@zkp2p/cash 0.4.8 → 0.4.9

package/dist/index.js

@@ -1,5 +1,5 @@
-import { MARKET_SPREAD_BPS, ORACLE_MIN_CONVERSION_RATE_SENTINEL, CASH_RETAIN_ON_EMPTY, BASE_USDC_ADDRESS, USDC_DECIMALS, BASE_CHAIN_ID, errors, isCashError, CASH_ORDER_STATUSES, mapChainError, CashError, CASH_ACCESS_GROUP_IDS, CASH_RESTRICTED_PLATFORMS } from './chunk-CSDSJVI7.js';
-export { BASE_CHAIN_ID, BASE_USDC_ADDRESS, CASH_ORDER_POLL_INTERVAL_MS, CASH_ORDER_STATUSES, CASH_RETAIN_ON_EMPTY, CashError, MARKET_SPREAD_BPS, ORACLE_MIN_CONVERSION_RATE_SENTINEL, USDC_DECIMALS, errors, isCashError, isUserRejectedError } from './chunk-CSDSJVI7.js';
+import { MARKET_SPREAD_BPS, ORACLE_MIN_CONVERSION_RATE_SENTINEL, CASH_RETAIN_ON_EMPTY, BASE_USDC_ADDRESS, USDC_DECIMALS, BASE_CHAIN_ID, errors, isCashError, CASH_ORDER_STATUSES, mapChainError, CashError, CASH_ACCESS_GROUP_IDS, CASH_RESTRICTED_PLATFORMS } from './chunk-4LPWKZMW.js';
+export { BASE_CHAIN_ID, BASE_USDC_ADDRESS, CASH_ORDER_POLL_INTERVAL_MS, CASH_ORDER_STATUSES, CASH_RETAIN_ON_EMPTY, CashError, MARKET_SPREAD_BPS, ORACLE_MIN_CONVERSION_RATE_SENTINEL, USDC_DECIMALS, errors, isCashError, isUserRejectedError } from './chunk-4LPWKZMW.js';
 import { parseAbi, parseEventLogs, isAddress, http, createWalletClient, encodeFunctionData } from 'viem';
 import { base } from 'viem/chains';
 import { getSpreadOracleConfig, currencyInfo, getPaymentMethodsCatalog, getGatingServiceAddress, resolvePaymentMethodHashFromCatalog, resolvePaymentMethodNameFromHash, getCurrencyCodeFromHash, createCompositeDepositId, appendAttributionToCalldata, Zkp2pClient, CHAINLINK_ORACLE_FEEDS } from '@zkp2p/sdk';
@@ -1773,8 +1773,6 @@ function createCashClient(options) {
       const payoutInput = validatePayout(input);
       const client = await signingClient("cashout", opts);
       const owner = opts.signer.account.address;
-      let sourceResult;
-      let cashoutAmount = input.amount;
       if (input.source) {
         const sourceSigner = opts.sourceSigner ?? (input.source.chainId === BASE_CHAIN_ID ? opts.signer : void 0);
         if (!sourceSigner?.account) throw errors.signerRequired("source cashout");
@@ -1795,7 +1793,7 @@ function createCashClient(options) {
         if (relayQuote.outputAmount < MIN_CASHOUT_AMOUNT) {
           throw errors.amountBelowMinimum(relayQuote.outputAmount, MIN_CASHOUT_AMOUNT);
         }
-        cashoutAmount = relayQuote.outputAmount;
+        const cashoutAmount = relayQuote.outputAmount;
         const depositInput2 = validateDepositInput(cashoutAmount, input, payoutInput);
         const params2 = await buildDepositParams(client, depositInput2);
         const escrow2 = client.escrowV2Address ?? client.escrowAddress;
@@ -1812,7 +1810,6 @@ function createCashClient(options) {
           txHashes: executed.txHashes,
           ...executed.transactions ? { transactions: executed.transactions } : {}
         };
-        sourceResult = routedSource;
         try {
           await waitForBaseSignerAfterRelay(
             client,
@@ -1946,8 +1943,7 @@ function createCashClient(options) {
         escrowAddress: resolved.escrowAddress,
         onchainDepositId: resolved.onchainDepositId,
         order,
-        ...accessPolicyTxHash ? { accessPolicyTxHash } : {},
-        ...sourceResult ? { source: sourceResult } : {}
+        ...accessPolicyTxHash ? { accessPolicyTxHash } : {}
       };
     },
     async prepare(input) {

