@atumlabs/mppx-atum-escrow 0.4.0 → 0.4.1

package/dist/{chunk-OEEC5P3E.js → chunk-LAWFMGYD.js}

@@ -11,11 +11,20 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -1929,7 +1938,7 @@ var require_errors2 = __commonJS({
   "../contracts/svm/escrow-encoding/typescript/dist/errors.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.DestinationTooLongError = exports.EmptyDestinationError = exports.ZeroSourceAmountError = exports.ZeroQuoteHashError = exports.InvalidHexError = exports.InvalidBase58Error = exports.InvalidPubkeyLengthError = exports.ZeroDepositHashError = exports.ZeroRecipientError = exports.ZeroReleaserError = exports.ZeroReserverError = exports.ZeroAmountError = exports.ZeroMintError = exports.ZeroDepositorError = exports.ZeroDepositRequestHashError = exports.EncodingError = void 0;
+    exports.InvalidEscrowDomainError = exports.DestinationTooLongError = exports.EmptyDestinationError = exports.ZeroSourceAmountError = exports.ZeroQuoteHashError = exports.InvalidHexError = exports.InvalidBase58Error = exports.InvalidPubkeyLengthError = exports.ZeroDepositHashError = exports.ZeroRecipientError = exports.ZeroReleaserError = exports.ZeroReserverError = exports.ZeroAmountError = exports.ZeroMintError = exports.ZeroDepositorError = exports.ZeroDepositRequestHashError = exports.EncodingError = void 0;
     var EncodingError = class extends Error {
       constructor(message) {
         super(message);
@@ -2042,6 +2051,13 @@ var require_errors2 = __commonJS({
       }
     };
     exports.DestinationTooLongError = DestinationTooLongError;
+    var InvalidEscrowDomainError = class extends EncodingError {
+      constructor(message) {
+        super(message);
+        this.name = "InvalidEscrowDomainError";
+      }
+    };
+    exports.InvalidEscrowDomainError = InvalidEscrowDomainError;
   }
 });
 
@@ -2750,12 +2766,17 @@ var require_escrow_domain = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.escrowDomainPrefixBytes = escrowDomainPrefixBytes;
+    exports.newEscrowDomain = newEscrowDomain;
+    var errors_1 = require_errors2();
     function escrowDomainPrefixBytes(domain) {
       if (domain.clusterId.length !== 32) {
-        throw new Error(`EscrowDomain.clusterId must be 32 bytes, got ${domain.clusterId.length}`);
+        throw new errors_1.InvalidEscrowDomainError(`EscrowDomain.clusterId must be 32 bytes, got ${domain.clusterId.length}`);
+      }
+      if (domain.programId.isZero()) {
+        throw new errors_1.InvalidEscrowDomainError("EscrowDomain.programId cannot be zero");
       }
       if (!Number.isInteger(domain.signatureDomainVersion) || domain.signatureDomainVersion < 1 || domain.signatureDomainVersion > 255) {
-        throw new Error(`EscrowDomain.signatureDomainVersion must be an integer in 1..=255, got ${domain.signatureDomainVersion}`);
+        throw new errors_1.InvalidEscrowDomainError(`EscrowDomain.signatureDomainVersion must be an integer in 1..=255, got ${domain.signatureDomainVersion}`);
       }
       return [
         new TextEncoder().encode("escrow"),
@@ -2764,6 +2785,25 @@ var require_escrow_domain = __commonJS({
         domain.programId.toBytes()
       ];
     }
+    function newEscrowDomain(clusterName, signatureDomainVersion, programId) {
+      const trimmed = clusterName.trim();
+      if (trimmed.length === 0) {
+        throw new errors_1.InvalidEscrowDomainError("EscrowDomain cluster name cannot be empty");
+      }
+      const encoded = new TextEncoder().encode(trimmed);
+      if (encoded.length > 32) {
+        throw new errors_1.InvalidEscrowDomainError(`EscrowDomain cluster name "${trimmed}" exceeds 32 bytes`);
+      }
+      if (!Number.isInteger(signatureDomainVersion) || signatureDomainVersion < 1 || signatureDomainVersion > 255) {
+        throw new errors_1.InvalidEscrowDomainError(`EscrowDomain.signatureDomainVersion must be an integer in 1..=255, got ${signatureDomainVersion}`);
+      }
+      if (programId.isZero()) {
+        throw new errors_1.InvalidEscrowDomainError("EscrowDomain.programId cannot be zero");
+      }
+      const clusterId = new Uint8Array(32);
+      clusterId.set(encoded);
+      return { clusterId, signatureDomainVersion, programId };
+    }
   }
 });
 
