@pafi-dev/issuer 0.24.1 → 0.25.0

package/dist/index.d.cts

@@ -1465,7 +1465,6 @@ interface ApiUserRequest {
     pointTokenAddress: Address;
 }
 interface ApiUserResponse {
-    mintRequestNonce: bigint;
     /**
      * Off-chain point balance from the issuer's ledger (excludes PENDING locks).
      * This is what the user can claim into on-chain PT via `/claim`.
@@ -2695,7 +2694,7 @@ interface IssuerStateValidatorLike {
  * own composer — gg56 uses a timestamp-key 2D nonce). Caller layers
  * paymaster sponsorship + sponsorAuth on top of the returned UserOps.
  */
-type PTClaimErrorCode = "INVALID_AMOUNT" | "VALIDATION_FAILED" | "BUILD_FAILED";
+type PTClaimErrorCode = "INVALID_AMOUNT" | "VALIDATION_FAILED" | "BUILD_FAILED" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT";
 declare class PTClaimError extends PafiSdkError {
     readonly httpStatus: "unprocessable";
     readonly code: PTClaimErrorCode;
@@ -2752,8 +2751,6 @@ interface PTClaimRequest {
     chainId: number;
     /** ERC-4337 account nonce for the user's EOA. */
     aaNonce: bigint;
-    /** Current `mintRequestNonces[userAddress]` from PointToken. */
-    mintRequestNonce: bigint;
 }
 interface PTClaimResponse {
     /** Sponsored UserOp — mint + PT fee transfer (when feeAmount > 0). */
@@ -2774,6 +2771,7 @@ interface PTClaimResponse {
 }
 declare class PTClaimHandler {
     private readonly cfg;
+    private readonly inFlightNonces;
     constructor(config: PTClaimHandlerConfig);
     handle(request: PTClaimRequest): Promise<PTClaimResponse>;
 }
@@ -3187,7 +3185,6 @@ interface PoolsDto {
     pools: unknown[];
 }
 interface UserDto {
-    mintRequestNonce: string;
     offChainBalance: string;
     onChainBalance: string;
     totalBalance: string;
@@ -3305,7 +3302,6 @@ declare class IssuerApiAdapter {
         pointTokenAddress: Address;
         amount: bigint;
         aaNonce: bigint;
-        mintRequestNonce: bigint;
     }): Promise<ClaimDto>;
     redeem(input: {
         authenticatedAddress: Address;
@@ -3327,7 +3323,6 @@ declare class IssuerApiAdapter {
         pointTokenAddress: Address;
         amount: bigint;
         aaNonce: bigint;
-        mintRequestNonce: bigint;
     }): Promise<MobilePrepareDto>;
     claimSubmit(input: {
         authenticatedAddress: Address;

package/dist/index.d.ts

@@ -1465,7 +1465,6 @@ interface ApiUserRequest {
     pointTokenAddress: Address;
 }
 interface ApiUserResponse {
-    mintRequestNonce: bigint;
     /**
      * Off-chain point balance from the issuer's ledger (excludes PENDING locks).
      * This is what the user can claim into on-chain PT via `/claim`.
@@ -2695,7 +2694,7 @@ interface IssuerStateValidatorLike {
  * own composer — gg56 uses a timestamp-key 2D nonce). Caller layers
  * paymaster sponsorship + sponsorAuth on top of the returned UserOps.
