@atumlabs/mppx-atum-escrow 0.1.1 → 0.3.0

package/dist/client.d.ts

@@ -1,9 +1,10 @@
 import * as zod_v4_core from 'zod/v4/core';
 import * as z from 'zod/mini';
 import { Signer } from 'ethers';
-import { S as SenderSigner, f as SenderSignerOptions, h as SolanaClusterUnixTimeReader } from './internal-CjcEyEsm.js';
-export { A as AtumEscrowChallenge, a as AtumEscrowCredential, C as ChargeCredentialPayload, c as ChargeRequest, d as ChargeRequestSchema, e as CredentialPayloadSchema, I as INTENT, M as METHOD_NAME, P as PaymentRequest, g as atumEscrowChargeMethod } from './internal-CjcEyEsm.js';
+import { S as SenderSigner, g as SenderSignerOptions, i as SolanaClusterUnixTimeReader } from './internal-9tB7y-A7.js';
+export { A as AtumEscrowChallenge, a as AtumEscrowCredential, C as ChargeCredentialPayload, c as ChargeRequest, d as ChargeRequestSchema, e as CredentialPayloadSchema, I as INTENT, f as INTENT_ID_META_KEY, M as METHOD_NAME, h as atumEscrowChargeMethod } from './internal-9tB7y-A7.js';
 import { Method } from 'mppx';
+export { PaymentRequest } from './generated/index.js';
 
 /** Configuration for the payer side of the method. */
 interface AtumEscrowClientConfig {
@@ -22,8 +23,10 @@ interface AtumEscrowClientConfig {
     /** Clock (epoch ms) used to derive absolute deadlines from the challenge budgets. Defaults to `Date.now`. */
     now?: () => number;
     /**
-     * Solana-only test seam: supplies the `issued_at` a Solana deposit is stamped with,
-     * keeping the build fully offline. Defaults to the client clock. Ignored for EVM/Tron.
+     * Solana-only: supplies the `issued_at` a Solana deposit is stamped with, keeping the
+     * build fully offline. Used only when the challenge does not carry a merchant-stamped
+     * `extra.issuedAt` (which takes precedence); if neither is present, the client clock is
+     * used. Ignored for EVM/Tron.
      */
     solanaClockReader?: SolanaClusterUnixTimeReader;
 }
@@ -35,16 +38,18 @@ interface AtumEscrowClientConfig {
  * built through the payment-gateway client's request builder, so the same call handles
  * EVM, Tron, and Solana sources.
  *
- * Idempotency: for EVM and Tron sources the deposit nonce (and the `request_id`) are
- * derived deterministically from the challenge id, so even if a caller rebuilds the
- * credential for the same challenge the escrow admits at most one deposit — the reused
- * nonce reverts the second on-chain. This holds only when the merchant issues a stable,
- * per-intent challenge id: set `opaque` to a per-payment identifier (e.g. an order id),
- * reused on retry of that intent, and keep `expires` stable or absent per intent (both feed
- * the challenge-id HMAC). Solana sources use a replay-window nonce rather than a
- * deterministic one and rely on the gateway's content-keyed dedup (the request id, and
- * thus the payment id, are still derived deterministically from the challenge id).
- * Building once and resubmitting the identical bytes remains the simplest safe pattern.
+ * Idempotency: the `request_id` is derived from the challenge's per-intent identifier (see
+ * {@link INTENT_ID_META_KEY}) via the shared sender_auth SDK, and `preparePaymentRequest` then
+ * derives the deposit nonce from that `request_id` on every chain. So rebuilding the credential
+ * for the same purchase reproduces the same payment identity, and the gateway de-duplicates the
+ * retry onto the original payment instead of charging twice. On EVM/Tron the reused Permit2
+ * nonce is a second, on-chain backstop (the duplicate deposit reverts); on Solana the replay
+ * nonce only guards a ~128s window, so there the gateway's `request_id` dedup is the durable
+ * protection.
+ *
+ * A challenge that carries no such identifier cannot be paid safely, so this client refuses it
+ * rather than falling back to something per-attempt. See
+ * {@link ../server!buildChargeChallenge | buildChargeChallenge} for the merchant side.
  *
  * @param config - the payer's signer, source account, and options.
