@zkp2p/zkp2p-attestation 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.3.0
+
+- BREAKING: Buyer TEE verify request body field renamed from `metadata` to `params`. The server Zod schema rejects the legacy `metadata` field. All `*BuyerTeeMetadata` types in `@zkp2p/zkp2p-attestation` are renamed to `*BuyerTeeParams`, and `BuyerTeeMetadataByPlatform` is now `BuyerTeeParamsByPlatform`.
+- BREAKING: Buyer TEE `params` shape no longer accepts duplicate provider-row fields. `N26BuyerTeeParams` is `{}`. `RevolutBuyerTeeParams`, `CitiBuyerTeeParams`, and `BankOfAmericaBuyerTeeParams` are `{ index }` only — `paymentId`, `transactionId`, and `confirmationNumber` are derived from the selected response row.
+- BREAKING: Drop `jweId` from the buyer TEE session-material plaintext and from `EncryptBuyerTeeSessionMaterialBaseParams`. The server enforces a strict plaintext schema and rejects envelopes that still carry `jweId`. Seller credential upload still uses `jweId`.
+- BREAKING: Drop `issuedAtMs` and `now` from `EncryptBuyerTeeSessionMaterialBaseParams` and from the buyer TEE plaintext schema. The server no longer enforces a 5-minute capture-age window on buyer envelopes; encrypted session material is valid for the lifetime of the upstream session (cookies/PAT). Seller credential upload still carries `issuedAtMs` and is unchanged.
+- Migration: regenerate buyer TEE envelopes after upgrading; do not retry an envelope produced by `<1.3.0`. Update buyer TEE call sites to rename `metadata` to `params` and drop the removed per-platform fields (Revolut `paymentId`, Citi `transactionId`, BoA `confirmationNumber`, N26 `paymentId`).
+- Operational note: a leaked encrypted JWE is now valid for the upstream session lifetime — treat any disclosure as equivalent to leaking the underlying upstream credential and rotate the upstream session.
+
 ## 1.2.0
 
 - Expand buyer TEE SDK types from Venmo-only to all 15 server-registered platforms.

package/README.md

@@ -78,8 +78,12 @@ const encryptedUpload = await nitro.createEncryptedSellerCredentialUpload({
 ```
 
 Buyer TEE requests use the same attested upload key and compact JWE envelope. The typed helper encrypts the captured
-session material, posts `{ encryptedSessionMaterial, metadata, chainId, intent }` to
-`POST /buyer/verify/:platform/:actionType`, unwraps the service envelope, and returns a typed `AttestationOutput`:
+session material, posts `{ encryptedSessionMaterial, params, chainId, intent }` to
+`POST /buyer/verify/:platform/:actionType`, unwraps the service envelope, and returns a typed `AttestationOutput`.
+The service does not enforce capture-age or one-use replay limits for buyer TEE session material; verification depends
+on the upstream session still being active. A leaked encrypted JWE is therefore valid for the upstream session
+lifetime — treat any accidental disclosure as equivalent to leaking the underlying upstream credential (cookies, PAT,
+etc.) and rotate the upstream session.
 
 ```ts
 const attestation = await nitro.verifyBuyerTeePayment({
@@ -89,7 +93,7 @@ const attestation = await nitro.verifyBuyerTeePayment({
     Cookie: "<captured-cookie-header>",
     "User-Agent": "<captured-user-agent>",
   },
-  metadata: { senderId: "<venmo-account-id>", index: 0 },
+  params: { senderId: "<venmo-account-id>", index: 0 },
   chainId,
   intent,
 });
@@ -109,7 +113,7 @@ await fetch(`${attestationServiceUrl}/buyer/verify/wise/transfer_wise`, {
   headers: { "content-type": "application/json" },
   body: JSON.stringify({
     encryptedSessionMaterial,
-    metadata: { profileId: "41246868", transactionId: "123456789" },
+    params: { profileId: "41246868", transactionId: "123456789" },
     chainId,
     intent,
   }),
@@ -118,26 +122,27 @@ await fetch(`${attestationServiceUrl}/buyer/verify/wise/transfer_wise`, {
 
 Buyer TEE platform matrix:
 
-| Platform | `actionType` | Required session-material headers | Metadata fields |
+| Platform | `actionType` | Required encrypted session material | Public params fields |
 |---|---|---|---|
 | `venmo` | `transfer_venmo` | `Cookie` | `senderId`, `index` |
 | `cashapp` | `transfer_cashapp` | `Cookie`, `x-csrf-token`, `x-device-name`, `x-request-signature`, `x-request-uuid`, `cash-web-request`, `x-web-device-info`, `x-web-context`, `x-bt-id` | `senderId`, `index` |
 | `luxon` | `transfer_luxon` | `X-Auth-Token` | `transferId` |
 | `monzo` | `transfer_monzo` | `Authorization` | `txId` |
-| `n26` | `transfer_n26` | `Cookie`, `csrf-token` | `body`, `paymentId` |
+| `n26` | `transfer_n26` | `Cookie`, `csrf-token`, `body` | `{}` |
 | `wise` | `transfer_wise` | `Cookie` or `X-Access-Token` | `profileId`, `transactionId` |
-| `revolut` | `transfer_revolut` | `Cookie`, `x-device-id` | `index`, `paymentId` |
+| `revolut` | `transfer_revolut` | `Cookie`, `x-device-id` | `index` |
 | `idfc` | `transfer_idfc` | `Cookie` | `senderId`, `index` |
-| `citi` | `transfer_zelle` | `Cookie` | `index`, optional `transactionId` |
-| `chime` | `transfer_chime` | `Cookie` | `body` |
+| `citi` | `transfer_zelle` | `Cookie` | `index` |
+| `chime` | `transfer_chime` | `Cookie`, `body` | `{}` |
 | `chase` | `transfer_zelle` | `Cookie`, `x-jpmc-channel`, `x-jpmc-csrf-token`, `Referer`, `Origin` | `index` |
-| `bankofamerica` | `transfer_zelle` | `Cookie` | `index`, `confirmationNumber` |
+| `bankofamerica` | `transfer_zelle` | `Cookie` | `index` |
 | `mercadopago` | `transfer_mercadopago` | `Cookie` | `paymentId`, `urlParamsFrom` |
 | `paypal` | `transfer_paypal` | `Cookie` | `index` |
 | `alipay` | `transfer_alipay` | `Cookie` | `tradeNo` |
 
 Per-platform session-material types require these headers using the canonical names shown above while still allowing
-additional captured headers.
+additional captured headers. Captured request bodies are session material because they can contain sensitive data and
+are encrypted before being sent to the service.
 
 ## Cache-Friendly Path
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zkp2p/zkp2p-attestation",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "type": "module",
   "description": "Browser, React Native, and Node verifier/encrypter for ZKP2P Nitro attested uploads",
   "packageManager": "yarn@3.6.3",