@pafi-dev/issuer 0.33.0 → 0.35.0

package/dist/index.js

@@ -1139,9 +1139,9 @@ function createPafiEstimatorClient(config) {
 var InMemoryCursorStore = class _InMemoryCursorStore {
   cursor;
   /**
-   * Child stores keyed by `forKey()`. Each child has its own cursor
-   * (the H-05 fix), so a single InMemoryCursorStore can back N
-   * PointIndexers in tests / single-process callers.
+   * Child stores keyed by `forKey()`. Each child has its own cursor,
+   * so a single InMemoryCursorStore can back N PointIndexers in tests
+   * / single-process callers.
    */
   children = /* @__PURE__ */ new Map();
   async load() {
@@ -2151,7 +2151,7 @@ var PTRedeemHandler = class {
     if (!config.supportedTokens) {
       throw new PTRedeemError(
         "UNSUPPORTED_POINT_TOKEN",
-        "PTRedeemHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+        "PTRedeemHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts)."
       );
     }
     this.supportedTokens = config.supportedTokens;
@@ -2165,7 +2165,7 @@ var PTRedeemHandler = class {
     if (this.signatureDeadlineSeconds * 1e3 > maxAllowedSignatureMs) {
       throw new PTRedeemError(
         "INVALID_AMOUNT",
-        `PTRedeemHandler config: signatureDeadlineSeconds (${this.signatureDeadlineSeconds}s) must be at most redeemLockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (redeemLockDurationMs=${this.redeemLockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS / 1e3}s). See audit M-11.`
+        `PTRedeemHandler config: signatureDeadlineSeconds (${this.signatureDeadlineSeconds}s) must be at most redeemLockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (redeemLockDurationMs=${this.redeemLockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS / 1e3}s).`
       );
     }
     if (config.redemptionService) {
@@ -2426,13 +2426,13 @@ var DEFAULT_STATUS_CONFIRMATIONS = 3;
 async function isReceiptPastConfirmations(receipt, provider, confirmations, onWarning, handlerName) {
   if (!provider) {
     onWarning?.(
-      `${handlerName}: provider missing \u2014 cannot enforce confirmation depth; deferring receipt fallback to on-chain indexer (audit PACI5-13).`
+      `${handlerName}: provider missing \u2014 cannot enforce confirmation depth; deferring receipt fallback to on-chain indexer.`
     );
     return false;
   }
   if (!receipt.blockNumber) {
     onWarning?.(
-      `${handlerName}: receipt has no blockNumber \u2014 cannot enforce confirmation depth; deferring to indexer (audit PACI5-13).`
+      `${handlerName}: receipt has no blockNumber \u2014 cannot enforce confirmation depth; deferring to indexer.`
     );
     return false;
   }
@@ -2442,7 +2442,7 @@ async function isReceiptPastConfirmations(receipt, provider, confirmations, onWa
     receiptBlock = BigInt(receipt.blockNumber);
   } catch {
     onWarning?.(
-      `${handlerName}: malformed receipt blockNumber (${receipt.blockNumber}) \u2014 deferring to indexer (audit PACI5-13).`
+      `${handlerName}: malformed receipt blockNumber (${receipt.blockNumber}) \u2014 deferring to indexer.`
     );
     return false;
   }
@@ -2451,7 +2451,7 @@ async function isReceiptPastConfirmations(receipt, provider, confirmations, onWa
     head = await provider.getBlockNumber();
   } catch (err) {
     onWarning?.(
-      `${handlerName}: getBlockNumber failed (${err instanceof Error ? err.message : String(err)}) \u2014 deferring to indexer (audit PACI5-13).`
+      `${handlerName}: getBlockNumber failed (${err instanceof Error ? err.message : String(err)}) \u2014 deferring to indexer.`
     );
     return false;
   }
@@ -2509,7 +2509,7 @@ async function handleClaimStatus(params) {
         if (receipt.success && receipt.txHash) {
           if (!lock.tokenAddress) {
             params.onWarning?.(
-              `handleClaimStatus: lock ${lock.lockId} has no tokenAddress; falling back to status-only flip (PACI5-24 defence degraded). Migrate the ledger to the multi-token schema.`
+              `handleClaimStatus: lock ${lock.lockId} has no tokenAddress; falling back to status-only flip \u2014 atomic debit+flip cannot run on a legacy single-token row. Migrate the ledger to the multi-token schema.`
             );
             await params.ledger.updateMintStatus(lock.lockId, "MINTED", receipt.txHash).catch((err) => {
               params.onWarning?.(
@@ -2763,8 +2763,8 @@ async function prepareMobileUserOp(params) {
       verificationGasLimit: fallback.userOp.verificationGasLimit.toString(),
       preVerificationGas: fallback.userOp.preVerificationGas.toString(),
       userOpHash: fallback.userOpHash,
-      // Audit PACI5-21 — carry the fallback-specific lockId so submit
-      // can bind the fallback userOpHash to the correct ledger row.
+      // Carry the fallback-specific lockId so submit can bind the
+      // fallback userOpHash to the correct ledger row.
       lockId: params.lockIdFallback
     };
   }
@@ -3041,7 +3041,7 @@ var PTClaimHandler = class {
     if (!config.supportedTokens) {
       throw new PTClaimError(
         "UNSUPPORTED_POINT_TOKEN",
-        "PTClaimHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+        "PTClaimHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts)."
