@pafi-dev/issuer 0.28.1 → 0.30.0

package/dist/index.d.cts

@@ -1884,6 +1884,27 @@ interface PTRedeemHandlerConfig {
      * provisioning time. Typically HSM/KMS-backed in prod.
      */
     burnerSignerWallet: WalletClient;
+    /**
+     * Issuer's allow-listed PointToken contracts (checksummed EIP-55).
+     * Every `handle()` call validates the request's `pointTokenAddress`
+     * against this set BEFORE any chain read, signer call, or pending
+     * credit reservation.
+     *
+     * Audit PACI5-18 (redeem twin of the claim-side finding) — the read
+     * surface (`IssuerApiHandlers.handleUser` / `handleRedemptionEvaluate`)
+     * enforces this allowlist, but the write surface previously skipped
+     * it. The asymmetry meant an issuer burner signer whitelisted on
+     * multiple PointTokens could be coerced into signing a valid
+     * `BurnRequest` for an off-allowlist token where no BurnIndexer is
+     * running — the on-chain burn would succeed but the off-chain
+     * pending credit would stay PENDING forever (or worse, resolve via
+     * the bundler-receipt fallback against an unbacked credit balance).
+     *
+     * Pass the SAME set used to construct `IssuerApiHandlers` and
+     * `PTClaimHandler` so the read, claim, and redeem paths agree on
+     * what this issuer is willing to sign for.
+     */
+    supportedTokens: ReadonlySet<Address>;
     /**
      * Optional — when wired, used to estimate the PT gas-reimbursement
      * fee. The handler self-computes `feeAmount` + `feeRecipient` so the
@@ -1977,7 +1998,7 @@ interface PTRedeemResponse {
     /** The BurnRequest deadline (unix seconds) — FE uses this to surface a countdown. */
     signatureDeadline: bigint;
 }
-type PTRedeemErrorCode = "UNAUTHORIZED" | "INVALID_AMOUNT" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT" | "LEDGER_NOT_SUPPORTED" | "SIGNING_FAILED" | "REDEMPTION_POLICY_DENIED";
+type PTRedeemErrorCode = "UNAUTHORIZED" | "INVALID_AMOUNT" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT" | "LEDGER_NOT_SUPPORTED" | "SIGNING_FAILED" | "REDEMPTION_POLICY_DENIED" | "UNSUPPORTED_POINT_TOKEN";
 declare class PTRedeemError extends PafiSdkError {
     readonly httpStatus: "unprocessable";
     readonly code: PTRedeemErrorCode;
@@ -1995,6 +2016,7 @@ declare class PTRedeemHandler {
     private readonly chainId;
     private readonly domainResolver;
     private readonly burnerSignerWallet;
+    private readonly supportedTokens;
     private readonly redeemLockDurationMs;
     private readonly signatureDeadlineSeconds;
     private readonly now;
@@ -2732,7 +2754,7 @@ interface IssuerStateValidatorLike {
  * own composer — gg56 uses a timestamp-key 2D nonce). Caller layers
  * paymaster sponsorship + sponsorAuth on top of the returned UserOps.
  */
-type PTClaimErrorCode = "INVALID_AMOUNT" | "VALIDATION_FAILED" | "BUILD_FAILED" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT";
+type PTClaimErrorCode = "INVALID_AMOUNT" | "VALIDATION_FAILED" | "BUILD_FAILED" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT" | "UNSUPPORTED_POINT_TOKEN";
 declare class PTClaimError extends PafiSdkError {
     readonly httpStatus: "unprocessable";
     readonly code: PTClaimErrorCode;
@@ -2754,6 +2776,25 @@ interface PTClaimHandlerConfig {
      * `chainId` + `pointTokenAddress` respectively.
      */
     domainResolver: PointTokenDomainResolver;
+    /**
+     * Issuer's allow-listed PointToken contracts (checksummed EIP-55).
+     * Every `handle()` call validates the request's `pointTokenAddress`
+     * against this set BEFORE any chain read or signer call.
+     *
+     * Audit PACI5-18 — the read surface (`IssuerApiHandlers.handleUser`,
+     * `handleRedemptionEvaluate`) enforces this allowlist, but the
+     * write surface (claim/redeem) previously skipped it. The asymmetry
+     * meant an issuer signer whitelisted as minter on PointTokens
+     * outside the configured indexer set could be coerced into signing
+     * a valid `MintForRequest` for an off-set token — the on-chain
+     * mint would succeed, but no PointIndexer was watching to debit the
+     * off-chain ledger. Silent supply-invariant violation.
+     *
+     * Pass the SAME set used to construct `IssuerApiHandlers` so the
+     * read and write paths agree on what this issuer is willing to
+     * sign for.
+     */
+    supportedTokens: ReadonlySet<Address>;
     /** Optional — when wired, used to estimate the PT gas-reimbursement fee. */
     feeService?: FeeManager;
     /** Optional — pre-validates issuer status + cap before locking balance. */

