@zkp2p/zkp2p-attestation 1.5.1 → 1.6.2

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.6.2
+
+- Default the production environment to `https://attestation-service.zkp2p.xyz` and bundle a production PCR8 pin for that hostname. The historical `attestation-service-preprod.zkp2p.xyz` hostname remains pinned to the same production PCR8.
+- Retry transient network-layer `GET /attestation` failures before surfacing `ATTESTATION_FETCH_FAILED`; HTTP errors, invalid responses, and timeouts still fail immediately.
+
+## 1.6.1
+
+- Add Cash App identity request typing for `register_cashapp`. Cash App identity session material requires `sessionCookie` and `requestPayload`, accepts optional `requestHeaders`, and uses `{}` public params.
+
+## 1.6.0
+
+- Add generic buyer TEE Zelle typing for `platform: "zelle"` and bank-specific action types `transfer_zelle_bofa`, `transfer_zelle_chase`, and `transfer_zelle_citi`; direct bank-specific Zelle routes and method hashes remain legacy drain-only.
+
 ## 1.5.1
 
 - Change Venmo identity registration to derive the stories URL from `params.SENDER_ID`. Venmo identity session material now requires only `Cookie`, while the service verifies the authenticated account id before replaying the derived stories request.

package/README.md

@@ -29,9 +29,9 @@ Environment defaults:
 | Environment | Service URL | PCR8 source |
 |---|---|---|
 | `staging` | `https://attestation-service-staging.zkp2p.xyz` | bundled staging pin |
-| `production` | `https://attestation-service-preprod.zkp2p.xyz` | bundled production/preprod pin |
+| `production` | `https://attestation-service.zkp2p.xyz` | bundled production pin |
 
-Callers can still pass `attestationServiceUrl` and `trust.expectedPcr8Hex` directly. Explicit trust pins always win.
+Callers can still pass `attestationServiceUrl` and `trust.expectedPcr8Hex` directly. Explicit trust pins always win. The historical `https://attestation-service-preprod.zkp2p.xyz` hostname remains pinned to the same production PCR8 while it continues to serve the Nitro prod deployment.
 
 ## Fast Path
 
@@ -75,7 +75,7 @@ const verifiedCredentialBundle = verifySellerCredentialBundle(credentialBundle,
 });
 ```
 
-Venmo, Cash App, and PayPal still require a top-level `payeeId`; existing callers can keep using the same call shape:
+Venmo, Cash App, PayPal, and Zelle still require a top-level `payeeId`; existing callers can keep using the same call shape:
 
 ```ts
 const encryptedUpload = await nitro.createEncryptedSellerCredentialUpload({
@@ -88,6 +88,8 @@ Venmo seller uploads can use either the existing session material or Google OAut
 
 PayPal Gmail OAuth seller uploads use the same app-selection model. Pass the seller PayPal email as `payeeId` and use `sessionMaterial: { credentialSource: "google_oauth", authorizationCode, redirectUri }`; the service validates Gmail access against paypal.com DKIM-signed payment receipts. To onboard through a partner-owned Google OAuth app, include `oauthClient: { clientId, clientSecret }` inside the encrypted `sessionMaterial`. The PayPal partner client secret is handled as seller credential material: it rides only in the compact JWE upload plaintext, is sealed with the Gmail refresh token in the KMS-envelope seller credential bundle, and is reused only to refresh that seller's Gmail access token.
 
+Zelle seller uploads use the same Gmail OAuth shape with `platform: "zelle"` and a top-level `payeeId` for the seller's Zelle recipient identifier. The service validates the OAuth mailbox by finding at least one DKIM-verified incoming Zelle receipt from a supported bank/Zelle sender, then later resolves `/seller/verify/zelle` by matching `txId` against the received receipt's transaction, confirmation, reference, or payment id. Seller Zelle attestations use the generic on-chain payment method `keccak256("zelle")`; receipt providers such as Chase, Citi, and Bank of America are metadata only.
+
 Buyer TEE requests use the same attested upload key and compact JWE envelope. The typed helper encrypts the captured
 session material, posts `{ encryptedSessionMaterial, params, chainId, intent }` to
 `POST /buyer/verify/:platform/:actionType`, unwraps the service envelope, and returns a typed `AttestationOutput`.
@@ -152,8 +154,15 @@ Buyer TEE platform matrix:
 | `chime` | `transfer_chime` | `Cookie`, `body` | `{}` |
 | `chase` | `transfer_zelle` | `Cookie`, `x-jpmc-channel`, `x-jpmc-csrf-token`, `Referer`, `Origin` | `index` |
 | `bankofamerica` | `transfer_zelle` | `Cookie` | `index` |
+| `zelle` | `transfer_zelle_bofa` | `Cookie` | `index` |
+| `zelle` | `transfer_zelle_chase` | `Cookie`, `x-jpmc-channel`, `x-jpmc-csrf-token`, `Referer`, `Origin` | `index` |
+| `zelle` | `transfer_zelle_citi` | `Cookie` | `index` |
 | `paypal` | `transfer_paypal` | `Cookie` | `PAYMENT_ID` |
 
+The generic Zelle buyer routes use bank-specific action types and attest `intent.paymentMethod = hashUtf8("zelle")`.
+New Zelle deposits and intents should use generic `zelle`. Direct bank-specific routes remain available only for
+legacy drain support with `hashUtf8("zelle-citi")`, `hashUtf8("zelle-chase")`, or `hashUtf8("zelle-bofa")`.
+
 Per-platform session-material types require these headers using the canonical names shown above while still allowing
 additional captured headers. Captured request bodies are session material because they can contain sensitive data and
 are encrypted before being sent to the service.
@@ -194,14 +203,19 @@ Identity platform matrix:
 | `venmo` | `register_venmo` | `Cookie` | `SENDER_ID` |
 | `paypal` | `register_paypal` | `Cookie` | `{}` |
 | `wise` | `register_wise` | `Cookie`, `X-Access-Token` | `PROFILE_ID` |
+| `cashapp` | `register_cashapp` | `sessionCookie`, `requestPayload`, optional `requestHeaders` | `{}` |
 
 For Venmo identity, pass `SENDER_ID` in public params and include a replayable `Cookie` header in encrypted session
 material. The service verifies the authenticated account id, derives the stories URL from `SENDER_ID`, and requires
 Venmo to return a valid stories response with an explicit `stories` array.
 
