C.pairingConfirmationCode=C.pairingCodeFromClaimToken=C.pairingClaimTokenHash=C.randomPairingClaimToken=C.pairingCodeHash=C.isValidPairingCode=C.formatPairingCode=C.normalizePairingCode=C.randomPairingCode=void 0;C.identityTapSigningBytes=C.hostedTapPayloadNamesMerchantRequest=C.issueHostedTapSlipFromTicket=C.validateIdentityHostedTapSlipRequest=C.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP=C.hostedPresenceAttemptId=C.issueHostedTapIdentitySlip=C.issueHostedPresenceIdentitySlip=C.IDENTITY_HOSTED_TAP_SLIP_PURPOSE=C.IDENTITY_PRESENCE_SLIP_PURPOSE=C.issueIdentityTapSlip=C.validateIdentityTapSlipRequest=C.IDENTITY_TAP_SLIP_REQUEST_TYP=C.verifyIdentityDeviceEnrollmentProof=C.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES=C.prepareIdentityHostedGateAuthorization=C.prepareIdentityDeviceGateAuthorization=C.identityDeviceEnrollmentPreimage=C.verifyIdentityTapLeaseRequestProof=C.createIdentityTapLeaseRequestProof=C.identityTapLeaseRequestIntentHash=C.issueIdentityTapLease=C.verifyIdentityTapDelegation=C.prepareIdentityTapDelegation=C.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE=C.IDENTITY_TAP_LEASE_AUDIENCE=C.IDENTITY_TAP_PURPOSE=C.IDENTITY_TAP_PROFILE=C.verifyIdentityPresenceLeaseChain=C.verifyHostedConnectorProof=C.issueIdentityPresenceLease=C.issueHostedConnectorProof=C.HOSTED_CONNECTOR_PROOF_TTL_SECONDS=C.HOSTED_CONNECTOR_PROOF_TYP=C.IDENTITY_PRESENCE_SIGNING_MODE=C.IDENTITY_PRESENCE_PURPOSE=C.IDENTITY_PRESENCE_LEASE_AUDIENCE=C.prepareIdentityPresenceDelegation=C.vicSettlementEnvelopeHash=C.usdcAtomicToUsdMicros=C.walletAuthorizationRequestHash=C.spendAuthorizationIntentHash=C.agentAuthorityGrantHash=C.isCanonicalBase64Url32=C.centsToUsdMicros=C.canonicalVicSettlementEnvelope=C.canonicalSpendAuthorizationIntent=C.canonicalAgentKeyDescriptor=C.canonicalAgentChannelDescriptor=C.canonicalAgentAuthorityGrant=void 0;C.verifyIdentityDeviceHandoffProof=C.identityDeviceHandoffIntentHash=C.identityDeviceProposalSha256=C.IDENTITY_DEVICE_HANDOFF_AUDIENCE=C.parseIdentityTapSignatureBase=C.identityTapPayloadSha256=void 0;var b8=Hu();Object.defineProperty(C,"computeJkt",{enumerable:!0,get:function(){return b8.computeJkt}});Object.defineProperty(C,"generateAgentKey",{enumerable:!0,get:function(){return b8.generateAgentKey}});Object.defineProperty(C,"agentKeyFromSeed",{enumerable:!0,get:function(){return b8.agentKeyFromSeed}});Object.defineProperty(C,"generateAnchorKey",{enumerable:!0,get:function(){return b8.generateAnchorKey}});Object.defineProperty(C,"anchorKeyFromSeed",{enumerable:!0,get:function(){return b8.anchorKeyFromSeed}});Object.defineProperty(C,"buildJwks",{enumerable:!0,get:function(){return b8.buildJwks}});var x1t=cPe();Object.defineProperty(C,"eip712DigestBase64Url",{enumerable:!0,get:function(){return x1t.eip712DigestBase64Url}});Object.defineProperty(C,"verifyEip712TypedDataSignature",{enumerable:!0,get:function(){return x1t.verifyEip712TypedDataSignature}});var Jln=Sft();Object.defineProperty(C,"turnkeyOwnerIdentityKey",{enumerable:!0,get:function(){return Jln.turnkeyOwnerIdentityKey}});var O1t=dPe();Object.defineProperty(C,"canonicalEvmProviderAddress",{enumerable:!0,get:function(){return O1t.canonicalEvmProviderAddress}});Object.defineProperty(C,"isCanonicalEvmProviderAddress",{enumerable:!0,get:function(){return O1t.isCanonicalEvmProviderAddress}});var E8=rB();Object.defineProperty(C,"TTL_REG_DAYS",{enumerable:!0,get:function(){return E8.TTL_REG_DAYS}});Object.defineProperty(C,"REGISTRATION_JWT_TYP",{enumerable:!0,get:function(){return E8.REGISTRATION_JWT_TYP}});Object.defineProperty(C,"derivePairwiseRef",{enumerable:!0,get:function(){return E8.derivePairwiseRef}});Object.defineProperty(C,"registrationHash",{enumerable:!0,get:function(){return E8.registrationHash}});Object.defineProperty(C,"issueRegistration",{enumerable:!0,get:function(){return E8.issueRegistration}});Object.defineProperty(C,"verifyRegistration",{enumerable:!0,get:function(){return E8.verifyRegistration}});var jI=j4e();Object.defineProperty(C,"TTL_FRESH_HOURS",{enumerable:!0,get:function(){return jI.TTL_FRESH_HOURS}});Object.defineProperty(C,"MAX_TTL_FRESH_HOURS",{enumerable:!0,get:function(){return jI.MAX_TTL_FRESH_HOURS}});Object.defineProperty(C,"FRESHNESS_JWT_TYP",{enumerable:!0,get:function(){return jI.FRESHNESS_JWT_TYP}});Object.defineProperty(C,"issueFreshness",{enumerable:!0,get:function(){return jI.issueFreshness}});Object.defineProperty(C,"verifyFreshness",{enumerable:!0,get:function(){return jI.verifyFreshness}});Object.defineProperty(C,"FreshnessService",{enumerable:!0,get:function(){return jI.FreshnessService}});Object.defineProperty(C,"InMemoryFreshnessStore",{enumerable:!0,get:function(){return jI.InMemoryFreshnessStore}});var R1t=q4e();Object.defineProperty(C,"DEFAULT_MAX_STALENESS_SECONDS",{enumerable:!0,get:function(){return R1t.DEFAULT_MAX_STALENESS_SECONDS}});Object.defineProperty(C,"verifyBindingChain",{enumerable:!0,get:function(){return R1t.verifyBindingChain}});var Xln=Lht();Object.defineProperty(C,"evaluateEconomic",{enumerable:!0,get:function(){return Xln.evaluateEconomic}});var Hy=uOe();Object.defineProperty(C,"PRODUCT_SPEND_POLICY_VERSION",{enumerable:!0,get:function(){return Hy.PRODUCT_SPEND_POLICY_VERSION}});Object.defineProperty(C,"canonicalMerchantOriginPattern",{enumerable:!0,get:function(){return Hy.canonicalMerchantOriginPattern}});Object.defineProperty(C,"canonicalMerchantPathPrefix",{enumerable:!0,get:function(){return Hy.canonicalMerchantPathPrefix}});Object.defineProperty(C,"canonicalMerchantTarget",{enumerable:!0,get:function(){return Hy.canonicalMerchantTarget}});Object.defineProperty(C,"canonicalOwnerProductSpendPolicy",{enumerable:!0,get:function(){return Hy.canonicalOwnerProductSpendPolicy}});Object.defineProperty(C,"canonicalRuntimeProductSpendAttenuation",{enumerable:!0,get:function(){return Hy.canonicalRuntimeProductSpendAttenuation}});Object.defineProperty(C,"evaluateProductSpendPolicy",{enumerable:!0,get:function(){return Hy.evaluateProductSpendPolicy}});Object.defineProperty(C,"isProductSpendPolicySubset",{enumerable:!0,get:function(){return Hy.isProductSpendPolicySubset}});Object.defineProperty(C,"productSpendPolicyHash",{enumerable:!0,get:function(){return Hy.productSpendPolicyHash}});var N1t=rgt();Object.defineProperty(C,"canonicalLegacyWalletSpendPolicy",{enumerable:!0,get:function(){return N1t.canonicalLegacyWalletSpendPolicy}});Object.defineProperty(C,"importLegacyWalletSpendPolicy",{enumerable:!0,get:function(){return N1t.importLegacyWalletSpendPolicy}});var Vy=Dy();Object.defineProperty(C,"POP_JWT_TYP",{enumerable:!0,get:function(){return Vy.POP_JWT_TYP}});Object.defineProperty(C,"UNIVERSAL_AGENT_OPERATION_AUDIENCE",{enumerable:!0,get:function(){return Vy.UNIVERSAL_AGENT_OPERATION_AUDIENCE}});Object.defineProperty(C,"DEFAULT_POP_MAX_AGE_SEC",{enumerable:!0,get:function(){return Vy.DEFAULT_POP_MAX_AGE_SEC}});Object.defineProperty(C,"randomPopNonce",{enumerable:!0,get:function(){return Vy.randomPopNonce}});Object.defineProperty(C,"createPopProof",{enumerable:!0,get:function(){return Vy.createPopProof}});Object.defineProperty(C,"createPopProofWithSigner",{enumerable:!0,get:function(){return Vy.createPopProofWithSigner}});Object.defineProperty(C,"createAgentOperationPopProof",{enumerable:!0,get:function(){return Vy.createAgentOperationPopProof}});Object.defineProperty(C,"verifyPopProof",{enumerable:!0,get:function(){return Vy.verifyPopProof}});Object.defineProperty(C,"verifyAgentOperationPopProof",{enumerable:!0,get:function(){return Vy.verifyAgentOperationPopProof}});var bh=hOe();Object.defineProperty(C,"RUNTIME_CERTIFICATE_TYP",{enumerable:!0,get:function(){return bh.RUNTIME_CERTIFICATE_TYP}});Object.defineProperty(C,"RUNTIME_CERTIFICATE_VERSION",{enumerable:!0,get:function(){return bh.RUNTIME_CERTIFICATE_VERSION}});Object.defineProperty(C,"RUNTIME_CERTIFICATE_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return bh.RUNTIME_CERTIFICATE_MAX_TTL_SECONDS}});Object.defineProperty(C,"CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return bh.CARD_RUNTIME_CERTIFICATE_MAX_TTL_SECONDS}});Object.defineProperty(C,"RUNTIME_CERTIFICATE_PURPOSES",{enumerable:!0,get:function(){return bh.RUNTIME_CERTIFICATE_PURPOSES}});Object.defineProperty(C,"HOSTED_RUNTIME_CERTIFICATE_PURPOSES",{enumerable:!0,get:function(){return bh.HOSTED_RUNTIME_CERTIFICATE_PURPOSES}});Object.defineProperty(C,"completeRuntimeCertificate",{enumerable:!0,get:function(){return bh.completeRuntimeCertificate}});Object.defineProperty(C,"issueRuntimeCertificate",{enumerable:!0,get:function(){return bh.issueRuntimeCertificate}});Object.defineProperty(C,"peekRuntimeCertificate",{enumerable:!0,get:function(){return bh.peekRuntimeCertificate}});Object.defineProperty(C,"prepareRuntimeCertificate",{enumerable:!0,get:function(){return bh.prepareRuntimeCertificate}});Object.defineProperty(C,"verifyRuntimeCertificate",{enumerable:!0,get:function(){return bh.verifyRuntimeCertificate}});var cu=ite();Object.defineProperty(C,"RUNTIME_DELEGATION_TYP",{enumerable:!0,get:function(){return cu.RUNTIME_DELEGATION_TYP}});Object.defineProperty(C,"RUNTIME_DELEGATION_VERSION",{enumerable:!0,get:function(){return cu.RUNTIME_DELEGATION_VERSION}});Object.defineProperty(C,"RUNTIME_DELEGATION_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return cu.RUNTIME_DELEGATION_MAX_TTL_SECONDS}});Object.defineProperty(C,"RUNTIME_LEASE_TYP",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_TYP}});Object.defineProperty(C,"RUNTIME_LEASE_VERSION",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_VERSION}});Object.defineProperty(C,"RUNTIME_LEASE_AUDIENCE",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_AUDIENCE}});Object.defineProperty(C,"RUNTIME_LEASE_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_MAX_TTL_SECONDS}});Object.defineProperty(C,"RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS",{enumerable:!0,get:function(){return cu.RUNTIME_AUTHORITY_CLOCK_SKEW_SECONDS}});Object.defineProperty(C,"RUNTIME_LEASE_PURPOSE",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_PURPOSE}});Object.defineProperty(C,"RUNTIME_LEASE_SIGNING_MODES",{enumerable:!0,get:function(){return cu.RUNTIME_LEASE_SIGNING_MODES}});Object.defineProperty(C,"prepareRuntimeDelegation",{enumerable:!0,get:function(){return cu.prepareRuntimeDelegation}});Object.defineProperty(C,"completeRuntimeDelegation",{enumerable:!0,get:function(){return cu.completeRuntimeDelegation}});Object.defineProperty(C,"issueRuntimeDelegation",{enumerable:!0,get:function(){return cu.issueRuntimeDelegation}});Object.defineProperty(C,"issueRuntimeLease",{enumerable:!0,get:function(){return cu.issueRuntimeLease}});Object.defineProperty(C,"verifyRuntimeDelegation",{enumerable:!0,get:function(){return cu.verifyRuntimeDelegation}});Object.defineProperty(C,"verifyRuntimeLeaseChain",{enumerable:!0,get:function(){return cu.verifyRuntimeLeaseChain}});var qI=Egt();Object.defineProperty(C,"RUNTIME_LEASE_REQUEST_VERSION",{enumerable:!0,get:function(){return qI.RUNTIME_LEASE_REQUEST_VERSION}});Object.defineProperty(C,"RUNTIME_LEASE_REQUEST_AUDIENCE",{enumerable:!0,get:function(){return qI.RUNTIME_LEASE_REQUEST_AUDIENCE}});Object.defineProperty(C,"RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS",{enumerable:!0,get:function(){return qI.RUNTIME_LEASE_REQUEST_MAX_AGE_SECONDS}});Object.defineProperty(C,"runtimeLeaseRequestIntentHash",{enumerable:!0,get:function(){return qI.runtimeLeaseRequestIntentHash}});Object.defineProperty(C,"createRuntimeLeaseRequestProof",{enumerable:!0,get:function(){return qI.createRuntimeLeaseRequestProof}});Object.defineProperty(C,"createRuntimeLeaseRequestProofWithSigner",{enumerable:!0,get:function(){return qI.createRuntimeLeaseRequestProofWithSigner}});Object.defineProperty(C,"verifyRuntimeLeaseRequestProof",{enumerable:!0,get:function(){return qI.verifyRuntimeLeaseRequestProof}});var zOe=Tgt();Object.defineProperty(C,"TAP_RUNTIME_SIGNATURE_DOMAIN",{enumerable:!0,get:function(){return zOe.TAP_RUNTIME_SIGNATURE_DOMAIN}});Object.defineProperty(C,"tapRuntimeSigningMessage",{enumerable:!0,get:function(){return zOe.tapRuntimeSigningMessage}});Object.defineProperty(C,"verifyTapRuntimeSignature",{enumerable:!0,get:function(){return zOe.verifyTapRuntimeSignature}});var Fy=kgt();Object.defineProperty(C,"WALLET_BINDING_TYP",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_TYP}});Object.defineProperty(C,"WALLET_BINDING_VERSION",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_VERSION}});Object.defineProperty(C,"WALLET_BINDING_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_MAX_TTL_SECONDS}});Object.defineProperty(C,"WALLET_BINDING_SIGNER_KIND",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_SIGNER_KIND}});Object.defineProperty(C,"WALLET_BINDING_DERIVATION_VERSION",{enumerable:!0,get:function(){return Fy.WALLET_BINDING_DERIVATION_VERSION}});Object.defineProperty(C,"prepareWalletBinding",{enumerable:!0,get:function(){return Fy.prepareWalletBinding}});Object.defineProperty(C,"completeWalletBinding",{enumerable:!0,get:function(){return Fy.completeWalletBinding}});Object.defineProperty(C,"issueWalletBinding",{enumerable:!0,get:function(){return Fy.issueWalletBinding}});Object.defineProperty(C,"verifyWalletBinding",{enumerable:!0,get:function(){return Fy.verifyWalletBinding}});var C1t=Dgt();Object.defineProperty(C,"INTENT_HASH_VERSION",{enumerable:!0,get:function(){return C1t.INTENT_HASH_VERSION}});Object.defineProperty(C,"canonicalIntentHash",{enumerable:!0,get:function(){return C1t.canonicalIntentHash}});var Vf=$4e();Object.defineProperty(C,"OWNERSHIP_CHALLENGE_DOMAIN_V1",{enumerable:!0,get:function(){return Vf.OWNERSHIP_CHALLENGE_DOMAIN_V1}});Object.defineProperty(C,"OWNERSHIP_PROOF_JWT_TYP",{enumerable:!0,get:function(){return Vf.OWNERSHIP_PROOF_JWT_TYP}});Object.defineProperty(C,"TTL_OWNERSHIP_HOURS",{enumerable:!0,get:function(){return Vf.TTL_OWNERSHIP_HOURS}});Object.defineProperty(C,"MAX_TTL_OWNERSHIP_HOURS",{enumerable:!0,get:function(){return Vf.MAX_TTL_OWNERSHIP_HOURS}});Object.defineProperty(C,"CHALLENGE_MAX_AGE_SEC",{enumerable:!0,get:function(){return Vf.CHALLENGE_MAX_AGE_SEC}});Object.defineProperty(C,"buildOwnershipChallenge",{enumerable:!0,get:function(){return Vf.buildOwnershipChallenge}});Object.defineProperty(C,"verifyOwnershipSignature",{enumerable:!0,get:function(){return Vf.verifyOwnershipSignature}});Object.defineProperty(C,"issueOwnershipProof",{enumerable:!0,get:function(){return Vf.issueOwnershipProof}});Object.defineProperty(C,"issueOwnershipProofWithSigner",{enumerable:!0,get:function(){return Vf.issueOwnershipProofWithSigner}});Object.defineProperty(C,"attestWalletOwnership",{enumerable:!0,get:function(){return Vf.attestWalletOwnership}});Object.defineProperty(C,"verifyOwnershipProof",{enumerable:!0,get:function(){return Vf.verifyOwnershipProof}});Object.defineProperty(C,"walletVerifiedFromProof",{enumerable:!0,get:function(){return Vf.walletVerifiedFromProof}});var hB=Lv();Object.defineProperty(C,"signJwtWithSigner",{enumerable:!0,get:function(){return hB.signJwtWithSigner}});Object.defineProperty(C,"LocalSigner",{enumerable:!0,get:function(){return hB.LocalSigner}});Object.defineProperty(C,"signerFromAnchorKey",{enumerable:!0,get:function(){return hB.signerFromAnchorKey}});Object.defineProperty(C,"signerFromSignFn",{enumerable:!0,get:function(){return hB.signerFromSignFn}});Object.defineProperty(C,"issueRegistrationWithSigner",{enumerable:!0,get:function(){return hB.issueRegistrationWithSigner}});var HI=Vgt();Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_JWT_TYP",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_JWT_TYP}});Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_ISSUER",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_ISSUER}});Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_AUDIENCE",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_AUDIENCE}});Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_POLICY_ID",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_POLICY_ID}});Object.defineProperty(C,"WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS",{enumerable:!0,get:function(){return HI.WALLET_AUTHORIZATION_PERMIT_MAX_TTL_SECONDS}});Object.defineProperty(C,"issueWalletAuthorizationPermit",{enumerable:!0,get:function(){return HI.issueWalletAuthorizationPermit}});Object.defineProperty(C,"verifyWalletAuthorizationPermit",{enumerable:!0,get:function(){return HI.verifyWalletAuthorizationPermit}});var Kv=zgt();Object.defineProperty(C,"SUCCESSION_JWT_TYP",{enumerable:!0,get:function(){return Kv.SUCCESSION_JWT_TYP}});Object.defineProperty(C,"KILL_SWITCH_JWT_TYP",{enumerable:!0,get:function(){return Kv.KILL_SWITCH_JWT_TYP}});Object.defineProperty(C,"issueSuccession",{enumerable:!0,get:function(){return Kv.issueSuccession}});Object.defineProperty(C,"verifySuccession",{enumerable:!0,get:function(){return Kv.verifySuccession}});Object.defineProperty(C,"issueKillSwitch",{enumerable:!0,get:function(){return Kv.issueKillSwitch}});Object.defineProperty(C,"verifyKillSwitch",{enumerable:!0,get:function(){return Kv.verifyKillSwitch}});Object.defineProperty(C,"attestationIsVoid",{enumerable:!0,get:function(){return Kv.attestationIsVoid}});Object.defineProperty(C,"KillList",{enumerable:!0,get:function(){return Kv.KillList}});var VI=Jgt();Object.defineProperty(C,"GRANT_JWT_TYP",{enumerable:!0,get:function(){return VI.GRANT_JWT_TYP}});Object.defineProperty(C,"TTL_GRANT_DAYS",{enumerable:!0,get:function(){return VI.TTL_GRANT_DAYS}});Object.defineProperty(C,"MAX_TTL_GRANT_DAYS",{enumerable:!0,get:function(){return VI.MAX_TTL_GRANT_DAYS}});Object.defineProperty(C,"GRANT_RAILS",{enumerable:!0,get:function(){return VI.GRANT_RAILS}});Object.defineProperty(C,"issueGrant",{enumerable:!0,get:function(){return VI.issueGrant}});Object.defineProperty(C,"issueGrantWithSigner",{enumerable:!0,get:function(){return VI.issueGrantWithSigner}});Object.defineProperty(C,"verifyGrant",{enumerable:!0,get:function(){return VI.verifyGrant}});var Nt=Zgt();Object.defineProperty(C,"AGENT_PAIRING_PROTOCOL_VERSION",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_PROTOCOL_VERSION}});Object.defineProperty(C,"AGENT_PAIRING_PROTOCOL_VERSION_V2",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_PROTOCOL_VERSION_V2}});Object.defineProperty(C,"AGENT_PAIRING_TTL_SECONDS",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_TTL_SECONDS}});Object.defineProperty(C,"AGENT_PAIRING_CODE_ALPHABET",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_CODE_ALPHABET}});Object.defineProperty(C,"AGENT_PAIRING_CODE_LENGTH",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_CODE_LENGTH}});Object.defineProperty(C,"AGENT_PAIRING_STATES",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_STATES}});Object.defineProperty(C,"AGENT_PAIRING_TERMINAL_STATES",{enumerable:!0,get:function(){return Nt.AGENT_PAIRING_TERMINAL_STATES}});Object.defineProperty(C,"isAgentPairingState",{enumerable:!0,get:function(){return Nt.isAgentPairingState}});Object.defineProperty(C,"canTransitionAgentPairing",{enumerable:!0,get:function(){return Nt.canTransitionAgentPairing}});Object.defineProperty(C,"assertAgentPairingTransition",{enumerable:!0,get:function(){return Nt.assertAgentPairingTransition}});Object.defineProperty(C,"randomPairingId",{enumerable:!0,get:function(){return Nt.randomPairingId}});Object.defineProperty(C,"randomAttachId",{enumerable:!0,get:function(){return Nt.randomAttachId}});Object.defineProperty(C,"randomHandoffId",{enumerable:!0,get:function(){return Nt.randomHandoffId}});Object.defineProperty(C,"randomSetupOperationId",{enumerable:!0,get:function(){return Nt.randomSetupOperationId}});Object.defineProperty(C,"randomPairingVerifier",{enumerable:!0,get:function(){return Nt.randomPairingVerifier}});Object.defineProperty(C,"pairingVerifierChallenge",{enumerable:!0,get:function(){return Nt.pairingVerifierChallenge}});Object.defineProperty(C,"randomPairingCode",{enumerable:!0,get:function(){return Nt.randomPairingCode}});Object.defineProperty(C,"normalizePairingCode",{enumerable:!0,get:function(){return Nt.normalizePairingCode}});Object.defineProperty(C,"formatPairingCode",{enumerable:!0,get:function(){return Nt.formatPairingCode}});Object.defineProperty(C,"isValidPairingCode",{enumerable:!0,get:function(){return Nt.isValidPairingCode}});Object.defineProperty(C,"pairingCodeHash",{enumerable:!0,get:function(){return Nt.pairingCodeHash}});Object.defineProperty(C,"randomPairingClaimToken",{enumerable:!0,get:function(){return Nt.randomPairingClaimToken}});Object.defineProperty(C,"pairingClaimTokenHash",{enumerable:!0,get:function(){return Nt.pairingClaimTokenHash}});Object.defineProperty(C,"pairingCodeFromClaimToken",{enumerable:!0,get:function(){return Nt.pairingCodeFromClaimToken}});Object.defineProperty(C,"pairingConfirmationCode",{enumerable:!0,get:function(){return Nt.pairingConfirmationCode}});Object.defineProperty(C,"setupConfirmationCode",{enumerable:!0,get:function(){return Nt.setupConfirmationCode}});Object.defineProperty(C,"canonicalPairingTerms",{enumerable:!0,get:function(){return Nt.canonicalPairingTerms}});Object.defineProperty(C,"canonicalPairingTermsV2",{enumerable:!0,get:function(){return Nt.canonicalPairingTermsV2}});Object.defineProperty(C,"pairingTermsHash",{enumerable:!0,get:function(){return Nt.pairingTermsHash}});Object.defineProperty(C,"pairingTermsV2Hash",{enumerable:!0,get:function(){return Nt.pairingTermsV2Hash}});Object.defineProperty(C,"pairingClaimMessage",{enumerable:!0,get:function(){return Nt.pairingClaimMessage}});Object.defineProperty(C,"pairingClaimMessageV2",{enumerable:!0,get:function(){return Nt.pairingClaimMessageV2}});Object.defineProperty(C,"pairingClaimHashV2",{enumerable:!0,get:function(){return Nt.pairingClaimHashV2}});Object.defineProperty(C,"pairingActivationMessage",{enumerable:!0,get:function(){return Nt.pairingActivationMessage}});Object.defineProperty(C,"pairingActivationMessageV2",{enumerable:!0,get:function(){return Nt.pairingActivationMessageV2}});Object.defineProperty(C,"AGENT_CAPABILITY_ATTACH_CAPABILITIES",{enumerable:!0,get:function(){return Nt.AGENT_CAPABILITY_ATTACH_CAPABILITIES}});Object.defineProperty(C,"AGENT_HANDOFF_AUTHORITIES",{enumerable:!0,get:function(){return Nt.AGENT_HANDOFF_AUTHORITIES}});Object.defineProperty(C,"AGENT_HANDOFF_COMPOUND_AUTHORITY",{enumerable:!0,get:function(){return Nt.AGENT_HANDOFF_COMPOUND_AUTHORITY}});Object.defineProperty(C,"handoffAuthorityCapabilities",{enumerable:!0,get:function(){return Nt.handoffAuthorityCapabilities}});Object.defineProperty(C,"capabilityAttachClaimMessageV2",{enumerable:!0,get:function(){return Nt.capabilityAttachClaimMessageV2}});Object.defineProperty(C,"capabilityAttachClaimHashV2",{enumerable:!0,get:function(){return Nt.capabilityAttachClaimHashV2}});Object.defineProperty(C,"capabilityAttachActivationMessageV2",{enumerable:!0,get:function(){return Nt.capabilityAttachActivationMessageV2}});Object.defineProperty(C,"keyRotationClaimMessageV2",{enumerable:!0,get:function(){return Nt.keyRotationClaimMessageV2}});Object.defineProperty(C,"keyRotationClaimHashV2",{enumerable:!0,get:function(){return Nt.keyRotationClaimHashV2}});Object.defineProperty(C,"agentMailCredentialClaimMessageV2",{enumerable:!0,get:function(){return Nt.agentMailCredentialClaimMessageV2}});Object.defineProperty(C,"pairingArtifactHash",{enumerable:!0,get:function(){return Nt.pairingArtifactHash}});Object.defineProperty(C,"canonicalPairingDeliveryArtifactV2",{enumerable:!0,get:function(){return Nt.canonicalPairingDeliveryArtifactV2}});Object.defineProperty(C,"pairingDeliveryArtifactV2Hash",{enumerable:!0,get:function(){return Nt.pairingDeliveryArtifactV2Hash}});Object.defineProperty(C,"pairingInstrumentCommitment",{enumerable:!0,get:function(){return Nt.pairingInstrumentCommitment}});Object.defineProperty(C,"sha256",{enumerable:!0,get:function(){return Nt.sha256}});var Rn=dD();Object.defineProperty(C,"AGENT_AUTHORITY_VERSION",{enumerable:!0,get:function(){return Rn.AGENT_AUTHORITY_VERSION}});Object.defineProperty(C,"AGENT_BUDGET_EPOCH_MODES",{enumerable:!0,get:function(){return Rn.AGENT_BUDGET_EPOCH_MODES}});Object.defineProperty(C,"AGENT_AUTHORITY_VALUATION_POLICY",{enumerable:!0,get:function(){return Rn.AGENT_AUTHORITY_VALUATION_POLICY}});Object.defineProperty(C,"AGENT_AUTHORIZATION_SCOPES",{enumerable:!0,get:function(){return Rn.AGENT_AUTHORIZATION_SCOPES}});Object.defineProperty(C,"AGENT_EXECUTION_READINESS_REASONS",{enumerable:!0,get:function(){return Rn.AGENT_EXECUTION_READINESS_REASONS}});Object.defineProperty(C,"AGENT_CHANNEL_KINDS",{enumerable:!0,get:function(){return Rn.AGENT_CHANNEL_KINDS}});Object.defineProperty(C,"AGENT_CHANNEL_ASSURANCES",{enumerable:!0,get:function(){return Rn.AGENT_CHANNEL_ASSURANCES}});Object.defineProperty(C,"AGENT_CHANNEL_STATUSES",{enumerable:!0,get:function(){return Rn.AGENT_CHANNEL_STATUSES}});Object.defineProperty(C,"AGENT_KEY_CUSTODIES",{enumerable:!0,get:function(){return Rn.AGENT_KEY_CUSTODIES}});Object.defineProperty(C,"AGENT_KEY_PURPOSES",{enumerable:!0,get:function(){return Rn.AGENT_KEY_PURPOSES}});Object.defineProperty(C,"AGENT_KEY_STATUSES",{enumerable:!0,get:function(){return Rn.AGENT_KEY_STATUSES}});Object.defineProperty(C,"USD_MICROS_PER_CENT",{enumerable:!0,get:function(){return Rn.USD_MICROS_PER_CENT}});Object.defineProperty(C,"VIC_PROCESSOR_ACTIONS",{enumerable:!0,get:function(){return Rn.VIC_PROCESSOR_ACTIONS}});Object.defineProperty(C,"VIC_SETTLEMENT_ENVELOPE_KIND",{enumerable:!0,get:function(){return Rn.VIC_SETTLEMENT_ENVELOPE_KIND}});Object.defineProperty(C,"VIC_SETTLEMENT_ENVELOPE_VERSION",{enumerable:!0,get:function(){return Rn.VIC_SETTLEMENT_ENVELOPE_VERSION}});Object.defineProperty(C,"authorizationScopeFacts",{enumerable:!0,get:function(){return Rn.authorizationScopeFacts}});Object.defineProperty(C,"canonicalAgentAuthorityGrant",{enumerable:!0,get:function(){return Rn.canonicalAgentAuthorityGrant}});Object.defineProperty(C,"canonicalAgentChannelDescriptor",{enumerable:!0,get:function(){return Rn.canonicalAgentChannelDescriptor}});Object.defineProperty(C,"canonicalAgentKeyDescriptor",{enumerable:!0,get:function(){return Rn.canonicalAgentKeyDescriptor}});Object.defineProperty(C,"canonicalSpendAuthorizationIntent",{enumerable:!0,get:function(){return Rn.canonicalSpendAuthorizationIntent}});Object.defineProperty(C,"canonicalVicSettlementEnvelope",{enumerable:!0,get:function(){return Rn.canonicalVicSettlementEnvelope}});Object.defineProperty(C,"centsToUsdMicros",{enumerable:!0,get:function(){return Rn.centsToUsdMicros}});Object.defineProperty(C,"isCanonicalBase64Url32",{enumerable:!0,get:function(){return Rn.isCanonicalBase64Url32}});Object.defineProperty(C,"agentAuthorityGrantHash",{enumerable:!0,get:function(){return Rn.agentAuthorityGrantHash}});Object.defineProperty(C,"spendAuthorizationIntentHash",{enumerable:!0,get:function(){return Rn.spendAuthorizationIntentHash}});Object.defineProperty(C,"walletAuthorizationRequestHash",{enumerable:!0,get:function(){return