@atumlabs/mppx-atum-escrow 0.1.0 → 0.2.2

package/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.2] - 2026-07-31
+
+### Changed
+- README: the proprietary-license notice now references the bundled `LICENSE` file by name instead of linking to it, so it no longer points at a repository that is not publicly shared.
+
+## [0.2.1] - 2026-07-27
+
+### Changed
+- Building and signing the payer's deposit authorization now runs entirely through the shared `@atum-labs/payment-request-sender-auth` library (via the updated `@atum-labs/payment-gateway-client`): the deposit nonce is derived deterministically from the charge identity (retry-safe) and the EVM/Tron permit deadline tracks the settlement horizon. No public API changes; the idempotency anchor is byte-identical.
+- Deposit-freshness verification (permit deadline) now uses the merchant's configured clock, consistent with the existing deadline-ordering and budget checks, instead of the wall clock.
+
+## [0.2.0] - 2026-07-24
+
+### Changed
+- Verifying the payer's deposit authorization (`sender_auth`) now delegates to the shared `@atum-labs/payment-request-sender-auth` library instead of an embedded copy of the recover-and-verify logic, keeping the escrow method byte-compatible with the rest of the Atum payment stack.
+
+## [0.1.1] - 2026-07-22
+
+### Changed
+- Packaging for standalone publication: externalized `@solana/web3.js` so the LGPL-licensed `rpc-websockets` (pulled in transitively) is no longer bundled into the published package. Added `THIRD-PARTY-NOTICES.txt` and license materials. No API changes.
+
+## [0.1.0] - 2026-07-21
+
+### Added
+- Initial release: `mppx-atum-escrow`, Atum's cross-chain escrow payment method for the MPP (x402-style) payment flow — build, sign, and verify a source-chain deposit authorization across EVM, Tron, and Solana.

package/LICENSE

@@ -0,0 +1,166 @@
+ATUM LABS, INC. - MPP ESCROW SDK PROPRIETARY LICENSE AGREEMENT
+Last Updated: July 22, 2026
+
+This Proprietary License Agreement (the "Agreement") governs access to and use of the npm package identified as @atumlabs/mppx-atum-escrow, together with all source code, compiled code, type definitions, schemas, documentation, examples, configuration materials, copies, updates, and other materials that Atum Labs, Inc. ("Atum") provides with or for that package (collectively, the "Software").
+
+"Licensee" means the legal entity that Atum has expressly authorized to access the Software. "Authorized Users" means Licensee's employees and individual contractors who need access for the Authorized Purpose, are subject to written confidentiality and use restrictions at least as protective as this Agreement, and are acting on Licensee's behalf. "Atum Services" means Atum's payment gateway, settlement network, APIs, SDKs other than the Software, smart contracts, hosted services, credentials, test environments, and related systems.
+
+The Software is proprietary to Atum and, unless Atum has expressly made particular materials public, confidential. By accessing the Software through a private registry or other Atum-controlled channel, or by installing, copying, executing, integrating, or using the Software, Licensee agrees to this Agreement. An individual accepting this Agreement for an entity represents that the individual has authority to bind that entity. A person or entity that does not agree to this Agreement, or is not authorized by Atum, must not access or use the Software.
+
+1. AUTHORIZED PURPOSE
+
+1.1 Authorized Purpose. Atum provides the Software solely so that Licensee may evaluate, install, configure, integrate, test, conduct internal security and operational reviews of, and use the Software in Licensee's own systems to connect to Atum Services and implement payment flows that Atum has approved in writing (the "Authorized Purpose"). The Authorized Purpose may include:
+
+(a) constructing and processing Machine Payments Protocol challenges, credentials, and receipts;
+
+(b) creating or validating source-chain deposit authorizations, payment requests, settlement-routing data, and settlement confirmations;
+
+(c) integrating payer-side and merchant-side applications with Atum-authorized payment workflows; and
+
+(d) configuring approved chains, assets, accounts, contracts, endpoints, deadlines, and related parameters in accordance with Atum documentation and instructions.
+
+1.2 Production Use. Evaluation, development, integration, security review, demonstration, sandbox, and testnet use are permitted within the scope Atum has approved. Production use, treasury use, use with real customer funds, or use to provide services to any third party is permitted only if Atum has expressly authorized that use in a separately executed agreement, order form, pilot agreement, or other written authorization.
