@zkp2p/sdk 0.14.8-rc.0 → 0.15.0-rc.0

package/README.md

@@ -40,7 +40,7 @@ For partner cash-out integrations, prefer stable `@zkp2p/cash@0.7.2` and its
 It selects the matching environment and keeps linking separate from cash-out.
 The direct SDK helpers below require `@zkp2p/sdk@0.14.2` or later.
 
-Open Peer's **Link your Venmo** popup for an already-registered account.
+Open Peer's **Verify your Venmo** popup for an already-registered account.
 The host passes the selected account hash; the user picks Gmail or Outlook,
 which opens that provider's consent, or iCloud Mail, which takes an Apple
 app-specific password on the Peer page.
@@ -398,7 +398,7 @@ const onchain = await client.getStakeVaultState({
 const indexed = await client.indexer.getStakingState({
   chainId: 8453,
   environment: 'base',
-  vaultAddress: client.getStakeVaultContract().address,
+  vaultAddress: (await client.getActiveStakeVaultContract()).address,
   disputeProtectionPolicyAddress: client.getDisputeProtectionPolicyContract().address,
   taker: takerAddress,
   // Always supply the effective owner from the fresh on-chain read.
@@ -409,7 +409,7 @@ const indexed = await client.indexer.getStakingState({
 
 const locks = await client.indexer.getStakeLocks({
   chainId: 8453,
-  vaultAddress: client.getStakeVaultContract().address,
+  vaultAddress: (await client.getActiveStakeVaultContract()).address,
   stakeOwner: onchain.stakeOwner,
   status: 'ACTIVE',
   limit: 50,
@@ -417,7 +417,7 @@ const locks = await client.indexer.getStakeLocks({
 
 const activity = await client.indexer.getStakeActivity({
   chainId: 8453,
-  vaultAddress: client.getStakeVaultContract().address,
+  vaultAddress: (await client.getActiveStakeVaultContract()).address,
   merchant: takerAddress,
   orderDirection: 'desc', // Newest first; defaults to asc for chronological ingestion.
   limit: 50,
@@ -429,7 +429,7 @@ const activity = await client.indexer.getStakeActivity({
 
 const totals = await client.indexer.getStakeTotals({
   chainId: 8453,
-  vaultAddress: client.getStakeVaultContract().address,
+  vaultAddress: (await client.getActiveStakeVaultContract()).address,
 });
 // totals.totalStaked and totals.totalLocked are decimal strings in token base units.
 // totals.stakerCount counts owners whose stake balance is greater than zero.
@@ -451,6 +451,29 @@ withdraws the complete claimable balance. Chargebackable capacity is exactly
 the effective owner's free stake (1:1); never sum a taker's self-stake with a
 sponsor's stake.
 
+`getActiveDisputeProtectionStack()` reads the live OrchestratorV3 hook, policy,
+and vault. It returns `null` for a zero hook, rejects unknown policies or vaults,
+and caches discovery per client for 30 seconds; failures are never cached.
+`getActiveStakeVaultContract()` returns that vault (canonical when the hook is zero).
+`getKnownStakeVaults()` lists canonical, Bypass, and any exported MethodScoped
+predecessor vault, deduplicated by address. `isNoStakeAvailable()` is true only
+when the live policy is the resolved payment-validation policy.
+
+Pass `stakeVaultAddress?: Address` to `getStakeVaultContract(options?)`,
+`getStakeVaultState({ staker, taker?, stakeVaultAddress? })`, every vault write,
+and `ensureStakeAllowance`. Single-value vault reads accept a trailing optional
+`options?: { stakeVaultAddress?: Address }`. Unknown vaults throw; reads, writes,
+and allowance default to the active vault (canonical only for a zero hook).
+The synchronous `getStakeVaultContract()` getter still returns bundle/canonical
+coordinates when no address is given; use `getActiveStakeVaultContract()` for
+the vault the live policy locks from. Each vault-state call resolves one vault
+for all accounting reads and its stake token; `admissionsPaused` comes from
+that vault's controller.
+The standalone `getAdmissionsPaused`, `getRiskWindow`, and
+`isDisputeProtectionEnabled` reads follow the live policy, using canonical only
+when the live hook is zero. `setDisputeProtectionEnabled` follows the same live
+policy unless `disputeProtectionPolicyAddress` is supplied.
+
 The vault's controller is the `DisputeProtectionPolicy` contract. It owns
 per-payment-method risk windows (`getRiskWindow(paymentMethodHash)`),
 per-deposit chargeback enablement (`isDisputeProtectionEnabled(escrow, depositId)`),
@@ -501,7 +524,7 @@ same finalized cutoff for every cursor in one ingestion pass. Follow
 empty page.
 