Rn.walletAuthorizationRequestHash}});Object.defineProperty(C,"usdcAtomicToUsdMicros",{enumerable:!0,get:function(){return Rn.usdcAtomicToUsdMicros}});Object.defineProperty(C,"vicSettlementEnvelopeHash",{enumerable:!0,get:function(){return Rn.vicSettlementEnvelopeHash}});var Zln=Qgt();Object.defineProperty(C,"prepareIdentityPresenceDelegation",{enumerable:!0,get:function(){return Zln.prepareIdentityPresenceDelegation}});var $y=DOe();Object.defineProperty(C,"IDENTITY_PRESENCE_LEASE_AUDIENCE",{enumerable:!0,get:function(){return $y.IDENTITY_PRESENCE_LEASE_AUDIENCE}});Object.defineProperty(C,"IDENTITY_PRESENCE_PURPOSE",{enumerable:!0,get:function(){return $y.IDENTITY_PRESENCE_PURPOSE}});Object.defineProperty(C,"IDENTITY_PRESENCE_SIGNING_MODE",{enumerable:!0,get:function(){return $y.IDENTITY_PRESENCE_SIGNING_MODE}});Object.defineProperty(C,"HOSTED_CONNECTOR_PROOF_TYP",{enumerable:!0,get:function(){return $y.HOSTED_CONNECTOR_PROOF_TYP}});Object.defineProperty(C,"HOSTED_CONNECTOR_PROOF_TTL_SECONDS",{enumerable:!0,get:function(){return $y.HOSTED_CONNECTOR_PROOF_TTL_SECONDS}});Object.defineProperty(C,"issueHostedConnectorProof",{enumerable:!0,get:function(){return $y.issueHostedConnectorProof}});Object.defineProperty(C,"issueIdentityPresenceLease",{enumerable:!0,get:function(){return $y.issueIdentityPresenceLease}});Object.defineProperty(C,"verifyHostedConnectorProof",{enumerable:!0,get:function(){return $y.verifyHostedConnectorProof}});Object.defineProperty(C,"verifyIdentityPresenceLeaseChain",{enumerable:!0,get:function(){return $y.verifyIdentityPresenceLeaseChain}});var wg=jOe();Object.defineProperty(C,"IDENTITY_TAP_PROFILE",{enumerable:!0,get:function(){return wg.IDENTITY_TAP_PROFILE}});Object.defineProperty(C,"IDENTITY_TAP_PURPOSE",{enumerable:!0,get:function(){return wg.IDENTITY_TAP_PURPOSE}});Object.defineProperty(C,"IDENTITY_TAP_LEASE_AUDIENCE",{enumerable:!0,get:function(){return wg.IDENTITY_TAP_LEASE_AUDIENCE}});Object.defineProperty(C,"IDENTITY_TAP_LEASE_REQUEST_AUDIENCE",{enumerable:!0,get:function(){return wg.IDENTITY_TAP_LEASE_REQUEST_AUDIENCE}});Object.defineProperty(C,"prepareIdentityTapDelegation",{enumerable:!0,get:function(){return wg.prepareIdentityTapDelegation}});Object.defineProperty(C,"verifyIdentityTapDelegation",{enumerable:!0,get:function(){return wg.verifyIdentityTapDelegation}});Object.defineProperty(C,"issueIdentityTapLease",{enumerable:!0,get:function(){return wg.issueIdentityTapLease}});Object.defineProperty(C,"identityTapLeaseRequestIntentHash",{enumerable:!0,get:function(){return wg.identityTapLeaseRequestIntentHash}});Object.defineProperty(C,"createIdentityTapLeaseRequestProof",{enumerable:!0,get:function(){return wg.createIdentityTapLeaseRequestProof}});Object.defineProperty(C,"verifyIdentityTapLeaseRequestProof",{enumerable:!0,get:function(){return wg.verifyIdentityTapLeaseRequestProof}});var gB=m1t();Object.defineProperty(C,"identityDeviceEnrollmentPreimage",{enumerable:!0,get:function(){return gB.identityDeviceEnrollmentPreimage}});Object.defineProperty(C,"prepareIdentityDeviceGateAuthorization",{enumerable:!0,get:function(){return gB.prepareIdentityDeviceGateAuthorization}});Object.defineProperty(C,"prepareIdentityHostedGateAuthorization",{enumerable:!0,get:function(){return gB.prepareIdentityHostedGateAuthorization}});Object.defineProperty(C,"IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES",{enumerable:!0,get:function(){return gB.IDENTITY_HOSTED_GATE_AUTHORIZATION_PURPOSES}});Object.defineProperty(C,"verifyIdentityDeviceEnrollmentProof",{enumerable:!0,get:function(){return gB.verifyIdentityDeviceEnrollmentProof}});var GOe=_1t();Object.defineProperty(C,"IDENTITY_TAP_SLIP_REQUEST_TYP",{enumerable:!0,get:function(){return GOe.IDENTITY_TAP_SLIP_REQUEST_TYP}});Object.defineProperty(C,"validateIdentityTapSlipRequest",{enumerable:!0,get:function(){return GOe.validateIdentityTapSlipRequest}});Object.defineProperty(C,"issueIdentityTapSlip",{enumerable:!0,get:function(){return GOe.issueIdentityTapSlip}});var _B=FOe();Object.defineProperty(C,"IDENTITY_PRESENCE_SLIP_PURPOSE",{enumerable:!0,get:function(){return _B.IDENTITY_PRESENCE_SLIP_PURPOSE}});Object.defineProperty(C,"IDENTITY_HOSTED_TAP_SLIP_PURPOSE",{enumerable:!0,get:function(){return _B.IDENTITY_HOSTED_TAP_SLIP_PURPOSE}});Object.defineProperty(C,"issueHostedPresenceIdentitySlip",{enumerable:!0,get:function(){return _B.issueHostedPresenceIdentitySlip}});Object.defineProperty(C,"issueHostedTapIdentitySlip",{enumerable:!0,get:function(){return _B.issueHostedTapIdentitySlip}});Object.defineProperty(C,"hostedPresenceAttemptId",{enumerable:!0,get:function(){return _B.hostedPresenceAttemptId}});var pte=T1t();Object.defineProperty(C,"IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP",{enumerable:!0,get:function(){return pte.IDENTITY_HOSTED_TAP_SLIP_REQUEST_TYP}});Object.defineProperty(C,"validateIdentityHostedTapSlipRequest",{enumerable:!0,get:function(){return pte.validateIdentityHostedTapSlipRequest}});Object.defineProperty(C,"issueHostedTapSlipFromTicket",{enumerable:!0,get:function(){return pte.issueHostedTapSlipFromTicket}});Object.defineProperty(C,"hostedTapPayloadNamesMerchantRequest",{enumerable:!0,get:function(){return pte.hostedTapPayloadNamesMerchantRequest}});var KOe=lte();Object.defineProperty(C,"identityTapSigningBytes",{enumerable:!0,get:function(){return KOe.identityTapSigningBytes}});Object.defineProperty(C,"identityTapPayloadSha256",{enumerable:!0,get:function(){return KOe.identityTapPayloadSha256}});Object.defineProperty(C,"parseIdentityTapSignatureBase",{enumerable:!0,get:function(){return KOe.parseIdentityTapSignatureBase}});var fte=P1t();Object.defineProperty(C,"IDENTITY_DEVICE_HANDOFF_AUDIENCE",{enumerable:!0,get:function(){return fte.IDENTITY_DEVICE_HANDOFF_AUDIENCE}});Object.defineProperty(C,"identityDeviceProposalSha256",{enumerable:!0,get:function(){return fte.identityDeviceProposalSha256}});Object.defineProperty(C,"identityDeviceHandoffIntentHash",{enumerable:!0,get:function(){return fte.identityDeviceHandoffIntentHash}});Object.defineProperty(C,"verifyIdentityDeviceHandoffProof",{enumerable:!0,get:function(){return fte.verifyIdentityDeviceHandoffProof}})});var m_t=_((wNi,f_t)=>{"use strict";var Qln=Object.create,Ste=Object.defineProperty,epn=Object.getOwnPropertyDescriptor,$1t=Object.getOwnPropertyNames,tpn=Object.getPrototypeOf,rpn=Object.prototype.hasOwnProperty,npn=(e,t)=>function(){try{return t||(0,e[$1t(e)[0]])((t={exports:{}}).exports,t),t.exports}catch(n){throw t=0,n}},ipn=(e,t)=>{for(var r in t)Ste(e,r,{get:t[r],enumerable:!0})},z1t=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of $1t(t))!rpn.call(e,i)&&i!==r&&Ste(e,i,{get:()=>t[i],enumerable:!(n=epn(t,i))||n.enumerable});return e},opn=(e,t,r)=>(r=e!=null?Qln(tpn(e)):{},z1t(t||!e||!e.__esModule?Ste(r,"default",{value:e,enumerable:!0}):r,e)),spn=e=>z1t(Ste({},"__esModule",{value:!0}),e),apn=npn({"../shared/dist/canonical-contract.js"(e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.CANONICAL_OPAQUE_ID_MAX_BYTES=e.CANONICAL_OPAQUE_ID_RE=e.CANONICAL_OPAQUE_ID_PATTERN=void 0,e.utf8ByteLength=n,e.isCanonicalText=i,e.compareCanonicalKeys=o,e.isCanonicalOpaqueId=s,e.assertCanonicalOpaqueId=a,e.CANONICAL_OPAQUE_ID_PATTERN="^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",e.CANONICAL_OPAQUE_ID_RE=new RegExp(e.CANONICAL_OPAQUE_ID_PATTERN),e.CANONICAL_OPAQUE_ID_MAX_BYTES=128;var t=/[\u0000-\u001f\u007f\u2028\u2029]/,r=new TextEncoder;function n(c){return r.encode(c).length}function i(c,u){return typeof c=="string"&&c.length>0&&n(c)<=u&&c.trim()===c&&c.normalize("NFC")===c&&!t.test(c)}function o(c,u){let d=r.encode(c),l=r.encode(u),p=Math.min(d.length,l.length);for(let f=0;f<p;f+=1)if(d[f]!==l[f])return d[f]-l[f];return d.length-l.length}function s(c){return typeof c=="string"&&n(c)<=e.CANONICAL_OPAQUE_ID_MAX_BYTES&&e.CANONICAL_OPAQUE_ID_RE.test(c)}function a(c,u="value"){if(!s(c))throw new Error(`${u} must be a canonical opaque id (max 128 ASCII bytes)`)}}}),G1t={};ipn(G1t,{AGENT_AUTHORITY_VALUATION_POLICY:()=>yte,AGENT_AUTHORITY_VERSION:()=>bB,AGENT_AUTHORIZATION_SCOPES:()=>oRe,AGENT_BUDGET_EPOCH_MODES:()=>Q1t,AGENT_CHANNEL_ASSURANCES:()=>s_t,AGENT_CHANNEL_KINDS:()=>i_t,AGENT_CHANNEL_STATUSES:()=>o_t,AGENT_EXECUTION_READINESS_REASONS:()=>Upn,AGENT_KEY_CUSTODIES:()=>r_t,AGENT_KEY_PURPOSES:()=>t_t,AGENT_KEY_STATUSES:()=>n_t,USD_MICROS_PER_CENT:()=>Ate,VIC_PROCESSOR_ACTIONS:()=>e_t,VIC_SETTLEMENT_ENVELOPE_KIND:()=>_te,VIC_SETTLEMENT_ENVELOPE_VERSION:()=>gte,agentAuthorityGrantHash:()=>Zpn,authorizationScopeFacts:()=>Wpn,canonicalAgentAuthorityGrant:()=>d_t,canonicalAgentChannelDescriptor:()=>Xpn,canonicalAgentKeyDescriptor:()=>Ypn,canonicalSpendAuthorizationIntent:()=>sRe,canonicalVicSettlementEnvelope:()=>l_t,centsToUsdMicros:()=>Gpn,isCanonicalBase64Url32:()=>Qv,spendAuthorizationIntentHash:()=>p_t,usdcAtomicToUsdMicros:()=>Kpn,vicSettlementEnvelopeHash:()=>Qpn,walletAuthorizationRequestHash:()=>efn});f_t.exports=spn(G1t);var cpn=e=>e/2**32|0,upn=e=>e>>>0;function dpn(e,t,r,n){let i=cpn(r),o=upn(r);e.setUint32(t,n?o:i,n),e.setUint32(t+4,n?i:o,n)}function M1t(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in e&&e.BYTES_PER_ELEMENT===1}var JOe=e=>e?`"${e}" `:"";function lpn(e,t=""){if(typeof e!="number")throw new TypeError(JOe(t)+"expected number, got "+typeof e);if(!Number.isSafeInteger(e)||e<0)throw new RangeError(JOe(t)+"expected integer >= 0, got "+e);return e}function K1t(e,t,r=""){if(M1t(e)&&(t===void 0||e.length===t))return e;t!==void 0&&lpn(t,"length");let n=M1t(e),i=t!==void 0?` of length ${t}`:"",o=n?`length=${e.length}`:`type=${typeof e}`,s=JOe(r)+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)}var ppn=(e,t)=>{if(e===null||typeof e!="object"||Array.isArray(e))throw new TypeError((t==="object"?"":`"${t}" `)+"expected object, got type="+typeof e)},k1t=(e,t)=>{ppn(e,t);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${t}" expected plain object`);if(Object.hasOwn(e,"__proto__"))throw new TypeError(`"${t}.__proto__" is not allowed`)};function D1t(e,t=!0){if(e.destroyed)throw new Error("hash was destroyed");if(t&&e.finished)throw new Error("digest() was already called")}function fpn(e,t){K1t(e,void 0,"output");let r=t.outputLen;if(!(e.length>=r))throw new RangeError('"output" expected length >= '+r)}function L1t(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function WOe(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function Ig(e,t){return e<<32-t|e>>>t}function mpn(e,t,r="opts"){return k1t(e,"defaults"),t!==void 0&&k1t(t,r),Object.assign(Object.create(null),e,t)}function hpn(e,t={}){if(typeof e!="function")throw new TypeError('"hashCons" expected function, got type='+typeof e);t=mpn({},t,"info");let r=(i,o)=>e(o).update(i).digest(),n=e(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>e(i),Object.assign(r,t),Object.freeze(r)}var gpn=e=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,e])});function _pn(e,t,r){return e&t^~e&r}function ypn(e,t,r){return e&t^e&r^t&r}var bpn=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,t,r,n){this.blockLen=e,this.outputLen=t,this.padOffset=r,this.isLE=n,this.buffer=new Uint8Array(e),this.view=WOe(this.buffer)}update(e){D1t(this),K1t(e);let{view:t,buffer:r,blockLen:n}=this,i=e.length,o=!1;for(let s=0;s<i;){let a=Math.min(n-this.pos,i-s);if(a===n){let c=WOe(e);for(;n<=i-s;s+=n)this.process(c,s);o=!0;continue}r.set(s===0&&a===i?e:e.subarray(s,s+a),this.pos),this.pos+=a,s+=a,this.pos===n&&(this.process(t,0),this.pos=0,o=!0)}return this.length+=e.length,o&&this.roundClean(),this}digestInto(e){D1t(this),fpn(e,this),this.finished=!0;let{buffer:t,view:r,blockLen:n,isLE:i}=this,{pos:o}=this;t[o++]=128,t.fill(0,o),this.padOffset>n-o&&(this.process(r,0),t.fill(0)),dpn(r,n-8,this.length*8,i),this.process(r,0),this.roundClean();let s=e===t?r:WOe(e),a=this.outputLen,c=a/4,u=this.get();if(a%4||c>u.length)throw new Error("invalid outputLen");for(let d=0;d<c;d++)s.setUint32(4*d,u[d],i)}digest(){let{buffer:e,outputLen:t}=this;this.digestInto(e);let r=e.slice(0,t);return this.destroy(),r}_cloneIntoMeta(e){let{buffer:t,length:r,finished:n,destroyed:i,pos:o}=this;return e.destroyed=i,e.finished=n,e.length=r,e.pos=o,o&&e.buffer.set(t),e}clone(){return this._cloneInto()}},Epn=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),Spn=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Wv=new Uint32Array(64),vpn=class extends bpn{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,t){super(64,e,8,!1),this.A=t[0]|0,this.B=t[1]|0,this.C=t[2]|0,this.D=t[3]|0,this.E=t[4]|0,this.F=t[5]|0,this.G=t[6]|0,this.H=t[7]|0}get(){let{A:e,B:t,C:r,D:n,E:i,F:o,G:s,H:a}=this;return[e,t,r,n,i,o,s,a]}set(e,t,r,n,i,o,s,a){this.A=e|0,this.B=t|0,this.C=r|0,this.D=n|0,this.E=i|0,this.F=o|0,this.G=s|0,this.H=a|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,t){for(let d=0;d<16;d++,t+=4)Wv[d]=e.getUint32(t,!1);for(let d=16;d<64;d++){let l=Wv[d-15],p=Wv[d-2],f=Ig(l,7)^Ig(l,18)^l>>>3,m=Ig(p,17)^Ig(p,19)^p>>>10;Wv[d]=m+Wv[d-7]+f+Wv[d-16]|0}let{A:r,B:n,C:i,D:o,E:s,F:a,G:c,H:u}=this;for(let d=0;d<64;d++){let l=Ig(s,6)^Ig(s,11)^Ig(s,25),p=u+l+_pn(s,a,c)+Spn[d]+Wv[d]|0,m=(Ig(r,2)^Ig(r,13)^Ig(r,22))+ypn(r,n,i)|0;u=c,c=a,a=s,s=o+p|0,o=i,i=n,n=r,r=p+m|0}r=r+this.A|0,n=n+this.B|0,i=i+this.C|0,o=o+this.D|0,s=s+this.E|0,a=a+this.F|0,c=c+this.G|0,u=u+this.H|0,this.set(r,n,i,o,s,a,c,u)}roundClean(){L1t(Wv)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),L1t(this.buffer)}},Tpn=class extends vpn{constructor(){super(32,Epn)}},vte=hpn(()=>new Tpn,gpn(1)),W1t=opn(apn()),tRe=Object.freeze,S8=0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn,XOe=0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3edn,mte=0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3n,ZOe=0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an,QOe=0x6666666666666666666666666666666666666666666666666666666666666658n,hte=S8-1n,Apn=tRe({p:S8,n:XOe,h:8n,a:hte,d:mte,Gx:ZOe,Gy:QOe}),Y1t=32,U1t=e=>e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"&&e.BYTES_PER_ELEMENT===1,Tte=(e,t,r="")=>{if(U1t(e)&&(t===void 0||e.length===t))return e;let n=U1t(e),i=t!==void 0?` of length ${t}`:"",o=n?`length=${e.length}`:`type=${typeof e}`,s=(r?`"${r}" `:"")+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)},wpn=(e,t="",r)=>Uint8Array.from(Tte(e,r,t)),J1t=(e,t)=>e.toString(16).padStart(t,"0"),rRe=e=>{let t="";for(let r of Tte(e))t+=J1t(r,2);return t},nRe=e=>{let t="hex invalid";if(typeof e!="string")throw new TypeError(t);if(e.length%2||!/^[\da-f]*$/i.test(e))throw new RangeError(t);let r=new Uint8Array(e.length/2);for(let n=0,i=0;n<r.length;n++,i+=2){let o=e.charCodeAt(i),s=e.charCodeAt(i+1);r[n]=((o&15)+(o>>6)*9)*16+(s&15)+(s>>6)*9}return r},Ipn=(...e)=>{let t=0;for(let i of e)t+=Tte(i).length;let r=new Uint8Array(t),n=0;for(let i of e)r.set(i,n),n+=i.length;return r},Ppn=(e=Y1t)=>{let t=globalThis?.crypto;if(typeof t?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined, consider polyfill");return t.getRandomValues(new Uint8Array(e))},FI=(e,t,r,n="bad number: out of range")=>{if(typeof e!="bigint")throw new TypeError(n);if(t<=e&&e<r)return e;throw new RangeError(n)},Vi=(e,t=S8)=>(e%=t)>=0n?e:t+e,B1t=(1n<<255n)-1n,Ze=e=>{if(e<0n)throw new RangeError("negative coordinate");let t=(e>>255n)*19n+(e&B1t);return t=(t>>255n)*19n+(t&B1t),t%S8},X1t=(e,t)=>{if(e===0n)throw new Error("invert: expected non-zero number");if(t<=1n)throw new Error("invert: expected modulus > 1, got "+t);let r=Vi(e,t),n=t,i=0n,o=1n;for(;r!==0n;){let a=n/r,c=n-r*a,u=i-o*a;n=r,r=c,i=o,o=u}if(n!==1n)throw new Error("invert: does not exist");return Vi(i,t)},YOe=e=>{if(e instanceof SB)return e;throw new TypeError("Point expected")},Z1t=2n**256n,SB=class $I{static BASE;static ZERO;X;Y;Z;T;constructor(t,r,n,i){let o=Z1t;this.X=FI(t,0n,o),this.Y=FI(r,0n,o),this.Z=FI(n,1n,o),this.T=FI(i,0n,o),tRe(this)}static CURVE(){return Apn}static fromAffine(t){return new $I(t.x,t.y,1n,Ze(t.x*t.y))}static fromBytes(t,r=!1){let n=wpn(t,"point",Y1t),i=n[31];n[31]=i&-129;let o=Opn(n);r||FI(o,0n,S8);let s=Ze(o*o),a=Vi(s-1n),c=Ze(mte*s+1n),{isValid:u,value:d}=Npn(a,c);if(!u)throw new Error("bad point: y not sqrt");let l=!!(i&128);if(!r&&d===0n&&l)throw new Error("bad point: x==0, isLastByteOdd");return l!==!!(d&1n)&&(d=Vi(-d)),new $I(d,o,1n,Ze(d*o))}static fromHex(t,r){return $I.fromBytes(nRe(t),r)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}assertValidity(){let t=hte,r=mte,n=this;if(n.is0())throw new Error("bad point: ZERO");let{X:i,Y:o,Z:s,T:a}=n,c=Ze(i*i),u=Ze(o*o),d=Ze(s*s),l=Ze(d*d),p=Ze(c*t),f=Ze(d*(p+u)),m=Vi(l+Ze(r*Ze(c*u)));if(f!==m)throw new Error("bad point: equation left != right (1)");let h=Ze(i*o),g=Ze(s*a);if(h!==g)throw new Error("bad point: equation left != right (2)");return this}equals(t){let{X:r,Y:n,Z:i}=this,{X:o,Y:s,Z:a}=YOe(t);return Ze(r*a)===Ze(o*i)&&Ze(n*a)===Ze(s*i)}is0(){return this.equals(zI)}negate(){return new $I(Vi(-this.X),this.Y,this.Z,Vi(-this.T))}double(){let{X:t,Y:r,Z:n}=this,i=hte,o=Ze(t*t),s=Ze(r*r),a=Ze(2n*n*n),c=Ze(i*o),u=Vi(t+r),d=Vi(Ze(u*u)-o-s),l=Vi(c+s),p=Vi(l-a),f=Vi(c-s),m=Ze(d*p),h=Ze(l*f),g=Ze(d*f),y=Ze(p*l);return new $I(m,h,y,g)}add(t){let{X:r,Y:n,Z:i,T:o}=this,{X:s,Y:a,Z:c,T:u}=YOe(t),d=hte,l=mte,p=Ze(r*s),f=Ze(n*a),m=Ze(Ze(o*l)*u),h=Ze(i*c),g=Vi(Ze(Vi(r+n)*Vi(s+a))-p-f),y=Vi(h-m),S=Vi(h+m),b=Vi(f-Ze(d*p)),E=Ze(g*y),T=Ze(S*b),w=Ze(g*b),I=Ze(y*S);return new $I(E,T,I,w)}subtract(t){return this.add(YOe(t).negate())}multiply(t,r=!0){if(!r&&t===0n||(FI(t,1n,XOe),!r&&this.is0()))return zI;if(t===1n)return this;if(this.equals(yB))return Mpn(t).p;let n=zI,i=yB,o=this;for(let s=0;r?s<256:t>0n;s++)t&1n?n=n.add(o):r&&(i=i.add(o)),o=o.double(),t>>=1n;return n}multiplyUnsafe(t){return this.multiply(t,!1)}toAffine(){let{X:t,Y:r,Z:n}=this;if(this.equals(zI))return{x:0n,y:1n};let i=X1t(n,S8);if(Ze(n*i)!==1n)throw new Error("invalid inverse");return{x:Ze(t*i),y:Ze(r*i)}}toBytes(){let{x:t,y:r}=this.toAffine(),n=xpn(r);return n[31]|=t&1n?128:0,n}toHex(){return rRe(this.toBytes())}clearCofactor(){return this.multiply(8n,!1)}isSmallOrder(){return this.clearCofactor().is0()}isTorsionFree(){return this.multiply(XOe/2n,!1).double().add(this).is0()}},yB=new SB(ZOe,QOe,1n,Vi(ZOe*QOe)),zI=new SB(0n,1n,1n,0n);SB.BASE=yB;SB.ZERO=zI;var xpn=e=>nRe(J1t(FI(e,0n,Z1t),64)).reverse(),Opn=e=>BigInt("0x"+rRe(Uint8Array.from(Tte(e)).reverse())),Pg=(e,t)=>{let r=e;for(;t-- >0;)r=Ze(r*r);return r},Rpn=e=>{let t=Ze(e*e),r=Ze(t*e),n=Ze(Pg(r,2)*r),i=Ze(Pg(n,1)*e),o=Ze(Pg(i,5)*i),s=Ze(Pg(o,10)*o),a=Ze(Pg(s,20)*s),c=Ze(Pg(a,40)*a),u=Ze(Pg(c,80)*c),d=Ze(Pg(u,80)*c),l=Ze(Pg(d,10)*o);return Ze(Pg(l,2)*e)},j1t=0x2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0n,Npn=(e,t)=>{let r=Ze(t*Ze(t*t)),n=Ze(Ze(r*r)*t),i=Rpn(Ze(e*n)),o=Ze(e*Ze(r*i)),s=Ze(t*Ze(o*o)),a=o,c=Ze(o*j1t),u=s===e,d=s===Vi(-e),l=s===Vi(-e*j1t);return u&&(o=a),(d||l)&&(o=c),(Vi(o)&1n)===1n&&(o=Vi(-o)),{isValid:u||d,value:o}},iRe=tRe({bytesToHex:rRe,hexToBytes:nRe,concatBytes:Ipn,mod:Vi,invert:X1t,randomBytes:Ppn}),Cpn=()=>{let e=[],t=yB,r;for(let n=0;n<33;n++){r=t,e.push(r);for(let i=1;i<128;i++)r=r.add(t),e.push(r);t=r.double()}return e},q1t=void 0,H1t=(e,t)=>{let r=t.negate();return e?r:t},Mpn=e=>{let t=q1t||(q1t=Cpn()),r=zI,n=yB;for(let i=0;i<33;i++){let o=Number(e&255n);e>>=8n,o>128&&(o-=256,e+=1n);let s=i*128,a=s+Math.abs(o)-1,c=i%2!==0,u=o<0;o===0?n=n.add(H1t(c,t[s])):r=r.add(H1t(u,t[a]))}if(e!==0n)throw new Error("invalid wnaf");return{p:r,f:n}},vNi=iRe.bytesToHex,TNi=iRe.hexToBytes,ANi=iRe.concatBytes;function kpn(e){let t="";for(let r=0;r<e.length;r++)t+=String.fromCharCode(e[r]);return btoa(t)}function Dpn(e){let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}function vB(e){return kpn(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Lpn(e){let t=e.length%4===0?0:4-e.length%4,r=e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat(t);return Dpn(r)}var bB=2,Q1t=["new","continue"],gte=1,_te="vic_draw",e_t=["charge_and_capture","authorize_only"],Ate=10000n,yte="nominal_usd_usdc_parity",oRe=["card:vic","wallet:x402"],Upn=["hosted_identity_key_migration_required","identity_key_expired","identity_key_rotated","identity_key_lost","identity_key_inactive","agent_inactive","current_grant_missing","current_grant_replaced","current_grant_expired","current_grant_inactive","required_scope_missing","managed_wallet_authority_unverified","authority_projection_unknown","authorization_version_unsupported","identity_key_custody_unsupported"],t_t=["identity","wallet_api","wallet_signing","email_signing","chain_identity"],r_t=["runtime","turnkey","server_encrypted","server_kms","external"],n_t=["pending","active","retired","revoked","lost"],i_t=["dotvisa","tap","email","messaging"],o_t=["provisioning","active","needs_attention","suspended","disabled"],s_t=["routing_only","provider_verified","agent_key_bound"],Bpn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,jpn=/^[A-Za-z0-9_-]{43}$/,qpn=/^(?:0|[1-9][0-9]*)$/,Hpn=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,6})?(?:Z|[+-]\d{2}:\d{2})$/,a_t=/[\u0000-\u001f\u007f]/,Vpn=2147483647,c_t=9223372036854775807n,V1t=100,Fpn=512,F1t=32,$pn=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.visa$/,bte=/^0x[0-9a-f]{40}$/,wte=new TextEncoder;function eRe(e,t){return(0,W1t.compareCanonicalKeys)(e,t)}function Jv(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Qv(e){if(typeof e!="string"||!jpn.test(e))return!1;try{let t=Lpn(e);return t.byteLength===32&&vB(t)===e}catch{return!1}}function Xv(e,t,r){let n=Object.keys(t).filter(i=>!r.has(i));if(n.length>0)throw new Error(`${e} contains unknown field(s): ${n.sort().join(", ")}`)}function zpn(e,t){if(typeof t!="string"||!Bpn.test(t))throw new Error(`${e} must be a UUID`)}function uu(e,t){return zpn(e,t),t.toLowerCase()}function EB(e,t){if(!(0,W1t.isCanonicalOpaqueId)(t))throw new Error(`${e} must be a non-empty opaque id (max 128 chars)`)}function zy(e,t){if(typeof t!="string")throw new Error(`${e} must be an ISO timestamp with an explicit time-zone offset`);let r=Hpn.exec(t);if(!r)throw new Error(`${e} must be an ISO timestamp with an explicit time-zone offset`);let[,n,i,o,s,a,c]=r,u=Number(n),d=Number(i),l=Number(o),p=Number(s),f=Number(a),m=Number(c),h=new Date(0);if(h.setUTCFullYear(u,d-1,l),h.setUTCHours(p,f,m,0),u===0||h.getUTCFullYear()!==u||h.getUTCMonth()!==d-1||h.getUTCDate()!==l||h.getUTCHours()!==p||h.getUTCMinutes()!==f||h.getUTCSeconds()!==m)throw new Error(`${e} must be a valid calendar timestamp`);let g=Date.parse(t);if(!Number.isFinite(g))throw new Error(`${e} must be a valid ISO timestamp`);return new Date(g).toISOString()}function Yv(e,t,r=!1){if(typeof t!="string"||!qpn.test(t))throw new Error(`${e} must be a canonical non-negative integer micros string`);if(!r&&t==="0")throw new Error(`${e} must be positive`);if(BigInt(t)>c_t)throw new Error(`${e} exceeds the PostgreSQL BIGINT range`);return t}function u_t(e,t){if(typeof t!="number"||!Number.isInteger(t)||t<=0||t>Vpn)throw new Error(`${e} must be a positive PostgreSQL INTEGER`);return t}function Ete(e,t){if(typeof t!="string")throw new Error(`${e} must be a string`);if(a_t.test(t))throw new Error(`${e} must be a bounded non-empty payee without control characters`);let r=t.normalize("NFC").trim();if(r.length===0||r.length>Fpn)throw new Error(`${e} must be a bounded non-empty payee without control characters`);return r}function Zv(e,t,r){if(typeof t!="string")throw new Error(`${e} must be a string`);if(a_t.test(t))throw new Error(`${e} must be bounded, non-empty text without control characters`);let n=t.normalize("NFC").trim();if(n.length===0||n.length>r)throw new Error(`${e} must be bounded, non-empty text without control characters`);return n}function nl(e,t){return typeof e=="string"&&t.includes(e)}function Gpn(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("cents must be a non-negative safe integer");let t=BigInt(e)*Ate;if(t>c_t)throw new Error("cents exceed the PostgreSQL BIGINT micros range");return t.toString()}function Kpn(e){return Yv("amountAtomic",e,!0)}function Wpn(e){if(e==="card:vic")return{scope:e,paymentRail:"card",protocol:null,instrumentKind:"vic_card"};if(e==="wallet:x402")return{scope:e,paymentRail:"stablecoin",protocol:"x402",instrumentKind:"turnkey_wallet"};throw new Error(`unknown authorization scope: ${String(e)}`)}function Ypn(e){if(!Jv(e))throw new Error("agent key descriptor must be an object");Xv("agent key descriptor",e,new Set(["keyId","agentId","purpose","algorithm","custody","fingerprint","status","createdAt","expiresAt"]));let t=uu("keyId",e.keyId),r=uu("agentId",e.agentId);if(!nl(e.purpose,t_t))throw new Error("invalid key purpose");if(!nl(e.algorithm,["Ed25519","P-256","secp256k1"]))throw new Error("invalid key algorithm");if(!nl(e.custody,r_t))throw new Error("invalid key custody");let n=Zv("fingerprint",e.fingerprint,255);if(e.purpose==="identity"){if(e.algorithm!=="Ed25519")throw new Error("identity keys must use Ed25519");if(!Qv(n))throw new Error("identity key fingerprint must be a 43-char RFC 7638 JKT")}if(e.purpose==="wallet_api"&&(e.algorithm!=="P-256"||e.custody!=="runtime"&&e.custody!=="server_kms"))throw new Error("wallet_api keys must be P-256 credentials held by an advisory runtime or the managed authority KMS");if(e.purpose==="wallet_signing"&&(e.algorithm!=="secp256k1"||e.custody!=="turnkey"))throw new Error("wallet_signing keys must be Turnkey-custodied secp256k1 money signers");if(e.purpose==="wallet_signing"&&(n=n.toLowerCase(),!bte.test(n)))throw new Error("wallet_signing fingerprint must be a canonical EVM address");if(e.purpose==="chain_identity"&&(e.algorithm!=="secp256k1"||e.custody!=="turnkey"))throw new Error("chain_identity keys must be Turnkey-custodied secp256k1 addresses");if(e.purpose==="chain_identity"&&(n=n.toLowerCase(),!bte.test(n)))throw new Error("chain_identity fingerprint must be a canonical EVM address");if(e.purpose==="email_signing"){if(e.algorithm!=="Ed25519")throw new Error("email_signing keys must use Ed25519");if(!Qv(n))throw new Error("email_signing key fingerprint must be a 43-char RFC 7638 JKT")}if(!nl(e.status,n_t))throw new Error("invalid key status");let i=zy("createdAt",e.createdAt),o=e.expiresAt===void 0?void 0:zy("expiresAt",e.expiresAt);if(o!==void 0&&Date.parse(o)<=Date.parse(i))throw new Error("expiresAt must be after createdAt");return{keyId:t,agentId:r,purpose:e.purpose,algorithm:e.algorithm,custody:e.custody,fingerprint:n,status:e.status,createdAt:i,...o!==void 0?{expiresAt:o}:{}}}function Jpn(e,t,r){if(!Jv(e))throw new Error("keyLink must be an object");Xv("channel keyLink",e,new Set(["keyId","agentId","purpose","fingerprint"]));let n=uu("keyLink.keyId",e.keyId),i=uu("keyLink.agentId",e.agentId);if(i!==t)throw new Error("keyLink.agentId must match the channel agentId");if(!nl(e.purpose,["identity","email_signing"]))throw new Error("channel keyLink cannot use a wallet-signing key");if(r==="email"&&e.purpose!=="email_signing")throw new Error("an agent-key-bound email channel requires an email_signing key");if((r==="tap"||r==="dotvisa")&&e.purpose!