@zkp2p/cash 0.5.4-rc.1 → 0.5.4-rc.2

package/AGENTS.md

@@ -8,7 +8,7 @@ You are integrating Peer Cash: an offramp that routes Relay-supported EVM
 assets or NEAR Intents 1Click external deposits into Base USDC, then converts
 Base USDC to fiat (Venmo, Revolut, Wise, Alipay, Zelle, ...) at a zero-spread
 Chainlink market rate. Existing corridors bind at intent signal; Alipay/CNY
-fixes a fresh Ethereum Chainlink snapshot during deposit preparation. The user whose USDC you
+fixes a fresh Ethereum Chainlink snapshot during deposit preparation; opt-in UPI/INR uses Polygon Chainlink. The user whose USDC you
 manage is the **maker**; a buyer pays them fiat and proves it with TEE-TLS; the
 protocol releases the USDC. Funds are held by the protocol, and only the maker
 can withdraw an unmatched deposit.
@@ -70,10 +70,10 @@ deposit-level integration share instead of applying maker L1/L2.
 - **Venmo, Revolut, Cash App, Monzo** validate the handle against the live
   platform at registration - the account must exist. The rest (Zelle, Chime,
   etc.) are format-checked only. Match handles to the `payeeHint`.
-- **UPI is staging-only and opt-in.** Construct the client with
+- **UPI is staging/preproduction-only and opt-in.** Construct the client with
   `features: { upi: true }`. Any valid UPI ID from any bank can receive; there
   is no seller bank login, extension, identity attestation, or prior
-  registration flow. Buyers currently prove from HDFC Bank through Gmail.
+  registration flow. Buyers pay and verify through Amazon Pay using standard UPI.
 
 ## The loop
 
@@ -196,8 +196,8 @@ const route = await cash.nearIntentsStatus({
 
 - **Respect the declared binding point.** `estimate()` is
   `kind: 'oracle-estimate'`. Its `binding` is `intent-signal` for existing
-  on-chain oracle corridors and `deposit-creation` for Alipay/CNY. Do not call
-  an estimate locked before that point. Once Alipay/CNY is prepared, its fresh
+  on-chain oracle corridors and `deposit-creation` for Alipay/CNY and UPI/INR. Do not call
+  an estimate locked before that point. Once a creation-time corridor is prepared, its fresh
   Chainlink snapshot is the on-chain maker floor.
 - **Do not invent an ETA.** Use `estimate().eta`: `{ seconds, label }` backed
   by the same rolling 30-day, intent-attributed pair sample as `fillStats()`,
@@ -342,4 +342,4 @@ read-only RPC with `upiCreationRateRpcUrl` or `upiCreationRateTransport`.
 Alipay/CNY retains the Ethereum registry and `creationRateRpcUrl` /
 `creationRateTransport`. UPI rejects the wrong chain, invalid rounds, and
 observations older than 24 hours; market closures do not bypass freshness.
-This does not change the staging-only UPI opt-in gate.
+UPI remains opt-in on staging/preproduction and disabled in production.

package/README.md

@@ -4,8 +4,8 @@ Route Relay-supported EVM assets or NEAR Intents 1Click external deposits into
 Base USDC, then cash out to fiat on Venmo, Revolut, Wise, Alipay, Zelle, and
 more at a zero-spread Chainlink market rate with no centralized off-ramp
 provider. Existing corridors bind the live oracle when a buyer signals;
-Alipay/CNY fixes a fresh Ethereum Chainlink snapshot when the SDK prepares the
-deposit.
+Alipay/CNY and opt-in UPI/INR fix fresh Chainlink snapshots when the SDK prepares
+the deposit (Ethereum for CNY; Polygon for INR).
