@atumlabs/mppx-atum-escrow 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- **Breaking: `PaymentSettlementStatus` now reads `'pending' | 'finalizing' | 'completed' | 'failed'`.** `cancelled` is removed — the gateway could not produce it, and a payment that ends undelivered is reported as `failed`. `finalizing` is added: the transaction is on chain but has not yet reached the confirmations its chain requires, so it is **not** terminal and a payment in that state is still waited on rather than written off. Code doing an exhaustive `switch` on this type will not compile until a `finalizing` branch is added. A status this package does not recognise is treated as pending rather than terminal, which is the safe direction: it raises `SettlementPendingError` (retry this purchase) instead of `SettlementFailedError` (start a new one), so a payment still in flight is never answered with an instruction to charge again.
+
+### Security
+- The axios copy bundled from the payment-gateway client is now 1.20.0, which patches the 1.13.x advisories. The notices file lists the new MIT transitives (`https-proxy-agent`, `agent-base`) that ride along.
+
+## [0.4.1] - 2026-09-18
+
+### Changed
+- Published under Apache-2.0 with `publishConfig.access: public`. npm will not overwrite 0.4.0, so this version exists to ship the LICENSE, NOTICE, and public visibility that 0.4.0 cannot take.
+
 ## [0.4.0] - 2026-09-16
 