@@ -2962,7 +3002,7 @@ var require_dist3 = __commonJS({
   "../contracts/svm/escrow-encoding/typescript/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.DEPOSIT_COMPUTE_UNIT_LIMIT = exports.REPLAY_BUCKETS = exports.MAX_VALID_SLOT = exports.REPLAY_SLOTS = exports.generateNonce = exports.computeRefundHashV2 = exports.computeRefundHash = exports.computeReleaseHashV2 = exports.computeReleaseHash = exports.computeReserveHashV3 = exports.computeReserveHashV2 = exports.computeReserveHash = exports.MAX_DESTINATION_LEN = exports.computeDestinationHash = exports.computeDepositHashV2 = exports.computeDepositHash = exports.InvalidHexError = exports.InvalidBase58Error = exports.InvalidPubkeyLengthError = exports.ZeroDepositHashError = exports.ZeroRecipientError = exports.ZeroReleaserError = exports.ZeroReserverError = exports.ZeroAmountError = exports.ZeroMintError = exports.ZeroDepositorError = exports.DestinationTooLongError = exports.EmptyDestinationError = exports.ZeroQuoteHashError = exports.ZeroDepositRequestHashError = exports.EncodingError = exports.escrowDomainPrefixBytes = exports.isZeroBytes32 = exports.stringToBytes = exports.keccak256 = exports.encodeU64LE = exports.Pubkey = void 0;
+    exports.DEPOSIT_COMPUTE_UNIT_LIMIT = exports.REPLAY_BUCKETS = exports.MAX_VALID_SLOT = exports.REPLAY_SLOTS = exports.generateNonce = exports.computeRefundHashV2 = exports.computeRefundHash = exports.computeReleaseHashV2 = exports.computeReleaseHash = exports.computeReserveHashV3 = exports.computeReserveHashV2 = exports.computeReserveHash = exports.MAX_DESTINATION_LEN = exports.computeDestinationHash = exports.computeDepositHashV2 = exports.computeDepositHash = exports.InvalidHexError = exports.InvalidBase58Error = exports.InvalidPubkeyLengthError = exports.InvalidEscrowDomainError = exports.ZeroSourceAmountError = exports.ZeroDepositHashError = exports.ZeroRecipientError = exports.ZeroReleaserError = exports.ZeroReserverError = exports.ZeroAmountError = exports.ZeroMintError = exports.ZeroDepositorError = exports.DestinationTooLongError = exports.EmptyDestinationError = exports.ZeroQuoteHashError = exports.ZeroDepositRequestHashError = exports.EncodingError = exports.newEscrowDomain = exports.escrowDomainPrefixBytes = exports.isZeroBytes32 = exports.stringToBytes = exports.keccak256 = exports.encodeU64LE = exports.Pubkey = void 0;
     var pubkey_1 = require_pubkey();
     Object.defineProperty(exports, "Pubkey", { enumerable: true, get: function() {
       return pubkey_1.Pubkey;
@@ -2984,6 +3024,9 @@ var require_dist3 = __commonJS({
     Object.defineProperty(exports, "escrowDomainPrefixBytes", { enumerable: true, get: function() {
       return escrow_domain_1.escrowDomainPrefixBytes;
     } });
+    Object.defineProperty(exports, "newEscrowDomain", { enumerable: true, get: function() {
+      return escrow_domain_1.newEscrowDomain;
+    } });
     var errors_1 = require_errors2();
     Object.defineProperty(exports, "EncodingError", { enumerable: true, get: function() {
       return errors_1.EncodingError;
@@ -3021,6 +3064,12 @@ var require_dist3 = __commonJS({
     Object.defineProperty(exports, "ZeroDepositHashError", { enumerable: true, get: function() {
       return errors_1.ZeroDepositHashError;
     } });
+    Object.defineProperty(exports, "ZeroSourceAmountError", { enumerable: true, get: function() {
+      return errors_1.ZeroSourceAmountError;
+    } });
+    Object.defineProperty(exports, "InvalidEscrowDomainError", { enumerable: true, get: function() {
+      return errors_1.InvalidEscrowDomainError;
+    } });
     Object.defineProperty(exports, "InvalidPubkeyLengthError", { enumerable: true, get: function() {
       return errors_1.InvalidPubkeyLengthError;
     } });