  */
@@ -62,7 +67,7 @@ declare function registerClient(config: AtumEscrowClientConfig): Method.Client<{
                 destination: z.ZodMiniObject<{
                     network: z.ZodMiniString<string>;
                     asset: z.ZodMiniString<string>;
-                    account: z.ZodMiniString<string>;
+                    address: z.ZodMiniString<string>;
                 }, zod_v4_core.$strip>;
                 fulfillmentAmount: z.ZodMiniString<string>;
                 escrow: z.ZodMiniString<string>;
@@ -72,9 +77,9 @@ declare function registerClient(config: AtumEscrowClientConfig): Method.Client<{
                 fulfillmentVerifierEndpoint: z.ZodMiniString<string>;
                 quoteDeadlineSeconds: z.ZodMiniNumber<number>;
                 fulfillmentDeadlineSeconds: z.ZodMiniNumber<number>;
-                permit2: z.ZodMiniOptional<z.ZodMiniString<string>>;
                 svmSignatureClusterId: z.ZodMiniOptional<z.ZodMiniString<string>>;
                 svmSignatureDomainVersion: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+                issuedAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
             }, zod_v4_core.$strip>;
         }, zod_v4_core.$strip>;
         readonly credential: {

package/dist/client.js

@@ -8,18 +8,20 @@ import { createRequire as __atumCreateRequire } from 'module'; const require = _
 import {
   ensureSourceApproval,
   registerClient
-} from "./chunk-L62WG2VU.js";
+} from "./chunk-ZFA5SSUP.js";
 import {
   ChargeRequestSchema,
   CredentialPayloadSchema,
   INTENT,
+  INTENT_ID_META_KEY,
   METHOD_NAME,
   atumEscrowChargeMethod
-} from "./chunk-2MWWLU75.js";
+} from "./chunk-Z3AUNEU5.js";
 export {
   ChargeRequestSchema,
   CredentialPayloadSchema,
   INTENT,
+  INTENT_ID_META_KEY,
   METHOD_NAME,
   atumEscrowChargeMethod,
   ensureSourceApproval,

package/dist/index.d.ts

@@ -1,6 +1,7 @@
-export { A as AtumEscrowChallenge, a as AtumEscrowCredential, b as AtumEscrowRequest, C as ChargeCredentialPayload, c as ChargeRequest, d as ChargeRequestSchema, e as CredentialPayloadSchema, I as INTENT, M as METHOD_NAME, P as PaymentRequest, S as SenderSigner, f as SenderSignerOptions, g as atumEscrowChargeMethod } from './internal-CjcEyEsm.js';
+export { A as AtumEscrowChallenge, a as AtumEscrowCredential, b as AtumEscrowRequest, C as ChargeCredentialPayload, c as ChargeRequest, d as ChargeRequestSchema, e as CredentialPayloadSchema, I as INTENT, f as INTENT_ID_META_KEY, M as METHOD_NAME, S as SenderSigner, g as SenderSignerOptions, h as atumEscrowChargeMethod } from './internal-9tB7y-A7.js';
 export { AtumEscrowClientConfig, EnsureApprovalResult, ensureSourceApproval, registerClient } from './client.js';
-export { AtumEscrowCorridor, AtumEscrowReceipt, AtumEscrowServerConfig, AtumEscrowSource, ChainDefaultsSource, FulfillmentConfirmation, PaymentSubmitter, buildChargeRequest, corridorFromDefaults, registerServer, validateCorridor } from './server.js';
+export { AtumEscrowCorridor, AtumEscrowReceipt, AtumEscrowServerConfig, AtumEscrowSource, ChainDefaultsSource, ChargeChallenge, FulfillmentConfirmation, PaymentRejectedError, PaymentSettlementStatus, PaymentSubmitResult, PaymentSubmitter, SettlementErrorDetails, SettlementFailedError, SettlementPendingError, buildChargeChallenge, buildChargeRequest, corridorFromDefaults, isPaymentRejected, isSettlementFailed, isSettlementPending, registerServer, validateCorridor } from './server.js';
+export { PaymentRequest } from './generated/index.js';
 import 'zod/mini';
 import 'mppx';
 import 'zod/v4/core';
@@ -12,11 +13,11 @@ import 'ethers';
  * and run json-schema-to-typescript to regenerate this file.