+For Cash App identity, pass the replayable Cash App session cookie as `sessionMaterial.sessionCookie` and the canonical
+`MY_ACTIVITY_WEB_V2` activity request body as `sessionMaterial.requestPayload`. Include captured replayable headers in
+`sessionMaterial.requestHeaders` when needed; the service ignores public params for this flow.
+
 Buyer TEE and identity expose discriminated unions keyed by `platform` and `actionType`, including per-platform
 `params`, so invalid pairings fail during TypeScript compilation. Seller credential upload keeps its existing
-platform narrowing (`wise` derives payee id from the credential; Venmo, Cash App, and PayPal require `payeeId`) but
+platform narrowing (`wise` derives payee id from the credential; Venmo, Cash App, PayPal, and Zelle require `payeeId`) but
 does not add exhaustive `sessionMaterial` typing: each seller platform can accept multiple credential sources, such as
 cookie headers or Google OAuth with optional partner OAuth client material, and encoding all combinations would make
 the SDK brittle without improving the wire contract.

package/dist/cli/verify.js

@@ -4267,6 +4267,8 @@ function parseAdvertisedPcr8(value, label) {
 
 // src/attestation/fetch.ts
 var MAX_ATTESTATION_RESPONSE_BYTES = 256 * 1024;
+var NETWORK_LAYER_FETCH_ATTEMPTS = 3;
+var NETWORK_LAYER_RETRY_DELAY_MS = 150;
 var ETH_ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
 function buildAttestationUrl(attestationServiceUrl, nonceHex) {
   const url = new URL(attestationServiceUrl);
@@ -4278,7 +4280,7 @@ function buildAttestationUrl(attestationServiceUrl, nonceHex) {
 }
 async function fetchAttestationEnvelope(params) {
   const url = buildAttestationUrl(params.attestationServiceUrl, params.nonceHex);
-  const response = await fetchWithTimeout(url.toString(), params.fetch, params.timeoutMs);
+  const response = await fetchWithNetworkRetry(url.toString(), params.fetch, params.timeoutMs);
   const responseText = await readResponseText(response);
   if (!response.ok) {
     fail("ATTESTATION_FETCH_FAILED", `GET /attestation failed with HTTP ${response.status}`, {
@@ -4372,6 +4374,20 @@ function parseOptionalAdvertisedPcr8(value, label) {
     fail("ATTESTATION_RESPONSE_INVALID", `${label} must be a 96-character lowercase hex string`, { cause });
   }
 }
+async function fetchWithNetworkRetry(url, fetcher, timeoutMs) {
+  let attempt = 1;
+  while (true) {
+    try {
+      return await fetchWithTimeout(url, fetcher, timeoutMs);
+    } catch (cause) {
+      if (!isNetworkLayerFetchFailure(cause) || attempt >= NETWORK_LAYER_FETCH_ATTEMPTS) {
+        throw cause;
+      }
+      await sleep(NETWORK_LAYER_RETRY_DELAY_MS * attempt);
+      attempt += 1;
+    }
+  }
+}
 async function fetchWithTimeout(url, fetcher, timeoutMs) {
   const controller = typeof AbortController !== "undefined" ? new AbortController() : void 0;
   let timeoutHandle;
@@ -4400,9 +4416,18 @@ async function fetchWithTimeout(url, fetcher, timeoutMs) {
     if (cause instanceof Error && (cause.name === "AbortError" || cause.message === "timeout")) {
       fail("TIMEOUT", `GET /attestation timed out after ${timeoutMs}ms`, { cause });
     }
-    fail("ATTESTATION_FETCH_FAILED", "GET /attestation failed at the network layer", { cause });
+    fail("ATTESTATION_FETCH_FAILED", "GET /attestation failed at the network layer", {
+      cause,
+      details: { layer: "network" }
+    });
   }
 }
+function isNetworkLayerFetchFailure(cause) {
+  return cause instanceof NitroAttestationError && cause.code === "ATTESTATION_FETCH_FAILED" && cause.details?.layer === "network";
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -4482,7 +4507,8 @@ var STAGING_PCR8 = "5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea571
 var PRODUCTION_PCR8 = "41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e";
 var DEFAULT_EXPECTED_PCR8_BY_HOST = {
   "attestation-service-staging.zkp2p.xyz": normalizePcr8Pin(STAGING_PCR8, "bundled staging PCR8"),
-  "attestation-service-preprod.zkp2p.xyz": normalizePcr8Pin(PRODUCTION_PCR8, "bundled production PCR8")
+  "attestation-service-preprod.zkp2p.xyz": normalizePcr8Pin(PRODUCTION_PCR8, "bundled production PCR8"),
+  "attestation-service.zkp2p.xyz": normalizePcr8Pin(PRODUCTION_PCR8, "bundled production PCR8")
 };
 
 // src/trust/resolveExpectedPcr8.ts