       );
     }
     const lockDurationMs = config.lockDurationMs ?? DEFAULT_LOCK_MS;
@@ -3050,7 +3050,7 @@ var PTClaimHandler = class {
     if (signatureDeadlineSeconds * 1e3 > maxAllowedSignatureMs) {
       throw new PTClaimError(
         "VALIDATION_FAILED",
-        `PTClaimHandler config: signatureDeadlineSeconds (${signatureDeadlineSeconds}s) must be at most lockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (lockDurationMs=${lockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS2 / 1e3}s). See audit M-11.`,
+        `PTClaimHandler config: signatureDeadlineSeconds (${signatureDeadlineSeconds}s) must be at most lockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (lockDurationMs=${lockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS2 / 1e3}s).`,
         {
           lockDurationMs,
           signatureDeadlineSeconds,
@@ -3164,6 +3164,13 @@ var PTClaimHandler = class {
             callData: previewUserOp.callData
           }
         }) : 0n;
+        if (feeAmount > 0n && feeAmount >= request.amount) {
+          throw new PTClaimError(
+            "INVALID_AMOUNT",
+            `fee (${feeAmount}) must be strictly less than claim amount (${request.amount})`,
+            { feeAmount: feeAmount.toString(), amount: request.amount.toString() }
+          );
+        }
         const domainName = await this.cfg.domainResolver.resolve(
           request.pointTokenAddress
         );
@@ -3794,8 +3801,6 @@ var IssuerApiAdapter = class {
       userAddress: authenticatedAddress,
       ledger: this.cfg.ledger,
       pafiBackendClient: this.cfg.pafiBackendClient,
-      // Audit PACI5-13 — pass the same provider the indexers use so
-      // the receipt fallback gates on the same reorg depth.
       provider: this.cfg.provider,
       onWarning: this.cfg.onWarning
     });
@@ -3806,7 +3811,6 @@ var IssuerApiAdapter = class {
       userAddress: authenticatedAddress,
       ledger: this.cfg.ledger,
       pafiBackendClient: this.cfg.pafiBackendClient,
-      // Audit PACI5-13 — see claimStatus comment.
       provider: this.cfg.provider,
       onWarning: this.cfg.onWarning
     });
@@ -4897,7 +4901,7 @@ async function createIssuerService(config) {
   const sharedCursorWithMultipleTokens = baseCursorStore !== void 0 && typeof baseCursorStore.forKey !== "function" && tokenAddresses.length > 1;
   if (sharedCursorWithMultipleTokens) {
     console.warn(
-      `[@pafi-dev/issuer] cursorStore lacks forKey() and ${tokenAddresses.length} PointTokens are configured. All PointIndexers will share one cursor row, causing token-skipping (audit finding H-05). Implement IIndexerCursorStore.forKey to return per-token derived stores. This permissive path will be removed in a future major release.`
+      `[@pafi-dev/issuer] cursorStore lacks forKey() and ${tokenAddresses.length} PointTokens are configured. All PointIndexers will share one cursor row, causing token-skipping. Implement IIndexerCursorStore.forKey to return per-token derived stores. This permissive path will be removed in a future major release.`
     );
   }
   const indexers = /* @__PURE__ */ new Map();
@@ -4988,7 +4992,7 @@ async function createIssuerService(config) {
     const lock = config.indexer.singletonLock;
     if (!lock) {
       console.warn(
-        "[@pafi-dev/issuer] indexer.autoStart=true without singletonLock \u2014 this is UNSAFE in multi-replica deployments (audit finding H-04). Either set replicas=1 + INDEXER_AUTOSTART=false on non-leader pods, or pass `singletonLock: makePostgresSingletonLock(dataSource)`. This permissive path will be removed in a future major release."
+        "[@pafi-dev/issuer] indexer.autoStart=true without singletonLock \u2014 this is UNSAFE in multi-replica deployments. Either set replicas=1 + INDEXER_AUTOSTART=false on non-leader pods, or pass `singletonLock: makePostgresSingletonLock(dataSource)`. This permissive path will be removed in a future major release."
       );
       for (const idx of indexers.values()) {
         idx.start();
@@ -5026,7 +5030,7 @@ import {
   issuerRegistryAbi,
   getContractAddresses as getContractAddresses8
 } from "@pafi-dev/core";
-var ISSUER_RECORD_TTL_MS = 3e4;
+var ISSUER_RECORD_TTL_MS = 1e4;
 var IssuerStateValidator = class _IssuerStateValidator {
   constructor(provider, registryAddress) {
     this.provider = provider;
@@ -5047,7 +5051,9 @@ var IssuerStateValidator = class _IssuerStateValidator {
   }
   /**
    * Invalidate cached state for one PointToken, or everything if omitted.
-   * Call after admin txs that change registry or cap settings.
+   * Call after admin txs that change registry or cap settings — closes
+   * the split-brain window described 
+   * passive TTL. Idempotent: safe to call when no entry exists.
    */
   invalidate(pointToken) {
     if (pointToken) {
@@ -5220,7 +5226,7 @@ var MemoryRedemptionHistoryStore = class {
 };
 
 // src/index.ts
-var PAFI_ISSUER_SDK_VERSION = true ? "0.33.0" : "dev";
+var PAFI_ISSUER_SDK_VERSION = true ? "0.35.0" : "dev";
 export {
   AdapterMisconfiguredError,
   AuthError,