=="identity")throw new Error(`${r} requires an identity key`);let o=Zv("keyLink.fingerprint",e.fingerprint,255);if(!Qv(o))throw new Error(`an ${e.purpose} key link fingerprint must be a 43-char RFC 7638 JKT`);return{keyId:n,agentId:i,purpose:e.purpose,fingerprint:o}}function Xpn(e){if(!Jv(e))throw new Error("agent channel descriptor must be an object");Xv("agent channel descriptor",e,new Set(["channelId","agentId","kind","status","assurance","address","providerRef","keyLink","capabilities","createdAt","verifiedAt","disabledAt"])),EB("channelId",e.channelId);let t=uu("agentId",e.agentId);if(!nl(e.kind,i_t))throw new Error("invalid channel kind");if(!nl(e.status,o_t))throw new Error("invalid channel status");if(!nl(e.assurance,s_t))throw new Error("invalid channel assurance");let r=e.address===void 0?void 0:Zv("address",e.address,320),n=e.kind==="dotvisa"?r?.toLowerCase():r;if((e.kind==="email"||e.kind==="dotvisa")&&n===void 0)throw new Error(`${e.kind} channels require an address`);if(e.kind==="dotvisa"&&n!==void 0&&!$pn.test(n))throw new Error("dotvisa channel address must be a canonical lowercase .visa address");if(e.kind==="tap"&&n!==void 0)throw new Error("tap channels use providerRef and cannot claim a public address");let i=e.providerRef===void 0?void 0:Zv("providerRef",e.providerRef,255);if(!Array.isArray(e.capabilities)||e.capabilities.length===0||e.capabilities.length>F1t)throw new Error(`capabilities must contain between 1 and ${F1t} entries`);let o=e.capabilities.map(l=>Zv("capability",l,64));if(new Set(o).size!==o.length)throw new Error("capabilities must not repeat");let s=zy("createdAt",e.createdAt),a=e.verifiedAt===void 0?void 0:zy("verifiedAt",e.verifiedAt),c=e.disabledAt===void 0?void 0:zy("disabledAt",e.disabledAt);if(a!==void 0&&Date.parse(a)<Date.parse(s))throw new Error("verifiedAt cannot be before createdAt");if(c!==void 0&&Date.parse(c)<Date.parse(s))throw new Error("disabledAt cannot be before createdAt");if(c!==void 0&&a!==void 0&&Date.parse(c)<Date.parse(a))throw new Error("disabledAt cannot be before verifiedAt");if(e.status==="disabled"!=(c!==void 0))throw new Error("status='disabled' and disabledAt must be set together");let u={channelId:e.channelId,agentId:t,kind:e.kind,status:e.status,...n!==void 0?{address:n}:{},...i!==void 0?{providerRef:i}:{},capabilities:[...o].sort(eRe),createdAt:s,...c!==void 0?{disabledAt:c}:{}};if(e.assurance==="routing_only"){if(a!==void 0||e.keyLink!==void 0)throw new Error("routing_only channels cannot claim verification or an agent key link");return{...u,assurance:"routing_only"}}if(i===void 0||a===void 0)throw new Error(`${e.assurance} channels require providerRef and verifiedAt`);if(e.assurance==="provider_verified"){if(e.keyLink!==void 0)throw new Error("provider_verified channels cannot claim an agent key link");return{...u,assurance:"provider_verified",providerRef:i,verifiedAt:a}}let d=Jpn(e.keyLink,t,e.kind);return{...u,assurance:"agent_key_bound",providerRef:i,verifiedAt:a,keyLink:d}}function d_t(e){if(!Jv(e))throw new Error("agent authority grant must be an object");if(Xv("agent authority grant",e,new Set(["v","grantId","agentId","version","budgetEpochId","budgetEpochMode","status","currency","valuationPolicy","totalMicros","perTransactionMicros","dailyMicros","scopes","payeeConstraints","effectiveAt","expiresAt","supersedesGrantId"])),e.v!==bB)throw new Error("grant.v must be 2");let t=uu("grantId",e.grantId),r=uu("agentId",e.agentId),n=u_t("version",e.version),i=uu("budgetEpochId",e.budgetEpochId);if(!nl(e.budgetEpochMode,Q1t))throw new Error("budgetEpochMode must be new or continue");if(!nl(e.status,["active","superseded","revoked"]))throw new Error("invalid grant status");if(e.currency!=="USD")throw new Error("currency must be 'USD'");if(e.valuationPolicy!==yte)throw new Error(`valuationPolicy must be '${yte}'`);let o=Yv("totalMicros",e.totalMicros),s=Yv("perTransactionMicros",e.perTransactionMicros);if(BigInt(s)>BigInt(o))throw new Error("perTransactionMicros cannot exceed totalMicros");let a=e.dailyMicros===void 0?void 0:Yv("dailyMicros",e.dailyMicros);if(a!==void 0){if(BigInt(a)>BigInt(o))throw new Error("dailyMicros cannot exceed totalMicros");if(BigInt(s)>BigInt(a))throw new Error("perTransactionMicros cannot exceed dailyMicros")}if(!Array.isArray(e.scopes)||e.scopes.length===0)throw new Error("scopes must be a non-empty array");let c=e.scopes.map(p=>{if(!Jv(p))throw new Error("grant scope must be an object");if(Xv("grant scope",p,new Set(["scope","totalMicros","perTransactionMicros","instrumentRef"])),!nl(p.scope,oRe))throw new Error("invalid authorization scope");let f=p.totalMicros===void 0?void 0:Yv("scope.totalMicros",p.totalMicros),m=p.perTransactionMicros===void 0?void 0:Yv("scope.perTransactionMicros",p.perTransactionMicros);if(f!==void 0&&BigInt(f)>BigInt(o))throw new Error("scope.totalMicros cannot exceed the aggregate totalMicros");if(m!==void 0&&BigInt(m)>BigInt(s))throw new Error("scope.perTransactionMicros cannot exceed the aggregate perTransactionMicros");if(f!==void 0&&m!==void 0&&BigInt(m)>BigInt(f))throw new Error("scope.perTransactionMicros cannot exceed scope.totalMicros");let h=Zv("scope.instrumentRef",p.instrumentRef,255);return{scope:p.scope,...f!==void 0?{totalMicros:f}:{},...m!==void 0?{perTransactionMicros:m}:{},instrumentRef:h}});if(new Set(c.map(({scope:p})=>p)).size!==c.length)throw new Error("scopes must not repeat");let u;if(e.payeeConstraints!==void 0){if(!Array.isArray(e.payeeConstraints)||e.payeeConstraints.length===0||e.payeeConstraints.length>V1t)throw new Error(`payeeConstraints must contain between 1 and ${V1t} entries`);if(u=e.payeeConstraints.map(f=>{if(!Jv(f))throw new Error("payee constraint must be an object");if(Xv("payee constraint",f,new Set(["scope","kind","canonicalId"])),f.scope==="card:vic"&&f.kind==="processor_merchant_id")return{scope:f.scope,kind:f.kind,canonicalId:Ete("payee constraint canonicalId",f.canonicalId)};if(f.scope==="wallet:x402"&&f.kind==="evm_address"){let m=Ete("payee constraint canonicalId",f.canonicalId).toLowerCase();if(!bte.test(m))throw new Error("wallet payee constraint canonicalId must be an EVM address");return{scope:f.scope,kind:f.kind,canonicalId:m}}throw new Error("payee constraint scope/kind combination is invalid")}),u.some(f=>!c.some(({scope:m})=>m===f.scope)))throw new Error("payee constraint scope must be present in grant scopes");let p=u.map(({scope:f,kind:m,canonicalId:h})=>`${f}:${m}:${h}`);if(new Set(p).size!==p.length)throw new Error("payeeConstraints must not repeat after normalization")}let d=zy("effectiveAt",e.effectiveAt),l=zy("expiresAt",e.expiresAt);if(Date.parse(l)<=Date.parse(d))throw new Error("expiresAt must be after effectiveAt");if(e.supersedesGrantId!==void 0&&uu("supersedesGrantId",e.supersedesGrantId)===t)throw new Error("a grant cannot supersede itself");return{v:bB,grantId:t,agentId:r,version:n,budgetEpochId:i,budgetEpochMode:e.budgetEpochMode,status:e.status,currency:"USD",valuationPolicy:yte,totalMicros:o,perTransactionMicros:s,...a!==void 0?{dailyMicros:a}:{},scopes:[...c].sort((p,f)=>eRe(p.scope,f.scope)),...u!==void 0?{payeeConstraints:[...u].sort((p,f)=>eRe(`${p.scope}:${p.kind}:${p.canonicalId}`,`${f.scope}:${f.kind}:${f.canonicalId}`))}:{},effectiveAt:d,expiresAt:l,...e.supersedesGrantId!==void 0?{supersedesGrantId:uu("supersedesGrantId",e.supersedesGrantId)}:{}}}function Zpn(e){let t=d_t(e),{status:r,...n}=t;return vB(vte(wte.encode(`visa-agent-authority-grant:v2:${JSON.stringify(n)}`)))}function l_t(e){if(!Jv(e))throw new Error("VIC settlement envelope must be an object");if(Xv("VIC settlement envelope",e,new Set(["v","kind","acquirerId","processorMerchantId","processorIntentId","instrumentRef","instrumentCommitment","payee","amountMicros","currency","processorAction","captureMode","settlementExpiresAt"])),e.v!==gte)throw new Error(`VIC settlement envelope.v must be ${gte}`);if(e.kind!==_te)throw new Error(`VIC settlement envelope.kind must be '${_te}'`);EB("acquirerId",e.acquirerId);let t=Zv("processorMerchantId",e.processorMerchantId,128);EB("processorIntentId",e.processorIntentId);let r=Object.prototype.hasOwnProperty.call(e,"instrumentRef"),n=Object.prototype.hasOwnProperty.call(e,"instrumentCommitment");if(r===n)throw new Error("VIC settlement envelope requires exactly one of instrumentRef or instrumentCommitment");let i=r?Zv("instrumentRef",e.instrumentRef,255):void 0,o=n?e.instrumentCommitment:void 0;if(o!==void 0&&!Qv(o))throw new Error("instrumentCommitment must be a 32-byte base64url commitment");let s=Ete("payee",e.payee),a=Yv("amountMicros",e.amountMicros);if(BigInt(a)%Ate!==0n)throw new Error("VIC amountMicros must represent a whole number of card cents");if(e.currency!=="USD")throw new Error("currency must be 'USD'");if(!nl(e.processorAction,e_t))throw new Error("processorAction must be 'charge_and_capture' or 'authorize_only'");if(!nl(e.captureMode,["exact","up_to"]))throw new Error("captureMode must be 'exact' or 'up_to'");if(e.processorAction==="charge_and_capture"&&e.captureMode!=="exact")throw new Error("charge_and_capture requires captureMode 'exact'");let c=zy("settlementExpiresAt",e.settlementExpiresAt),u={v:gte,kind:_te,acquirerId:e.acquirerId,processorMerchantId:t,processorIntentId:e.processorIntentId,payee:s,amountMicros:a,currency:"USD",processorAction:e.processorAction,captureMode:e.captureMode,settlementExpiresAt:c};return i!==void 0?{...u,instrumentRef:i}:{...u,instrumentCommitment:o}}function Qpn(e){let t=l_t(e),r=JSON.stringify({v:t.v,kind:t.kind,acquirerId:t.acquirerId,processorMerchantId:t.processorMerchantId,processorIntentId:t.processorIntentId,..."instrumentRef"in t?{instrumentRef:t.instrumentRef}:{instrumentCommitment:t.instrumentCommitment},payee:t.payee,amountMicros:t.amountMicros,currency:t.currency,processorAction:t.processorAction,captureMode:t.captureMode,settlementExpiresAt:t.settlementExpiresAt});return vB(vte(wte.encode(`visa-vic-settlement-envelope:v1:${r}`)))}function sRe(e){if(!Jv(e))throw new Error("spend authorization intent must be an object");if(Xv("spend authorization intent",e,new Set(["v","authorizationId","agentId","keyJkt","grantId","grantVersion","budgetEpochId","scope","amountMicros","currency","payee","intentId","economicIntentId","settlementHash","settlementExpiresAt"])),e.v!==bB)throw new Error("intent.v must be 2");let t=uu("authorizationId",e.authorizationId),r=uu("agentId",e.agentId);if(!Qv(e.keyJkt))throw new Error("keyJkt must be a 43-char RFC 7638 thumbprint");let n=uu("grantId",e.grantId),i=u_t("grantVersion",e.grantVersion),o=uu("budgetEpochId",e.budgetEpochId);if(!nl(e.scope,oRe))throw new Error("invalid authorization scope");let s=Yv("amountMicros",e.amountMicros);if(e.scope==="card:vic"&&BigInt(s)%Ate!==0n)throw new Error("card:vic amountMicros must represent a whole number of card cents");if(e.currency!=="USD")throw new Error("currency must be 'USD'");let a=Ete("payee",e.payee),c=e.scope==="wallet:x402"?a.toLowerCase():a;if(e.scope==="wallet:x402"&&!bte.test(c))throw new Error("wallet:x402 payee must be an EVM address");if(EB("intentId",e.intentId),EB("economicIntentId",e.economicIntentId),!Qv(e.settlementHash))throw new Error("settlementHash is required and must be a 32-byte base64url commitment");let u=zy("settlementExpiresAt",e.settlementExpiresAt);return{v:bB,authorizationId:t,agentId:r,keyJkt:e.keyJkt,grantId:n,grantVersion:i,budgetEpochId:o,scope:e.scope,amountMicros:s,currency:"USD",payee:c,intentId:e.intentId,economicIntentId:e.economicIntentId,settlementHash:e.settlementHash,settlementExpiresAt:u}}function p_t(e){let t=sRe(e),r=JSON.stringify({v:t.v,authorizationId:t.authorizationId,agentId:t.agentId,keyJkt:t.keyJkt,grantId:t.grantId,grantVersion:t.grantVersion,budgetEpochId:t.budgetEpochId,scope:t.scope,amountMicros:t.amountMicros,currency:t.currency,payee:t.payee,intentId:t.intentId,economicIntentId:t.economicIntentId,settlementHash:t.settlementHash,settlementExpiresAt:t.settlementExpiresAt});return vB(vte(wte.encode(`visa-agent-spend-authorization:v2:${r}`)))}function efn(e){let t=sRe(e.intent),r=uu("walletApiKeyId",e.walletApiKeyId),n=uu("runtimeSessionId",e.runtimeSessionId);if(e.executionChannel!=="cli"&&e.executionChannel!=="mcp")throw new Error("executionChannel must be cli or mcp");if(!Qv(e.resourceCommitment))throw new Error("resourceCommitment must be a 32-byte base64url commitment");let i=JSON.stringify({v:1,intentHash:p_t(t),walletApiKeyId:r,runtimeSessionId:n,executionChannel:e.executionChannel,resourceCommitment:e.resourceCommitment});return vB(vte(wte.encode(`visa-wallet-authorization-request:v1:${i}`)))}});var E_t=_(lr=>{"use strict";Object.defineProperty(lr,"__esModule",{value:!0});lr.FINANCIAL_REVOCATION_TYPE=lr.FinancialProofError=lr.FINANCIAL_REQUEST_MAX_BYTES=lr.FINANCIAL_JWS_MAX_BYTES=lr.FINANCIAL_APPROVAL_TYPE=lr.FINANCIAL_APPROVAL_AUDIENCE=void 0;lr.parseFinancialCanonicalJson=AB;lr.parseCardDisclosureConsent=g_t;lr.parseFinancialOwnerApproval=aRe;lr.financialRootJkt=Ote;lr.prepareFinancialOwnerApproval=cRe;lr.verifyFinancialOwnerApproval=__t;lr.completeFinancialOwnerApproval=nfn;lr.parseFinancialOwnerChallengeView=ifn;lr.parseFinancialOwnerRevocation=uRe;lr.prepareFinancialOwnerRevocation=y_t;lr.verifyFinancialOwnerRevocation=b_t;lr.completeFinancialOwnerRevocation=ofn;var h_t=m_t(),Ky=jS(),v8=gS();lr.FINANCIAL_APPROVAL_AUDIENCE="urn:visa:authority:financial";lr.FINANCIAL_APPROVAL_TYPE="visa-financial-grant-approval+jwt";lr.FINANCIAL_JWS_MAX_BYTES=16384;lr.FINANCIAL_REQUEST_MAX_BYTES=262144;var tfn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,Og=new TextEncoder,Pte=new TextDecoder("utf-8",{fatal:!0}),rfn=["v","purpose","audience","approvalId","challenge","ownerPrincipalId","associationId","associationVersion","agentId","rootJkt","grantHash","previousGrantId","previousGrantVersion","iat","exp"],xte=class extends Error{constructor(t){super(t),this.name="FinancialProofError"}};lr.FinancialProofError=xte;function Sr(e){throw new xte(e)}function Gy(e,t){if(!e||typeof e!="object"||Array.isArray(e))return Sr("Expected a closed object");let r=e;return Object.keys(r).length!==t.length||t.some(n=>!Object.hasOwn(r,n))?Sr("Unexpected or missing field"):r}function xg(e){return typeof e=="number"&&Number.isSafeInteger(e)&&e>0}function TB(e){return typeof e=="string"&&tfn.test(e)}function Sh(e,t){if(typeof e!="string"||!/^[A-Za-z0-9_-]+$/.test(e))return Sr("Invalid base64url");let r=new Uint8Array((0,Ky.base64UrlToBytes)(e));return(0,Ky.bytesToBase64Url)(r)!==e||t!==void 0&&r.length!==t?Sr("Noncanonical base64url"):r}function Ite(e){if(typeof e=="string")for(let t=0;t<e.length;t++){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(++t);n>=56320&&n<=57343||Sr("Invalid Unicode")}else r>=56320&&r<=57343&&Sr("Invalid Unicode")}else if(Array.isArray(e))for(let t of e)Ite(t);else if(e&&typeof e=="object")for(let[t,r]of Object.entries(e))Ite(t),Ite(r)}function AB(e,t=lr.FINANCIAL_REQUEST_MAX_BYTES){if(Og.encode(e).length>t)return Sr("Financial input too large");let r;try{r=JSON.parse(e)}catch{return Sr("Invalid JSON")}return Ite(r),(0,v8.canonicalEnvelopeJson)(r)!==e?Sr("Noncanonical JSON"):r}function g_t(e){let t=Gy(e,["v","runtimeId","mode"]);return t.v!==1||!TB(t.runtimeId)||t.mode!=="private"&&t.mode!=="agent_history"?Sr("Invalid card disclosure consent"):{v:1,runtimeId:t.runtimeId,mode:t.mode}}function aRe(e){let t=e?.v,r=Gy(e,[...rfn,...t===2?["cardDisclosure"]:[]]);if(r.v!==1&&r.v!==2||r.purpose!=="financial.grant.approve"||r.audience!==lr.FINANCIAL_APPROVAL_AUDIENCE)return Sr("Wrong financial approval profile");for(let n of["approvalId","ownerPrincipalId","associationId","agentId"])if(!TB(r[n]))return Sr("Invalid approval identity");for(let n of["challenge","rootJkt","grantHash"])Sh(r[n],32);return!xg(r.associationVersion)||!xg(r.iat)||!xg(r.exp)||r.exp<=r.iat||r.exp-r.iat>300?Sr("Invalid approval version or window"):(r.previousGrantId===null?r.previousGrantVersion!==null:!TB(r.previousGrantId)||!xg(r.previousGrantVersion))?Sr("Invalid grant predecessor"):{...r,...r.v===2?{cardDisclosure:g_t(r.cardDisclosure)}:{}}}async function Ote(e){let t=Gy(e,["kty","crv","x"]);return t.kty!=="OKP"||t.crv!=="Ed25519"?Sr("Expected owner Ed25519 root"):(Sh(t.x,32),(0,Ky.bytesToBase64Url)(new Uint8Array(await crypto.subtle.digest("SHA-256",Og.encode((0,v8.canonicalJson)(t))))))}function cRe(e,t){let r=aRe(e),n=(0,h_t.canonicalAgentAuthorityGrant)(t);if(n.status!=="active"||n.agentId!==r.agentId||(0,h_t.agentAuthorityGrantHash)(n)!==r.grantHash)return Sr("Displayed grant does not match approval");if(r.v===2&&!n.scopes.some(s=>s.scope==="card:vic"))return Sr("Card disclosure requires a card spending scope");let i={alg:"EdDSA",typ:lr.FINANCIAL_APPROVAL_TYPE,kid:r.rootJkt},o=`${(0,Ky.bytesToBase64Url)(Og.encode((0,v8.canonicalJson)(i)))}.${(0,Ky.bytesToBase64Url)(Og.encode((0,v8.canonicalJson)(r)))}`;return{statement:r,grant:n,signingInput:o}}async function __t(e,t,r){if(typeof e!="string"||Og.encode(e).length>lr.FINANCIAL_JWS_MAX_BYTES)return Sr("Financial proof too large");let n=e.split(".");if(n.length!==3)return Sr("Invalid compact JWS");let i=Gy(AB(Pte.decode(Sh(n[0])),lr.FINANCIAL_JWS_MAX_BYTES),["alg","typ","kid"]),o=aRe(AB(Pte.decode(Sh(n[1])),lr.FINANCIAL_JWS_MAX_BYTES));if(i.alg!=="EdDSA"||i.typ!==lr.FINANCIAL_APPROVAL_TYPE||i.kid!==o.rootJkt||await Ote(t)!==o.rootJkt)return Sr("Wrong owner approval key or purpose");if(!xg(r)||o.iat>r+5||r>=o.exp)return Sr("Owner approval expired or not yet valid");let s=await crypto.subtle.importKey("raw",Sh(t.x,32),{name:"Ed25519"},!1,["verify"]);return await crypto.subtle.verify("Ed25519",s,Sh(n[2],64),Og.encode(`${n[0]}.${n[1]}`))?o:Sr("Invalid owner signature")}async function nfn(e,t,r,n,i){if(n.length!==64)return Sr("Invalid owner signature length");let{signingInput:o}=cRe(e,t),s=`${o}.${(0,Ky.bytesToBase64Url)(n)}`;return await __t(s,r,i),s}async function ifn(e){let t=Gy(e,["v","statement","grant","root","projection"]);if(t.v!==1)return Sr("Unknown owner review version");let{statement:r,grant:n}=cRe(t.statement,t.grant),i=Gy(t.root,["organizationId","rootKeyId","publicJwk"]);for(let s of["organizationId","rootKeyId"])if(typeof i[s]!="string"||!/^[-_A-Za-z0-9]{1,256}$/.test(i[s]))return Sr("Invalid protected root coordinates");if(await Ote(i.publicJwk)!==r.rootJkt)return Sr("Protected root does not match owner approval");let o=Gy(t.projection,["agentId","ownerPublicId"]);return o.agentId!==r.agentId||!TB(o.ownerPublicId)||o.ownerPublicId===r.ownerPrincipalId?Sr("Invalid protected owner projection"):{v:1,statement:r,grant:n,root:{organizationId:i.organizationId,rootKeyId:i.rootKeyId,publicJwk:{...i.publicJwk}},projection:{agentId:r.agentId,ownerPublicId:o.ownerPublicId}}}lr.FINANCIAL_REVOCATION_TYPE="visa-financial-grant-revocation+jwt";function uRe(e){let t=Gy(e,["v","purpose","audience","approvalId","ownerPrincipalId","associationId","associationVersion","agentId","rootJkt","grantId","grantVersion","grantHash","iat","exp"]);if(t.v!==1||t.purpose!=="financial.grant.revoke"||t.audience!==lr.FINANCIAL_APPROVAL_AUDIENCE)return Sr("Wrong financial revocation profile");for(let r of["approvalId","ownerPrincipalId","associationId","agentId","grantId"])if(!TB(t[r]))return Sr("Invalid revocation identity");for(let r of["rootJkt","grantHash"])Sh(t[r],32);return!xg(t.associationVersion)||!xg(t.grantVersion)||!xg(t.iat)||!xg(t.exp)||t.exp<=t.iat||t.exp-t.iat>300?Sr("Invalid revocation version or window"):{...t}}function y_t(e){let t=uRe(e),r={alg:"EdDSA",typ:lr.FINANCIAL_REVOCATION_TYPE,kid:t.rootJkt};return{statement:t,signingInput:`${(0,Ky.bytesToBase64Url)(Og.encode((0,v8.canonicalJson)(r)))}.${(0,Ky.bytesToBase64Url)(Og.encode((0,v8.canonicalJson)(t)))}`}}async function b_t(e,t,r){if(typeof e!="string"||Og.encode(e).length>lr.FINANCIAL_JWS_MAX_BYTES)return Sr("Financial proof too large");let n=e.split(".");if(n.length!==3)return Sr("Invalid compact JWS");let i=Gy(AB(Pte.decode(Sh(n[0])),lr.FINANCIAL_JWS_MAX_BYTES),["alg","typ","kid"]),o=uRe(AB(Pte.decode(Sh(n[1])),lr.FINANCIAL_JWS_MAX_BYTES));if(i.alg!=="EdDSA"||i.typ!==lr.FINANCIAL_REVOCATION_TYPE||i.kid!==o.rootJkt||await Ote(t)!==o.rootJkt)return Sr("Wrong owner revocation key or purpose");if(!xg(r)||o.iat>r+5||r>=o.exp)return Sr("Owner revocation expired or not yet valid");let s=await crypto.subtle.importKey("raw",Sh(t.x,32),{name:"Ed25519"},!1,["verify"]);return await crypto.subtle.verify("Ed25519",s,Sh(n[2],64),Og.encode(`${n[0]}.${n[1]}`))?o:Sr("Invalid owner signature")}async function ofn(e,t,r,n){if(r.length!==64)return Sr("Invalid owner signature length");let i=`${y_t(e).signingInput}.${(0,Ky.bytesToBase64Url)(r)}`;return await b_t(i,t,n),i}});var v_t=_(_p=>{"use strict";Object.defineProperty(_p,"__esModule",{value:!0});_p.FINANCIAL_DEVICE_OPERATIONS_AUDIENCE=_p.FINANCIAL_DEVICE_ENROLLMENT_AUDIENCE=_p.WALLET_DEVICE_HANDOFF_AUDIENCE=_p.CARD_DEVICE_HANDOFF_AUDIENCE=void 0;_p.financialDeviceProposalHash=afn;_p.financialDeviceOperationsRequestHash=cfn;_p.financialDeviceEnrollmentChallengeHash=ufn;var lRe=_W(),pRe=jS(),Rte=gS(),sfn=E_t(),dRe=Zee();_p.CARD_DEVICE_HANDOFF_AUDIENCE="visa:financial:card-device-handoff:v1";_p.WALLET_DEVICE_HANDOFF_AUDIENCE="visa:financial:wallet-device-handoff:v1";function afn(e){let t=["v","purpose","requestId","associationId","associationVersion","agentId","runtimeId","rootJkt","publicJwk"];if(e?.v===2&&t.push("rail"),!e||Object.keys(e).sort().join(",")!==t.sort().join(",")||!(e.v===1||e.v===2&&e.rail==="card:vic")||e.purpose!=="financial.runtime.device.proposal"||![e.requestId,e.associationId,e.runtimeId].every(r=>typeof r=="string"&&fRe.test(r))||typeof e.agentId!="string"||!e.agentId||e.agentId.length>256||!Number.isSafeInteger(e.associationVersion)||e.associationVersion<1||!(0,dRe.isCanonicalBase64Url32)(e.rootJkt)||!e.publicJwk||Object.keys(e.publicJwk).sort().join(",")!=="crv,kty,x"||e.publicJwk.crv!=="Ed25519"||e.publicJwk.kty!=="OKP"||!(0,dRe.isCanonicalBase64Url32)(e.publicJwk.x))throw new Error("financial_device_proposal_invalid");return(0,pRe.bytesToBase64Url)((0,lRe.sha256)(new TextEncoder().encode((0,Rte.canonicalJson)(e))))}_p.FINANCIAL_DEVICE_ENROLLMENT_AUDIENCE="visa:financial:device-enrollment:v1";_p.FINANCIAL_DEVICE_OPERATIONS_AUDIENCE="visa:financial:device-operations:v1";function cfn(e){let t=["v","purpose","requestId","agentId","runtimeId","limit"];if(!e||typeof e!="object"||Object.keys(e).sort().join(",")!==t.sort().join(",")||e.v!==1||e.purpose!=="financial.wallet.operations.read"||![e.requestId,e.agentId,e.runtimeId].every(r=>typeof r=="string"&&fRe.test(r))||!Number.isSafeInteger(e.limit)||e.limit<1||e.limit>50)throw new Error("financial_device_operations_request_invalid");return(0,pRe.bytesToBase64Url)((0,lRe.sha256)(new TextEncoder().encode((0,Rte.canonicalJson)(e))))}var S_t=["v","purpose","requestId","associationId","associationVersion","runtimeId","runtimeGeneration","childJkt","preparedCertificate","preparedDelegation","expiresAt"],fRe=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;function ufn(e){let t=(0,sfn.parseFinancialCanonicalJson)((0,Rte.canonicalJson)(e));if(!t||Array.isArray(t)||Object.keys(t).length!==S_t.length||S_t.some(r=>!Object.hasOwn(t,r))||t.v!==1||t.purpose!=="financial.runtime.device.enroll"||!["requestId","associationId","runtimeId"].every(r=>typeof t[r]=="string"&&fRe.test(t[r]))||!["associationVersion","runtimeGeneration","expiresAt"].every(r=>Number.isSafeInteger(t[r])&&t[r]>0)||!(0,dRe.isCanonicalBase64Url32)(t.childJkt))throw new Error("financial_device_challenge_invalid");for(let r of["preparedCertificate","preparedDelegation"]){let n=t[r];if(!n||Array.isArray(n)||Object.keys(n).sort().join(",")!=="claims,signingInput"||typeof n.signingInput!="string"||n.signingInput.length>16384||!n.claims||typeof n.claims!="object"||Array.isArray(n.claims))throw new Error("financial_device_challenge_invalid")}return(0,pRe.bytesToBase64Url)((0,lRe.sha256)(new TextEncoder().encode((0,Rte.canonicalJson)(t))))}});async function mRe(e){let{key:t,approved:r,result:n}=e;if(!n.certificate.startsWith(r.preparedCertificate.signingInput+".")||!n.delegation.startsWith(r.preparedDelegation.signingInput+"."))throw new Error("financial_device_owner_result_invalid");let i={keys:[{...e.rootPublicJwk,kid:e.rootKid}]},o=Math.floor(Date.now()/1e3),s=await(0,Nte.verifyRuntimeCertificate)(n.certificate,{jwks:i,nowSec:o,expectedAgentId:t.binding.agentId,expectedRootJkt:t.binding.rootJkt,expectedRuntimeId:t.runtimeId,expectedRuntimeJkt:t.jkt,requiredPurpose:"wallet:x402"}),a=await(0,Nte.verifyRuntimeDelegation)(n.delegation,{ownerJwks:i,nowSec:o,expectedRootKid:e.rootKid,expectedRootJkt:t.binding.rootJkt,expectedAgentId:t.binding.agentId,expectedRuntimeId:t.runtimeId,expectedRuntimeJkt:t.jkt,expectedNetwork:"eip155:8453",expectedLeaseIssuerJkt:r.preparedDelegation.claims.leaseIssuerJkt,expectedDelegationId:r.preparedDelegation.claims.jti});if(n.v!==1||n.runtimeId!==t.runtimeId||n.childJkt!==t.jkt||!s.ok||!a.ok)throw new Error("financial_device_owner_result_invalid");return n}var Nte,T_t=A(()=>{"use strict";Nte=ie(Eh())});function IB(e,t){if(!/^[0-9a-f-]{36}$/.test(e))throw new Error("financial_device_agent_invalid");let r=(0,wB.join)(To(t),"financial-device");return(0,Cte.mkdirSync)(r,{recursive:!0,mode:448}),(0,wB.join)(r,e+".pending.json")}function dfn(e,t){let r=qk(IB(e,t));if(r===null)return null;t6(r);let n=JSON.parse(r);if((0,_Re.financialDeviceProposalHash)(n.proposal),n.v===1&&!Object.prototype.hasOwnProperty.call(n,"ceremony")){let i=IB(e,t),o=i.replace(".pending.json",`.outdated.${n.proposal.requestId}.json`);throw(0,Cte.renameSync)(i,o),new Error(`financial_device_record_outdated: this device's wallet approval was started by an older Visa CLI and cannot be resumed (kept as ${(0,wB.basename)(o)}). Re-enroll: run \`visa connect\` again.`)}if(n.v!==1||!n.ceremony||typeof n.ceremony!="object"||!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(n.ceremony.ceremonyId)||!/^[A-Za-z0-9_-]{43}$/.test(n.ceremony.challenge)||!/^[A-Za-z0-9_-]{43}$/.test(n.ceremony.verifier)||(0,GI.createHash)("sha256").update(n.ceremony.verifier).digest("base64url")!==n.ceremony.challenge||n.proposal.agentId!==e||n.runtimeKey.binding.agentId!==e||n.runtimeKey.runtimeId!==n.proposal.runtimeId||n.runtimeKey.binding.rootJkt!==n.proposal.rootJkt||(0,gRe.computeJkt)(n.rootPublicJwk)!==n.proposal.rootJkt)throw new Error("financial_device_record_invalid");return n}function hRe(e,t){let r=JSON.stringify(e);t6(r),Hk(IB(e.proposal.agentId,t),r)}async function Mte(e){let t=dfn(e.agentId,e.env);if(t){if((0,Wy.canonicalJson)(t.ceremony)!==(0,Wy.canonicalJson)(e.ceremony))throw new Error("financial_device_ceremony_changed");let s=await e.api.financialRuntimeRequest("device-handoff-create",{requestId:t.proposal.requestId,proposal:t.proposal,ceremony:t.ceremony}),a=Math.floor(Date.now()/1e3),c=s.evidence?.wallet_receipt,u=f=>{if(typeof f!