@atumlabs/payment-gateway-client 3.0.0 → 3.0.1

package/dist/cli/send-payment.js

@@ -1,9 +1,7 @@
 #!/usr/bin/env node
 /*
- * Copyright (c) 2026 Atum Labs, Inc. All rights reserved.
- * Proprietary and confidential.
- * Access and use are governed by the LICENSE file distributed with this package.
- * Do not remove, alter, or obscure this notice.
+ * Copyright 2026 Atum Labs, Inc.
+ * SPDX-License-Identifier: Apache-2.0
  */
 "use strict";
 var __create = Object.create;
@@ -12,11 +10,20 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -2105,7 +2112,7 @@ var require_errors2 = __commonJS({
   "../contracts/svm/escrow-encoding/typescript/dist/errors.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.DestinationTooLongError = exports2.EmptyDestinationError = exports2.ZeroSourceAmountError = exports2.ZeroQuoteHashError = exports2.InvalidHexError = exports2.InvalidBase58Error = exports2.InvalidPubkeyLengthError = exports2.ZeroDepositHashError = exports2.ZeroRecipientError = exports2.ZeroReleaserError = exports2.ZeroReserverError = exports2.ZeroAmountError = exports2.ZeroMintError = exports2.ZeroDepositorError = exports2.ZeroDepositRequestHashError = exports2.EncodingError = void 0;
+    exports2.InvalidEscrowDomainError = exports2.DestinationTooLongError = exports2.EmptyDestinationError = exports2.ZeroSourceAmountError = exports2.ZeroQuoteHashError = exports2.InvalidHexError = exports2.InvalidBase58Error = exports2.InvalidPubkeyLengthError = exports2.ZeroDepositHashError = exports2.ZeroRecipientError = exports2.ZeroReleaserError = exports2.ZeroReserverError = exports2.ZeroAmountError = exports2.ZeroMintError = exports2.ZeroDepositorError = exports2.ZeroDepositRequestHashError = exports2.EncodingError = void 0;
     var EncodingError = class extends Error {
       constructor(message) {
         super(message);
@@ -2218,6 +2225,13 @@ var require_errors2 = __commonJS({
       }
     };
     exports2.DestinationTooLongError = DestinationTooLongError;
+    var InvalidEscrowDomainError = class extends EncodingError {
+      constructor(message) {
+        super(message);
+        this.name = "InvalidEscrowDomainError";
+      }
+    };
+    exports2.InvalidEscrowDomainError = InvalidEscrowDomainError;
   }
 });
 
@@ -2926,12 +2940,17 @@ var require_escrow_domain = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.escrowDomainPrefixBytes = escrowDomainPrefixBytes;
+    exports2.newEscrowDomain = newEscrowDomain;
+    var errors_1 = require_errors2();
     function escrowDomainPrefixBytes(domain) {
       if (domain.clusterId.length !== 32) {
-        throw new Error(`EscrowDomain.clusterId must be 32 bytes, got ${domain.clusterId.length}`);
+        throw new errors_1.InvalidEscrowDomainError(`EscrowDomain.clusterId must be 32 bytes, got ${domain.clusterId.length}`);
+      }
+      if (domain.programId.isZero()) {
+        throw new errors_1.InvalidEscrowDomainError("EscrowDomain.programId cannot be zero");
       }
       if (!Number.isInteger(domain.signatureDomainVersion) || domain.signatureDomainVersion < 1 || domain.signatureDomainVersion > 255) {
-        throw new Error(`EscrowDomain.signatureDomainVersion must be an integer in 1..=255, got ${domain.signatureDomainVersion}`);
+        throw new errors_1.InvalidEscrowDomainError(`EscrowDomain.signatureDomainVersion must be an integer in 1..=255, got ${domain.signatureDomainVersion}`);
       }
       return [
         new TextEncoder().encode("escrow"),
@@ -2940,6 +2959,25 @@ var require_escrow_domain = __commonJS({
         domain.programId.toBytes()
       ];
     }
+    function newEscrowDomain(clusterName, signatureDomainVersion, programId) {
+      const trimmed = clusterName.trim();
+      if (trimmed.length === 0) {
+        throw new errors_1.InvalidEscrowDomainError("EscrowDomain cluster name cannot be empty");
+      }
+      const encoded = new TextEncoder().encode(trimmed);
+      if (encoded.length > 32) {
+        throw new errors_1.InvalidEscrowDomainError(`EscrowDomain cluster name "${trimmed}" exceeds 32 bytes`);
+      }
+      if (!Number.isInteger(signatureDomainVersion) || signatureDomainVersion < 1 || signatureDomainVersion > 255) {
