@atumlabs/payment-gateway-client 1.0.1 → 2.0.0

package/CHANGELOG.md

@@ -0,0 +1,40 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [2.0.0] - 2026-07-27
+
+### Breaking
+- `request_id` is now required on `preparePaymentRequest` (the client no longer silently auto-generates one, which could turn a retry into a second payment). Callers must supply a stable `request_id` and reuse it on retry. The `send-payment` CLI generates a one-shot id when `--request-id` is omitted.
+- An explicit `deadlineSeconds` that is shorter than the settlement window (`fulfillmentDeadlineSeconds`) is now rejected — the deposit permit must stay valid until settlement.
+- Solana now honors an explicit `nonce` (it was ignored on Solana in 1.0.2) and validates it at build time: a caller-supplied nonce must fit an unsigned 64-bit integer and its low byte (the on-chain replay slot) must be `< 235`, otherwise the build throws instead of failing later on-chain. Omitting `nonce` still derives it deterministically as before.
+
+### Changed
+- Deposits are now built and signed through the shared `@atum-labs/payment-request-sender-auth` library instead of the client's own copy of that logic (single source of truth across the payment stack). The public signing API (`createSenderSigner`, `signPaymentRequest`, `resolveTurnkeyAddresses`) is unchanged.
+- The EVM/Tron deposit permit deadline now tracks the payment's settlement (`fulfillment_deadline`) instead of a fixed far-future date, so the authorization's validity window is meaningful.
+
+### Added
+- The deposit's single-use nonce is now derived deterministically from `request_id` + depositor, so rebuilding the same payment (e.g. on retry) reproduces the same single-use nonce. The guarantee differs by chain: on EVM/Tron the Permit2 nonce is a permanent on-chain bitmap, so of any number of rebuilds only one deposit can ever settle; on Solana the escrow replay nonce protects only within a ~128s window (`issued_at` is re-read per build), and the gateway's `request_id` dedup is the durable backstop beyond it — pin `issued_at` via `solanaClockReader` to keep a rebuild inside the same window.
+- The depositor address is canonicalized before it seeds the nonce: EVM `0x` addresses are lower-cased (so a checksummed and a lowercase address derive the same nonce), while case-sensitive base58 (Solana/Tron) is used verbatim.
+
+## [1.0.2] - 2026-07-17
+
+### Added
+- Turnkey signing provider: sign payments with a Turnkey-managed wallet using `--provider turnkey` (CLI and SDK), as an alternative to a local private key. The sender address is resolved from and verified against the Turnkey wallet per source chain.
+
+### Changed
+- README now targets npm consumers; the monorepo source setup moved to `CONTRIBUTING.md`.
+
+## [1.0.1] - 2024-12-04
+
+### Added
+- Help documentation now includes instructions on how to check payment status
+
+### Changed
+- Default payment gateway now points to prod-testnet instead of staging-testnet
+
+### Fixed
+- CLI now properly respects the `/defaults` fulfillment verifier endpoint

package/README.md

@@ -8,47 +8,15 @@ TypeScript client for Atum Payment Gateway API with CLI support.
 
 ## Installation
 
-The package can be published to npm or to GitHub Packages (same artifact). Install
-from whichever registry it was published to.
-
-### From npm (public)
+`@atumlabs/payment-gateway-client` is a private npm package. Once your npm account
+has been granted access, install it with npm:
 
 ```bash
-npm install @atum-labs/payment-gateway-client
+npm install @atumlabs/payment-gateway-client
 ```
 
-### From GitHub Packages (private)
-
-Point the `@atum-labs` scope at GitHub's npm registry and authenticate with a
-classic personal access token that has the `read:packages` scope. Add an `.npmrc`
-in your project (or `~/.npmrc`):
-
-```
-@atum-labs:registry=https://npm.pkg.github.com
-//npm.pkg.github.com/:_authToken=YOUR_GITHUB_TOKEN
-```
-
-Then `npm install @atum-labs/payment-gateway-client`. Your GitHub account must
-have been granted read access to the package.
-
-Either way this also installs the `send-payment`, `request-quote`,
-`quote-status`, and `payment-status` CLI commands.
-
-### From source (monorepo)
-
-payment-gateway-client lives inside the protocol monorepo. To work on it from source:
-
-```bash
-git clone https://github.com/Atum-Labs/protocol.git
-cd protocol
-
-# Install the workspace with pnpm. This builds payment-gateway-client and its
-# in-repo deps (km-core, turnkey-signer, solana-escrow-encoding) via the workspace:
-pnpm install
-
-# (Optional) expose the CLI globally:
-cd payment-gateway-client && pnpm link --global
-```
+This also installs the `send-payment`, `request-quote`, `quote-status`, and
+`payment-status` CLI commands.
 
 ## CLI Usage
 
@@ -142,7 +110,7 @@ PRIVATE_KEY=0xabc... send-payment \
 To remove the global CLI command:
 
 ```bash
-npm unlink -g @atum-labs/payment-gateway-client
+npm unlink -g @atumlabs/payment-gateway-client
 ```
 
 ## SDK Usage
@@ -154,7 +122,7 @@ import {
   PaymentGatewayClient,
   type PaymentResponse,
   ApiError
-} from '@atum-labs/payment-gateway-client';
+} from '@atumlabs/payment-gateway-client';
 import { ethers } from 'ethers';
 
 const client = new PaymentGatewayClient({