@zkp2p/sdk 0.10.0-rc.6 → 0.10.0

package/dist/index.mjs

@@ -1,12 +1,13 @@
-export { ZERO_RATE_MANAGER_ID, classifyDelegationState, getDelegationRoute, isZeroRateManagerId, normalizeRateManagerId, normalizeRegistry } from './chunk-LPJE2MN7.mjs';
+import { IntentGuardianOperations } from './chunk-WXEP544Y.mjs';
+export { TAKER_TIER_CAPS, TAKER_TIER_FEE_DISCOUNT_BPS, TAKER_TIER_ORDER, TAKER_TIER_SCHEDULE, ZERO_RATE_MANAGER_ID, classifyDelegationState, classifyIntentGuardianError, getDelegationRoute, getNextTakerTier, getTakerTierFeeDiscountBps, isZeroRateManagerId, normalizeRateManagerId, normalizeRegistry } from './chunk-WXEP544Y.mjs';
 import { ValidationError, APIError, NetworkError } from './chunk-GHQK65J2.mjs';
 export { APIError, ContractError, ErrorCode, NetworkError, ValidationError, ZKP2PError } from './chunk-GHQK65J2.mjs';
-import { METHOD_NAME_TO_HASH, matchesQuotePaymentMethod, matchesPaymentMethodNameAndHash, getContracts, getRateManagerContracts, getPaymentMethodsCatalog, resolvePaymentMethodHashFromCatalog, getGatingServiceAddress, parseBigIntLike, SUPPORTED_PAYMENT_METHOD_HASHES, resolveFiatCurrencyBytes32, resolvePaymentMethodNameFromHash } from './chunk-3XY3E4VH.mjs';
-export { DEFERRED_SETTLEMENT_FUNDED_EVENT_ABI, ORCHESTRATOR_V3_ABI, PAYMENT_PLATFORMS, RISK_MANAGER_ABI, RISK_POSITION_SETTLED_EVENT_ABI, STAKE_VAULT_ABI, asciiToBytes32, enrichPvDepositView, enrichPvIntentView, ensureBytes32, getContracts, getGatingServiceAddress, getOrchestratorV3Contract, getPaymentMethodsCatalog, getRateManagerContracts, getRiskManagerContract, getStakeVaultContract, parseDepositView, parseIntentView, resolveFiatCurrencyBytes32, resolvePaymentMethodHash, resolvePaymentMethodHashFromCatalog, resolvePaymentMethodNameFromHash } from './chunk-3XY3E4VH.mjs';
+import { METHOD_NAME_TO_HASH, matchesQuotePaymentMethod, matchesPaymentMethodNameAndHash, getContracts, getRateManagerContracts, getPaymentMethodsCatalog, resolvePaymentMethodHashFromCatalog, getGatingServiceAddress, parseBigIntLike, SUPPORTED_PAYMENT_METHOD_HASHES, resolveFiatCurrencyBytes32, resolvePaymentMethodNameFromHash } from './chunk-JRLUSPR3.mjs';
+export { PAYMENT_PLATFORMS, asciiToBytes32, enrichPvDepositView, enrichPvIntentView, ensureBytes32, getContracts, getGatingServiceAddress, getIntentGuardianContract, getPaymentMethodsCatalog, getRateManagerContracts, hasIntentGuardian, parseDepositView, parseIntentView, resolveFiatCurrencyBytes32, resolvePaymentMethodHash, resolvePaymentMethodHashFromCatalog, resolvePaymentMethodNameFromHash } from './chunk-JRLUSPR3.mjs';
 import { Currency, currencyKeccak256 } from './chunk-ZFBH4HD7.mjs';
 export { Currency, currencyInfo, getCurrencyCodeFromHash, getCurrencyInfoFromCountryCode, getCurrencyInfoFromHash, isSupportedCurrencyHash, mapConversionRatesToOnchainMinRate } from './chunk-ZFBH4HD7.mjs';
 import './chunk-J5LGTIGS.mjs';
-import { concatHex, encodeFunctionData, encodeAbiParameters, createPublicClient, http, zeroAddress, formatUnits } from 'viem';
+import { concatHex, encodeFunctionData, encodeAbiParameters, createPublicClient, http, formatUnits } from 'viem';
 import { hardhat, base } from 'viem/chains';
 import { createEncryptedBuyerTeeSessionMaterial as createEncryptedBuyerTeeSessionMaterial$1, createEncryptedSellerCredentialUpload } from '@zkp2p/zkp2p-attestation';
 export { createNitroAttestationClient } from '@zkp2p/zkp2p-attestation';
@@ -153,8 +154,6 @@ var ContractRouter = class {
     this.orchestratorAbi = config.orchestratorAbi;
     this.orchestratorV2Address = config.orchestratorV2Address;
     this.orchestratorV2Abi = config.orchestratorV2Abi;
-    this.orchestratorV3Address = config.orchestratorV3Address;
-    this.orchestratorV3Abi = config.orchestratorV3Abi;
     this.orchestratorAddresses = config.orchestratorAddresses;
     this._registerContexts();
   }
@@ -185,26 +184,24 @@ var ContractRouter = class {
     for (let index = 0; index < configuredPairCount; index += 1) {
       addEscrowOrchestratorPair(this.escrowAddresses[index], this.orchestratorAddresses[index]);
     }
-    const resolveOrchestratorAbi = (address) => this.getOrchestratorContextByAddress(address)?.abi ?? (isSameAddress(address, this.orchestratorV3Address) ? this.orchestratorV3Abi : isSameAddress(address, this.orchestratorV2Address) ? this.orchestratorV2Abi ?? this.orchestratorAbi : this.orchestratorAbi ?? this.orchestratorV2Abi);
+    const resolveOrchestratorAbi = (address) => this.getOrchestratorContextByAddress(address)?.abi ?? (isSameAddress(address, this.orchestratorV2Address) ? this.orchestratorV2Abi ?? this.orchestratorAbi : this.orchestratorAbi ?? this.orchestratorV2Abi);
     const uniqueOrchestratorAddresses = /* @__PURE__ */ new Set();
     for (const address of [
       primaryOrchestratorAddress,
       this.orchestratorAddress,
       this.orchestratorV2Address,
-      this.orchestratorV3Address,
       ...this.orchestratorAddresses
     ]) {
       if (!address) continue;
       const key = address.toLowerCase();
       if (uniqueOrchestratorAddresses.has(key)) continue;
       uniqueOrchestratorAddresses.add(key);
-      const isV3 = isSameAddress(address, this.orchestratorV3Address);
-      const abi = isV3 ? this.orchestratorV3Abi : isSameAddress(address, this.orchestratorV2Address) ? this.orchestratorV2Abi ?? this.orchestratorAbi : this.orchestratorAbi ?? this.orchestratorV2Abi;
+      const abi = isSameAddress(address, this.orchestratorV2Address) ? this.orchestratorV2Abi ?? this.orchestratorAbi : this.orchestratorAbi ?? this.orchestratorV2Abi;
       if (!abi) continue;
       registerOrchestrator({
         address,
         abi,
-        version: isV3 ? "v3" : "v2"
+        version: "v2"
       });
     }
     const uniqueEscrowAddresses = /* @__PURE__ */ new Set();
@@ -820,7 +817,7 @@ async function sendTransactionWithAttribution(walletClient, request, referrer, o
 // src/utils/constants.ts
 var DEFAULT_BASE_API_URL = "https://api.zkp2p.xyz";
 
-// ../../node_modules/.pnpm/@zkp2p+contracts-v2@0.3.0_ethers@6.16.0_bufferutil@4.1.0_utf-8-validate@5.0.10__typescript@5.9.3_zod@4.2.1/node_modules/@zkp2p/contracts-v2/oracleFeeds/chainlink.json
+// ../../node_modules/.pnpm/@zkp2p+contracts-v2@0.4.0-rc.0_ethers@6.16.0_bufferutil@4.1.0_utf-8-validate@5.0.10__typescript@5.9.3_zod@4.2.1/node_modules/@zkp2p/contracts-v2/oracleFeeds/chainlink.json
 var chainlink_default = {
   feeds: [
     {
@@ -1224,12 +1221,7 @@ var IntentOperations = class {
     });
     const currentEscrow = this.config.getEscrowV2Address();
     const currentOrchestrator = this.config.getOrchestratorV2Address();
-    const isOrchestratorV3 = orchestratorContext.version === "v3";
-    const hasPinnedV3Target = isOrchestratorV3 && params.orchestratorAddress !== void 0;
-    if (!hasPinnedV3Target && currentEscrow && escrowContext.address.toLowerCase() !== currentEscrow.toLowerCase()) {