+        throw new errors_1.InvalidEscrowDomainError(`EscrowDomain.signatureDomainVersion must be an integer in 1..=255, got ${signatureDomainVersion}`);
+      }
+      if (programId.isZero()) {
+        throw new errors_1.InvalidEscrowDomainError("EscrowDomain.programId cannot be zero");
+      }
+      const clusterId = new Uint8Array(32);
+      clusterId.set(encoded);
+      return { clusterId, signatureDomainVersion, programId };
+    }
   }
 });
 
@@ -3138,7 +3176,7 @@ var require_dist4 = __commonJS({
   "../contracts/svm/escrow-encoding/typescript/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.DEPOSIT_COMPUTE_UNIT_LIMIT = exports2.REPLAY_BUCKETS = exports2.MAX_VALID_SLOT = exports2.REPLAY_SLOTS = exports2.generateNonce = exports2.computeRefundHashV2 = exports2.computeRefundHash = exports2.computeReleaseHashV2 = exports2.computeReleaseHash = exports2.computeReserveHashV3 = exports2.computeReserveHashV2 = exports2.computeReserveHash = exports2.MAX_DESTINATION_LEN = exports2.computeDestinationHash = exports2.computeDepositHashV2 = exports2.computeDepositHash = exports2.InvalidHexError = exports2.InvalidBase58Error = exports2.InvalidPubkeyLengthError = exports2.ZeroDepositHashError = exports2.ZeroRecipientError = exports2.ZeroReleaserError = exports2.ZeroReserverError = exports2.ZeroAmountError = exports2.ZeroMintError = exports2.ZeroDepositorError = exports2.DestinationTooLongError = exports2.EmptyDestinationError = exports2.ZeroQuoteHashError = exports2.ZeroDepositRequestHashError = exports2.EncodingError = exports2.escrowDomainPrefixBytes = exports2.isZeroBytes32 = exports2.stringToBytes = exports2.keccak256 = exports2.encodeU64LE = exports2.Pubkey = void 0;
+    exports2.DEPOSIT_COMPUTE_UNIT_LIMIT = exports2.REPLAY_BUCKETS = exports2.MAX_VALID_SLOT = exports2.REPLAY_SLOTS = exports2.generateNonce = exports2.computeRefundHashV2 = exports2.computeRefundHash = exports2.computeReleaseHashV2 = exports2.computeReleaseHash = exports2.computeReserveHashV3 = exports2.computeReserveHashV2 = exports2.computeReserveHash = exports2.MAX_DESTINATION_LEN = exports2.computeDestinationHash = exports2.computeDepositHashV2 = exports2.computeDepositHash = exports2.InvalidHexError = exports2.InvalidBase58Error = exports2.InvalidPubkeyLengthError = exports2.InvalidEscrowDomainError = exports2.ZeroSourceAmountError = exports2.ZeroDepositHashError = exports2.ZeroRecipientError = exports2.ZeroReleaserError = exports2.ZeroReserverError = exports2.ZeroAmountError = exports2.ZeroMintError = exports2.ZeroDepositorError = exports2.DestinationTooLongError = exports2.EmptyDestinationError = exports2.ZeroQuoteHashError = exports2.ZeroDepositRequestHashError = exports2.EncodingError = exports2.newEscrowDomain = exports2.escrowDomainPrefixBytes = exports2.isZeroBytes32 = exports2.stringToBytes = exports2.keccak256 = exports2.encodeU64LE = exports2.Pubkey = void 0;
     var pubkey_1 = require_pubkey();
     Object.defineProperty(exports2, "Pubkey", { enumerable: true, get: function() {
       return pubkey_1.Pubkey;
@@ -3160,6 +3198,9 @@ var require_dist4 = __commonJS({
     Object.defineProperty(exports2, "escrowDomainPrefixBytes", { enumerable: true, get: function() {
       return escrow_domain_1.escrowDomainPrefixBytes;
     } });
+    Object.defineProperty(exports2, "newEscrowDomain", { enumerable: true, get: function() {
+      return escrow_domain_1.newEscrowDomain;
+    } });
     var errors_1 = require_errors2();
     Object.defineProperty(exports2, "EncodingError", { enumerable: true, get: function() {
       return errors_1.EncodingError;
@@ -3197,6 +3238,12 @@ var require_dist4 = __commonJS({
     Object.defineProperty(exports2, "ZeroDepositHashError", { enumerable: true, get: function() {
       return errors_1.ZeroDepositHashError;
     } });
+    Object.defineProperty(exports2, "ZeroSourceAmountError", { enumerable: true, get: function() {
+      return errors_1.ZeroSourceAmountError;
+    } });
+    Object.defineProperty(exports2, "InvalidEscrowDomainError", { enumerable: true, get: function() {
+      return errors_1.InvalidEscrowDomainError;
+    } });
     Object.defineProperty(exports2, "InvalidPubkeyLengthError", { enumerable: true, get: function() {
       return errors_1.InvalidPubkeyLengthError;