 ### Changed

package/LICENSE

@@ -1,166 +1,202 @@
-ATUM LABS, INC. - MPP ESCROW SDK PROPRIETARY LICENSE AGREEMENT
-Last Updated: July 22, 2026
 
-This Proprietary License Agreement (the "Agreement") governs access to and use of the npm package identified as @atumlabs/mppx-atum-escrow, together with all source code, compiled code, type definitions, schemas, documentation, examples, configuration materials, copies, updates, and other materials that Atum Labs, Inc. ("Atum") provides with or for that package (collectively, the "Software").
-
-"Licensee" means the legal entity that Atum has expressly authorized to access the Software. "Authorized Users" means Licensee's employees and individual contractors who need access for the Authorized Purpose, are subject to written confidentiality and use restrictions at least as protective as this Agreement, and are acting on Licensee's behalf. "Atum Services" means Atum's payment gateway, settlement network, APIs, SDKs other than the Software, smart contracts, hosted services, credentials, test environments, and related systems.
-
-The Software is proprietary to Atum and, unless Atum has expressly made particular materials public, confidential. By accessing the Software through a private registry or other Atum-controlled channel, or by installing, copying, executing, integrating, or using the Software, Licensee agrees to this Agreement. An individual accepting this Agreement for an entity represents that the individual has authority to bind that entity. A person or entity that does not agree to this Agreement, or is not authorized by Atum, must not access or use the Software.
-
-1. AUTHORIZED PURPOSE
-
-1.1 Authorized Purpose. Atum provides the Software solely so that Licensee may evaluate, install, configure, integrate, test, conduct internal security and operational reviews of, and use the Software in Licensee's own systems to connect to Atum Services and implement payment flows that Atum has approved in writing (the "Authorized Purpose"). The Authorized Purpose may include:
-
-(a) constructing and processing Machine Payments Protocol challenges, credentials, and receipts;
-
-(b) creating or validating source-chain deposit authorizations, payment requests, settlement-routing data, and settlement confirmations;
-
-(c) integrating payer-side and merchant-side applications with Atum-authorized payment workflows; and
-
-(d) configuring approved chains, assets, accounts, contracts, endpoints, deadlines, and related parameters in accordance with Atum documentation and instructions.
-
-1.2 Production Use. Evaluation, development, integration, security review, demonstration, sandbox, and testnet use are permitted within the scope Atum has approved. Production use, treasury use, use with real customer funds, or use to provide services to any third party is permitted only if Atum has expressly authorized that use in a separately executed agreement, order form, pilot agreement, or other written authorization.
-
-1.3 No Service Access Grant. Access to the Software does not itself authorize access to any Atum Service, blockchain account, smart contract, signing key, API key, credential, asset, or production environment. All such access is subject to separate approval and any additional terms Atum specifies.
-
-2. LICENSE GRANT
-
-2.1 Limited License. Subject to Licensee's continuing compliance with this Agreement and all separate Atum authorizations, Atum grants Licensee a limited, revocable, non-exclusive, non-transferable, and non-sublicensable license during the Term to:
-
-(a) download, install, execute, and internally use the Software solely for the Authorized Purpose;
-
-(b) make a reasonable number of copies for development, testing, deployment, backup, and archival purposes, provided that every copy retains all copyright, proprietary, confidentiality, and license notices;
-
-(c) incorporate the unmodified Software into Licensee's own applications and deploy those applications within environments controlled by Licensee or expressly approved by Atum, solely for the Authorized Purpose and not as a standalone product or service;
-
-(d) create configuration files, adapters, wrappers, deployment materials, logging, observability, security controls, and other integration code that calls the Software's published interfaces, provided that such materials do not expose, reproduce, modify, or bypass protected portions of the Software; and
-
-(e) permit Authorized Users to exercise the rights above on Licensee's behalf.
-
-2.2 Responsibility for Authorized Users. Licensee is responsible for each Authorized User's compliance with this Agreement and for all activity conducted through Licensee's registry accounts, credentials, environments, and deployments.
-
-2.3 No Implied Rights. No rights are granted by implication, estoppel, exhaustion, or otherwise. All rights not expressly granted are reserved by Atum.
-
-3. RESTRICTIONS
-
-Licensee must not, and must not permit any other person or entity to:
-
-(a) use the Software outside the Authorized Purpose or after Atum's authorization has expired or been withdrawn;
-
-(b) provide registry credentials or access to the Software to any person other than an Authorized User;
-
-(c) publish, disclose, mirror, fork, upload, transmit, distribute, or otherwise make the Software or any substantial portion of it available through a public repository, public package registry, public website, public model registry, file-sharing service, or other public or unauthorized channel;
-