-      throw new Error("signalIntent is only supported on the current EscrowV2 deployment");
-    }
-    if (!isOrchestratorV3 && currentOrchestrator && orchestratorContext.address.toLowerCase() !== currentOrchestrator.toLowerCase()) {
+    if (currentEscrow && escrowContext.address.toLowerCase() !== currentEscrow.toLowerCase() || currentOrchestrator && orchestratorContext.address.toLowerCase() !== currentOrchestrator.toLowerCase()) {
       throw new Error(
         "signalIntent is only supported on the current EscrowV2 / OrchestratorV2 deployment"
       );
@@ -1249,7 +1241,7 @@ var IntentOperations = class {
     let { gatingServiceSignature, signatureExpiration } = params;
     let preIntentHookData = params.preIntentHookData;
     const baseApiUrl = this.config.getBaseApiUrl();
-    if (!isOrchestratorV3 && (!gatingServiceSignature || !signatureExpiration) && baseApiUrl) {
+    if ((!gatingServiceSignature || !signatureExpiration) && baseApiUrl) {
       const apiOpts = {
         baseApiUrl,
         apiKey: this.config.getApiKey(),
@@ -1297,10 +1289,7 @@ var IntentOperations = class {
         });
       }
     }
-    if (isOrchestratorV3) {
-      gatingServiceSignature = "0x";
-      signatureExpiration = 0n;
-    } else if (!gatingServiceSignature || !signatureExpiration) {
+    if (!gatingServiceSignature || !signatureExpiration) {
       throw new Error("Missing gatingServiceSignature/signatureExpiration");
     }
     const args = [
@@ -1980,7 +1969,7 @@ var ProtocolViewerReader = class {
       if (inputCount === null) {
         throw new Error("Configured ProtocolViewer ABI does not expose getDeposit");
       }
-      const { parseDepositView: parseDepositView2 } = await import('./protocolViewerParsers-HMOHJWSP.mjs');
+      const { parseDepositView: parseDepositView2 } = await import('./protocolViewerParsers-QMHI74AA.mjs');
       if (inputCount >= 3) {
         return tryContexts(
           protocolViewerContexts,
@@ -2059,7 +2048,7 @@ var ProtocolViewerReader = class {
       return Promise.all(ids.map((id) => this.config.host.getPvDepositById(id)));
     }
     const bn = ids.map((id) => typeof id === "bigint" ? id : parseRawDepositId(id));
-    const { parseDepositView: parseDepositView2 } = await import('./protocolViewerParsers-HMOHJWSP.mjs');
+    const { parseDepositView: parseDepositView2 } = await import('./protocolViewerParsers-QMHI74AA.mjs');
     if (inputCount >= 2) {
       const requests = ids.map((id, index) => ({
         index,
@@ -2164,7 +2153,7 @@ var ProtocolViewerReader = class {
     if (!protocolViewerAddress || !protocolViewerAbi || inputCount === null) {
       return this.config.host.getPvAccountDepositsFromIndexer(owner);
     }
-    const { parseDepositView: parseDepositView2 } = await import('./protocolViewerParsers-HMOHJWSP.mjs');
+    const { parseDepositView: parseDepositView2 } = await import('./protocolViewerParsers-QMHI74AA.mjs');
     const { address, abi } = this.config.host.requireProtocolViewer();
     if (inputCount >= 2) {
       const readAndFilter = async (raw2) => {
@@ -2235,7 +2224,7 @@ var ProtocolViewerReader = class {
     if (protocolViewerEntries.length === 0) {
       throw new Error("ProtocolViewer not available for this network");
     }
-    const { parseIntentView: parseIntentView2 } = await import('./protocolViewerParsers-HMOHJWSP.mjs');
+    const { parseIntentView: parseIntentView2 } = await import('./protocolViewerParsers-QMHI74AA.mjs');
     const intentsByHash = /* @__PURE__ */ new Map();
     let attemptedRead = false;
     let hadSuccessfulRead = false;
@@ -2343,7 +2332,7 @@ var ProtocolViewerReader = class {
     if (protocolViewerEntries.length === 0) {
       throw new Error("ProtocolViewer not available for this network");
     }
-    const { parseIntentView: parseIntentView2 } = await import('./protocolViewerParsers-HMOHJWSP.mjs');
+    const { parseIntentView: parseIntentView2 } = await import('./protocolViewerParsers-QMHI74AA.mjs');
     let lastError;
     for (const pvEntry of protocolViewerEntries) {
       const inputCount = this.pvEntryFunctionInputCount(pvEntry, "getIntent");
@@ -4537,32 +4526,13 @@ async function apiGetOwnerDeposits(req, apiKey, baseApiUrl, authToken, timeoutMs
     statusCode: 200
   };
 }
-async function apiGetTakerStake(req, baseApiUrl, timeoutMs) {
-  if (!isValidHexAddress(req.owner)) {
-    throw new ValidationError("owner must be a valid Ethereum address", "owner");
-  }
+async function apiGetTakerTier(req, baseApiUrl, timeoutMs) {
   const normalizedOwner = req.owner.toLowerCase();
   const query = new URLSearchParams({
     owner: normalizedOwner,
     chainId: String(req.chainId)
   });
-  const endpoint = `/v2/taker/stake?${query.toString()}`;
-  return apiFetch({
-    url: `${withApiBase(baseApiUrl)}${endpoint}`,
-    method: "GET",
-    timeoutMs
-  });
-}
-async function apiGetTakerCapacity(req, baseApiUrl, timeoutMs) {
-  if (!isValidHexAddress(req.owner)) {
-    throw new ValidationError("owner must be a valid Ethereum address", "owner");
-  }
-  const normalizedOwner = req.owner.toLowerCase();
-  const query = new URLSearchParams({
-    owner: normalizedOwner,
-    chainId: String(req.chainId)
-  });
-  const endpoint = `/v2/taker/capacity?${query.toString()}`;
+  const endpoint = `/v2/taker/tier?${query.toString()}`;
   return apiFetch({
     url: `${withApiBase(baseApiUrl)}${endpoint}`,
     method: "GET",
@@ -5288,74 +5258,209 @@ var VaultOperations = class {
 var getRateManagerReadFunction = (abi, functionName) => Array.isArray(abi) && abi.some(
   (item) => item.type === "function" && item.name === functionName
 );
-var StakeOperations = class {
+
+// src/client/AccessPolicyOperations.ts
+var AccessPolicyUnsupportedError = class extends Error {
+  constructor(contract) {
+    super(`${contract} is not deployed for this environment.`);
+    this.name = "AccessPolicyUnsupportedError";
+  }
+};
+var AccessPolicyOperations = class {
   constructor(config) {
     this.config = config;
   }
-  getContract() {
-    const address = this.config.getStakeVaultAddress();
-    const abi = this.config.getStakeVaultAbi();
-    const stakeToken = this.config.getStakeTokenAddress();
-    if (!address || !abi || !stakeToken) {
-      throw new Error("StakeVault not available for this chain/environment");
-    }
-    return { address, abi, stakeToken };
+  get isSupported() {
+    return Boolean(
+      this.config.getPolicyAddress() && this.config.getPolicyAbi() && this.config.getRegistryAddress() && this.config.getRegistryAbi()
+    );
+  }
+  requirePolicy() {
+    const address = this.config.getPolicyAddress();
+    const abi = this.config.getPolicyAbi();
+    if (!address || !abi) throw new AccessPolicyUnsupportedError("WhitelistPolicy");