     } });
@@ -5477,6 +5524,7 @@ var require_policies = __commonJS({
     exports2.buildDenyApproveToNonAllowedSpenderTron = buildDenyApproveToNonAllowedSpenderTron;
     exports2.listPolicies = listPolicies;
     exports2.deletePolicy = deletePolicy;
+    exports2.planPolicyChanges = planPolicyChanges;
     exports2.applyPolicies = applyPolicies;
     function derivePoliciesFromAllowlist(policy, chain, context) {
       const policies = [];
@@ -5664,26 +5712,54 @@ var require_policies = __commonJS({
         policyId
       });
     }
+    function planPolicyChanges(existing, policies) {
+      const existingByName = new Map(existing.map((p) => [p.policyName, p]));
+      const drifted = [];
+      for (const p of policies) {
+        const prev = existingByName.get(p.policyName);
+        if (!prev)
+          continue;
+        const matches = prev.effect === p.effect && prev.condition === p.condition && (prev.consensus ?? "") === (p.consensus ?? "");
+        if (!matches)
+          drifted.push({ name: p.policyName, diff: formatPolicyDiff(prev, p) });
+      }
+      const emittedNames = new Set(policies.map((p) => p.policyName));
+      const stale = existing.filter((p) => !emittedNames.has(p.policyName));
+      const seen = /* @__PURE__ */ new Set();
+      const duplicateNames = [
+        ...new Set(existing.filter((p) => !(seen.size === seen.add(p.policyName).size)).map((p) => p.policyName))
+      ];
+      return { drifted, stale, duplicateNames };
+    }
     async function applyPolicies(client, policies, options) {
       const existing = await listPolicies(client, options.organizationId);
       const existingByName = new Map(existing.map((p) => [p.policyName, p]));
       const created = [];
       const skippedUnchanged = [];
-      const drifted = [];
       const replaced = [];
+      const pruned = [];
+      const { drifted, stale } = planPolicyChanges(existing, policies);
+      if (stale.length > 0 && !options.prune) {
+        const detail = stale.map((p) => `  - ${p.policyName} [${p.effect}] (${p.policyId})`).join("\n");
+        throw new Error(`${stale.length} live polic${stale.length === 1 ? "y is" : "ies are"} absent from the emitted set:
+${detail}
+
+A retired ALLOW left live keeps granting what it always granted, so a narrower replacement does not take effect until it is gone. Re-run with --prune to delete them, or reconcile the config if they are policies this set should still emit.`);
+      }
+      if (drifted.length > 0 && !options.update) {
+        const detail = drifted.map((d) => `  - ${d.name}:
+${indent(d.diff, "      ")}`).join("\n");
+        throw new Error(`Content drift detected on ${drifted.length} polic${drifted.length === 1 ? "y" : "ies"}. Re-run with --update to delete-and-recreate, or fix the existing policy in the Turnkey console.
+${detail}`);
+      }
+      const driftedNames = new Set(drifted.map((d) => d.name));
       for (const p of policies) {
         const prev = existingByName.get(p.policyName);
         if (prev) {
-          const matches = prev.effect === p.effect && prev.condition === p.condition && (prev.consensus ?? "") === (p.consensus ?? "");
-          if (matches) {
+          if (!driftedNames.has(p.policyName)) {
             skippedUnchanged.push(p.policyName);
             continue;
           }
-          const diff = formatPolicyDiff(prev, p);
-          if (!options.update) {
-            drifted.push({ name: p.policyName, diff });
-            continue;
-          }
           await deletePolicy(client, prev.policyId);
           const newId = await createPolicyRaw(client, p);
           replaced.push({ name: p.policyName, oldPolicyId: prev.policyId, newPolicyId: newId });
@@ -5693,13 +5769,11 @@ var require_policies = __commonJS({
         const id = await createPolicyRaw(client, p);
         created.push(id);
       }
-      if (drifted.length > 0) {
-        const detail = drifted.map((d) => `  - ${d.name}:
-${indent(d.diff, "      ")}`).join("\n");
-        throw new Error(`Content drift detected on ${drifted.length} polic${drifted.length === 1 ? "y" : "ies"}. Re-run with --update to delete-and-recreate, or fix the existing policy in the Turnkey console.
