@zkp2p/sdk 0.14.6 → 0.14.7-rc.0

package/dist/{currency-OXHRXRZK.mjs → currency-5JVD64RX.mjs}

@@ -1,4 +1,4 @@
 export { Currency, currencyInfo, getCurrencyCodeFromHash, getCurrencyInfoFromCountryCode, getCurrencyInfoFromHash, isSupportedCurrencyHash, mapConversionRatesToOnchain, mapConversionRatesToOnchainMinRate } from './chunk-WDEEWFEU.mjs';
-import './chunk-BBPE3X6U.mjs';
-//# sourceMappingURL=currency-OXHRXRZK.mjs.map
-//# sourceMappingURL=currency-OXHRXRZK.mjs.map
+import './chunk-35IHGX4I.mjs';
+//# sourceMappingURL=currency-5JVD64RX.mjs.map
+//# sourceMappingURL=currency-5JVD64RX.mjs.map

package/dist/{currency-OXHRXRZK.mjs.map → currency-5JVD64RX.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"currency-OXHRXRZK.mjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"currency-5JVD64RX.mjs"}

package/dist/index.cjs

@@ -21,7 +21,7 @@ var __export = (target, all) => {
 var define_ZKP2P_SDK_BUILD_METADATA_default;
 var init_define_ZKP2P_SDK_BUILD_METADATA = __esm({
   "<define:__ZKP2P_SDK_BUILD_METADATA__>"() {
-    define_ZKP2P_SDK_BUILD_METADATA_default = { schemaVersion: 2, source: { repository: "zkp2p/zkp2p-clients", commitSha: "fd02009b2fcfda2e4ee8decaa6bd572181ffdb4a", kind: "github", distributable: true }, sdkPackageVersion: "0.14.6", contractsPackageVersion: "0.4.4-rc.2", indexerSchemaPackageVersion: "0.22.0", activeDisputeStack: { base: { version: 2, selectionHash: "ba40c2954b408d0c658881a8d28e5bfcc9bade5cc3d953fd17eae1eca69d841c" }, baseStaging: { version: 2, selectionHash: "6c49c1ce51eec594a22385c4efcab08aa9926b6b63a725e14a0027ec5d2f4fc9" } } };
+    define_ZKP2P_SDK_BUILD_METADATA_default = { schemaVersion: 2, source: { repository: "zkp2p/zkp2p-clients", commitSha: "702186ed22ef1102f2827501e14f12172b5acf9b", kind: "github", distributable: true }, sdkPackageVersion: "0.14.7-rc.0", contractsPackageVersion: "0.4.4-rc.2", indexerSchemaPackageVersion: "0.22.0", activeDisputeStack: { base: { version: 2, selectionHash: "ba40c2954b408d0c658881a8d28e5bfcc9bade5cc3d953fd17eae1eca69d841c" }, baseStaging: { version: 2, selectionHash: "6c49c1ce51eec594a22385c4efcab08aa9926b6b63a725e14a0027ec5d2f4fc9" } } };
   }
 });
 
@@ -107181,7 +107181,7 @@ async function apiUpdateReferralCode(req, opts) {
   });
   return unwrapResponseObject(response);
 }
-async function apiUploadSellerCredential(processorName, payeeDetails, bundle, baseApiUrl, timeoutMs, authorizationToken) {
+async function apiUploadSellerCredential(processorName, payeeDetails, bundle, baseApiUrl, timeoutMs, authorizationToken, retryCount) {
   const endpoint = `/v2/makers/${encodeURIComponent(processorName)}/${encodeURIComponent(
     payeeDetails
   )}/seller-credential`;
@@ -107190,7 +107190,8 @@ async function apiUploadSellerCredential(processorName, payeeDetails, bundle, ba
     method: "POST",
     body: bundle,
     timeoutMs,
-    authorizationToken
+    authorizationToken,
+    retryCount
   });
 }
 async function apiUploadGoogleOAuthSellerCredential(processorName, payeeDetails, body, baseApiUrl, opts) {
@@ -107261,6 +107262,15 @@ async function apiGetSellerCredentialStatus(processorName, payeeDetails, baseApi
     timeoutMs
   });
 }
+async function apiGetVenmoPayeeId(payeeDetails, baseApiUrl, timeoutMs) {
+  return apiFetch({
+    url: `${withApiBase(baseApiUrl)}/v2/makers/venmo/${encodeURIComponent(payeeDetails)}/payee-id`,
+    method: "GET",
+    timeoutMs,
+    // Shares Curator's seller-credential limit with the upload; a 429 returns to the user.
+    retryCount: 1
+  });
+}
 async function apiVerifySellerPayment(platform, req, baseApiUrl, timeoutMs, apiKey) {
   const body = {
     txId: req.txId,
@@ -110858,6 +110868,240 @@ async function fetchFulfillmentAndPayment(client, intentHash) {
 // src/client/Zkp2pClient.ts
 init_contracts2();
 