+
+1.3 No Service Access Grant. Access to the Software does not itself authorize access to any Atum Service, blockchain account, smart contract, signing key, API key, credential, asset, or production environment. All such access is subject to separate approval and any additional terms Atum specifies.
+
+2. LICENSE GRANT
+
+2.1 Limited License. Subject to Licensee's continuing compliance with this Agreement and all separate Atum authorizations, Atum grants Licensee a limited, revocable, non-exclusive, non-transferable, and non-sublicensable license during the Term to:
+
+(a) download, install, execute, and internally use the Software solely for the Authorized Purpose;
+
+(b) make a reasonable number of copies for development, testing, deployment, backup, and archival purposes, provided that every copy retains all copyright, proprietary, confidentiality, and license notices;
+
+(c) incorporate the unmodified Software into Licensee's own applications and deploy those applications within environments controlled by Licensee or expressly approved by Atum, solely for the Authorized Purpose and not as a standalone product or service;
+
+(d) create configuration files, adapters, wrappers, deployment materials, logging, observability, security controls, and other integration code that calls the Software's published interfaces, provided that such materials do not expose, reproduce, modify, or bypass protected portions of the Software; and
+
+(e) permit Authorized Users to exercise the rights above on Licensee's behalf.
+
+2.2 Responsibility for Authorized Users. Licensee is responsible for each Authorized User's compliance with this Agreement and for all activity conducted through Licensee's registry accounts, credentials, environments, and deployments.
+
+2.3 No Implied Rights. No rights are granted by implication, estoppel, exhaustion, or otherwise. All rights not expressly granted are reserved by Atum.
+
+3. RESTRICTIONS
+
+Licensee must not, and must not permit any other person or entity to:
+
+(a) use the Software outside the Authorized Purpose or after Atum's authorization has expired or been withdrawn;
+
+(b) provide registry credentials or access to the Software to any person other than an Authorized User;
+
+(c) publish, disclose, mirror, fork, upload, transmit, distribute, or otherwise make the Software or any substantial portion of it available through a public repository, public package registry, public website, public model registry, file-sharing service, or other public or unauthorized channel;
+
+(d) sell, rent, lease, sublicense, assign, timeshare, commercialize, or distribute the Software, or offer the Software as a standalone product, hosted service, managed service, service bureau, or other offering for the benefit of a third party;
+
+(e) modify, adapt, translate, or create derivative works of the Software, except for integration materials expressly permitted by Section 2.1(d) or as Atum approves in writing;
+
+(f) reverse engineer, decompile, disassemble, decode, or otherwise attempt to derive nonpublic source code, underlying ideas, algorithms, architecture, internal interfaces, settlement logic, auction logic, routing logic, security controls, or trade secrets from the Software, except to the limited extent a restriction is prohibited by applicable law after prior written notice to Atum;
+
+(g) use the Software, its schemas, workflows, interfaces, documentation, or output to build, operate, support, or improve a competing payment-orchestration, settlement, routing, escrow, auction, intent-processing, payment-gateway, or transaction-coordination product or service;
+
+(h) bypass, disable, weaken, or interfere with authentication, authorization, access controls, signature verification, source-approval checks, replay protection, nonce handling, idempotency, chain or asset validation, destination validation, quote deadlines, fulfillment deadlines, settlement-routing checks, receipt validation, logging, rate limits, or any other safety or security mechanism;
+
+(i) configure or use the Software with any contract, chain, asset, account, signer, endpoint, gateway, verifier, proxy, or other component that Atum has not approved for the applicable use;
+
+(j) use the Software to initiate, authorize, submit, conceal, facilitate, or process any unauthorized, fraudulent, forged, misleading, replayed, duplicated, expired, manipulated, unlawful, or otherwise invalid payment, transaction, credential, signature, settlement instruction, or request;
+
+(k) remove, alter, disable, or obscure any copyright, proprietary, confidentiality, attribution, trademark, warning, or license notice;
+
+(l) use the Software, related documentation, or nonpublic output to train, fine-tune, evaluate, benchmark, or improve any artificial-intelligence, machine-learning, large-language-model, or automated code-generation system without Atum's prior written consent;
+
+(m) publish or disclose benchmark, performance, security-testing, or competitive-analysis results concerning the Software or Atum Services without Atum's prior written consent; or
+
+(n) use the Software in violation of applicable law, sanctions, export controls, Atum instructions, or the rights of any third party.