 Before enabling dispute-protected admission, prove that the live Base contracts
-still match the deployment manifest embedded in the exact SDK artifact:
+match the packaged manifest or verified Bypass successor records:
 
 ```ts
 const readiness = await client.getDisputeProtectionReadiness();
@@ -511,7 +534,15 @@ if (readiness.state !== 'active_successor_verified' || !readiness.readyForDisput
 }
 ```
 
-The reader pins every code and state read to one `asOfBlock`, including exact
+Known results expose `verifiedStack`: `manifest` for the manifest path or
+`bypass_records` for an active Bypass hook distinct from the manifest hook. The
+Bypass path proves code presence and the specified hook/registry/policy/vault
+relations at one block; it does not claim manifest runtime-hash or governance
+verification for those new deployments. Missing records leave this path off.
+On Base staging the manifest now names the Bypass stack, so its Bypass records
+equal the manifest identities and readiness runs the full manifest path there.
+
+The manifest reader pins every code and state read to one `asOfBlock`, including exact
 governance owners, authorization sets, attestation witnesses, and signature
 thresholds. It distinguishes
 `recognized_predecessor`, `passive_successor`, `active_successor_verified`,
@@ -523,6 +554,15 @@ verified while `orchestratorPaused`, `allowMultipleIntents`, and
 traffic. Unknown hooks, misconfigured successors, runtime-code changes,
 dependency mismatches, and RPC failures return `mismatch` and fail closed.
 
+An activated successor may keep its recognized predecessor policy as a
+`DisputeNullifierRegistry` writer while that predecessor's intents drain. The
+active state therefore requires every active writer and accepts the
+manifest's `RecognizedPredecessorPolicy` as the only additional writer, after
+verifying its packaged runtime hash at `asOfBlock`. Any other writer, or a
+missing active writer, is a `mismatch`. The passive state keeps its exact
+writer set, and an orchestrator the manifest does not list is always a
+`mismatch`.
+
 Dispute evidence callers should read the current attestation trust roots before
 requesting evidence and again before submitting it:
 
@@ -531,6 +571,7 @@ const attestationConfig = await readDisputeAttestationConfig({
   publicClient,
   chainId: 8453,
   environment: 'production',
+  // policyAddress: found.policyAddress, // optional known historical policy
 });
 
 if (attestationConfig.requiredSignatures !== 1) {
@@ -547,6 +588,8 @@ selection hashes. A local build has the deterministic `development` identity
 and is deliberately non-distributable, so its readiness reader returns
 `mismatch` before making RPC calls.
 
+Quote and orderbook requests accept `includeNoStakeCompatible?: boolean` to opt in to protected rows a taker may signal without stake (Venmo only today). Only `true` is sent; false and omitted values leave the field absent.
+
 For table-style liquidity UIs, the low-level `apiGetOrderbookTable()` adapter exposes curator's paginated public/private orderbook rows and row-level privacy metadata.
 
 ## Seller Credential Status
@@ -590,8 +633,6 @@ await client.uploadICloudMailSellerCredential({
 
 The password is encrypted to the attested enclave and posted directly to the attestor paired with `baseApiUrl`. The returned bundle is verified against the pinned enclave signer, platform and maker before it is stored unchanged; the maker is not re-registered. React Native callers pass `{ attestationRuntime: { subtle, getRandomValues } }`. Failures reject with `ICloudMailCredentialError`, whose `reason` names the condition (`payee_mismatch`, `payee_not_found`, `receipt_not_found`, `app_password_rejected`, `rate_limited` with `retryAfterMs`, and so on). The method never retries; one connection per mailbox runs at a time. `isMailboxSellerCredentialType` recognizes Gmail, Outlook and iCloud Mail credentials.
 