-${detail}`);
+      for (const p of stale) {
+        await deletePolicy(client, p.policyId);
+        pruned.push({ name: p.policyName, policyId: p.policyId });
       }
-      return { created, skippedUnchanged, replaced };
+      return { created, skippedUnchanged, replaced, pruned };
     }
     async function createPolicyRaw(client, p) {
       const result = await client.executeActivity("ACTIVITY_TYPE_CREATE_POLICY_V3", "create_policy", {
@@ -5745,6 +5819,8 @@ var require_sender_policies = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.TRON_PERMIT2 = exports2.EVM_PERMIT2 = void 0;
+    exports2.tronTip712ChainId = tronTip712ChainId;
+    exports2.toTronEvmHex = toTronEvmHex;
     exports2.buildSenderPolicies = buildSenderPolicies;
     exports2.tronBase58ToEvmHex = tronBase58ToEvmHex;
     var node_crypto_1 = require("crypto");
@@ -5754,6 +5830,57 @@ var require_sender_policies = __commonJS({
       shasta: "TPUqJPASUn1zLvbLBgRZ5pBYrx7WSe5ahp"
     };
     var APPROVE_SELECTOR = "0x095ea7b3";
+    var PERMIT2_PRIMARY_TYPE = "PermitWitnessTransferFrom";
+    var PERMIT2_DOMAIN_NAME = "Permit2";
+    var TRON_TIP712_CHAIN_IDS = {
+      mainnet: 728126428,
+      shasta: 2494104990
+    };
+    function tronTip712ChainId(caip2) {
+      const cluster = caip2.split(":")[1] ?? "";
+      const id = Object.hasOwn(TRON_TIP712_CHAIN_IDS, cluster) ? TRON_TIP712_CHAIN_IDS[cluster] : void 0;
+      if (id === void 0) {
+        throw new Error(`Sender extras: unsupported Tron network "${caip2}". Known clusters: ${Object.keys(TRON_TIP712_CHAIN_IDS).join(", ")}.`);
+      }
+      return (id & 4294967295) >>> 0;
+    }
+    function evmNumericChainId(caip2) {
+      const id = Number.parseInt(caip2.split(":")[1] ?? "", 10);
+      if (!Number.isSafeInteger(id) || id <= 0) {
+        throw new Error(`Sender extras: chain id "${caip2}" is not a usable eip155 CAIP-2 identifier.`);
+      }
+      return id;
+    }
+    var lower = (a) => a.toLowerCase();
+    function assertEvmAddress(address, chainKey) {
+      if (!/^0x[0-9a-fA-F]{40}$/.test(address)) {
+        throw new Error(`Sender extras: ${JSON.stringify(address)} on chain "${chainKey}" is not a 20-byte 0x hex address. A malformed literal matches nothing, which denies every payment on this chain.`);
+      }
+      return address;
+    }
+    function toTronEvmHex(address) {
+      if (address.startsWith("T"))
+        return `0x${tronBase58ToEvmHex(address)}`;
+      if (/^0x[0-9a-fA-F]{40}$/.test(address))
+        return lower(address);
+      throw new Error(`Sender extras: Tron address ${JSON.stringify(address)} is neither a base58 (T\u2026) address nor a 20-byte 0x hex address, so its TIP-712 message form cannot be derived.`);
+    }
+    var quotedLower = (xs) => xs.map((x) => `'${lower(x)}'`).join(", ");
+    function quotedExact(xs, chainKey) {
+      for (const x of xs) {
+        if (x.includes("'") || x.includes("\\")) {
+          throw new Error(`Sender extras: destination ${JSON.stringify(x)} on chain "${chainKey}" contains a quote or backslash, which cannot appear in a policy condition literal.`);
+        }
+        if (x.length === 0 || !x.includes("@")) {
+          throw new Error(`Sender extras: destination ${JSON.stringify(x)} on chain "${chainKey}" is not a composed destination (<caip19-asset>@<account>). Build it with buildEscrowDestination.`);
+        }
+        if (Buffer.byteLength(x, "utf8") > MAX_DESTINATION_BYTES) {