 
 Peer Cash is an **offramp-only** SDK for the [ZKP2P](https://peer.xyz)
 protocol. The cashing-out user is the maker: their USDC becomes a deposit in
@@ -94,16 +94,18 @@ for await (const order of cash.watch(depositId)) {
 }
 ```
 
-### Staging UPI cash-out
+### Staging and preproduction UPI cash-out
 
-UPI is an opt-in staging corridor until the payment method exists in production
-contracts. Any valid UPI ID from any bank can receive a cash-out. The seller
+UPI requires the canonical UPI/INR catalog from `@zkp2p/sdk` 0.14.2-rc.1
+or its approved successor; a missing catalog entry keeps the corridor disabled.
+UPI is an opt-in staging and preproduction corridor. Production remains disabled
+pending rollout review. Any valid UPI ID from any bank can receive a cash-out. The seller
 does not connect a bank account, install an extension, or complete a separate
 registration flow:
 
 ```ts
 const cash = createCashClient({
-  environment: 'staging',
+  environment: 'preproduction',
   features: { upi: true },
 });
 
@@ -116,18 +118,25 @@ await cash.cashout(
 );
 ```
 
-Buyers currently prove UPI payments from HDFC Bank through one-shot, read-only
-Gmail access. That buyer limitation does not restrict which bank issued the
-seller's UPI ID.
+Buyers pay and verify through Amazon Pay using standard UPI. UPI Lite and
+merchant payments are unsupported. The seller may receive at a valid UPI ID
+from any bank.
+
+INR pricing uses the [Chainlink Polygon INR/USD feed](https://data.chain.link/feeds/polygon/mainnet/inr-usd),
+inverted into INR per USDC and fixed at deposit preparation. The SDK rejects
+invalid rounds and readings older than 24 hours, including market-hour gaps.
+Only oracle reads use Polygon; funds and transactions stay on Base. Override
+the Polygon reader with `upiCreationRateTransport` or `upiCreationRateRpcUrl`.
+The existing `creationRateTransport`/`creationRateRpcUrl` options remain Ethereum-only for CNY.
 
 ## Pick the right SDK
 
 Peer Cash and the general ZKP2P SDK serve different integration depths:
 
-| Package       | Use it when                                       | Boundary                                                                                                                                                                                                           |
-| ------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `@zkp2p/cash` | Cash-out is the product                           | Offramp only. The user is always the maker, the destination is Base USDC, pricing is zero-spread Chainlink (signal-time by default; creation-time for Alipay/CNY), and the SDK owns the resumable order lifecycle. |
-| `@zkp2p/sdk`  | You are composing directly with the Peer protocol | General maker and taker operations, deposits, intents, proofs, quotes, vaults, rate managers, referrals, hooks, and API helpers. Your application owns the workflow and protocol choices.                          |
+| Package       | Use it when                                       | Boundary                                                                                                                                                                                                                       |
+| ------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `@zkp2p/cash` | Cash-out is the product                           | Offramp only. The user is always the maker, the destination is Base USDC, pricing is zero-spread Chainlink (signal-time by default; creation-time for Alipay/CNY and UPI/INR), and the SDK owns the resumable order lifecycle. |
+| `@zkp2p/sdk`  | You are composing directly with the Peer protocol | General maker and taker operations, deposits, intents, proofs, quotes, vaults, rate managers, referrals, hooks, and API helpers. Your application owns the workflow and protocol choices.                                      |
 
 Peer Cash is a narrow facade over `@zkp2p/sdk`, not a replacement for it. It
 cannot express custom spreads, buyer-side proof flows, vaults, disputes, or
@@ -177,14 +186,14 @@ mixed historical deposit.