  */
 /**
- * The `extra.atum` object carried inside an atum-escrow x402 PaymentRequirements entry (accepts[]): the merchant's receive-side plus the contract/role addresses and deadline budgets. Scheme-specific data the standard x402 `extra` bag treats as opaque, so it is owned here and shared by all role mechanisms. Addresses are chain-general: an EVM `0x`-prefixed hex address, or a Tron/Solana base58 address, depending on the source/destination chain.
+ * The `extra.atum` object carried inside an atum-escrow x402 PaymentRequirements entry (accepts[]): the merchant's receive-side plus the contract/role addresses and deadline budgets. Scheme-specific data the standard x402 `extra` bag treats as opaque, so it is owned here and shared by all role mechanisms. Addresses are chain-general: an EVM `0x`-hex address (20 bytes) or a base58-encoded address (Solana/Tron), per the field's CAIP-2 chain.
  */
 interface AtumEscrowExtra {
     /**
-     * Where the merchant receives (CAIP-2 chain, token, account).
+     * Where the merchant receives (CAIP-2 chain, token, address).
      */
     destination: {
         /**
@@ -24,36 +25,36 @@ interface AtumEscrowExtra {
          */
         network: string;
         /**
-         * Destination token address (EVM hex or base58).
+         * Destination token contract address (EVM hex or base58, per the destination chain).
          */
         asset: string;
         /**
-         * Merchant receive account (EVM hex or base58).
+         * Merchant receive address (EVM hex or base58, per the destination chain).
          */
-        account: string;
+        address: string;
     };
     /**
      * Exact amount the merchant receives, in atomic token units.
      */
     fulfillmentAmount: string;
     /**
-     * Source-chain escrow contract (the x402 payTo).
+     * Source-chain escrow contract (the x402 payTo); EVM hex or base58, per the source chain.
      */
     escrow: string;
     /**
-     * Destination-chain fulfillment proxy contract.
+     * Destination-chain fulfillment proxy contract (EVM hex or base58, per the destination chain).
      */
     fulfillmentProxy: string;
     /**
-     * Reserver role address (escrow deposit witness).
+     * Atum reserver role address (escrow deposit witness); EVM hex or base58, per the source chain.
      */
     reserver: string;
     /**
-     * Releaser role address (escrow deposit witness).
+     * Atum releaser role address (escrow deposit witness); EVM hex or base58, per the source chain.
      */
     releaser: string;
     /**
-     * Source-chain fulfillment-verifier endpoint the payment request carries. The verifier account and the quote selector are the releaser and reserver respectively, so only the endpoint is not otherwise present in this object.
+     * Source-chain fulfillment-verifier endpoint the payment request carries. The verifier account and the quote_selector are the releaser and reserver respectively (the network derives the deposit witness roles from them), so only the endpoint is not otherwise present in this object.
      */
     fulfillmentVerifierEndpoint: string;
     /**
@@ -65,17 +66,17 @@ interface AtumEscrowExtra {
      */
     fulfillmentDeadlineSeconds: number;
     /**
-     * Tron-only: the Permit2 contract address the deposit authorization is signed against (the TIP-712 verifying contract). Present only when the source chain is Tron; on EVM the canonical Permit2 address is well-known, and Solana does not use Permit2.
-     */
-    permit2?: string;
-    /**
-     * Solana-only: cluster identifier used to domain-separate the deposit authorization. Present only when the source chain is Solana; omitted for EVM/Tron.
+     * Solana source only: cluster name used to build the 32-byte cluster_id in the V3 escrow signature domain. Optional; the facilitator requires it for a Solana source.
      */
     svmSignatureClusterId?: string;
     /**
-     * Solana-only: signature domain version used to domain-separate the deposit authorization. Present only when the source chain is Solana; omitted for EVM/Tron.
+     * Solana source only: escrow signature-domain version (V3 domain separation). Optional; required for a Solana source.
      */
     svmSignatureDomainVersion?: number;
+    /**
+     * Solana source only: merchant-stamped issue time in epoch seconds. The merchant reads the cluster clock so the client makes no RPC and the 402 stays self-contained. Optional; required for a Solana source.