+          throw new Error(`Sender extras: destination ${JSON.stringify(x)} on chain "${chainKey}" is longer than ${MAX_DESTINATION_BYTES} bytes, which the escrow rejects as DestinationTooLong, so no deposit could ever carry it.`);
+        }
+      }
+      return xs.map((x) => `'${x}'`).join(", ");
+    }
+    var MAX_DESTINATION_BYTES = 256;
     var SOLANA_STANDARD_PROGRAMS = [
       "11111111111111111111111111111111",
       // System
@@ -5783,12 +5910,20 @@ var require_sender_policies = __commonJS({
     }
     function buildSenderPolicies(extras, chains) {
       const policies = [];
-      policies.push({
-        policyName: "allowSignRawPayload",
-        effect: "EFFECT_ALLOW",
-        condition: `activity.type in ['ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2', 'ACTIVITY_TYPE_SIGN_RAW_PAYLOADS'] && activity.params.hash_function in ['HASH_FUNCTION_KECCAK256', 'HASH_FUNCTION_NOT_APPLICABLE']`,
-        notes: "Allows Permit2 EIP-712 (secp256k1 KECCAK256) and Solana inner-signature (ed25519) signing."
-      });
+      const permit2Evm = lower(extras.permit2 ?? exports2.EVM_PERMIT2);
+      for (const chain of chains) {
+        if (chain.kind !== "evm" && chain.kind !== "tron")
+          continue;
+        policies.push(permit2TypedDataAllow(chain, extras, permit2Evm));
+      }
+      if (chains.some((c) => c.kind === "solana")) {
+        policies.push({
+          policyName: "allowEd25519RawPayload",
+          effect: "EFFECT_ALLOW",
+          condition: `activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.encoding in ['PAYLOAD_ENCODING_HEXADECIMAL', 'PAYLOAD_ENCODING_TEXT_UTF8'] && activity.params.hash_function == 'HASH_FUNCTION_NOT_APPLICABLE'`,
+          notes: "Solana deposit inner signature (ed25519 over the deposit digest). Legal on secp256k1 only with EIP712, which the API enforces, so this stays an ed25519-only path."
+        });
+      }
       for (const chain of chains) {
         if (chain.kind === "evm") {
           const evmChainId = parseInt(chain.chainId.split(":")[1], 10);
@@ -5797,7 +5932,7 @@ var require_sender_policies = __commonJS({
             throw new Error(`Sender extras: chain "${chain.key}" has no allowedTokens. Add at least one ERC-20 contract address the sender's wallet is permitted to approve, or remove this chain.`);
           }
           const tokenList = tokens.map((t) => `'${t}'`).join(", ");
-          const permit2Lower = exports2.EVM_PERMIT2.replace(/^0x/, "");
+          const permit2Lower = permit2Evm.replace(/^0x/, "");
           policies.push({
             policyName: `allowApproveToPermit2 (${chain.chainId})`,
             effect: "EFFECT_ALLOW",
@@ -5887,13 +6022,70 @@ var require_sender_policies = __commonJS({
         }
       }
       policies.push({
-        policyName: "denyNoOpHash",
+        policyName: "denyNonTypedDataHashFunctions",
         effect: "EFFECT_DENY",
-        condition: `activity.type in ['ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2', 'ACTIVITY_TYPE_SIGN_RAW_PAYLOADS'] && activity.params.hash_function == 'HASH_FUNCTION_NO_OP'`,
-        notes: "Sender never uses NO_OP; NOT_APPLICABLE is the only allowed raw-payload hash mode."
+        condition: `activity.type in ['ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2', 'ACTIVITY_TYPE_SIGN_RAW_PAYLOADS'] && activity.params.hash_function in ['HASH_FUNCTION_NO_OP', 'HASH_FUNCTION_SHA256', 'HASH_FUNCTION_KECCAK256']`,
+        notes: "NO_OP signs a caller-chosen digest as-is; KECCAK256 signs a caller-chosen preimage, which reproduces any EIP-712 digest and bypasses every typed-data condition."
