@usdctofiat/offramp 3.0.1 → 3.0.3

package/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Fixed
+
+- Reject shortened or non-PayPal URLs in the PayPal.me username normalizer so
+  inputs like `t.co/...` cannot be converted into a fake PayPal username.
+
+### Changed
+
+- Bump `@zkp2p/sdk` to `0.4.1`.
+
+## [3.0.3] - 2026-05-20
+
+### Fixed
+
+- Return canonical OTC share links from `getOtcLink()` and `enableOtc()` using
+  `https://otc.usdctofiat.xyz/d/<escrow>/<depositId>`.
+
+## [3.0.2] - 2026-05-19
+
+### Fixed
+
+- Pass the canonical `DEFAULT_INTENT_GUARDIAN_ADDRESS` on `createDeposit` so
+  SDK-created deposits share the same guardian as the zkp2p-clients web flow
+  instead of falling back to `ZERO_ADDRESS` at the contract.
+
 ## [3.0.1] - 2026-05-10
 
 ### Fixed

package/README.md

@@ -102,7 +102,7 @@ const { depositId, otcLink } = await offramp(walletClient, {
   identifier: "alice",
   otcTaker: "0xBuyerAddress",
 });
-// otcLink = "https://usdctofiat.xyz/deposit/0x.../362"
+// otcLink = "https://otc.usdctofiat.xyz/d/0x.../362"
 // Share otcLink with the buyer — they open it, connect their wallet, and fill the order.
 ```
 

package/dist/{chunk-5KJ4DFWK.js → chunk-4KKKDDES.js}

@@ -1,6 +1,6 @@
 // src/config.ts
 import { getContracts, getGatingServiceAddress } from "@zkp2p/sdk";
-var SDK_VERSION = "3.0.1";
+var SDK_VERSION = "3.0.3";
 var BASE_CHAIN_ID = 8453;
 var RUNTIME_ENV = "production";
 var API_BASE_URL = "https://api.zkp2p.xyz";
@@ -17,6 +17,7 @@ var GATING_SERVICE_ADDRESS = getGatingServiceAddress(
 var DELEGATE_RATE_MANAGER_ID = "0x8666d6fb0f6797c56e95339fd7ca82fdd348b9db200e10a4c4aa0a0b879fc41c";
 var RATE_MANAGER_REGISTRY_ADDRESS = "0xeed7db23e724ac4590d6db6f78fda6db203535f3";
 var DELEGATE_MANAGER_FEE_BPS = 10;
+var DEFAULT_INTENT_GUARDIAN_ADDRESS = "0xe29a5BD4D0CEbA6C125A0361E7D20ab4eA275C2f";
 var REFERRER = "galleonlabs";
 var MIN_DEPOSIT_USDC = 1;
 var MIN_ORDER_USDC = 1;
@@ -101,7 +102,8 @@ var FALLBACK_CURRENCIES = {
   zelle: ["USD"],
   paypal: ["USD", "EUR", "GBP", "SGD", "NZD", "AUD", "CAD"],
   monzo: ["GBP"],
-  n26: ["EUR"]
+  n26: ["EUR"],
+  luxon: ["USD", "EUR", "GBP"]
 };
 function gatherCatalogHashes(platform) {
   if (platform === "zelle") {
@@ -125,13 +127,39 @@ function resolveSupportedCurrencies(platform) {
 function normalizePaypalMeUsername(value) {
   const trimmed = value.trim();
   if (!trimmed) return "";
-  const withoutProtocol = trimmed.replace(/^https?:\/\//i, "").replace(/^www\./i, "");
-  if (/^paypal\.me(?:[?#].*)?$/i.test(withoutProtocol)) return "";
-  const withoutDomain = withoutProtocol.replace(/^paypal\.me\//i, "");
-  const [pathWithoutQuery] = withoutDomain.split(/[?#]/, 1);
+  const withoutProtocol = trimmed.replace(/^https?:\/\//i, "");
+  const [pathWithoutQuery] = withoutProtocol.split(/[?#]/, 1);
   const sanitizedPath = pathWithoutQuery.replace(/^\/+/, "");
-  const [username] = sanitizedPath.split("/", 1);
-  return username.replace(/^@+/, "").trim().toLowerCase();
+  const [host = "", ...pathSegments] = sanitizedPath.split("/");
+  const normalizedHost = host.toLowerCase().replace(/^www\./i, "");
+  if (normalizedHost === "paypal.me") {
+    const [username = ""] = pathSegments;
+    return username.replace(/^@+/, "").trim().toLowerCase();
+  }
+  if (normalizedHost === "paypal.com") {
+    const [paypalMePath = "", username = ""] = pathSegments;
+    if (paypalMePath.toLowerCase() !== "paypalme") return "";
+    return username.replace(/^@+/, "").trim().toLowerCase();
+  }
+  if (/^https?:\/\//i.test(trimmed) || trimmed.includes("/")) {