-To store the bundle through another Curator route, such as an App Clip's request-scoped SAR connection, call `client.attestICloudMailSellerCredential` with the same arguments. It runs the same checks, enclave upload and verification, then returns the verified `SellerCredentialBundleUpload` without storing it, so it needs no Curator session. Walletless callers use the exported `attestICloudMailSellerCredential(params, { attestationServiceUrl, baseApiUrl, timeoutMs, attestationRuntime })` and name the attestor themselves. Errors, the mailbox lock and rate-limit delays match the upload.
-
 ```ts
 const status = await client.getSellerCredentialStatus({
   processorName: 'venmo',
@@ -634,6 +675,91 @@ await client.releaseFundsToPayer({
 
 Use `referralFees[]` for multi-recipient fee distribution on OrchestratorV2 and V3.
 
+### Signal intent stake mode
+
+`signalIntent`, `signalIntent.prepare`, `prepareSignalIntent`, and the React
+`useSignalIntent` hook accept `noStake?: boolean` (default `false`). Use `true`
+only for Venmo Friends & Family payments funded from Venmo balance. Any other
+payment method, by name or hash, throws `ValidationError` with field `noStake`
+before `/v3/sign` is called. The SDK sends
+`abi.encode(paymentValidationPolicy, abi.encode(noStake))` to both `/v3/sign`
+and OrchestratorV3 whenever the selected deployment has a payment-validation
+policy. This target comes from the bundle, independently of the live hook.
+
+The installed `@zkp2p/contracts-v2@0.4.4-rc.5` bundle records the fresh Bypass trio
+redeployed on Base staging on 2026-10-13 as active: the staging canonical aliases
+(`StakeVault`, `DisputeProtectionPolicy`, `IntentLifecycleHookV1`) and the staging
+dispute-stack manifest name the same addresses as the Bypass records, staging
+selects UPV4, and staging signals carry the policy envelope. The predecessor
+staging vault stays exported as `StakeVaultMethodScoped`, so its stake remains
+readable and withdrawable. Base (production and preproduction) exports zero
+placeholders that the resolvers ignore: signals keep `0x`, UPV3 remains
+selected, and `noStake: true` throws `ValidationError` with field `noStake`.
+Base canonical aliases and its dispute-stack manifest are unchanged. No-stake
+availability still follows the live chain: the live lifecycle hook's policy
+must be the resolved payment-validation policy.
+
+**Breaking migration:** caller `data` is removed from signal parameters. UPV4
+interprets every non-empty V3 data value as a payment-validation envelope.
+Pass `noStake` instead; supply post-intent hook inputs as `postIntentHookData`
+at fulfillment. Legacy JavaScript calls with `data: '0x'` or `undefined`
+are accepted; other values throw `ValidationError` with field `data`.
+
+### Read or change an intent's stake mode
+
+`client.getPaymentValidationPolicyContract()` returns `{ address, abi }` or
+`undefined`. The standalone `getPaymentValidationPolicyContract(chainId, env)`
+resolves only the named Bypass policy record or its staging override. Bypass
+records remain exported by name after canonical aliases move to their addresses;
+without a Bypass address, resolution fails closed.
+The returned ABI merges the bundle with `NO_STAKE_DISPUTE_PROTECTION_POLICY_ABI`.
+
+For a deployment with that policy, the taker can change a pending intent's mode:
+
+```ts
+const policy = client.getPaymentValidationPolicyContract();
+if (!policy) throw new Error('No payment-validation policy in this deployment');
+
+const prepared = await client.setIntentNoStake.prepare({
+  intentHash,
+  noStake: true,
+});
+// Or execute using client.setIntentNoStake({ intentHash, noStake: true }).
+
+const noStake = await client.isIntentNoStake(intentHash);
+const intent = await client.getDisputeProtectionIntent(intentHash, {
+  disputeProtectionPolicyAddress: policy.address,
+  blockNumber: 123456n, // Optional historical read
+});
+```
+