 
 ## Payout rails and access policies
 
-| Payout rail           | Access-policy behavior                                                     | New payee registration                                                                 |
-| --------------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
-| Venmo                 | Peer Pay merchant policy attaches for that payment method                  | Curator validates the live handle                                                      |
-| PayPal                | Same method-scoped Peer Pay follow-up                                      | Requires a Peer TEE browser-extension identity attestation                             |
-| Cash App              | No access-policy follow-up; non-chargebackable and no stake required       | Curator validates the live handle                                                      |
-| Wise                  | No access-policy follow-up                                                 | Requires a Peer TEE browser-extension identity attestation                             |
-| UPI (staging opt-in)  | No access-policy follow-up                                                 | Any valid UPI ID; no account connection or identity attestation                        |
-| Other supported rails | No access-policy follow-up; use `capabilities()` for currencies and format | Follow the `payeeHint`; live-validation behavior is described in the integration guide |
+| Payout rail                  | Access-policy behavior                                                     | New payee registration                                                                 |
+| ---------------------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
+| Venmo                        | Peer Pay merchant policy attaches for that payment method                  | Curator validates the live handle                                                      |
+| PayPal                       | Same method-scoped Peer Pay follow-up                                      | Requires a Peer TEE browser-extension identity attestation                             |
+| Cash App                     | No access-policy follow-up; non-chargebackable and no stake required       | Curator validates the live handle                                                      |
+| Wise                         | No access-policy follow-up                                                 | Requires a Peer TEE browser-extension identity attestation                             |
+| UPI (staging/preprod opt-in) | No access-policy follow-up                                                 | Any valid UPI ID; no account connection or identity attestation                        |
+| Other supported rails        | No access-policy follow-up; use `capabilities()` for currencies and format | Follow the `payeeHint`; live-validation behavior is described in the integration guide |
 
 No platform requires an atomic access-policy flow. `cashout()` and `prepare()`
 work with any viem `WalletClient`, including a local or externally connected
@@ -380,7 +389,7 @@ awaiting-buyer ──────────► matched ───────
   resulting CNY-per-USDC maker floor when it prepares the deposit. A buyer may
   signal at that floor or a better rate for the maker.
 - **Read `binding`.** `estimate().binding` is `intent-signal` by default and
-  `deposit-creation` for Alipay/CNY. An estimate remains approximate until its
+  `deposit-creation` for Alipay/CNY and UPI/INR. An estimate remains approximate until its
   stated binding point.
 - **ETA is historical.** `estimate().eta` is just `{ seconds, label }`, backed
   by the same rolling 30-day, intent-attributed pair sampler as `fillStats()`,
@@ -474,7 +483,7 @@ is the default source and the only destination asset for cashout orders.
 Runnable first-party examples in [`examples/`](examples):
 
 - [`node-cashout.ts`](examples/node-cashout.ts) - server-side cash-out with a private-key signer, plus order tracking.
-- [`upi-staging-cashout.ts`](examples/upi-staging-cashout.ts) - opt-in UPI/INR cash-out to any valid UPI ID on staging.
+- [`upi-staging-cashout.ts`](examples/upi-staging-cashout.ts) - opt-in UPI/INR cash-out to any valid UPI ID on staging or preproduction.
 - [`agent-tool-use.ts`](examples/agent-tool-use.ts) - wiring the verbs into an agent tool-use loop with host-side signing.
 - [`carpe-diem-provider-cashout`](examples/carpe-diem-provider-cashout) - cash out confirmed Carpe Diem provider DIEM revenue through the connected Base wallet.
 - [`mpp-merchant-cashout`](examples/mpp-merchant-cashout) - turn confirmed MPP merchant revenue into an unsigned Peer Cash plan while the merchant keeps custody and signing.
@@ -498,12 +507,3 @@ the package, not the contributor entry point.
 ## License
 
 MIT
-
-UPI/INR reads the live Chainlink Polygon mainnet proxy
-`0xDA0F8Df6F5dB15b346f4B8D1156722027E194E60` (chain 137), inverts
-USD per INR, and rounds the creation-time maker floor up. Configure its
-read-only RPC with `upiCreationRateRpcUrl` or `upiCreationRateTransport`.
-Alipay/CNY retains the Ethereum registry and `creationRateRpcUrl` /
-`creationRateTransport`. UPI rejects the wrong chain, invalid rounds, and
-observations older than 24 hours; market closures do not bypass freshness.
-This does not change the staging-only UPI opt-in gate.