+
+4. SECURITY AND OPERATIONAL REQUIREMENTS
+
+4.1 Security. Licensee must use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the Software and the payment activity involved. Licensee must restrict access under least-privilege principles, maintain appropriate logging and monitoring, and protect registry credentials, private keys, signing keys, API keys, RPC credentials, gateway credentials, and other secrets in secure secret-management systems. Licensee must not hard-code or commit secrets into the Software, an application bundle, a repository, or any other location accessible to unauthorized persons.
+
+4.2 Validation and Controls. Before any use involving live systems or assets, Licensee is solely responsible for reviewing the Software and its dependencies, testing the complete payment flow, validating its deployment, and confirming the adequacy of its internal approvals, maker-checker procedures, transaction limits, monitoring, incident response, and reconciliation controls. Licensee must independently verify all material payment parameters, including the source chain, source asset, source account, token approval, destination chain, destination asset, destination account, amount, fees, deadlines, contract addresses, routing fields, signatures, and settlement results.
+
+4.3 Authorized Configurations. Licensee must use only versions, dependencies, chains, assets, contracts, endpoints, and configurations that Atum has approved for the applicable use and must implement security, technical, operational, and compliance updates that Atum reasonably requires.
+
+4.4 Incidents. Licensee must promptly notify Atum at legal@atumlabs.xyz, and through any security contact Atum designates, of any actual or suspected unauthorized access, disclosure, credential compromise, key compromise, misuse, security incident, invalid payment activity, or material vulnerability involving the Software or an Atum Service. Licensee must reasonably cooperate in investigation, containment, remediation, and required notifications.
+
+4.5 Suspension. Atum may suspend or revoke access to the Software, a private registry, credentials, or Atum Services immediately if Atum reasonably believes continued access or use presents a legal, regulatory, sanctions, fraud, security, market-integrity, asset-loss, or operational risk, or if Licensee breaches this Agreement.
+
+5. ATUM SERVICES AND THIRD-PARTY COMPONENTS
+
+5.1 Atum Services. The Software is integration software and is not itself a wallet, custodian, exchange, money transmitter, payment processor, signing service, settlement service, or grant of access to Atum Services. Licensee's access to and use of Atum Services are governed by separate written terms, technical requirements, and approvals. Atum may change, limit, suspend, or discontinue an Atum Service as permitted by those terms.
+
+5.2 Third-Party Components. The Software may include, depend on, interoperate with, or require third-party software, protocols, libraries, networks, wallets, RPC services, or other services. Third-party components are governed by their own licenses and terms, which are not replaced or limited by this Agreement. Licensee is responsible for complying with those terms and for determining whether each third-party component is appropriately licensed, secure, available, and suitable for Licensee's use. Atum may require Licensee to pin, update, replace, self-host, or discontinue a third-party dependency.
+
+6. OWNERSHIP; LICENSEE APPLICATIONS; FEEDBACK
+
+6.1 Atum Ownership. As between the parties, Atum and its licensors retain all right, title, and interest in and to the Software, Atum Services, Atum documentation, Atum technology, and all related intellectual-property and proprietary rights. No ownership interest is transferred to Licensee.
+
+6.2 Licensee Applications. Subject to Atum's ownership of the Software and Atum technology, Licensee retains its rights in applications, data, and integration code that Licensee independently develops without incorporating Atum Confidential Information other than as authorized by this Agreement. Licensee's ownership does not include the Software, any modification or derivative work of the Software, or any Atum interface, schema, documentation, or technology reproduced in Licensee materials.
+
+6.3 Feedback. If Licensee provides feedback, suggestions, bug reports, enhancement requests, or other input concerning the Software or Atum Services, Licensee grants Atum a perpetual, irrevocable, worldwide, royalty-free, transferable, sublicensable license to use, reproduce, modify, distribute, commercialize, and otherwise exploit that feedback without restriction or obligation. Licensee is not required to disclose its confidential information in feedback.
+
+6.4 Trademarks. No right to use an Atum name, logo, trademark, service mark, domain name, or trade dress is granted, except for accurate internal identification of the Software or as Atum separately approves in writing.
+
+7. CONFIDENTIALITY
+
+7.1 Confidential Information. Nonpublic Software and related source code, documentation, schemas, configurations, examples, security information, endpoints, credentials, architecture, workflows, and technical or operational materials are Atum Confidential Information. If the parties have a separate nondisclosure agreement, that agreement governs confidentiality and controls over any inconsistent provision in this Section.