+`setIntentNoStake` accepts optional `orchestratorAddress`,
+`disputeProtectionPolicyAddress`, and `txOverrides`. The default orchestrator
+is configured OrchestratorV3; an override must be a configured orchestrator.
+The policy defaults to the payment-validation policy and throws if neither
+resolution nor an explicit address supplies one. The contract enforces taker
+ownership, pending status, and sufficient free stake when switching back to
+staked mode.
+
+`isIntentNoStake(intentHash, { disputeProtectionPolicyAddress? })` uses the same
+policy default. `getDisputeProtectionIntent(intentHash, options?)` also accepts
+`blockNumber` and falls back to the canonical policy: its eight-field tuple is
+identical on the old deployment. Pin the original policy when reading historical
+intents; this API does not discover which policy owns an intent.
+
+`DisputeProtectionIntent` contains `taker`, `stakeOwner`, `depositor`,
+`paymentMethod`, `status`, `riskWindow`, `releaseEligibleAt`, and
+`releaseAmount`. Its exported `DisputeProtectionIntentStatus` enum is
+`None=0, Pending=1, Cancelled=2, Settled=3, Released=4, Disputed=5`.
+`parseDisputeProtectionIntent(value: unknown)` accepts a named object or
+positional tuple and returns `null` for malformed values. The client getter
+throws for malformed results.
+
+`encodePaymentValidationHookData(policy: Address, noStake: boolean): Hex` and
+`decodePaymentValidationHookData(data: Hex): { policy: Address; noStake: boolean } | null`
+are exported for integrations validating envelopes; decoding rejects malformed
+or noncanonical data.
+
 ## Extend an Intent Lifetime
 
 The standalone `IntentGuardian` lets any payer buy more time for a live intent.
@@ -1195,3 +1321,17 @@ pnpm docs
 Use `platform: 'upi'` with `callerAddress` and `sessionMaterial: { sessionCookie, userAgent }` in the private extension runtime. Omit `payeeId` and `offchainId` when creating the bundle: the attestor derives the receiving VPA from Amazon's current QR. `getAmazonPaySellerIdentity(bundle)` reads that returned identity; storage registers that exact VPA and checks its maker hash against the sealed bundle. Never expose session material to the requesting page.
 
 Amazon capture requires extension 0.6.8 or later. Staging SAR uses the trusted staging attestor and staging provider templates; production requires its Amazon template and backend rollout. This source change does not publish either package or extension.
+
+### Historical dispute policy lookup
+
+`findDisputeProtectionIntent({ publicClient, chainId, environment, intentHash,
+blockNumber? })` queries the payment-validation, canonical, manifest, and
+recognized predecessor policies in that order, deduplicated. The first intent
+whose status is not `None` wins. It returns `null` only when every intent read
+parses as `None`; an unreadable intent throws. The result contains
+`policyAddress`, the parsed `intent`, and `noStake` (false if that getter reverts).
+All calls share a block. Use the returned policy for dispute submission and
+`readDisputeAttestationConfig({ publicClient, chainId, environment, policyAddress })`.
+For a known non-manifest policy, the latter follows `disputeVerifier()` and
+`attestationVerifier()` before reading witnesses and threshold at one block.
+Unknown policies throw. Omitting `policyAddress` preserves manifest behavior.

package/dist/build-metadata.json

@@ -2,12 +2,12 @@
   "schemaVersion": 2,
   "source": {
     "repository": "zkp2p/zkp2p-clients",
-    "commitSha": "959ea2fdca3a9938c97be98f96f66f1e74ec144d",
+    "commitSha": "471e50cadb04d41b35fe48316aa94c56dec4d4a7",
     "kind": "github",
     "distributable": true
   },
-  "sdkPackageVersion": "0.14.8-rc.0",
-  "contractsPackageVersion": "0.4.4-rc.2",
+  "sdkPackageVersion": "0.15.0-rc.0",
+  "contractsPackageVersion": "0.4.4-rc.5",
   "indexerSchemaPackageVersion": "0.22.0",
   "activeDisputeStack": {
     "base": {
@@ -16,7 +16,7 @@