package/dist/react.d.cts

@@ -1,5 +1,5 @@
 import { CurrencyType } from '@zkp2p/sdk';
-import { s as CashClient, L as EstimateInput, i as CashEstimate, J as CashoutOptions, h as CashoutResult, H as CashoutInput, T as TopUpResult, W as WithdrawResult, e as CashOrder } from './createCashClient-BJmz3v4_.cjs';
+import { s as CashClient, L as EstimateInput, i as CashEstimate, J as CashoutOptions, h as CashoutResult, H as CashoutInput, T as TopUpResult, W as WithdrawResult, e as CashOrder } from './createCashClient-Br7uu4lQ.cjs';
 import { WalletClient } from 'viem';
 import '@relayprotocol/relay-sdk';
 

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import { CurrencyType } from '@zkp2p/sdk';
-import { s as CashClient, L as EstimateInput, i as CashEstimate, J as CashoutOptions, h as CashoutResult, H as CashoutInput, T as TopUpResult, W as WithdrawResult, e as CashOrder } from './createCashClient-BJmz3v4_.js';
+import { s as CashClient, L as EstimateInput, i as CashEstimate, J as CashoutOptions, h as CashoutResult, H as CashoutInput, T as TopUpResult, W as WithdrawResult, e as CashOrder } from './createCashClient-Br7uu4lQ.js';
 import { WalletClient } from 'viem';
 import '@relayprotocol/relay-sdk';
 

package/dist/react.js

@@ -1,4 +1,4 @@
-import { isCashError, CASH_ORDER_POLL_INTERVAL_MS } from './chunk-CSDSJVI7.js';
+import { isCashError, CASH_ORDER_POLL_INTERVAL_MS } from './chunk-4LPWKZMW.js';
 import { useState, useRef, useCallback, useEffect, useMemo } from 'react';
 
 function useEstimate({

package/dist/tools.cjs

@@ -2,7 +2,7 @@
 
 // package.json
 var package_default = {
-  version: "0.4.8"};
+  version: "0.4.9"};
 
 // src/tools/index.ts
 var bigintString = {
@@ -164,7 +164,7 @@ var builtInCashTools = [
   },
   {
     name: "cash_cashout",
-    description: "Start a Base-USDC cash-out using the custody-separated prepare path. Returns UNSIGNED transactions plus same-index steps [approve, createDeposit]; signing and ordered submission stay host-side. For Venmo, Cash App, or PayPal, accessPolicyRequired is true: confirm createDeposit, finalize its receipt, then prepare and submit the access policy with the depositor. For another source asset, complete cash_source_quote and cash_source_status first, then pass the guaranteed Base USDC output amount here.",
+    description: "Start a Base-USDC cash-out using the custody-separated prepare path. Returns UNSIGNED transactions plus same-index steps [approve, createDeposit]; signing and ordered submission stay host-side. If any payout leg is Venmo, Cash App, or PayPal, accessPolicyRequired is true: after createDeposit confirms, the host adapter must call CashClient.finalizePreparedCashout(receipt), then prepare and confirm CashClient.prepareAccessPolicy(depositId) with the depositor. These receipt/signing methods are not separate built-in tools. For another source asset, complete cash_source_quote and cash_source_status first, then pass the guaranteed Base USDC output amount here.",
     inputSchema: {
       type: "object",
       properties: {