+      });
+      policies.push({
+        policyName: "denyAccountDelegationEncoding",
+        effect: "EFFECT_DENY",
+        condition: `activity.type in ['ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2', 'ACTIVITY_TYPE_SIGN_RAW_PAYLOADS'] && activity.params.encoding == 'PAYLOAD_ENCODING_EIP7702_AUTHORIZATION'`,
+        notes: "One signature would delegate the sender EOA to an attacker contract."
+      });
+      policies.push({
+        policyName: "denyBatchRawPayloads",
+        effect: "EFFECT_DENY",
+        condition: `activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOADS'`,
+        notes: "Message conditions bind one payload of a batch, so a second could ride along unbound."
       });
       return policies;
     }
+    function permit2TypedDataAllow(chain, extras, permit2Evm) {
+      const escrowsRaw = extras.escrows?.[chain.key] ?? [];
+      if (escrowsRaw.length === 0) {
+        throw new Error(`Sender extras: chain "${chain.key}" has no escrows. Permit2 leaves the transfer recipient out of the signed struct, so the escrow named as \`spender\` IS the funds destination \u2014 without it a stolen key can authorize a pull to anywhere. Read it from payment-gw /v1/defaults?chain_id=${chain.chainId} (escrow_contract).`);
+      }
+      const isTron = chain.kind === "tron";
+      const tronCluster = isTron ? chain.chainId.split(":")[1] ?? "" : "";
+      if (isTron) {
+        const expected = extras.network === "mainnet" ? "mainnet" : "shasta";
+        if (tronCluster !== expected) {
+          throw new Error(`Sender extras: network "${extras.network}" selects the ${expected} Permit2 deployment, but chain "${chain.key}" is "${chain.chainId}". The domain would carry one cluster's Permit2 with another's chain id, which matches no signature the runtime produces.`);
+        }
+      }
+      const permit2 = isTron ? `0x${tronBase58ToEvmHex(exports2.TRON_PERMIT2[tronCluster])}` : permit2Evm;
+      const chainIdValue = isTron ? tronTip712ChainId(chain.chainId) : evmNumericChainId(chain.chainId);
+      const addr = (xs) => quotedLower(xs.map((x) => isTron ? toTronEvmHex(x) : assertEvmAddress(x, chain.key)));
+      const tokens = extras.allowedTokens[chain.key] ?? [];
+      if (tokens.length === 0) {
+        throw new Error(`Sender extras: chain "${chain.key}" has no allowedTokens, so the typed-data allow would not bind which token the permit moves.`);
+      }
+      const tokenClause = ` && eth.eip_712.message['permitted']['token'] in [${addr(tokens)}]`;
+      const reservers = extras.reservers?.[chain.key] ?? [];
+      const releasers = extras.releasers?.[chain.key] ?? [];
+      for (const [role, vals, field] of [
+        ["reservers", reservers, "quote_selector"],
+        ["releasers", releasers, "fulfillment_verifier.account"]
+      ]) {
+        if (vals.length === 0) {
+          throw new Error(`Sender extras: chain "${chain.key}" has no ${role}. Either witness role can divert funds at settlement and the payer pins neither client-side, so leaving this unset is a hole this policy set is meant to close. Read it from payment-gw /v1/defaults?chain_id=${chain.chainId} (${field}).`);
+        }
+      }
+      const reserverClause = ` && eth.eip_712.message['witness']['reserver'] in [${addr(reservers)}]`;
+      const releaserClause = ` && eth.eip_712.message['witness']['releaser'] in [${addr(releasers)}]`;
+      const destinations = extras.allowedDestinations?.[chain.key] ?? [];
+      if (destinations.length === 0) {
+        throw new Error(`Sender extras: chain "${chain.key}" has no allowedDestinations. Without them a stolen key can authorize a deposit whose payout instruction names the attacker, which is the hole this policy set exists to close. Compose each entry with buildEscrowDestination, or remove the chain.`);
+      }
+      const destinationClause = ` && eth.eip_712.message['witness']['destination'] in [${quotedExact(destinations, chain.key)}]`;
+      return {
+        policyName: `allowPermit2DepositTypedData (${chain.chainId})`,
+        effect: "EFFECT_ALLOW",
+        condition: `activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.encoding == 'PAYLOAD_ENCODING_EIP712' && activity.params.hash_function == 'HASH_FUNCTION_NOT_APPLICABLE' && eth.eip_712.primary_type == '${PERMIT2_PRIMARY_TYPE}' && eth.eip_712.domain.name == '${PERMIT2_DOMAIN_NAME}' && eth.eip_712.domain.verifying_contract == '${permit2}' && eth.eip_712.domain.chain_id == ${chainIdValue} && eth.eip_712.message['spender'] in [${addr(escrowsRaw)}]` + tokenClause + reserverClause + releaserClause + destinationClause,
+        notes: "The sender's only fund-moving signature: a Permit2 deposit authorization into an allowlisted escrow, for an allowlisted token, committing to an allowlisted destination."