package/dist/index.cjs

@@ -142,26 +142,18 @@ async function readCashCreationRate(publicClient, platform, currency, nowSeconds
 async function readAlipayCnyCreationRate(publicClient, nowSeconds = Math.floor(Date.now() / 1e3)) {
   return readCashCreationRate(publicClient, "alipay", "CNY", nowSeconds);
 }
-var UPI_STAGING_PAYMENT_METHOD_HASH = "0xe99a5081226cbbff9440a63da5caa04fa30f210c12c4dd9976132ac075054cd9";
 function getCashPaymentMethodsCatalog(environment, features = {}) {
   const catalog = sdk.getPaymentMethodsCatalog(8453, environment);
-  if (environment !== "staging" || features.upi !== true || catalog.upi) {
+  if ((environment === "staging" || environment === "preproduction") && features.upi === true) {
     return catalog;
   }
-  return {
-    ...catalog,
-    upi: {
-      paymentMethodHash: UPI_STAGING_PAYMENT_METHOD_HASH,
-      currencies: [sdk.currencyInfo.INR.currencyCodeHash],
-      timestampBuffer: 30,
-      providerHashes: []
-    }
-  };
+  const enabledCatalog = { ...catalog };
+  delete enabledCatalog.upi;
+  return enabledCatalog;
 }
 function resolveCashPaymentMethodHash(processorName, catalog) {
-  const normalized = processorName.trim().toLowerCase();
-  if (normalized === "upi" && catalog.upi) {
-    return catalog.upi.paymentMethodHash;
+  if (processorName.trim().toLowerCase() === "upi" && !catalog.upi) {
+    throw new Error("UPI is not enabled in this environment catalog");
   }
   return sdk.resolvePaymentMethodHashFromCatalog(processorName, catalog);
 }
@@ -665,9 +657,7 @@ function buildCapabilities(environment, features = {}) {
       requiresIdentityAttestation: IDENTITY_ATTESTATION_PLATFORMS.has(platform),
       requiresAtomicAccessPolicy: false
     };
-  }).filter(
-    (p) => p.currencies.length > 0 && (p.platform !== "upi" || environment === "staging" && features.upi === true)
-  ).sort((a, b) => a.platform.localeCompare(b.platform));
+  }).filter((p) => p.currencies.length > 0).sort((a, b) => a.platform.localeCompare(b.platform));
   const currencies = [...new Set(platforms.flatMap((p) => p.currencies))].sort();
   const baseUsdc = { address: BASE_USDC_ADDRESS, symbol: "USDC", decimals: USDC_DECIMALS };
   return {

package/dist/index.d.cts

@@ -255,9 +255,8 @@ declare function buildIntentAmountRange(amount: bigint): {
  *
  * Registers payee details with the curator (no auth), resolves payment-method
  * hashes + the gating service from the catalog, and assembles the override
- * arrays with signal-time oracle configs. Alipay/CNY is the explicit exception:
- * it fixes a fresh Chainlink Ethereum snapshot as the maker floor because Base
- * has no CNY oracle adapter.
+ * arrays with signal-time oracle configs. Alipay/CNY and UPI/INR instead fix
+ * fresh Chainlink snapshots from Ethereum and Polygon as their maker floors.
  */
 declare function prepareCashDepositParams(client: Zkp2pClient, input: CashDepositInput, adapters?: OracleAdapterOverrides, creationRateReader?: CreationRateReader, features?: CashCatalogFeatures): Promise<CreateDepositParamsArg>;
 

package/dist/index.d.ts

@@ -255,9 +255,8 @@ declare function buildIntentAmountRange(amount: bigint): {
  *
  * Registers payee details with the curator (no auth), resolves payment-method
  * hashes + the gating service from the catalog, and assembles the override
- * arrays with signal-time oracle configs. Alipay/CNY is the explicit exception:
- * it fixes a fresh Chainlink Ethereum snapshot as the maker floor because Base
- * has no CNY oracle adapter.