package/dist/tools.d.cts

@@ -145,7 +145,7 @@ declare const builtInCashTools: readonly [{
     };
 }, {
     readonly name: "cash_cashout";
-    readonly description: "Start a Base-USDC cash-out using the custody-separated prepare path. Returns UNSIGNED transactions plus same-index steps [approve, createDeposit]; signing and ordered submission stay host-side. For Venmo, Cash App, or PayPal, accessPolicyRequired is true: confirm createDeposit, finalize its receipt, then prepare and submit the access policy with the depositor. For another source asset, complete cash_source_quote and cash_source_status first, then pass the guaranteed Base USDC output amount here.";
+    readonly description: "Start a Base-USDC cash-out using the custody-separated prepare path. Returns UNSIGNED transactions plus same-index steps [approve, createDeposit]; signing and ordered submission stay host-side. If any payout leg is Venmo, Cash App, or PayPal, accessPolicyRequired is true: after createDeposit confirms, the host adapter must call CashClient.finalizePreparedCashout(receipt), then prepare and confirm CashClient.prepareAccessPolicy(depositId) with the depositor. These receipt/signing methods are not separate built-in tools. For another source asset, complete cash_source_quote and cash_source_status first, then pass the guaranteed Base USDC output amount here.";
     readonly inputSchema: {
         readonly type: "object";
         readonly properties: {

package/dist/tools.d.ts

@@ -145,7 +145,7 @@ declare const builtInCashTools: readonly [{
     };
 }, {
     readonly name: "cash_cashout";
-    readonly description: "Start a Base-USDC cash-out using the custody-separated prepare path. Returns UNSIGNED transactions plus same-index steps [approve, createDeposit]; signing and ordered submission stay host-side. For Venmo, Cash App, or PayPal, accessPolicyRequired is true: confirm createDeposit, finalize its receipt, then prepare and submit the access policy with the depositor. For another source asset, complete cash_source_quote and cash_source_status first, then pass the guaranteed Base USDC output amount here.";
+    readonly description: "Start a Base-USDC cash-out using the custody-separated prepare path. Returns UNSIGNED transactions plus same-index steps [approve, createDeposit]; signing and ordered submission stay host-side. If any payout leg is Venmo, Cash App, or PayPal, accessPolicyRequired is true: after createDeposit confirms, the host adapter must call CashClient.finalizePreparedCashout(receipt), then prepare and confirm CashClient.prepareAccessPolicy(depositId) with the depositor. These receipt/signing methods are not separate built-in tools. For another source asset, complete cash_source_quote and cash_source_status first, then pass the guaranteed Base USDC output amount here.";
     readonly inputSchema: {
         readonly type: "object";
         readonly properties: {

package/dist/tools.js

@@ -1,6 +1,6 @@
 // package.json
 var package_default = {
-  version: "0.4.8"};
+  version: "0.4.9"};
 
 // src/tools/index.ts
 var bigintString = {
@@ -162,7 +162,7 @@ var builtInCashTools = [
   },
   {
     name: "cash_cashout",
-    description: "Start a Base-USDC cash-out using the custody-separated prepare path. Returns UNSIGNED transactions plus same-index steps [approve, createDeposit]; signing and ordered submission stay host-side. For Venmo, Cash App, or PayPal, accessPolicyRequired is true: confirm createDeposit, finalize its receipt, then prepare and submit the access policy with the depositor. For another source asset, complete cash_source_quote and cash_source_status first, then pass the guaranteed Base USDC output amount here.",
+    description: "Start a Base-USDC cash-out using the custody-separated prepare path. Returns UNSIGNED transactions plus same-index steps [approve, createDeposit]; signing and ordered submission stay host-side. If any payout leg is Venmo, Cash App, or PayPal, accessPolicyRequired is true: after createDeposit confirms, the host adapter must call CashClient.finalizePreparedCashout(receipt), then prepare and confirm CashClient.prepareAccessPolicy(depositId) with the depositor. These receipt/signing methods are not separate built-in tools. For another source asset, complete cash_source_quote and cash_source_status first, then pass the guaranteed Base USDC output amount here.",
     inputSchema: {
       type: "object",
       properties: {

package/docs/lifecycle-and-recovery.md

@@ -66,15 +66,18 @@ transaction confirms, call `finalizePreparedCashout(receipt)` to decode it with
 the environment-correct escrow ABI and obtain the resumable `CashoutResult`.
 