     },
     "baseStaging": {
       "version": 2,
-      "selectionHash": "6c49c1ce51eec594a22385c4efcab08aa9926b6b63a725e14a0027ec5d2f4fc9"
+      "selectionHash": "e3b360a09c2f541052ab7519987862e1f59c0efc9bc25daea09937e9ea59b783"
     }
   }
 }

package/dist/{chunk-KQT4XYPO.mjs → chunk-6K2RTFER.mjs}

@@ -5,8 +5,8 @@ var __export = (target, all) => {
 };
 
 // <define:__ZKP2P_SDK_BUILD_METADATA__>
-var define_ZKP2P_SDK_BUILD_METADATA_default = { schemaVersion: 2, source: { repository: "zkp2p/zkp2p-clients", commitSha: "959ea2fdca3a9938c97be98f96f66f1e74ec144d", kind: "github", distributable: true }, sdkPackageVersion: "0.14.8-rc.0", contractsPackageVersion: "0.4.4-rc.2", indexerSchemaPackageVersion: "0.22.0", activeDisputeStack: { base: { version: 2, selectionHash: "ba40c2954b408d0c658881a8d28e5bfcc9bade5cc3d953fd17eae1eca69d841c" }, baseStaging: { version: 2, selectionHash: "6c49c1ce51eec594a22385c4efcab08aa9926b6b63a725e14a0027ec5d2f4fc9" } } };
+var define_ZKP2P_SDK_BUILD_METADATA_default = { schemaVersion: 2, source: { repository: "zkp2p/zkp2p-clients", commitSha: "471e50cadb04d41b35fe48316aa94c56dec4d4a7", kind: "github", distributable: true }, sdkPackageVersion: "0.15.0-rc.0", contractsPackageVersion: "0.4.4-rc.5", indexerSchemaPackageVersion: "0.22.0", activeDisputeStack: { base: { version: 2, selectionHash: "ba40c2954b408d0c658881a8d28e5bfcc9bade5cc3d953fd17eae1eca69d841c" }, baseStaging: { version: 2, selectionHash: "e3b360a09c2f541052ab7519987862e1f59c0efc9bc25daea09937e9ea59b783" } } };
 
 export { __export, define_ZKP2P_SDK_BUILD_METADATA_default };
-//# sourceMappingURL=chunk-KQT4XYPO.mjs.map
-//# sourceMappingURL=chunk-KQT4XYPO.mjs.map
+//# sourceMappingURL=chunk-6K2RTFER.mjs.map
+//# sourceMappingURL=chunk-6K2RTFER.mjs.map

package/dist/{chunk-KQT4XYPO.mjs.map → chunk-6K2RTFER.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["%3Cdefine:__ZKP2P_SDK_BUILD_METADATA__%3E"],"names":[],"mappings":";;;;;;;AAAA,IAAA,uCAAA,GAAA,EAAC,aAAA,EAAgB,CAAA,EAAE,MAAA,EAAS,EAAC,YAAa,qBAAA,EAAsB,SAAA,EAAY,0CAAA,EAA2C,IAAA,EAAO,UAAS,aAAA,EAAgB,IAAA,EAAI,EAAE,iBAAA,EAAoB,eAAc,uBAAA,EAA0B,YAAA,EAAa,2BAAA,EAA8B,QAAA,EAAS,oBAAqB,EAAC,IAAA,EAAO,EAAC,OAAA,EAAU,GAAE,aAAA,EAAgB,kEAAA,EAAkE,EAAE,WAAA,EAAc,EAAC,OAAA,EAAU,CAAA,EAAE,aAAA,EAAgB,kEAAA,IAAmE","file":"chunk-KQT4XYPO.mjs","sourcesContent":["{\"schemaVersion\":2,\"source\":{\"repository\":\"zkp2p/zkp2p-clients\",\"commitSha\":\"959ea2fdca3a9938c97be98f96f66f1e74ec144d\",\"kind\":\"github\",\"distributable\":true},\"sdkPackageVersion\":\"0.14.8-rc.0\",\"contractsPackageVersion\":\"0.4.4-rc.2\",\"indexerSchemaPackageVersion\":\"0.22.0\",\"activeDisputeStack\":{\"base\":{\"version\":2,\"selectionHash\":\"ba40c2954b408d0c658881a8d28e5bfcc9bade5cc3d953fd17eae1eca69d841c\"},\"baseStaging\":{\"version\":2,\"selectionHash\":\"6c49c1ce51eec594a22385c4efcab08aa9926b6b63a725e14a0027ec5d2f4fc9\"}}}"]}
+{"version":3,"sources":["%3Cdefine:__ZKP2P_SDK_BUILD_METADATA__%3E"],"names":[],"mappings":";;;;;;;AAAA,IAAA,uCAAA,GAAA,EAAC,aAAA,EAAgB,CAAA,EAAE,MAAA,EAAS,EAAC,YAAa,qBAAA,EAAsB,SAAA,EAAY,0CAAA,EAA2C,IAAA,EAAO,UAAS,aAAA,EAAgB,IAAA,EAAI,EAAE,iBAAA,EAAoB,eAAc,uBAAA,EAA0B,YAAA,EAAa,2BAAA,EAA8B,QAAA,EAAS,oBAAqB,EAAC,IAAA,EAAO,EAAC,OAAA,EAAU,GAAE,aAAA,EAAgB,kEAAA,EAAkE,EAAE,WAAA,EAAc,EAAC,OAAA,EAAU,CAAA,EAAE,aAAA,EAAgB,kEAAA,IAAmE","file":"chunk-6K2RTFER.mjs","sourcesContent":["{\"schemaVersion\":2,\"source\":{\"repository\":\"zkp2p/zkp2p-clients\",\"commitSha\":\"471e50cadb04d41b35fe48316aa94c56dec4d4a7\",\"kind\":\"github\",\"distributable\":true},\"sdkPackageVersion\":\"0.15.0-rc.0\",\"contractsPackageVersion\":\"0.4.4-rc.5\",\"indexerSchemaPackageVersion\":\"0.22.0\",\"activeDisputeStack\":{\"base\":{\"version\":2,\"selectionHash\":\"ba40c2954b408d0c658881a8d28e5bfcc9bade5cc3d953fd17eae1eca69d841c\"},\"baseStaging\":{\"version\":2,\"selectionHash\":\"e3b360a09c2f541052ab7519987862e1f59c0efc9bc25daea09937e9ea59b783\"}}}"]}