+ * arrays with signal-time oracle configs. Alipay/CNY and UPI/INR instead fix
+ * fresh Chainlink snapshots from Ethereum and Polygon as their maker floors.
  */
 declare function prepareCashDepositParams(client: Zkp2pClient, input: CashDepositInput, adapters?: OracleAdapterOverrides, creationRateReader?: CreationRateReader, features?: CashCatalogFeatures): Promise<CreateDepositParamsArg>;
 

package/dist/index.js

@@ -120,26 +120,18 @@ async function readCashCreationRate(publicClient, platform, currency, nowSeconds
 async function readAlipayCnyCreationRate(publicClient, nowSeconds = Math.floor(Date.now() / 1e3)) {
   return readCashCreationRate(publicClient, "alipay", "CNY", nowSeconds);
 }
-var UPI_STAGING_PAYMENT_METHOD_HASH = "0xe99a5081226cbbff9440a63da5caa04fa30f210c12c4dd9976132ac075054cd9";
 function getCashPaymentMethodsCatalog(environment, features = {}) {
   const catalog = getPaymentMethodsCatalog(8453, environment);
-  if (environment !== "staging" || features.upi !== true || catalog.upi) {
+  if ((environment === "staging" || environment === "preproduction") && features.upi === true) {
     return catalog;
   }
-  return {
-    ...catalog,
-    upi: {
-      paymentMethodHash: UPI_STAGING_PAYMENT_METHOD_HASH,
-      currencies: [currencyInfo.INR.currencyCodeHash],
-      timestampBuffer: 30,
-      providerHashes: []
-    }
-  };
+  const enabledCatalog = { ...catalog };
+  delete enabledCatalog.upi;
+  return enabledCatalog;
 }
 function resolveCashPaymentMethodHash(processorName, catalog) {
-  const normalized = processorName.trim().toLowerCase();
-  if (normalized === "upi" && catalog.upi) {
-    return catalog.upi.paymentMethodHash;
+  if (processorName.trim().toLowerCase() === "upi" && !catalog.upi) {
+    throw new Error("UPI is not enabled in this environment catalog");
   }
   return resolvePaymentMethodHashFromCatalog(processorName, catalog);
 }
@@ -643,9 +635,7 @@ function buildCapabilities(environment, features = {}) {
       requiresIdentityAttestation: IDENTITY_ATTESTATION_PLATFORMS.has(platform),
       requiresAtomicAccessPolicy: false
     };
-  }).filter(
-    (p) => p.currencies.length > 0 && (p.platform !== "upi" || environment === "staging" && features.upi === true)
-  ).sort((a, b) => a.platform.localeCompare(b.platform));
+  }).filter((p) => p.currencies.length > 0).sort((a, b) => a.platform.localeCompare(b.platform));
   const currencies = [...new Set(platforms.flatMap((p) => p.currencies))].sort();
   const baseUsdc = { address: BASE_USDC_ADDRESS, symbol: "USDC", decimals: USDC_DECIMALS };
   return {

package/dist/tools.cjs

@@ -2,7 +2,7 @@
 
 // package.json
 var package_default = {
-  version: "0.5.4-rc.1"};
+  version: "0.5.4-rc.2"};
 
 // src/tools/index.ts
 var bigintString = {

package/dist/tools.js

@@ -1,6 +1,6 @@
 // package.json
 var package_default = {
-  version: "0.5.4-rc.1"};
+  version: "0.5.4-rc.2"};
 
 // src/tools/index.ts
 var bigintString = {

package/examples/upi-staging-cashout.ts

@@ -2,15 +2,19 @@
 import { createCashClient, usdc } from '@zkp2p/cash';
 import type { WalletClient } from 'viem';
 
-export async function cashOutToUpi(signer: WalletClient, upiId: string) {
+export async function cashOutToUpi(
+  signer: WalletClient,
+  upiId: string,
+  environment: 'staging' | 'preproduction' = 'staging',
+) {
   const cash = createCashClient({
-    environment: 'staging',
+    environment,
     features: { upi: true },
   });
 
   const upi = cash.capabilities().platforms.find(({ platform }) => platform === 'upi');
   if (!upi?.currencies.includes('INR')) {
-    throw new Error('UPI is not enabled in this staging SDK build.');
+    throw new Error('UPI is not enabled in this environment.');
   }
 
   return cash.cashout(

package/llms.txt

@@ -25,7 +25,7 @@ Key facts:
   then cash out Base-only. Use EXACT_OUTPUT when the order amount must be fixed.