+    return trimmed;
+  }
+  return trimmed.replace(/^@+/, "").toLowerCase();
+}
+function isValidIBAN(iban) {
+  const upper = iban.toUpperCase();
+  if (!/^[A-Z]{2}[0-9]{2}[A-Z0-9]{11,30}$/.test(upper)) return false;
+  const rearranged = upper.slice(4) + upper.slice(0, 4);
+  const numeric = rearranged.split("").map((ch) => {
+    const code = ch.charCodeAt(0);
+    return code >= 65 && code <= 90 ? (code - 55).toString() : ch;
+  }).join("");
+  let remainder = numeric;
+  while (remainder.length > 2) {
+    const block = remainder.slice(0, 9);
+    remainder = (parseInt(block, 10) % 97).toString() + remainder.slice(block.length);
+  }
+  return parseInt(remainder, 10) % 97 === 1;
 }
 var BLUEPRINTS = {
   venmo: {
@@ -183,9 +211,9 @@ var BLUEPRINTS = {
     transform: (v) => v.replace(/^@+/, "").trim(),
     extensionRegistration: {
       providerId: "wise",
-      requiredPrompt: "This Wisetag is not registered yet. Verify it in the Peer extension, then refresh and retry with the same Wisetag.",
-      ctaLabel: "Install Peer Extension",
-      minExtensionVersion: "0.4.12"
+      requiredPrompt: "This Wisetag is not registered yet. Register it with PeerAuth, then retry with the same Wisetag.",
+      ctaLabel: "Register Wisetag",
+      minExtensionVersion: "0.5.0"
     }
   },
   mercadopago: {
@@ -202,7 +230,11 @@ var BLUEPRINTS = {
     identifierLabel: "Email",
     placeholder: "email",
     helperText: "Registered Zelle email",
-    validation: z.string().email()
+    // Curator's ZelleProcessor rejects any non-lowercase email outright, so
+    // canonicalize to lowercase here rather than letting /v2/makers/create
+    // reject after the maker has already approved USDC + paid gas.
+    validation: z.string().email(),
+    transform: (v) => v.trim().toLowerCase()
   },
   paypal: {
     id: "paypal",
@@ -210,14 +242,17 @@ var BLUEPRINTS = {
     identifierLabel: "PayPal.me Username",
     placeholder: "paypal.me/your-username",
     helperText: "Your PayPal.me username, not your email",
-    validation: z.string().min(1, "PayPal.me username is required").regex(/^[a-z0-9._-]+$/i, "Use your PayPal.me username (letters, numbers, . _ -)"),
+    validation: z.string().min(1, "PayPal.me username is required").regex(
+      /^[a-z0-9._-]+$/i,
+      "Use your PayPal.me username or paypal.me link, not a shortened URL."
+    ),
     transform: normalizePaypalMeUsername,
     extensionRegistration: {
       providerId: "paypal",
-      requiredPrompt: "This PayPal username is not registered yet. Verify it in the Peer extension, then refresh and retry with the same PayPal username.",
-      ctaLabel: "Install Peer Extension",
+      requiredPrompt: "This PayPal username is not registered yet. Register it with PeerAuth, then retry with the same PayPal username.",
+      ctaLabel: "Register PayPal Username",
       ctaSubtext: "PayPal Business accounts are not supported at this time.",
-      minExtensionVersion: "0.4.14"
+      minExtensionVersion: "0.5.0"
     }
   },
   monzo: {
@@ -234,8 +269,20 @@ var BLUEPRINTS = {
     identifierLabel: "IBAN",
     placeholder: "IBAN (e.g. DE89...)",
     helperText: "Your IBAN (spaces will be removed)",
-    validation: z.string().min(15).max(34).regex(/^[A-Z]{2}[0-9]{2}[A-Z0-9]+$/i),
+    // transform runs before validation, so the schema sees a spaceless,
+    // uppercased IBAN. The MOD-97 refine mirrors curator's N26Processor so a
+    // typo'd-but-well-formed IBAN fails here, not after USDC approval + gas.