+// src/icloudMail.ts
+init_define_ZKP2P_SDK_BUILD_METADATA();
+init_errors();
+var ICloudMailCredentialError = class extends Error {
+  constructor(reason, message, options = {}) {
+    super(message);
+    this.reason = reason;
+    this.name = "ICloudMailCredentialError";
+    this.retryAfterMs = options.retryAfterMs;
+    this.cause = options.cause;
+  }
+};
+var MAILBOX_SELLER_CREDENTIAL_TYPES = /* @__PURE__ */ new Set([
+  "google_oauth",
+  "microsoft_oauth",
+  "icloud_mail"
+]);
+var isMailboxSellerCredentialType = (credentialType) => typeof credentialType === "string" && MAILBOX_SELLER_CREDENTIAL_TYPES.has(credentialType);
+var ATTESTOR_ENVIRONMENTS = {
+  "attestation-service.zkp2p.xyz": "production",
+  "attestation-service-staging.zkp2p.xyz": "staging"
+};
+var SELLER_CREDENTIAL_SIGNERS = {
+  production: "0xe078d93bfdd87a8c5c5cca5905dcba0dd7a1f0bd",
+  staging: "0x66649f896521b0fb487fe2077b4fbda283d7f19a"
+};
+var ATTESTOR_TIMEOUT_MS = 2e4;
+var DEFAULT_RETRY_AFTER_MS = 6e4;
+var mailboxesInFlight = /* @__PURE__ */ new Set();
+var mailboxRetryAt = /* @__PURE__ */ new Map();
+var asRecord = (value) => typeof value === "object" && value !== null ? value : null;
+function rateLimited(mailboxEmail, responseObject, cause) {
+  const seconds = responseObject?.retryAfterSeconds;
+  const retryAfterMs = typeof seconds === "string" && /^\d+$/.test(seconds) ? Number(seconds) * 1e3 : DEFAULT_RETRY_AFTER_MS;
+  mailboxRetryAt.set(mailboxEmail, Date.now() + retryAfterMs);
+  return new ICloudMailCredentialError("rate_limited", "iCloud Mail is rate limited", {
+    retryAfterMs,
+    cause
+  });
+}
+function toAttestorError(error, platform, mailboxEmail) {
+  if (!(error instanceof zkp2pAttestation.NitroAttestationError)) {
+    return new ICloudMailCredentialError("unavailable", "iCloud Mail upload failed", {
+      cause: error
+    });
+  }
+  if (error.code === "TIMEOUT" || error.code === "ATTESTATION_FETCH_FAILED") {
+    return new ICloudMailCredentialError("unavailable", error.message, { cause: error });
+  }
+  if (error.code !== "SERVICE_RESPONSE_ERROR") {
+    return new ICloudMailCredentialError("bundle_unverified", error.message, {
+      cause: error
+    });
+  }
+  const status = error.details?.status;
+  const responseObject = asRecord(error.details?.responseObject);
+  if (status === 429) return rateLimited(mailboxEmail, responseObject, error);
+  if (status === 400 && responseObject?.code === `${platform.toUpperCase()}_ICLOUD_RECEIPT_NOT_FOUND`) {
+    return new ICloudMailCredentialError("receipt_not_found", error.message, {
+      cause: error
+    });
+  }
+  if (status === 410) {
+    return new ICloudMailCredentialError("app_password_rejected", error.message, {
+      cause: error
+    });
+  }
+  return new ICloudMailCredentialError(
+    typeof status === "number" && status >= 500 ? "unavailable" : "upload_rejected",
+    error.message,
+    { cause: error }
+  );
+}
+var curatorResponseBody = (error) => asRecord(asRecord(error.details)?.responseBody);
+var VENMO_PAYEE_LOOKUP_ERRORS = /* @__PURE__ */ new Map([
+  ["maker_not_found", "maker_not_found"],
+  ["venmo_user_not_found", "payee_not_found"],
+  ["venmo_account_id_mismatch", "payee_mismatch"]
+]);
+function toVenmoPayeeLookupError(error, mailboxEmail) {
+  if (error instanceof exports.APIError) {
+    const responseBody = curatorResponseBody(error);
+    const reason = VENMO_PAYEE_LOOKUP_ERRORS.get(responseBody?.errorCode);
+    if (reason) return new ICloudMailCredentialError(reason, error.message, { cause: error });
+    if (error.status === 429) {
+      return rateLimited(mailboxEmail, asRecord(responseBody?.responseObject), error);
+    }
+  }
+  return new ICloudMailCredentialError("unavailable", "Venmo account lookup failed", {
+    cause: error
+  });
+}
+function toCuratorError(error, mailboxEmail) {
+  if (error instanceof exports.APIError) {
+    if (error.status === 404) {