  */
-type PTClaimErrorCode = "INVALID_AMOUNT" | "VALIDATION_FAILED" | "BUILD_FAILED";
+type PTClaimErrorCode = "INVALID_AMOUNT" | "VALIDATION_FAILED" | "BUILD_FAILED" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT";
 declare class PTClaimError extends PafiSdkError {
     readonly httpStatus: "unprocessable";
     readonly code: PTClaimErrorCode;
@@ -2752,8 +2751,6 @@ interface PTClaimRequest {
     chainId: number;
     /** ERC-4337 account nonce for the user's EOA. */
     aaNonce: bigint;
-    /** Current `mintRequestNonces[userAddress]` from PointToken. */
-    mintRequestNonce: bigint;
 }
 interface PTClaimResponse {
     /** Sponsored UserOp — mint + PT fee transfer (when feeAmount > 0). */
@@ -2774,6 +2771,7 @@ interface PTClaimResponse {
 }
 declare class PTClaimHandler {
     private readonly cfg;
+    private readonly inFlightNonces;
     constructor(config: PTClaimHandlerConfig);
     handle(request: PTClaimRequest): Promise<PTClaimResponse>;
 }
@@ -3187,7 +3185,6 @@ interface PoolsDto {
     pools: unknown[];
 }
 interface UserDto {
-    mintRequestNonce: string;
     offChainBalance: string;
     onChainBalance: string;
     totalBalance: string;
@@ -3305,7 +3302,6 @@ declare class IssuerApiAdapter {
         pointTokenAddress: Address;
         amount: bigint;
         aaNonce: bigint;
-        mintRequestNonce: bigint;
     }): Promise<ClaimDto>;
     redeem(input: {
         authenticatedAddress: Address;
@@ -3327,7 +3323,6 @@ declare class IssuerApiAdapter {
         pointTokenAddress: Address;
         amount: bigint;
         aaNonce: bigint;
-        mintRequestNonce: bigint;
     }): Promise<MobilePrepareDto>;
     claimSubmit(input: {
         authenticatedAddress: Address;

package/dist/index.js

@@ -1665,7 +1665,6 @@ function hashKeyToInt64(key) {
 import { getAddress as getAddress5 } from "viem";
 import {
   getMintFeeBps,
-  getMintRequestNonce,
   getPointTokenBalance,
   isMinter
 } from "@pafi-dev/core";
@@ -1937,14 +1936,12 @@ var IssuerApiHandlers = class _IssuerApiHandlers {
         { requested: pointToken }
       );
     }
-    const [mintRequestNonce, offChainBalance, onChainBalance, minter] = await Promise.all([
-      getMintRequestNonce(this.provider, pointToken, normalizedAuthed),
+    const [offChainBalance, onChainBalance, minter] = await Promise.all([
       this.ledger.getBalance(normalizedAuthed, pointToken),
       getPointTokenBalance(this.provider, pointToken, normalizedAuthed),
       isMinter(this.provider, pointToken, normalizedAuthed)
     ]);
     return {
-      mintRequestNonce,
       offChainBalance,
       onChainBalance,
       totalBalance: offChainBalance + onChainBalance,
@@ -2087,7 +2084,8 @@ import {
   Source as Source2
 } from "@pafi-dev/core";
 var DEFAULT_REDEEM_LOCK_MS = 15 * 60 * 1e3;
-var DEFAULT_SIG_DEADLINE_SEC = 15 * 60;
+var M11_SAFETY_MARGIN_MS = 30 * 1e3;
+var DEFAULT_SIG_DEADLINE_SEC = (DEFAULT_REDEEM_LOCK_MS - M11_SAFETY_MARGIN_MS) / 1e3;
 var PTRedeemError = class extends PafiSdkError {
   httpStatus = "unprocessable";
   code;
@@ -2154,6 +2152,13 @@ var PTRedeemHandler = class {
     this.redeemLockDurationMs = config.redeemLockDurationMs ?? DEFAULT_REDEEM_LOCK_MS;
     this.signatureDeadlineSeconds = config.signatureDeadlineSeconds ?? DEFAULT_SIG_DEADLINE_SEC;
     this.now = config.now ?? (() => Date.now());
+    const maxAllowedSignatureMs = this.redeemLockDurationMs - M11_SAFETY_MARGIN_MS;
+    if (this.signatureDeadlineSeconds * 1e3 > maxAllowedSignatureMs) {
+      throw new PTRedeemError(
+        "INVALID_AMOUNT",
+        `PTRedeemHandler config: signatureDeadlineSeconds (${this.signatureDeadlineSeconds}s) must be at most redeemLockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (redeemLockDurationMs=${this.redeemLockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS / 1e3}s). See audit M-11.`
