@pafi-dev/issuer 0.34.0 → 0.35.1

package/dist/index.d.cts

@@ -968,16 +968,16 @@ interface BurnEvent {
  * Postgres / a file. The SDK does not own persistence because every
  * issuer has their own storage stack.
  *
- * **Per-token keying (audit finding H-05).** When multiple PointTokens
- * are wired through a single `createIssuerService` call, each
- * `PointIndexer` MUST get its own cursor — otherwise token A advances
- * the shared cursor past token B's events and token B's mints are
- * never finalized (off-chain balance never deducts → on-chain PT
- * supply for token B exceeds off-chain backing). Combined with the
- * H-04 monotonic-save fix this becomes a catastrophic-and-stable
- * state where token B's cursor can never catch up. Implementations
- * SHOULD expose `forKey(key)` returning a derived store keyed under
- * a distinct namespace; the SDK factory calls it once per token.
+ * **Per-token keying.** When multiple PointTokens are wired through a
+ * single `createIssuerService` call, each `PointIndexer` MUST get its
+ * own cursor — otherwise token A advances the shared cursor past
+ * token B's events and token B's mints are never finalized (off-chain
+ * balance never deducts → on-chain PT supply for token B exceeds
+ * off-chain backing). Combined with the monotonic-save invariant this
+ * becomes a catastrophic-and-stable state where token B's cursor can
+ * never catch up. Implementations SHOULD expose `forKey(key)`
+ * returning a derived store keyed under a distinct namespace; the SDK
+ * factory calls it once per token.
  *
  * When `forKey` is absent, the SDK falls back to the bare store and
  * emits a runtime warning if more than one token is configured. New
@@ -995,7 +995,7 @@ interface IIndexerCursorStore {
      *
      * Optional for backwards compatibility, but REQUIRED in practice
      * whenever more than one PointToken is wired through the SDK
-     * factory (see H-05).
+     * factory (per-token keying section above).
      */
     forKey?(key: string): IIndexerCursorStore;
 }
@@ -1006,9 +1006,9 @@ interface IIndexerCursorStore {
 declare class InMemoryCursorStore implements IIndexerCursorStore {
     private cursor;
     /**
-     * Child stores keyed by `forKey()`. Each child has its own cursor
-     * (the H-05 fix), so a single InMemoryCursorStore can back N
-     * PointIndexers in tests / single-process callers.
+     * Child stores keyed by `forKey()`. Each child has its own cursor,
+     * so a single InMemoryCursorStore can back N PointIndexers in tests
+     * / single-process callers.
      */
     private readonly children;
     load(): Promise<bigint | undefined>;
@@ -1198,11 +1198,11 @@ declare class PointIndexer {
 
 /**
  * Mirror of `PointIndexerFinalizeError` — raised when
- * `ledger.resolveCreditByBurnTx` rejects. See audit M-12: pre-fix this
- * was silently swallowed and the cursor advanced regardless,
- * permanently dropping confirmed on-chain burns from the off-chain
- * credit pipeline. Post-fix the error propagates, the chunk's cursor
- * save is skipped, and the next tick retries.
+ * `ledger.resolveCreditByBurnTx` rejects. Silently swallowing this
+ * error and advancing the cursor anyway would permanently drop
+ * confirmed on-chain burns from the off-chain credit pipeline. The
+ * error therefore propagates, the chunk's cursor save is skipped,
+ * and the next tick retries.
  */
 declare class BurnIndexerFinalizeError extends Error {
     readonly context: {
@@ -1516,7 +1516,7 @@ type PoolsProvider = (request: ApiPoolsRequest) => Promise<ApiPoolsResponse>;
 