+      return new ICloudMailCredentialError("maker_not_found", error.message, {
+        cause: error
+      });
+    }
+    if (error.status === 401 || error.status === 403) {
+      return new ICloudMailCredentialError("auth_required", error.message, {
+        cause: error
+      });
+    }
+    if (error.status === 429) {
+      const responseObject = asRecord(curatorResponseBody(error)?.responseObject);
+      return rateLimited(mailboxEmail, responseObject, error);
+    }
+  }
+  if (error instanceof exports.NetworkError) {
+    return new ICloudMailCredentialError("unavailable", error.message, { cause: error });
+  }
+  return new ICloudMailCredentialError(
+    "store_failed",
+    "Curator did not store the iCloud credential",
+    {
+      cause: error
+    }
+  );
+}
+async function resolveVenmoPayeeId(payeeDetails, mailboxEmail, context) {
+  let payeeId;
+  try {
+    const response = await apiGetVenmoPayeeId(payeeDetails, context.baseApiUrl, context.timeoutMs);
+    payeeId = response.responseObject?.payeeId;
+  } catch (error) {
+    throw toVenmoPayeeLookupError(error, mailboxEmail);
+  }
+  if (typeof payeeId !== "string" || zkp2pAttestation.hashUtf8(payeeId) !== payeeDetails) {
+    throw new ICloudMailCredentialError(
+      "payee_mismatch",
+      "Curator returned a Venmo account that does not match the registered maker"
+    );
+  }
+  return payeeId;
+}
+function resolveAttestorEnvironment(attestationServiceUrl) {
+  const environment = ATTESTOR_ENVIRONMENTS[new URL(attestationServiceUrl).hostname];
+  if (!environment) {
+    throw new Error(`Unsupported iCloud Mail attestor: ${attestationServiceUrl}`);
+  }
+  return environment;
+}
+async function uploadICloudMailSellerCredential(params, context) {
+  const { appSpecificPassword, platform } = params;
+  const mailboxEmail = params.mailboxEmail.trim().toLowerCase();
+  if (!mailboxEmail) throw new exports.ValidationError("mailboxEmail is required", "mailboxEmail");
+  if (!appSpecificPassword) {
+    throw new exports.ValidationError("appSpecificPassword is required", "appSpecificPassword");
+  }
+  const payeeDetails = params.payeeDetails.toLowerCase();
+  const payeeEmail = params.platform === "paypal" ? params.payeeEmail.trim().toLowerCase() : null;
+  if (payeeEmail !== null && zkp2pAttestation.hashUtf8(payeeEmail) !== payeeDetails) {
+    throw new ICloudMailCredentialError(
+      "payee_mismatch",
+      "The PayPal email does not match the registered maker"
+    );
+  }
+  const retryAt = mailboxRetryAt.get(mailboxEmail);
+  if (retryAt !== void 0 && retryAt > Date.now()) {
+    throw new ICloudMailCredentialError("rate_limited", "iCloud Mail is rate limited", {
+      retryAfterMs: retryAt - Date.now()
+    });
+  }
+  if (mailboxesInFlight.has(mailboxEmail)) {
+    throw new ICloudMailCredentialError("mailbox_busy", "This mailbox is already connecting");
+  }
+  const environment = resolveAttestorEnvironment(context.attestationServiceUrl);
+  mailboxesInFlight.add(mailboxEmail);
+  try {
+    const payeeId = payeeEmail ?? await resolveVenmoPayeeId(payeeDetails, mailboxEmail, context);
+    let bundle;
+    try {
+      const nitro = zkp2pAttestation.createNitroAttestationClient({
+        environment,
+        attestationServiceUrl: context.attestationServiceUrl,
+        timeoutMs: ATTESTOR_TIMEOUT_MS,
+        ...context.attestationRuntime
+      });
+      bundle = await nitro.uploadSellerCredential({
+        platform,
+        payeeId,
+        sessionMaterial: { credentialSource: "icloud_mail", mailboxEmail, appSpecificPassword }
+      });
+    } catch (error) {
+      throw toAttestorError(error, platform, mailboxEmail);
+    }
+    try {
+      zkp2pAttestation.verifySellerCredentialBundle(bundle, {
+        trustedSigners: [SELLER_CREDENTIAL_SIGNERS[environment]],
+        expectedPlatform: platform,
+        expectedPayeeIdHash: payeeDetails
+      });
+    } catch (error) {
+      throw new ICloudMailCredentialError(