+      );
+    }
     if (config.redemptionService) {
       this.redemptionService = config.redemptionService;
     }
@@ -2219,8 +2224,14 @@ var PTRedeemHandler = class {
     }
   }
   async _handleAfterNonceLock(request, burnNonce, pointTokenAddress) {
+    const referenceMs = this.now();
+    const projectedLockExpiresAtMs = referenceMs + this.redeemLockDurationMs;
+    const requestedDeadlineSec = Math.floor(referenceMs / 1e3) + this.signatureDeadlineSeconds;
+    const lockBoundedDeadlineSec = Math.floor(
+      (projectedLockExpiresAtMs - M11_SAFETY_MARGIN_MS) / 1e3
+    );
     const previewDeadline = BigInt(
-      Math.floor(this.now() / 1e3) + this.signatureDeadlineSeconds
+      Math.min(requestedDeadlineSec, lockBoundedDeadlineSec)
     );
     let fee;
     if (request.feeAmount !== void 0) {
@@ -2228,7 +2239,7 @@ var PTRedeemHandler = class {
     } else if (this.feeService) {
       const previewUserOp = this.relayService.previewBurnUserOp({
         userAddress: request.userAddress,
-        aaNonce: burnNonce,
+        aaNonce: request.aaNonce,
         pointTokenAddress,
         amount: request.amount,
         deadline: previewDeadline
@@ -2854,6 +2865,7 @@ async function handleMobileSubmit(params) {
 // src/api/handlers/ptClaimHandler.ts
 import { getAddress as getAddress9 } from "viem";
 import {
+  POINT_TOKEN_ABI as POINT_TOKEN_ABI2,
   decodeBatchExecuteCalls,
   getContractAddresses as getContractAddresses3
 } from "@pafi-dev/core";
@@ -2889,14 +2901,30 @@ function isNoWrapper2(address) {
   return lower === "0x0000000000000000000000000000000000000000" || lower === "0x000000000000000000000000000000000000dead";
 }
 var DEFAULT_LOCK_MS = 15 * 60 * 1e3;
-var DEFAULT_SIG_DEADLINE_SEC2 = 15 * 60;
+var M11_SAFETY_MARGIN_MS2 = 30 * 1e3;
+var DEFAULT_SIG_DEADLINE_SEC2 = (DEFAULT_LOCK_MS - M11_SAFETY_MARGIN_MS2) / 1e3;
 var PTClaimHandler = class {
   cfg;
+  inFlightNonces = /* @__PURE__ */ new Map();
   constructor(config) {
+    const lockDurationMs = config.lockDurationMs ?? DEFAULT_LOCK_MS;
+    const signatureDeadlineSeconds = config.signatureDeadlineSeconds ?? DEFAULT_SIG_DEADLINE_SEC2;
+    const maxAllowedSignatureMs = lockDurationMs - M11_SAFETY_MARGIN_MS2;
+    if (signatureDeadlineSeconds * 1e3 > maxAllowedSignatureMs) {
+      throw new PTClaimError(
+        "VALIDATION_FAILED",
+        `PTClaimHandler config: signatureDeadlineSeconds (${signatureDeadlineSeconds}s) must be at most lockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (lockDurationMs=${lockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS2 / 1e3}s). See audit M-11.`,
+        {
+          lockDurationMs,
+          signatureDeadlineSeconds,
+          maxAllowedSignatureSec: maxAllowedSignatureMs / 1e3
+        }
+      );
+    }
     this.cfg = {
       ...config,
-      lockDurationMs: config.lockDurationMs ?? DEFAULT_LOCK_MS,
-      signatureDeadlineSeconds: config.signatureDeadlineSeconds ?? DEFAULT_SIG_DEADLINE_SEC2,
+      lockDurationMs,
+      signatureDeadlineSeconds,
       now: config.now ?? (() => Date.now())
     };
   }
@@ -2926,77 +2954,82 @@ var PTClaimHandler = class {
     }
     const chainAddresses = getContractAddresses3(request.chainId);
     const { batchExecutor: batchExecutorAddress } = chainAddresses;
+    let mintRequestNonce;
+    try {
+      mintRequestNonce = await this.cfg.provider.readContract({
+        address: request.pointTokenAddress,
+        abi: POINT_TOKEN_ABI2,
+        functionName: "mintRequestNonces",
+        args: [request.userAddress]
+      });
+    } catch (err) {
+      throw new PTClaimError(
+        "NONCE_READ_FAILED",
