# Changelog

## 3.1.0

- Remove the retired preproduction hostname and PCR8 from bundled trust pins.
- Add typed Venmo and PayPal dispute helpers for attested session encryption, `POST /dispute/verify`, and local `DisputeAttestation` verification. The helpers use the `ZKP2P DisputeVerifier` EIP-712 domain and `DisputeDetails` wire fields while keeping all extracted identifiers out of public params.

## 3.0.1

- Restore the generic Buyer TEE compact JWE for standalone identity capture while retaining the Alipay types added in 3.0.0. `callerAddress` remains required on `POST /identity` and in the signed typed data, but is no longer required by identity encryption helpers or nested inside encrypted session material.
- Keep PayPal, Wise, and Alipay maker registration public without Privy bearer authentication, linked-wallet enforcement, an alternate endpoint, or a compatibility wire.

## 3.0.0

- BREAKING: `/identity` and its package helpers now require normalized `callerAddress` inside session-material JWEs and require the encrypted address to match the outer request. Unbound identity envelopes are rejected; buyer TEE envelopes are unchanged.
- Add typed Alipay buyer TEE and identity requests using `transfer_alipay`/`register_alipay` with encrypted `Cookie` session material.
- Add typed Monobank buyer TEE payloads using `transfer_monobank`, encrypted `X-Token` session material, and `ACCOUNT_ID`/`TRANSACTION_ID` params.
- Type seller-produced Monobank identity attestations as `register_monobank` while keeping Monobank excluded from the standalone identity request API.

## 2.0.0

- Hard-cut the preprod hostname to the isolated preprod enclave PCR8. Production remains pinned only at `attestation-service.zkp2p.xyz`.
- BREAKING: Buyer TEE Zelle verification now accepts only `platform: "zelle"` with `transfer_zelle_bofa`, `transfer_zelle_chase`, or `transfer_zelle_citi`. All three actions attest the generic Zelle payment-method hash.

## 1.6.3

- Bind the default global `fetch` fallback to `globalThis` so browser and extension callers that rely on SDK defaults do not hit receiver-sensitive `Illegal invocation` failures. Caller-provided `fetch` overrides are still used unchanged.

## 1.6.2

- Default the production environment to `https://attestation-service.zkp2p.xyz` and bundle a production PCR8 pin for that hostname. The historical `attestation-service-preprod.zkp2p.xyz` hostname remains pinned to the same production PCR8.
- Retry transient network-layer `GET /attestation` failures before surfacing `ATTESTATION_FETCH_FAILED`; HTTP errors, invalid responses, and timeouts still fail immediately.

## 1.6.1

- Add Cash App identity request typing for `register_cashapp`. Cash App identity session material requires `sessionCookie` and `requestPayload`, accepts optional `requestHeaders`, and uses `{}` public params.

## 1.6.0

- Add generic buyer TEE Zelle typing for `platform: "zelle"` and bank-specific action types `transfer_zelle_bofa`, `transfer_zelle_chase`, and `transfer_zelle_citi`.

## 1.5.1

- Change Venmo identity registration to derive the stories URL from `params.SENDER_ID`. Venmo identity session material now requires only `Cookie`, while the service verifies the authenticated account id before replaying the derived stories request.

## 1.5.0

- Require the captured Venmo identity stories URL in session material. This release was superseded by `1.5.1` because the runtime no longer requires `sessionMaterial.url`.
- Require `callerAddress` on identity attestation requests and bind it into the signed `IdentityAttestation`; `verifyIdentityAttestation` now requires `expectedCallerAddress`.

## 1.4.0

- Add typed identity flow helpers: `encryptIdentitySessionMaterial`, `createEncryptedIdentitySessionMaterial`, and `requestIdentityAttestation`.
- Add response signature verifiers for all TEE flows: `verifyBuyerTeePaymentAttestation`, `verifyIdentityAttestation`, and `verifySellerCredentialBundle`.
- Require caller-provided intent/payee bindings in response verifiers so valid same-domain attestations cannot be replayed for the wrong buyer intent, identity, or seller credential.
- Export `getUnifiedPaymentVerifierDomainSeparator` and `hashUtf8` so consumers can pin the EIP-712 domain and compute expected payee hashes.
- Add identity platform/action/params typing for Venmo, PayPal, and Wise. Wrong platform/action pairings now fail at TypeScript compile time.
- Keep buyer TEE's per-platform param typing and add identity param typing. Seller credential upload keeps its existing Wise-vs-payee-id platform narrowing while leaving `sessionMaterial` flexible because each seller platform can accept multiple credential sources.
- Move `ethers` to runtime dependencies because public response verifiers recover EIP-712 signers.