package/dist/client.d.ts

@@ -1,10 +1,11 @@
 import * as zod_v4_core from 'zod/v4/core';
 import * as z from 'zod/mini';
-import { S as SenderSigner, h as SenderSignerOptions, k as SolanaClusterUnixTimeReader } from './internal-CJEu9yUF.js';
-export { A as AtumEscrowChallenge, a as AtumEscrowCredential, C as ChargeCredentialPayload, d as ChargeRequest, e as ChargeRequestSchema, f as CredentialPayloadSchema, I as INTENT, g as INTENT_ID_META_KEY, M as METHOD_NAME, i as atumEscrowChargeMethod } from './internal-CJEu9yUF.js';
+import { S as SenderSigner, h as SenderSignerOptions, k as SolanaClusterUnixTimeReader } from './internal-BZBJJfaL.js';
+export { A as AtumEscrowChallenge, a as AtumEscrowCredential, C as ChargeCredentialPayload, d as ChargeRequest, e as ChargeRequestSchema, f as CredentialPayloadSchema, I as INTENT, g as INTENT_ID_META_KEY, M as METHOD_NAME, i as atumEscrowChargeMethod } from './internal-BZBJJfaL.js';
 import { Method } from 'mppx';
 import { Signer } from 'ethers';
 export { PaymentRequest } from './generated/index.js';
+import './sender-auth-verify-C-Q-zvAO.js';
 
 /**
  * Result of an {@link ensureSourceApproval} call.

package/dist/client.js

@@ -1,14 +1,12 @@
 /*
- * Copyright (c) 2026 Atum Labs, Inc. All rights reserved.
- * Proprietary and confidential.
- * Access and use are governed by the LICENSE file distributed with this package.
- * Do not remove, alter, or obscure this notice.
+ * Copyright 2026 Atum Labs, Inc.
+ * SPDX-License-Identifier: Apache-2.0
  */
 import { createRequire as __atumCreateRequire } from 'module'; const require = __atumCreateRequire(import.meta.url);
 import {
   import_payment_request_token_approval,
   registerClient
-} from "./chunk-KRSFEITH.js";
+} from "./chunk-IGTT7XSG.js";
 import {
   ChargeRequestSchema,
   CredentialPayloadSchema,
@@ -16,7 +14,7 @@ import {
   INTENT_ID_META_KEY,
   METHOD_NAME,
   atumEscrowChargeMethod
-} from "./chunk-OEEC5P3E.js";
+} from "./chunk-LAWFMGYD.js";
 var export_ensureSourceApproval = import_payment_request_token_approval.ensureSourceApproval;
 var export_isUnconfirmed = import_payment_request_token_approval.isUnconfirmed;
 var export_needsSourceApproval = import_payment_request_token_approval.needsSourceApproval;

package/dist/index.d.ts

@@ -1,7 +1,8 @@
-export { A as AtumEscrowChallenge, a as AtumEscrowCredential, b as AtumEscrowExtra, c as AtumEscrowRequest, C as ChargeCredentialPayload, d as ChargeRequest, e as ChargeRequestSchema, f as CredentialPayloadSchema, I as INTENT, g as INTENT_ID_META_KEY, M as METHOD_NAME, S as SenderSigner, h as SenderSignerOptions, i as atumEscrowChargeMethod } from './internal-CJEu9yUF.js';
+export { A as AtumEscrowChallenge, a as AtumEscrowCredential, b as AtumEscrowExtra, c as AtumEscrowRequest, C as ChargeCredentialPayload, d as ChargeRequest, e as ChargeRequestSchema, f as CredentialPayloadSchema, I as INTENT, g as INTENT_ID_META_KEY, M as METHOD_NAME, S as SenderSigner, h as SenderSignerOptions, i as atumEscrowChargeMethod } from './internal-BZBJJfaL.js';
 export { ApprovalParams, AtumEscrowClientConfig, ConfirmationOptions, EnsureApprovalResult, TronWebLike, ensureSourceApproval, isUnconfirmed, needsSourceApproval, registerClient } from './client.js';
 export { AtumEscrowCorridor, AtumEscrowReceipt, AtumEscrowServer, AtumEscrowServerConfig, AtumEscrowSource, ChainDefaultsSource, ChargeChallenge, FulfillmentConfirmation, PaymentRejectedError, PaymentSettlementStatus, PaymentSubmitResult, PaymentSubmitter, SettlementErrorDetails, SettlementFailedError, SettlementPendingError, buildChargeChallenge, buildChargeRequest, corridorFromDefaults, isPaymentRejected, isSettlementFailed, isSettlementPending, registerServer, validateCorridor } from './server.js';
 export { PaymentRequest } from './generated/index.js';
+import './sender-auth-verify-C-Q-zvAO.js';
 import 'zod/mini';
 import 'mppx';
 import 'zod/v4/core';