+        "bundle_unverified",
+        "Seller credential bundle failed verification",
+        { cause: error }
+      );
+    }
+    if (bundle.credentialType !== "icloud_mail") {
+      throw new ICloudMailCredentialError(
+        "bundle_unverified",
+        `Attestor returned credential type ${bundle.credentialType}`
+      );
+    }
+    let stored;
+    try {
+      const response = await apiUploadSellerCredential(
+        platform,
+        payeeDetails,
+        bundle,
+        context.baseApiUrl,
+        context.timeoutMs,
+        context.authorizationToken,
+        // Send once: a 429 or lost response returns to the user, who retries.
+        1
+      );
+      stored = response.success ? response.responseObject : null;
+    } catch (error) {
+      throw toCuratorError(error, mailboxEmail);
+    }
+    if (stored?.status !== "active" || stored.credentialType !== "icloud_mail" || stored.platform !== platform || stored.payeeIdHash.toLowerCase() !== payeeDetails) {
+      throw new ICloudMailCredentialError(
+        "store_failed",
+        "Curator did not store an active iCloud credential"
+      );
+    }
+    return stored;
+  } finally {
+    mailboxesInFlight.delete(mailboxEmail);
+  }
+}
+
 // src/sellerCredentials.ts
 init_define_ZKP2P_SDK_BUILD_METADATA();
 function normalizeBaseApiUrl(value) {
@@ -114152,6 +114396,32 @@ var Zkp2pClient = class {
       uploadOptions
     );
   }
+  /**
+   * Connect an iCloud Mail receipt inbox for PayPal or Venmo seller automated
+   * release. The app-specific password is encrypted to the attested enclave and
+   * posted directly to the attestor (no proxy, no retry). The returned bundle is
+   * verified against the pinned enclave signer, platform and registered maker,
+   * then stored unchanged for that maker; the maker is not re-registered.
+   *
+   * Rejects with `ICloudMailCredentialError` (`reason` names the failure)
+   * before any mailbox work when `payeeId` does not hash to `payeeDetails`,
+   * while another connection for the mailbox runs, or during a rate-limit
+   * delay. The attestor defaults to the one paired with `baseApiUrl`.
+   */
+  async uploadICloudMailSellerCredential(params, opts) {
+    const baseApiUrl = this.stripTrailingSlash(
+      opts?.baseApiUrl ?? this.baseApiUrl ?? DEFAULT_BASE_API_URL
+    );
+    return uploadICloudMailSellerCredential(params, {
+      attestationServiceUrl: this.stripTrailingSlash(
+        opts?.attestationServiceUrl ?? this.defaultAttestationServiceForBaseApiUrl(baseApiUrl)
+      ),
+      attestationRuntime: opts?.attestationRuntime,
+      baseApiUrl,
+      timeoutMs: this.apiTimeoutMs,
+      authorizationToken: await this.resolveAuthorizationToken()
+    });
+  }
   /**
    * Status is a coarse curator-owned signal (`active` / `inactive` / `missing`) and intentionally
    * omits low-level diagnostics. Curator may still re-probe stale credentials during verify, so callers
@@ -114640,6 +114910,7 @@ exports.CHAINLINK_ORACLE_ADAPTER = CHAINLINK_ORACLE_ADAPTER;
 exports.CHAINLINK_ORACLE_FEEDS = CHAINLINK_ORACLE_FEEDS;
 exports.ContractRouter = ContractRouter;
 exports.DEFAULT_ORACLE_MAX_STALENESS_SECONDS = DEFAULT_ORACLE_MAX_STALENESS_SECONDS;
+exports.ICloudMailCredentialError = ICloudMailCredentialError;
 exports.IndexerClient = IndexerClient;
 exports.IndexerDepositService = IndexerDepositService;
 exports.IndexerRateManagerService = IndexerRateManagerService;
@@ -114727,6 +114998,7 @@ exports.getSpreadOracleConfig = getSpreadOracleConfig;
 exports.getStakeVaultContract = getStakeVaultContract;
 exports.getVenmoGmailConnectUrl = getVenmoGmailConnectUrl;
 exports.hasIntentGuardian = hasIntentGuardian;
+exports.isMailboxSellerCredentialType = isMailboxSellerCredentialType;
 exports.isPeerExtensionAvailable = isPeerExtensionAvailable;
 exports.isSupportedCurrencyHash = isSupportedCurrencyHash;
 exports.isValidReferralCode = isValidReferralCode;