="string")throw new Error("financial_device_record_invalid");let m=JSON.parse(Buffer.from(f.split(".")[1]??"","base64url").toString()).exp;if(!Number.isSafeInteger(m))throw new Error("financial_device_record_invalid");return m>a},d=c&&u(s.prepared?.certificate)&&u(s.prepared?.delegation)&&u(c.walletBinding),l=!s.prepared||s.prepared.status==="active"||s.prepared.status==="pending"&&s.prepared.challenge.expiresAt>a;if(d||!c&&!s.expired&&l)return t;Hk(IB(e.agentId,e.env).replace(".pending.json",`.expired.${t.proposal.requestId}.json`),JSON.stringify(t));let p={v:1,ceremony:t.ceremony,proposal:{...t.proposal,requestId:(0,GI.randomUUID)()},runtimeKey:t.runtimeKey,rootKid:t.rootKid,rootPublicJwk:t.rootPublicJwk};return hRe(p,e.env),p}let r=await e.api.financialRuntimeRequest("device-context",{requestId:(0,GI.randomUUID)(),agentId:e.agentId});if(r.agentId!==e.agentId||(0,gRe.computeJkt)(r.rootPublicJwk)!==r.rootJkt)throw new Error("financial_device_context_invalid");if(e.ownerPublicId!==void 0&&typeof r.ownerPublicId=="string"&&r.ownerPublicId!==e.ownerPublicId)throw new Error("Protected wallet owner differs from the active profile");let n=await e.signer.create({profile:"legacy-root-certified-v1",purpose:"wallet:x402",agentId:e.agentId,rootJkt:r.rootJkt}),i={v:1,purpose:"financial.runtime.device.proposal",requestId:(0,GI.randomUUID)(),associationId:r.associationId,associationVersion:r.associationVersion,agentId:e.agentId,runtimeId:n.runtimeId,rootJkt:r.rootJkt,publicJwk:n.publicJwk};(0,_Re.financialDeviceProposalHash)(i);let o={v:1,ceremony:e.ceremony,proposal:i,runtimeKey:n,rootKid:r.rootKid,rootPublicJwk:r.rootPublicJwk};return hRe(o,e.env),o}async function PB(e){let t=e.pending,r=t.proposal,n=await e.signer.describe(t.runtimeKey.handle);if((0,Wy.canonicalJson)(n)!==(0,Wy.canonicalJson)(t.runtimeKey)||n.binding.profile!=="legacy-root-certified-v1"||n.binding.purpose!=="wallet:x402")throw new Error("financial_device_handle_changed");let i=async(c,u={})=>e.api.financialRuntimeRequest(c,{requestId:r.requestId,proposal:r,...c==="device-handoff-create"?{ceremony:t.ceremony}:{},...u}),o=await i("device-handoff-create");if(o.expired&&!o.evidence?.wallet_receipt)throw new Error("This enrollment ceremony expired. Start a fresh enrollment; this expired proposal cannot be approved.");if((0,Wy.canonicalJson)(o.proposal)!==(0,Wy.canonicalJson)(r))throw new Error("financial_device_proposal_mismatch");let s=o.evidence?.owner_signatures,a=o.prepared;if(s&&a&&!o.evidence?.device_proof){if(await mRe({key:n,rootKid:t.rootKid,rootPublicJwk:t.rootPublicJwk,approved:a.challenge,result:{v:1,runtimeId:r.runtimeId,childJkt:n.jkt,...s}}),t.challenge&&(0,Wy.canonicalJson)(t.challenge)!==(0,Wy.canonicalJson)(a.challenge))throw new Error("financial_device_challenge_changed");t.childPop||(t.challenge=a.challenge,t.childPop=await e.signer.financialEnrollmentProof(n.handle,a.challenge),hRe(t,e.env)),o=await i("device-handoff-proof",{childPop:t.childPop})}return o}async function yRe(e){let t=e.pending,r=t.proposal,n=await PB(e),i=n.evidence?.wallet_receipt;if(n.prepared?.status!=="active"||!i)return null;let o=await e.signer.describe(t.runtimeKey.handle),s=await mRe({key:o,rootKid:t.rootKid,rootPublicJwk:t.rootPublicJwk,approved:n.prepared.challenge,result:{v:1,runtimeId:r.runtimeId,childJkt:o.jkt,certificate:n.prepared.certificate,delegation:n.prepared.delegation}}),{verifyWalletBinding:a}=await Promise.resolve().then(()=>ie(Eh())),c=await e.api.financialRuntimeRequest("device-context",{requestId:(0,GI.randomUUID)(),agentId:r.agentId});if(c.associationId!==r.associationId||c.associationVersion!==r.associationVersion||c.rootJkt!==r.rootJkt||i.agentId!==r.agentId||i.runtimeId!==r.runtimeId||i.runtimeCertificate!==s.certificate||typeof c.grantId!="string"||!Number.isSafeInteger(c.grantVersion)||c.grantVersion<1||typeof c.ownerPublicId!="string")throw new Error("financial_device_activation_changed");if(!(await a(i.walletBinding,{jwks:{keys:[{...t.rootPublicJwk,kid:t.rootKid}]},nowSec:Math.floor(Date.now()/1e3),expectedAgentId:r.agentId,expectedRootJkt:r.rootJkt,expectedSubOrganizationId:c.organizationId,expectedWalletId:i.walletId,expectedWalletAddress:i.walletAddress,expectedNetwork:"eip155:8453",expectedExecutor:{kind:"turnkey_tvc_p256",publicKey:i.credentialPublicKey,derivationVersion:"visa-tvc-slipgate-v2"}})).ok)throw new Error("financial_device_wallet_binding_invalid");let d={...t,challenge:n.prepared.challenge,certificate:s.certificate,delegation:s.delegation,walletBinding:i.walletBinding,wallet:{walletId:i.walletId,walletAddress:i.walletAddress,credentialPublicKey:i.credentialPublicKey},organizationId:c.organizationId,ownerPublicId:c.ownerPublicId,grantId:c.grantId,grantVersion:c.grantVersion},l=JSON.stringify(d);return t6(l),Hk(IB(r.agentId,e.env).replace(".pending.json",".active.json"),l),d}var Cte,wB,GI,gRe,Wy,_Re,T8=A(()=>{"use strict";Cte=require("node:fs"),wB=require("node:path"),GI=require("node:crypto"),gRe=ie(Eh()),Wy=ie(gS()),_Re=ie(v_t());rK();kd();T_t()});function KI(e){let t=X_(e);if(new URL(t).protocol!=="https:")throw new Error("Protected enrollment requires the HTTPS Auth origin");return t}function OB(e){let t=(0,WI.join)(To(e),"protected-enrollment");return(0,kte.mkdirSync)(t,{recursive:!0,mode:448}),Vc(t),t}function ERe(e,t,r){if(!e||e.status!=="active"||e.v!==1||!A8.test(e.ceremonyId)||e.challenge!==t||e.confirmCode!==r||!P_t.test(t)||!/^[ABCDEFGHJKMNPQRSTUVWXYZ23456789]{6}$/.test(r)||!A8.test(e.agentId)||!A8.test(e.ownerPublicId)||!A8.test(e.associationId)||!Number.isSafeInteger(e.associationVersion)||e.associationVersion<1||typeof e.rootKid!="string"||!e.rootKid||typeof e.organizationId!="string"||!e.organizationId||(0,I_t.computeJkt)(e.rootPublicJwk)!==e.rootJkt)throw new Error("Protected enrollment result does not match this terminal")}function pfn(e){let t=Xl((0,WI.join)(OB(e),"pending.json"));if(t===null)return null;let r=JSON.parse(t);if(r.v!==1||!P_t.test(r.verifier)||x_t(r.verifier)!==r.challenge||KI(r.authorityOrigin)!==r.authorityOrigin||KI(r.executionOrigin)!==r.executionOrigin||X_(r.webOrigin)!==r.webOrigin||!Number.isSafeInteger(r.createdAt)||!(/^(?:ca_[A-Za-z0-9_-]{24})$/.test(r.ceremonyId)||A8.test(r.ceremonyId))||r.transportProfileId!==(Bu(e)?.profileId??null))throw new Error("Protected enrollment pending state or transport profile changed");if(r.binding&&(ERe(r.binding,r.challenge,TS(r.verifier)),r.ceremonyId!==r.binding.ceremonyId))throw new Error("Protected enrollment ceremony changed");return r}function mfn(e){try{return pfn(e)}catch(t){return Wn.warn("agent:protected_enrollment_pending_replaced",{reason:t instanceof Error?t.message:"pending record could not be read"}),null}}function O_t(e){let t=KI(i6()),r=X_(e.webOrigin),n=mfn(e.env),i=n!==null&&Date.now()-n.createdAt<ffn;if(n&&i&&!e.restart){if(n.authorityOrigin!==t||n.webOrigin!==r||n.executionOrigin!==t)throw new Error("Resume requires the original protected authority and browser origins");return n}if(n?.binding&&i&&e.restart)throw new Error("This enrollment is already bound. Resume its device approval before starting another agent.");let o=(0,xB.randomBytes)(32).toString("base64url"),s={v:1,verifier:o,challenge:x_t(o),authorityOrigin:t,executionOrigin:t,webOrigin:r,transportProfileId:Bu(e.env)?.profileId??null,createdAt:Date.now(),ceremonyId:"ca_"+(0,xB.randomBytes)(18).toString("base64url")};return Fc((0,WI.join)(OB(e.env),"pending.json"),JSON.stringify(s)),s}function SRe(e=process.env,t){let r=(t??"").trim().toLowerCase().replace(/[\s_]+/g,"-");if(r&&bRe[r])return bRe[r];let n=D1e(e);return n&&bRe[n]||null}function R_t(e,t){let r=new URL("/agent/enroll/protected-agent",e.webOrigin);return r.searchParams.set("cliChallenge",e.challenge),t&&r.searchParams.set("app",t),r.toString()}function vRe(e){let t=e&&typeof e=="object"?e.name:void 0;return typeof t=="string"?t:""}function yfn(e){try{let t=JSON.parse(e),r=t&&typeof t=="object"&&!Array.isArray(t)?t:{},n=i=>typeof i=="string"&&_fn.test(i)?i:null;return{code:n(r.code),reason:n(r.reason),purchaseId:r.reason==="terms_conflict"&&typeof r.purchaseId=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(r.purchaseId)?r.purchaseId:null}}catch{return{code:null,reason:null}}}async function TRe(e,t,r,n,i="Protected authority",o=hfn,s={}){let a;try{a=await n(KI(e)+t,{method:"POST",headers:{...s,"content-type":"application/json","X-Source":"cli","X-Visa-CLI-Version":lfn,...Yk()},body:(0,w8.canonicalJson)(JSON.parse(JSON.stringify(r))),redirect:"error",signal:AbortSignal.timeout(o)})}catch(u){let d=vRe(u);throw new Yy(i,d==="TimeoutError"||d==="AbortError"?"timeout":"network",o)}if(!a.ok){let u={code:null,reason:null};try{let d=await a.text();d.length<=262144&&(u=yfn(d))}catch{}throw new I8(i,a.status,u.code,u.reason,u.purchaseId)}let c;try{c=await a.text()}catch{throw new Yy(i,"response",o)}if(c.length>262144)throw new Yy(i,"response",o);try{return JSON.parse(c)}catch{throw new Yy(i,"response",o)}}function bfn(e,t=fetch){return KI(e),{financialRuntimeRequest:(r,n)=>TRe(e,`/v1/financial-runtime/${r}`,n,t)}}async function N_t(e,t,r=fetch){if(e.transportProfileId!==(Bu(t)?.profileId??null))throw new Error("Protected enrollment transport profile changed");if(e.binding)return A_t(e,e.binding,t),e.binding;let n=await TRe(e.executionOrigin,"/v1/enrollment/cli-claim",{verifier:e.verifier},r);if(n?.ok!==!0)throw new Error("Protected authority refused enrollment pickup");if(n.result?.status==="pending")return null;let i=n.result;return ERe(i,e.challenge,TS(e.verifier)),e.ceremonyId=i.ceremonyId,e.binding=i,Fc((0,WI.join)(OB(t),"pending.json"),JSON.stringify(e)),A_t(e,i,t),i}function A_t(e,t,r){let n={v:1,authorityOrigin:e.authorityOrigin,executionOrigin:e.executionOrigin,transportProfileId:e.transportProfileId,binding:t},i=(0,WI.join)(OB(r),`${t.agentId}.json`),o=Xl(i);if(o!==null&&(0,w8.canonicalJson)(JSON.parse(o))!==(0,w8.canonicalJson)(n))throw new Error("Protected agent selection changed");Fc(i,JSON.stringify(n))}function C_t(e,t=fetch){let r=bfn(e.executionOrigin,t);return{financialRuntimeRequest:async(n,i)=>{let o=n==="execute"?await TRe(e.executionOrigin,"/v1/financial-runtime/execute",i,t,"Protected policy transport",gfn):await r.financialRuntimeRequest(n,i);if(n==="device-context"){let s=e.binding;if(o.agentId!==s.agentId||o.ownerPublicId!==s.ownerPublicId||o.associationId!==s.associationId||o.associationVersion!==s.associationVersion||o.rootJkt!==s.rootJkt||o.rootKid!==s.rootKid||o.organizationId!==s.organizationId||(0,w8.canonicalJson)(o.rootPublicJwk)!==(0,w8.canonicalJson)(s.rootPublicJwk))throw new Error("Protected device context differs from the independently claimed owner")}return o}}}function Efn(e){let t=OB(e);return(0,kte.readdirSync)(t).filter(r=>A8.test(r.replace(/\.json$/,""))&&r.endsWith(".json")).flatMap(r=>{let n=Xl((0,WI.join)(t,r));if(n===null)return[];let i=JSON.parse(n);if(i.v!==1||KI(i.authorityOrigin)!==i.authorityOrigin||KI(i.executionOrigin)!==i.executionOrigin||i.binding.agentId+".json"!==r)throw new Error("Protected selection is invalid");return ERe(i.binding,i.binding.challenge,i.binding.confirmCode),[i]})}function RB(e){let t=Bu(e)?.profileId??null;return Efn(e).filter(r=>r.transportProfileId===t)}var xB,kte,WI,I_t,w8,lfn,A8,P_t,x_t,ffn,bRe,hfn,gfn,Yy,I8,_fn,NB=A(()=>{"use strict";T8();xB=require("node:crypto"),kte=require("node:fs"),WI=require("node:path"),I_t=ie(Eh()),w8=ie(gS());CK();L1e();mS();q_();o6();Zl();kd();IK();lfn="5.0.0-rc.356",A8=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,P_t=/^[A-Za-z0-9_-]{43}$/,x_t=e=>(0,xB.createHash)("sha256").update(e).digest("base64url");ffn=9e5;bRe={"claude-code":"claude",codex:"codex",openclaw:"openclaw",hermes:"hermes"};hfn=2e4,gfn=12e4,Yy=class extends Error{constructor(r,n,i){super(n==="timeout"?`${r} timed out after ${Math.round(i/1e3)} s`:n==="response"?`${r} answered, but the answer could not be read`:`${r} could not be reached`);this.reason=n;this.name="ProtectedAuthorityTransportError"}reason},I8=class extends Error{constructor(r,n,i,o=null,s=null){super(`${r} refused this request (HTTP ${n}${i?`, ${i}`:""})`);this.status=n;this.code=i;this.reason=o;this.purchaseId=s;this.name="ProtectedAuthorityRefusedError"}status;code;reason;purchaseId};_fn=/^[a-z][a-z0-9_]{0,63}$/});var q_t=_(Pe=>{"use strict";Object.defineProperty(Pe,"__esModule",{value:!0});Pe.JOURNAL_ENVELOPE_V3_ENV=Pe.INTENT_NARRATIVE_USER_REQUEST_MAX=Pe.VALID_JOURNAL_CURRENCIES=Pe.TransactionIntentJournalError=Pe.INTENT_NARRATIVE_SCHEMA=Pe.INTENT_ALTERNATIVES_MAX=Pe.VALID_INTENT_DISCOVERY_SOURCES=Pe.INTENT_DISCOVERY_SOURCES=Pe.VALID_INTENT_INITIATORS=Pe.INTENT_INITIATORS=Pe.VALID_INTENT_CATEGORIES=Pe.INTENT_CATEGORIES=Pe.SUPPORTED_TRANSACTION_INTENT_JOURNAL_VERSIONS=Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED=Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED=Pe.TRANSACTION_INTENT_JOURNAL_VERSION=void 0;Pe.findNarrativePersonalData=L_t;Pe.validateIntentNarrative=U_t;Pe.journalEnvelopeV3Enabled=Afn;Pe.journalEnvelopeSalted=wfn;Pe.userIntentHash=Ifn;Pe.newUserIntentSalt=Pfn;Pe.saltedUserIntentHash=B_t;Pe.transactionIntentJournalHash=xfn;Pe.parseTransactionIntentJournalV1=j_t;Pe.buildTransactionIntentJournal=Ofn;var Lte=require("node:crypto"),Sfn=G_();Pe.TRANSACTION_INTENT_JOURNAL_VERSION=1;Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED=2;Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED=3;Pe.SUPPORTED_TRANSACTION_INTENT_JOURNAL_VERSIONS=[Pe.TRANSACTION_INTENT_JOURNAL_VERSION,Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED,Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED];Pe.INTENT_CATEGORIES=["api_inference","api_data","compute_storage","media_content","software_subscription","digital_goods","physical_goods","service_booking","donation_tip","other"];Pe.VALID_INTENT_CATEGORIES=new Set(Pe.INTENT_CATEGORIES);Pe.INTENT_INITIATORS=["user_explicit","agent_derived"];Pe.VALID_INTENT_INITIATORS=new Set(Pe.INTENT_INITIATORS);Pe.INTENT_DISCOVERY_SOURCES=["user_supplied","wallet_discover","wallet_directory","merchant_challenge","ucp","other"];Pe.VALID_INTENT_DISCOVERY_SOURCES=new Set(Pe.INTENT_DISCOVERY_SOURCES);Pe.INTENT_ALTERNATIVES_MAX=1e3;Pe.INTENT_NARRATIVE_SCHEMA={type:"object",description:"REQUIRED. What the user asked for, and what this purchase buys. Recorded as audit evidence and checked by the policy engine against the payment that follows \u2014 drift between what you state here and what you pay is refused. Write the way a human would want this to read on a statement six months from now: name the thing, not the transaction. Keep personal details \u2014 names, addresses, email addresses, account numbers, order numbers \u2014 OUT of product, purpose and expectedResult; those three are stored as written.",properties:{userRequest:{type:"string",description:"The user's own request that this purchase fulfils, verbatim or tightly summarized. It never leaves this machine: only a salted hash of it is sent."},product:{type:"string",description:'What is being bought, in plain words a human would recognize \u2014 "four hours of GPU time", "one stock photo licence", "50k tokens of image captioning". Not the URL, and not "API call".'},category:{type:"string",enum:[...Pe.INTENT_CATEGORIES],description:"Which kind of purchase this is. Pick the closest one; use other only when none of the others fits, not when the choice is merely hard."},purpose:{type:"string",description:"Why this purchase advances the user's goal \u2014 the reason for it, not a restatement of the product."},quantity:{type:"integer",description:"How many units are being bought. Defaults to 1 when omitted."},expectedResult:{type:"string",description:"What you expect to receive for the money: the artifact, the access, or the outcome."},recurring:{type:"boolean",description:"true when this purchase repeats on a schedule, such as a subscription. false for a one-off."},initiator:{type:"string",enum:[...Pe.INTENT_INITIATORS],description:"user_explicit when the user asked for this purchase; agent_derived when you concluded it was needed. Answer honestly \u2014 this records who decided, and neither answer is better than the other."},discoveredVia:{type:"string",enum:[...Pe.INTENT_DISCOVERY_SOURCES],description:"How you found this merchant: user_supplied when the user named it, wallet_discover or wallet_directory when a Visa CLI search found it, merchant_challenge when you already had the 402, ucp for a UCP handoff, otherwise other."},alternativesConsidered:{type:"integer",description:`How many other options you weighed before choosing this one. 0 is a real answer, not a missing one. At most ${Pe.INTENT_ALTERNATIVES_MAX}.`}},required:["userRequest","product","category"],additionalProperties:!1};var P8=class extends Error{code;constructor(t,r){super(r),this.code=t,this.name="TransactionIntentJournalError"}};Pe.TransactionIntentJournalError=P8;var M_t=/^[A-Za-z0-9_-]{43}$/,k_t=/^[1-9][0-9]*$/;Pe.VALID_JOURNAL_CURRENCIES=new Set(["USD","USDC"]);function Ps(e,t){throw new P8(e,t)}function CB(e,t){return(!e||typeof e!="object"||Array.isArray(e))&&Ps("invalid_journal",`${t} must be an object`),e}function MB(e,t,r=[]){for(let n of Object.keys(e))!t.includes(n)&&!r.includes(n)&&Ps("invalid_journal",`unknown journal field: ${n}`);for(let n of t)e[n]===void 0&&Ps("invalid_journal",`missing journal field: ${n}`)}function D_t(e,t){let r=Js(e,t,2048),n;try{n=new URL(r)}catch{Ps("invalid_journal",`${t} must be an absolute http(s) URL`)}return n.protocol!=="https:"&&n.protocol!=="http:"&&Ps("invalid_journal",`${t} must be an absolute http(s) URL`),r}function Js(e,t,r){return(typeof e!="string"||e.length===0||e.length>r)&&Ps("invalid_journal",`${t} must be a non-empty string of at most ${r} characters`),/[\u0000-\u001f\u007f]/.test(e)&&Ps("invalid_journal",`${t} must not contain control characters`),e}Pe.INTENT_NARRATIVE_USER_REQUEST_MAX=2e3;var vfn=[[/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/,"an email address"],[/\b(?:\+?1[\s.-]?)?\(?\d{3}\)?[\s.-]?\d{3}[\s.-]?\d{4}\b/,"a phone number"],[/\b\d{1,5}\s+[A-Za-z][A-Za-z.'-]*(?:\s+[A-Za-z][A-Za-z.'-]*)*\s+(?:Street|St|Avenue|Ave|Road|Rd|Lane|Ln|Drive|Dr|Boulevard|Blvd|Court|Ct|Way|Terrace|Place|Pl)\b\.?/i,"a street address"]];function Tfn(e){for(let t of e.match(/\b(?:\d[ -]?){13,19}\b/g)??[]){let r=t.replace(/\D/g,"");if(r.length<13||r.length>19)continue;let n=0,i=!1;for(let o=r.length-1;o>=0;o--){let s=r.charCodeAt(o)-48;i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}if(n%10===0)return!0}return!1}function L_t(e){let t=vfn.filter(([r])=>r.test(e)).map(([,r])=>r);return Tfn(e)&&t.push("a card or account number"),t}function Dte(e,t,r,{stored:n=!1}={}){if(typeof e!="string"||e.length===0)return{ok:!1,message:`intent.${t} must be a non-empty string.`};if(e.length>r)return{ok:!1,message:`intent.${t} must be at most ${r} characters.`};if(/[\u0000-\u001f\u007f]/.test(e))return{ok:!1,message:`intent.${t} must not contain control characters.`};if(n){let i=L_t(e);if(i.length>0)return{ok:!1,message:`intent.${t} contains ${i.join(" and ")}. product, purpose and expectedResult are stored as written \u2014 describe what was bought and leave the person's details in userRequest, which is committed by a hash and never leaves this machine.`}}return{ok:!0,value:e}}function U_t(e){if(!e||typeof e!="object"||Array.isArray(e))return{ok:!1,message:"intent must be an object with userRequest and product."};let t=e;for(let o of Object.keys(t))if(!["userRequest","product","purpose","quantity","expectedResult","recurring","category","initiator","discoveredVia","alternativesConsidered"].includes(o))return{ok:!1,message:`intent.${o} is not a recognized field.`};let r=Dte(t.userRequest,"userRequest",Pe.INTENT_NARRATIVE_USER_REQUEST_MAX);if(!r.ok)return r;let n=Dte(t.product,"product",512,{stored:!0});if(!n.ok)return n;if(typeof t.category!="string"||!Pe.VALID_INTENT_CATEGORIES.has(t.category))return{ok:!1,message:`intent.category is required and must be one of: ${Pe.INTENT_CATEGORIES.join(", ")}.`};let i={userRequest:r.value,product:n.value,category:t.category};if(t.purpose!==void 0){let o=Dte(t.purpose,"purpose",512,{stored:!0});if(!o.ok)return o;i.purpose=o.value}if(t.expectedResult!==void 0){let o=Dte(t.expectedResult,"expectedResult",512,{stored:!0});if(!o.ok)return o;i.expectedResult=o.value}if(t.quantity!==void 0){let o=t.quantity;if(typeof o!="number"||!Number.isSafeInteger(o)||o<1||o>1e6)return{ok:!1,message:"intent.quantity must be a whole number from 1 to 1000000."};i.quantity=o}if(t.initiator!==void 0){if(typeof t.initiator!="string"||!Pe.VALID_INTENT_INITIATORS.has(t.initiator))return{ok:!1,message:`intent.initiator must be one of: ${Pe.INTENT_INITIATORS.join(", ")}.`};i.initiator=t.initiator}if(t.discoveredVia!==void 0){if(typeof t.discoveredVia!="string"||!Pe.VALID_INTENT_DISCOVERY_SOURCES.has(t.discoveredVia))return{ok:!1,message:`intent.discoveredVia must be one of: ${Pe.INTENT_DISCOVERY_SOURCES.join(", ")}.`};i.discoveredVia=t.discoveredVia}if(t.alternativesConsidered!==void 0){let o=t.alternativesConsidered;if(typeof o!="number"||!Number.isSafeInteger(o)||o<0||o>Pe.INTENT_ALTERNATIVES_MAX)return{ok:!1,message:`intent.alternativesConsidered must be a whole number from 0 to ${Pe.INTENT_ALTERNATIVES_MAX}.`};i.alternativesConsidered=o}if(t.recurring!==void 0){if(typeof t.recurring!="boolean")return{ok:!1,message:"intent.recurring must be true or false."};i.recurring=t.recurring}return{ok:!0,narrative:i}}Pe.JOURNAL_ENVELOPE_V3_ENV="VISA_JOURNAL_V3";function Afn(e=process.env){return e[Pe.JOURNAL_ENVELOPE_V3_ENV]!=="false"}function wfn(e=process.env){return!0}function Ifn(e){return(0,Lte.createHash)("sha256").update(e,"utf8").digest("base64url")}function Pfn(){return(0,Lte.randomBytes)(32).toString("base64url")}function B_t(e,t){return(0,Lte.createHash)("sha256").update(`visa-user-intent:v2:${e}:${t}`,"utf8").digest("base64url")}function xfn(e){return(0,Lte.createHash)("sha256").update((0,Sfn.canonicalJson)(e),"utf8").digest("base64url")}function j_t(e){let t=CB(e,"journal");t.v!==Pe.TRANSACTION_INTENT_JOURNAL_VERSION&&t.v!==Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED&&t.v!==Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED&&Ps("invalid_journal","unsupported journal version");let r=t.v===Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED,n=t.v===Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED||r;MB(t,["v","userIntent","product","quantity","merchant","amountMicros","recurrence","endpoint","economicIntentId","executionPayloadHash",...n?["currency"]:[],...r?["category"]:[]],["purpose","maxPriceMicros","payee","expectedResult",...r?["initiator","discoveredVia","alternativesConsidered"]:[]]);let i=CB(t.userIntent,"userIntent");MB(i,["kind","hash"]),i.kind!=="agent_attested"&&Ps("invalid_journal","userIntent.kind must be agent_attested");let o=Js(i.hash,"userIntent.hash",43);M_t.test(o)||Ps("invalid_journal","userIntent.hash must be sha256 base64url");let s;n&&(s=Js(t.currency,"currency",10),Pe.VALID_JOURNAL_CURRENCIES.has(s)||Ps("invalid_journal","currency must be one of USD, USDC"));let a,c,u,d;if(r){let E=Js(t.category,"category",64);if(Pe.VALID_INTENT_CATEGORIES.has(E)||Ps("invalid_journal",`category must be one of ${Pe.INTENT_CATEGORIES.join(", ")}`),a=E,t.initiator!==void 0){let T=Js(t.initiator,"initiator",64);Pe.VALID_INTENT_INITIATORS.has(T)||Ps("invalid_journal",`initiator must be one of ${Pe.INTENT_INITIATORS.join(", ")}`),c=T}if(t.discoveredVia!==void 0){let T=Js(t.discoveredVia,"discoveredVia",64);Pe.VALID_INTENT_DISCOVERY_SOURCES.has(T)||Ps("invalid_journal",`discoveredVia must be one of ${Pe.INTENT_DISCOVERY_SOURCES.join(", ")}`),u=T}if(t.alternativesConsidered!==void 0){let T=t.alternativesConsidered;(typeof T!="number"||!Number.isSafeInteger(T)||T<0||T>Pe.INTENT_ALTERNATIVES_MAX)&&Ps("invalid_journal",`alternativesConsidered must be an integer from 0 to ${Pe.INTENT_ALTERNATIVES_MAX}`),d=T}}let l=Js(t.product,"product",512);(typeof t.quantity!="number"||!Number.isSafeInteger(t.quantity)||t.quantity<1||t.quantity>1e6)&&Ps("invalid_journal","quantity must be a positive integer");let p=CB(t.merchant,"merchant");MB(p,["url"],["id","name"]);let f=D_t(p.url,"merchant.url"),m=Js(t.amountMicros,"amountMicros",40);k_t.test(m)||Ps("invalid_journal","amountMicros must be a canonical positive integer string");let h;t.maxPriceMicros!==void 0&&(h=Js(t.maxPriceMicros,"maxPriceMicros",40),k_t.test(h)||Ps("invalid_journal","maxPriceMicros must be a canonical positive integer string")),t.recurrence!=="one_time"&&t.recurrence!=="recurring"&&Ps("invalid_journal","recurrence must be one_time or recurring");let g=CB(t.endpoint,"endpoint");MB(g,["tool"],["url"]);let y=Js(g.tool,"endpoint.tool",128),S;if(t.payee!==void 0){let E=CB(t.payee,"payee");MB(E,["address","network"],["asset"]),S={address:Js(E.address,"payee.address",256),network:Js(E.network,"payee.network",64),...E.asset===void 0?{}:{asset:Js(E.asset,"payee.asset",256)}}}let b=Js(t.executionPayloadHash,"executionPayloadHash",43);return M_t.test(b)||Ps("invalid_journal","executionPayloadHash must be sha256 base64url"),{v:t.v,userIntent:{kind:"agent_attested",hash:o},product:l,quantity:t.quantity,merchant:{url:f,...p.id===void 0?{}:{id:Js(p.id,"merchant.id",512)},...p.name===void 0?{}:{name:Js(p.name,"merchant.name",255)}},...t.purpose===void 0?{}:{purpose:Js(t.purpose,"purpose",512)},amountMicros:m,...s===void 0?{}:{currency:s},...h===void 0?{}:{maxPriceMicros:h},recurrence:t.recurrence,endpoint:{tool:y,...g.url===void 0?{}:{url:D_t(g.url,"endpoint.url")}},...S===void 0?{}:{payee:S},...t.expectedResult===void 0?{}:{expectedResult:Js(t.expectedResult,"expectedResult",512)},...a===void 0?{}:{category:a},...c===void 0?{}:{initiator:c},...u===void 0?{}:{discoveredVia:u},...d===void 0?{}:{alternativesConsidered:d},economicIntentId:Js(t.economicIntentId,"economicIntentId",256),executionPayloadHash:b}}function Ofn(e,t){let{userIntentSalt:r,userIntentHash:n,...i}=e,o=U_t(n?{...i,userRequest:"committed"}:i);if(!o.ok)throw new P8("invalid_journal",o.message);let s=t.categorized!==!1,a;if(n)a=n;else if(r)a=B_t(r,o.narrative.userRequest);else throw new P8("invalid_journal","a journal needs either a client-held userIntentSalt or a precomputed userIntentHash; the tool boundary mints one and keeps it");let c={v:s?Pe.TRANSACTION_INTENT_JOURNAL_VERSION_CATEGORIZED:Pe.TRANSACTION_INTENT_JOURNAL_VERSION_SALTED,userIntent:{kind:"agent_attested",hash:a},product:o.narrative.product,quantity:o.narrative.quantity??1,merchant:{url:t.merchantUrl,...t.merchantId?{id:t.merchantId}:{},...t.merchantName?{name:t.merchantName}:{}},...o.narrative.purpose?{purpose:o.narrative.purpose}:{},amountMicros:t.amountMicros,...t.currency?{currency:t.currency}:{},...t.maxPriceMicros?{maxPriceMicros:t.maxPriceMicros}:{},recurrence:o.narrative.recurring?"recurring":"one_time",endpoint:{tool:t.endpointTool,...t.endpointUrl?{url:t.endpointUrl}:{}},...t.payee?{payee:t.payee}:{},...o.narrative.expectedResult?