+    validation: z.string().regex(/^[A-Z]{2}[0-9]{2}[A-Z0-9]{11,30}$/, "Enter a valid IBAN").refine(isValidIBAN, "That IBAN looks wrong \u2014 its checksum doesn't match"),
     transform: (v) => v.replace(/\s/g, "").toUpperCase()
+  },
+  luxon: {
+    id: "luxon",
+    name: "Luxon",
+    identifierLabel: "Email",
+    placeholder: "your-luxon-email@example.com",
+    helperText: "Email address registered with Luxon",
+    validation: z.string().email(),
+    transform: (v) => v.trim()
   }
 };
 function buildPlatformEntry(bp) {
@@ -274,8 +321,18 @@ var PLATFORMS = {
   ZELLE: buildPlatformEntry(BLUEPRINTS.zelle),
   PAYPAL: buildPlatformEntry(BLUEPRINTS.paypal),
   MONZO: buildPlatformEntry(BLUEPRINTS.monzo),
-  N26: buildPlatformEntry(BLUEPRINTS.n26)
+  N26: buildPlatformEntry(BLUEPRINTS.n26),
+  LUXON: buildPlatformEntry(BLUEPRINTS.luxon)
+};
+var PLATFORM_LIMITS = {
+  venmo: { platformCapUsd: 5e3 },
+  n26: { platformCapUsd: 1e4 },
+  paypal: { minTier: "PLUS" }
 };
+function getPlatformLimits(platform) {
+  const id = platform.trim().toLowerCase();
+  return PLATFORM_LIMITS[id] ?? null;
+}
 function getPlatformById(id) {
   return Object.values(PLATFORMS).find((p) => p.id === id) ?? null;
 }
@@ -384,349 +441,7 @@ function isUserCancellation(error) {
 // src/otc.ts
 import { createPublicClient, http, isAddress, zeroAddress } from "viem";
 import { base } from "viem/chains";
-
-// ../../node_modules/@zkp2p/contracts-v2/abis/base/WhitelistPreIntentHook.json
-var WhitelistPreIntentHook_default = [
-  {
-    inputs: [
-      {
-        internalType: "address",
-        name: "_orchestratorRegistry",
-        type: "address"
-      }
-    ],
-    stateMutability: "nonpayable",
-    type: "constructor"
-  },
-  {
-    inputs: [],
-    name: "EmptyArray",
-    type: "error"
-  },
-  {
-    inputs: [
-      {
-        internalType: "address",
-        name: "taker",
-        type: "address"
-      },
-      {
-        internalType: "address",
-        name: "escrow",
-        type: "address"
-      },
-      {
-        internalType: "uint256",
-        name: "depositId",
-        type: "uint256"
-      }
-    ],
-    name: "TakerNotInWhitelist",
-    type: "error"
-  },
-  {
-    inputs: [
-      {
-        internalType: "address",
-        name: "taker",
-        type: "address"
-      },
-      {
-        internalType: "address",
-        name: "escrow",
-        type: "address"
-      },
-      {
-        internalType: "uint256",
-        name: "depositId",
-        type: "uint256"
-      }
-    ],
-    name: "TakerNotWhitelisted",
-    type: "error"
-  },
-  {
-    inputs: [
-      {
-        internalType: "address",
-        name: "caller",
-        type: "address"
-      },
-      {
-        internalType: "address",
-        name: "owner",
-        type: "address"
-      },
-      {
-        internalType: "address",
-        name: "delegate",
-        type: "address"
-      }
-    ],
-    name: "UnauthorizedCallerOrDelegate",
-    type: "error"
-  },
-  {
-    inputs: [
-      {
-        internalType: "address",
-        name: "caller",
-        type: "address"
-      }
-    ],
-    name: "UnauthorizedOrchestratorCaller",
-    type: "error"
-  },
-  {
-    inputs: [],
-    name: "ZeroAddress",
-    type: "error"
-  },
-  {
-    anonymous: false,
-    inputs: [
-      {
-        indexed: true,
-        internalType: "address",
-        name: "escrow",
-        type: "address"
-      },
-      {
-        indexed: true,
-        internalType: "uint256",
-        name: "depositId",
-        type: "uint256"
-      },
-      {
-        indexed: true,
-        internalType: "address",
-        name: "taker",
-        type: "address"
-      }
-    ],
-    name: "TakerRemovedFromWhitelist",
-    type: "event"
-  },
-  {
-    anonymous: false,
-    inputs: [
-      {
-        indexed: true,
-        internalType: "address",
-        name: "escrow",
-        type: "address"
-      },
-      {
-        indexed: true,
-        internalType: "uint256",
-        name: "depositId",
-        type: "uint256"
-      },
-      {
-        indexed: true,
-        internalType: "address",
-        name: "taker",
-        type: "address"
-      }
-    ],
-    name: "TakerWhitelisted",
-    type: "event"
-  },
-  {
-    inputs: [
-      {
-        internalType: "address",