+      };
+    }
     function tronBase58ToEvmHex(b58) {
       const ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
       let bn = 0n;
@@ -6197,7 +6389,7 @@ var require_admin = __commonJS({
   "../key-management/providers/turnkey/typescript/dist/admin/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.validateExtras = exports2.buildExtrasPolicies = exports2.tronBase58ToEvmHex = exports2.TRON_PERMIT2 = exports2.EVM_PERMIT2 = exports2.buildSenderPolicies = exports2.listPolicies = exports2.derivePoliciesFromAllowlist = exports2.deletePolicy = exports2.buildDenyApproveToNonAllowedSpenderTron = exports2.buildDenyApproveToNonAllowedSpenderEvm = exports2.buildAllowSignRawPayloadPolicy = exports2.applyPolicies = exports2.createWalletWithChainAccounts = exports2.planRevocation = exports2.listUsers = exports2.isExpiredApiKey = exports2.isDurableApiKey = exports2.getUser = exports2.findApiKeyByPublicKey = exports2.deleteApiKeys = exports2.addApiKeys = exports2.UnsafeRevocationError = exports2.MAX_API_KEYS_PER_USER = exports2.listPendingActivities = exports2.getRootQuorum = exports2.getActivity = exports2.approvedVoterIds = exports2.approveActivity = exports2.provisionAgentUser = exports2.deleteSubOrganization = exports2.listSubOrganizations = exports2.createSubOrganization = void 0;
+    exports2.validateExtras = exports2.buildExtrasPolicies = exports2.tronTip712ChainId = exports2.tronBase58ToEvmHex = exports2.toTronEvmHex = exports2.TRON_PERMIT2 = exports2.EVM_PERMIT2 = exports2.buildSenderPolicies = exports2.planPolicyChanges = exports2.listPolicies = exports2.derivePoliciesFromAllowlist = exports2.deletePolicy = exports2.buildDenyApproveToNonAllowedSpenderTron = exports2.buildDenyApproveToNonAllowedSpenderEvm = exports2.buildAllowSignRawPayloadPolicy = exports2.applyPolicies = exports2.createWalletWithChainAccounts = exports2.planRevocation = exports2.listUsers = exports2.isExpiredApiKey = exports2.isDurableApiKey = exports2.getUser = exports2.findApiKeyByPublicKey = exports2.deleteApiKeys = exports2.addApiKeys = exports2.UnsafeRevocationError = exports2.MAX_API_KEYS_PER_USER = exports2.listPendingActivities = exports2.getRootQuorum = exports2.getActivity = exports2.approvedVoterIds = exports2.approveActivity = exports2.provisionAgentUser = exports2.deleteSubOrganization = exports2.listSubOrganizations = exports2.createSubOrganization = void 0;
     var sub_organizations_1 = require_sub_organizations();
     Object.defineProperty(exports2, "createSubOrganization", { enumerable: true, get: function() {
       return sub_organizations_1.createSubOrganization;
@@ -6287,6 +6479,9 @@ var require_admin = __commonJS({
     Object.defineProperty(exports2, "listPolicies", { enumerable: true, get: function() {
       return policies_1.listPolicies;
     } });
+    Object.defineProperty(exports2, "planPolicyChanges", { enumerable: true, get: function() {
+      return policies_1.planPolicyChanges;
+    } });
     var sender_policies_1 = require_sender_policies();
     Object.defineProperty(exports2, "buildSenderPolicies", { enumerable: true, get: function() {
       return sender_policies_1.buildSenderPolicies;
@@ -6297,9 +6492,15 @@ var require_admin = __commonJS({
     Object.defineProperty(exports2, "TRON_PERMIT2", { enumerable: true, get: function() {
       return sender_policies_1.TRON_PERMIT2;
     } });
+    Object.defineProperty(exports2, "toTronEvmHex", { enumerable: true, get: function() {
+      return sender_policies_1.toTronEvmHex;
+    } });
     Object.defineProperty(exports2, "tronBase58ToEvmHex", { enumerable: true, get: function() {
       return sender_policies_1.tronBase58ToEvmHex;
     } });
+    Object.defineProperty(exports2, "tronTip712ChainId", { enumerable: true, get: function() {
+      return sender_policies_1.tronTip712ChainId;