-(d) sell, rent, lease, sublicense, assign, timeshare, commercialize, or distribute the Software, or offer the Software as a standalone product, hosted service, managed service, service bureau, or other offering for the benefit of a third party;
-
-(e) modify, adapt, translate, or create derivative works of the Software, except for integration materials expressly permitted by Section 2.1(d) or as Atum approves in writing;
-
-(f) reverse engineer, decompile, disassemble, decode, or otherwise attempt to derive nonpublic source code, underlying ideas, algorithms, architecture, internal interfaces, settlement logic, auction logic, routing logic, security controls, or trade secrets from the Software, except to the limited extent a restriction is prohibited by applicable law after prior written notice to Atum;
-
-(g) use the Software, its schemas, workflows, interfaces, documentation, or output to build, operate, support, or improve a competing payment-orchestration, settlement, routing, escrow, auction, intent-processing, payment-gateway, or transaction-coordination product or service;
-
-(h) bypass, disable, weaken, or interfere with authentication, authorization, access controls, signature verification, source-approval checks, replay protection, nonce handling, idempotency, chain or asset validation, destination validation, quote deadlines, fulfillment deadlines, settlement-routing checks, receipt validation, logging, rate limits, or any other safety or security mechanism;
-
-(i) configure or use the Software with any contract, chain, asset, account, signer, endpoint, gateway, verifier, proxy, or other component that Atum has not approved for the applicable use;
-
-(j) use the Software to initiate, authorize, submit, conceal, facilitate, or process any unauthorized, fraudulent, forged, misleading, replayed, duplicated, expired, manipulated, unlawful, or otherwise invalid payment, transaction, credential, signature, settlement instruction, or request;
-
-(k) remove, alter, disable, or obscure any copyright, proprietary, confidentiality, attribution, trademark, warning, or license notice;
-
-(l) use the Software, related documentation, or nonpublic output to train, fine-tune, evaluate, benchmark, or improve any artificial-intelligence, machine-learning, large-language-model, or automated code-generation system without Atum's prior written consent;
-
-(m) publish or disclose benchmark, performance, security-testing, or competitive-analysis results concerning the Software or Atum Services without Atum's prior written consent; or
-
-(n) use the Software in violation of applicable law, sanctions, export controls, Atum instructions, or the rights of any third party.
-
-4. SECURITY AND OPERATIONAL REQUIREMENTS
-
-4.1 Security. Licensee must use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the Software and the payment activity involved. Licensee must restrict access under least-privilege principles, maintain appropriate logging and monitoring, and protect registry credentials, private keys, signing keys, API keys, RPC credentials, gateway credentials, and other secrets in secure secret-management systems. Licensee must not hard-code or commit secrets into the Software, an application bundle, a repository, or any other location accessible to unauthorized persons.
-
-4.2 Validation and Controls. Before any use involving live systems or assets, Licensee is solely responsible for reviewing the Software and its dependencies, testing the complete payment flow, validating its deployment, and confirming the adequacy of its internal approvals, maker-checker procedures, transaction limits, monitoring, incident response, and reconciliation controls. Licensee must independently verify all material payment parameters, including the source chain, source asset, source account, token approval, destination chain, destination asset, destination account, amount, fees, deadlines, contract addresses, routing fields, signatures, and settlement results.
-
-4.3 Authorized Configurations. Licensee must use only versions, dependencies, chains, assets, contracts, endpoints, and configurations that Atum has approved for the applicable use and must implement security, technical, operational, and compliance updates that Atum reasonably requires.
-
-4.4 Incidents. Licensee must promptly notify Atum at legal@atumlabs.xyz, and through any security contact Atum designates, of any actual or suspected unauthorized access, disclosure, credential compromise, key compromise, misuse, security incident, invalid payment activity, or material vulnerability involving the Software or an Atum Service. Licensee must reasonably cooperate in investigation, containment, remediation, and required notifications.
-
-4.5 Suspension. Atum may suspend or revoke access to the Software, a private registry, credentials, or Atum Services immediately if Atum reasonably believes continued access or use presents a legal, regulatory, sanctions, fraud, security, market-integrity, asset-loss, or operational risk, or if Licensee breaches this Agreement.
-
-5. ATUM SERVICES AND THIRD-PARTY COMPONENTS
-
-5.1 Atum Services. The Software is integration software and is not itself a wallet, custodian, exchange, money transmitter, payment processor, signing service, settlement service, or grant of access to Atum Services. Licensee's access to and use of Atum Services are governed by separate written terms, technical requirements, and approvals. Atum may change, limit, suspend, or discontinue an Atum Service as permitted by those terms.
-