+        `failed to read mintRequestNonces(${request.userAddress}): ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    const nonceKey = `${getAddress9(request.userAddress).toLowerCase()}:${request.pointTokenAddress.toLowerCase()}`;
+    let userNonces = this.inFlightNonces.get(nonceKey);
+    if (!userNonces) {
+      userNonces = /* @__PURE__ */ new Set();
+      this.inFlightNonces.set(nonceKey, userNonces);
+    }
+    if (userNonces.has(mintRequestNonce)) {
+      throw new PTClaimError(
+        "NONCE_IN_FLIGHT",
+        `concurrent claim for nonce ${mintRequestNonce} in progress; retry after the prior request completes`,
+        { userAddress: request.userAddress, pointToken: request.pointTokenAddress, nonce: mintRequestNonce.toString() }
+      );
+    }
+    userNonces.add(mintRequestNonce);
     const wrapperOverride = this.cfg.mintFeeWrapperAddress;
     const wrapperFromSdk = chainAddresses.mintFeeWrapper;
     const resolvedWrapper = wrapperOverride !== void 0 ? isNoWrapper2(wrapperOverride) ? void 0 : wrapperOverride : isNoWrapper2(wrapperFromSdk) ? void 0 : wrapperFromSdk;
-    const lockId = await this.cfg.ledger.lockForMinting(
-      request.userAddress,
-      request.amount,
-      this.cfg.lockDurationMs,
-      request.pointTokenAddress
-    );
     try {
-      const signatureDeadline = BigInt(
-        Math.floor(this.cfg.now() / 1e3) + this.cfg.signatureDeadlineSeconds
-      );
-      const previewUserOp = this.cfg.relayService.previewMintUserOp({
-        userAddress: request.userAddress,
-        aaNonce: request.aaNonce,
-        pointTokenAddress: request.pointTokenAddress,
-        amount: request.amount,
-        deadline: signatureDeadline,
-        mintFeeWrapperAddress: resolvedWrapper
-      });
-      const feeAmount = this.cfg.feeService ? await this.cfg.feeService.estimateGasFee({
-        scenario: resolvedWrapper ? "mint-wrapped" : "mint",
-        contractAddress: request.pointTokenAddress,
-        partialUserOp: {
-          sender: previewUserOp.sender,
-          nonce: previewUserOp.nonce,
-          callData: previewUserOp.callData
-        }
-      }) : 0n;
-      const domainName = await this.cfg.domainResolver.resolve(
+      const lockCreatedAtMs = this.cfg.now();
+      const lockExpiresAtMs = lockCreatedAtMs + this.cfg.lockDurationMs;
+      const lockId = await this.cfg.ledger.lockForMinting(
+        request.userAddress,
+        request.amount,
+        this.cfg.lockDurationMs,
         request.pointTokenAddress
       );
-      const domain = {
-        name: domainName,
-        chainId: request.chainId,
-        verifyingContract: request.pointTokenAddress
-      };
-      let userOp;
       try {
-        userOp = await this.cfg.relayService.prepareMint({
+        const requestedDeadlineSec = Math.floor(lockCreatedAtMs / 1e3) + this.cfg.signatureDeadlineSeconds;
+        const lockBoundedDeadlineSec = Math.floor(
+          (lockExpiresAtMs - M11_SAFETY_MARGIN_MS2) / 1e3
+        );
+        const signatureDeadline = BigInt(
+          Math.min(requestedDeadlineSec, lockBoundedDeadlineSec)
+        );
+        const previewUserOp = this.cfg.relayService.previewMintUserOp({
           userAddress: request.userAddress,
           aaNonce: request.aaNonce,
-          batchExecutorAddress,
           pointTokenAddress: request.pointTokenAddress,
           amount: request.amount,
-          issuerSignerWallet: this.cfg.issuerSignerWallet,
-          domain,
-          mintRequestNonce: request.mintRequestNonce,
           deadline: signatureDeadline,
-          mintFeeWrapperAddress: resolvedWrapper,
-          // Pass the bundler-estimated `feeAmount` explicitly so the
-          // RelayService skips its legacy `quoteOperatorFeePt` path
-          // (which uses the SDK's old 12_000 bps premium default).