## 1.3.1

- Republish of 1.3.0 from a clean build. The 1.3.0 tarball on npm shipped a stale `dist/` (built from a pre-rebase checkout): the runtime `dist/index.cjs` still posted the legacy `metadata` field and the typings still exported `*BuyerTeeMetadata` / `BuyerTeeMetadataByPlatform`. The new server only accepts `params`, so consumers on 1.3.0 hit a 4xx on every buyer TEE verify call.
- Action: upgrade to 1.3.1. 1.3.0 will be `npm deprecate`'d.

## 1.3.0

- BREAKING: Buyer TEE verify request body field renamed from `metadata` to `params`. The server Zod schema rejects the legacy `metadata` field. All `*BuyerTeeMetadata` types in `@zkp2p/zkp2p-attestation` are renamed to `*BuyerTeeParams`, and `BuyerTeeMetadataByPlatform` is now `BuyerTeeParamsByPlatform`.
- BREAKING: Buyer TEE `params` shape no longer accepts duplicate provider-row fields. `N26BuyerTeeParams` is `{}`. `RevolutBuyerTeeParams`, `CitiBuyerTeeParams`, and `BankOfAmericaBuyerTeeParams` are `{ index }` only — `paymentId`, `transactionId`, and `confirmationNumber` are derived from the selected response row.
- BREAKING: Drop `jweId` from the buyer TEE session-material plaintext and from `EncryptBuyerTeeSessionMaterialBaseParams`. The server enforces a strict plaintext schema and rejects envelopes that still carry `jweId`. Seller credential upload still uses `jweId`.
- BREAKING: Drop `issuedAtMs` and `now` from `EncryptBuyerTeeSessionMaterialBaseParams` and from the buyer TEE plaintext schema. The server no longer enforces a 5-minute capture-age window on buyer envelopes; encrypted session material is valid for the lifetime of the upstream session (cookies/PAT). Seller credential upload still carries `issuedAtMs` and is unchanged.
- Migration: regenerate buyer TEE envelopes after upgrading; do not retry an envelope produced by `<1.3.0`. Update buyer TEE call sites to rename `metadata` to `params` and drop the removed per-platform fields (Revolut `paymentId`, Citi `transactionId`, BoA `confirmationNumber`, N26 `paymentId`).
- Operational note: a leaked encrypted JWE is now valid for the upstream session lifetime — treat any disclosure as equivalent to leaking the underlying upstream credential and rotate the upstream session.

## 1.2.0

- Expand buyer TEE SDK types from Venmo-only to all 15 server-registered platforms.
- Tie each buyer TEE platform to its valid `actionType`, metadata shape, and named session-material header map.
- Require documented buyer TEE session-material headers in the per-platform TypeScript types (e.g. Wise `Cookie` or `X-Access-Token`, Revolut `Cookie` and `x-device-id`). A payload missing the required headers is a type error at the call site.
- Export `AttestationOutput`, `BuyerTeeVerifier`, `/buyer/supported`, and service response types for callers.
- Add `verifyBuyerTeePayment()` and `uploadSellerCredential()` one-shot helpers that chain attest → encrypt → POST → unwrap and return a typed result.
- Enforce `timeoutMs` across buyer TEE verify and seller credential upload POST requests, including through response body reads so stalled streams abort.
- Preserve structured unsuccessful ServiceResponse details on SDK errors via a new `SERVICE_RESPONSE_ERROR` code carrying `details.responseObject` — enables UIs to consume Wise multi-profile `WISE_PROFILE_SELECTION_REQUIRED` payloads and any future business-logic 4xx.
- Reject successful ServiceResponse envelopes that omit a `responseObject` (defends against bad-deploy / proxy-rewrite cases that would otherwise resolve helpers with `undefined`).
- Add buyer TEE discriminated-union type tests for Wise metadata/action narrowing and Revolut header enforcement.
- Drop the deprecated `verifyingContract` from the new buyer TEE verify helper parameters; the server resolves it from `DEPLOYMENT_ENV`.
- Keep the internal service-response envelope out of the public SDK type exports.

## 1.1.0

- Add buyer TEE session-material encryption helpers.
- Add platform-aware seller credential upload encryption.
- Support Wise seller credential uploads with `platform: "wise"` and no top-level `payeeId`.
- Preserve the existing payee-based upload shape for Venmo, Cash App, and PayPal.

## 1.0.0

- Rename `@zkp2p/verify-nitro-attestation` to `@zkp2p/zkp2p-attestation`.
- Add browser/RN/Node WebCrypto verifier entrypoints.
- Add seller credential upload compact JWE encryption.
- Add environment-initialized client for staging and production/preprod deployments.
- Rewrite the verifier CLI on top of the library.
- Replace the deleted `verify.mjs` script with the `zkp2p-attestation-verify` package binary and `yarn verify` wrapper.
- Migration: consumers should install/import `@zkp2p/zkp2p-attestation`; any direct references to `package/verify-nitro-attestation/verify.mjs` should move to the package CLI or public library entrypoints.