-5.2 Third-Party Components. The Software may include, depend on, interoperate with, or require third-party software, protocols, libraries, networks, wallets, RPC services, or other services. Third-party components are governed by their own licenses and terms, which are not replaced or limited by this Agreement. Licensee is responsible for complying with those terms and for determining whether each third-party component is appropriately licensed, secure, available, and suitable for Licensee's use. Atum may require Licensee to pin, update, replace, self-host, or discontinue a third-party dependency.
-
-6. OWNERSHIP; LICENSEE APPLICATIONS; FEEDBACK
-
-6.1 Atum Ownership. As between the parties, Atum and its licensors retain all right, title, and interest in and to the Software, Atum Services, Atum documentation, Atum technology, and all related intellectual-property and proprietary rights. No ownership interest is transferred to Licensee.
-
-6.2 Licensee Applications. Subject to Atum's ownership of the Software and Atum technology, Licensee retains its rights in applications, data, and integration code that Licensee independently develops without incorporating Atum Confidential Information other than as authorized by this Agreement. Licensee's ownership does not include the Software, any modification or derivative work of the Software, or any Atum interface, schema, documentation, or technology reproduced in Licensee materials.
-
-6.3 Feedback. If Licensee provides feedback, suggestions, bug reports, enhancement requests, or other input concerning the Software or Atum Services, Licensee grants Atum a perpetual, irrevocable, worldwide, royalty-free, transferable, sublicensable license to use, reproduce, modify, distribute, commercialize, and otherwise exploit that feedback without restriction or obligation. Licensee is not required to disclose its confidential information in feedback.
-
-6.4 Trademarks. No right to use an Atum name, logo, trademark, service mark, domain name, or trade dress is granted, except for accurate internal identification of the Software or as Atum separately approves in writing.
-
-7. CONFIDENTIALITY
-
-7.1 Confidential Information. Nonpublic Software and related source code, documentation, schemas, configurations, examples, security information, endpoints, credentials, architecture, workflows, and technical or operational materials are Atum Confidential Information. If the parties have a separate nondisclosure agreement, that agreement governs confidentiality and controls over any inconsistent provision in this Section.
-
-7.2 Protection and Use. Licensee must protect Atum Confidential Information using at least reasonable care and no less than the care it uses for its own information of similar sensitivity. Licensee may use Atum Confidential Information only for the Authorized Purpose and disclose it only to Authorized Users with a need to know.
-
-7.3 Exclusions. The confidentiality obligations in this Section do not apply to information that Licensee can demonstrate through contemporaneous records: (a) became public through no breach of an obligation; (b) was lawfully known to Licensee without restriction before receipt from Atum; (c) was independently developed without use of Atum Confidential Information; or (d) was lawfully received from a third party without a duty of confidentiality.
-
-7.4 Required Disclosure. If Licensee is legally required to disclose Atum Confidential Information, Licensee must, to the extent legally permitted, provide prompt written notice to Atum and reasonable assistance in seeking protective treatment, and disclose only the portion legally required.
-
-8. COMPLIANCE VERIFICATION; EXPORT AND SANCTIONS
-
-8.1 Compliance Verification. Upon reasonable request, Licensee will provide a written certification of compliance with this Agreement and reasonable information sufficient to confirm that access is limited to Authorized Users and approved environments. Any review will be conducted in a manner designed to minimize disruption and protect Licensee's unrelated confidential information.
-
-8.2 Export and Sanctions. Licensee must comply with applicable export-control and economic-sanctions laws and must not permit access to or use of the Software by a prohibited party, in a prohibited territory, or for a prohibited end use.
-
-9. SUPPORT, UPDATES, AND CHANGES
-
-Atum has no obligation to provide maintenance, support, service levels, updates, upgrades, corrections, or continued availability unless a separately executed agreement expressly requires them. Atum may provide updates or replacement versions in its discretion. An update may include new or revised terms, and Licensee must not use an update unless Licensee accepts the terms applicable to that update.
-
-10. DISCLAIMER OF WARRANTIES
-
-EXCEPT TO THE EXTENT A SEPARATELY EXECUTED AGREEMENT EXPRESSLY PROVIDES OTHERWISE, THE SOFTWARE IS PROVIDED "AS IS," "AS AVAILABLE," AND WITH ALL FAULTS, WITHOUT ANY EXPRESS, IMPLIED, OR STATUTORY WARRANTY.
-
-TO THE FULLEST EXTENT PERMITTED BY LAW, ATUM DISCLAIMS ALL WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, SECURITY, AVAILABILITY, COMPATIBILITY, AND UNINTERRUPTED OR ERROR-FREE OPERATION. ATUM DOES NOT WARRANT THAT THE SOFTWARE WILL PREVENT LOSS, FRAUD, REPLAY, MISCONFIGURATION, UNAUTHORIZED SIGNING, DUPLICATE SUBMISSION, OR INVALID SETTLEMENT; THAT ANY PAYMENT WILL BE QUOTED, ACCEPTED, COMPLETED, FINAL, REVERSIBLE, OR PROFITABLE; THAT ANY BLOCKCHAIN, TOKEN, CONTRACT, WALLET, RPC SERVICE, THIRD-PARTY COMPONENT, OR ATUM SERVICE WILL REMAIN AVAILABLE OR COMPATIBLE; OR THAT USE OF THE SOFTWARE WILL SATISFY ANY LEGAL, REGULATORY, COMPLIANCE, ACCOUNTING, TAX, SECURITY, OR OPERATIONAL REQUIREMENT.