{expectedResult:o.narrative.expectedResult}:{},...s?{category:o.narrative.category,...o.narrative.initiator?{initiator:o.narrative.initiator}:{},...o.narrative.discoveredVia?{discoveredVia:o.narrative.discoveredVia}:{},...o.narrative.alternativesConsidered!==void 0?{alternativesConsidered:o.narrative.alternativesConsidered}:{}}:{},economicIntentId:t.economicIntentId,executionPayloadHash:t.executionPayloadHash};return j_t(c)}});var ARe=_(vh=>{"use strict";Object.defineProperty(vh,"__esModule",{value:!0});vh.formatCents=V_t;vh.formatUsd=Nfn;vh.formatMicros=Ute;vh.formatMicrosWire=Cfn;vh.formatTxAmount=Mfn;vh.formatDate=kfn;vh.formatRelativeTime=Dfn;vh.formatTime=Lfn;vh.formatAge=Ufn;var H_t=1e6,Rfn=100;function V_t(e,t={}){let r=t.fallback??"\u2014";if(e==null||!Number.isFinite(e))return r;let i=(e/Rfn).toLocaleString("en-US",{style:"currency",currency:"USD",minimumFractionDigits:t.minimumFractionDigits??2,maximumFractionDigits:t.maximumFractionDigits??2});return t.showPlusSign&&e>0?`+${i}`:i}function Nfn(e,t={}){let r=t.fallback??"\u2014";if(e==null||!Number.isFinite(e))return r;let n=e.toLocaleString("en-US",{style:"currency",currency:"USD",minimumFractionDigits:t.minimumFractionDigits??2,maximumFractionDigits:t.maximumFractionDigits??2});return t.showPlusSign&&e>0?`+${n}`:n}function Ute(e,t={}){let r=t.fallback??"\u2014",n=typeof e=="string"?e===""?null:Number(e):e;if(n==null||!Number.isFinite(n))return r;let o=(n/H_t).toLocaleString("en-US",{style:"currency",currency:"USD",minimumFractionDigits:t.minimumFractionDigits??2,maximumFractionDigits:t.maximumFractionDigits??6});return t.showPlusSign&&n>0?`+${o}`:o}function Cfn(e,t,r={}){return e&&/^-?\d+$/.test(e)?Ute(e,r):t!=null&&Number.isFinite(t)?V_t(t,r):r.fallback??"\u2014"}function Mfn(e,t={}){let r=Number(e.amount_micros);if(Number.isFinite(r)&&e.amount_micros!=null&&e.amount_micros!=="")return Ute(r,t);let n=Number(String(e.amount).replace(/^\$/,""));return Number.isFinite(n)?Ute(n*H_t,t):t.fallback??"\u2014"}function kfn(e,t={}){let r=t.fallback??"\u2014";if(!e)return r;let n=new Date(e);return Number.isNaN(n.getTime())?r:n.toLocaleDateString("en-US",{month:"short",day:"numeric",year:"numeric",timeZone:t.timeZone??"UTC"})}function Dfn(e,t=Date.now()){if(!e)return"\u2014";let r=Date.parse(e);if(Number.isNaN(r))return"\u2014";let n=t-r,i=n>=0,o=Math.abs(n),s=Math.floor(o/1e3),a=Math.floor(s/60),c=Math.floor(a/60),u=Math.floor(c/24),d=Math.floor(u/7),l=Math.floor(u/30),p=Math.floor(u/365);return s<45?"just now":a<1?i?"a minute ago":"in a minute":a<60?x8(n,i,a,"minute"):c<24?x8(n,i,c,"hour"):u===1?i?"yesterday":"tomorrow":u<7?x8(n,i,u,"day"):d<4?x8(n,i,d,"week"):l<12?x8(n,i,l,"month"):x8(n,i,p,"year")}function x8(e,t,r,n){let i=r!==1?"s":"";return t?`${r} ${n}${i} ago`:`in ${r} ${n}${i}`}function Lfn(e,t={}){let r=t.fallback??"\u2014";if(!e)return r;let n=new Date(e);return Number.isNaN(n.getTime())?r:n.toLocaleString("en-US",{month:"short",day:"numeric",year:"numeric",hour:"2-digit",minute:"2-digit",timeZone:t.timeZone??"UTC"})}function Ufn(e,t){if(!e)return"";let r=Date.parse(e);if(Number.isNaN(r))return"";let n=Math.max(0,t-r),i=Math.floor(n/1e3);if(i<45)return"just now";let o=Math.floor(i/60);if(o<60)return`${o}m ago`;let s=Math.floor(o/60);if(s<24)return`${s}h ago`;let a=Math.floor(s/24);if(a<30)return`${a}d ago`;let c=Math.floor(a/30);return c<12?`${c}mo ago`:`${Math.floor(a/365)}y ago`}});var wRe=_(Wr=>{"use strict";Object.defineProperty(Wr,"__esModule",{value:!0});Wr.AGENT_GRANT_MAX_PER_PURCHASE_CENTS=Wr.AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS=Wr.AGENT_GRANT_MIN_LIMIT_MICROS=Wr.AGENT_GRANT_MAX_PER_PURCHASE_MICROS=Wr.AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS=Wr.MPP_PAYMENT_MAX_MICROS=Wr.MPP_PAYMENT_MIN_MICROS=Wr.DEFAULT_SESSION_CAP_MICROS=Wr.MAX_MERCHANT_PRICE_MICROS=Wr.MIN_MERCHANT_PRICE_MICROS=Wr.DEFAULT_AUTOTOPUP_THRESHOLD_MICROS=Wr.DEFAULT_DAILY_CAP_MICROS=Wr.MIN_TOPUP_RETRY_FLOOR_MICROS=Wr.MIN_TOPUP_MICROS=Wr.MIN_SETTLEMENT_MICROS=void 0;var yp=Rg();Wr.MIN_SETTLEMENT_MICROS=(0,yp.micros)(10000000n);Wr.MIN_TOPUP_MICROS=(0,yp.micros)(1000000n);Wr.MIN_TOPUP_RETRY_FLOOR_MICROS=(0,yp.micros)(1000000n);Wr.DEFAULT_DAILY_CAP_MICROS=(0,yp.micros)(5000000n);Wr.DEFAULT_AUTOTOPUP_THRESHOLD_MICROS=(0,yp.micros)(5000000n);Wr.MIN_MERCHANT_PRICE_MICROS=(0,yp.micros)(0n);Wr.MAX_MERCHANT_PRICE_MICROS=(0,yp.micros)(10000000000n);Wr.DEFAULT_SESSION_CAP_MICROS=(0,yp.micros)(5000000n);Wr.MPP_PAYMENT_MIN_MICROS=(0,yp.micros)(10000n);Wr.MPP_PAYMENT_MAX_MICROS=(0,yp.micros)(1000000000n);Wr.AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS=(0,yp.micros)(1000000000n);Wr.AGENT_GRANT_MAX_PER_PURCHASE_MICROS=(0,yp.micros)(50000000n);Wr.AGENT_GRANT_MIN_LIMIT_MICROS=(0,yp.micros)(1000n);Wr.AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS=1e5;Wr.AGENT_GRANT_MAX_PER_PURCHASE_CENTS=5e3});var K_t=_(bp=>{"use strict";Object.defineProperty(bp,"__esModule",{value:!0});bp.MAX_BUDGET_DRAWS=void 0;bp.derivePurchaseCountDetail=$_t;bp.derivePurchaseCountDetailMicros=z_t;bp.derivePurchaseCount=G_t;bp.describePurchaseCount=Hfn;bp.describePurchaseCountMicros=Vfn;var O8=ARe(),Bfn=wRe();bp.MAX_BUDGET_DRAWS=20;function F_t(e,t){if(!Number.isSafeInteger(t)||t<=0)throw new TypeError(`${e}: expected a positive safe integer of cents, got ${t}`)}function $_t(e,t){F_t("aggregateCeilingCents",e),F_t("perPurchaseCents",t);let r=Math.ceil(e/t),n=Math.max(1,Math.min(bp.MAX_BUDGET_DRAWS,r)),i=r>bp.MAX_BUDGET_DRAWS;return{count:n,clamped:i,unreachableCents:i?e-n*t:0}}function kB(e,t){if(!/^[1-9]\d{0,18}$/.test(t))throw new TypeError(`${e}: expected canonical positive integer micros, got ${t}`);return BigInt(t)}function z_t(e,t){let r=kB("aggregateCeilingMicros",e),n=kB("perPurchaseMicros",t),i=(r+n-1n)/n,o=Math.max(1,Math.min(bp.MAX_BUDGET_DRAWS,Number(i))),s=i>BigInt(bp.MAX_BUDGET_DRAWS);return{count:o,clamped:s,unreachableMicros:s?(r-BigInt(o)*n).toString():"0"}}function G_t(e,t){return $_t(e,t).count}function jfn(e){let t=[Math.floor(e/5),Math.floor(e/4),Math.floor(e/2)].filter(r=>r>=1);for(let r of t){let n=G_t(e,r);if(n>=2)return{perCents:r,count:n}}return null}function qfn(e){let t=kB("aggregateCeilingMicros",e),r=[t/5n,t/4n,t/2n].filter(n=>n>=Bfn.AGENT_GRANT_MIN_LIMIT_MICROS);for(let n of r){let i=z_t(e,n.toString()).count;if(i>=2)return{perMicros:n.toString(),count:i}}return null}function Hfn(e,t,r){let n=(0,O8.formatCents)(t);if(e.clamped)return`This budget covers ${e.count} purchases \u2014 the most one budget allows. Each can be up to ${n}. ${(0,O8.formatCents)(e.unreachableCents)} of the total can never be spent. Raise the per-purchase amount to use all of it.`;if(e.count===1){let i=jfn(r),o=i?` Lower the per-purchase amount to allow more purchases \u2014 ${(0,O8.formatCents)(i.perCents)} allows ${i.count}.`:" Lower the per-purchase amount to allow more purchases.";return`This budget covers 1 purchase of up to ${n}. A smaller charge still uses that one purchase, and leftover budget sits unused.${o}`}return`This budget covers ${e.count} purchases. Each can be up to ${n}. Smaller charges are fine \u2014 each one still counts as a purchase.`}function Vfn(e,t,r){kB("perPurchaseMicros",t),kB("aggregateCeilingMicros",r);let n=(0,O8.formatMicros)(t);if(e.clamped)return`This budget covers ${e.count} purchases \u2014 the most one budget allows. Each can be up to ${n}. ${(0,O8.formatMicros)(e.unreachableMicros)} of the total can never be spent. Raise the per-purchase amount to use all of it.`;if(e.count===1){let i=qfn(r),o=i?` Lower the per-purchase amount to allow more purchases \u2014 ${(0,O8.formatMicros)(i.perMicros)} allows ${i.count}.`:" Lower the per-purchase amount to allow more purchases.";return`This budget covers 1 purchase of up to ${n}. A smaller charge still uses that one purchase, and leftover budget sits unused.${o}`}return`This budget covers ${e.count} purchases. Each can be up to ${n}. Smaller charges are fine \u2014 each one still counts as a purchase.`}});var Rg=_(ut=>{"use strict";Object.defineProperty(ut,"__esModule",{value:!0});ut.describePurchaseCountMicros=ut.describePurchaseCount=ut.derivePurchaseCountDetailMicros=ut.derivePurchaseCountDetail=ut.derivePurchaseCount=ut.MAX_BUDGET_DRAWS=ut.AGENT_GRANT_MAX_PER_PURCHASE_CENTS=ut.AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS=ut.AGENT_GRANT_MIN_LIMIT_MICROS=ut.AGENT_GRANT_MAX_PER_PURCHASE_MICROS=ut.AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS=ut.formatAge=ut.formatTime=ut.formatRelativeTime=ut.formatDate=ut.formatTxAmount=ut.formatMicrosWire=ut.formatMicros=ut.formatUsd=ut.formatCents=void 0;ut.micros=Ffn;ut.fromCents=$fn;ut.fromUsdc=zfn;ut.fromUsd=Gfn;ut.toCents=Kfn;ut.toCentsForAcquirer=Wfn;ut.toUsdc=Yfn;ut.toWire=Jfn;ut.fromWire=Xfn;ut.toDisplay=Zfn;ut.toUsdRounded2dp=Qfn;ut.add=emn;ut.sub=tmn;ut.clampNonNegative=rmn;ut.isNonNegative=nmn;ut.max=imn;ut.min=omn;var Jy=10000n,W_t=1000000n;function Ffn(e){return e}function $fn(e){if(!Number.isFinite(e)||!Number.isInteger(e)||!Number.isSafeInteger(e))throw new TypeError(`fromCents: expected safe integer, got ${e}`);return BigInt(e)*Jy}function zfn(e){return e}function Gfn(e){if(!Number.isFinite(e))throw new TypeError(`fromUsd: expected finite number, got ${e}`);return BigInt(Math.round(e*1e6))}function Kfn(e){if(e>=0n)return Number(e/Jy);let t=e/Jy,r=e%Jy;return Number(r===0n?t:t-1n)}function Wfn(e){if(e<0n)throw new RangeError(`toCentsForAcquirer: refusing negative micros (${e}); card charges are non-negative`);return Number(e/Jy)}function Yfn(e){return e}function Jfn(e){return e.toString()}function Xfn(e){if(typeof e!="string"||e.length===0)throw new TypeError(`fromWire: expected non-empty string, got ${typeof e} ${JSON.stringify(e)}`);if(!/^-?\d+$/.test(e))throw new TypeError(`fromWire: not a valid micros integer: ${JSON.stringify(e)}`);return BigInt(e)}function Zfn(e,t={}){let r=t.decimals??2,n=t.symbol??"$",i=e<0n,o=i?-e:e,s=o/W_t,a=o%W_t,c=i?"-":"";if(r===0)return`${c}${n}${s.toString()}`;let u=a.toString().padStart(6,"0").slice(0,r);return`${c}${n}${s.toString()}.${u}`}function Qfn(e){let t=e<0n,r=t?-e:e,n=r/Jy,o=r%Jy*2n,s;o<Jy?s=n:o>Jy?s=n+1n:s=n%2n===0n?n:n+1n;let a=Number(s)/100;return t?-a:a}function emn(e,t){return e+t}function tmn(e,t){return e-t}function rmn(e){return e<0n?0n:e}function nmn(e){return e>=0n}function imn(e,t){return e>t?e:t}function omn(e,t){return e<t?e:t}var Xy=ARe();Object.defineProperty(ut,"formatCents",{enumerable:!0,get:function(){return Xy.formatCents}});Object.defineProperty(ut,"formatUsd",{enumerable:!0,get:function(){return Xy.formatUsd}});Object.defineProperty(ut,"formatMicros",{enumerable:!0,get:function(){return Xy.formatMicros}});Object.defineProperty(ut,"formatMicrosWire",{enumerable:!0,get:function(){return Xy.formatMicrosWire}});Object.defineProperty(ut,"formatTxAmount",{enumerable:!0,get:function(){return Xy.formatTxAmount}});Object.defineProperty(ut,"formatDate",{enumerable:!0,get:function(){return Xy.formatDate}});Object.defineProperty(ut,"formatRelativeTime",{enumerable:!0,get:function(){return Xy.formatRelativeTime}});Object.defineProperty(ut,"formatTime",{enumerable:!0,get:function(){return Xy.formatTime}});Object.defineProperty(ut,"formatAge",{enumerable:!0,get:function(){return Xy.formatAge}});var DB=wRe();Object.defineProperty(ut,"AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MAX_AGGREGATE_CEILING_MICROS}});Object.defineProperty(ut,"AGENT_GRANT_MAX_PER_PURCHASE_MICROS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MAX_PER_PURCHASE_MICROS}});Object.defineProperty(ut,"AGENT_GRANT_MIN_LIMIT_MICROS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MIN_LIMIT_MICROS}});Object.defineProperty(ut,"AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MAX_AGGREGATE_CEILING_CENTS}});Object.defineProperty(ut,"AGENT_GRANT_MAX_PER_PURCHASE_CENTS",{enumerable:!0,get:function(){return DB.AGENT_GRANT_MAX_PER_PURCHASE_CENTS}});var R8=K_t();Object.defineProperty(ut,"MAX_BUDGET_DRAWS",{enumerable:!0,get:function(){return R8.MAX_BUDGET_DRAWS}});Object.defineProperty(ut,"derivePurchaseCount",{enumerable:!0,get:function(){return R8.derivePurchaseCount}});Object.defineProperty(ut,"derivePurchaseCountDetail",{enumerable:!0,get:function(){return R8.derivePurchaseCountDetail}});Object.defineProperty(ut,"derivePurchaseCountDetailMicros",{enumerable:!0,get:function(){return R8.derivePurchaseCountDetailMicros}});Object.defineProperty(ut,"describePurchaseCount",{enumerable:!0,get:function(){return R8.describePurchaseCount}});Object.defineProperty(ut,"describePurchaseCountMicros",{enumerable:!0,get:function(){return R8.describePurchaseCountMicros}})});var MRe=_(Zu=>{"use strict";var smn=Zu&&Zu.__createBinding||(Object.create?(function(e,t,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(t,r);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[r]}}),Object.defineProperty(e,n,i)}):(function(e,t,r,n){n===void 0&&(n=r),e[n]=t[r]})),amn=Zu&&Zu.__setModuleDefault||(Object.create?(function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}):function(e,t){e.default=t}),X_t=Zu&&Zu.__importStar||(function(){var e=function(t){return e=Object.getOwnPropertyNames||function(r){var n=[];for(var i in r)Object.prototype.hasOwnProperty.call(r,i)&&(n[n.length]=i);return n},e(t)};return function(t){if(t&&t.__esModule)return t;var r={};if(t!=null)for(var n=e(t),i=0;i<n.length;i++)n[i]!=="default"&&smn(r,t,n[i]);return amn(r,t),r}})();Object.defineProperty(Zu,"__esModule",{value:!0});Zu.pruneResponsesDir=BB;Zu.isTextualContentType=Bte;Zu.isValidUtf8=ORe;Zu.spillFilename=eyt;Zu.extractPaidImageArtifact=bmn;Zu.describePaidBody=xRe;Zu.capturePaidResponse=Emn;var il=X_t(require("fs")),LB=X_t(require("path")),IRe=require("node:crypto"),Z_t=16*1024,PRe=2*1024,cmn=64*1024*1024,Q_t=32*1024*1024,Y_t=24*1024*1024,umn=2e3,dmn=12,lmn=3e4,UB=256*1024*1024;function BB(e,t=UB,r){try{let n=new Set((typeof r=="string"?[r]:r??[]).map(s=>LB.basename(s))),i=il.readdirSync(e).map(s=>{if(s.includes(".part-"))return null;try{let a=il.statSync(LB.join(e,s));return a.isFile()?{name:s,size:a.size,mtime:a.mtimeMs}:null}catch{return null}}).filter(s=>s!==null).sort((s,a)=>n.has(s.name)&&!n.has(a.name)?-1:n.has(a.name)&&!n.has(s.name)?1:a.mtime-s.mtime),o=0;for(let s of i)if(o+=s.size,o>t&&!n.has(s.name))try{il.rmSync(LB.join(e,s.name),{force:!0})}catch{}}catch{}}var pmn=new Set(["application/json","application/xml","application/javascript","application/x-www-form-urlencoded","application/csv"]);function Bte(e){if(!e)return!1;let t=e.split(";",1)[0].trim().toLowerCase();return t.startsWith("text/")||t.endsWith("+json")||t.endsWith("+xml")||pmn.has(t)}function ORe(e){try{return new TextDecoder("utf-8",{fatal:!0}).decode(e),!0}catch{return!1}}var fmn={"application/json":".json","application/pdf":".pdf","audio/mpeg":".mp3","image/gif":".gif","image/jpeg":".jpg","image/png":".png","image/svg+xml":".svg","image/webp":".webp","text/csv":".csv","text/html":".html","text/plain":".txt","video/mp4":".mp4"};function eyt(e,t,r){let n="unknown-host";try{n=new URL(e).hostname.toLowerCase()}catch{}let i=n.replace(/[^a-z0-9.-]/g,"_").slice(0,80),o=(t??"").split(";",1)[0].trim().toLowerCase(),s=fmn[o]??(Bte(t)?".txt":".bin");return`${r.toISOString().replace(/[:.]/g,"-")}-${i}${s}`}function RRe(e,t,r){let n=eyt(t,r,new Date),i=LB.extname(n),o=n.slice(0,n.length-i.length);return LB.join(e,`${o}-${(0,IRe.randomBytes)(8).toString("hex")}${i}`)}function NRe(e){il.mkdirSync(e,{recursive:!0,mode:448})}var mmn=new Set(["image/gif","image/jpeg","image/png","image/webp"]);function hmn(e){let t=(e??"").split(";",1)[0].trim().toLowerCase();return t==="application/json"||t.endsWith("+json")}function gmn(e,t){if(t==="image/png")return e.length>=8&&e.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]));if(t==="image/jpeg")return e.length>=3&&e[0]===255&&e[1]===216&&e[2]===255;if(t==="image/gif"){if(e.length<6)return!1;let r=e.subarray(0,6).toString("ascii");return r==="GIF87a"||r==="GIF89a"}return e.length>=12&&e.subarray(0,4).toString("ascii")==="RIFF"&&e.subarray(8,12).toString("ascii")==="WEBP"}function _mn(e){if(!e.startsWith("data:image/"))return null;let t=e.indexOf(";base64,");if(t<=5)return null;let r=e.slice(5,t).toLowerCase();if(!mmn.has(r))return null;let n=e.slice(t+8);if(n.length===0||n.length%4!==0||n.length>Math.ceil(Y_t/3)*4)return null;let i=Buffer.from(n,"base64");if(i.length===0||i.length>Y_t||i.toString("base64")!==n)return null;let o=r;return gmn(i,o)?{body:i,mimeType:o}:null}function ymn(e){let t=[{depth:0,value:e}],r=0;for(;t.length>0&&r<umn;){let n=t.pop();if(r+=1,typeof n.value=="string"){let o=_mn(n.value);if(o)return o;continue}if(n.depth>=dmn||!n.value||typeof n.value!="object")continue;let i=Array.isArray(n.value)?n.value:Object.values(n.value);for(let o=i.length-1;o>=0;o-=1)t.push({depth:n.depth+1,value:i[o]})}return null}function bmn(e,t,r,n){let i=CRe(e,t,r,n);return i&&BB(n,UB,[i.path]),i}function CRe(e,t,r,n){if(!hmn(t)||r.length===0||r.length>Q_t||!ORe(r))return null;let i;try{i=JSON.parse(r.toString("utf8"))}catch{return null}let o=ymn(i);if(!o)return null;let s=null;try{NRe(n);let a=RRe(n,e,o.mimeType);return s=`${a}.part-${process.pid}-${(0,IRe.randomBytes)(8).toString("hex")}`,il.writeFileSync(s,o.body,{flag:"wx",mode:384}),il.renameSync(s,a),s=null,{kind:"image",path:a,mimeType:o.mimeType,sha256:(0,IRe.createHash)("sha256").update(o.body).digest("hex"),bytes:o.body.length}}catch{if(s)try{il.rmSync(s,{force:!0})}catch{}return null}}function J_t(e,t){let r=0;for(;r<t.length;){let n=il.writeSync(e,t,r,t.length-r,null);if(n<=0)throw new Error("Paid response file write made no progress.");r+=n}}function xRe(e,t,r,n,i){let o=r?Bte(r):ORe(n),s={status:t,contentType:r??"unknown",bodyBytes:n.length};if(n.length===0)return{...s,body:""};let a=CRe(e,r,n,i);if(o&&n.length<=Z_t)return a&&BB(i,UB,[a.path]),{...s,body:n.toString("utf-8"),...a?{imageArtifact:a}:{}};NRe(i);let c=RRe(i,e,r);return il.writeFileSync(c,n,{flag:"wx",mode:384}),BB(i,UB,a?[c,a.path]:[c]),{...s,bodyFile:c,...a?{imageArtifact:a}:{},...o?{bodyPreview:n.subarray(0,PRe).toString("utf-8")}:{},note:"Body too large or binary to inline \u2014 full paid response written to bodyFile."}}async function Emn(e,t,r,n={}){let i=n.maxBytes??cmn,o=n.timeoutMs??lmn;if(!Number.isSafeInteger(i)||i<=0)throw new Error("Paid response capture maxBytes must be a positive safe integer.");if(!Number.isFinite(o)||o<=0)throw new Error("Paid response capture timeoutMs must be positive.");let s=t.headers.get("content-length");if(s&&/^\d+$/.test(s.trim())){let b=Number(s);if(Number.isSafeInteger(b)&&b>i)throw t.body?.cancel("paid response exceeds capture limit").catch(()=>{}),new Error(`Merchant response body exceeds the ${i}-byte capture limit (declared ${b} bytes).`)}if(!t.body)return xRe(e,t.status,t.headers.get("content-type"),Buffer.alloc(0),r);let a=t.body.getReader(),c=Date.now(),u=[],d=0,l=0,p=null,f=null,m=null,h=[],g=0,y=()=>{p!==null&&(il.closeSync(p),p=null)},S=()=>{if(y(),m)try{il.rmSync(m,{force:!0})}catch{}};try{for(;;){let w=o-(Date.now()-c);if(w<=0)throw new Error(`Merchant response body timed out after ${o}ms.`);let I,N=new Promise((x,D)=>{I=setTimeout(()=>D(new Error(`Merchant response body timed out after ${o}ms.`)),w)}),O;try{O=await Promise.race([a.read(),N])}finally{I&&clearTimeout(I)}if(O.done)break;let P=Buffer.from(O.value);if(l+=P.length,l>i)throw new Error(`Merchant response body exceeded the ${i}-byte capture limit.`);if(g<PRe){let x=P.subarray(0,Math.min(P.length,PRe-g));h.push(Buffer.from(x)),g+=x.length}if(p===null){if(u.push(P),d+=P.length,d<=Z_t)continue;NRe(r),f=RRe(r,e,t.headers.get("content-type")),m=`${f}.part-${process.pid}-${Math.random().toString(16).slice(2)}`,p=il.openSync(m,"wx",384);for(let x of u)J_t(p,x);u.length=0,d=0}else J_t(p,P)}if(p===null){let w=Buffer.concat(u,d);return xRe(e,t.status,t.headers.get("content-type"),w,r)}y(),il.renameSync(m,f),m=null;let b=t.headers.get("content-type"),E=b?Bte(b):!1,T=l<=Q_t?CRe(e,b,il.readFileSync(f),r):null;return BB(r,UB,T?[f,T.path]:[f]),{status:t.status,contentType:b??"unknown",bodyBytes:l,bodyFile:f,...T?{imageArtifact:T}:{},...E?{bodyPreview:Buffer.concat(h).toString("utf-8")}:{},note:"Body too large or binary to inline \u2014 full paid response written to bodyFile."}}catch(b){throw a.cancel("paid response capture failed").catch(()=>{}),S(),b}finally{try{a.releaseLock()}catch{}}}});var N8=_(Ng=>{"use strict";Object.defineProperty(Ng,"__esModule",{value:!0});Ng.hashTypedData=Ng.EIP3009_TYPES=Ng.MAX_DEADLINE_SECONDS=Ng.NETWORKS=void 0;Ng.NETWORKS={"base-mainnet":{id:"base-mainnet",caip2:"eip155:8453",chainId:8453,usdc:{address:"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",eip712Domain:{name:"USD Coin",version:"2"}},rpcUrl:"https://mainnet.base.org",explorerBaseUrl:"https://basescan.org",isTestnet:!1},"base-sepolia":{id:"base-sepolia",caip2:"eip155:84532",chainId:84532,usdc:{address:"0x036CbD53842c5426634e7929541eC2318f3dCF7e",eip712Domain:{name:"USDC",version:"2"}},rpcUrl:"https://sepolia.base.org",explorerBaseUrl:"https://sepolia.basescan.org",isTestnet:!0}};Ng.MAX_DEADLINE_SECONDS=600;Ng.EIP3009_TYPES={TransferWithAuthorization:[{name:"from",type:"address"},{name:"to",type:"address"},{name:"value",type:"uint256"},{name:"validAfter",type:"uint256"},{name:"validBefore",type:"uint256"},{name:"nonce",type:"bytes32"}]};var Smn=ph();Object.defineProperty(Ng,"hashTypedData",{enumerable:!0,get:function(){return Smn.hashTypedData}})});var eT=_(bc=>{"use strict";Object.defineProperty(bc,"__esModule",{value:!0});bc.TURNKEY_API_BASE_URL_ENV=bc.CIRCLE_TESTNET_FAUCET_URL=bc.NETWORK_ENV=bc.NETWORKS=void 0;bc.resolveNetwork=Tmn;bc.turnkeyApiBaseUrl=wmn;bc.explorerTxUrl=Imn;bc.explorerAddressUrl=Pmn;var tyt=N8(),vmn=N8();Object.defineProperty(bc,"NETWORKS",{enumerable:!0,get:function(){return vmn.NETWORKS}});bc.NETWORK_ENV="VISA_V4_NETWORK";bc.CIRCLE_TESTNET_FAUCET_URL="https://faucet.circle.com";var ryt={"base-mainnet":"base-mainnet","base-sepolia":"base-sepolia","eip155:8453":"base-mainnet","eip155:84532":"base-sepolia"};function Tmn(e=process.env){let t=(e[bc.NETWORK_ENV]??"").trim();if(t==="")return tyt.NETWORKS["base-mainnet"];let r=ryt[t.toLowerCase()];if(!r)throw new Error(`unknown ${bc.NETWORK_ENV} value ${JSON.stringify(t)} \u2014 valid values: `+Object.keys(ryt).join(", "));return tyt.NETWORKS[r]}bc.TURNKEY_API_BASE_URL_ENV="TURNKEY_API_BASE_URL";var Amn="https://api.turnkey.com";function wmn(e=process.env){let t=(e[bc.TURNKEY_API_BASE_URL_ENV]??"").trim();return t===""?Amn:t}function Imn(e,t){return`${e.explorerBaseUrl}/tx/${t}`}function Pmn(e,t){return`${e.explorerBaseUrl}/address/${t}`}});var C8=_(Lt=>{"use strict";Object.defineProperty(Lt,"__esModule",{value:!0});Lt.notImplemented=Lt.bitMask=Lt.utf8ToBytes=Lt.randomBytes=Lt.isBytes=Lt.hexToBytes=Lt.concatBytes=Lt.bytesToUtf8=Lt.bytesToHex=Lt.anumber=Lt.abytes=void 0;Lt.abool=xmn;Lt._abool2=Omn;Lt._abytes2=Rmn;Lt.numberToHexUnpadded=nyt;Lt.hexToNumber=DRe;Lt.bytesToNumberBE=Nmn;Lt.bytesToNumberLE=Cmn;Lt.numberToBytesBE=iyt;Lt.numberToBytesLE=Mmn;Lt.numberToVarBytesBE=kmn;Lt.ensureBytes=Dmn;Lt.equalBytes=Lmn;Lt.copyBytes=Umn;Lt.asciiToBytes=Bmn;Lt.inRange=oyt;Lt.aInRange=jmn;Lt.bitLen=qmn;Lt.bitGet=Hmn;Lt.bitSet=Vmn;Lt.createHmacDrbg=$mn;Lt.validateObject=Gmn;Lt.isHash=Kmn;Lt._validateObject=Wmn;Lt.memoized=Jmn;var Cg=Zo(),Zy=Zo();Object.defineProperty(Lt,"abytes",{enumerable:!0,get:function(){return Zy.abytes}});Object.defineProperty(Lt,"anumber",{enumerable:!0,get:function(){return Zy.anumber}});Object.defineProperty(Lt,"bytesToHex",{enumerable:!0,get:function(){return Zy.bytesToHex}});Object.defineProperty(Lt,"bytesToUtf8",{enumerable:!0,get:function(){return Zy.bytesToUtf8}});Object.defineProperty(Lt,"concatBytes",{enumerable:!0,get:function(){return Zy.concatBytes}});Object.defineProperty(Lt,"hexToBytes",{enumerable:!0,get:function(){return Zy.hexToBytes}});Object.defineProperty(Lt,"isBytes",{enumerable:!0,get:function(){return Zy.isBytes}});Object.defineProperty(Lt,"randomBytes",{enumerable:!0,get:function(){return Zy.randomBytes}});Object.defineProperty(Lt,"utf8ToBytes",{enumerable:!0,get:function(){return Zy.utf8ToBytes}});var jte=BigInt(0),jB=BigInt(1);function xmn(e,t){if(typeof t!="boolean")throw new Error(e+" boolean expected, got "+t)}function Omn(e,t=""){if(typeof e!="boolean"){let r=t&&`"${t}"`;throw new Error(r+"expected boolean, got type="+typeof e)}return e}function Rmn(e,t,r=""){let n=(0,Cg.isBytes)(e),i=e?.length,o=t!==void 0;if(!n||o&&i!==t){let s=r&&`"${r}" `,a=o?` of length ${t}`:"",c=n?`length=${i}`:`type=${typeof e}`;throw new Error(s+"expected Uint8Array"+a+", got "+c)}return e}function nyt(e){let t=e.toString(16);return t.length&1?"0"+t:t}function DRe(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?jte:BigInt("0x"+e)}function Nmn(e){return DRe((0,Cg.bytesToHex)(e))}function Cmn(e){return(0,Cg.abytes)(e),DRe((0,Cg.bytesToHex)(Uint8Array.from(e).reverse()))}function iyt(e,t){return(0,Cg.hexToBytes)(e.toString(16).padStart(t*2,"0"))}function Mmn(e,t){return iyt(e,t).reverse()}function kmn(e){return(0,Cg.hexToBytes)(nyt(e))}function Dmn(e,t,r){let n;if(typeof t=="string")try{n=(0,Cg.hexToBytes)(t)}catch(o){throw new Error(e+" must be hex string or Uint8Array, cause: "+o)}else if((0,Cg.isBytes)(t))n=Uint8Array.from(t);else throw new Error(e+" must be hex string or Uint8Array");let i=n.length;if(typeof r=="number"&&i!==r)throw new Error(e+" of length "+r+" expected, got "+i);return n}function Lmn(e,t){if(e.length!==t.length)return!1;let r=0;for(let n=0;n<e.length;n++)r|=e[n]^t[n];return r===0}function Umn(e){return Uint8Array.from(e)}function Bmn(e){return Uint8Array.from(e,(t,r)=>{let n=t.charCodeAt(0);if(t.length!==1||n>127)throw new Error(`string contains non-ASCII character "${e[r]}" with code ${n} at position ${r}`);return n})}var kRe=e=>typeof e=="bigint"&&jte<=e;function oyt(e,t,r){return kRe(e)&&kRe(t)&&kRe(r)&&t<=e&&e<r}function jmn(e,t,r,n){if(!oyt(t,r,n))throw new Error("expected valid "+e+": "+r+" <= n < "+n+", got "+t)}function qmn(e){let t;for(t=0;e>jte;e>>=jB,t+=1);return t}function Hmn(e,t){return e>>BigInt(t)&jB}function Vmn(e,t,r){return e|(r?jB:jte)<<BigInt(t)}var Fmn=e=>(jB<<BigInt(e))-jB;Lt.bitMask=Fmn;function $mn(e,t,r){if(typeof e!="number"||e<2)throw new Error("hashLen must be a number");if(typeof t!="number"||t<2)throw new Error("qByteLen must be a number");if(typeof r!="function")throw new Error("hmacFn must be a function");let n=f=>new Uint8Array(f),i=f=>Uint8Array.of(f),o=n(e),s=n(e),a=0,c=()=>{o.fill(1),s.fill(0),a=0},u=(...f)=>r(s,o,...f),d=(f=n(0))=>{s=u(i(0),f),o=u(),f.length!==0&&(s=u(i(1),f),o=u())},l=()=>{if(a++>=1e3)throw new Error("drbg: tried 1000 values");let f=0,m=[];for(;f<t;){o=u();let h=o.slice();m.push(h),f+=o.length}return(0,Cg.concatBytes)(...m)};return(f,m)=>{c(),d(f);let h;for(;!