@pafi-dev/issuer 0.34.0 → 0.35.0

package/dist/index.cjs

@@ -1373,9 +1373,9 @@ function createPafiEstimatorClient(config) {
 var InMemoryCursorStore = class _InMemoryCursorStore {
   cursor;
   /**
-   * Child stores keyed by `forKey()`. Each child has its own cursor
-   * (the H-05 fix), so a single InMemoryCursorStore can back N
-   * PointIndexers in tests / single-process callers.
+   * Child stores keyed by `forKey()`. Each child has its own cursor,
+   * so a single InMemoryCursorStore can back N PointIndexers in tests
+   * / single-process callers.
    */
   children = /* @__PURE__ */ new Map();
   async load() {
@@ -2375,7 +2375,7 @@ var PTRedeemHandler = class {
     if (!config.supportedTokens) {
       throw new PTRedeemError(
         "UNSUPPORTED_POINT_TOKEN",
-        "PTRedeemHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+        "PTRedeemHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts)."
       );
     }
     this.supportedTokens = config.supportedTokens;
@@ -2389,7 +2389,7 @@ var PTRedeemHandler = class {
     if (this.signatureDeadlineSeconds * 1e3 > maxAllowedSignatureMs) {
       throw new PTRedeemError(
         "INVALID_AMOUNT",
-        `PTRedeemHandler config: signatureDeadlineSeconds (${this.signatureDeadlineSeconds}s) must be at most redeemLockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (redeemLockDurationMs=${this.redeemLockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS / 1e3}s). See audit M-11.`
+        `PTRedeemHandler config: signatureDeadlineSeconds (${this.signatureDeadlineSeconds}s) must be at most redeemLockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (redeemLockDurationMs=${this.redeemLockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS / 1e3}s).`
       );
     }
     if (config.redemptionService) {
@@ -2733,7 +2733,7 @@ async function handleClaimStatus(params) {
         if (receipt.success && receipt.txHash) {
           if (!lock.tokenAddress) {
             params.onWarning?.(
-              `handleClaimStatus: lock ${lock.lockId} has no tokenAddress; falling back to status-only flip (PACI5-24 defence degraded). Migrate the ledger to the multi-token schema.`
+              `handleClaimStatus: lock ${lock.lockId} has no tokenAddress; falling back to status-only flip \u2014 atomic debit+flip cannot run on a legacy single-token row. Migrate the ledger to the multi-token schema.`
             );
             await params.ledger.updateMintStatus(lock.lockId, "MINTED", receipt.txHash).catch((err) => {
               params.onWarning?.(
@@ -2981,8 +2981,8 @@ async function prepareMobileUserOp(params) {
       verificationGasLimit: fallback.userOp.verificationGasLimit.toString(),
       preVerificationGas: fallback.userOp.preVerificationGas.toString(),
       userOpHash: fallback.userOpHash,
-      // Audit PACI5-21 — carry the fallback-specific lockId so submit
-      // can bind the fallback userOpHash to the correct ledger row.
+      // Carry the fallback-specific lockId so submit can bind the
+      // fallback userOpHash to the correct ledger row.
       lockId: params.lockIdFallback
     };
   }
@@ -3255,7 +3255,7 @@ var PTClaimHandler = class {
     if (!config.supportedTokens) {
       throw new PTClaimError(
         "UNSUPPORTED_POINT_TOKEN",
-        "PTClaimHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+        "PTClaimHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts)."
       );
     }
     const lockDurationMs = config.lockDurationMs ?? DEFAULT_LOCK_MS;
@@ -3264,7 +3264,7 @@ var PTClaimHandler = class {
     if (signatureDeadlineSeconds * 1e3 > maxAllowedSignatureMs) {
       throw new PTClaimError(
         "VALIDATION_FAILED",
-        `PTClaimHandler config: signatureDeadlineSeconds (${signatureDeadlineSeconds}s) must be at most lockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (lockDurationMs=${lockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS2 / 1e3}s). See audit M-11.`,
+        `PTClaimHandler config: signatureDeadlineSeconds (${signatureDeadlineSeconds}s) must be at most lockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (lockDurationMs=${lockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS2 / 1e3}s).`,
         {
           lockDurationMs,
           signatureDeadlineSeconds,
@@ -3378,6 +3378,13 @@ var PTClaimHandler = class {
             callData: previewUserOp.callData
           }
         }) : 0n;
+        if (feeAmount > 0n && feeAmount >= request.amount) {
+          throw new PTClaimError(
+            "INVALID_AMOUNT",
+            `fee (${feeAmount}) must be strictly less than claim amount (${request.amount})`,
+            { feeAmount: feeAmount.toString(), amount: request.amount.toString() }
+          );
+        }
         const domainName = await this.cfg.domainResolver.resolve(
           request.pointTokenAddress
         );
@@ -5082,7 +5089,7 @@ async function createIssuerService(config) {
   const sharedCursorWithMultipleTokens = baseCursorStore !== void 0 && typeof baseCursorStore.forKey !== "function" && tokenAddresses.length > 1;
   if (sharedCursorWithMultipleTokens) {
     console.warn(
-      `[@pafi-dev/issuer] cursorStore lacks forKey() and ${tokenAddresses.length} PointTokens are configured. All PointIndexers will share one cursor row, causing token-skipping (audit finding H-05). Implement IIndexerCursorStore.forKey to return per-token derived stores. This permissive path will be removed in a future major release.`
+      `[@pafi-dev/issuer] cursorStore lacks forKey() and ${tokenAddresses.length} PointTokens are configured. All PointIndexers will share one cursor row, causing token-skipping. Implement IIndexerCursorStore.forKey to return per-token derived stores. This permissive path will be removed in a future major release.`
     );
   }
   const indexers = /* @__PURE__ */ new Map();
@@ -5173,7 +5180,7 @@ async function createIssuerService(config) {
     const lock = config.indexer.singletonLock;
     if (!lock) {
       console.warn(
-        "[@pafi-dev/issuer] indexer.autoStart=true without singletonLock \u2014 this is UNSAFE in multi-replica deployments (audit finding H-04). Either set replicas=1 + INDEXER_AUTOSTART=false on non-leader pods, or pass `singletonLock: makePostgresSingletonLock(dataSource)`. This permissive path will be removed in a future major release."
+        "[@pafi-dev/issuer] indexer.autoStart=true without singletonLock \u2014 this is UNSAFE in multi-replica deployments. Either set replicas=1 + INDEXER_AUTOSTART=false on non-leader pods, or pass `singletonLock: makePostgresSingletonLock(dataSource)`. This permissive path will be removed in a future major release."
       );
       for (const idx of indexers.values()) {
         idx.start();
@@ -5229,7 +5236,7 @@ var IssuerStateValidator = class _IssuerStateValidator {
   /**
    * Invalidate cached state for one PointToken, or everything if omitted.
    * Call after admin txs that change registry or cap settings — closes
-   * the split-brain window described in audit PACI5-3 ahead of the
+   * the split-brain window described 
    * passive TTL. Idempotent: safe to call when no entry exists.
    */
   invalidate(pointToken) {
@@ -5403,7 +5410,7 @@ var MemoryRedemptionHistoryStore = class {
 };
 
 // src/index.ts
-var PAFI_ISSUER_SDK_VERSION = true ? "0.34.0" : "dev";
+var PAFI_ISSUER_SDK_VERSION = true ? "0.35.0" : "dev";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AdapterMisconfiguredError,