-
-11. LIMITATION OF LIABILITY
-
-11.1 Excluded Damages. TO THE FULLEST EXTENT PERMITTED BY LAW, AND EXCEPT TO THE EXTENT A SEPARATELY EXECUTED AGREEMENT EXPRESSLY PROVIDES OTHERWISE, ATUM WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, OPPORTUNITY, GOODWILL, DATA, DIGITAL ASSETS, TOKENS, FUNDS, TRANSACTION VALUE, SIGNATURES, KEYS, OR CREDENTIALS, ARISING OUT OF OR RELATING TO THE SOFTWARE OR THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-11.2 Specific Risks. Without limiting Section 11.1, Atum will not be liable for loss arising from an incorrect address, chain, asset, amount, approval, deadline, signature, request, configuration, dependency, or credential; unauthorized or compromised access; failed, delayed, duplicated, reverted, reorganized, or otherwise unsuccessful blockchain activity; smart-contract behavior; network congestion; RPC, wallet, registry, gateway, or third-party service failure; or Licensee's failure to implement required security or operational controls, except to the extent liability cannot be excluded under applicable law.
-
-11.3 Liability Cap. If no separately executed agreement supplies a different liability allocation, Atum's total cumulative liability arising out of or relating to the Software or this Agreement will not exceed the greater of: (a) one hundred U.S. dollars (US $100); or (b) the amounts Licensee paid directly to Atum specifically for the Software during the twelve months preceding the event giving rise to the claim.
-
-12. TERM; TERMINATION; EFFECT
-
-12.1 Term. This Agreement begins when Licensee first accesses the Software and continues until terminated (the "Term").
-
-12.2 Termination. Licensee may terminate this Agreement by permanently ceasing use of and destroying the Software. Atum may terminate this Agreement on ten days' written notice, immediately upon Licensee's breach, immediately when Licensee is no longer authorized to possess or use the Software, or immediately under the circumstances described in Section 4.5. A separately executed agreement may establish different termination rights for approved production use.
-
-12.3 Effect. Upon termination or Atum's written request following expiration or revocation of authorization, Licensee must promptly: (a) stop accessing, installing, executing, integrating, deploying, and using the Software; (b) remove the Software from active systems and applications; (c) disable related access and credentials as directed by Atum; (d) destroy all copies and Atum Confidential Information in Licensee's possession or control, except copies retained solely where required by law and kept inaccessible and confidential; and (e) certify destruction upon reasonable request.
-
-12.4 Survival. Sections 3, 5.2, 6, 7, 10, 11, 12.3, 12.4, 13, and 14, and any provision that by its nature should survive, will survive termination.
-
-13. GOVERNING LAW; VENUE; EQUITABLE RELIEF
-
-This Agreement is governed by the laws of the State of Delaware, without regard to conflict-of-law principles. The state and federal courts located in Delaware have exclusive jurisdiction over disputes arising out of or relating to this Agreement, and each party consents to personal jurisdiction and venue in those courts. Unauthorized use or disclosure of the Software or Atum Confidential Information may cause irreparable harm for which monetary damages are inadequate, and Atum may seek appropriate injunctive or equitable relief in addition to other remedies.
-
-14. GENERAL
-
-14.1 Order of Precedence. If Atum and Licensee have executed a master services agreement, order form, pilot agreement, software license agreement, nondisclosure agreement, or other definitive agreement that expressly governs the Software or Atum Services, that agreement controls over any conflicting term of this Agreement. A nondisclosure agreement controls specifically with respect to confidentiality. Except for such an agreement, this Agreement is the complete agreement concerning the Software and supersedes prior or contemporaneous communications about its licensing.
-
-14.2 Assignment. Licensee may not assign or transfer this Agreement or any right under it, whether by operation of law, merger, change of control, or otherwise, without Atum's prior written consent. Any prohibited assignment is void. Atum may assign this Agreement to an affiliate or in connection with a merger, reorganization, financing, sale of assets, or change of control.
-
-14.3 Severability; Waiver. If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions will remain in effect. A failure or delay in enforcing a provision is not a waiver.
-
-14.4 Amendments. Any amendment applicable to a version of the Software already provided to Licensee must be in writing and accepted by authorized representatives of the parties, except that Atum may issue security, technical, and operational requirements as contemplated by this Agreement.
-
-14.5 Notices. Legal notices to Atum under this Agreement must be sent to legal@atumlabs.xyz. Atum may send notices to the email address associated with Licensee's registry account or otherwise designated by Licensee.
-
-14.6 Reservation of Rights. All rights not expressly granted are reserved by Atum.
-
-Copyright (c) 2026 Atum Labs, Inc. All rights reserved.
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,2 @@
+Atum Protocol
+Copyright 2026 Atum Labs, Inc.