+    return { address, abi };
+  }
+  requireRegistry() {
+    const address = this.config.getRegistryAddress();
+    const abi = this.config.getRegistryAbi();
+    if (!address || !abi) throw new AccessPolicyUnsupportedError("AddressGroupRegistry");
+    return { address, abi };
+  }
+  /* ============ Reads ============ */
+  async isEnabled(params) {
+    const { address, abi } = this.requirePolicy();
+    return await this.config.getPublicClient().readContract({
+      address,
+      abi,
+      functionName: "enabled",
+      args: [params.escrow, params.depositId]
+    });
+  }
+  /** Groups are enumerable onchain; direct addresses deliberately are not. */
+  async getAllowedGroups(params) {
+    const { address, abi } = this.requirePolicy();
+    return await this.config.getPublicClient().readContract({
+      address,
+      abi,
+      functionName: "getAllowedGroups",
+      args: [params.escrow, params.depositId]
+    });
+  }
+  /**
+   * Point check for one address. There is no enumeration getter, so this can
+   * confirm a known address but can never reconstruct a missing list.
+   */
+  async isWhitelisted(params) {
+    const { address, abi } = this.requirePolicy();
+    return await this.config.getPublicClient().readContract({
+      address,
+      abi,
+      functionName: "isWhitelisted",
+      args: [params.escrow, params.depositId, params.taker]
+    });
+  }
+  async maxGroupsPerDeposit() {
+    const { address, abi } = this.requirePolicy();
+    return await this.config.getPublicClient().readContract({
+      address,
+      abi,
+      functionName: "MAX_GROUPS_PER_DEPOSIT"
+    });
+  }
+  async groupExists(groupId) {
+    const { address, abi } = this.requireRegistry();
+    return await this.config.getPublicClient().readContract({
+      address,
+      abi,
+      functionName: "groupExists",
+      args: [groupId]
+    });
+  }
+  /** Curated membership OR resolver. Resolver failures fail closed. */
+  async isMember(params) {
+    const { address, abi } = this.requireRegistry();
+    return await this.config.getPublicClient().readContract({
+      address,
+      abi,
+      functionName: "isMember",
+      args: [params.groupId, params.account]
+    });
   }
-  read(functionName, args = []) {
-    const { address, abi } = this.getContract();
-    return this.config.getPublicClient().readContract({
+  /* ============ Prepareable writes ============ */
+  preparePolicyCall(functionName, args, txOverrides) {
+    const { address, abi } = this.requirePolicy();
+    return this.config.prepareContractTransaction({
       address,
       abi,
       functionName,
-      args
+      args,
+      txOverrides
     });
   }
-  getStakeBalance(stakeOwner) {
-    return this.read("stakeBalance", [stakeOwner]);
+  prepareConfigureDeposit(params) {
+    return this.preparePolicyCall(
+      "configureDeposit",
+      [params.escrow, params.depositId, params.enabled, params.groupIds, params.takers],
+      params.txOverrides
+    );
   }
-  getLockedStake(stakeOwner) {
-    return this.read("lockedStake", [stakeOwner]);
+  prepareSetEnabled(params) {
+    return this.preparePolicyCall(
+      "setEnabled",
+      [params.escrow, params.depositId, params.enabled],
+      params.txOverrides
+    );
   }
-  getFreeStake(stakeOwner) {
-    return this.read("freeStake", [stakeOwner]);
+  prepareAddAllowedGroups(params) {
+    return this.preparePolicyCall(
+      "addAllowedGroups",
+      [params.escrow, params.depositId, params.groupIds],
+      params.txOverrides
+    );
   }
-  getClaimable(beneficiary) {
-    return this.read("claimable", [beneficiary]);
+  prepareRemoveAllowedGroups(params) {
+    return this.preparePolicyCall(
+      "removeAllowedGroups",
+      [params.escrow, params.depositId, params.groupIds],
+      params.txOverrides
+    );
   }
-  getStakeOwner(taker) {
-    return this.read("stakeOwnerOf", [taker]);
+  prepareAddWhitelistedAddresses(params) {
+    return this.preparePolicyCall(
+      "addWhitelistedAddresses",
+      [params.escrow, params.depositId, params.takers],
+      params.txOverrides
+    );
   }
-  getSelectedStakeOwner(taker) {
-    return this.read("selectedStakeOwner", [taker]);
+  prepareRemoveWhitelistedAddresses(params) {
+    return this.preparePolicyCall(
+      "removeWhitelistedAddresses",
+      [params.escrow, params.depositId, params.takers],
+      params.txOverrides
+    );
   }
-  getTakerAuthorization(stakeOwner, taker) {
-    return this.read("authorizedTakers", [stakeOwner, taker]);
+  /** Encodes one planner step. */
+  preparePlanStep(params) {
+    const { escrow, depositId, step, txOverrides } = params;
+    switch (step.kind) {
+      case "configureDeposit":
+        return this.prepareConfigureDeposit({
+          escrow,
+          depositId,
+          enabled: step.enabled,
+          groupIds: step.groupIds,
+          takers: step.takers,
+          txOverrides
+        });
+      case "setEnabled":
+        return this.prepareSetEnabled({ escrow, depositId, enabled: step.enabled, txOverrides });
+      case "addAllowedGroups":
+        return this.prepareAddAllowedGroups({
+          escrow,
+          depositId,
+          groupIds: step.groupIds,
+          txOverrides
+        });
+      case "removeAllowedGroups":
+        return this.prepareRemoveAllowedGroups({
+          escrow,
+          depositId,
+          groupIds: step.groupIds,
+          txOverrides
+        });
+      case "addWhitelistedAddresses":
+        return this.prepareAddWhitelistedAddresses({
+          escrow,
+          depositId,
+          takers: step.takers,
+          txOverrides
+        });
+      case "removeWhitelistedAddresses":
+        return this.prepareRemoveWhitelistedAddresses({
+          escrow,
+          depositId,
+          takers: step.takers,
+          txOverrides
+        });
+    }
   }
-  async getStakeVaultState(params) {
-    const taker = params.taker ?? params.staker;
-    const { stakeToken } = this.getContract();
-    const [stakeOwner, rawSelection, staked, locked, free, claimable] = await Promise.all([
-      this.getStakeOwner(taker),
-      this.getSelectedStakeOwner(taker),
-      this.getStakeBalance(params.staker),
-      this.getLockedStake(params.staker),
-      this.getFreeStake(params.staker),
-      this.getClaimable(params.staker)
-    ]);
-    const selectedStakeOwner = rawSelection === zeroAddress ? null : rawSelection;
-    const selectionAuthorized = selectedStakeOwner ? await this.getTakerAuthorization(selectedStakeOwner, taker) : false;
-    return {
-      staker: params.staker,
-      taker,
-      stakeToken,
-      stakeOwner,
-      selectedStakeOwner,
-      selectionAuthorized,
-      staked,
-      locked,
-      free,
-      claimable
-    };
+  /**
+   * Encodes a whole plan, in order.