 - estimate() reports its binding point. Existing corridors bind the on-chain
   oracle when an intent is signaled; Alipay/CNY fixes a fresh Ethereum
-  Chainlink snapshot during deposit preparation. ETA is `{ seconds, label }` from the same rolling
+  Chainlink snapshot during deposit preparation; UPI/INR uses a fresh Polygon Chainlink snapshot. ETA is `{ seconds, label }` from the same rolling
   30-day, intent-attributed pair sampler as fillStats(), not a guarantee.
 - fillStats() returns raw `{ fills, medianFillSeconds? }` evidence keyed by
   `platform:currency` or a sorted set such as `revolut:EUR+GBP+USD`. Set
@@ -38,11 +38,11 @@ Key facts:
   fillStats() separately.
 - capabilities() exposes one Zelle platform. A zelle cashout attaches only the
   generic Zelle payment method to the on-chain deposit.
-- UPI/INR is staging-only and fail-closed. Enable it with
-  `createCashClient({ environment: 'staging', features: { upi: true } })`.
+- UPI/INR is staging/preproduction-only and fail-closed. Enable it with
+  `createCashClient({ environment: 'preproduction', features: { upi: true } })`.
   Any valid UPI ID from any bank can receive without a seller login,
   extension, identity attestation, or prior registration flow. Buyers
-  currently prove HDFC Bank payments through Gmail.
+  pay and verify through Amazon Pay using standard UPI.
 - Resume any order from its depositId alone (composite escrow_onchainId).
 - One unwind verb: withdraw(depositId) - prunes expired intents automatically;
   pass amount for a partial withdrawal of the unlocked balance.
@@ -136,4 +136,4 @@ read-only RPC with `upiCreationRateRpcUrl` or `upiCreationRateTransport`.
 Alipay/CNY retains the Ethereum registry and `creationRateRpcUrl` /
 `creationRateTransport`. UPI rejects the wrong chain, invalid rounds, and
 observations older than 24 hours; market closures do not bypass freshness.
-This does not change the staging-only UPI opt-in gate.
+UPI remains opt-in on staging/preproduction and disabled in production.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zkp2p/cash",
-  "version": "0.5.4-rc.1",
+  "version": "0.5.4-rc.2",
   "description": "Peer Cash - offramp-only SDK for routing Relay or NEAR Intents assets to Base USDC, then cashing out to fiat at zero-spread Chainlink market rates.",
   "license": "MIT",
   "author": "Peer (https://peer.xyz)",

package/skills/peer-cash-integration/SKILL.md

@@ -32,7 +32,7 @@ protocol-held funds and no custodial off-ramp provider.
   `oracleRateConfig { spreadBps: 0 }`; the binding rate is the Chainlink rate
   when a buyer signals. Alipay/CNY is the exception: because Base has no CNY
   oracle adapter, the SDK reads Chainlink CNY/USD on Ethereum and fixes that
-  fresh snapshot as the maker floor during deposit preparation. Read
+  fresh snapshot as the maker floor during deposit preparation. UPI/INR does the same using the direct Polygon INR/USD feed, rejecting wrong-chain, stale and invalid data. Read
   `estimate().binding` and `capabilities().platforms[].pricing`.
 - **Custody story.** Funds are held by the protocol contract only. An unmatched
   deposit is withdrawable by the maker at any time. The SDK never holds keys.
@@ -183,11 +183,11 @@ platforms outright: a previously registered handle can be reused with bare
 payee data. Handle `PAYEE_VERIFICATION_REQUIRED` when registration is still
 needed.