 The deprecated `requiresAtomicAccessPolicy` capability is always `false`:
-policy attachment is sequential, not atomic. Venmo, Cash App, and PayPal
-cash-outs nevertheless attach Plus, Pro, Peer Makers, and Peer Pay groups by
-default. Signed `cashout()` confirms the deposit before submitting and
-confirming the policy with the same viem wallet, so a brief unprotected interval
-exists. For `prepare()`, `accessPolicyRequired` marks whether the host must call
+policy attachment is sequential, not atomic. If any payout leg uses Venmo,
+Cash App, or PayPal, the cash-out nevertheless restricts intent signaling to
+the Plus, Pro, Peer Makers, and Peer Pay groups by default. Signed `cashout()`
+confirms the deposit before submitting and confirming the policy with the same
+viem wallet, so a brief unprotected interval exists. For `prepare()`,
+`accessPolicyRequired` marks whether the host must call
 `prepareAccessPolicy(depositId)` after finalizing the confirmed deposit receipt.
 Any viem `WalletClient`, including an EOA, can submit it; Privy is not required.
-If the follow-up fails, the deposit already exists. Recover from
-`ACCESS_POLICY_CONFIGURATION_FAILED` and never repeat the cash-out.
+If the follow-up fails, the deposit already exists. Never repeat the cash-out.
+When `ACCESS_POLICY_CONFIGURATION_FAILED.recovery.transactionHash` is present,
+inspect it before preparing another policy; resubmit only when that transaction
+is absent or confirmed reverted.
 
 There is no static chain/token allowlist in Peer Cash. Relay decides source
 support through its metadata and quote execution, filtered to the viem/EVM
@@ -278,8 +281,10 @@ whole life. Two things to know for long-lived orders:
   the payee is re-registered. Format-only platforms (Zelle, Chime, …) are
   never re-checked.
 - **Wise and PayPal** require a signed identity attestation for a new payee
-  registration. A previously registered handle can be reused with bare payee
-  data. If the handle is new and no attestation is supplied, the SDK surfaces
+  registration. The SDK accepts the structured attestation but does not mint
+  it; first-party Peer web obtains it through the Peer TEE browser extension.
+  A previously registered handle can be reused with bare payee data. If the
+  handle is new and no attestation is supplied, the SDK surfaces
   `PAYEE_VERIFICATION_REQUIRED`; `capabilities()` flags these platforms with
   `requiresIdentityAttestation: true`.
 
@@ -300,7 +305,7 @@ explicit override.
 | `INVALID_INTENT_AMOUNT_RANGE`           | no        | Min/max is non-positive, inverted, or exceeds the deposit. Correct the range.                                                                |
 | `INVALID_PAYOUT_CURRENCIES`             | no        | The currency set is empty or contains duplicates. Pass a non-empty unique set from `capabilities()`.                                         |
 | `INVALID_PAYOUT_PLATFORMS`              | no        | The payout leg set is empty or repeats a platform. Pass one leg, or an array of legs using each platform at most once.                       |
-| `PAYEE_VERIFICATION_REQUIRED`           | no        | A new Wise/PayPal payee needs an attestation. Register it through Peer first; an existing registration can be reused.                        |
+| `PAYEE_VERIFICATION_REQUIRED`           | no        | A new Wise/PayPal payee needs an attestation from Peer web and its TEE browser extension; an existing registration can be reused.            |
 | `PAYEE_REGISTRATION_FAILED`             | yes       | Curator rejected the handle or was unavailable. Check `payeeHint` and retry.                                                                 |
 | `ATOMIC_ACCESS_POLICY_REQUIRED`         | no        | Deprecated compatibility code. Current SDK flows never emit it.                                                                              |
 | `SOURCE_ROUTE_UNSUPPORTED_IN_PREPARE`   | no        | `prepare()` accepts Base USDC only. Use signed source execution, or complete Relay first and then prepare the Base cashout.                  |
@@ -320,7 +325,7 @@ explicit override.
 | `TRANSACTION_SUBMISSION_UNKNOWN`        | no        | A Base mutation returned no hash but may have broadcast. Inspect wallet/protocol state and its recovery action before any retry.             |
 | `TRANSACTION_STATUS_UNKNOWN`            | no        | A transaction was submitted but its receipt is unknown. Inspect `recovery.transactionHash` before resubmitting.                              |
 | `DEPOSIT_RESOLUTION_FAILED`             | no        | Base tx succeeded but no `DepositReceived` was decoded. Inspect its logs and recover the composite id.                                       |
-| `ACCESS_POLICY_CONFIGURATION_FAILED`    | no        | Optional policy preparation failed. The cash-out remains valid; retry the opt-in with the same depositor if desired.                         |
+| `ACCESS_POLICY_CONFIGURATION_FAILED`    | no        | The deposit exists but its required policy was not confirmed. Inspect `transactionHash` if present; attach the policy if still needed.       |
 | `INVALID_DEPOSIT_ID`                    | no        | The id is not `escrowAddress_onchainId`. A bare number cannot cold-hydrate; use the value returned by `cashout()`.                           |
 | `ORDER_NOT_FOUND`                       | yes       | Unknown id or immediate indexer lag. Verify the id and retry shortly after creation.                                                         |
 | `INDEXER_LAG`                           | yes       | Indexer trails the chain. Retry the read shortly.                                                                                            |