+
+7.2 Protection and Use. Licensee must protect Atum Confidential Information using at least reasonable care and no less than the care it uses for its own information of similar sensitivity. Licensee may use Atum Confidential Information only for the Authorized Purpose and disclose it only to Authorized Users with a need to know.
+
+7.3 Exclusions. The confidentiality obligations in this Section do not apply to information that Licensee can demonstrate through contemporaneous records: (a) became public through no breach of an obligation; (b) was lawfully known to Licensee without restriction before receipt from Atum; (c) was independently developed without use of Atum Confidential Information; or (d) was lawfully received from a third party without a duty of confidentiality.
+
+7.4 Required Disclosure. If Licensee is legally required to disclose Atum Confidential Information, Licensee must, to the extent legally permitted, provide prompt written notice to Atum and reasonable assistance in seeking protective treatment, and disclose only the portion legally required.
+
+8. COMPLIANCE VERIFICATION; EXPORT AND SANCTIONS
+
+8.1 Compliance Verification. Upon reasonable request, Licensee will provide a written certification of compliance with this Agreement and reasonable information sufficient to confirm that access is limited to Authorized Users and approved environments. Any review will be conducted in a manner designed to minimize disruption and protect Licensee's unrelated confidential information.
+
+8.2 Export and Sanctions. Licensee must comply with applicable export-control and economic-sanctions laws and must not permit access to or use of the Software by a prohibited party, in a prohibited territory, or for a prohibited end use.
+
+9. SUPPORT, UPDATES, AND CHANGES
+
+Atum has no obligation to provide maintenance, support, service levels, updates, upgrades, corrections, or continued availability unless a separately executed agreement expressly requires them. Atum may provide updates or replacement versions in its discretion. An update may include new or revised terms, and Licensee must not use an update unless Licensee accepts the terms applicable to that update.
+
+10. DISCLAIMER OF WARRANTIES
+
+EXCEPT TO THE EXTENT A SEPARATELY EXECUTED AGREEMENT EXPRESSLY PROVIDES OTHERWISE, THE SOFTWARE IS PROVIDED "AS IS," "AS AVAILABLE," AND WITH ALL FAULTS, WITHOUT ANY EXPRESS, IMPLIED, OR STATUTORY WARRANTY.
+
+TO THE FULLEST EXTENT PERMITTED BY LAW, ATUM DISCLAIMS ALL WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, SECURITY, AVAILABILITY, COMPATIBILITY, AND UNINTERRUPTED OR ERROR-FREE OPERATION. ATUM DOES NOT WARRANT THAT THE SOFTWARE WILL PREVENT LOSS, FRAUD, REPLAY, MISCONFIGURATION, UNAUTHORIZED SIGNING, DUPLICATE SUBMISSION, OR INVALID SETTLEMENT; THAT ANY PAYMENT WILL BE QUOTED, ACCEPTED, COMPLETED, FINAL, REVERSIBLE, OR PROFITABLE; THAT ANY BLOCKCHAIN, TOKEN, CONTRACT, WALLET, RPC SERVICE, THIRD-PARTY COMPONENT, OR ATUM SERVICE WILL REMAIN AVAILABLE OR COMPATIBLE; OR THAT USE OF THE SOFTWARE WILL SATISFY ANY LEGAL, REGULATORY, COMPLIANCE, ACCOUNTING, TAX, SECURITY, OR OPERATIONAL REQUIREMENT.
+
+11. LIMITATION OF LIABILITY
+
+11.1 Excluded Damages. TO THE FULLEST EXTENT PERMITTED BY LAW, AND EXCEPT TO THE EXTENT A SEPARATELY EXECUTED AGREEMENT EXPRESSLY PROVIDES OTHERWISE, ATUM WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, OPPORTUNITY, GOODWILL, DATA, DIGITAL ASSETS, TOKENS, FUNDS, TRANSACTION VALUE, SIGNATURES, KEYS, OR CREDENTIALS, ARISING OUT OF OR RELATING TO THE SOFTWARE OR THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+11.2 Specific Risks. Without limiting Section 11.1, Atum will not be liable for loss arising from an incorrect address, chain, asset, amount, approval, deadline, signature, request, configuration, dependency, or credential; unauthorized or compromised access; failed, delayed, duplicated, reverted, reorganized, or otherwise unsuccessful blockchain activity; smart-contract behavior; network congestion; RPC, wallet, registry, gateway, or third-party service failure; or Licensee's failure to implement required security or operational controls, except to the extent liability cannot be excluded under applicable law.
