@pafi-dev/core 0.22.0 → 0.24.0

package/dist/index.d.cts

@@ -2491,9 +2491,34 @@ interface PafiServiceUrls {
  * NOTE: placeholder URLs — Phi will swap in real prod/staging hosts
  * once the deploy targets are finalized. SDK version bump captures
  * the change.
+ *
+ * Audit PACI5-17 — production deployments SHOULD pass explicit
+ * `overrides` to `getPafiServiceUrls(chainId, overrides)` (sourced from
+ * env vars like `PAFI_SPONSOR_RELAYER_URL`, `PAFI_ISSUER_API_URL`)
+ * instead of relying on these defaults. The SDK ship-default is a
+ * convenience for dev/test; relying on it for production means an SDK
+ * version bump is required to retarget environments.
  */
 declare const PAFI_SERVICE_URLS: Record<number, PafiServiceUrls>;
-declare function getPafiServiceUrls(chainId: number): PafiServiceUrls;
+/**
+ * Resolve PAFI HTTP service URLs for the chain. Caller MAY pass
+ * `overrides` to point at a different environment (production,
+ * staging, local mock) without bumping the SDK.
+ *
+ * Audit PACI5-17 — production issuer backends MUST surface the URL
+ * via env vars and pass them through here so the deployed binary
+ * does not depend on hardcoded ship-defaults that may target dev
+ * infrastructure. Example:
+ *
+ *   const services = getPafiServiceUrls(8453, {
+ *     sponsorRelayer: process.env.PAFI_SPONSOR_RELAYER_URL,
+ *     issuerApi:      process.env.PAFI_ISSUER_API_URL,
+ *   });
+ *
+ * Undefined / empty-string overrides are ignored so callers can safely
+ * pass through optional env vars.
+ */
+declare function getPafiServiceUrls(chainId: number, overrides?: Partial<PafiServiceUrls>): PafiServiceUrls;
 
 /**
  * Public contract surface for `@pafi-dev/core/contracts`.

package/dist/index.d.ts

@@ -2491,9 +2491,34 @@ interface PafiServiceUrls {
  * NOTE: placeholder URLs — Phi will swap in real prod/staging hosts
  * once the deploy targets are finalized. SDK version bump captures
  * the change.
+ *
+ * Audit PACI5-17 — production deployments SHOULD pass explicit
+ * `overrides` to `getPafiServiceUrls(chainId, overrides)` (sourced from
+ * env vars like `PAFI_SPONSOR_RELAYER_URL`, `PAFI_ISSUER_API_URL`)
+ * instead of relying on these defaults. The SDK ship-default is a
+ * convenience for dev/test; relying on it for production means an SDK
+ * version bump is required to retarget environments.
  */
 declare const PAFI_SERVICE_URLS: Record<number, PafiServiceUrls>;
-declare function getPafiServiceUrls(chainId: number): PafiServiceUrls;
+/**
+ * Resolve PAFI HTTP service URLs for the chain. Caller MAY pass
+ * `overrides` to point at a different environment (production,
+ * staging, local mock) without bumping the SDK.
+ *
+ * Audit PACI5-17 — production issuer backends MUST surface the URL
+ * via env vars and pass them through here so the deployed binary
+ * does not depend on hardcoded ship-defaults that may target dev
+ * infrastructure. Example:
+ *
+ *   const services = getPafiServiceUrls(8453, {
+ *     sponsorRelayer: process.env.PAFI_SPONSOR_RELAYER_URL,
+ *     issuerApi:      process.env.PAFI_ISSUER_API_URL,
+ *   });
+ *
+ * Undefined / empty-string overrides are ignored so callers can safely
+ * pass through optional env vars.
+ */
+declare function getPafiServiceUrls(chainId: number, overrides?: Partial<PafiServiceUrls>): PafiServiceUrls;
 
 /**
  * Public contract surface for `@pafi-dev/core/contracts`.