-        name: "_escrow",
-        type: "address"
-      },
-      {
-        internalType: "uint256",
-        name: "_depositId",
-        type: "uint256"
-      },
-      {
-        internalType: "address[]",
-        name: "_takers",
-        type: "address[]"
-      }
-    ],
-    name: "addToWhitelist",
-    outputs: [],
-    stateMutability: "nonpayable",
-    type: "function"
-  },
-  {
-    inputs: [
-      {
-        internalType: "address",
-        name: "_escrow",
-        type: "address"
-      },
-      {
-        internalType: "uint256",
-        name: "_depositId",
-        type: "uint256"
-      },
-      {
-        internalType: "address",
-        name: "_taker",
-        type: "address"
-      }
-    ],
-    name: "isWhitelisted",
-    outputs: [
-      {
-        internalType: "bool",
-        name: "",
-        type: "bool"
-      }
-    ],
-    stateMutability: "view",
-    type: "function"
-  },
-  {
-    inputs: [],
-    name: "orchestratorRegistry",
-    outputs: [
-      {
-        internalType: "contract IOrchestratorRegistry",
-        name: "",
-        type: "address"
-      }
-    ],
-    stateMutability: "view",
-    type: "function"
-  },
-  {
-    inputs: [
-      {
-        internalType: "address",
-        name: "_escrow",
-        type: "address"
-      },
-      {
-        internalType: "uint256",
-        name: "_depositId",
-        type: "uint256"
-      },
-      {
-        internalType: "address[]",
-        name: "_takers",
-        type: "address[]"
-      }
-    ],
-    name: "removeFromWhitelist",
-    outputs: [],
-    stateMutability: "nonpayable",
-    type: "function"
-  },
-  {
-    inputs: [
-      {
-        components: [
-          {
-            internalType: "address",
-            name: "taker",
-            type: "address"
-          },
-          {
-            internalType: "address",
-            name: "escrow",
-            type: "address"
-          },
-          {
-            internalType: "uint256",
-            name: "depositId",
-            type: "uint256"
-          },
-          {
-            internalType: "uint256",
-            name: "amount",
-            type: "uint256"
-          },
-          {
-            internalType: "address",
-            name: "to",
-            type: "address"
-          },
-          {
-            internalType: "bytes32",
-            name: "paymentMethod",
-            type: "bytes32"
-          },
-          {
-            internalType: "bytes32",
-            name: "fiatCurrency",
-            type: "bytes32"
-          },
-          {
-            internalType: "uint256",
-            name: "conversionRate",
-            type: "uint256"
-          },
-          {
-            components: [
-              {
-                internalType: "address",
-                name: "recipient",
-                type: "address"
-              },
-              {
-                internalType: "uint256",
-                name: "fee",
-                type: "uint256"
-              }
-            ],
-            internalType: "struct IReferralFee.ReferralFee[]",
-            name: "referralFees",
-            type: "tuple[]"
-          },
-          {
-            internalType: "bytes",
-            name: "preIntentHookData",
-            type: "bytes"
-          }
-        ],
-        internalType: "struct IPreIntentHook.PreIntentContext",
-        name: "_ctx",
-        type: "tuple"
-      }
-    ],
-    name: "validateSignalIntent",
-    outputs: [],
-    stateMutability: "view",
-    type: "function"
-  },
-  {
-    inputs: [
-      {
-        internalType: "address",
-        name: "",
-        type: "address"
-      },
-      {
-        internalType: "uint256",
-        name: "",
-        type: "uint256"
-      },
-      {
-        internalType: "address",
-        name: "",
-        type: "address"
-      }
-    ],
-    name: "whitelist",
-    outputs: [
-      {
-        internalType: "bool",
-        name: "",
-        type: "bool"
-      }
-    ],
-    stateMutability: "view",
-    type: "function"
-  }
-];
+import WhitelistPreIntentHookABI from "@zkp2p/contracts-v2/abis/base/WhitelistPreIntentHook.json";
 
 // src/sdk-client.ts
 import { OfframpClient } from "@zkp2p/sdk";
@@ -742,7 +457,7 @@ function createSdkClient(walletClient) {
 
 // src/otc.ts