+     */
+    issuedAt?: string;
 }
 
 export type { AtumEscrowExtra };

package/dist/index.js

@@ -8,29 +8,45 @@ import { createRequire as __atumCreateRequire } from 'module'; const require = _
 import {
   ensureSourceApproval,
   registerClient
-} from "./chunk-L62WG2VU.js";
+} from "./chunk-ZFA5SSUP.js";
 import {
+  PaymentRejectedError,
+  SettlementFailedError,
+  SettlementPendingError,
+  buildChargeChallenge,
   buildChargeRequest,
   corridorFromDefaults,
+  isPaymentRejected,
+  isSettlementFailed,
+  isSettlementPending,
   registerServer,
   validateCorridor
-} from "./chunk-W6D2D767.js";
+} from "./chunk-4YD6566T.js";
 import {
   ChargeRequestSchema,
   CredentialPayloadSchema,
   INTENT,
+  INTENT_ID_META_KEY,
   METHOD_NAME,
   atumEscrowChargeMethod
-} from "./chunk-2MWWLU75.js";
+} from "./chunk-Z3AUNEU5.js";
 export {
   ChargeRequestSchema,
   CredentialPayloadSchema,
   INTENT,
+  INTENT_ID_META_KEY,
   METHOD_NAME,
+  PaymentRejectedError,
+  SettlementFailedError,
+  SettlementPendingError,
   atumEscrowChargeMethod,
+  buildChargeChallenge,
   buildChargeRequest,
   corridorFromDefaults,
   ensureSourceApproval,
+  isPaymentRejected,
+  isSettlementFailed,
+  isSettlementPending,
   registerClient,
   registerServer,
   validateCorridor

package/dist/internal-9tB7y-A7.d.ts

@@ -0,0 +1,365 @@
+import * as z from 'zod/mini';
+import { PaymentRequest } from './generated/index.js';
+import { Challenge, Credential } from 'mppx';
+
+/**
+ * A message that has been cryptographically signed to prove authorization.
+ * The signature proves you control the wallet that's sending funds.
+ *
+ */
+type SignedMessage = {
+    /**
+     * The data that was signed. Format depends on the blockchain:
+     * - EVM: Hex-encoded message hash (with 0x prefix)
+     * - Solana: Base64 encoded message
+     * - Tron: Hex-encoded message hash (possibly without 0x prefix)
+     *
+     */
+    message: string;
+    /**
+     * Optional: If 'message' contains a hash, this field contains the original data
+     * before it was hashed. Useful for verification and debugging.
+     *
+     */
+    message_prehash?: string;
+    /**
+     * The cryptographic signature proving you authorized this message.
+     * Format varies by blockchain (hex for EVM/Tron, base58 for Solana).
+     *
+     */
+    signature: string;
+};
+
+/**
+ * Chain defaults returned by the payment gateway /defaults endpoint.
+ */
+interface ChainDefaults {
+    escrowContract: string;
+    quoteSelector: string;
+    fulfillmentVerifierAccount: string;
+    fulfillmentVerifierEndpoint: string;
+    fulfillmentProxy: string;
+    permit2Contract?: string;
+    /**
+     * V3 Solana escrow domain-separation fields, surfaced by payment-gw
+     * `/defaults` for Solana source chains. Used to build the EscrowDomain that the
+     * V3 deposit hash binds to. Absent for EVM/Tron.
+     */
+    svmSignatureClusterId?: string;
+    svmSignatureDomainVersion?: number;
+}
+
+interface Logger {
+    debug(obj: unknown, msg?: string): void;
+    info(obj: unknown, msg?: string): void;
+    warn(obj: unknown, msg?: string): void;
+    error(obj: unknown, msg?: string): void;
+    child(bindings: Record<string, unknown>): Logger;
+}
+
+interface Counter {
+    add(value: number, attributes?: Record<string, unknown>): void;
+}
+interface Histogram {
+    record(value: number, attributes?: Record<string, unknown>): void;
+}
+interface InstrumentOptions {
+    description?: string;
+    unit?: string;
+}
+interface Meter {
+    createCounter(name: string, options?: InstrumentOptions): Counter;
+    createHistogram(name: string, options?: InstrumentOptions): Histogram;
+}
+
+/**
+ * Resolves the `issued_at` timestamp for a Solana deposit authorization from the
+ * cluster's on-chain clock instead of the local wall clock.