-          // Without this, the response's `feeAmount` (from FeeManager,
-          // 100% premium on top of PAFI's 110% server-side estimate)
-          // would diverge from the actual PT.transfer amount in the
-          // UserOp batch (`quoteOperatorFeePt`'s 120%), and the user
-          // would see one value while the wallet transferred another.
-          feeAmount
+          mintFeeWrapperAddress: resolvedWrapper
         });
-      } catch (err) {
-        throw new PTClaimError(
-          "BUILD_FAILED",
-          `prepareMint failed: ${err instanceof Error ? err.message : String(err)}`
+        const feeAmount = this.cfg.feeService ? await this.cfg.feeService.estimateGasFee({
+          scenario: resolvedWrapper ? "mint-wrapped" : "mint",
+          contractAddress: request.pointTokenAddress,
+          partialUserOp: {
+            sender: previewUserOp.sender,
+            nonce: previewUserOp.nonce,
+            callData: previewUserOp.callData
+          }
+        }) : 0n;
+        const domainName = await this.cfg.domainResolver.resolve(
+          request.pointTokenAddress
         );
-      }
-      let fallback;
-      if (feeAmount > 0n) {
+        const domain = {
+          name: domainName,
+          chainId: request.chainId,
+          verifyingContract: request.pointTokenAddress
+        };
+        let userOp;
         try {
-          fallback = await this.cfg.relayService.prepareMint({
+          userOp = await this.cfg.relayService.prepareMint({
             userAddress: request.userAddress,
             aaNonce: request.aaNonce,
             batchExecutorAddress,
@@ -3004,34 +3037,68 @@ var PTClaimHandler = class {
             amount: request.amount,
             issuerSignerWallet: this.cfg.issuerSignerWallet,
             domain,
-            mintRequestNonce: request.mintRequestNonce,
+            mintRequestNonce,
             deadline: signatureDeadline,
-            feeAmount: 0n,
-            mintFeeWrapperAddress: resolvedWrapper
+            mintFeeWrapperAddress: resolvedWrapper,
+            // Pass the bundler-estimated `feeAmount` explicitly so the
+            // RelayService skips its legacy `quoteOperatorFeePt` path
+            // (which uses the SDK's old 12_000 bps premium default).
+            // Without this, the response's `feeAmount` (from FeeManager,
+            // 100% premium on top of PAFI's 110% server-side estimate)
+            // would diverge from the actual PT.transfer amount in the
+            // UserOp batch (`quoteOperatorFeePt`'s 120%), and the user
+            // would see one value while the wallet transferred another.