package/dist/index.js

@@ -1,14 +1,12 @@
 /*
- * Copyright (c) 2026 Atum Labs, Inc. All rights reserved.
- * Proprietary and confidential.
- * Access and use are governed by the LICENSE file distributed with this package.
- * Do not remove, alter, or obscure this notice.
+ * Copyright 2026 Atum Labs, Inc.
+ * SPDX-License-Identifier: Apache-2.0
  */
 import { createRequire as __atumCreateRequire } from 'module'; const require = __atumCreateRequire(import.meta.url);
 import {
   import_payment_request_token_approval,
   registerClient
-} from "./chunk-KRSFEITH.js";
+} from "./chunk-IGTT7XSG.js";
 import {
   PaymentRejectedError,
   SettlementFailedError,
@@ -21,7 +19,7 @@ import {
   isSettlementPending,
   registerServer,
   validateCorridor
-} from "./chunk-TPLD2L6B.js";
+} from "./chunk-EWIOTGMO.js";
 import {
   ChargeRequestSchema,
   CredentialPayloadSchema,
@@ -29,7 +27,7 @@ import {
   INTENT_ID_META_KEY,
   METHOD_NAME,
   atumEscrowChargeMethod
-} from "./chunk-OEEC5P3E.js";
+} from "./chunk-LAWFMGYD.js";
 var export_ensureSourceApproval = import_payment_request_token_approval.ensureSourceApproval;
 var export_isUnconfirmed = import_payment_request_token_approval.isUnconfirmed;
 var export_needsSourceApproval = import_payment_request_token_approval.needsSourceApproval;

package/dist/{internal-CJEu9yUF.d.ts → internal-BZBJJfaL.d.ts}

@@ -1,34 +1,8 @@
+import { t } from './sender-auth-verify-C-Q-zvAO.js';
 import * as z from 'zod/mini';
 import { PaymentRequest } from './generated/index.js';
 import { Challenge, Credential } from 'mppx';
 
-/**
- * A message that has been cryptographically signed to prove authorization. The signature proves you control the wallet that's sending funds.
- */
-type SignedMessage = {
-    /**
-     * The data that was signed. Format depends on the blockchain:
-     * - EVM: Hex-encoded message hash (with 0x prefix)
-     * - Solana: Hex-encoded message hash (with 0x prefix)
-     * - Tron: Hex-encoded message hash (possibly without 0x prefix)
-     */
-    message: string;
-    /**
-     * Optional: If 'message' contains a hash, this field contains the original data before it was hashed. Useful for verification and debugging.
-     */
-    message_prehash?: string;
-    /**
-     * The cryptographic signature proving you authorized this message. Hex-encoded with a 0x prefix on every supported chain. The signer's own public key is base58 on Solana, but the signature itself is not.
-     */
-    signature: string;
-    /**
-     * Optional chain-specific payload containing additional signing context (e.g., delegate_signer for Solana). Preserved through the pipeline for downstream consumers.
-     */
-    payload?: {
-        [key: string]: unknown;
-    };
-};
-
 /**
  * Chain defaults returned by the payment gateway /v1/defaults endpoint.
  */
@@ -41,10 +15,10 @@ interface ChainDefaults {
     permit2Contract?: string;
     /**
      * Which deposit witness the escrow deployed on this chain pins, surfaced by payment-gw
-     * `/v1/defaults` as `deposit_witness_version` (CORE-2033). EVM/Tron only — Solana carries the
+     * `/v1/defaults` as `deposit_witness_version`. EVM/Tron only — Solana carries the
      * same fact in `svmSignatureDomainVersion` below.
      *
-     * `4` and above select the CORE-2120 four-member witness
+     * `4` and above select the four-member witness
      * (`depositRequestHash`, `destination`, `reserver`, `releaser`); `3` selects the two-member
      * witness a not-yet-redeployed escrow pins. ABSENT means four — see the sender-auth package's
      * `ChainDefaults.depositWitnessVersion` for why absence is the permissive default.
@@ -116,7 +90,7 @@ interface SenderSignature {
 }
 /** Signs a single sender_auth signed message for a payment request. */
 interface SenderSigner {
-    sign(signedMessage: SignedMessage): Promise<SenderSignature>;
+    sign(signedMessage: t): Promise<SenderSignature>;
 }
 /** Turnkey provider configuration (shared by the SDK and the CLI env loader). */
 interface TurnkeyConfig {