+ *
+ * The escrow validates `now_sec >= issued_at` against Solana's `Clock` sysvar
+ * (crates/replay/src/check.rs). That on-chain clock is global consensus and only
+ * moves forward, so a value read at build time is a safe lower bound at
+ * settlement, which removes the `Escrow_FutureTransaction` failure that a raw
+ * `Date.now()` (client wall clock, possibly ahead of the lagging cluster clock)
+ * can trigger.
+ *
+ * The read is best-effort: on any failure, timeout, or unresolved RPC it falls
+ * back to `Date.now()` minus a skew buffer, so a flaky public endpoint degrades
+ * to the previous behavior rather than blocking the payment.
+ */
+
+/** Reads the cluster's on-chain unix timestamp (seconds) from an RPC endpoint. */
+type SolanaClusterUnixTimeReader = (rpcUrl: string, timeoutMs: number) => Promise<bigint>;
+
+/** Result of signing a sender_auth message. */
+interface SenderSignature {
+    /** 0x-prefixed signature hex (65-byte secp256k1 for EVM/Tron, 64-byte ed25519 for Solana). */
+    signature: string;
+    /**
+     * base58 signer public key for non-recoverable schemes (Solana), attached to
+     * the signed message's payload.delegate_signer. Absent for EVM/Tron, whose
+     * secp256k1 signatures are recoverable.
+     */
+    delegateSigner?: string;
+}
+/** Signs a single sender_auth signed message for a payment request. */
+interface SenderSigner {
+    sign(signedMessage: SignedMessage): Promise<SenderSignature>;
+}
+/** Turnkey provider configuration (shared by the SDK and the CLI env loader). */
+interface TurnkeyConfig {
+    organizationId: string;
+    walletId: string;
+    apiPublicKey: string;
+    apiPrivateKey: string;
+    /**
+     * Chain-native address the signer is expected to resolve to. Verified against
+     * the address Turnkey returns at initialize(); a mismatch fails fast rather
+     * than signing as the wrong depositor.
+     */
+    pinnedAddress?: string;
+    /**
+     * Optional observability threaded to the Turnkey network path (default noop).
+     * SDK consumers can wire their own logger and meter; the CLI leaves them unset.
+     */
+    logger?: Logger;
+    meter?: Meter;
+}
+/** Options selecting a sender-signing provider. Defaults to the private-key provider. */
+type SenderSignerOptions = {
+    provider?: 'raw';
+    privateKey: string;
+    pinnedAddress?: string;
+} | ({
+    provider: 'turnkey';
+} & TurnkeyConfig);
+
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+/**
+ * The MPP `charge` challenge request — the method-specific `request` blob inside an mppx Challenge. It carries the source option the payer funds from plus the destination/corridor block (the reused `extra`). MPP has no x402 `accepts[]` envelope, so the source option that x402 carried at the `accepts[]` top level rides here alongside `extra`. One source option per challenge; a 402 may advertise several challenges to offer several source options.
+ */
+interface AtumEscrowRequest {
+    /**
+     * The source chain/token/cap the payer funds from.
+     */
+    source: {
+        /**
+         * CAIP-2 source chain id (e.g. eip155:8453).
+         */
+        network: string;
+        /**
+         * Source token address (EVM hex or base58, per the source chain).
+         */
+        asset: string;
+        /**
+         * Source spend cap (fulfillmentAmount + markup), in atomic token units — the authoritative `max_source_amount` the payer signs.
+         */
+        amount: string;
+    };
+    extra: AtumEscrowExtra;
+}
+/**
+ * The `extra.atum` object carried inside an atum-escrow x402 PaymentRequirements entry (accepts[]): the merchant's receive-side plus the contract/role addresses and deadline budgets. Scheme-specific data the standard x402 `extra` bag treats as opaque, so it is owned here and shared by all role mechanisms. Addresses are chain-general: an EVM `0x`-hex address (20 bytes) or a base58-encoded address (Solana/Tron), per the field's CAIP-2 chain.
+ */
+interface AtumEscrowExtra {
+    /**
+     * Where the merchant receives (CAIP-2 chain, token, address).
+     */
+    destination: {
+        /**
+         * CAIP-2 destination chain id (e.g. eip155:42161).
+         */
+        network: string;
+        /**
+         * Destination token contract address (EVM hex or base58, per the destination chain).