(h=m(l()));)d();return c(),h}}var zmn={bigint:e=>typeof e=="bigint",function:e=>typeof e=="function",boolean:e=>typeof e=="boolean",string:e=>typeof e=="string",stringOrUint8Array:e=>typeof e=="string"||(0,Cg.isBytes)(e),isSafeInteger:e=>Number.isSafeInteger(e),array:e=>Array.isArray(e),field:(e,t)=>t.Fp.isValid(e),hash:e=>typeof e=="function"&&Number.isSafeInteger(e.outputLen)};function Gmn(e,t,r={}){let n=(i,o,s)=>{let a=zmn[o];if(typeof a!="function")throw new Error("invalid validator function");let c=e[i];if(!(s&&c===void 0)&&!a(c,e))throw new Error("param "+String(i)+" is invalid. Expected "+o+", got "+c)};for(let[i,o]of Object.entries(t))n(i,o,!1);for(let[i,o]of Object.entries(r))n(i,o,!0);return e}function Kmn(e){return typeof e=="function"&&Number.isSafeInteger(e.outputLen)}function Wmn(e,t,r={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function n(i,o,s){let a=e[i];if(s&&a===void 0)return;let c=typeof a;if(c!==o||a===null)throw new Error(`param "${i}" is invalid: expected ${o}, got ${c}`)}Object.entries(t).forEach(([i,o])=>n(i,o,!1)),Object.entries(r).forEach(([i,o])=>n(i,o,!0))}var Ymn=()=>{throw new Error("not implemented")};Lt.notImplemented=Ymn;function Jmn(e){let t=new WeakMap;return(r,...n)=>{let i=t.get(r);if(i!==void 0)return i;let o=e(r,...n);return t.set(r,o),o}}});var JI=_(Fi=>{"use strict";Object.defineProperty(Fi,"__esModule",{value:!0});Fi.isNegativeLE=void 0;Fi.mod=ol;Fi.pow=Qmn;Fi.pow2=ehn;Fi.invert=qte;Fi.tonelliShanks=URe;Fi.FpSqrt=pyt;Fi.validateField=ohn;Fi.FpPow=BRe;Fi.FpInvertBatch=fyt;Fi.FpDiv=shn;Fi.FpLegendre=Hte;Fi.FpIsSquare=ahn;Fi.nLength=jRe;Fi.Field=Vte;Fi.FpSqrtOdd=chn;Fi.FpSqrtEven=uhn;Fi.hashToPrivateScalar=dhn;Fi.getFieldBytesLength=qRe;Fi.getMinHashLength=myt;Fi.mapHashToField=lhn;var sl=C8(),Qu=BigInt(0),xs=BigInt(1),YI=BigInt(2),syt=BigInt(3),ayt=BigInt(4),cyt=BigInt(5),Xmn=BigInt(7),uyt=BigInt(8),Zmn=BigInt(9),dyt=BigInt(16);function ol(e,t){let r=e%t;return r>=Qu?r:t+r}function Qmn(e,t,r){return BRe(Vte(r),e,t)}function ehn(e,t,r){let n=e;for(;t-- >Qu;)n*=n,n%=r;return n}function qte(e,t){if(e===Qu)throw new Error("invert: expected non-zero number");if(t<=Qu)throw new Error("invert: expected positive modulus, got "+t);let r=ol(e,t),n=t,i=Qu,o=xs,s=xs,a=Qu;for(;r!==Qu;){let u=n/r,d=n%r,l=i-s*u,p=o-a*u;n=r,r=d,i=s,o=a,s=l,a=p}if(n!==xs)throw new Error("invert: does not exist");return ol(i,t)}function LRe(e,t,r){if(!e.eql(e.sqr(t),r))throw new Error("Cannot find square root")}function lyt(e,t){let r=(e.ORDER+xs)/ayt,n=e.pow(t,r);return LRe(e,n,t),n}function thn(e,t){let r=(e.ORDER-cyt)/uyt,n=e.mul(t,YI),i=e.pow(n,r),o=e.mul(t,i),s=e.mul(e.mul(o,YI),i),a=e.mul(o,e.sub(s,e.ONE));return LRe(e,a,t),a}function rhn(e){let t=Vte(e),r=URe(e),n=r(t,t.neg(t.ONE)),i=r(t,n),o=r(t,t.neg(n)),s=(e+Xmn)/dyt;return(a,c)=>{let u=a.pow(c,s),d=a.mul(u,n),l=a.mul(u,i),p=a.mul(u,o),f=a.eql(a.sqr(d),c),m=a.eql(a.sqr(l),c);u=a.cmov(u,d,f),d=a.cmov(p,l,m);let h=a.eql(a.sqr(d),c),g=a.cmov(u,d,h);return LRe(a,g,c),g}}function URe(e){if(e<syt)throw new Error("sqrt is not defined for small field");let t=e-xs,r=0;for(;t%YI===Qu;)t/=YI,r++;let n=YI,i=Vte(e);for(;Hte(i,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return lyt;let o=i.pow(n,t),s=(t+xs)/YI;return function(c,u){if(c.is0(u))return u;if(Hte(c,u)!==1)throw new Error("Cannot find square root");let d=r,l=c.mul(c.ONE,o),p=c.pow(u,t),f=c.pow(u,s);for(;!c.eql(p,c.ONE);){if(c.is0(p))return c.ZERO;let m=1,h=c.sqr(p);for(;!c.eql(h,c.ONE);)if(m++,h=c.sqr(h),m===d)throw new Error("Cannot find square root");let g=xs<<BigInt(d-m-1),y=c.pow(l,g);d=m,l=c.sqr(y),p=c.mul(p,l),f=c.mul(f,y)}return f}}function pyt(e){return e%ayt===syt?lyt:e%uyt===cyt?thn:e%dyt===Zmn?rhn(e):URe(e)}var nhn=(e,t)=>(ol(e,t)&xs)===xs;Fi.isNegativeLE=nhn;var ihn=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function ohn(e){let t={ORDER:"bigint",MASK:"bigint",BYTES:"number",BITS:"number"},r=ihn.reduce((n,i)=>(n[i]="function",n),t);return(0,sl._validateObject)(e,r),e}function BRe(e,t,r){if(r<Qu)throw new Error("invalid exponent, negatives unsupported");if(r===Qu)return e.ONE;if(r===xs)return t;let n=e.ONE,i=t;for(;r>Qu;)r&xs&&(n=e.mul(n,i)),i=e.sqr(i),r>>=xs;return n}function fyt(e,t,r=!1){let n=new Array(t.length).fill(r?e.ZERO:void 0),i=t.reduce((s,a,c)=>e.is0(a)?s:(n[c]=s,e.mul(s,a)),e.ONE),o=e.inv(i);return t.reduceRight((s,a,c)=>e.is0(a)?s:(n[c]=e.mul(s,n[c]),e.mul(s,a)),o),n}function shn(e,t,r){return e.mul(t,typeof r=="bigint"?qte(r,e.ORDER):e.inv(r))}function Hte(e,t){let r=(e.ORDER-xs)/YI,n=e.pow(t,r),i=e.eql(n,e.ONE),o=e.eql(n,e.ZERO),s=e.eql(n,e.neg(e.ONE));if(!i&&!o&&!s)throw new Error("invalid Legendre symbol result");return i?1:o?0:-1}function ahn(e,t){return Hte(e,t)===1}function jRe(e,t){t!==void 0&&(0,sl.anumber)(t);let r=t!==void 0?t:e.toString(2).length,n=Math.ceil(r/8);return{nBitLength:r,nByteLength:n}}function Vte(e,t,r=!1,n={}){if(e<=Qu)throw new Error("invalid field: expected ORDER > 0, got "+e);let i,o,s=!1,a;if(typeof t=="object"&&t!=null){if(n.sqrt||r)throw new Error("cannot specify opts in two arguments");let p=t;p.BITS&&(i=p.BITS),p.sqrt&&(o=p.sqrt),typeof p.isLE=="boolean"&&(r=p.isLE),typeof p.modFromBytes=="boolean"&&(s=p.modFromBytes),a=p.allowedLengths}else typeof t=="number"&&(i=t),n.sqrt&&(o=n.sqrt);let{nBitLength:c,nByteLength:u}=jRe(e,i);if(u>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");let d,l=Object.freeze({ORDER:e,isLE:r,BITS:c,BYTES:u,MASK:(0,sl.bitMask)(c),ZERO:Qu,ONE:xs,allowedLengths:a,create:p=>ol(p,e),isValid:p=>{if(typeof p!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof p);return Qu<=p&&p<e},is0:p=>p===Qu,isValidNot0:p=>!l.is0(p)&&l.isValid(p),isOdd:p=>(p&xs)===xs,neg:p=>ol(-p,e),eql:(p,f)=>p===f,sqr:p=>ol(p*p,e),add:(p,f)=>ol(p+f,e),sub:(p,f)=>ol(p-f,e),mul:(p,f)=>ol(p*f,e),pow:(p,f)=>BRe(l,p,f),div:(p,f)=>ol(p*qte(f,e),e),sqrN:p=>p*p,addN:(p,f)=>p+f,subN:(p,f)=>p-f,mulN:(p,f)=>p*f,inv:p=>qte(p,e),sqrt:o||(p=>(d||(d=pyt(e)),d(l,p))),toBytes:p=>r?(0,sl.numberToBytesLE)(p,u):(0,sl.numberToBytesBE)(p,u),fromBytes:(p,f=!0)=>{if(a){if(!a.includes(p.length)||p.length>u)throw new Error("Field.fromBytes: expected "+a+" bytes, got "+p.length);let h=new Uint8Array(u);h.set(p,r?0:h.length-p.length),p=h}if(p.length!==u)throw new Error("Field.fromBytes: expected "+u+" bytes, got "+p.length);let m=r?(0,sl.bytesToNumberLE)(p):(0,sl.bytesToNumberBE)(p);if(s&&(m=ol(m,e)),!f&&!l.isValid(m))throw new Error("invalid field element: outside of range 0..ORDER");return m},invertBatch:p=>fyt(l,p),cmov:(p,f,m)=>m?f:p});return Object.freeze(l)}function chn(e,t){if(!e.isOdd)throw new Error("Field doesn't have isOdd");let r=e.sqrt(t);return e.isOdd(r)?r:e.neg(r)}function uhn(e,t){if(!e.isOdd)throw new Error("Field doesn't have isOdd");let r=e.sqrt(t);return e.isOdd(r)?e.neg(r):r}function dhn(e,t,r=!1){e=(0,sl.ensureBytes)("privateHash",e);let n=e.length,i=jRe(t).nByteLength+8;if(i<24||n<i||n>1024)throw new Error("hashToPrivateScalar: expected "+i+"-1024 bytes of input, got "+n);let o=r?(0,sl.bytesToNumberLE)(e):(0,sl.bytesToNumberBE)(e);return ol(o,t-xs)+xs}function qRe(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function myt(e){let t=qRe(e);return t+Math.ceil(t/2)}function lhn(e,t,r=!1){let n=e.length,i=qRe(t),o=myt(t);if(n<16||n<o||n>1024)throw new Error("expected "+o+"-1024 bytes of input, got "+n);let s=r?(0,sl.bytesToNumberLE)(e):(0,sl.bytesToNumberBE)(e),a=ol(s,t-xs)+xs;return r?(0,sl.numberToBytesLE)(a,i):(0,sl.numberToBytesBE)(a,i)}});var Syt=_(Th=>{"use strict";Object.defineProperty(Th,"__esModule",{value:!0});Th.wNAF=void 0;Th.negateCt=$Re;Th.normalizeZ=phn;Th.mulEndoUnsafe=fhn;Th.pippenger=mhn;Th.precomputeMSMUnsafe=hhn;Th.validateBasic=ghn;Th._createCurveFields=_hn;var qB=C8(),HB=JI(),M8=BigInt(0),XI=BigInt(1);function $Re(e,t){let r=t.negate();return e?r:t}function phn(e,t){let r=(0,HB.FpInvertBatch)(e.Fp,t.map(n=>n.Z));return t.map((n,i)=>e.fromAffine(n.toAffine(r[i])))}function GRe(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function HRe(e,t){GRe(e,t);let r=Math.ceil(t/e)+1,n=2**(e-1),i=2**e,o=(0,qB.bitMask)(e),s=BigInt(e);return{windows:r,windowSize:n,mask:o,maxNumber:i,shiftBy:s}}function hyt(e,t,r){let{windowSize:n,mask:i,maxNumber:o,shiftBy:s}=r,a=Number(e&i),c=e>>s;a>n&&(a-=o,c+=XI);let u=t*n,d=u+Math.abs(a)-1,l=a===0,p=a<0,f=t%2!==0;return{nextN:c,offset:d,isZero:l,isNeg:p,isNegF:f,offsetF:u}}function yyt(e,t){if(!Array.isArray(e))throw new Error("array expected");e.forEach((r,n)=>{if(!(r instanceof t))throw new Error("invalid point at index "+n)})}function byt(e,t){if(!Array.isArray(e))throw new Error("array of scalars expected");e.forEach((r,n)=>{if(!t.isValid(r))throw new Error("invalid scalar at index "+n)})}var VRe=new WeakMap,Eyt=new WeakMap;function FRe(e){return Eyt.get(e)||1}function gyt(e){if(e!==M8)throw new Error("invalid wNAF")}var zRe=class{constructor(t,r){this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=r}_unsafeLadder(t,r,n=this.ZERO){let i=t;for(;r>M8;)r&XI&&(n=n.add(i)),i=i.double(),r>>=XI;return n}precomputeWindow(t,r){let{windows:n,windowSize:i}=HRe(r,this.bits),o=[],s=t,a=s;for(let c=0;c<n;c++){a=s,o.push(a);for(let u=1;u<i;u++)a=a.add(s),o.push(a);s=a.double()}return o}wNAF(t,r,n){if(!this.Fn.isValid(n))throw new Error("invalid scalar");let i=this.ZERO,o=this.BASE,s=HRe(t,this.bits);for(let a=0;a<s.windows;a++){let{nextN:c,offset:u,isZero:d,isNeg:l,isNegF:p,offsetF:f}=hyt(n,a,s);n=c,d?o=o.add($Re(p,r[f])):i=i.add($Re(l,r[u]))}return gyt(n),{p:i,f:o}}wNAFUnsafe(t,r,n,i=this.ZERO){let o=HRe(t,this.bits);for(let s=0;s<o.windows&&n!==M8;s++){let{nextN:a,offset:c,isZero:u,isNeg:d}=hyt(n,s,o);if(n=a,!u){let l=r[c];i=i.add(d?l.negate():l)}}return gyt(n),i}getPrecomputes(t,r,n){let i=VRe.get(r);return i||(i=this.precomputeWindow(r,t),t!==1&&(typeof n=="function"&&(i=n(i)),VRe.set(r,i))),i}cached(t,r,n){let i=FRe(t);return this.wNAF(i,this.getPrecomputes(i,t,n),r)}unsafe(t,r,n,i){let o=FRe(t);return o===1?this._unsafeLadder(t,r,i):this.wNAFUnsafe(o,this.getPrecomputes(o,t,n),r,i)}createCache(t,r){GRe(r,this.bits),Eyt.set(t,r),VRe.delete(t)}hasCache(t){return FRe(t)!==1}};Th.wNAF=zRe;function fhn(e,t,r,n){let i=t,o=e.ZERO,s=e.ZERO;for(;r>M8||n>M8;)r&XI&&(o=o.add(i)),n&XI&&(s=s.add(i)),i=i.double(),r>>=XI,n>>=XI;return{p1:o,p2:s}}function mhn(e,t,r,n){yyt(r,e),byt(n,t);let i=r.length,o=n.length;if(i!==o)throw new Error("arrays of points and scalars must have equal length");let s=e.ZERO,a=(0,qB.bitLen)(BigInt(i)),c=1;a>12?c=a-3:a>4?c=a-2:a>0&&(c=2);let u=(0,qB.bitMask)(c),d=new Array(Number(u)+1).fill(s),l=Math.floor((t.BITS-1)/c)*c,p=s;for(let f=l;f>=0;f-=c){d.fill(s);for(let h=0;h<o;h++){let g=n[h],y=Number(g>>BigInt(f)&u);d[y]=d[y].add(r[h])}let m=s;for(let h=d.length-1,g=s;h>0;h--)g=g.add(d[h]),m=m.add(g);if(p=p.add(m),f!==0)for(let h=0;h<c;h++)p=p.double()}return p}function hhn(e,t,r,n){GRe(n,t.BITS),yyt(r,e);let i=e.ZERO,o=2**n-1,s=Math.ceil(t.BITS/n),a=(0,qB.bitMask)(n),c=r.map(u=>{let d=[];for(let l=0,p=u;l<o;l++)d.push(p),p=p.add(u);return d});return u=>{if(byt(u,t),u.length>r.length)throw new Error("array of scalars must be smaller than array of points");let d=i;for(let l=0;l<s;l++){if(d!==i)for(let f=0;f<n;f++)d=d.double();let p=BigInt(s*n-(l+1)*n);for(let f=0;f<u.length;f++){let m=u[f],h=Number(m>>p&a);h&&(d=d.add(c[f][h-1]))}}return d}}function ghn(e){return(0,HB.validateField)(e.Fp),(0,qB.validateObject)(e,{n:"bigint",h:"bigint",Gx:"field",Gy:"field"},{nBitLength:"isSafeInteger",nByteLength:"isSafeInteger"}),Object.freeze({...(0,HB.nLength)(e.n,e.nBitLength),...e,p:e.Fp.ORDER})}function _yt(e,t,r){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return(0,HB.validateField)(t),t}else return(0,HB.Field)(e,{isLE:r})}function _hn(e,t,r={},n){if(n===void 0&&(n=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let c of["p","n","h"]){let u=t[c];if(!(typeof u=="bigint"&&u>M8))throw new Error(`CURVE.${c} must be positive bigint`)}let i=_yt(t.p,r.Fp,n),o=_yt(t.n,r.Fn,n),a=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let c of a)if(!i.isValid(t[c]))throw new Error(`CURVE.${c} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:i,Fn:o}}});var $te=_(_i=>{"use strict";Object.defineProperty(_i,"__esModule",{value:!0});_i.DER=_i.DERErr=void 0;_i._splitEndoScalar=Tyt;_i._normFnElement=tT;_i.weierstrassN=JRe;_i.SWUFpSqrtRatio=wyt;_i.mapToCurveSimpleSWU=Ehn;_i.ecdh=Pyt;_i.ecdsa=xyt;_i.weierstrassPoints=Shn;_i._legacyHelperEquat=Ryt;_i.weierstrass=whn;var yhn=cv(),bhn=Zo(),pt=C8(),Qy=Syt(),D8=JI(),vyt=(e,t)=>(e+(e>=0?t:-t)/Mg)/t;function Tyt(e,t,r){let[[n,i],[o,s]]=t,a=vyt(s*e,r),c=vyt(-i*e,r),u=e-a*n-c*o,d=-a*i-c*s,l=u<Ah,p=d<Ah;l&&(u=-u),p&&(d=-d);let f=(0,pt.bitMask)(Math.ceil((0,pt.bitLen)(r)/2))+Ec;if(u<Ah||u>=f||d<Ah||d>=f)throw new Error("splitScalar (endomorphism): failed, k="+e);return{k1neg:l,k1:u,k2neg:p,k2:d}}function WRe(e){if(!["compact","recovered","der"].includes(e))throw new Error('Signature format must be "compact", "recovered", or "der"');return e}function KRe(e,t){let r={};for(let n of Object.keys(t))r[n]=e[n]===void 0?t[n]:e[n];return(0,pt._abool2)(r.lowS,"lowS"),(0,pt._abool2)(r.prehash,"prehash"),r.format!==void 0&&WRe(r.format),r}var Fte=class extends Error{constructor(t=""){super(t)}};_i.DERErr=Fte;_i.DER={Err:Fte,_tlv:{encode:(e,t)=>{let{Err:r}=_i.DER;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length&1)throw new r("tlv.encode: unpadded data");let n=t.length/2,i=(0,pt.numberToHexUnpadded)(n);if(i.length/2&128)throw new r("tlv.encode: long form length too big");let o=n>127?(0,pt.numberToHexUnpadded)(i.length/2|128):"";return(0,pt.numberToHexUnpadded)(e)+o+i+t},decode(e,t){let{Err:r}=_i.DER,n=0;if(e<0||e>256)throw new r("tlv.encode: wrong tag");if(t.length<2||t[n++]!==e)throw new r("tlv.decode: wrong tlv");let i=t[n++],o=!!(i&128),s=0;if(!o)s=i;else{let c=i&127;if(!c)throw new r("tlv.decode(long): indefinite length not supported");if(c>4)throw new r("tlv.decode(long): byte length is too big");let u=t.subarray(n,n+c);if(u.length!==c)throw new r("tlv.decode: length bytes not complete");if(u[0]===0)throw new r("tlv.decode(long): zero leftmost byte");for(let d of u)s=s<<8|d;if(n+=c,s<128)throw new r("tlv.decode(long): not minimal encoding")}let a=t.subarray(n,n+s);if(a.length!==s)throw new r("tlv.decode: wrong value length");return{v:a,l:t.subarray(n+s)}}},_int:{encode(e){let{Err:t}=_i.DER;if(e<Ah)throw new t("integer: negative integers are not allowed");let r=(0,pt.numberToHexUnpadded)(e);if(Number.parseInt(r[0],16)&8&&(r="00"+r),r.length&1)throw new t("unexpected DER parsing assertion: unpadded hex");return r},decode(e){let{Err:t}=_i.DER;if(e[0]&128)throw new t("invalid signature integer: negative");if(e[0]===0&&!(e[1]&128))throw new t("invalid signature integer: unnecessary leading zero");return(0,pt.bytesToNumberBE)(e)}},toSig(e){let{Err:t,_int:r,_tlv:n}=_i.DER,i=(0,pt.ensureBytes)("signature",e),{v:o,l:s}=n.decode(48,i);if(s.length)throw new t("invalid signature: left bytes after parsing");let{v:a,l:c}=n.decode(2,o),{v:u,l:d}=n.decode(2,c);if(d.length)throw new t("invalid signature: left bytes after parsing");return{r:r.decode(a),s:r.decode(u)}},hexFromSig(e){let{_tlv:t,_int:r}=_i.DER,n=t.encode(2,r.encode(e.r)),i=t.encode(2,r.encode(e.s)),o=n+i;return t.encode(48,o)}};var Ah=BigInt(0),Ec=BigInt(1),Mg=BigInt(2),k8=BigInt(3),YRe=BigInt(4);function tT(e,t){let{BYTES:r}=e,n;if(typeof t=="bigint")n=t;else{let i=(0,pt.ensureBytes)("private key",t);try{n=e.fromBytes(i)}catch{throw new Error(`invalid private key: expected ui8a of size ${r}, got ${typeof t}`)}}if(!e.isValidNot0(n))throw new Error("invalid private key: out of range [1..N-1]");return n}function JRe(e,t={}){let r=(0,Qy._createCurveFields)("weierstrass",e,t),{Fp:n,Fn:i}=r,o=r.CURVE,{h:s,n:a}=o;(0,pt._validateObject)(t,{},{allowInfinityPoint:"boolean",clearCofactor:"function",isTorsionFree:"function",fromBytes:"function",toBytes:"function",endo:"object",wrapPrivateKey:"boolean"});let{endo:c}=t;if(c&&(!n.is0(o.a)||typeof c.beta!="bigint"||!Array.isArray(c.basises)))throw new Error('invalid endo: expected "beta": bigint and "basises": array');let u=Iyt(n,i);function d(){if(!n.isOdd)throw new Error("compression is not supported: Field does not have .isOdd()")}function l(D,B,M){let{x:R,y:k}=B.toAffine(),U=n.toBytes(R);if((0,pt._abool2)(M,"isCompressed"),M){d();let L=!n.isOdd(k);return(0,pt.concatBytes)(Ayt(L),U)}else return(0,pt.concatBytes)(Uint8Array.of(4),U,n.toBytes(k))}function p(D){(0,pt._abytes2)(D,void 0,"Point");let{publicKey:B,publicKeyUncompressed:M}=u,R=D.length,k=D[0],U=D.subarray(1);if(R===B&&(k===2||k===3)){let L=n.fromBytes(U);if(!n.isValid(L))throw new Error("bad point: is not on curve, wrong x");let q=h(L),j;try{j=n.sqrt(q)}catch(ee){let ne=ee instanceof Error?": "+ee.message:"";throw new Error("bad point: is not on curve, sqrt error"+ne)}d();let F=n.isOdd(j);return(k&1)===1!==F&&(j=n.neg(j)),{x:L,y:j}}else if(R===M&&k===4){let L=n.BYTES,q=n.fromBytes(U.subarray(0,L)),j=n.fromBytes(U.subarray(L,L*2));if(!g(q,j))throw new Error("bad point: is not on curve");return{x:q,y:j}}else throw new Error(`bad point: got length ${R}, expected compressed=${B} or uncompressed=${M}`)}let f=t.toBytes||l,m=t.fromBytes||p;function h(D){let B=n.sqr(D),M=n.mul(B,D);return n.add(n.add(M,n.mul(D,o.a)),o.b)}function g(D,B){let M=n.sqr(B),R=h(D);return n.eql(M,R)}if(!g(o.Gx,o.Gy))throw new Error("bad curve params: generator point");let y=n.mul(n.pow(o.a,k8),YRe),S=n.mul(n.sqr(o.b),BigInt(27));if(n.is0(n.add(y,S)))throw new Error("bad curve params: a or b");function b(D,B,M=!1){if(!n.isValid(B)||M&&n.is0(B))throw new Error(`bad point coordinate ${D}`);return B}function E(D){if(!(D instanceof O))throw new Error("ProjectivePoint expected")}function T(D){if(!c||!c.basises)throw new Error("no endo");return Tyt(D,c.basises,i.ORDER)}let w=(0,pt.memoized)((D,B)=>{let{X:M,Y:R,Z:k}=D;if(n.eql(k,n.ONE))return{x:M,y:R};let U=D.is0();B==null&&(B=U?n.ONE:n.inv(k));let L=n.mul(M,B),q=n.mul(R,B),j=n.mul(k,B);if(U)return{x:n.ZERO,y:n.ZERO};if(!n.eql(j,n.ONE))throw new Error("invZ was invalid");return{x:L,y:q}}),I=(0,pt.memoized)(D=>{if(D.is0()){if(t.allowInfinityPoint&&!n.is0(D.Y))return;throw new Error("bad point: ZERO")}let{x:B,y:M}=D.toAffine();if(!n.isValid(B)||!n.isValid(M))throw new Error("bad point: x or y not field elements");if(!g(B,M))throw new Error("bad point: equation left != right");if(!D.isTorsionFree())throw new Error("bad point: not in prime-order subgroup");return!0});function N(D,B,M,R,k){return M=new O(n.mul(M.X,D),M.Y,M.Z),B=(0,Qy.negateCt)(R,B),M=(0,Qy.negateCt)(k,M),B.add(M)}class O{constructor(B,M,R){this.X=b("x",B),this.Y=b("y",M,!0),this.Z=b("z",R),Object.freeze(this)}static CURVE(){return o}static fromAffine(B){let{x:M,y:R}=B||{};if(!B||!n.isValid(M)||!n.isValid(R))throw new Error("invalid affine point");if(B instanceof O)throw new Error("projective point not allowed");return n.is0(M)&&n.is0(R)?O.ZERO:new O(M,R,n.ONE)}static fromBytes(B){let M=O.fromAffine(m((0,pt._abytes2)(B,void 0,"point")));return M.assertValidity(),M}static fromHex(B){return O.fromBytes((0,pt.ensureBytes)("pointHex",B))}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(B=8,M=!0){return x.createCache(this,B),M||this.multiply(k8),this}assertValidity(){I(this)}hasEvenY(){let{y:B}=this.toAffine();if(!n.isOdd)throw new Error("Field doesn't support isOdd");return!n.isOdd(B)}equals(B){E(B);let{X:M,Y:R,Z:k}=this,{X:U,Y:L,Z:q}=B,j=n.eql(n.mul(M,q),n.mul(U,k)),F=n.eql(n.mul(R,q),n.mul(L,k));return j&&F}negate(){return new O(this.X,n.neg(this.Y),this.Z)}double(){let{a:B,b:M}=o,R=n.mul(M,k8),{X:k,Y:U,Z:L}=this,q=n.ZERO,j=n.ZERO,F=n.ZERO,H=n.mul(k,k),ee=n.mul(U,U),ne=n.mul(L,L),Q=n.mul(k,U);return Q=n.add(Q,Q),F=n.mul(k,L),F=n.add(F,F),q=n.mul(B,F),j=n.mul(R,ne),j=n.add(q,j),q=n.sub(ee,j),j=n.add(ee,j),j=n.mul(q,j),q=n.mul(Q,q),F=n.mul(R,F),ne=n.mul(B,ne),Q=n.sub(H,ne),Q=n.mul(B,Q),Q=n.add(Q,F),F=n.add(H,H),H=n.add(F,H),H=n.add(H,ne),H=n.mul(H,Q),j=n.add(j,H),ne=n.mul(U,L),ne=n.add(ne,ne),H=n.mul(ne,Q),q=n.sub(q,H),F=n.mul(ne,ee),F=n.add(F,F),F=n.add(F,F),new O(q,j,F)}add(B){E(B);let{X:M,Y:R,Z:k}=this,{X:U,Y:L,Z:q}=B,j=n.ZERO,F=n.ZERO,H=n.ZERO,ee=o.a,ne=n.mul(o.b,k8),Q=n.mul(M,U),le=n.mul(R,L),_e=n.mul(k,q),we=n.add(M,R),Ee=n.add(U,L);we=n.mul(we,Ee),Ee=n.add(Q,le),we=n.sub(we,Ee),Ee=n.add(M,k);let Te=n.add(U,q);return Ee=n.mul(Ee,Te),Te=n.add(Q,_e),Ee=n.sub(Ee,Te),Te=n.add(R,k),j=n.add(L,q),Te=n.mul(Te,j),j=n.add(le,_e),Te=n.sub(Te,j),H=n.mul(ee,Ee),j=n.mul(ne,_e),H=n.add(j,H),j=n.sub(le,H),H=n.add(le,H),F=n.mul(j,H),le=n.add(Q,Q),le=n.add(le,Q),_e=n.mul(ee,_e),Ee=n.mul(ne,Ee),le=n.add(le,_e),_e=n.sub(Q,_e),_e=n.mul(ee,_e),Ee=n.add(Ee,_e),Q=n.mul(le,Ee),F=n.add(F,Q),Q=n.mul(Te,Ee),j=n.mul(we,j),j=n.sub(j,Q),Q=n.mul(we,le),H=n.mul(Te,H),H=n.add(H,Q),new O(j,F,H)}subtract(B){return this.add(B.negate())}is0(){return this.equals(O.ZERO)}multiply(B){let{endo:M}=t;if(!i.isValidNot0(B))throw new Error("invalid scalar: out of range");let R,k,U=L=>x.cached(this,L,q=>(0,Qy.normalizeZ)(O,q));if(M){let{k1neg:L,k1:q,k2neg:j,k2:F}=T(B),{p:H,f:ee}=U(q),{p:ne,f:Q}=U(F);k=ee.add(Q),R=N(M.beta,H,ne,L,j)}else{let{p:L,f:q}=U(B);R=L,k=q}return(0,Qy.normalizeZ)(O,[R,k])[0]}multiplyUnsafe(B){let{endo:M}=t,R=this;if(!i.isValid(B))throw new Error("invalid scalar: out of range");if(B===Ah||R.is0())return O.ZERO;if(B===Ec)return R;if(x.hasCache(this))return this.multiply(B);if(M){let{k1neg:k,k1:U,k2neg:L,k2:q}=T(B),{p1:j,p2:F}=(0,Qy.mulEndoUnsafe)(O,R,U,q);return N(M.beta,j,F,k,L)}else return x.unsafe(R,B)}multiplyAndAddUnsafe(B,M,R){let k=this.multiplyUnsafe(M).add(B.multiplyUnsafe(R));return k.is0()?void 0:k}toAffine(B){return w(this,B)}isTorsionFree(){let{isTorsionFree:B}=t;return s===Ec?!0:B?B(O,this):x.unsafe(this,a).is0()}clearCofactor(){let{clearCofactor:B}=t;return s===Ec?this:B?B(O,this):this.multiplyUnsafe(s)}isSmallOrder(){return this.multiplyUnsafe(s).is0()}toBytes(B=!0){return(0,pt._abool2)(B,"isCompressed"),this.assertValidity(),f(O,this,B)}toHex(B=!0){return(0,pt.bytesToHex)(this.toBytes(B))}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}get px(){return this.X}get py(){return this.X}get pz(){return this.Z}toRawBytes(B=!0){return this.toBytes(B)}_setWindowSize(B){this.precompute(B)}static normalizeZ(B){return(0,Qy.normalizeZ)(O,B)}static msm(B,M){return(0,Qy.pippenger)(O,i,B,M)}static fromPrivateKey(B){return O.BASE.multiply(tT(i,B))}}O.BASE=new O(o.Gx,o.Gy,n.ONE),O.ZERO=new O(n.ZERO,n.ONE,n.ZERO),O.Fp=n,O.Fn=i;let P=i.BITS,x=new Qy.wNAF(O,t.endo?Math.ceil(P/2):P);return O.BASE.precompute(8),O}function Ayt(e){return Uint8Array.of(e?2:3)}function wyt(e,t){let r=e.ORDER,n=Ah;for(let m=r-Ec;m%Mg===Ah;m/=Mg)n+=Ec;let i=n,o=Mg<<i-Ec-Ec,s=o*Mg,a=(r-Ec)/s,c=(a-Ec)/Mg,u=s-Ec,d=o,l=e.pow(t,a),p=e.pow(t,(a+Ec)/Mg),f=(m,h)=>{let g=l,y=e.pow(h,u),S=e.sqr(y);S=e.mul(S,h);let b=e.mul(m,S);b=e.pow(b,c),b=e.mul(b,y),y=e.mul(b,h),S=e.mul(b,m);let E=e.mul(S,y);b=e.pow(E,d);let T=e.eql(b,e.ONE);y=e.mul(S,p),b=e.mul(E,g),S=e.cmov(y,S,T),E=e.cmov(b,E,T);for(let w=i;w>Ec;w--){let I=w-Mg;I=Mg<<I-Ec;let N=e.pow(E,I),O=e.eql(N,e.ONE);y=e.mul(S,g),g=e.mul(g,g),N=e.mul(E,g),S=e.cmov(y,S,O),E=e.cmov(N,E,O)}return{isValid:T,value:S}};if(e.ORDER%YRe===k8){let m=(e.ORDER-k8)/YRe,h=e.sqrt(e.neg(t));f=(g,y)=>{let S=e.sqr(y),b=e.mul(g,y);S=e.mul(S,b);let E=e.pow(S,m);E=e.mul(E,b);let T=e.mul(E,h),w=e.mul(e.sqr(E),y),I=e.eql(w,g),N=e.cmov(T,E,I);return{isValid:I,value:N}}}return f}function Ehn(e,t){(0,D8.validateField)(e);let{A:r,B:n,Z:i}=t;if(!e.isValid(r)||!e.isValid(n)||!e.isValid(i))throw new Error("mapToCurveSimpleSWU: invalid opts");let o=wyt(e,i);if(!e.isOdd)throw new Error("Field does not have .isOdd()");return s=>{let a,c,u,d,l,p,f,m;a=e.sqr(s),a=e.mul(a,i),c=e.sqr(a),c=e.add(c,a),u=e.add(c,e.ONE),u=e.mul(u,n),d=e.cmov(i,e.neg(c),!e.eql(c,e.ZERO)),d=e.mul(d,r),c=e.sqr(u),p=e.sqr(d),l=e.mul(p,r),c=e.add(c,l),c=e.mul(c,u),p=e.mul(p,d),l=e.mul(p,n),c=e.add(c,l),f=e.mul(a,u);let{isValid:h,value:g}=o(c,p);m=e.mul(a,s),m=e.mul(m,g),f=e.cmov(f,u,h),m=e.cmov(m,g,h);let y=e.isOdd(s)===e.isOdd(m);m=e.cmov(e.neg(m),m,y);let S=(0,D8.FpInvertBatch)(e,[d],!0)[0];return f=e.mul(f,S),{x:f,y:m}}}function Iyt(e,t){return{secretKey:t.BYTES,publicKey:1+e.BYTES,publicKeyUncompressed:1+2*e.BYTES,publicKeyHasPrefix:!0,signature:2*t.BYTES}}function Pyt(e,t={}){let{Fn:r}=e,n=t.randomBytes||pt.randomBytes,i=Object.assign(Iyt(e.Fp,r),{seed:(0,D8.getMinHashLength)(r.ORDER)});function o(f){try{return!!tT(r,f)}catch{return!1}}function s(f,m){let{publicKey:h,publicKeyUncompressed:g}=i;try{let y=f.length;return m===!0&&y!==h||m===!1&&y!==g?!1:!!e.fromBytes(f)}catch{return!1}}function a(f=n(i.seed)){return(0,D8.mapHashToField)((0,pt._abytes2)(f,i.seed,"seed"),r.ORDER)}function c(f,m=!0){return e.BASE.multiply(tT(r,f)).toBytes(m)}function u(f){let m=a(f);return{secretKey:m,publicKey:c(m)}}function d(f){if(typeof f=="bigint")return!1;if(f instanceof e)return!0;let{secretKey:m,publicKey:h,publicKeyUncompressed:g}=i;if(r.allowedLengths||m===h)return;let y=(0,pt.ensureBytes)("key",f).length;return y===h||y===g}function l(f,m,h=!0){if(d(f)===!0)throw new Error("first arg must be private key");if(d(m)===!1)throw new Error("second arg must be public key");let g=tT(r,f);return e.fromHex(m).multiply(g).toBytes(h)}return Object.freeze({getPublicKey:c,getSharedSecret:l,keygen:u,Point:e,utils:{isValidSecretKey:o,isValidPublicKey:s,randomSecretKey:a,isValidPrivateKey:o,randomPrivateKey:a,normPrivateKeyToScalar:f=>tT(r,f),precompute(f=8,m=e.BASE){return m.precompute(f,!1)}},lengths:i})}function xyt(e,t,r={}){(0,bhn.ahash)(t),(0,pt._validateObject)(r,{},{hmac:"function",lowS:"boolean",randomBytes:"function",bits2int:"function",bits2int_modN:"function"});let n=r.randomBytes||pt.randomBytes,i=r.hmac||((M,...R)=>(0,yhn.hmac)(t,M,(0,pt.concatBytes)(...R))),{Fp:o,Fn:s}=e,{ORDER:a,BITS:c}=s,{keygen:u,getPublicKey:d,getSharedSecret:l,utils:p,lengths:f}=Pyt(e,r),m={prehash:!1,lowS:typeof r.lowS=="boolean"?r.lowS:!1,format:void 0,extraEntropy:!1},h="compact";function g(M){let R=a>>Ec;return M>R}function y(M,R){if(!s.isValidNot0(R))throw new Error(`invalid signature ${M}: out of range 1..Point.Fn.ORDER`);return R}function S(M,R){WRe(R);let k=f.signature,U=R==="compact"?k:R==="recovered"?k+1:void 0;return(0,pt._abytes2)(M,U,`${R} signature`)}class b{constructor(R,k,U){this.r=y("r",R),this.s=y("s",k),U!