package/examples/agent-tool-use.ts

@@ -54,7 +54,9 @@ async function executeTool(name: string, args: Record<string, unknown>): Promise
       case 'cash_cashout': {
         // Tool/prepare path: Base USDC only. cash_source_quote is read-only;
         // the host must execute and confirm Relay with its own signer/runtime,
-        // then call this tool with the guaranteed Base USDC amount.
+        // then call this tool with the guaranteed Base USDC amount. Persist
+        // accessPolicyRequired: after createDeposit confirms, the host adapter
+        // calls finalizePreparedCashout(receipt), then prepareAccessPolicy().
         const input = {
           amount: BigInt(args.amount as string),
           receive: args.receive as never,
@@ -108,12 +110,16 @@ const caps = (await executeTool('cash_capabilities', {})) as {
     platform: string;
     currencies: string[];
     payeeHint: string;
+    requiresIdentityAttestation: boolean;
     requiresAtomicAccessPolicy: boolean;
   }[];
 };
 const venmo = caps.platforms.find((p) => p.platform === 'venmo');
 console.log(`agent sees ${caps.platforms.length} platforms; venmo capability:`);
-console.log(`  hint="${venmo?.payeeHint}" atomic=${venmo?.requiresAtomicAccessPolicy}\n`);
+console.log(
+  `  hint="${venmo?.payeeHint}" identityAttestation=${venmo?.requiresIdentityAttestation}`,
+);
+console.log('  sequential access policy is reported by cash_cashout.accessPolicyRequired\n');
 
 const est = await executeTool('cash_estimate', {
   amount: usdc(250).toString(),

package/examples/node-cashout.ts

@@ -10,8 +10,9 @@
  *
  * The curator validates supported handles against the live platform, so the
  * payee must be a real account. A new Wise/PayPal registration also needs the
- * identity attestation created by Peer; an existing registered handle can be
- * reused. This private-key EOA works directly with every supported platform;
+ * identity attestation obtained by Peer web through the Peer TEE browser
+ * extension; an existing registered handle can be reused. This private-key EOA
+ * works directly with every supported platform;
  * no Privy wallet is required. Venmo, Cash App, and PayPal attach their access
  * policy in a confirmed follow-up transaction. Override the demo corridor with:
  *   CASH_PLATFORM=revolut CASH_CURRENCY=EUR CASH_PAYEE=your-revtag