+         */
+        asset: string;
+        /**
+         * Merchant receive address (EVM hex or base58, per the destination chain).
+         */
+        address: string;
+    };
+    /**
+     * Exact amount the merchant receives, in atomic token units.
+     */
+    fulfillmentAmount: string;
+    /**
+     * Source-chain escrow contract (the x402 payTo); EVM hex or base58, per the source chain.
+     */
+    escrow: string;
+    /**
+     * Destination-chain fulfillment proxy contract (EVM hex or base58, per the destination chain).
+     */
+    fulfillmentProxy: string;
+    /**
+     * Atum reserver role address (escrow deposit witness); EVM hex or base58, per the source chain.
+     */
+    reserver: string;
+    /**
+     * Atum releaser role address (escrow deposit witness); EVM hex or base58, per the source chain.
+     */
+    releaser: string;
+    /**
+     * Source-chain fulfillment-verifier endpoint the payment request carries. The verifier account and the quote_selector are the releaser and reserver respectively (the network derives the deposit witness roles from them), so only the endpoint is not otherwise present in this object.
+     */
+    fulfillmentVerifierEndpoint: string;
+    /**
+     * Recommended quote-deadline budget in seconds, relative to signing time.
+     */
+    quoteDeadlineSeconds: number;
+    /**
+     * Recommended fulfillment-deadline budget in seconds, relative to signing time.
+     */
+    fulfillmentDeadlineSeconds: number;
+    /**
+     * Solana source only: cluster name used to build the 32-byte cluster_id in the V3 escrow signature domain. Optional; the facilitator requires it for a Solana source.
+     */
+    svmSignatureClusterId?: string;
+    /**
+     * Solana source only: escrow signature-domain version (V3 domain separation). Optional; required for a Solana source.
+     */
+    svmSignatureDomainVersion?: number;
+    /**
+     * Solana source only: merchant-stamped issue time in epoch seconds. The merchant reads the cluster clock so the client makes no RPC and the 402 stays self-contained. Optional; required for a Solana source.
+     */
+    issuedAt?: string;
+}
+
+/**
+ * Shared internals for the Atum escrow MPP method: the wire schemas, the method
+ * definition, the shared types, and the pure chain/address helpers used by both
+ * the payer ({@link ./client}) and merchant ({@link ./server}) sides.
+ *
+ * This module is not a public entry point — consumers import from the package
+ * root, `/client`, or `/server`. The helpers here are exported only so the
+ * client and server modules can share them.
+ *
+ * @internal
+ */
+
+/** The method name advertised in MPP challenges and credentials. */
+declare const METHOD_NAME = "atum-escrow";
+/** The MPP intent this method implements. */
+declare const INTENT = "charge";
+/**
+ * Challenge-metadata key carrying the merchant's per-intent payment identifier.
+ *
+ * The payer derives the payment's `request_id` from this value, and the gateway
+ * de-duplicates on that `request_id`. So the key's lifetime defines what counts as "the same
+ * payment": one value per thing being bought, reused on every retry of that purchase, never
+ * shared between two purchases.
+ *
+ * It rides in challenge metadata rather than in the charge request because it identifies the
+ * purchase, not its terms — two sequential orders for the same item have identical terms and
+ * must still be two payments. Metadata is covered by the challenge-id HMAC, so a payer cannot
+ * substitute another intent's identifier to have a second purchase resolve onto an
+ * already-settled payment.
+ *
+ * Prefixed to keep it distinct from a merchant's own metadata and from the framework's
+ * reserved keys.
+ */
+declare const INTENT_ID_META_KEY = "atumIntentId";
+/**
+ * Schema for the `charge` challenge request — the method-specific data a merchant
+ * publishes in an MPP `402` challenge. It describes what the merchant receives and the
+ * source option the payer may fund from, so the payer can build the payment offline.