+
+11.3 Liability Cap. If no separately executed agreement supplies a different liability allocation, Atum's total cumulative liability arising out of or relating to the Software or this Agreement will not exceed the greater of: (a) one hundred U.S. dollars (US $100); or (b) the amounts Licensee paid directly to Atum specifically for the Software during the twelve months preceding the event giving rise to the claim.
+
+12. TERM; TERMINATION; EFFECT
+
+12.1 Term. This Agreement begins when Licensee first accesses the Software and continues until terminated (the "Term").
+
+12.2 Termination. Licensee may terminate this Agreement by permanently ceasing use of and destroying the Software. Atum may terminate this Agreement on ten days' written notice, immediately upon Licensee's breach, immediately when Licensee is no longer authorized to possess or use the Software, or immediately under the circumstances described in Section 4.5. A separately executed agreement may establish different termination rights for approved production use.
+
+12.3 Effect. Upon termination or Atum's written request following expiration or revocation of authorization, Licensee must promptly: (a) stop accessing, installing, executing, integrating, deploying, and using the Software; (b) remove the Software from active systems and applications; (c) disable related access and credentials as directed by Atum; (d) destroy all copies and Atum Confidential Information in Licensee's possession or control, except copies retained solely where required by law and kept inaccessible and confidential; and (e) certify destruction upon reasonable request.
+
+12.4 Survival. Sections 3, 5.2, 6, 7, 10, 11, 12.3, 12.4, 13, and 14, and any provision that by its nature should survive, will survive termination.
+
+13. GOVERNING LAW; VENUE; EQUITABLE RELIEF
+
+This Agreement is governed by the laws of the State of Delaware, without regard to conflict-of-law principles. The state and federal courts located in Delaware have exclusive jurisdiction over disputes arising out of or relating to this Agreement, and each party consents to personal jurisdiction and venue in those courts. Unauthorized use or disclosure of the Software or Atum Confidential Information may cause irreparable harm for which monetary damages are inadequate, and Atum may seek appropriate injunctive or equitable relief in addition to other remedies.
+
+14. GENERAL
+
+14.1 Order of Precedence. If Atum and Licensee have executed a master services agreement, order form, pilot agreement, software license agreement, nondisclosure agreement, or other definitive agreement that expressly governs the Software or Atum Services, that agreement controls over any conflicting term of this Agreement. A nondisclosure agreement controls specifically with respect to confidentiality. Except for such an agreement, this Agreement is the complete agreement concerning the Software and supersedes prior or contemporaneous communications about its licensing.
+
+14.2 Assignment. Licensee may not assign or transfer this Agreement or any right under it, whether by operation of law, merger, change of control, or otherwise, without Atum's prior written consent. Any prohibited assignment is void. Atum may assign this Agreement to an affiliate or in connection with a merger, reorganization, financing, sale of assets, or change of control.
+
+14.3 Severability; Waiver. If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions will remain in effect. A failure or delay in enforcing a provision is not a waiver.
+
+14.4 Amendments. Any amendment applicable to a version of the Software already provided to Licensee must be in writing and accepted by authorized representatives of the parties, except that Atum may issue security, technical, and operational requirements as contemplated by this Agreement.
+
+14.5 Notices. Legal notices to Atum under this Agreement must be sent to legal@atumlabs.xyz. Atum may send notices to the email address associated with Licensee's registry account or otherwise designated by Licensee.
+
+14.6 Reservation of Rights. All rights not expressly granted are reserved by Atum.
+
+Copyright (c) 2026 Atum Labs, Inc. All rights reserved.

package/README.md

@@ -1,5 +1,9 @@
 # @atumlabs/mppx-atum-escrow
 
+> **Proprietary software - not open source.**
+>
+> Copyright (c) 2026 Atum Labs, Inc. All rights reserved. Access to and use of `@atumlabs/mppx-atum-escrow` are limited to entities expressly authorized by Atum and are governed by the Atum MPP Escrow SDK Proprietary License Agreement in the LICENSE file included with this package. Do not redistribute, publish, mirror, sublicense, or provide this package to any unauthorized person. By accessing, installing, copying, or using the package, you agree to the license terms.
+
 An [`mppx`](https://www.npmjs.com/package/mppx) payment method that lets a merchant accept
 **cross-chain stablecoin payments** through Atum, over the Machine Payments Protocol (MPP).