vet-sdk-core-ts 0.4.18 → 0.4.19

package/dist/payment.d.ts

@@ -1,10 +1,10 @@
-import { type EvmPaymentNetworkId, type UsdcEvmNetwork, type UsdcPaymentQuote } from 'vet-data-utils-ts/payment';
-export { EvmPaymentNetworkIds, PaymentAssetIds, PaymentCurrencyCodes, PaymentProviderIds, USDC_BASE_NETWORKS, USDC_DECIMALS, VET_PAYMENT_TEST_DATA, type EvmPaymentNetworkId, type PaymentProviderId, type UsdcEvmNetwork, type UsdcPaymentQuote, usdOfferToUsdcMinor, } from 'vet-data-utils-ts/payment';
-export type UsdcPaymentQuotePolicy = Readonly<{
+import { type EvmPaymentNetworkId, type EvmTransferNetwork, type EvmTransferPaymentQuote } from 'vet-data-utils-ts/payment';
+export { EvmPaymentNetworkIds, PaymentAssetIds, PaymentCurrencyCodes, PaymentProviderIds, USDC_BASE_NETWORKS, USDC_DECIMALS, VET_PAYMENT_TEST_DATA, type EvmPaymentNetworkId, type PaymentProviderId, type EvmTransferNetwork, type EvmTransferPaymentConfirmation, type EvmTransferPaymentQuote, usdOfferToUsdcMinor, } from 'vet-data-utils-ts/payment';
+export type EvmTransferPaymentQuotePolicy = Readonly<{
     now: Date;
     recipient: `0x${string}`;
     allowMainnet: boolean;
-    networks?: Readonly<Partial<Record<EvmPaymentNetworkId, UsdcEvmNetwork>>>;
+    networks?: Readonly<Partial<Record<EvmPaymentNetworkId, EvmTransferNetwork>>>;
 }>;
 /** Validates a server-authored quote without trusting browser network fields. */
-export declare function validateUsdcPaymentQuote(value: unknown, policy: UsdcPaymentQuotePolicy): UsdcPaymentQuote;
+export declare function validateEvmTransferPaymentQuote(value: unknown, policy: EvmTransferPaymentQuotePolicy): EvmTransferPaymentQuote;

package/dist/payment.js

@@ -1,4 +1,4 @@
-import { PaymentProviderIds, USDC_DECIMALS, USDC_BASE_NETWORKS, } from 'vet-data-utils-ts/payment';
+import { PaymentProviderIds, PaymentAssetIds, USDC_DECIMALS, USDC_BASE_NETWORKS, } from 'vet-data-utils-ts/payment';
 export { EvmPaymentNetworkIds, PaymentAssetIds, PaymentCurrencyCodes, PaymentProviderIds, USDC_BASE_NETWORKS, USDC_DECIMALS, VET_PAYMENT_TEST_DATA, usdOfferToUsdcMinor, } from 'vet-data-utils-ts/payment';
 const EVM_ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
 const POSITIVE_INTEGER_PATTERN = /^[1-9][0-9]*$/;
@@ -6,11 +6,13 @@ function paymentContractError(code) {
     throw new Error(code);
 }
 /** Validates a server-authored quote without trusting browser network fields. */
-export function validateUsdcPaymentQuote(value, policy) {
+export function validateEvmTransferPaymentQuote(value, policy) {
     if (!value || typeof value !== "object")
         paymentContractError("payment_quote_invalid");
     const quote = value;
-    if (quote.version !== 1 || quote.provider !== PaymentProviderIds.UsdcEvm) {
+    if (quote.version !== 1
+        || quote.provider !== PaymentProviderIds.EvmTransfer
+        || quote.asset !== PaymentAssetIds.Usdc) {
         paymentContractError("payment_quote_invalid");
     }
     const networks = policy.networks || USDC_BASE_NETWORKS;
@@ -20,7 +22,8 @@ export function validateUsdcPaymentQuote(value, policy) {
     if (network.mainnet && !policy.allowMainnet)
         paymentContractError("payment_mainnet_not_enabled");
     if (!EVM_ADDRESS_PATTERN.test(String(quote.tokenContract || ""))
-        || quote.tokenContract?.toLowerCase() !== network.usdcContract.toLowerCase()) {
+        || quote.asset !== network.asset
+        || quote.tokenContract?.toLowerCase() !== network.tokenContract.toLowerCase()) {
         paymentContractError("payment_token_contract_not_allowed");
     }
     if (!EVM_ADDRESS_PATTERN.test(String(quote.recipient || ""))
@@ -30,12 +33,16 @@ export function validateUsdcPaymentQuote(value, policy) {
     if (!POSITIVE_INTEGER_PATTERN.test(String(quote.amountMinor || "")) || quote.decimals !== USDC_DECIMALS) {
         paymentContractError("payment_amount_invalid");
     }
-    if (!String(quote.paymentReference || "").trim() || !String(quote.invoiceId || "").trim()) {
+    if (!String(quote.paymentReference || "").trim()
+        || !String(quote.invoiceId || "").trim()
+        || !String(quote.offerId || "").trim()) {
         paymentContractError("payment_reference_invalid");
     }
     const expiresAt = Date.parse(String(quote.expiresAt || ""));
-    if (!Number.isFinite(expiresAt))
+    const createdAt = Date.parse(String(quote.createdAt || ""));
+    if (!Number.isFinite(createdAt) || !Number.isFinite(expiresAt) || createdAt >= expiresAt) {
         paymentContractError("payment_quote_invalid");
+    }
     if (expiresAt <= policy.now.getTime())
         paymentContractError("payment_quote_expired");
     return quote;

package/docs/LOCAL_FIRST_RELEASE_CONTRACT.md

@@ -55,6 +55,14 @@ Keep all participating repositories on pushed but unmerged branches while the
 local matrix is still being corrected. Build an immutable tarball with
 `npm pack` and install it in downstream branches with `--no-save`.
 
+Start every downstream proof from its committed lockfile with `npm ci`. If a
+normal `npm install --no-save <tarball>` would re-resolve unrelated dependency
+ranges, do not use that resolver path: overlay the exact packed contents in the
+matching `node_modules` package directory, or use an equivalent isolated
+installation that leaves `package.json` and the lockfile unchanged. Before
+testing, verify the exact local package versions and any runtime-sensitive
+baseline dependencies. A later `npm ci` must remove the temporary overlay.
+
 The tarball is temporary test input. Never commit a `file:`, Git, workspace or
 vendored tarball dependency or its generated lockfile state. An npm
 authorization or publication failure must never stop the local `test` stage.
@@ -78,7 +86,8 @@ After all local gates are green:
    versions installed, then build immutable GW images and run `local-network`.
 6. Portal consumers remain on pushed, unmerged branches with the immutable
    tarball during `local-network`; do not reinstall or repeat their already-green
-   local matrix.
+   local matrix. The gateway image and Fabric gate do not require changing a
+   portal that already proved the same package tarball locally.
 7. After `local-network` is green, install the exact registry version in each
    affected portal, commit its registry dependency and lockfile, and run only
    the minimal artifact smoke.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vet-sdk-core-ts",
-  "version": "0.4.18",
+  "version": "0.4.19",
   "description": "Browser-safe VetChain core contracts and governed animal species identifiers",
   "license": "Apache-2.0",
   "author": "Connecting Solution & Applications Ltd",
@@ -68,6 +68,6 @@
   "dependencies": {
     "@noble/hashes": "^2.2.0",
     "gdc-common-utils-ts": "2.9.4",
-    "vet-data-utils-ts": "0.5.4"
+    "vet-data-utils-ts": "0.5.5"
   }
 }