 /**
  * Per-user redemption history needed by the evaluator. The issuer can
- * implement this with their existing burn audit table (preferred) or
+ * implement this with their existing burn journal table (preferred) or
  * use the bundled MemoryRedemptionHistoryStore for tests.
  */
 interface IRedemptionHistoryStore {
@@ -2327,15 +2327,15 @@ interface PendingUserOpEntry {
          * sponsored lock because the on-chain amount the user burns/mints
          * differs between variants.
          *
-         * Audit PACI5-21 — pre-fix `handleMobileSubmit.bindUserOpHash`
-         * always bound the submitted userOpHash to the SPONSORED lockId,
-         * even when the user submitted the fallback variant. The
-         * bundler-receipt fallback in `handleRedeemStatus` then resolved
-         * the sponsored credit (`amount - fee`) against the on-chain
-         * burn of the FULL `amount` — every fee-bearing fallback redeem
-         * permanently under-credited the user by exactly the fee. Surface
-         * the fallback lockId here so submit can route the bind to the
-         * correct ledger row.
+         * If `handleMobileSubmit.bindUserOpHash` bound the submitted
+         * userOpHash to the SPONSORED lockId even when the user submitted
+         * the fallback variant, the bundler-receipt fallback in
+         * `handleRedeemStatus` would resolve the sponsored credit
+         * (`amount - fee`) against the on-chain burn of the FULL `amount`
+         * — every fee-bearing fallback redeem would permanently
+         * under-credit the user by exactly the fee. Surface the fallback
+         * lockId here so submit can route the bind to the correct ledger
+         * row.
          */
         lockId?: string;
     };
@@ -2506,12 +2506,13 @@ interface PreparedUserOp {
  *   (paymaster signature mismatch) and/or AA24 (sender signature
  *   mismatch) — opaque failures that take hours to debug.
  *
- *   Splitting "merge" and "hash" into two free functions invited
- *   exactly this bug — each call site reinvented the merge logic,
- *   and one was already drifting (see audit M-02). Returning all
- *   three pieces (`userOp`, `userOpHash`, `typedData`) from a single
- *   call makes "hash before merge" structurally impossible: there is
- *   no intermediate userOp to compute a stale hash over.
+ *   Splitting "merge" and "hash" into two free functions invites
+ *   exactly this bug: each call site has to reinvent the merge logic,
+ *   and any drift between sites silently produces stale hashes.
+ *   Returning all three pieces (`userOp`, `userOpHash`, `typedData`)
+ *   from a single call makes "hash before merge" structurally
+ *   impossible: there is no intermediate userOp to compute a stale
+ *   hash over.
  *
  * Behaviour:
  *   - When `paymasterFields` is undefined (paymaster declined / Path
@@ -2564,12 +2565,12 @@ interface PrepareMobileUserOpParams {
      * fallback variant (PTRedeemHandler reserves
      * `amount` for fallback vs `amount - fee` for sponsored).
      *
-     * Audit PACI5-21 — when omitted, `handleMobileSubmit` binds the
-     * fallback userOpHash to the outer sponsored `lockId`, which made
+     * When omitted, `handleMobileSubmit` binds the fallback userOpHash
+     * to the outer sponsored `lockId`, which makes
      * `handleRedeemStatus`'s bundler-receipt fallback resolve the
      * SMALLER sponsored credit against the on-chain burn of the FULL
-     * amount. Every fee-bearing fallback redeem permanently
-     * under-credited the user by exactly the fee. Pass the fallback
+     * amount — every fee-bearing fallback redeem then permanently
+     * under-credits the user by exactly the fee. Pass the fallback
      * lockId here so submit can route the bind to the correct row.
      */
     lockIdFallback?: string;
@@ -2689,8 +2690,8 @@ interface HandleMobilePrepareParams {
     /**
      * Optional separate lock id for the fallback path. Required when the
      * upstream handler (e.g. PTRedeemHandler) reserves a DIFFERENT
-     * ledger row for the fallback variant. See audit PACI5-21 +
-     * `prepareMobileUserOp` for the full rationale.
+     * ledger row for the fallback variant. See `prepareMobileUserOp`
+     * for the full rationale.
      */
     lockIdFallback?: string;
     /**
@@ -3178,7 +3179,7 @@ interface IssuerServiceConfig {
          * If `true`, the factory calls `indexer.start()` before returning.
          * Default: `false` — the caller decides when to begin polling.
          *
-         * **SAFETY (H-04):** in a multi-replica deployment, ALWAYS pair
+         * **SAFETY:** in a multi-replica deployment, ALWAYS pair
          * `autoStart: true` with `singletonLock` below. Without leader
          * election, every replica starts its own indexer fleet and races
          * against the others — see `ISingletonLock` docs for the
@@ -3805,7 +3806,7 @@ interface RequestPaymasterParams {
     /** Target contract (typically the PointToken). */
     pointTokenAddress: Address;
     /**
-     * Function name to surface in audit / paymaster context. Defaults to
+     * Function name to surface in logs / paymaster context. Defaults to
      * a per-scenario sensible value (`mint` / `burn` / `swap` / generic
      * scenario name).
      */
@@ -3951,7 +3952,7 @@ declare class IssuerStateError extends PafiSdkError {
  * Caching:
  *   - `PointToken.issuer()` — memoized for the process lifetime (immutable)
  *   - Full state (registry + totalSupply) — 10s TTL per PointToken
- *     (was 30s pre-audit PACI5-3; see `ISSUER_RECORD_TTL_MS` comment)
+ *     (see `ISSUER_RECORD_TTL_MS` comment)
  *   - Burst calls while a fetch is in-flight share the same Promise
  *     (thundering-herd protection)
  *   - Operators can call `invalidate()` after admin txs land to bust
@@ -3975,7 +3976,7 @@ declare class IssuerStateValidator {
     /**
      * Invalidate cached state for one PointToken, or everything if omitted.
      * Call after admin txs that change registry or cap settings — closes
-     * the split-brain window described in audit PACI5-3 ahead of the
+     * the split-brain window described
      * passive TTL. Idempotent: safe to call when no entry exists.
      */
     invalidate(pointToken?: Address): void;
@@ -4062,7 +4063,7 @@ declare const REDEMPTION_HISTORY_WINDOW_SEC: number;
 /**
  * In-memory IRedemptionHistoryStore for tests + the bundled NestJS
  * example. Production issuers should implement this against their
- * existing burn/audit table — sumRedeemedSince is hot path on every
+ * existing burn/journal table — sumRedeemedSince is hot path on every
  * redemption preview.
  */
 declare class MemoryRedemptionHistoryStore implements IRedemptionHistoryStore {