=null&&(this.recovery=U),Object.freeze(this)}static fromBytes(R,k=h){S(R,k);let U;if(k==="der"){let{r:F,s:H}=_i.DER.toSig((0,pt._abytes2)(R));return new b(F,H)}k==="recovered"&&(U=R[0],k="compact",R=R.subarray(1));let L=s.BYTES,q=R.subarray(0,L),j=R.subarray(L,L*2);return new b(s.fromBytes(q),s.fromBytes(j),U)}static fromHex(R,k){return this.fromBytes((0,pt.hexToBytes)(R),k)}addRecoveryBit(R){return new b(this.r,this.s,R)}recoverPublicKey(R){let k=o.ORDER,{r:U,s:L,recovery:q}=this;if(q==null||![0,1,2,3].includes(q))throw new Error("recovery id invalid");if(a*Mg<k&&q>1)throw new Error("recovery id is ambiguous for h>1 curve");let F=q===2||q===3?U+a:U;if(!o.isValid(F))throw new Error("recovery id 2 or 3 invalid");let H=o.toBytes(F),ee=e.fromBytes((0,pt.concatBytes)(Ayt((q&1)===0),H)),ne=s.inv(F),Q=T((0,pt.ensureBytes)("msgHash",R)),le=s.create(-Q*ne),_e=s.create(L*ne),we=e.BASE.multiplyUnsafe(le).add(ee.multiplyUnsafe(_e));if(we.is0())throw new Error("point at infinify");return we.assertValidity(),we}hasHighS(){return g(this.s)}toBytes(R=h){if(WRe(R),R==="der")return(0,pt.hexToBytes)(_i.DER.hexFromSig(this));let k=s.toBytes(this.r),U=s.toBytes(this.s);if(R==="recovered"){if(this.recovery==null)throw new Error("recovery bit must be present");return(0,pt.concatBytes)(Uint8Array.of(this.recovery),k,U)}return(0,pt.concatBytes)(k,U)}toHex(R){return(0,pt.bytesToHex)(this.toBytes(R))}assertValidity(){}static fromCompact(R){return b.fromBytes((0,pt.ensureBytes)("sig",R),"compact")}static fromDER(R){return b.fromBytes((0,pt.ensureBytes)("sig",R),"der")}normalizeS(){return this.hasHighS()?new b(this.r,s.neg(this.s),this.recovery):this}toDERRawBytes(){return this.toBytes("der")}toDERHex(){return(0,pt.bytesToHex)(this.toBytes("der"))}toCompactRawBytes(){return this.toBytes("compact")}toCompactHex(){return(0,pt.bytesToHex)(this.toBytes("compact"))}}let E=r.bits2int||function(R){if(R.length>8192)throw new Error("input is too large");let k=(0,pt.bytesToNumberBE)(R),U=R.length*8-c;return U>0?k>>BigInt(U):k},T=r.bits2int_modN||function(R){return s.create(E(R))},w=(0,pt.bitMask)(c);function I(M){return(0,pt.aInRange)("num < 2^"+c,M,Ah,w),s.toBytes(M)}function N(M,R){return(0,pt._abytes2)(M,void 0,"message"),R?(0,pt._abytes2)(t(M),void 0,"prehashed message"):M}function O(M,R,k){if(["recovered","canonical"].some(le=>le in k))throw new Error("sign() legacy options not supported");let{lowS:U,prehash:L,extraEntropy:q}=KRe(k,m);M=N(M,L);let j=T(M),F=tT(s,R),H=[I(F),I(j)];if(q!=null&&q!==!1){let le=q===!0?n(f.secretKey):q;H.push((0,pt.ensureBytes)("extraEntropy",le))}let ee=(0,pt.concatBytes)(...H),ne=j;function Q(le){let _e=E(le);if(!s.isValidNot0(_e))return;let we=s.inv(_e),Ee=e.BASE.multiply(_e).toAffine(),Te=s.create(Ee.x);if(Te===Ah)return;let Ke=s.create(we*s.create(ne+Te*F));if(Ke===Ah)return;let We=(Ee.x===Te?0:2)|Number(Ee.y&Ec),gt=Ke;return U&&g(Ke)&&(gt=s.neg(Ke),We^=1),new b(Te,gt,We)}return{seed:ee,k2sig:Q}}function P(M,R,k={}){M=(0,pt.ensureBytes)("message",M);let{seed:U,k2sig:L}=O(M,R,k);return(0,pt.createHmacDrbg)(t.outputLen,s.BYTES,i)(U,L)}function x(M){let R,k=typeof M=="string"||(0,pt.isBytes)(M),U=!k&&M!==null&&typeof M=="object"&&typeof M.r=="bigint"&&typeof M.s=="bigint";if(!k&&!U)throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");if(U)R=new b(M.r,M.s);else if(k){try{R=b.fromBytes((0,pt.ensureBytes)("sig",M),"der")}catch(L){if(!(L instanceof _i.DER.Err))throw L}if(!R)try{R=b.fromBytes((0,pt.ensureBytes)("sig",M),"compact")}catch{return!1}}return R||!1}function D(M,R,k,U={}){let{lowS:L,prehash:q,format:j}=KRe(U,m);if(k=(0,pt.ensureBytes)("publicKey",k),R=N((0,pt.ensureBytes)("message",R),q),"strict"in U)throw new Error("options.strict was renamed to lowS");let F=j===void 0?x(M):b.fromBytes((0,pt.ensureBytes)("sig",M),j);if(F===!1)return!1;try{let H=e.fromBytes(k);if(L&&F.hasHighS())return!1;let{r:ee,s:ne}=F,Q=T(R),le=s.inv(ne),_e=s.create(Q*le),we=s.create(ee*le),Ee=e.BASE.multiplyUnsafe(_e).add(H.multiplyUnsafe(we));return Ee.is0()?!1:s.create(Ee.x)===ee}catch{return!1}}function B(M,R,k={}){let{prehash:U}=KRe(k,m);return R=N(R,U),b.fromBytes(M,"recovered").recoverPublicKey(R).toBytes()}return Object.freeze({keygen:u,getPublicKey:d,getSharedSecret:l,utils:p,lengths:f,Point:e,sign:P,verify:D,recoverPublicKey:B,Signature:b,hash:t})}function Shn(e){let{CURVE:t,curveOpts:r}=Oyt(e),n=JRe(t,r);return Thn(e,n)}function Oyt(e){let t={a:e.a,b:e.b,p:e.Fp.ORDER,n:e.n,h:e.h,Gx:e.Gx,Gy:e.Gy},r=e.Fp,n=e.allowedPrivateKeyLengths?Array.from(new Set(e.allowedPrivateKeyLengths.map(s=>Math.ceil(s/2)))):void 0,i=(0,D8.Field)(t.n,{BITS:e.nBitLength,allowedLengths:n,modFromBytes:e.wrapPrivateKey}),o={Fp:r,Fn:i,allowInfinityPoint:e.allowInfinityPoint,endo:e.endo,isTorsionFree:e.isTorsionFree,clearCofactor:e.clearCofactor,fromBytes:e.fromBytes,toBytes:e.toBytes};return{CURVE:t,curveOpts:o}}function vhn(e){let{CURVE:t,curveOpts:r}=Oyt(e),n={hmac:e.hmac,randomBytes:e.randomBytes,lowS:e.lowS,bits2int:e.bits2int,bits2int_modN:e.bits2int_modN};return{CURVE:t,curveOpts:r,hash:e.hash,ecdsaOpts:n}}function Ryt(e,t,r){function n(i){let o=e.sqr(i),s=e.mul(o,i);return e.add(e.add(s,e.mul(i,t)),r)}return n}function Thn(e,t){let{Fp:r,Fn:n}=t;function i(s){return(0,pt.inRange)(s,Ec,n.ORDER)}let o=Ryt(r,e.a,e.b);return Object.assign({},{CURVE:e,Point:t,ProjectivePoint:t,normPrivateKeyToScalar:s=>tT(n,s),weierstrassEquation:o,isWithinCurveOrder:i})}function Ahn(e,t){let r=t.Point;return Object.assign({},t,{ProjectivePoint:r,CURVE:Object.assign({},e,(0,D8.nLength)(r.Fn.ORDER,r.Fn.BITS))})}function whn(e){let{CURVE:t,curveOpts:r,hash:n,ecdsaOpts:i}=vhn(e),o=JRe(t,r),s=xyt(o,n,i);return Ahn(e,s)}});var XRe=_(zte=>{"use strict";Object.defineProperty(zte,"__esModule",{value:!0});zte.getHash=Phn;zte.createCurve=xhn;var Ihn=$te();function Phn(e){return{hash:e}}function xhn(e,t){let r=n=>(0,Ihn.weierstrass)({...e,hash:n});return{...r(t),create:r}}});var ZRe=_(kg=>{"use strict";Object.defineProperty(kg,"__esModule",{value:!0});kg._DST_scalar=void 0;kg.expand_message_xmd=Myt;kg.expand_message_xof=kyt;kg.hash_to_field=Gte;kg.isogenyMap=Nhn;kg.createHasher=Chn;var Sc=C8(),Nyt=JI(),Ohn=Sc.bytesToNumberBE;function rT(e,t){if(VB(e),VB(t),e<0||e>=1<<8*t)throw new Error("invalid I2OSP input: "+e);let r=Array.from({length:t}).fill(0);for(let n=t-1;n>=0;n--)r[n]=e&255,e>>>=8;return new Uint8Array(r)}function Rhn(e,t){let r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e[n]^t[n];return r}function VB(e){if(!Number.isSafeInteger(e))throw new Error("number expected")}function Cyt(e){if(!(0,Sc.isBytes)(e)&&typeof e!="string")throw new Error("DST must be Uint8Array or string");return typeof e=="string"?(0,Sc.utf8ToBytes)(e):e}function Myt(e,t,r,n){(0,Sc.abytes)(e),VB(r),t=Cyt(t),t.length>255&&(t=n((0,Sc.concatBytes)((0,Sc.utf8ToBytes)("H2C-OVERSIZE-DST-"),t)));let{outputLen:i,blockLen:o}=n,s=Math.ceil(r/i);if(r>65535||s>255)throw new Error("expand_message_xmd: invalid lenInBytes");let a=(0,Sc.concatBytes)(t,rT(t.length,1)),c=rT(0,o),u=rT(r,2),d=new Array(s),l=n((0,Sc.concatBytes)(c,e,u,rT(0,1),a));d[0]=n((0,Sc.concatBytes)(l,rT(1,1),a));for(let f=1;f<=s;f++){let m=[Rhn(l,d[f-1]),rT(f+1,1),a];d[f]=n((0,Sc.concatBytes)(...m))}return(0,Sc.concatBytes)(...d).slice(0,r)}function kyt(e,t,r,n,i){if((0,Sc.abytes)(e),VB(r),t=Cyt(t),t.length>255){let o=Math.ceil(2*n/8);t=i.create({dkLen:o}).update((0,Sc.utf8ToBytes)("H2C-OVERSIZE-DST-")).update(t).digest()}if(r>65535||t.length>255)throw new Error("expand_message_xof: invalid lenInBytes");return i.create({dkLen:r}).update(e).update(rT(r,2)).update(t).update(rT(t.length,1)).digest()}function Gte(e,t,r){(0,Sc._validateObject)(r,{p:"bigint",m:"number",k:"number",hash:"function"});let{p:n,k:i,m:o,hash:s,expand:a,DST:c}=r;if(!(0,Sc.isHash)(r.hash))throw new Error("expected valid hash");(0,Sc.abytes)(e),VB(t);let u=n.toString(2).length,d=Math.ceil((u+i)/8),l=t*o*d,p;if(a==="xmd")p=Myt(e,c,l,s);else if(a==="xof")p=kyt(e,c,l,i,s);else if(a==="_internal_pass")p=e;else throw new Error('expand must be "xmd" or "xof"');let f=new Array(t);for(let m=0;m<t;m++){let h=new Array(o);for(let g=0;g<o;g++){let y=d*(g+m*o),S=p.subarray(y,y+d);h[g]=(0,Nyt.mod)(Ohn(S),n)}f[m]=h}return f}function Nhn(e,t){let r=t.map(n=>Array.from(n).reverse());return(n,i)=>{let[o,s,a,c]=r.map(l=>l.reduce((p,f)=>e.add(e.mul(p,n),f))),[u,d]=(0,Nyt.FpInvertBatch)(e,[s,c],!0);return n=e.mul(o,u),i=e.mul(i,e.mul(a,d)),{x:n,y:i}}}kg._DST_scalar=(0,Sc.utf8ToBytes)("HashToScalar-");function Chn(e,t,r){if(typeof t!="function")throw new Error("mapToCurve() must be defined");function n(o){return e.fromAffine(t(o))}function i(o){let s=o.clearCofactor();return s.equals(e.ZERO)?e.ZERO:(s.assertValidity(),s)}return{defaults:r,hashToCurve(o,s){let a=Object.assign({},r,s),c=Gte(o,2,a),u=n(c[0]),d=n(c[1]);return i(u.add(d))},encodeToCurve(o,s){let a=r.encodeDST?{DST:r.encodeDST}:{},c=Object.assign({},r,a,s),u=Gte(o,1,c),d=n(u[0]);return i(d)},mapToCurve(o){if(!Array.isArray(o))throw new Error("expected array of bigints");for(let s of o)if(typeof s!="bigint")throw new Error("expected array of bigints");return i(n(o))},hashToScalar(o,s){let a=e.Fn.ORDER,c=Object.assign({},r,{p:a,m:1,DST:kg._DST_scalar},s);return Gte(o,1,c)[0][0]}}}});var $yt=_(vc=>{"use strict";Object.defineProperty(vc,"__esModule",{value:!0});vc.encodeToCurve=vc.hashToCurve=vc.secp256k1_hasher=vc.schnorr=vc.secp256k1=void 0;var Kte=ag(),Byt=Zo(),Mhn=XRe(),jyt=ZRe(),ed=JI(),qyt=$te(),Ep=C8(),L8={p:BigInt("0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f"),n:BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),h:BigInt(1),a:BigInt(0),b:BigInt(7),Gx:BigInt("0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"),Gy:BigInt("0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")},khn={beta:BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),basises:[[BigInt("0x3086d221a7d46bcde86c90e49284eb15"),-BigInt("0xe4437ed6010e88286f547fa90abfe4c3")],[BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),BigInt("0x3086d221a7d46bcde86c90e49284eb15")]]},Dhn=BigInt(0),Dyt=BigInt(1),QRe=BigInt(2);function Lhn(e){let t=L8.p,r=BigInt(3),n=BigInt(6),i=BigInt(11),o=BigInt(22),s=BigInt(23),a=BigInt(44),c=BigInt(88),u=e*e*e%t,d=u*u*e%t,l=(0,ed.pow2)(d,r,t)*d%t,p=(0,ed.pow2)(l,r,t)*d%t,f=(0,ed.pow2)(p,QRe,t)*u%t,m=(0,ed.pow2)(f,i,t)*f%t,h=(0,ed.pow2)(m,o,t)*m%t,g=(0,ed.pow2)(h,a,t)*h%t,y=(0,ed.pow2)(g,c,t)*g%t,S=(0,ed.pow2)(y,a,t)*h%t,b=(0,ed.pow2)(S,r,t)*d%t,E=(0,ed.pow2)(b,s,t)*m%t,T=(0,ed.pow2)(E,n,t)*u%t,w=(0,ed.pow2)(T,QRe,t);if(!eb.eql(eb.sqr(w),e))throw new Error("Cannot find square root");return w}var eb=(0,ed.Field)(L8.p,{sqrt:Lhn});vc.secp256k1=(0,Mhn.createCurve)({...L8,Fp:eb,lowS:!0,endo:khn},Kte.sha256);var Lyt={};function Wte(e,...t){let r=Lyt[e];if(r===void 0){let n=(0,Kte.sha256)((0,Ep.utf8ToBytes)(e));r=(0,Ep.concatBytes)(n,n),Lyt[e]=r}return(0,Kte.sha256)((0,Ep.concatBytes)(r,...t))}var t8e=e=>e.toBytes(!0).slice(1),U8=vc.secp256k1.Point,r8e=e=>e%QRe===Dhn;function e8e(e){let{Fn:t,BASE:r}=U8,n=(0,qyt._normFnElement)(t,e),i=r.multiply(n);return{scalar:r8e(i.y)?n:t.neg(n),bytes:t8e(i)}}function Hyt(e){let t=eb;if(!t.isValidNot0(e))throw new Error("invalid x: Fail if x \u2265 p");let r=t.create(e*e),n=t.create(r*e+BigInt(7)),i=t.sqrt(n);r8e(i)||(i=t.neg(i));let o=U8.fromAffine({x:e,y:i});return o.assertValidity(),o}var FB=Ep.bytesToNumberBE;function Vyt(...e){return U8.Fn.create(FB(Wte("BIP0340/challenge",...e)))}function Uyt(e){return e8e(e).bytes}function Uhn(e,t,r=(0,Byt.randomBytes)(32)){let{Fn:n}=U8,i=(0,Ep.ensureBytes)("message",e),{bytes:o,scalar:s}=e8e(t),a=(0,Ep.ensureBytes)("auxRand",r,32),c=n.toBytes(s^FB(Wte("BIP0340/aux",a))),u=Wte("BIP0340/nonce",c,o,i),{bytes:d,scalar:l}=e8e(u),p=Vyt(d,o,i),f=new Uint8Array(64);if(f.set(d,0),f.set(n.toBytes(n.create(l+p*s)),32),!Fyt(f,i,o))throw new Error("sign: Invalid signature produced");return f}function Fyt(e,t,r){let{Fn:n,BASE:i}=U8,o=(0,Ep.ensureBytes)("signature",e,64),s=(0,Ep.ensureBytes)("message",t),a=(0,Ep.ensureBytes)("publicKey",r,32);try{let c=Hyt(FB(a)),u=FB(o.subarray(0,32));if(!(0,Ep.inRange)(u,Dyt,L8.p))return!1;let d=FB(o.subarray(32,64));if(!(0,Ep.inRange)(d,Dyt,L8.n))return!1;let l=Vyt(n.toBytes(u),t8e(c),s),p=i.multiplyUnsafe(d).add(c.multiplyUnsafe(n.neg(l))),{x:f,y:m}=p.toAffine();return!(p.is0()||!r8e(m)||f!==u)}catch{return!1}}vc.schnorr=(()=>{let r=(i=(0,Byt.randomBytes)(48))=>(0,ed.mapHashToField)(i,L8.n);vc.secp256k1.utils.randomSecretKey;function n(i){let o=r(i);return{secretKey:o,publicKey:Uyt(o)}}return{keygen:n,getPublicKey:Uyt,sign:Uhn,verify:Fyt,Point:U8,utils:{randomSecretKey:r,randomPrivateKey:r,taggedHash:Wte,lift_x:Hyt,pointToBytes:t8e,numberToBytesBE:Ep.numberToBytesBE,bytesToNumberBE:Ep.bytesToNumberBE,mod:ed.mod},lengths:{secretKey:32,publicKey:32,publicKeyHasPrefix:!1,signature:64,seed:48}}})();var Bhn=(0,jyt.isogenyMap)(eb,[["0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7","0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581","0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262","0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c"],["0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b","0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14","0x0000000000000000000000000000000000000000000000000000000000000001"],["0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c","0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3","0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931","0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84"],["0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b","0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573","0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f","0x0000000000000000000000000000000000000000000000000000000000000001"]].map(e=>e.map(t=>BigInt(t)))),jhn=(0,qyt.mapToCurveSimpleSWU)(eb,{A:BigInt("0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533"),B:BigInt("1771"),Z:eb.create(BigInt("-11"))});vc.secp256k1_hasher=(0,jyt.createHasher)(vc.secp256k1.Point,e=>{let{x:t,y:r}=jhn(eb.create(e[0]));return Bhn(t,r)},{DST:"secp256k1_XMD:SHA-256_SSWU_RO_",encodeDST:"secp256k1_XMD:SHA-256_SSWU_NU_",p:eb.ORDER,m:1,k:128,expand:"xmd",hash:Kte.sha256});vc.hashToCurve=vc.secp256k1_hasher.hashToCurve;vc.encodeToCurve=vc.secp256k1_hasher.encodeToCurve});var u8e=_(Fe=>{"use strict";Object.defineProperty(Fe,"__esModule",{value:!0});Fe.bytes=Fe.stringToBytes=Fe.str=Fe.bytesToString=Fe.hex=Fe.utf8=Fe.bech32m=Fe.bech32=Fe.base58check=Fe.createBase58check=Fe.base58xmr=Fe.base58xrp=Fe.base58flickr=Fe.base58=Fe.base64urlnopad=Fe.base64url=Fe.base64nopad=Fe.base64=Fe.base32crockford=Fe.base32hexnopad=Fe.base32hex=Fe.base32nopad=Fe.base32=Fe.base16=Fe.utils=void 0;function ZI(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function o8e(e,...t){if(!ZI(e))throw new Error("Uint8Array expected");if(t.length>0&&!t.includes(e.length))throw new Error("Uint8Array expected of length "+t+", got length="+e.length)}function Yyt(e,t){return Array.isArray(t)?t.length===0?!0:e?t.every(r=>typeof r=="string"):t.every(r=>Number.isSafeInteger(r)):!1}function s8e(e){if(typeof e!="function")throw new Error("function expected");return!0}function nT(e,t){if(typeof t!="string")throw new Error(`${e}: string expected`);return!0}function B8(e){if(!Number.isSafeInteger(e))throw new Error(`invalid integer: ${e}`)}function Jte(e){if(!Array.isArray(e))throw new Error("array expected")}function Xte(e,t){if(!Yyt(!0,t))throw new Error(`${e}: array of strings expected`)}function a8e(e,t){if(!Yyt(!1,t))throw new Error(`${e}: array of numbers expected`)}function td(...e){let t=o=>o,r=(o,s)=>a=>o(s(a)),n=e.map(o=>o.encode).reduceRight(r,t),i=e.map(o=>o.decode).reduce(r,t);return{encode:n,decode:i}}function al(e){let t=typeof e=="string"?e.split(""):e,r=t.length;Xte("alphabet",t);let n=new Map(t.map((i,o)=>[i,o]));return{encode:i=>(Jte(i),i.map(o=>{if(!Number.isSafeInteger(o)||o<0||o>=r)throw new Error(`alphabet.encode: digit index outside alphabet "${o}". Allowed: ${e}`);return t[o]})),decode:i=>(Jte(i),i.map(o=>{nT("alphabet.decode",o);let s=n.get(o);if(s===void 0)throw new Error(`Unknown letter: "${o}". Allowed: ${e}`);return s}))}}function cl(e=""){return nT("join",e),{encode:t=>(Xte("join.decode",t),t.join(e)),decode:t=>(nT("join.decode",t),t.split(e))}}function zB(e,t="="){return B8(e),nT("padding",t),{encode(r){for(Xte("padding.encode",r);r.length*e%8;)r.push(t);return r},decode(r){Xte("padding.decode",r);let n=r.length;if(n*e%8)throw new Error("padding: invalid, string should have whole number of bytes");for(;n>0&&r[n-1]===t;n--)if((n-1)*e%8===0)throw new Error("padding: invalid, string has too much padding");return r.slice(0,n)}}}function Jyt(e){return s8e(e),{encode:t=>t,decode:t=>e(t)}}function n8e(e,t,r){if(t<2)throw new Error(`convertRadix: invalid from=${t}, base cannot be less than 2`);if(r<2)throw new Error(`convertRadix: invalid to=${r}, base cannot be less than 2`);if(Jte(e),!e.length)return[];let n=0,i=[],o=Array.from(e,a=>{if(B8(a),a<0||a>=t)throw new Error(`invalid integer: ${a}`);return a}),s=o.length;for(;;){let a=0,c=!0;for(let u=n;u<s;u++){let d=o[u],l=t*a,p=l+d;if(!Number.isSafeInteger(p)||l/t!==a||p-d!==l)throw new Error("convertRadix: carry overflow");let f=p/r;a=p%r;let m=Math.floor(f);if(o[u]=m,!Number.isSafeInteger(m)||m*r+a!==p)throw new Error("convertRadix: carry overflow");if(c)m?c=!1:n=u;else continue}if(i.push(a),c)break}for(let a=0;a<e.length-1&&e[a]===0;a++)i.push(0);return i.reverse()}var Xyt=(e,t)=>t===0?e:Xyt(t,e%t),Zte=(e,t)=>e+(t-Xyt(e,t)),Yte=(()=>{let e=[];for(let t=0;t<40;t++)e.push(2**t);return e})();function Qte(e,t,r,n){if(Jte(e),t<=0||t>32)throw new Error(`convertRadix2: wrong from=${t}`);if(r<=0||r>32)throw new Error(`convertRadix2: wrong to=${r}`);if(Zte(t,r)>32)throw new Error(`convertRadix2: carry overflow from=${t} to=${r} carryBits=${Zte(t,r)}`);let i=0,o=0,s=Yte[t],a=Yte[r]-1,c=[];for(let u of e){if(B8(u),u>=s)throw new Error(`convertRadix2: invalid data word=${u} from=${t}`);if(i=i<<t|u,o+t>32)throw new Error(`convertRadix2: carry overflow pos=${o} from=${t}`);for(o+=t;o>=r;o-=r)c.push((i>>o-r&a)>>>0);let d=Yte[o];if(d===void 0)throw new Error("invalid carry");i&=d-1}if(i=i<<r-o&a,!n&&o>=t)throw new Error("Excess padding");if(!n&&i>0)throw new Error(`Non-zero padding: ${i}`);return n&&o>0&&c.push(i>>>0),c}function Zyt(e){B8(e);let t=2**8;return{encode:r=>{if(!ZI(r))throw new Error("radix.encode input should be Uint8Array");return n8e(Array.from(r),t,e)},decode:r=>(a8e("radix.decode",r),Uint8Array.from(n8e(r,e,t)))}}function Sp(e,t=!1){if(B8(e),e<=0||e>32)throw new Error("radix2: bits should be in (0..32]");if(Zte(8,e)>32||Zte(e,8)>32)throw new Error("radix2: carry overflow");return{encode:r=>{if(!ZI(r))throw new Error("radix2.encode input should be Uint8Array");return Qte(Array.from(r),8,e,!t)},decode:r=>(a8e("radix2.decode",r),Uint8Array.from(Qte(r,e,8,t)))}}function zyt(e){return s8e(e),function(...t){try{return e.apply(null,t)}catch{}}}function Qyt(e,t){return B8(e),s8e(t),{encode(r){if(!ZI(r))throw new Error("checksum.encode: input should be Uint8Array");let n=t(r).slice(0,e),i=new Uint8Array(r.length+e);return i.set(r),i.set(n,r.length),i},decode(r){if(!ZI(r))throw new Error("checksum.decode: input should be Uint8Array");let n=r.slice(0,-e),i=r.slice(-e),o=t(n).slice(0,e);for(let s=0;s<e;s++)if(o[s]!==i[s])throw new Error("Invalid checksum");return n}}}Fe.utils={alphabet:al,chain:td,checksum:Qyt,convertRadix:n8e,convertRadix2:Qte,radix:Zyt,radix2:Sp,join:cl,padding:zB};Fe.base16=td(Sp(4),al("0123456789ABCDEF"),cl(""));Fe.base32=td(Sp(5),al("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"),zB(5),cl(""));Fe.base32nopad=td(Sp(5),al("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"),cl(""));Fe.base32hex=td(Sp(5),al("0123456789ABCDEFGHIJKLMNOPQRSTUV"),zB(5),cl(""));Fe.base32hexnopad=td(Sp(5),al("0123456789ABCDEFGHIJKLMNOPQRSTUV"),cl(""));Fe.base32crockford=td(Sp(5),al("0123456789ABCDEFGHJKMNPQRSTVWXYZ"),cl(""),Jyt(e=>e.toUpperCase().replace(/O/g,"0").replace(/[IL]/g,"1")));var ebt=typeof Uint8Array.from([]).toBase64=="function"&&typeof Uint8Array.fromBase64=="function",tbt=(e,t)=>{nT("base64",e);let r=t?/^[A-Za-z0-9=_-]+$/:/^[A-Za-z0-9=+/]+$/,n=t?"base64url":"base64";if(e.length>0&&!r.test(e))throw new Error("invalid base64");return Uint8Array.fromBase64(e,{alphabet:n,lastChunkHandling:"strict"})};Fe.base64=ebt?{encode(e){return o8e(e),e.toBase64()},decode(e){return tbt(e,!1)}}:td(Sp(6),al("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),zB(6),cl(""));Fe.base64nopad=td(Sp(6),al("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),cl(""));Fe.base64url=ebt?{encode(e){return o8e(e),e.toBase64({alphabet:"base64url"})},decode(e){return tbt(e,!0)}}:td(Sp(6),al("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"),zB(6),cl(""));Fe.base64urlnopad=td(Sp(6),al("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"),cl(""));var c8e=e=>td(Zyt(58),al(e),cl(""));Fe.base58=c8e("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz");Fe.base58flickr=c8e("123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ");Fe.base58xrp=c8e("rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz");var Gyt=[0,2,3,5,6,7,9,10,11];Fe.base58xmr={encode(e){let t="";for(let r=0;r<e.length;r+=8){let n=e.subarray(r,r+8);t+=Fe.base58.encode(n).padStart(Gyt[n.length],"1")}return t},decode(e){let t=[];for(let r=0;r<e.length;r+=11){let n=e.slice(r,r+11),i=Gyt.indexOf(n.length),o=Fe.base58.decode(n);for(let s=0;s<o.length-i;s++)if(o[s]!==0)throw new Error("base58xmr: wrong padding");t=t.concat(Array.from(o.slice(o.length-i)))}return Uint8Array.from(t)}};var qhn=e=>td(Qyt(4,t=>e(e(t))),Fe.base58);Fe.createBase58check=qhn;Fe.base58check=Fe.createBase58check;var i8e=td(al("qpzry9x8gf2tvdw0s3jn54khce6mua7l"),cl("")),Kyt=[996825010,642813549,513874426,1027748829,705979059];function $B(e){let t=e>>25,r=(e&33554431)<<5;for(let n=0;n<Kyt.length;n++)(t>>n&1)===1&&(r^=Kyt[n]);return r}function Wyt(e,t,r=1){let n=e.length,i=1;for(let o=0;o<n;o++){let s=e.charCodeAt(o);if(s<33||s>126)throw new Error(`Invalid prefix (${e})`);i=$B(i)^s>>5}i=$B(i);for(let o=0;o<n;o++)i=$B(i)^e.charCodeAt(o)&31;for(let o of t)i=$B(i)^o;for(let o=0;o<6;o++)i=$B(i);return i^=r,i8e.encode(Qte([i%Yte[30]],30,5,!1))}function rbt(e){let t=e==="bech32"?1:734539939,r=Sp(5),n=r.decode,i=r.encode,o=zyt(n);function s(l,p,f=90){nT("bech32.encode prefix",l),ZI(p)&&(p=Array.from(p)),a8e("bech32.encode",p);let m=l.length;if(m===0)throw new TypeError(`Invalid prefix length ${m}`);let h=m+7+p.length;if(f!==!1&&h>f)throw new TypeError(`Length ${h} exceeds limit ${f}`);let g=l.toLowerCase(),y=Wyt(g,p,t);return`${g}1${i8e.encode(p)}${y}`}function a(l,p=90){nT("bech32.decode input",l);let f=l.length;if(f<8||p!==!1&&f>p)throw new TypeError(`invalid string length: ${f} (${l}). Expected (8..${p})`);let m=l.toLowerCase();if(l!==m&&l!==l.toUpperCase())throw new Error("String must be lowercase or uppercase");let h=m.lastIndexOf("1");if(h===0||h===-1)throw new Error('Letter "1" must be present between prefix and data only');let g=m.slice(0,h),y=m.slice(h+1);if(y.length<6)throw new Error("Data must be at least 6 characters long");let S=i8e.decode(y).slice(0,-6),b=Wyt(g,S,t);if(!y.endsWith(b))throw new Error(`Invalid checksum in ${l}: expected "${b}"`);return{prefix:g,words:S}}let c=zyt(a);function u(l){let{prefix:p,words:f}=a(l,!1);return{prefix:p,words:f,bytes:n(f)}}function d(l,p){return s(l,i(p))}return{encode:s,decode:a,encodeFromBytes:d,decodeToBytes:u,decodeUnsafe:c,fromWords:n,fromWordsUnsafe:o,toWords:i}}Fe.bech32=rbt("bech32");Fe.bech32m=rbt("bech32m");Fe.utf8={encode:e=>new TextDecoder().decode(e),decode:e=>new TextEncoder().encode(e)};var Hhn=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",Vhn={encode(e){return o8e(e),e.toHex()},decode(e){return nT("hex",e),Uint8Array.fromHex(e)}};Fe.hex=Hhn?Vhn:td(Sp(4),al("0123456789abcdef"),cl(""),Jyt(e=>{if(typeof e!="string"||e.length%2!==0)throw new TypeError(`hex.decode: expected string, got ${typeof e} with length ${e.length}`);return e.toLowerCase()}));var ere={utf8:Fe.utf8,hex:Fe.hex,base16:Fe.base16,base32:Fe.base32,base64:Fe.base64,base64url:Fe.base64url,base58:Fe.base58,base58xmr:Fe.base58xmr},nbt="Invalid encoding type. Available types: utf8, hex, base16, base32, base64, base64url, base58, base58xmr",Fhn=(e,t)=>{if(typeof e!="string"||!ere.hasOwnProperty(e))throw new TypeError(nbt);if(!ZI(t))throw new TypeError("bytesToString() expects Uint8Array");return ere[e].encode(t)};Fe.bytesToString=Fhn;Fe.str=Fe.bytesToString;var $hn=(e,t)=>{if(!ere.hasOwnProperty(e))throw new TypeError(nbt);if(typeof t!="string")throw new TypeError("stringToBytes() expects string");return ere[e].decode(t)};Fe.stringToBytes=$hn;Fe.bytes=Fe.stringToBytes});var f8e=_(rb=>{"use strict";Object.defineProperty(rb,"__esModule",{value:!0});rb.HDKey=rb.HARDENED_OFFSET=void 0;var zhn=JI(),tb=$yt(),ibt=cv(),Ghn=BAe(),nre=ag(),du=Zo(),Khn=u8e(),tre=tb.secp256k1.ProjectivePoint,d8e=(0,Khn.createBase58check)(nre.sha256);function obt(e){(0,du.abytes)(e);let t=e.length===0?"0":(0,du.bytesToHex)(e);return BigInt("0x"+t)}function Whn(e){if(typeof e!="bigint")throw new Error("bigint expected");return(0,du.hexToBytes)(e.toString(16).padStart(64,"0"))}var Yhn=(0,du.utf8ToBytes)("Bitcoin seed"),l8e={private:76066276,public:76067358};rb.HARDENED_OFFSET=2147483648;var Jhn=e=>(0,Ghn.ripemd160)((0,nre.sha256)(e)),Xhn=e=>(0,du.createView)(e).getUint32(0,!1),rre=e=>{if(!Number.isSafeInteger(e)||e<0||e>2**32-1)throw new Error("invalid number, should be from 0 to 2**32-1, got "+e);let t=new Uint8Array(4);return(0,du.createView)(t).setUint32(0,e,!1),t},p8e=class e{get fingerprint(){if(!this.pubHash)throw new Error("No publicKey set!");return Xhn(this.pubHash)}get identifier(){return this.pubHash}get pubKeyHash(){return this.pubHash}get privateKey(){return this.privKeyBytes||null}get publicKey(){return this.pubKey||null}get privateExtendedKey(){let t=this.privateKey;if(!t)throw new Error("No private key");return d8e.encode(this.serialize(this.versions.private,(0,du.concatBytes)(new Uint8Array([0]),t)))}get publicExtendedKey(){if(!this.pubKey)throw new Error("No public key");return d8e.encode(this.serialize(this.versions.public,this.pubKey))}static fromMasterSeed(t,r=l8e){if((0,du.abytes)(t),8*t.length<128||8*t.length>512)throw new Error("HDKey: seed length must be between 128 and 512 bits; 256 bits is advised, got "+t.length);let n=(0,ibt.hmac)(nre.sha512,Yhn,t);return new e({versions:r,chainCode:n.slice(32),privateKey:n.slice(0,32)})}static fromExtendedKey(t,r=l8e){let n=d8e.decode(t),i=(0,du.createView)(n),o=i.getUint32(0,!1),s={versions:r,depth:n[4],parentFingerprint:i.getUint32(5,!1),index:i.getUint32(9,!1),chainCode:n.slice(13,45)},a=n.slice(45),c=a[0]===0;if(o!==r[c?"private":"public"])throw new Error("Version mismatch");return c?new e({...s,privateKey:a.slice(1)}):new e({...s,publicKey:a})}static fromJSON(t){return e.fromExtendedKey(t.xpriv)}constructor(t){if(this.depth=0,this.index=0,this.chainCode=null,this.parentFingerprint=0,!t||typeof t!="object")throw new Error("HDKey.constructor must not be called directly");if(this.versions=t.versions||l8e,this.depth=t.depth||0,this.chainCode=t.chainCode||null,this.index=t.index||0,this.parentFingerprint=t.parentFingerprint||0,!this.depth&&(this.parentFingerprint||this.index))throw new Error("HDKey: zero depth with non-zero index/parent fingerprint");if(t.publicKey&&t.privateKey)throw new Error("HDKey: publicKey and privateKey at same time.");if(t.privateKey){if(!tb.secp256k1.utils.isValidPrivateKey(t.privateKey))throw new Error("Invalid private key");this.privKey=typeof t.privateKey=="bigint"?t.privateKey:obt(t.privateKey),this.privKeyBytes=Whn(this.privKey),this.pubKey=tb.secp256k1.getPublicKey(t.privateKey,!0)}else if(t.publicKey)this.pubKey=tre.fromHex(t.publicKey).toRawBytes(!0);else throw new Error("HDKey: no public or private key provided");this.pubHash=Jhn(this.pubKey)}derive(t){if(!