+            feeAmount
           });
         } catch (err) {
           throw new PTClaimError(
             "BUILD_FAILED",
-            `prepareMint (fallback) failed: ${err instanceof Error ? err.message : String(err)}`
+            `prepareMint failed: ${err instanceof Error ? err.message : String(err)}`
           );
         }
+        let fallback;
+        if (feeAmount > 0n) {
+          try {
+            fallback = await this.cfg.relayService.prepareMint({
+              userAddress: request.userAddress,
+              aaNonce: request.aaNonce,
+              batchExecutorAddress,
+              pointTokenAddress: request.pointTokenAddress,
+              amount: request.amount,
+              issuerSignerWallet: this.cfg.issuerSignerWallet,
+              domain,
+              mintRequestNonce,
+              deadline: signatureDeadline,
+              feeAmount: 0n,
+              mintFeeWrapperAddress: resolvedWrapper
+            });
+          } catch (err) {
+            throw new PTClaimError(
+              "BUILD_FAILED",
+              `prepareMint (fallback) failed: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+        const calls = decodeBatchExecuteCalls(userOp.callData);
+        const callsFallback = fallback ? decodeBatchExecuteCalls(fallback.callData) : void 0;
+        return {
+          userOp,
+          fallback,
+          lockId,
+          feeAmount,
+          signatureDeadline,
+          expiresInSeconds: Math.floor(this.cfg.lockDurationMs / 1e3),
+          calls,
+          callsFallback
+        };
+      } catch (err) {
+        await this.cfg.ledger.releaseLock(lockId).catch(() => {
+        });
+        throw err;
       }
-      const calls = decodeBatchExecuteCalls(userOp.callData);
-      const callsFallback = fallback ? decodeBatchExecuteCalls(fallback.callData) : void 0;
-      return {
-        userOp,
-        fallback,
-        lockId,
-        feeAmount,
-        signatureDeadline,
-        expiresInSeconds: Math.floor(this.cfg.lockDurationMs / 1e3),
-        calls,
-        callsFallback
-      };
-    } catch (err) {
-      await this.cfg.ledger.releaseLock(lockId).catch(() => {
-      });
-      throw err;
+    } finally {
+      userNonces.delete(mintRequestNonce);
+      if (userNonces.size === 0) this.inFlightNonces.delete(nonceKey);
     }
   }
 };
@@ -3370,7 +3437,6 @@ var IssuerApiAdapter = class {
       }
     );
     return {
-      mintRequestNonce: result.mintRequestNonce.toString(),
       offChainBalance: result.offChainBalance.toString(),
       onChainBalance: result.onChainBalance.toString(),
       totalBalance: result.totalBalance.toString(),
@@ -3394,8 +3460,7 @@ var IssuerApiAdapter = class {
       amount: input.amount,
       pointTokenAddress,
       chainId: input.chainId,
-      aaNonce: input.aaNonce,
-      mintRequestNonce: input.mintRequestNonce
+      aaNonce: input.aaNonce
     });
     const sponsorAuth = await this.buildSponsorAuth(
       input.authenticatedAddress,
@@ -3491,8 +3556,7 @@ var IssuerApiAdapter = class {
       amount: input.amount,
       pointTokenAddress,
       chainId: input.chainId,
-      aaNonce: input.aaNonce,
-      mintRequestNonce: input.mintRequestNonce
+      aaNonce: input.aaNonce
     });
     const prepared = await this.runMobilePrepare(
       input.authenticatedAddress,
@@ -4759,7 +4823,7 @@ async function createIssuerService(config) {
 // src/issuer-state/validator.ts
 import { getAddress as getAddress13 } from "viem";
 import {
-  POINT_TOKEN_ABI as POINT_TOKEN_ABI2,
+  POINT_TOKEN_ABI as POINT_TOKEN_ABI3,
   issuerRegistryAbi,
   getContractAddresses as getContractAddresses8
 } from "@pafi-dev/core";
@@ -4808,7 +4872,7 @@ var IssuerStateValidator = class _IssuerStateValidator {
     if (cached) return cached;
     const issuer = await this.provider.readContract({
       address: key,
-      abi: POINT_TOKEN_ABI2,
+      abi: POINT_TOKEN_ABI3,
       functionName: "issuer"
     });
     this.pointTokenIssuerCache.set(key, getAddress13(issuer));
@@ -4901,7 +4965,7 @@ var IssuerStateValidator = class _IssuerStateValidator {
     };
     const equitySupply = await this.provider.readContract({
       address: tokenAddr,
-      abi: POINT_TOKEN_ABI2,
+      abi: POINT_TOKEN_ABI3,
       functionName: "equitySupply"
     });
     const hardCap = issuer.capitalBase * BigInt(issuer.basisPoints) / 10000n;
@@ -4957,7 +5021,7 @@ var MemoryRedemptionHistoryStore = class {
 };
 
 // src/index.ts
-var PAFI_ISSUER_SDK_VERSION = true ? "0.24.1" : "dev";
+var PAFI_ISSUER_SDK_VERSION = true ? "0.25.0" : "dev";
 export {
   AdapterMisconfiguredError,
   AuthError,