+   *
+   * A plan with violations encodes to nothing: an invalid draft must be
+   * rejected before a wallet is ever opened.
+   */
+  preparePlan(params) {
+    if (params.plan.violations.length > 0) return [];
+    return params.plan.steps.map(
+      (step) => this.preparePlanStep({
+        escrow: params.escrow,
+        depositId: params.depositId,
+        step,
+        txOverrides: params.txOverrides
+      })
+    );
   }
 };
 
@@ -6418,45 +6523,6 @@ var Zkp2pClient = class {
    * @throws Error if walletClient is missing an account
    */
   constructor(opts) {
-    /** Deposit USDC stake owned by the transaction sender. */
-    this.depositStake = this.buildStakeVaultMethod(
-      "depositStake",
-      (params) => [params.amount]
-    );
-    /** Withdraw the sender's free stake immediately; locked stake cannot move. */
-    this.withdrawStake = this.buildStakeVaultMethod(
-      "withdrawStake",
-      (params) => [params.amount]
-    );
-    /** Withdraw the sender's complete claimable USDC balance. */
-    this.claim = this.buildStakeVaultMethod("claim", () => []);
-    /** Grant or revoke a taker's access to the sender's stake. */
-    this.setTakerAuthorization = this.buildStakeVaultMethod("setTakerAuthorization", (params) => [params.taker, params.authorized]);
-    /** Select the authorizing stake owner that backs the connected taker. */
-    this.selectStakeOwner = this.buildStakeVaultMethod(
-      "selectStakeOwner",
-      (params) => [params.stakeOwner]
-    );
-    /** Clear the connected taker's selection and return to self-stake. */
-    this.clearStakeOwner = this.buildStakeVaultMethod(
-      "clearStakeOwner",
-      () => []
-    );
-    /**
-     * Release one or more RiskManager positions whose chargeback window matured.
-     * Pass `riskManagerAddress` to pin the transaction to a snapshotted deployment.
-     */
-    this.releaseMaturedPositions = this.buildRiskManagerMethod("releaseMaturedPositions", (params) => [params.intentHashes]);
-    /**
-     * Reconcile one failed OrchestratorV3 cancellation callback.
-     * Pass `riskManagerAddress` to pin the transaction to a snapshotted deployment.
-     */
-    this.reconcileCancellation = this.buildRiskManagerMethod("reconcileCancellation", (params) => [params.intentHash]);
-    /**
-     * Reconcile multiple failed OrchestratorV3 cancellation callbacks.
-     * Pass `riskManagerAddress` to pin the transaction to a snapshotted deployment.
-     */
-    this.reconcileCancellations = this.buildRiskManagerMethod("reconcileCancellations", (params) => [params.intentHashes]);
     // ╔═══════════════════════════════════════════════════════════════════════════╗
     // ║ CORE: DEPOSIT MANAGEMENT                                                 ║
     // ╚═══════════════════════════════════════════════════════════════════════════╝
@@ -6756,6 +6822,30 @@ var Zkp2pClient = class {
         }
       }
     );
+    /**
+     * Pay to extend a live intent through the standalone prepaid IntentGuardian.
+     *
+     * Payment is prepaid and non-refundable and transfers to the deposit owner,
+     * not the protocol. Any account may pay for any live intent — the payer does
+     * not have to be the taker — so the deposit token must be approved to the
+     * guardian by whoever signs this.
+     *
+     * `maxCost` is required slippage protection: the guardian fee is
+     * owner-governed and may change between quoting and execution, in which case
+     * the call reverts with ExtensionCostExceedsMax instead of overcharging.
+     * Never pass an unbounded maximum.
+     *
+     * Escrow still enforces the cumulative intent lifetime cap; the guardian does
+     * not bypass it. After confirmation, refetch the intent — canonical expiry
+     * comes from Escrow's IntentExpiryExtended event, not from guardian events.
+     */
+    this.extendIntentLifetime = this.buildIntentGuardianMethod("extendIntent", (params) => [
+      params.escrow,
+      params.depositId,
+      params.intentHash,
+      params.additionalTime,
+      params.maxCost
+    ]);
     /**
      * Update vault manager fee.