package/dist/index.d.ts

@@ -1884,6 +1884,27 @@ interface PTRedeemHandlerConfig {
      * provisioning time. Typically HSM/KMS-backed in prod.
      */
     burnerSignerWallet: WalletClient;
+    /**
+     * Issuer's allow-listed PointToken contracts (checksummed EIP-55).
+     * Every `handle()` call validates the request's `pointTokenAddress`
+     * against this set BEFORE any chain read, signer call, or pending
+     * credit reservation.
+     *
+     * Audit PACI5-18 (redeem twin of the claim-side finding) — the read
+     * surface (`IssuerApiHandlers.handleUser` / `handleRedemptionEvaluate`)
+     * enforces this allowlist, but the write surface previously skipped
+     * it. The asymmetry meant an issuer burner signer whitelisted on
+     * multiple PointTokens could be coerced into signing a valid
+     * `BurnRequest` for an off-allowlist token where no BurnIndexer is
+     * running — the on-chain burn would succeed but the off-chain
+     * pending credit would stay PENDING forever (or worse, resolve via
+     * the bundler-receipt fallback against an unbacked credit balance).
+     *
+     * Pass the SAME set used to construct `IssuerApiHandlers` and
+     * `PTClaimHandler` so the read, claim, and redeem paths agree on
+     * what this issuer is willing to sign for.
+     */
+    supportedTokens: ReadonlySet<Address>;
     /**
      * Optional — when wired, used to estimate the PT gas-reimbursement
      * fee. The handler self-computes `feeAmount` + `feeRecipient` so the
@@ -1977,7 +1998,7 @@ interface PTRedeemResponse {
     /** The BurnRequest deadline (unix seconds) — FE uses this to surface a countdown. */
     signatureDeadline: bigint;
 }
-type PTRedeemErrorCode = "UNAUTHORIZED" | "INVALID_AMOUNT" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT" | "LEDGER_NOT_SUPPORTED" | "SIGNING_FAILED" | "REDEMPTION_POLICY_DENIED";
+type PTRedeemErrorCode = "UNAUTHORIZED" | "INVALID_AMOUNT" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT" | "LEDGER_NOT_SUPPORTED" | "SIGNING_FAILED" | "REDEMPTION_POLICY_DENIED" | "UNSUPPORTED_POINT_TOKEN";
 declare class PTRedeemError extends PafiSdkError {
     readonly httpStatus: "unprocessable";
     readonly code: PTRedeemErrorCode;
@@ -1995,6 +2016,7 @@ declare class PTRedeemHandler {
     private readonly chainId;
     private readonly domainResolver;
     private readonly burnerSignerWallet;
+    private readonly supportedTokens;
     private readonly redeemLockDurationMs;
     private readonly signatureDeadlineSeconds;
     private readonly now;
@@ -2732,7 +2754,7 @@ interface IssuerStateValidatorLike {
  * own composer — gg56 uses a timestamp-key 2D nonce). Caller layers
  * paymaster sponsorship + sponsorAuth on top of the returned UserOps.
  */
-type PTClaimErrorCode = "INVALID_AMOUNT" | "VALIDATION_FAILED" | "BUILD_FAILED" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT";
+type PTClaimErrorCode = "INVALID_AMOUNT" | "VALIDATION_FAILED" | "BUILD_FAILED" | "NONCE_READ_FAILED" | "NONCE_IN_FLIGHT" | "UNSUPPORTED_POINT_TOKEN";
 declare class PTClaimError extends PafiSdkError {
     readonly httpStatus: "unprocessable";
     readonly code: PTClaimErrorCode;
@@ -2754,6 +2776,25 @@ interface PTClaimHandlerConfig {
      * `chainId` + `pointTokenAddress` respectively.
      */
     domainResolver: PointTokenDomainResolver;
+    /**
+     * Issuer's allow-listed PointToken contracts (checksummed EIP-55).
+     * Every `handle()` call validates the request's `pointTokenAddress`
+     * against this set BEFORE any chain read or signer call.
+     *
+     * Audit PACI5-18 — the read surface (`IssuerApiHandlers.handleUser`,
+     * `handleRedemptionEvaluate`) enforces this allowlist, but the
+     * write surface (claim/redeem) previously skipped it. The asymmetry
+     * meant an issuer signer whitelisted as minter on PointTokens
+     * outside the configured indexer set could be coerced into signing
+     * a valid `MintForRequest` for an off-set token — the on-chain
+     * mint would succeed, but no PointIndexer was watching to debit the
+     * off-chain ledger. Silent supply-invariant violation.
+     *
+     * Pass the SAME set used to construct `IssuerApiHandlers` so the
+     * read and write paths agree on what this issuer is willing to
+     * sign for.
+     */
+    supportedTokens: ReadonlySet<Address>;
     /** Optional — when wired, used to estimate the PT gas-reimbursement fee. */
     feeService?: FeeManager;
     /** Optional — pre-validates issuer status + cap before locking balance. */