package/dist/index.js

@@ -1,15 +1,3 @@
-import {
-  erc20Abi,
-  permit2Abi,
-  pointModuleCoreAbi,
-  pointTokenFactoryAbi,
-  settlementVaultAbi,
-  tokenRegistryAbi,
-  universalRouterAbi,
-  v3QuoterV2Abi,
-  vaultFactoryAbi,
-  vaultRegistryAbi
-} from "./chunk-ZQVYWMOG.js";
 import {
   SPONSOR_AUTH_DOMAIN_ANCHOR_BASE_MAINNET,
   SPONSOR_AUTH_DOMAIN_NAME,
@@ -45,6 +33,18 @@ import {
   verifyIssuerOperative,
   verifyMint
 } from "./chunk-4VPIPVV5.js";
+import {
+  erc20Abi,
+  permit2Abi,
+  pointModuleCoreAbi,
+  pointTokenFactoryAbi,
+  settlementVaultAbi,
+  tokenRegistryAbi,
+  universalRouterAbi,
+  v3QuoterV2Abi,
+  vaultFactoryAbi,
+  vaultRegistryAbi
+} from "./chunk-ZQVYWMOG.js";
 import {
   issuerRegistryAbi,
   mintFeeWrapperAbi,
@@ -900,11 +900,23 @@ var CONTRACT_ADDRESSES = {
     // top-level export.
     permit2: "0xEB450d21ae68D3303Cf5775A54Cc84EE7c3fC8eC",
     // ── Stablecoins ───────────────────────────────────────────────
-    // USDT inherited from v1.6 (MockUSDT — no new V2 USDT deploy).
-    usdt: "0x3F7e71B150e97316Bb9f363A32c19CcD36ac2382",
-    // V2 USDC — PAFI ecosystem USDC (custom deploy, NOT canonical Base
-    // USDC `0x833589fC...`). Paired with the USDC/USD Chainlink feed below.
-    usdc: "0xf0Fa9eB05fd3a373d3c54775Ff0ed55Dc9cc2D3E",
+    // Canonical Base stables — the PT pools team deploys against these
+    // (verified on-chain: pool `0xB135E06E…` LTR/USDC and `0x6348D133…`
+    // JLB/USDC both list `token = 0x833589fC…` = canonical USDC). The
+    // earlier PAFI custom-deploy USDT/USDC (MockUSDT `0x3F7e71…` +
+    // PAFI V2 USDC `0xf0Fa9eB0…`) were unused by production pools and
+    // caused sponsor-relayer's `isStableFeeToken` to fall through to
+    // the PT quoter, producing 1e12× INSUFFICIENT_FEE rejects on every
+    // swap. See addresses.ts history before 2026-06-16 if archeology
+    // is needed.
+    //
+    // Canonical Tether USDT on Base (Tether's official native deploy,
+    // symbol="USDT", name="Tether USD", 6 decimals).
+    usdt: "0xfde4C96c8593536E31F229EA8f37b2ADa2699bb2",
+    // Canonical Circle USDC on Base (Coinbase official deploy,
+    // symbol="USDC", 6 decimals). Paired with the USDC/USD Chainlink
+    // feed below.
+    usdc: "0x833589fCD6EDb6E08f4c7C32D4f71b54bdA02913",
     chainlinkUsdcUsd: "0xEE86BfD4E2B3A1e71a1b45f750791D67e735e4a7",
     // ── V2 core registries (replaces v1.6) ────────────────────────
     issuerRegistry: "0x3e82647b0f716f80e65d311354E2C4F0DcFd6997",
@@ -1510,14 +1522,21 @@ var PAFI_SERVICE_URLS = {
     issuerApi: "https://api-dev.pacificfinance.org/api/issuer"
   }
 };
-function getPafiServiceUrls(chainId) {
-  const urls = PAFI_SERVICE_URLS[chainId];
-  if (!urls) {
+function getPafiServiceUrls(chainId, overrides) {
+  const defaults = PAFI_SERVICE_URLS[chainId];
+  if (!defaults) {
     throw new Error(
-      `getPafiServiceUrls: no PAFI service URLs for chainId ${chainId}. Supported: ${Object.keys(PAFI_SERVICE_URLS).join(", ")}`
+      `getPafiServiceUrls: no PAFI service URLs for chainId ${chainId}. Supported: ${Object.keys(PAFI_SERVICE_URLS).join(", ")}. Provide explicit overrides for unsupported chains.`
     );
   }
-  return urls;
+  const cleanOverrides = {};
+  if (overrides?.sponsorRelayer) {
+    cleanOverrides.sponsorRelayer = overrides.sponsorRelayer;
+  }
+  if (overrides?.issuerApi) {
+    cleanOverrides.issuerApi = overrides.issuerApi;
+  }
+  return { ...defaults, ...cleanOverrides };
 }
 
 // src/web-handoff/webPopup.ts