      */
@@ -7315,8 +7405,6 @@ var Zkp2pClient = class {
     this.escrowV2Abi = abis.escrowV2 ?? abis.escrow;
     this.orchestratorV2Address = toAddress(addresses.orchestratorV2 ?? addresses.orchestrator);
     this.orchestratorV2Abi = abis.orchestratorV2 ?? abis.orchestrator;
-    this.orchestratorV3Address = toAddress(addresses.orchestratorV3);
-    this.orchestratorV3Abi = abis.orchestratorV3;
     const configuredEscrowAddresses = (addresses.escrowAddresses ?? []).map((value) => toAddress(value)).filter((value) => Boolean(value));
     const configuredOrchestratorAddresses = (addresses.orchestratorAddresses ?? []).map((value) => toAddress(value)).filter((value) => Boolean(value));
     this.escrowAddresses = uniqAddresses([
@@ -7330,7 +7418,6 @@ var Zkp2pClient = class {
     }
     this.orchestratorAddresses = uniqAddresses([
       this.orchestratorV2Address ?? toAddress(addresses.orchestrator),
-      this.orchestratorV3Address,
       ...configuredOrchestratorAddresses
     ]);
     this.orchestratorAddress = this.orchestratorV2Address ?? toAddress(addresses.orchestrator) ?? this.orchestratorAddresses[0];
@@ -7354,14 +7441,16 @@ var Zkp2pClient = class {
     this.rateManagerV1Abi = abis.rateManagerV1;
     this.orchestratorRegistryAddress = toAddress(addresses.orchestratorRegistry);
     this.orchestratorRegistryAbi = abis.orchestratorRegistry;
+    this.addressGroupRegistryAddress = toAddress(addresses.addressGroupRegistry);
+    this.addressGroupRegistryAbi = abis.addressGroupRegistry;
+    this.whitelistPolicyAddress = toAddress(addresses.whitelistPolicy);
+    this.whitelistPolicyAbi = abis.whitelistPolicy;
     this.rateManagerRegistryAddress = toAddress(addresses.rateManagerRegistry) ?? this.rateManagerV1Address;
     this.rateManagerRegistryAbi = abis.rateManagerRegistry ?? this.rateManagerV1Abi;
     this.rateManagerControllerAddress = toAddress(addresses.rateManagerController);
     this.rateManagerControllerAbi = abis.rateManagerController;
-    this.stakeVaultAddress = toAddress(addresses.stakeVault);
-    this.stakeVaultAbi = abis.stakeVault;
-    this.riskManagerAddress = toAddress(addresses.riskManager);
-    this.riskManagerAbi = abis.riskManager;
+    this.intentGuardianAddress = toAddress(addresses.intentGuardian);
+    this.intentGuardianAbi = abis.intentGuardian;
     if (!this.rateManagerRegistryAddress || !this.rateManagerRegistryAbi) {
       try {
         const rateManagerContracts = getRateManagerContracts(this.chainId, this.runtimeEnv);
@@ -7387,8 +7476,6 @@ var Zkp2pClient = class {
       orchestratorAbi: this.orchestratorAbi,
       orchestratorV2Address: this.orchestratorV2Address,
       orchestratorV2Abi: this.orchestratorV2Abi,
-      orchestratorV3Address: this.orchestratorV3Address,
-      orchestratorV3Abi: this.orchestratorV3Abi,
       orchestratorAddresses: this.orchestratorAddresses
     });
     if (addresses.usdc) this._usdcAddress = addresses.usdc;
@@ -7444,11 +7531,10 @@ var Zkp2pClient = class {
         prepareContractTransaction: (tx) => this.prepareContractTransaction(tx)
       }
     });
-    this._stakeOps = new StakeOperations({
+    this._intentGuardianOps = new IntentGuardianOperations({
       getPublicClient: () => this.publicClient,
-      getStakeVaultAddress: () => this.stakeVaultAddress,
-      getStakeVaultAbi: () => this.stakeVaultAbi,
-      getStakeTokenAddress: () => this._usdcAddress
+      getGuardianAddress: () => this.intentGuardianAddress,
+      getGuardianAbi: () => this.intentGuardianAbi
     });
     this._intentOps = new IntentOperations({
       getWalletClient: () => this.walletClient,
@@ -7473,6 +7559,14 @@ var Zkp2pClient = class {
         getPvIntent: (intentHash) => this.getPvIntent(intentHash)
       }
     });
+    this._accessPolicyOps = new AccessPolicyOperations({
+      getPublicClient: () => this.publicClient,
+      getPolicyAddress: () => this.whitelistPolicyAddress,
+      getPolicyAbi: () => this.whitelistPolicyAbi,
+      getRegistryAddress: () => this.addressGroupRegistryAddress,
+      getRegistryAbi: () => this.addressGroupRegistryAbi,
+      prepareContractTransaction: (tx) => this.prepareContractTransaction(tx)
+    });
     this._referralOps = new ReferralAccountOperations({
       getWalletClient: () => this.walletClient,
       getChainId: () => this.chainId,
@@ -7680,13 +7774,10 @@ var Zkp2pClient = class {
     const explicit = this.getOrchestratorContextByAddress(options?.orchestratorAddress);
     if (explicit) return explicit;
     if (options?.orchestratorAddress) {
-      const abi = this.orchestratorV3Abi ?? this.orchestratorAbi ?? this.orchestratorV2Abi;
+      const addr = options.orchestratorAddress;
+      const abi = this.orchestratorV2Abi ?? this.orchestratorAbi;
       if (!abi) throw new Error("Orchestrator not available");
-      return {
-        address: options.orchestratorAddress,
-        abi,
-        version: this.orchestratorV3Abi ? "v3" : "v2"
-      };
+      return { address: addr, abi, version: "v2" };
     }
     if (options?.intentHash) {
       try {
@@ -7872,7 +7963,7 @@ var Zkp2pClient = class {
   buildContractMethod(resolveContract, functionName, buildArgs, buildValue) {
     return Object.assign(
       async (params) => {
-        const contract = resolveContract(params);
+        const contract = resolveContract();
         if (!contract.address || !contract.abi) {
           throw new Error(`${contract.label} not available`);
         }
@@ -7888,7 +7979,7 @@ var Zkp2pClient = class {
       },
       {
         prepare: async (params) => {
-          const contract = resolveContract(params);
+          const contract = resolveContract();
           if (!contract.address || !contract.abi) {
             throw new Error(`${contract.label} not available`);
           }
@@ -7910,23 +8001,12 @@ var Zkp2pClient = class {
       }
     );
   }
-  buildStakeVaultMethod(functionName, buildArgs) {
+  buildIntentGuardianMethod(functionName, buildArgs) {
     return this.buildContractMethod(
       () => ({
-        address: this.stakeVaultAddress,
-        abi: this.stakeVaultAbi,
-        label: "StakeVault"
-      }),
-      functionName,
-      buildArgs
-    );
-  }
-  buildRiskManagerMethod(functionName, buildArgs) {
-    return this.buildContractMethod(
-      (params) => ({
-        address: params.riskManagerAddress ?? this.riskManagerAddress,
-        abi: this.riskManagerAbi,
-        label: "RiskManager"
+        address: this.intentGuardianAddress,
+        abi: this.intentGuardianAbi,
+        label: "IntentGuardian"
       }),
       functionName,
       buildArgs
@@ -8389,76 +8469,6 @@ var Zkp2pClient = class {
     });
     return { hadAllowance: false, hash };
   }
-  // ╔═══════════════════════════════════════════════════════════════════════════╗
-  // ║ CORE: TAKER STAKING                                                      ║
-  // ╚═══════════════════════════════════════════════════════════════════════════╝
-  /**
-   * Return the resolved StakeVault coordinates for advanced wallet, relayer,
-   * or reactive read integrations.
-   */
-  getStakeVaultContract() {
-    return this._stakeOps.getContract();
-  }
-  /** Return the resolved OrchestratorV3 coordinates for advanced integrations. */
-  getOrchestratorV3Contract() {
-    if (!this.orchestratorV3Address || !this.orchestratorV3Abi) {
-      throw new Error("OrchestratorV3 not available for this chain/environment");
-    }
-    return { address: this.orchestratorV3Address, abi: this.orchestratorV3Abi };
-  }
-  /** Return the resolved RiskManager coordinates for keeper integrations. */
-  getRiskManagerContract() {
-    if (!this.riskManagerAddress || !this.riskManagerAbi) {
-      throw new Error("RiskManager not available for this chain/environment");
-    }
-    return { address: this.riskManagerAddress, abi: this.riskManagerAbi };
-  }
-  /**
-   * Ensure the connected wallet has approved enough USDC for StakeVault.
-   * If an approval is submitted, wait for it to confirm before depositing.