 var WHITELIST_HOOK_ADDRESS = "0xda023Ea0d789A41BcF5866F7B6BBd2CaDF9b79B8";
-var OTC_BASE_URL = "https://usdctofiat.xyz";
+var OTC_BASE_URL = "https://otc.usdctofiat.xyz";
 async function enableOtc(walletClient, depositId, takerAddress, escrowAddress) {
   if (!isAddress(takerAddress)) {
     throw new OfframpError("Invalid taker address", "VALIDATION");
@@ -814,7 +529,7 @@ async function disableOtc(walletClient, depositId, escrowAddress) {
 }
 function getOtcLink(depositId, escrowAddress) {
   const escrow = escrowAddress || ESCROW_ADDRESS;
-  return `${OTC_BASE_URL}/deposit/${escrow}/${depositId}`;
+  return `${OTC_BASE_URL}/d/${escrow}/${depositId}`;
 }
 async function writeContract(walletClient, functionName, args) {
   const wc = walletClient;
@@ -823,7 +538,7 @@ async function writeContract(walletClient, functionName, args) {
   }
   await wc.writeContract({
     address: WHITELIST_HOOK_ADDRESS,
-    abi: WhitelistPreIntentHook_default,
+    abi: WhitelistPreIntentHookABI,
     functionName,
     args
   });
@@ -832,7 +547,7 @@ async function readIsWhitelisted(escrow, depositId, taker) {
   const publicClient = createPublicClient({ chain: base, transport: http(BASE_RPC_URL) });
   return publicClient.readContract({
     address: WHITELIST_HOOK_ADDRESS,
-    abi: WhitelistPreIntentHook_default,
+    abi: WhitelistPreIntentHookABI,
     functionName: "isWhitelisted",
     args: [escrow, depositId, taker]
   });
@@ -1199,6 +914,28 @@ async function registerPayeeDetails(processorName, payload) {
     clearTimeout(timeout);
   }
 }
+async function validatePayeeDetails(processorName, offchainId) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), PAYEE_REGISTRATION_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${API_BASE_URL}/v2/makers/validate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ processorName, offchainId }),
+      signal: controller.signal
+    });
+    if (!res.ok) return "unknown";
+    const json = await res.json();
+    if (typeof json.responseObject === "boolean") {
+      return json.responseObject ? "valid" : "invalid";
+    }
+    return "unknown";
+  } catch {
+    return "unknown";
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function attachOracleConfig(entries, conversionRates) {
   return entries.map(
     (group, gi) => group.map((entry, ci) => {
@@ -1370,6 +1107,17 @@ async function offramp(walletClient, params, onProgress, telemetryContext) {
     } catch (err) {
       if (err instanceof OfframpError) throw err;
     }
+    const canonicalName = platformId.startsWith("zelle") ? "zelle" : platformId;
+    if (!getPeerExtensionRegistrationInfo(platformId)) {
+      const outcome = await validatePayeeDetails(canonicalName, normalizedIdentifier);
+      if (outcome === "invalid") {
+        throw new OfframpError(
+          `Couldn't verify that ${platform.name} ${platform.identifier.label.toLowerCase()}. Double-check it and try again.`,
+          "VALIDATION",
+          "registering"
+        );
+      }
+    }
     const client = createSdkClient(walletClient);
     const txOverrides = { referrer: [REFERRER] };
     emitProgress({ step: "approving" });
@@ -1394,7 +1142,6 @@ async function offramp(walletClient, params, onProgress, telemetryContext) {
     }
     emitProgress({ step: "registering" });
     let hashedOnchainId;
-    const canonicalName = platformId.startsWith("zelle") ? "zelle" : platformId;
     try {
       const payeePayload = buildDepositData(canonicalName, normalizedIdentifier);
       hashedOnchainId = await registerPayeeDetails(canonicalName, payeePayload);
@@ -1444,6 +1191,7 @@ async function offramp(walletClient, params, onProgress, telemetryContext) {
           data: "0x"
         })),
         currenciesOverride,
+        intentGuardian: DEFAULT_INTENT_GUARDIAN_ADDRESS,
         escrowAddress: ESCROW_ADDRESS,
         txOverrides
       });
@@ -1757,7 +1505,10 @@ import {
 export {
   ESCROW_ADDRESS,
   normalizePaypalMeUsername,
+  isValidIBAN,
   PLATFORMS,
+  PLATFORM_LIMITS,
+  getPlatformLimits,
   getPeerExtensionRegistrationInfo,
   isPeerExtensionRegistrationError,
   MakersCreateError,
@@ -1784,4 +1535,4 @@ export {
   openPeerExtensionInstallPage,
   getPeerExtensionState
 };
-//# sourceMappingURL=chunk-5KJ4DFWK.js.map
+//# sourceMappingURL=chunk-4KKKDDES.js.map