package/llms.txt

@@ -40,7 +40,8 @@ Key facts:
   prepareWithdraw, prepareTopUp) for host-side signing; source-routed cashout
   needs signer-backed Relay execution first. prepare() and the cash_cashout tool
   are Base-USDC-only; cash_source_quote/status do not execute the route.
-  @zkp2p/cash/tools ships a JSON-schema tool manifest.
+  @zkp2p/cash/tools ships a JSON-schema tool manifest. Receipt finalization
+  and policy preparation remain CashClient methods for the host adapter.
 - Errors are typed: { code, retryable, remediation, recovery? }. Completed
   Relay routes retain requestId, flat hashes, and origin/destination
   transactions. Retry Base-only after SOURCE_ROUTE_COMPLETED_CASHOUT_FAILED;
@@ -67,12 +68,17 @@ Key facts:
 - Default path is same-chain Base USDC. Optional `source` on `cashout()` runs
   Relay source-to-Base-USDC first; non-Base source chains require
   `sourceSigner`.
-- Wise and PayPal require attestation for a new payee registration; a
-  previously registered bare handle can be reused.
+- Wise and PayPal require attestation for a new payee registration. The SDK
+  accepts but does not mint it; first-party Peer web obtains it through the
+  Peer TEE browser extension. A previously registered bare handle can be reused.
 - Venmo, Cash App, and PayPal attach Plus, Pro, Peer Makers, and Peer Pay
-  groups after the deposit confirms. The follow-up is intentionally non-atomic;
-  `cashout()` submits it with the same viem wallet, while prepared hosts must
-  act when `accessPolicyRequired` is true. Any EOA works; Privy is not required.
+  groups after the deposit confirms, restricting which takers can signal an
+  intent. If any payout leg uses one of these platforms, the follow-up is
+  intentionally non-atomic; `cashout()` submits it with the same viem wallet,
+  while prepared hosts must act when `accessPolicyRequired` is true. Any EOA
+  works; Privy is not required. On ACCESS_POLICY_CONFIGURATION_FAILED, never
+  repeat the cashout; inspect recovery.transactionHash before resubmitting a
+  policy.
 - Preproduction uses https://api-preprod.zkp2p.xyz by default; staging uses
   https://api-staging.zkp2p.xyz. curatorUrl can override either.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zkp2p/cash",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "description": "Peer Cash - offramp-only SDK for routing crypto to Base USDC, then cashing out to fiat at the live oracle market rate.",
   "license": "MIT",
   "author": "Peer (https://peer.xyz)",
@@ -105,9 +105,9 @@
     "ci": "bun run typecheck && bun run lint && bun run format:check && bun run test && bun run audit && bun run build && bun run pack:check"
   },
   "dependencies": {
-    "@relayprotocol/relay-sdk": "^6.1.3",
+    "@relayprotocol/relay-sdk": "^7.0.1",
     "@zkp2p/sdk": "0.12.0",
-    "zod": "^3.25.76"
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
     "react": ">=18",
@@ -119,19 +119,19 @@
     }
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.5",
+    "@eslint/js": "^10.0.1",
     "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
+    "@types/react": "^19.2.18",
     "@types/react-test-renderer": "19.1.0",
-    "eslint": "^9.39.5",
-    "eslint-config-prettier": "^9.1.2",
-    "prettier": "^3.9.5",
-    "react": "^19.2.7",
-    "react-test-renderer": "19.2.7",
+    "eslint": "^10.8.1",
+    "eslint-config-prettier": "^10.1.8",
+    "prettier": "^3.9.6",
+    "react": "^19.2.8",
+    "react-test-renderer": "19.2.8",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.63.0",
-    "viem": "^2.55.1",
+    "typescript-eslint": "^8.67.0",
+    "viem": "^2.55.15",
     "vitest": "^4.1.10"
   }
 }