+ */
+declare const ChargeRequestSchema: z.ZodMiniObject<{
+    source: z.ZodMiniObject<{
+        network: z.ZodMiniString<string>;
+        asset: z.ZodMiniString<string>;
+        amount: z.ZodMiniString<string>;
+    }, z.core.$strip>;
+    extra: z.ZodMiniObject<{
+        destination: z.ZodMiniObject<{
+            network: z.ZodMiniString<string>;
+            asset: z.ZodMiniString<string>;
+            address: z.ZodMiniString<string>;
+        }, z.core.$strip>;
+        fulfillmentAmount: z.ZodMiniString<string>;
+        escrow: z.ZodMiniString<string>;
+        fulfillmentProxy: z.ZodMiniString<string>;
+        reserver: z.ZodMiniString<string>;
+        releaser: z.ZodMiniString<string>;
+        fulfillmentVerifierEndpoint: z.ZodMiniString<string>;
+        quoteDeadlineSeconds: z.ZodMiniNumber<number>;
+        fulfillmentDeadlineSeconds: z.ZodMiniNumber<number>;
+        svmSignatureClusterId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+        svmSignatureDomainVersion: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+        issuedAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * Schema for the `charge` credential payload — the signed payment the payer returns in
+ * the MPP credential. It carries the Atum payment request; the request's signatures and
+ * terms are verified in full during server verification and by the Atum Payment Gateway,
+ * so this envelope validates only that the request is present.
+ */
+declare const CredentialPayloadSchema: z.ZodMiniObject<{
+    paymentRequest: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
+}, z.core.$strip>;
+/**
+ * The `charge` challenge request — the canonical `AtumEscrowRequest` shape (source option
+ * + the destination/corridor `extra`). The runtime schema above is verified against this
+ * type at compile time (below), so the validator and the canonical schema cannot drift.
+ */
+type ChargeRequest = AtumEscrowRequest;
+/** The `charge` credential payload, carrying the signed Atum payment request. */
+interface ChargeCredentialPayload {
+    /** The signed Atum payment request: source/destination, amounts, and authorizations. */
+    paymentRequest: PaymentRequest;
+}
+/**
+ * The MPP challenge for this method. Uses the schema's inferred type for the request
+ * (equal to {@link ChargeRequest} by the compile-time guard above, and compatible with
+ * the framework's `Record<string, unknown>` request constraint).
+ */
+type AtumEscrowChallenge = Challenge.Challenge<z.infer<typeof ChargeRequestSchema>, "charge", "atum-escrow">;
+/** The MPP credential for this method. */
+type AtumEscrowCredential = Credential.Credential<ChargeCredentialPayload, AtumEscrowChallenge>;
+/**
+ * The base `atum-escrow` charge method. Extend it with `registerClient` on the payer side
+ * and `registerServer` on the merchant side.
+ */
+declare const atumEscrowChargeMethod: {
+    readonly name: "atum-escrow";
+    readonly intent: "charge";
+    readonly schema: {
+        readonly request: z.ZodMiniObject<{
+            source: z.ZodMiniObject<{
+                network: z.ZodMiniString<string>;
+                asset: z.ZodMiniString<string>;
+                amount: z.ZodMiniString<string>;
+            }, z.core.$strip>;
+            extra: z.ZodMiniObject<{
+                destination: z.ZodMiniObject<{
+                    network: z.ZodMiniString<string>;
+                    asset: z.ZodMiniString<string>;
+                    address: z.ZodMiniString<string>;
+                }, z.core.$strip>;
+                fulfillmentAmount: z.ZodMiniString<string>;
+                escrow: z.ZodMiniString<string>;
+                fulfillmentProxy: z.ZodMiniString<string>;
+                reserver: z.ZodMiniString<string>;
+                releaser: z.ZodMiniString<string>;
+                fulfillmentVerifierEndpoint: z.ZodMiniString<string>;
+                quoteDeadlineSeconds: z.ZodMiniNumber<number>;
+                fulfillmentDeadlineSeconds: z.ZodMiniNumber<number>;
+                svmSignatureClusterId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                svmSignatureDomainVersion: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+                issuedAt: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        readonly credential: {
+            readonly payload: z.ZodMiniObject<{
+                paymentRequest: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
+            }, z.core.$strip>;
+        };
+    };
+};
+
+export { type AtumEscrowChallenge as A, type ChargeCredentialPayload as C, INTENT as I, METHOD_NAME as M, type SenderSigner as S, type AtumEscrowCredential as a, type AtumEscrowRequest as b, type ChargeRequest as c, ChargeRequestSchema as d, CredentialPayloadSchema as e, INTENT_ID_META_KEY as f, type SenderSignerOptions as g, atumEscrowChargeMethod as h, type SolanaClusterUnixTimeReader as i, type ChainDefaults as j };