-   */
-  async ensureStakeAllowance(params) {
-    const { address, stakeToken } = this._stakeOps.getContract();
-    return this.ensureAllowance({
-      token: stakeToken,
-      spender: address,
-      amount: params.amount,
-      maxApprove: params.maxApprove,
-      txOverrides: params.txOverrides
-    });
-  }
-  /** Read total stake owned by an address directly from StakeVault. */
-  getStakeBalance(stakeOwner) {
-    return this._stakeOps.getStakeBalance(stakeOwner);
-  }
-  /** Read stake committed to active RiskManager locks. */
-  getLockedStake(stakeOwner) {
-    return this._stakeOps.getLockedStake(stakeOwner);
-  }
-  /** Read stake available for immediate withdrawal or a new lock. */
-  getFreeStake(stakeOwner) {
-    return this._stakeOps.getFreeStake(stakeOwner);
-  }
-  /** Read the non-stake USDC withdrawable by a beneficiary with `claim()`. */
-  getClaimable(beneficiary) {
-    return this._stakeOps.getClaimable(beneficiary);
-  }
-  /** Resolve the effective stake owner backing a taker. */
-  getStakeOwner(taker) {
-    return this._stakeOps.getStakeOwner(taker);
-  }
-  /** Read a taker's raw selection, which is stale once authorization is revoked. */
-  getSelectedStakeOwner(taker) {
-    return this._stakeOps.getSelectedStakeOwner(taker);
-  }
-  /** Read whether a stake owner currently authorizes a taker. */
-  getTakerAuthorization(stakeOwner, taker) {
-    return this._stakeOps.getTakerAuthorization(stakeOwner, taker);
-  }
-  /** Read the complete authoritative StakeVault state needed by a staking UI. */
-  getStakeVaultState(params) {
-    return this._stakeOps.getStakeVaultState(params);
-  }
   /**
    * Registers payee details with the curator API and returns hashed on-chain IDs.
    *
@@ -8694,6 +8704,31 @@ var Zkp2pClient = class {
     });
     return { depositDetails, prepared };
   }
+  /**
+   * Live guardian policy, including whether governance has disabled extensions
+   * by setting the fee to zero. Read this rather than caching a fee value.
+   */
+  async getIntentGuardianPolicy() {
+    return this._intentGuardianOps.getPolicy();
+  }
+  /**
+   * Authoritative on-chain extension quote. Call immediately before signing and
+   * derive `maxCost` from the result — a displayed quote is never a commitment.
+   */
+  async quoteIntentExtension(params) {
+    return this._intentGuardianOps.quoteExtensionCost(params);
+  }
+  /**
+   * Payer allowance/balance against the guardian for the target deposit token.
+   * The guardian charges `deposit.token`, which is not necessarily USDC.
+   */
+  async getIntentGuardianPayerFunding(params) {
+    return this._intentGuardianOps.getPayerFunding(params);
+  }
+  /** True when this deployment has a usable guardian. Gate UI on this. */
+  hasIntentGuardian() {
+    return this._intentGuardianOps.isAvailable();
+  }
   /**
    * Read controller delegation state for a deposit.
    */
@@ -8728,6 +8763,16 @@ var Zkp2pClient = class {
   async prepareReleaseFundsToPayer(params) {
     return this._intentOps.prepareReleaseFundsToPayer(params);
   }
+  /**
+   * Deposit access policies and verified address groups.
+   *
+   * `accessPolicy.isSupported` is false wherever the contracts are not
+   * deployed. Writes are depositor-only, and saving a policy configures storage
+   * rather than enforcing admission.
+   */
+  get accessPolicy() {
+    return this._accessPolicyOps;
+  }
   async prepareSetDepositPreIntentHook(params) {
     return this._intentOps.prepareSetDepositPreIntentHook(params);
   }
@@ -8894,48 +8939,25 @@ var Zkp2pClient = class {
     return appendReferrerFeeDisplayFieldsToBestByPlatform(enrichedQuote, referrerFeeConfig);
   }
   // ───────────────────────────────────────────────────────────────────────────
-  // SUPPORTING: TAKER STAKE & CAPACITY
-  // (Used by frontends to display the stake portfolio and per-platform taking
-  // capacity; never used to filter quotes)
+  // SUPPORTING: TAKER TIER
+  // (Used by frontends to display taker limits)
   // ───────────────────────────────────────────────────────────────────────────
   /**
-   * **Supporting Method** - Fetches the stake portfolio backing a taker:
-   * staked/pending-withdrawal/eligible/reserved/free balances, reservation
-   * aggregates, delegation, and exit state.
+   * **Supporting Method** - Fetches taker tier information for an address.
    *
-   * @param req - Stake request parameters
-   * @param req.owner - Taker address (the resolved stake owner may differ)
+   * @param req - Taker tier request parameters
+   * @param req.owner - Taker address
    * @param req.chainId - Chain ID
    * @param opts - Optional overrides for API URL and timeout
-   * @returns Taker stake response
+   * @returns Taker tier response
    */
-  async getTakerStake(req, opts) {
+  async getTakerTier(req, opts) {
     const baseApiUrl = (opts?.baseApiUrl ?? this.baseApiUrl ?? DEFAULT_BASE_API_URL).replace(
       /\/$/,
       ""
     );
     const timeoutMs = opts?.timeoutMs ?? this.apiTimeoutMs;
-    return apiGetTakerStake(req, baseApiUrl, timeoutMs);
-  }
-  /**
-   * **Supporting Method** - Fetches per-platform bonded taking capacity, free
-   * takes, curve terms, warnings, and operational gates for a taker's shared
-   * stake portfolio. Platform capacities are alternative views of one shared
-   * balance and must never be summed.