package/skills/peer-cash-integration/SKILL.md

@@ -29,6 +29,10 @@ custodial off-ramp provider.
   - anything in your UI or agent output implying a locked rate is a bug.
 - **Custody story.** Funds are held by the protocol contract only. An unmatched
   deposit is withdrawable by the maker at any time. The SDK never holds keys.
+- **Restricted intent signaling.** If any payout leg uses Venmo, Cash App, or
+  PayPal, the Plus, Pro, Peer Makers, and Peer Pay groups attach after the
+  deposit confirms. Signed `cashout()` handles the sequential follow-up with
+  the same viem wallet. Prepared hosts must finish it explicitly; any EOA works.
 - **Honest ETA.** Use `estimate().eta`: `{ seconds, label }` backed by rolling
   30-day indexer data from zero-spread (`spreadBps: 0`) market-rate deposits in
   the same payout corridor, measured from deposit creation to first fill. Do
@@ -67,7 +71,13 @@ const res = await cash.cashout(
   },
   { signer },
 );
-const { txs, steps } = await cash.prepare({/* same input */}); // 2b unsigned plan
+const { txs, steps, accessPolicyRequired } = await cash.prepare({/* same input */}); // 2b unsigned plan
+// Submit txs in order. After createDeposit confirms:
+const prepared = cash.finalizePreparedCashout(createDepositReceipt);
+if (accessPolicyRequired) {
+  const policyTx = cash.prepareAccessPolicy(prepared.depositId);
+  await hostSubmitAndConfirm(policyTx);
+}
 const order = await cash.order(res.depositId); // 3 observe
 const mine = await cash.orders(ownerAddress, { inFlight: true }); // 4 list
 for await (const o of cash.watch(res.depositId)) {
@@ -107,7 +117,10 @@ counterparts. `prepare()` rejects `source`. Source-routed cashout runs Relay
 first; use signed `cashout({ source }, { signer, sourceSigner })`, or execute
 and confirm Relay in the host before preparing a Base-USDC cashout.
 `cash_source_quote` and `cash_source_status` are quote/read tools, not a
-host-side execution path.
+host-side execution path. The built-in tool manifest also does not expose
+receipt finalization or access-policy submission as separate tools; the host
+adapter calls those `CashClient` methods after its signer confirms
+`createDeposit`.
 Every protocol transaction carries ERC-8021 attribution. To receive the
 deposit-level integration share, copy the six-character code from your Peer
 mobile or web referral screen and configure it directly:
@@ -127,9 +140,11 @@ that deposit. Use one referral code per deposit. Renaming the displayed code
 later does not change the owner of an already-attributed open deposit.
 
 Wise and PayPal require an identity attestation for a new payee registration.
-Do not disable them outright: a previously registered handle can be reused
-with bare payee data. Handle `PAYEE_VERIFICATION_REQUIRED` when registration
-is still needed.
+The SDK accepts the structured attestation but does not mint it; first-party
+Peer web obtains it through the Peer TEE browser extension. Do not disable these
+platforms outright: a previously registered handle can be reused with bare
+payee data. Handle `PAYEE_VERIFICATION_REQUIRED` when registration is still
+needed.
 
 ## 4. Order management - indexer-native
 
@@ -167,6 +182,10 @@ those, don't re-derive. The recovery boundaries that matter most in practice:
 - `TRANSACTION_SUBMISSION_UNKNOWN` = a Base mutation returned no hash but may
   have broadcast. Follow `error.recovery`, inspect Base wallet/protocol state,
   and do not retry until absence is proven.
+- `ACCESS_POLICY_CONFIGURATION_FAILED` = the deposit exists but its required
+  policy was not confirmed. Never cash out again. Inspect
+  `error.recovery.transactionHash` when present; prepare another policy only
+  if that transaction is absent or confirmed reverted.
 - `INDEXER_UNAVAILABLE` / `ORACLE_READ_FAILED` = retry the read only. Do not
   repeat the transaction that produced the id or balance being inspected.
 - `SIGNER_CHAIN_MISMATCH` = switch to the required chain and obtain a fresh
@@ -183,7 +202,8 @@ Run against `environment: 'staging'` with a small funded wallet.
 
 Prove both routes without waiting for a buyer:
 
-1. Create a real 1–2 USDC Base-USDC deposit; retain `depositId` and Base tx.
+1. Create a real 1–2 USDC Base-USDC deposit; retain `depositId`, the Base tx,
+   and `accessPolicyTxHash` when using Venmo, Cash App, or PayPal.
 2. Retry through indexer lag until `order(depositId)` is `awaiting-buyer`, and
    assert `orders(owner)` contains it.
 3. Withdraw it; assert `returned` and the Base USDC balance is restored minus