package/dist/index.js

@@ -2108,6 +2108,7 @@ var PTRedeemHandler = class {
   chainId;
   domainResolver;
   burnerSignerWallet;
+  supportedTokens;
   redeemLockDurationMs;
   signatureDeadlineSeconds;
   now;
@@ -2147,6 +2148,13 @@ var PTRedeemHandler = class {
     this.chainId = config.chainId;
     this.domainResolver = config.domainResolver;
     this.burnerSignerWallet = config.burnerSignerWallet;
+    if (!config.supportedTokens) {
+      throw new PTRedeemError(
+        "UNSUPPORTED_POINT_TOKEN",
+        "PTRedeemHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+      );
+    }
+    this.supportedTokens = config.supportedTokens;
     if (this.burnerSignerWallet?.account?.type === "local") {
       console.warn("[PAFI] PTRedeemHandler: burnerSignerWallet uses a local (private key) account. Use a KMS-backed signer in production.");
     }
@@ -2175,6 +2183,12 @@ var PTRedeemHandler = class {
       throw new PTRedeemError("INVALID_AMOUNT", "redeem amount must be positive");
     }
     const pointTokenAddress = getAddress7(request.pointTokenAddress);
+    if (!this.supportedTokens.has(pointTokenAddress)) {
+      throw new PTRedeemError(
+        "UNSUPPORTED_POINT_TOKEN",
+        `redeem: pointTokenAddress ${pointTokenAddress} is not in the issuer's supported-token allowlist. Check IssuerApiHandlers.supportedTokens and PTRedeemHandler.config.supportedTokens point at the same set.`
+      );
+    }
     if (this.redemptionService) {
       const decision = await this.redemptionService.evaluate(
         request.userAddress,
@@ -2424,13 +2438,43 @@ async function handleClaimStatus(params) {
         lock.userOpHash
       );
       if (receipt) {
-        status = receipt.success ? "MINTED" : "FAILED";
-        txHash = receipt.txHash;
-        await params.ledger.updateMintStatus(lock.lockId, status, receipt.txHash).catch((err) => {
-          params.onWarning?.(
-            `handleClaimStatus: ledger updateMintStatus failed for lock ${lock.lockId}: ${err}`
-          );
-        });
+        if (receipt.success && receipt.txHash) {
+          if (!lock.tokenAddress) {
+            params.onWarning?.(
+              `handleClaimStatus: lock ${lock.lockId} has no tokenAddress; falling back to status-only flip (PACI5-24 defence degraded). Migrate the ledger to the multi-token schema.`
+            );
+            await params.ledger.updateMintStatus(lock.lockId, "MINTED", receipt.txHash).catch((err) => {
+              params.onWarning?.(
+                `handleClaimStatus: ledger updateMintStatus failed for lock ${lock.lockId}: ${err}`
+              );