+    } });
     var extras_policies_1 = require_extras_policies();
     Object.defineProperty(exports2, "buildExtrasPolicies", { enumerable: true, get: function() {
       return extras_policies_1.buildExtrasPolicies;
@@ -7404,6 +7605,9 @@ var PaymentGatewayClient = class {
   }
 };
 
+// src/timeout-http-request.ts
+var import_axios2 = __toESM(require("axios"));
+
 // src/errors.ts
 var GatewayTimeoutError = class extends Error {
   constructor(baseUrl, timeoutMs) {
@@ -7467,6 +7671,12 @@ function isAxiosTimeout(error) {
   if (failure.code === "ECONNABORTED" || failure.code === "ETIMEDOUT") return true;
   return failure.code === "ERR_BAD_RESPONSE" && /stream has been aborted/i.test(failure.message ?? "");
 }
+function dropPartialResponseOnTimeout(error) {
+  if (isAxiosTimeout(error) && error !== null && typeof error === "object" && "response" in error) {
+    delete error.response;
+  }
+  return error;
+}
 function translateTimeout(error, baseUrl, fallbackTimeoutMs) {
   if (!isAxiosTimeout(error)) return error;
   const configured = error.config?.timeout;
@@ -7474,6 +7684,11 @@ function translateTimeout(error, baseUrl, fallbackTimeoutMs) {
 }
 
 // src/timeout-http-request.ts
+var timeoutAxios = import_axios2.default.create();
+timeoutAxios.interceptors.response.use(
+  void 0,
+  (error) => Promise.reject(dropPartialResponseOnTimeout(error))
+);
 function withRequestTimeout(config2, timeouts) {
   const request2 = new Interceptors();
   for (const fn of config2?.interceptors?.request?._fns ?? []) request2.use(fn);
@@ -7489,7 +7704,7 @@ var TimeoutHttpRequest = class extends AxiosHttpRequest {
   }
   request(options) {
     return new CancelablePromise((resolve2, reject, onCancel) => {
-      const pending = super.request(options);
+      const pending = request(this.config, options, timeoutAxios);
       onCancel(() => pending.cancel());
       pending.then(resolve2, (error) => {
         const request2 = { method: options.method, url: options.url, wait: options.query?.wait };
@@ -7809,7 +8024,7 @@ var import_chain_address2 = __toESM(require_dist2());
 
 // src/payment-tracking.ts
 function isTerminalStatus(status) {
-  return status === "completed" || status === "failed" || status === "cancelled";
+  return status === "completed" || status === "failed";
 }
 var DEFAULT_WAIT_SECONDS = 60;
 var DEFAULT_WAIT_BUDGET_MS = DEFAULT_WAIT_SECONDS * 1e3;
@@ -8169,8 +8384,8 @@ var PaymentGatewayClient2 = class extends PaymentGatewayClient {
       // reasonable against that type - would otherwise build an EIP-712 domain around a
       // null verifyingContract.
       permit2Contract: data.permit2_contract ?? void 0,
-      // Which deposit witness the escrow on this chain pins (CORE-2033). Absent means the
-      // four-member CORE-2120 witness — see ChainDefaults.depositWitnessVersion for why
+      // Which deposit witness the escrow on this chain pins. Absent means the
+      // four-member witness — see ChainDefaults.depositWitnessVersion for why
       // absence is the permissive default. EVM/Tron only; Solana uses the svm_* fields below.
       depositWitnessVersion: data.deposit_witness_version ?? void 0,
       // V3 Solana escrow domain separation. Present only for Solana
@@ -8385,7 +8600,7 @@ function runCli(program2, ...parseArgs) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = true ? "3.0.0" : "0.0.0-dev";
+var PACKAGE_VERSION = true ? "3.0.1" : "0.0.0-dev";
 
 // src/cli/payment-outcome.ts
 var EXIT_COMPLETED = 0;
@@ -8402,7 +8617,7 @@ function describePaymentOutcome(input) {
       summary: `completed: ${payment} settled.${replay}`
     };
   }
-  if (status === "failed" || status === "cancelled") {
+  if (status === "failed") {
     const reason = errorCode ? ` (${errorCode})` : "";
     return {
       exitCode: EXIT_TERMINAL_FAILURE,