-   *
-   * @param req - Capacity request parameters
-   * @param req.owner - Taker address (the resolved stake owner may differ)
-   * @param req.chainId - Chain ID
-   * @param opts - Optional overrides for API URL and timeout
-   * @returns Taker capacity response
-   */
-  async getTakerCapacity(req, opts) {
-    const baseApiUrl = (opts?.baseApiUrl ?? this.baseApiUrl ?? DEFAULT_BASE_API_URL).replace(
-      /\/$/,
-      ""
-    );
-    const timeoutMs = opts?.timeoutMs ?? this.apiTimeoutMs;
-    return apiGetTakerCapacity(req, baseApiUrl, timeoutMs);
+    return apiGetTakerTier(req, baseApiUrl, timeoutMs);
   }
   /**
    * Fetch a referral dashboard. Pass `address` for a public wallet-keyed read;
@@ -9254,15 +9276,12 @@ var Zkp2pClient = class {
       escrowAddresses: this.escrowAddresses,
       orchestrator: this.orchestratorAddress,
       orchestratorV2: this.orchestratorV2Address,
-      orchestratorV3: this.orchestratorV3Address,
       orchestratorAddresses: this.orchestratorAddresses,
       protocolViewer: this.protocolViewerAddress,
       protocolViewerEntries: this._protocolViewerEntries.map((e) => e.address),
       unifiedPaymentVerifier: this.unifiedPaymentVerifier,
       rateManagerV1: this.rateManagerV1Address,
       orchestratorRegistry: this.orchestratorRegistryAddress,
-      stakeVault: this.stakeVaultAddress,
-      riskManager: this.riskManagerAddress,
       usdc: this._usdcAddress
     };
   }
@@ -9337,57 +9356,162 @@ var createPeerExtensionSdk = (options = {}) => ({
 });
 var peerExtensionSdk = createPeerExtensionSdk();
 
-// src/riskMath.ts
-var RISK_BPS_DENOMINATOR = 10000n;
-var RISK_SECONDS_PER_HOUR = 3600n;
-var RISK_EXTENSION_DENOMINATOR = RISK_BPS_DENOMINATOR * RISK_SECONDS_PER_HOUR;
-function integer(value, label) {
-  if (typeof value === "number" && (!Number.isSafeInteger(value) || value < 0)) {
-    throw new RangeError(`${label} must be a non-negative safe integer`);
-  }
-  const parsed = BigInt(value.toString());
-  if (parsed < 0n) throw new RangeError(`${label} must be non-negative`);
-  return parsed;
-}
-function ceilDiv(numerator, denominator) {
-  if (denominator <= 0n) throw new RangeError("denominator must be positive");
-  if (numerator === 0n) return 0n;
-  return (numerator - 1n) / denominator + 1n;
-}
-function calculateIntentExtensionCost(intentAmount, extensionTime, extensionPenaltyBpsPerHour) {
-  const amount = integer(intentAmount, "intentAmount");
-  const duration = integer(extensionTime, "extensionTime");
-  const slope = integer(extensionPenaltyBpsPerHour, "extensionPenaltyBpsPerHour");
-  return ceilDiv(amount * slope * duration, RISK_EXTENSION_DENOMINATOR);
-}
-function calculateIntentExtensionPenalty(intentAmount, baseIntentExpiry, terminalAt, totalExtensionTime, extensionPenaltyBpsPerHour) {
-  const baseExpiry = integer(baseIntentExpiry, "baseIntentExpiry");
-  const terminal = integer(terminalAt, "terminalAt");
-  const purchasedTime = integer(totalExtensionTime, "totalExtensionTime");
-  if (terminal <= baseExpiry || purchasedTime === 0n) {
-    return { penalty: 0n, chargeableTime: 0n };
-  }
-  const elapsed = terminal - baseExpiry;
-  const chargeableTime = elapsed < purchasedTime ? elapsed : purchasedTime;
+// src/client/accessPolicyPlan.ts
+var MAX_GROUPS_PER_DEPOSIT = 10;
+var MAX_ADDRESSES_PER_CALL = 50;
+var MAX_WHITELISTED_ADDRESSES = 500;
+var chunk = (values, size) => {
+  if (values.length <= size) return values.length > 0 ? [values] : [];
+  const batches = [];
+  for (let index = 0; index < values.length; index += size) {
+    batches.push(values.slice(index, index + size));
+  }
+  return batches;
+};
+var normalizeList = (values) => {
+  const seen = /* @__PURE__ */ new Set();
+  const normalized = [];
+  for (const value of values) {
+    if (typeof value !== "string") continue;
+    const trimmed = value.trim().toLowerCase();
+    if (!trimmed || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    normalized.push(trimmed);
+  }
+  return normalized;
+};
+var normalizeAccessPolicyState = (state) => ({
+  enabled: Boolean(state.enabled),
+  groupIds: normalizeList(state.groupIds),
+  addresses: normalizeList(state.addresses)
+});
+var difference = (left, right) => {
+  const exclude = new Set(right);
+  return left.filter((value) => !exclude.has(value));
+};
+var diffAccessPolicy = (persistedInput, draftInput) => {
+  const persisted = normalizeAccessPolicyState(persistedInput);
+  const draft = normalizeAccessPolicyState(draftInput);
   return {
-    penalty: calculateIntentExtensionCost(intentAmount, chargeableTime, extensionPenaltyBpsPerHour),
-    chargeableTime
+    addedGroupIds: difference(draft.groupIds, persisted.groupIds),
+    removedGroupIds: difference(persisted.groupIds, draft.groupIds),
+    addedAddresses: difference(draft.addresses, persisted.addresses),
+    removedAddresses: difference(persisted.addresses, draft.addresses),
+    enabledChanged: persisted.enabled !== draft.enabled
   };
-}
-function calculateRequiredCoverage(amount, chargebackable) {
-  return chargebackable ? integer(amount, "amount") : 0n;
-}
-function calculateStakeBackedCapacity(freeStake) {
-  return integer(freeStake, "freeStake");
-}
-function selectRiskMode(amount, freeStake, chargebackable, deferredPayoutEnabled) {
-  const required = calculateRequiredCoverage(amount, chargebackable);
-  if (!chargebackable) return "UNBONDED";
-  if (integer(freeStake, "freeStake") >= required) return "STAKE_BACKED";
-  if (deferredPayoutEnabled) return "DEFERRED_PAYOUT";
-  throw new RangeError("insufficient collateral and deferred payout is disabled");
-}
+};
+var planAccessPolicyUpdate = (persistedInput, draftInput) => {
+  const persisted = normalizeAccessPolicyState(persistedInput);
+  const draft = normalizeAccessPolicyState(draftInput);
+  const diff = diffAccessPolicy(persisted, draft);
+  const hasChanges = diff.enabledChanged || diff.addedGroupIds.length > 0 || diff.removedGroupIds.length > 0 || diff.addedAddresses.length > 0 || diff.removedAddresses.length > 0;
+  const violations = [];
+  if (draft.enabled && draft.groupIds.length === 0 && draft.addresses.length === 0) {
+    violations.push("empty-restricted-policy");
+  }
+  if (draft.groupIds.length > MAX_GROUPS_PER_DEPOSIT) {
+    violations.push("group-cap-exceeded");
+  }
+  if (draft.addresses.length > MAX_WHITELISTED_ADDRESSES) {
+    violations.push("address-cap-exceeded");
+  }
+  if (!hasChanges || violations.length > 0) {
+    return {
+      diff,
+      steps: [],
+      hasChanges,
+      ordering: hasChanges ? "additions-first" : "no-changes",
+      violations,
+      resultingGroupCount: draft.groupIds.length
+    };
+  }