package/dist/server.d.ts

@@ -1,8 +1,9 @@
-import { i as atumEscrowChargeMethod, j as ChainDefaults, d as ChargeRequest } from './internal-CJEu9yUF.js';
-export { A as AtumEscrowChallenge, a as AtumEscrowCredential, C as ChargeCredentialPayload, e as ChargeRequestSchema, f as CredentialPayloadSchema, I as INTENT, g as INTENT_ID_META_KEY, M as METHOD_NAME } from './internal-CJEu9yUF.js';
+import { i as atumEscrowChargeMethod, j as ChainDefaults, d as ChargeRequest } from './internal-BZBJJfaL.js';
+export { A as AtumEscrowChallenge, a as AtumEscrowCredential, C as ChargeCredentialPayload, e as ChargeRequestSchema, f as CredentialPayloadSchema, I as INTENT, g as INTENT_ID_META_KEY, M as METHOD_NAME } from './internal-BZBJJfaL.js';
 import { Errors, Receipt, Method } from 'mppx';
 import { PaymentRequest } from './generated/index.js';
 export { PaymentRequest } from './generated/index.js';
+import './sender-auth-verify-C-Q-zvAO.js';
 import 'zod/mini';
 
 /**
@@ -239,8 +240,15 @@ interface AtumEscrowCorridor {
     /** Accepted source options; selected per charge by `(network, asset)`. */
     sources: AtumEscrowSource[];
 }
-/** Lifecycle state the gateway reports for a payment. */
-type PaymentSettlementStatus = 'pending' | 'completed' | 'failed' | 'cancelled';
+/**
+ * Lifecycle state the gateway reports for a payment.
+ *
+ * `finalizing` means the payment is on chain but has not yet reached the confirmation depth its
+ * chain requires. It is NOT terminal: a payer must keep waiting on the same idempotency key, never
+ * start a second payment for it.
+ *
+ */
+type PaymentSettlementStatus = 'pending' | 'finalizing' | 'completed' | 'failed';
 /** What a {@link PaymentSubmitter} resolves with. */
 interface PaymentSubmitResult {
     /** The gateway's payment id. Present whenever the payment was accepted. */

package/dist/server.js

@@ -1,8 +1,6 @@
 /*
- * Copyright (c) 2026 Atum Labs, Inc. All rights reserved.
- * Proprietary and confidential.
- * Access and use are governed by the LICENSE file distributed with this package.
- * Do not remove, alter, or obscure this notice.
+ * Copyright 2026 Atum Labs, Inc.
+ * SPDX-License-Identifier: Apache-2.0
  */
 import { createRequire as __atumCreateRequire } from 'module'; const require = __atumCreateRequire(import.meta.url);
 import {
@@ -17,7 +15,7 @@ import {
   isSettlementPending,
   registerServer,
   validateCorridor
-} from "./chunk-TPLD2L6B.js";
+} from "./chunk-EWIOTGMO.js";
 import {
   ChargeRequestSchema,
   CredentialPayloadSchema,
@@ -25,7 +23,7 @@ import {
   INTENT_ID_META_KEY,
   METHOD_NAME,
   atumEscrowChargeMethod
-} from "./chunk-OEEC5P3E.js";
+} from "./chunk-LAWFMGYD.js";
 export {
   ChargeRequestSchema,
   CredentialPayloadSchema,

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@atumlabs/mppx-atum-escrow",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Atum cross-chain escrow payment method for the Machine Payments Protocol (MPP).",
   "author": "Atum Labs, Inc.",
-  "license": "SEE LICENSE IN LICENSE",
+  "license": "Apache-2.0",
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "homepage": "https://github.com/Atum-Labs/protocol/tree/main/mppx-atum-escrow#readme",
   "repository": {
@@ -51,6 +51,7 @@
     "README.md",
     "CHANGELOG.md",
     "LICENSE",
+    "NOTICE",
     "THIRD-PARTY-NOTICES.txt"
   ],
   "scripts": {
@@ -92,7 +93,7 @@
     "mppx": "^0.8.12",
     "tsup": "^8.5.1",
     "typescript": "^5.6.3",
-    "vitest": "^2.1.9",
+    "vitest": "^4.1.11",
     "zod": "^4.4.3"
   }
 }