package/README.md

@@ -1,8 +1,9 @@
 # @atumlabs/mppx-atum-escrow
 
-> **Proprietary software - not open source.**
+> Copyright 2026 Atum Labs, Inc.
 >
-> Copyright (c) 2026 Atum Labs, Inc. All rights reserved. Access to and use of `@atumlabs/mppx-atum-escrow` are limited to entities expressly authorized by Atum and are governed by the Atum MPP Escrow SDK Proprietary License Agreement in the LICENSE file included with this package. Do not redistribute, publish, mirror, sublicense, or provide this package to any unauthorized person. By accessing, installing, copying, or using the package, you agree to the license terms.
+> Licensed under the Apache License, Version 2.0. See the `LICENSE` file
+> distributed with this package.
 
 An [`mppx`](https://www.npmjs.com/package/mppx) payment method that lets a merchant accept
 **cross-chain stablecoin payments** through Atum, over the Machine Payments Protocol (MPP).

package/THIRD-PARTY-NOTICES.txt

@@ -2,12 +2,11 @@ THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
 ==============================================================================
 @atumlabs/mppx-atum-escrow
 
-@atumlabs/mppx-atum-escrow is proprietary software, governed by the license
-agreement in the package-root LICENSE file. THIS file is not that license. This
+@atumlabs/mppx-atum-escrow is licensed under the Apache License, Version 2.0, as stated
+in the package-root LICENSE file. THIS file is not that license. This
 package includes the third-party software identified below; the licenses and
 notices reproduced here apply only to those third-party components. They do not
-modify the proprietary license governing this package or any Atum-authored code,
-and they do not make it open source.
+modify the Apache-2.0 license governing this package or any Atum-authored code.
 
 The published artifact of this package (the compiled code under dist/) statically
 bundles the third-party open-source components listed below; their source is
@@ -18,9 +17,9 @@ as (peer)dependencies of this package (for example @solana/web3.js, ethers, bs58
 tweetnacl, zod, and mppx) — those ship under their own licenses and are not
 redistributed here.
 
-LICENSE SUMMARY (27 components)
+LICENSE SUMMARY (28 components)
 ------------------------------------------------------------------------------
-   27  MIT
+   28  MIT
 ==============================================================================
 
 ------------------------------------------------------------------------------
@@ -50,6 +49,13 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
+------------------------------------------------------------------------------
+agent-base  6.0.2   (MIT)
+Author: Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)
+------------------------------------------------------------------------------
+
+[No license file is distributed inside this package. Declared license: MIT; author: Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/).]
+
 ------------------------------------------------------------------------------
 asynckit  0.4.0   (MIT)
 Author: Alex Indigo <iam@alexindigo.com>
@@ -78,7 +84,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 ------------------------------------------------------------------------------
-axios  1.13.2   (MIT)
+axios  1.20.0   (MIT)
 Author: Matt Zabriskie
 ------------------------------------------------------------------------------
 
@@ -563,6 +569,13 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+------------------------------------------------------------------------------
+https-proxy-agent  5.0.1   (MIT)
+Author: Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)
+------------------------------------------------------------------------------
+
+[No license file is distributed inside this package. Declared license: MIT; author: Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/).]
+
 ------------------------------------------------------------------------------
 math-intrinsics  1.1.0   (MIT)
 Author: Jordan Harband <ljharb@gmail.com>
@@ -672,32 +685,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-------------------------------------------------------------------------------
-proxy-from-env  1.1.0   (MIT)
-Author: Rob Wu <rob@robwu.nl> (https://robwu.nl/)
-------------------------------------------------------------------------------
-
-The MIT License
-
-Copyright (C) 2016-2018 Rob Wu <rob@robwu.nl>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
 ------------------------------------------------------------------------------
 supports-color  10.2.2   (MIT)
 Author: Sindre Sorhus <sindresorhus@gmail.com>

package/dist/{chunk-TPLD2L6B.js → chunk-EWIOTGMO.js}

@@ -13,7 +13,7 @@ import {
   require_dist2 as require_dist,
   sameAddress,
   sameAssetIdentifier
-} from "./chunk-OEEC5P3E.js";
+} from "./chunk-LAWFMGYD.js";
 
 // src/server.ts
 var import_payment_request_sender_auth2 = __toESM(require_dist(), 1);
@@ -211,7 +211,7 @@ function registerServer(config) {
       const result = await config.submitter.submit(pr);
       const fc = result.fulfillment_confirmation;
       if (!fc) {
-        const terminal = result.status === "failed" || result.status === "cancelled";
+        const terminal = result.status === "failed";
         if (terminal) {
           throw new SettlementFailedError({ paymentId: result.payment_id, state: result.status });
         }