/^[mM]'?/.test(t))throw new Error('Path must start with "m" or "M"');if(/^[mM]'?$/.test(t))return this;let r=t.replace(/^[mM]'?\//,"").split("/"),n=this;for(let i of r){let o=/^(\d+)('?)$/.exec(i),s=o&&o[1];if(!o||o.length!==3||typeof s!="string")throw new Error("invalid child index: "+i);let a=+s;if(!Number.isSafeInteger(a)||a>=rb.HARDENED_OFFSET)throw new Error("Invalid index");o[2]==="'"&&(a+=rb.HARDENED_OFFSET),n=n.deriveChild(a)}return n}deriveChild(t){if(!this.pubKey||!this.chainCode)throw new Error("No publicKey or chainCode set");let r=rre(t);if(t>=rb.HARDENED_OFFSET){let a=this.privateKey;if(!a)throw new Error("Could not derive hardened child key");r=(0,du.concatBytes)(new Uint8Array([0]),a,r)}else r=(0,du.concatBytes)(this.pubKey,r);let n=(0,ibt.hmac)(nre.sha512,this.chainCode,r),i=obt(n.slice(0,32)),o=n.slice(32);if(!tb.secp256k1.utils.isValidPrivateKey(i))throw new Error("Tweak bigger than curve order");let s={versions:this.versions,chainCode:o,depth:this.depth+1,parentFingerprint:this.fingerprint,index:t};try{if(this.privateKey){let a=(0,zhn.mod)(this.privKey+i,tb.secp256k1.CURVE.n);if(!tb.secp256k1.utils.isValidPrivateKey(a))throw new Error("The tweak was out of range or the resulted private key is invalid");s.privateKey=a}else{let a=tre.fromHex(this.pubKey).add(tre.fromPrivateKey(i));if(a.equals(tre.ZERO))throw new Error("The tweak was equal to negative P, which made the result key invalid");s.publicKey=a.toRawBytes(!0)}return new e(s)}catch{return this.deriveChild(t+1)}}sign(t){if(!this.privateKey)throw new Error("No privateKey set!");return(0,du.abytes)(t,32),tb.secp256k1.sign(t,this.privKey).toCompactRawBytes()}verify(t,r){if((0,du.abytes)(t,32),(0,du.abytes)(r,64),!this.publicKey)throw new Error("No publicKey set!");let n;try{n=tb.secp256k1.Signature.fromCompact(r)}catch{return!1}return tb.secp256k1.verify(n,t,this.publicKey)}wipePrivateData(){return this.privKey=void 0,this.privKeyBytes&&(this.privKeyBytes.fill(0),this.privKeyBytes=void 0),this}toJSON(){return{xpriv:this.privateExtendedKey,xpub:this.publicExtendedKey}}serialize(t,r){if(!this.chainCode)throw new Error("No chainCode set");return(0,du.abytes)(r,33),(0,du.concatBytes)(rre(t),new Uint8Array([this.depth]),rre(this.parentFingerprint),rre(this.index),this.chainCode,r)}};rb.HDKey=p8e});var cbt=_(ire=>{"use strict";Object.defineProperty(ire,"__esModule",{value:!0});ire.pbkdf2=Qhn;ire.pbkdf2Async=e0n;var Zhn=cv(),wh=Zo();function sbt(e,t,r,n){(0,wh.ahash)(e);let i=(0,wh.checkOpts)({dkLen:32,asyncTick:10},n),{c:o,dkLen:s,asyncTick:a}=i;if((0,wh.anumber)(o),(0,wh.anumber)(s),(0,wh.anumber)(a),o<1)throw new Error("iterations (c) should be >= 1");let c=(0,wh.kdfInputToBytes)(t),u=(0,wh.kdfInputToBytes)(r),d=new Uint8Array(s),l=Zhn.hmac.create(e,c),p=l._cloneInto().update(u);return{c:o,dkLen:s,asyncTick:a,DK:d,PRF:l,PRFSalt:p}}function abt(e,t,r,n,i){return e.destroy(),t.destroy(),n&&n.destroy(),(0,wh.clean)(i),r}function Qhn(e,t,r,n){let{c:i,dkLen:o,DK:s,PRF:a,PRFSalt:c}=sbt(e,t,r,n),u,d=new Uint8Array(4),l=(0,wh.createView)(d),p=new Uint8Array(a.outputLen);for(let f=1,m=0;m<o;f++,m+=a.outputLen){let h=s.subarray(m,m+a.outputLen);l.setInt32(0,f,!1),(u=c._cloneInto(u)).update(d).digestInto(p),h.set(p.subarray(0,h.length));for(let g=1;g<i;g++){a._cloneInto(u).update(p).digestInto(p);for(let y=0;y<h.length;y++)h[y]^=p[y]}}return abt(a,c,s,u,p)}async function e0n(e,t,r,n){let{c:i,dkLen:o,asyncTick:s,DK:a,PRF:c,PRFSalt:u}=sbt(e,t,r,n),d,l=new Uint8Array(4),p=(0,wh.createView)(l),f=new Uint8Array(c.outputLen);for(let m=1,h=0;h<o;m++,h+=c.outputLen){let g=a.subarray(h,h+c.outputLen);p.setInt32(0,m,!1),(d=u._cloneInto(d)).update(l).digestInto(f),g.set(f.subarray(0,g.length)),await(0,wh.asyncLoop)(i-1,s,()=>{c._cloneInto(d).update(f).digestInto(f);for(let y=0;y<g.length;y++)g[y]^=f[y]})}return abt(c,u,a,d,f)}});var _8e=_(iT=>{"use strict";Object.defineProperty(iT,"__esModule",{value:!0});iT.generateMnemonic=r0n;iT.mnemonicToEntropy=fbt;iT.entropyToMnemonic=mbt;iT.validateMnemonic=i0n;iT.mnemonicToSeed=o0n;iT.mnemonicToSeedSync=s0n;var ubt=cbt(),h8e=ag(),m8e=Zo(),ore=u8e(),t0n=e=>e[0]==="\u3042\u3044\u3053\u304F\u3057\u3093";function dbt(e){if(typeof e!="string")throw new TypeError("invalid mnemonic type: "+typeof e);return e.normalize("NFKD")}function g8e(e){let t=dbt(e),r=t.split(" ");if(![12,15,18,21,24].includes(r.length))throw new Error("Invalid mnemonic");return{nfkd:t,words:r}}function lbt(e){(0,m8e.abytes)(e,16,20,24,28,32)}function r0n(e,t=128){if((0,m8e.anumber)(t),t%32!==0||t>256)throw new TypeError("Invalid entropy");return mbt((0,m8e.randomBytes)(t/8),e)}var n0n=e=>{let t=8-e.length/4;return new Uint8Array([(0,h8e.sha256)(e)[0]>>t<<t])};function pbt(e){if(!Array.isArray(e)||e.length!==2048||typeof e[0]!="string")throw new Error("Wordlist: expected array of 2048 strings");return e.forEach(t=>{if(typeof t!="string")throw new Error("wordlist: non-string element: "+t)}),ore.utils.chain(ore.utils.checksum(1,n0n),ore.utils.radix2(11,!0),ore.utils.alphabet(e))}function fbt(e,t){let{words:r}=g8e(e),n=pbt(t).decode(r);return lbt(n),n}function mbt(e,t){return lbt(e),pbt(t).encode(e).join(t0n(t)?"\u3000":" ")}function i0n(e,t){try{fbt(e,t)}catch{return!1}return!0}var hbt=e=>dbt("mnemonic"+e);function o0n(e,t=""){return(0,ubt.pbkdf2Async)(h8e.sha512,g8e(e).nfkd,hbt(t),{c:2048,dkLen:64})}function s0n(e,t=""){return(0,ubt.pbkdf2)(h8e.sha512,g8e(e).nfkd,hbt(t),{c:2048,dkLen:64})}});var gbt=_(y8e=>{"use strict";Object.defineProperty(y8e,"__esModule",{value:!0});y8e.generateMnemonic=c0n;var a0n=_8e();function c0n(e,t){return(0,a0n.generateMnemonic)(e,t)}});var _bt=_(b8e=>{"use strict";Object.defineProperty(b8e,"__esModule",{value:!0});b8e.generatePrivateKey=l0n;var u0n=Ef(),d0n=De();function l0n(){return(0,d0n.toHex)(u0n.secp256k1.utils.randomPrivateKey())}});var S8e=_(E8e=>{"use strict";Object.defineProperty(E8e,"__esModule",{value:!0});E8e.toAccount=p0n;var ybt=sp(),bbt=cc();function p0n(e){if(typeof e=="string"){if(!(0,bbt.isAddress)(e,{strict:!1}))throw new ybt.InvalidAddressError({address:e});return{address:e,type:"json-rpc"}}if(!(0,bbt.isAddress)(e.address,{strict:!1}))throw new ybt.InvalidAddressError({address:e.address});return{address:e.address,nonceManager:e.nonceManager,sign:e.sign,signAuthorization:e.signAuthorization,signMessage:e.signMessage,signTransaction:e.signTransaction,signTypedData:e.signTypedData,source:"custom",type:"local"}}});var QI=_(are=>{"use strict";Object.defineProperty(are,"__esModule",{value:!0});are.setSignEntropy=_0n;are.sign=y0n;var f0n=Ef(),m0n=sc(),h0n=yn(),Ebt=De(),g0n=wU(),sre=!1;function _0n(e){if(!e)throw new Error("must be a `true` or a hex value.");sre=e}async function y0n({hash:e,privateKey:t,to:r="object"}){let{r:n,s:i,recovery:o}=f0n.secp256k1.sign(e.slice(2),t.slice(2),{lowS:!0,extraEntropy:(0,m0n.isHex)(sre,{strict:!1})?(0,h0n.hexToBytes)(sre):sre}),s={r:(0,Ebt.numberToHex)(n,{size:32}),s:(0,Ebt.numberToHex)(i,{size:32}),v:o?28n:27n,yParity:o};return r==="bytes"||r==="hex"?(0,g0n.serializeSignature)({...s,to:r}):s}});var T8e=_(v8e=>{"use strict";Object.defineProperty(v8e,"__esModule",{value:!0});v8e.signAuthorization=S0n;var b0n=WY(),E0n=QI();async function S0n(e){let{chainId:t,nonce:r,privateKey:n,to:i="object"}=e,o=e.contractAddress??e.address,s=await(0,E0n.sign)({hash:(0,b0n.hashAuthorization)({address:o,chainId:t,nonce:r}),privateKey:n,to:i});return i==="object"?{address:o,chainId:t,nonce:r,...s}:s}});var w8e=_(A8e=>{"use strict";Object.defineProperty(A8e,"__esModule",{value:!0});A8e.signMessage=A0n;var v0n=rI(),T0n=QI();async function A0n({message:e,privateKey:t}){return await(0,T0n.sign)({hash:(0,v0n.hashMessage)(e),privateKey:t,to:"hex"})}});var P8e=_(I8e=>{"use strict";Object.defineProperty(I8e,"__esModule",{value:!0});I8e.signTransaction=x0n;var w0n=Yc(),I0n=sR(),P0n=QI();async function x0n(e){let{privateKey:t,transaction:r,serializer:n=I0n.serializeTransaction}=e,i=r.type==="eip4844"?{...r,sidecars:!1}:r,o=await(0,P0n.sign)({hash:(0,w0n.keccak256)(await n(i)),privateKey:t});return await n(r,o)}});var O8e=_(x8e=>{"use strict";Object.defineProperty(x8e,"__esModule",{value:!0});x8e.signTypedData=N0n;var O0n=nI(),R0n=QI();async function N0n(e){let{privateKey:t,...r}=e;return await(0,R0n.sign)({hash:(0,O0n.hashTypedData)(r),privateKey:t,to:"hex"})}});var N8e=_(R8e=>{"use strict";Object.defineProperty(R8e,"__esModule",{value:!0});R8e.privateKeyToAccount=H0n;var C0n=Ef(),M0n=De(),k0n=S8e(),D0n=CO(),L0n=QI(),U0n=T8e(),B0n=w8e(),j0n=P8e(),q0n=O8e();function H0n(e,t={}){let{nonceManager:r}=t,n=(0,M0n.toHex)(C0n.secp256k1.getPublicKey(e.slice(2),!1)),i=(0,D0n.publicKeyToAddress)(n);return{...(0,k0n.toAccount)({address:i,nonceManager:r,async sign({hash:s}){return(0,L0n.sign)({hash:s,privateKey:e,to:"hex"})},async signAuthorization(s){return(0,U0n.signAuthorization)({...s,privateKey:e})},async signMessage({message:s}){return(0,B0n.signMessage)({message:s,privateKey:e})},async signTransaction(s,{serializer:a}={}){return(0,j0n.signTransaction)({privateKey:e,transaction:s,serializer:a})},async signTypedData(s){return(0,q0n.signTypedData)({...s,privateKey:e})}}),publicKey:n,source:"privateKey"}}});var M8e=_(C8e=>{"use strict";Object.defineProperty(C8e,"__esModule",{value:!0});C8e.hdKeyToAccount=$0n;var V0n=De(),F0n=N8e();function $0n(e,{accountIndex:t=0,addressIndex:r=0,changeIndex:n=0,path:i,...o}={}){let s=e.derive(i||`m/44'/60'/${t}'/${n}/${r}`);return{...(0,F0n.privateKeyToAccount)((0,V0n.toHex)(s.privateKey),o),getHdKey:()=>s,source:"hd"}}});var Sbt=_(k8e=>{"use strict";Object.defineProperty(k8e,"__esModule",{value:!0});k8e.mnemonicToAccount=W0n;var z0n=f8e(),G0n=_8e(),K0n=M8e();function W0n(e,{passphrase:t,...r}={}){let n=(0,G0n.mnemonicToSeedSync)(e,t);return(0,K0n.hdKeyToAccount)(z0n.HDKey.fromMasterSeed(n),r)}});var vbt=_(D8e=>{"use strict";Object.defineProperty(D8e,"__esModule",{value:!0});D8e.privateKeyToAddress=Z0n;var Y0n=Ef(),J0n=De(),X0n=CO();function Z0n(e){let t=(0,J0n.bytesToHex)(Y0n.secp256k1.getPublicKey(e.slice(2),!1));return(0,X0n.publicKeyToAddress)(t)}});var Tbt=_(cre=>{"use strict";Object.defineProperty(cre,"__esModule",{value:!0});cre.wordlist=void 0;cre.wordlist=`abdikace
 abeceda
 adresa
 agrese
@@ -20756,7 +20756,7 @@ Mongoose Error Code: ${t.code}`:""}`})}function yWe(e,t,r,n=void 0){r&&(0,_Ei.sa
 `),Gk(YJe(),n+`
 `),NSr()}catch{}}function oXe(e){try{let t=Wk();if(!t)return;let r=Math.max(Date.now(),t.renderedAt+1),n={...t,refreshFailedAt:r,refreshErrorReason:mK(e).slice(0,200)};Gk(dK(),JSON.stringify(n)+`
 `)}catch{}}function zk(){try{$r.unlinkSync(JJe())}catch{}}function Wk(){let e=dK();if(!$r.existsSync(e))return null;try{return JSON.parse($r.readFileSync(e,"utf-8"))}catch{return null}}function sXe(){return Wk()?.status??null}function kSr(){if(process.env.JEST_WORKER_ID)return;let e=JJe();try{if($r.mkdirSync(Un.dirname(e),{recursive:!0}),!BSr(e))return;let t=process.argv[1]?Un.resolve(process.argv[1]):"";if(!t){zk();return}let r=cK(),n=(process.env.VISA_CLI_HUD_THEME??"").toLowerCase().trim(),i=r==="no-color"||n==="light"||n==="dark"?{}:{VISA_CLI_HUD_THEME:r};RSr(Date.now());let o=(0,GJe.spawn)(process.execPath,[t,...WJe],{detached:!0,stdio:"ignore",env:{...process.env,...i,VISA_CLI_SHELL_HUD_BACKGROUND:"1"}});o.once("error",zk),o.unref()}catch{zk()}}function mK(e){return e.replace(/\u001B\][^\u0007]*(?:\u0007|\u001B\\)/g,"").replace(/\u001B\[[0-?]*[ -/]*[@-~]/g,"").replace(/\u001B[P_^][^\u001B]*(?:\u001B\\|\u0007)/g,"").replace(/[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g,"").replace(/\s+/g," ").trim()}var DSr=/^\u001B\[(?:0|38;2;\d{1,3};\d{1,3};\d{1,3}|38;5;\d{1,3})m$/;function LSr(e){let t=[],r=`__VISA_CLI_HUD_SGR_${(0,r1e.randomBytes)(8).toString("hex")}_`,n=e.replace(/\u001B\[[0-?]*[ -/]*[@-~]/g,o=>{if(!DSr.test(o))return"";let s=`${r}${t.length}__`;return t.push(o),s}),i=new RegExp(`${r}(\\d+)__`,"g");return mK(n).replace(i,(o,s)=>t[Number(s)]??"")}var no={get reset(){return ic().reset},get visaBlue(){return ic().visaBlue},get visaBlueSoft(){return ic().visaBlueSoft},get visaGold(){return ic().visaGold},get green(){return ic().green},get muted(){return ic().muted},get chrome(){return ic().chrome}};function wo(e,t){return e.length===0||process.env.NO_COLOR||uK()?e:`${t}${e}${no.reset}`}function $Je(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function USr(){let e=Kk.homedir();if(!e||!Un.isAbsolute(e))throw new Error("unable to determine a valid home directory");return Un.resolve(e)}function BSr(e){for(let t=0;t<2;t+=1){let r;try{return r=$r.openSync(e,"wx"),$r.writeFileSync(r,String(Date.now())),!0}catch(n){if(n?.code!=="EEXIST")return!1;try{let i=$r.statSync(e);if(Date.now()-i.mtimeMs<=gSr)return!1;$r.unlinkSync(e)}catch{}}finally{r!==void 0&&$r.closeSync(r)}}return!1}function zJe(e){return e instanceof Error?e.message:"unknown file system error"}function Gk(e,t){$r.mkdirSync(Un.dirname(e),{recursive:!0});let r=`${e}.${process.pid}.${(0,r1e.randomBytes)(8).toString("hex")}.tmp`;try{$r.writeFileSync(r,t),$r.renameSync(r,e)}catch(n){try{$r.unlinkSync(r)}catch{}throw n}}var jSr=1440*60*1e3;function gK(e,t){ya.mkdirSync(ju.dirname(e),{recursive:!0});let r=`${e}.${process.pid}.${uXe.randomBytes(8).toString("hex")}.tmp`;try{ya.writeFileSync(r,JSON.stringify(t,null,2)+`
-`),ya.renameSync(r,e)}catch(n){try{ya.unlinkSync(r)}catch{}throw n}}function aXe(e){return`'${e.replace(/'/g,"'\\''")}'`}var o1e="# visa-cli-hud-v1";function _K(e,t){if(!e&&!t&&qSr())return`visa-cli config statusline ${o1e}`;let r=e??process.execPath,n=t??process.argv[1]??"",i=n?ju.resolve(n):"";return`${i?`${aXe(r)} ${aXe(i)} config statusline`:"visa-cli config statusline"} ${o1e}`}function qSr(){try{return(0,dXe.execSync)("command -v visa-cli",{stdio:"ignore",timeout:1e3}),!0}catch{return!1}}function s1e(e){return typeof e!="string"?!1:e.includes(o1e)?!0:e.includes("visa-cli")&&e.includes("statusline")}function HSr(){return"5.0.0-rc.355"}function yK(e){let t=ju.dirname(ju.resolve(e));return ju.basename(t)===".claude"?ju.dirname(t):lXe.homedir()}function hK(e,t){let r=ju.relative(t,e);return!r.startsWith("..")&&!ju.isAbsolute(r)?`~/${r}`:e}function VSr(e){return ju.join(yK(e),".visa-cli","hud-self-heal.json")}function FSr(e,t,r,n){try{if(!ya.existsSync(e))return!1;let i=JSON.parse(ya.readFileSync(e,"utf-8"));return i.version===t&&typeof i.checkedAt=="number"&&r-i.checkedAt<n}catch{return!1}}function i1e(e,t,r){try{gK(e,{version:t,checkedAt:r})}catch{}}function $Sr(e,t){return e&&typeof e=="object"&&!Array.isArray(e)?{...e,type:"command",command:t}:{type:"command",command:t}}function bK(e,t={}){let r=t.now??Date.now(),n=t.version??HSr(),i=t.stampPath??VSr(e),o=t.minIntervalMs??jSr,s=[],a=!1,c=!1;if(!t.force&&FSr(i,n,r,o))return{checked:!1,statusLineRepaired:!1,shellHudRemoved:!1,messages:s,skippedReason:"recently checked"};try{if(!ya.existsSync(e))return i1e(i,n,r),{checked:!0,statusLineRepaired:a,shellHudRemoved:c,messages:s};let u=JSON.parse(ya.readFileSync(e,"utf-8")),d=u.statusLine,l=d&&typeof d=="object"&&!Array.isArray(d)?d.command:"";if(!s1e(l))return i1e(i,n,r),{checked:!0,statusLineRepaired:a,shellHudRemoved:c,messages:s};let p=(t.getCommand??_K)();if(l!==p&&(u.statusLine=$Sr(d,p),gK(e,u),a=!0,s.push("Repaired Claude Code statusLine command to use the current Visa CLI.")),!pXe()){let f=yK(e);if(fK(f).length>0){let h=n1e(null,f);if(h.removed&&h.rcPaths&&h.rcPaths.length>0){let g=h.rcPaths.map(y=>hK(y,f)).join(", ");c=!0,s.push(`Cleaned legacy shell-prompt HUD block from ${g}.`)}}}return i1e(i,n,r),{checked:!0,statusLineRepaired:a,shellHudRemoved:c,messages:s}}catch(u){if(t.force){let d=u instanceof Error?u.message:"unknown error";try{process.stderr.write(`visa-cli: HUD self-heal skipped \u2014 ${d}. Run: visa connect claude
+`),ya.renameSync(r,e)}catch(n){try{ya.unlinkSync(r)}catch{}throw n}}function aXe(e){return`'${e.replace(/'/g,"'\\''")}'`}var o1e="# visa-cli-hud-v1";function _K(e,t){if(!e&&!t&&qSr())return`visa-cli config statusline ${o1e}`;let r=e??process.execPath,n=t??process.argv[1]??"",i=n?ju.resolve(n):"";return`${i?`${aXe(r)} ${aXe(i)} config statusline`:"visa-cli config statusline"} ${o1e}`}function qSr(){try{return(0,dXe.execSync)("command -v visa-cli",{stdio:"ignore",timeout:1e3}),!0}catch{return!1}}function s1e(e){return typeof e!="string"?!1:e.includes(o1e)?!0:e.includes("visa-cli")&&e.includes("statusline")}function HSr(){return"5.0.0-rc.356"}function yK(e){let t=ju.dirname(ju.resolve(e));return ju.basename(t)===".claude"?ju.dirname(t):lXe.homedir()}function hK(e,t){let r=ju.relative(t,e);return!r.startsWith("..")&&!ju.isAbsolute(r)?`~/${r}`:e}function VSr(e){return ju.join(yK(e),".visa-cli","hud-self-heal.json")}function FSr(e,t,r,n){try{if(!ya.existsSync(e))return!1;let i=JSON.parse(ya.readFileSync(e,"utf-8"));return i.version===t&&typeof i.checkedAt=="number"&&r-i.checkedAt<n}catch{return!1}}function i1e(e,t,r){try{gK(e,{version:t,checkedAt:r})}catch{}}function $Sr(e,t){return e&&typeof e=="object"&&!Array.isArray(e)?{...e,type:"command",command:t}:{type:"command",command:t}}function bK(e,t={}){let r=t.now??Date.now(),n=t.version??HSr(),i=t.stampPath??VSr(e),o=t.minIntervalMs??jSr,s=[],a=!1,c=!1;if(!t.force&&FSr(i,n,r,o))return{checked:!1,statusLineRepaired:!1,shellHudRemoved:!1,messages:s,skippedReason:"recently checked"};try{if(!ya.existsSync(e))return i1e(i,n,r),{checked:!0,statusLineRepaired:a,shellHudRemoved:c,messages:s};let u=JSON.parse(ya.readFileSync(e,"utf-8")),d=u.statusLine,l=d&&typeof d=="object"&&!Array.isArray(d)?d.command:"";if(!s1e(l))return i1e(i,n,r),{checked:!0,statusLineRepaired:a,shellHudRemoved:c,messages:s};let p=(t.getCommand??_K)();if(l!==p&&(u.statusLine=$Sr(d,p),gK(e,u),a=!0,s.push("Repaired Claude Code statusLine command to use the current Visa CLI.")),!pXe()){let f=yK(e);if(fK(f).length>0){let h=n1e(null,f);if(h.removed&&h.rcPaths&&h.rcPaths.length>0){let g=h.rcPaths.map(y=>hK(y,f)).join(", ");c=!0,s.push(`Cleaned legacy shell-prompt HUD block from ${g}.`)}}}return i1e(i,n,r),{checked:!0,statusLineRepaired:a,shellHudRemoved:c,messages:s}}catch(u){if(t.force){let d=u instanceof Error?u.message:"unknown error";try{process.stderr.write(`visa-cli: HUD self-heal skipped \u2014 ${d}. Run: visa connect claude
 `)}catch{}}return{checked:!0,statusLineRepaired:a,shellHudRemoved:c,messages:s}}}function zSr(e,t){let r=yK(t),n=fK(r);if(n.length===0)return e;let i=n.map(o=>hK(o,r)).join(", ");return`${e}
 Note: a shell-prompt HUD block was detected in ${i}. If it is unintended, delete the lines between '# >>> visa-cli shell hud v2 >>>' and '# <<< visa-cli shell hud v2 <<<' in ${i}`}function pXe(e=process.env.VISA_HUD_KEEP_SHELL){if(e===void 0)return!1;let t=e.trim().toLowerCase();return t==="1"||t==="true"||t==="yes"||t==="on"}function cXe(e,t){let r=yK(t),n=fK(r);if(n.length===0)return e;let i=n.map(s=>hK(s,r)).join(", ");if(pXe())return`${e}
 Note: a legacy shell-prompt HUD block was detected in ${i}. VISA_HUD_KEEP_SHELL set \u2014 leaving it in place. To remove it, unset VISA_HUD_KEEP_SHELL and run visa connect claude again, or delete the lines between '# >>> visa-cli shell hud v2 >>>' and '# <<< visa-cli shell hud v2 <<<' in ${i}`;let o=n1e(null,r);if(o.removed&&o.rcPaths&&o.rcPaths.length>0){let s=o.rcPaths.map(a=>hK(a,r)).join(", ");return`${e}
@@ -20794,7 +20794,7 @@ Note: a legacy shell-prompt HUD block was detected in ${i} but could not be auto
 `)}function ZXe(e,t="global"){let r=t==="project"?Xt.join(process.cwd(),".mcp.json"):A1e(e);try{let n=Xt.dirname(r);cn.existsSync(n)||cn.mkdirSync(n,{recursive:!0});let i=I1e(e,t),o=Fvr();if(i==="toml"){let s=cn.existsSync(r)?cn.readFileSync(r,"utf-8"):"",a=zvr(s,"visa-cli",o);cn.writeFileSync(r,a)}else if(i==="yaml"){let s=cn.existsSync(r)?cn.readFileSync(r,"utf-8"):"",a=Yvr(s,"visa-cli",o);cn.writeFileSync(r,a)}else{let s={};if(cn.existsSync(r))try{s=JSON.parse(cn.readFileSync(r,"utf-8"))}catch{s={}}for(let[c,u]of Object.entries(e.seedConfig??{}))c in s||(s[c]=u);let a=$vr(s,e.configKey);a["visa-cli"]=e.buildEntry?e.buildEntry(o):o,cn.writeFileSync(r,JSON.stringify(s,null,2)+`
 `)}}catch(n){throw jvr(n)?new T1e(e,r,n):n}return{installed:!0,configPath:r,message:e.postInstallHint}}function QXe(e,t="global"){let r=t==="project"?Xt.join(process.cwd(),".mcp.json"):A1e(e);if(!cn.existsSync(r))return{removed:!1,configPath:r};let n=I1e(e,t);if(n==="toml"){let s=cn.readFileSync(r,"utf-8");return YXe(s,"visa-cli")?(cn.writeFileSync(r,Gvr(s,"visa-cli")),{removed:!0,configPath:r}):{removed:!1,configPath:r}}if(n==="yaml"){let s=cn.readFileSync(r,"utf-8");return XXe(s,"visa-cli")?(cn.writeFileSync(r,Jvr(s,"visa-cli")),{removed:!0,configPath:r}):{removed:!1,configPath:r}}let i;try{i=JSON.parse(cn.readFileSync(r,"utf-8"))}catch{return{removed:!1,configPath:r}}let o=KXe(i,e.configKey);return!o||!o["visa-cli"]?{removed:!1,configPath:r}:(delete o["visa-cli"],cn.writeFileSync(r,JSON.stringify(i,null,2)+`
-`),{removed:!0,configPath:r})}function O1e(e,t="global"){let r=t==="project"?Xt.join(process.cwd(),".mcp.json"):A1e(e);if(!cn.existsSync(r))return!1;let n=I1e(e,t);if(n==="toml")try{let i=cn.readFileSync(r,"utf-8");return!!YXe(i,"visa-cli")}catch{return!1}if(n==="yaml")try{let i=cn.readFileSync(r,"utf-8");return!!XXe(i,"visa-cli")}catch{return!1}try{let i=JSON.parse(cn.readFileSync(r,"utf-8"));return!!KXe(i,e.configKey)?.["visa-cli"]}catch{return!1}}CK();o6();var cTr="5.0.0-rc.355",uTr="https://app.visacli.sh",uZe="https://web-visa-code-preview.up.railway.app",dTr="/agent/enroll";function lTr(e=cTr){return/-(?:rc|alpha|beta)\./i.test(e)}function C1e(e){let t=e.length;for(;t>0&&e.charCodeAt(t-1)===47;)t--;return e.slice(0,t)}function pTr(e=process.env){let t=e.VISA_AUTH_URL?.trim()||p1e("auth.serverUrl");if(!t)return!1;try{return new URL(t).origin===new URL(f1e).origin}catch{return!1}}function MK(e=process.env){let t=e.VISA_VERIFY_WEB_URL?.trim();return t?C1e(t):pTr(e)||lTr()?uZe:uTr}function dZe(e){return`${C1e(e)}${dTr}`}async function lZe(e,t){let r=t?.fetchImpl??fetch,n=t?.maxAttempts??3,i=t?.timeoutMs??5e3,o=t?.sleep??(d=>new Promise(l=>setTimeout(l,d))),s=`${C1e(e)}/api/agent-enroll/health`,a=null,c=null;for(let d=1;d<=n;d++){t?.onProgress?.(d,n,s);try{if(c=await r(s,{method:"GET",headers:{accept:"application/json"},signal:AbortSignal.timeout(i)}),c.ok||c.status<500)break;d<n&&await o(d*100)}catch(l){c=null,a=l,d<n&&await o(d*100)}}if(!c){let d=a instanceof Error?a.message:String(a??"network error");return{ready:!1,kind:"network",warning:`Could not reach ${s}: ${d} \u2014 the link may not work yet.`,healthUrl:s}}return c.ok?(await c.json().catch(()=>null))?.clients?.auth!=="turnkey"?{ready:!1,kind:"auth_mode_mismatch",warning:`V4 sign-in is not enabled on this deployment (${e}); refusing to open the retired GitHub flow.`,healthUrl:s}:{ready:!0,healthUrl:s}:c.status<500?{ready:!1,kind:"client",warning:`V4 sign-in is unavailable on this deployment (${c.status} at ${s}); refusing to open the retired GitHub flow.`,healthUrl:s}:{ready:!1,kind:"server",warning:`V4 sign-in readiness check failed (${c.status}) at ${s} \u2014 the link may not work yet.`,healthUrl:s}}$_();function M1e(e,t={}){let r={success:!0,command:e,ts:new Date().toISOString()};for(let[n,i]of Object.entries(t))i!==void 0&&(r[n]=i);return r}function k1e(e,t,r={}){let{code:n,cause:i,fix:o,nextAction:s,...a}=r,c=n?G0(n):JYe(i),u=G0(c.code,{...o!==void 0?{fix:o}:{fix:c.fix},nextAction:s??c.nextAction}),d=XYe(i),l={success:!1,command:e,ts:new Date().toISOString(),error:t,code:u.code,kind:u.kind,fix:u.fix,nextAction:u.nextAction,...d?{details:d}:{}};for(let[p,f]of Object.entries(a))f!==void 0&&(l[p]=f);return l}var Qk=require("process"),fTr=["json","yaml","tsv","table"];function fZe(e){return fTr.includes(e)}function eD(e,t){switch(t){case"json":Qk.stdout.write(JSON.stringify(e)+`
+`),{removed:!0,configPath:r})}function O1e(e,t="global"){let r=t==="project"?Xt.join(process.cwd(),".mcp.json"):A1e(e);if(!cn.existsSync(r))return!1;let n=I1e(e,t);if(n==="toml")try{let i=cn.readFileSync(r,"utf-8");return!!YXe(i,"visa-cli")}catch{return!1}if(n==="yaml")try{let i=cn.readFileSync(r,"utf-8");return!!XXe(i,"visa-cli")}catch{return!1}try{let i=JSON.parse(cn.readFileSync(r,"utf-8"));return!!KXe(i,e.configKey)?.["visa-cli"]}catch{return!1}}CK();o6();var cTr="5.0.0-rc.356",uTr="https://app.visacli.sh",uZe="https://web-visa-code-preview.up.railway.app",dTr="/agent/enroll";function lTr(e=cTr){return/-(?:rc|alpha|beta)\./i.test(e)}function C1e(e){let t=e.length;for(;t>0&&e.charCodeAt(t-1)===47;)t--;return e.slice(0,t)}function pTr(e=process.env){let t=e.VISA_AUTH_URL?.trim()||p1e("auth.serverUrl");if(!t)return!1;try{return new URL(t).origin===new URL(f1e).origin}catch{return!1}}function MK(e=process.env){let t=e.VISA_VERIFY_WEB_URL?.trim();return t?C1e(t):pTr(e)||lTr()?uZe:uTr}function dZe(e){return`${C1e(e)}${dTr}`}async function lZe(e,t){let r=t?.fetchImpl??fetch,n=t?.maxAttempts??3,i=t?.timeoutMs??5e3,o=t?.sleep??(d=>new Promise(l=>setTimeout(l,d))),s=`${C1e(e)}/api/agent-enroll/health`,a=null,c=null;for(let d=1;d<=n;d++){t?.onProgress?.(d,n,s);try{if(c=await r(s,{method:"GET",headers:{accept:"application/json"},signal:AbortSignal.timeout(i)}),c.ok||c.status<500)break;d<n&&await o(d*100)}catch(l){c=null,a=l,d<n&&await o(d*100)}}if(!c){let d=a instanceof Error?a.message:String(a??"network error");return{ready:!1,kind:"network",warning:`Could not reach ${s}: ${d} \u2014 the link may not work yet.`,healthUrl:s}}return c.ok?(await c.json().catch(()=>null))?.clients?.auth!=="turnkey"?{ready:!1,kind:"auth_mode_mismatch",warning:`V4 sign-in is not enabled on this deployment (${e}); refusing to open the retired GitHub flow.`,healthUrl:s}:{ready:!0,healthUrl:s}:c.status<500?{ready:!1,kind:"client",warning:`V4 sign-in is unavailable on this deployment (${c.status} at ${s}); refusing to open the retired GitHub flow.`,healthUrl:s}:{ready:!1,kind:"server",warning:`V4 sign-in readiness check failed (${c.status}) at ${s} \u2014 the link may not work yet.`,healthUrl:s}}$_();function M1e(e,t={}){let r={success:!0,command:e,ts:new Date().toISOString()};for(let[n,i]of Object.entries(t))i!==void 0&&(r[n]=i);return r}function k1e(e,t,r={}){let{code:n,cause:i,fix:o,nextAction:s,...a}=r,c=n?G0(n):JYe(i),u=G0(c.code,{...o!==void 0?{fix:o}:{fix:c.fix},nextAction:s??c.nextAction}),d=XYe(i),l={success:!1,command:e,ts:new Date().toISOString(),error:t,code:u.code,kind:u.kind,fix:u.fix,nextAction:u.nextAction,...d?{details:d}:{}};for(let[p,f]of Object.entries(a))f!==void 0&&(l[p]=f);return l}var Qk=require("process"),fTr=["json","yaml","tsv","table"];function fZe(e){return fTr.includes(e)}function eD(e,t){switch(t){case"json":Qk.stdout.write(JSON.stringify(e)+`
 `);return;case"yaml":Qk.stdout.write(mTr(e)+`
 `);return;case"tsv":Qk.stdout.write(hTr(e)+`
 `);return;case"table":Qk.stdout.write(gTr(e)+`