+            });
+            status = "MINTED";
+            txHash = receipt.txHash;
+          } else {
+            try {
+              await params.ledger.deductBalance(
+                lock.userAddress,
+                lock.amount,
+                receipt.txHash,
+                lock.tokenAddress
+              );
+              status = "MINTED";
+              txHash = receipt.txHash;
+            } catch (deductErr) {
+              params.onWarning?.(
+                `handleClaimStatus: deductBalance failed for lock ${lock.lockId}: ${deductErr}`
+              );
+            }
+          }
+        } else {
+          await params.ledger.updateMintStatus(lock.lockId, "FAILED", receipt.txHash).catch((err) => {
+            params.onWarning?.(
+              `handleClaimStatus: ledger updateMintStatus failed for lock ${lock.lockId}: ${err}`
+            );
+          });
+          status = "FAILED";
+          txHash = receipt.txHash;
+        }
       }
     } catch (err) {
       params.onWarning?.(
@@ -2912,6 +2956,12 @@ var PTClaimHandler = class {
   cfg;
   inFlightNonces = /* @__PURE__ */ new Map();
   constructor(config) {
+    if (!config.supportedTokens) {
+      throw new PTClaimError(
+        "UNSUPPORTED_POINT_TOKEN",
+        "PTClaimHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+      );
+    }
     const lockDurationMs = config.lockDurationMs ?? DEFAULT_LOCK_MS;
     const signatureDeadlineSeconds = config.signatureDeadlineSeconds ?? DEFAULT_SIG_DEADLINE_SEC2;
     const maxAllowedSignatureMs = lockDurationMs - M11_SAFETY_MARGIN_MS2;
@@ -2943,6 +2993,14 @@ var PTClaimHandler = class {
     if (request.amount <= 0n) {
       throw new PTClaimError("INVALID_AMOUNT", "claim amount must be positive");
     }
+    const pointTokenAddress = getAddress9(request.pointTokenAddress);
+    if (!this.cfg.supportedTokens.has(pointTokenAddress)) {
+      throw new PTClaimError(
+        "UNSUPPORTED_POINT_TOKEN",
+        `claim: pointTokenAddress ${pointTokenAddress} is not in the issuer's supported-token allowlist. Check IssuerApiHandlers.supportedTokens and PTClaimHandler.config.supportedTokens point at the same set.`,
+        { requested: pointTokenAddress }
+      );
+    }
     if (this.cfg.issuerStateValidator) {
       try {
         await this.cfg.issuerStateValidator.preValidateMint(
@@ -5029,7 +5087,7 @@ var MemoryRedemptionHistoryStore = class {
 };
 
 // src/index.ts
-var PAFI_ISSUER_SDK_VERSION = true ? "0.28.1" : "dev";
+var PAFI_ISSUER_SDK_VERSION = true ? "0.30.0" : "dev";
 export {
   AdapterMisconfiguredError,
   AuthError,