+  const peakIfAddingFirst = (/* @__PURE__ */ new Set([...persisted.groupIds, ...diff.addedGroupIds])).size;
+  const mustRemoveGroupsFirst = peakIfAddingFirst > MAX_GROUPS_PER_DEPOSIT;
+  const ordering = !draft.enabled ? "disable-first" : mustRemoveGroupsFirst ? "removals-first" : "additions-first";
+  const steps = [];
+  const additionSteps = () => {
+    const collected = [];
+    if (diff.addedGroupIds.length > 0) {
+      collected.push({
+        kind: "addAllowedGroups",
+        groupIds: diff.addedGroupIds
+      });
+    }
+    for (const batch of chunk(diff.addedAddresses, MAX_ADDRESSES_PER_CALL)) {
+      collected.push({ kind: "addWhitelistedAddresses", takers: batch });
+    }
+    return collected;
+  };
+  const removalSteps = () => {
+    const collected = [];
+    if (diff.removedGroupIds.length > 0) {
+      collected.push({
+        kind: "removeAllowedGroups",
+        groupIds: diff.removedGroupIds
+      });
+    }
+    for (const batch of chunk(diff.removedAddresses, MAX_ADDRESSES_PER_CALL)) {
+      collected.push({ kind: "removeWhitelistedAddresses", takers: batch });
+    }
+    return collected;
+  };
+  if (ordering === "disable-first") {
+    if (diff.enabledChanged) {
+      steps.push({ kind: "setEnabled", enabled: false });
+    }
+    steps.push(...removalSteps(), ...additionSteps());
+    return {
+      diff,
+      steps,
+      hasChanges,
+      ordering,
+      violations,
+      resultingGroupCount: draft.groupIds.length
+    };
+  }
+  if (ordering === "removals-first") {
+    if (persisted.enabled) {
+      steps.push({ kind: "setEnabled", enabled: false });
+    }
+    steps.push(...removalSteps(), ...additionSteps());
+    steps.push({ kind: "setEnabled", enabled: true });
+    return {
+      diff,
+      steps,
+      hasChanges,
+      ordering,
+      violations,
+      resultingGroupCount: draft.groupIds.length
+    };
+  }
+  if (diff.enabledChanged) {
+    const [firstBatch = [], ...overflowBatches] = chunk(
+      diff.addedAddresses,
+      MAX_ADDRESSES_PER_CALL
+    );
+    steps.push({
+      kind: "configureDeposit",
+      enabled: true,
+      groupIds: diff.addedGroupIds,
+      takers: firstBatch
+    });
+    for (const batch of overflowBatches) {
+      steps.push({ kind: "addWhitelistedAddresses", takers: batch });
+    }
+  } else {
+    steps.push(...additionSteps());
+  }
+  steps.push(...removalSteps());
+  return {
+    diff,
+    steps,
+    hasChanges,
+    ordering,
+    violations,
+    resultingGroupCount: draft.groupIds.length
+  };
+};
 
-export { BASE_BUILDER_CODE, CHAINLINK_ORACLE_ADAPTER, CHAINLINK_ORACLE_FEEDS, ContractRouter, DEFAULT_ORACLE_MAX_STALENESS_SECONDS, IndexerClient, IndexerDepositService, IndexerRateManagerService, Zkp2pClient as OfframpClient, PEER_EXTENSION_CHROME_URL, PLATFORM_METADATA, PYTH_CONTRACT_BASE, PYTH_ORACLE_ADAPTER, PYTH_ORACLE_FEEDS, REFERRAL_SIGNATURE_DOMAIN, REFERRAL_SIGNATURE_TYPES, RISK_BPS_DENOMINATOR, RISK_EXTENSION_DENOMINATOR, RISK_SECONDS_PER_HOUR, SPREAD_ORACLE_FEEDS, SUPPORTED_CHAIN_IDS, TOKEN_METADATA, ZKP2P_ANDROID_REFERRER, ZKP2P_IOS_REFERRER, Zkp2pClient, apiCreateReferralCode, apiCreateSellerCredentialBundle, apiGetDepositBundle, apiGetOrderbook, apiGetOrderbookTable, apiGetOwnerDeposits, apiGetPayeeDetails, apiGetQuotesBestByPlatform, apiGetReferralDashboard, apiGetReferralEarnings, apiGetTakerCapacity, apiGetTakerStake, apiLookupReferralCode, apiPostDepositDetails, apiRedeemReferralCode, apiRequestIdentityAttestation, apiUpdateReferralCode, apiUploadGoogleOAuthSellerCredential, apiUploadSellerCredentialBundle, apiValidatePayeeDetails, apiVerifyBuyerTeePayment, appendAttributionToCalldata, assertValidReferrerFeeConfig, calculateIntentExtensionCost, calculateIntentExtensionPenalty, calculateRequiredCoverage, calculateStakeBackedCapacity, compareEventCursorIdsByRecency, convertDepositsForLiquidity, convertIndexerDepositToEscrowView, convertIndexerIntentsToEscrowViews, createCompositeDepositId, createEncryptedBuyerTeeSessionMaterial, createPeerExtensionSdk, defaultIndexerEndpoint, encodePythAdapterConfig, encodeSpreadOracleAdapterConfig, encodeWithAttribution, fetchFulfillmentAndPayment as fetchIndexerFulfillmentAndPayment, getAttributionDataSuffix, getPeerExtensionState, getSpreadOracleConfig, isPeerExtensionAvailable, isValidReferralCode, isValidReferrerFeeBps, isValidReferrerFeeRecipient, logger, normalizeReferralCode, openPeerExtensionInstallPage, parseReferrerFeeConfig, peerExtensionSdk, referrerFeeConfigToPreciseUnits, selectRiskMode, sendTransactionWithAttribution, setLogLevel, validateOracleFeedsOnChain };
+export { AccessPolicyOperations, AccessPolicyUnsupportedError, BASE_BUILDER_CODE, CHAINLINK_ORACLE_ADAPTER, CHAINLINK_ORACLE_FEEDS, ContractRouter, DEFAULT_ORACLE_MAX_STALENESS_SECONDS, IndexerClient, IndexerDepositService, IndexerRateManagerService, MAX_ADDRESSES_PER_CALL, MAX_GROUPS_PER_DEPOSIT, MAX_WHITELISTED_ADDRESSES, Zkp2pClient as OfframpClient, PEER_EXTENSION_CHROME_URL, PLATFORM_METADATA, PYTH_CONTRACT_BASE, PYTH_ORACLE_ADAPTER, PYTH_ORACLE_FEEDS, REFERRAL_SIGNATURE_DOMAIN, REFERRAL_SIGNATURE_TYPES, SPREAD_ORACLE_FEEDS, SUPPORTED_CHAIN_IDS, TOKEN_METADATA, ZKP2P_ANDROID_REFERRER, ZKP2P_IOS_REFERRER, Zkp2pClient, apiCreateReferralCode, apiCreateSellerCredentialBundle, apiGetDepositBundle, apiGetOrderbook, apiGetOrderbookTable, apiGetOwnerDeposits, apiGetPayeeDetails, apiGetQuotesBestByPlatform, apiGetReferralDashboard, apiGetReferralEarnings, apiGetTakerTier, apiLookupReferralCode, apiPostDepositDetails, apiRedeemReferralCode, apiRequestIdentityAttestation, apiUpdateReferralCode, apiUploadGoogleOAuthSellerCredential, apiUploadSellerCredentialBundle, apiValidatePayeeDetails, apiVerifyBuyerTeePayment, appendAttributionToCalldata, assertValidReferrerFeeConfig, compareEventCursorIdsByRecency, convertDepositsForLiquidity, convertIndexerDepositToEscrowView, convertIndexerIntentsToEscrowViews, createCompositeDepositId, createEncryptedBuyerTeeSessionMaterial, createPeerExtensionSdk, defaultIndexerEndpoint, diffAccessPolicy, encodePythAdapterConfig, encodeSpreadOracleAdapterConfig, encodeWithAttribution, fetchFulfillmentAndPayment as fetchIndexerFulfillmentAndPayment, getAttributionDataSuffix, getPeerExtensionState, getSpreadOracleConfig, isPeerExtensionAvailable, isValidReferralCode, isValidReferrerFeeBps, isValidReferrerFeeRecipient, logger, normalizeAccessPolicyState, normalizeReferralCode, openPeerExtensionInstallPage, parseReferrerFeeConfig, peerExtensionSdk, planAccessPolicyUpdate, referrerFeeConfigToPreciseUnits, sendTransactionWithAttribution, setLogLevel, validateOracleFeedsOnChain };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map