 
-UPI is a staging-only opt-in until production contracts support it. Enable it
-with `features: { upi: true }` on a staging client. Accept any locally valid
+UPI is a staging/preproduction-only opt-in while production rollout awaits review. Enable it
+with `features: { upi: true }` on a staging or preproduction client. Accept any locally valid
 UPI ID from any bank; do not add a seller bank-login, extension, identity
-attestation, or pre-registration step. Buyers currently prove HDFC Bank UPI
-payments through Gmail.
+attestation, or pre-registration step. Buyers pay and verify through Amazon Pay using standard UPI; UPI Lite and
+merchant payments are unsupported.
 
 ## 4. Order management - indexer-native
 
@@ -264,6 +264,8 @@ Prove both routes without waiting for a buyer:
 If withdrawal fails with funds stuck: stop, do not retry blindly, escalate to
 a human with the `depositId` and tx hashes.
 
+## UPI oracle checks
+
 UPI/INR reads the live Chainlink Polygon mainnet proxy
 `0xDA0F8Df6F5dB15b346f4B8D1156722027E194E60` (chain 137), inverts
 USD per INR, and rounds the creation-time maker floor up. Configure its
@@ -271,7 +273,7 @@ read-only RPC with `upiCreationRateRpcUrl` or `upiCreationRateTransport`.
 Alipay/CNY retains the Ethereum registry and `creationRateRpcUrl` /
 `creationRateTransport`. UPI rejects the wrong chain, invalid rounds, and
 observations older than 24 hours; market closures do not bypass freshness.
-This does not change the staging-only UPI opt-in gate.
+UPI remains opt-in on staging/preproduction and disabled in production.
 
 Before a funded UPI QA run, call
 `cash.estimate({ amount: 1000000n, platform: 'upi', currency: 'INR' }, { includeEta: false })`

package/skills/upi-preprod-qa/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: upi-preprod-qa
+description: Verify the Cash SDK Amazon Pay UPI corridor on preproduction, including catalog gates, a small maker deposit, indexing, and cleanup.
+---
+
+# UPI preproduction QA
+
+Use the exact published Cash candidate and record its SDK/contracts versions.
+Require `createCashClient({ environment: 'preproduction', features: { upi: true } })`
+to advertise UPI/INR. Without the flag, and in production even with the flag,
+UPI must be absent and unsigned preparation must reject before registration or rate reads.
+The canonical contracts catalog must contain the live UPI method and INR currency;
+never invent a catalog entry when the package or registry omits one.
+
+From a clean consumer of the candidate, run this catalog check before creating
+any transaction:
+
+```ts
+import { createCashClient } from '@zkp2p/cash';
+
+for (const environment of ['staging', 'preproduction', 'production'] as const) {
+  for (const upi of [false, true]) {
+    const client = createCashClient({ environment, features: { upi } });
+    const method = client.capabilities().platforms.find((item) => item.platform === 'upi');
+    const expected = upi && environment !== 'production';
+    if (Boolean(method?.currencies.includes('INR')) !== expected) {
+      throw new Error(`Unexpected UPI catalog for ${environment}, flag=${upi}`);
+    }
+  }
+}
+```
+
+Use an explicitly authorized low-value wallet and verified recipient UPI ID.
+Keep the identity and operation ledger in ignored private storage, outside this skill.
+`cashout` accepts any valid VPA; no seller bank login or identity attestation is required.
+Verify INR pricing is a fresh Polygon Chainlink snapshot fixed at deposit creation.
+The official [INR/USD feed](https://data.chain.link/feeds/polygon/mainnet/inr-usd)
+is proxy `0xDA0F8Df6F5dB15b346f4B8D1156722027E194E60` on chain 137;
+it is not registered in Ethereum's Feed Registry. Before funding, call
+`cash.estimate({ amount: 5_000_000n, platform: 'upi', currency: 'INR' }, { includeEta: false })`
+against the live default or explicitly configured Polygon RPC. Confirm a positive
+rate, fresh `oracleUpdatedAt`, and `binding: 'deposit-creation'`. Do not accept
+mocked-rate unit tests as proof of a functioning live corridor. The reader must
+reject the wrong chain, invalid/incomplete rounds, future timestamps and data
+older than 86,400 seconds. Forex market-hour gaps must fail closed; do not
+substitute a static price or relax freshness to make QA pass.
+
+With bounded task authorization, create one small Base-USDC deposit, recording
+transaction hash and deposit ID before any retry. Confirm the receipt, then
+`order`/`orders` and the matching preproduction indexer's MethodCurrency and
+QuoteCandidate. Check exact UPI/INR hashes, payee hash, amounts, and rate. Share
+this one fixture with authorized buyer QA instead of funding duplicate deposits.
+Keep quotes within the maker minimum and available liquidity.
+
+Use `examples/upi-staging-cashout.ts` with its explicit `preproduction`
+environment argument as the maker API example. Use the supported Cash client
+methods for signing and finalization; never copy an old escrow address or
+transaction payload. For GraphQL, filter `MethodCurrency` and `QuoteCandidate`
+by the recorded `depositId`, `paymentMethodHash`, and `currencyCode`. Require
+exactly one matching tuple, Base USDC, a positive matching conversion rate,
+`isActive: true`, `hasMinLiquidity: true`, and enough available liquidity.
+Inspect `disputeProtectionRequiresStake` before buyer QA so stake admission is
+not mistaken for a payment-proof failure.
+
+Buyer QA belongs to the client and attestation repositories. Amazon Pay is the
+sole client flow: no HDFC/Gmail selector or fallback copy. Pay with standard UPI
+to a person, then verify from the same Amazon account. Exclude UPI Lite, merchant
+payments and incoming transactions. Keep session evidence encrypted. A real
+intent requires the exact payment identity, allowed payment-time window, and an
+unused payment nullifier. Report maker deposit, buyer signal, evidence proof,
+and settlement as separate checkpoints. Backend HDFC support is retained until
+a separately authorized retirement; do not remove its server routes here.
+
+After buyer intents are cancelled or otherwise terminal, call the supported
+`withdraw` path and verify the receipt and returned order state. If a transaction
+has an unknown result, inspect its receipt and existing deposit before retrying.
+Stop further spending on an unexplained balance or identity mismatch.
+
+Run `bun run ci` for SDK changes. Keep private VPA, cookies, raw receipts, keys, and request
+bodies out of committed evidence; publish only redacted checkpoint results.
+
+## Live order reconstruction regression
+
+After the exact UPI fixture is indexed, require both `cash.order(depositId)` and `cash.orders(owner)` to return it. Fixed UPI/INR creation-rate deposits must have positive fixed-rate evidence and the indexed `peer-cash` attribution marker. Do not classify unrelated Advanced Sell deposits as Cash orders. A quoteable indexer row alone is insufficient: run order lookup, partial-fill observation and withdrawal checks too. Keep the method/currency pair explicit; UPI/CNY must be rejected.
+
+## Small-fixture visibility and dust reconciliation
+
+The web orderbook hides deposits below USD 5 by default. Enable its low-liquidity
+filter before diagnosing an active small fixture as missing. Selector liquidity
+can include a deposit that the orderbook display hides. A verified read-only
+Express `getQuote` accepted INR 10 against a 1 USDC fixture; quoteability still
+depends on the current maker minimum, available liquidity and rate. This does
+not authorize a payment or another fixture, and a quote is not a settlement.
+
+The verified contract dust threshold is 0.1 USDC. A remaining amount below that
+threshold may be collected as protocol dust rather than refunded to the maker.
+Reconcile `DustCollected` events and actual token transfers with the successful
+receipt, buyer proceeds, fees and maker balance. Do not interpret Cash
+`returnedAmount` alone as a maker refund. Confirm the deployed threshold again
+if the contract version changes, and retain exact amounts in private receipts.