package/dist/index.d.ts

@@ -968,16 +968,16 @@ interface BurnEvent {
  * Postgres / a file. The SDK does not own persistence because every
  * issuer has their own storage stack.
  *
- * **Per-token keying (audit finding H-05).** When multiple PointTokens
- * are wired through a single `createIssuerService` call, each
- * `PointIndexer` MUST get its own cursor — otherwise token A advances
- * the shared cursor past token B's events and token B's mints are
- * never finalized (off-chain balance never deducts → on-chain PT
- * supply for token B exceeds off-chain backing). Combined with the
- * H-04 monotonic-save fix this becomes a catastrophic-and-stable
- * state where token B's cursor can never catch up. Implementations
- * SHOULD expose `forKey(key)` returning a derived store keyed under
- * a distinct namespace; the SDK factory calls it once per token.
+ * **Per-token keying.** When multiple PointTokens are wired through a
+ * single `createIssuerService` call, each `PointIndexer` MUST get its
+ * own cursor — otherwise token A advances the shared cursor past
+ * token B's events and token B's mints are never finalized (off-chain
+ * balance never deducts → on-chain PT supply for token B exceeds
+ * off-chain backing). Combined with the monotonic-save invariant this
+ * becomes a catastrophic-and-stable state where token B's cursor can
+ * never catch up. Implementations SHOULD expose `forKey(key)`
+ * returning a derived store keyed under a distinct namespace; the SDK
+ * factory calls it once per token.
  *
  * When `forKey` is absent, the SDK falls back to the bare store and
  * emits a runtime warning if more than one token is configured. New
@@ -995,7 +995,7 @@ interface IIndexerCursorStore {
      *
      * Optional for backwards compatibility, but REQUIRED in practice
      * whenever more than one PointToken is wired through the SDK
-     * factory (see H-05).
+     * factory (per-token keying section above).
      */
     forKey?(key: string): IIndexerCursorStore;
 }
@@ -1006,9 +1006,9 @@ interface IIndexerCursorStore {
 declare class InMemoryCursorStore implements IIndexerCursorStore {
     private cursor;
     /**
-     * Child stores keyed by `forKey()`. Each child has its own cursor
-     * (the H-05 fix), so a single InMemoryCursorStore can back N
-     * PointIndexers in tests / single-process callers.
+     * Child stores keyed by `forKey()`. Each child has its own cursor,
+     * so a single InMemoryCursorStore can back N PointIndexers in tests
+     * / single-process callers.
      */
     private readonly children;
     load(): Promise<bigint | undefined>;
@@ -1198,11 +1198,11 @@ declare class PointIndexer {
 
 /**
  * Mirror of `PointIndexerFinalizeError` — raised when
- * `ledger.resolveCreditByBurnTx` rejects. See audit M-12: pre-fix this
- * was silently swallowed and the cursor advanced regardless,
- * permanently dropping confirmed on-chain burns from the off-chain
- * credit pipeline. Post-fix the error propagates, the chunk's cursor
- * save is skipped, and the next tick retries.
+ * `ledger.resolveCreditByBurnTx` rejects. Silently swallowing this
+ * error and advancing the cursor anyway would permanently drop
+ * confirmed on-chain burns from the off-chain credit pipeline. The
+ * error therefore propagates, the chunk's cursor save is skipped,
+ * and the next tick retries.
  */
 declare class BurnIndexerFinalizeError extends Error {
     readonly context: {
@@ -1516,7 +1516,7 @@ type PoolsProvider = (request: ApiPoolsRequest) => Promise<ApiPoolsResponse>;
 
 /**
  * Per-user redemption history needed by the evaluator. The issuer can
- * implement this with their existing burn audit table (preferred) or
+ * implement this with their existing burn journal table (preferred) or
  * use the bundled MemoryRedemptionHistoryStore for tests.
  */
 interface IRedemptionHistoryStore {
@@ -2327,15 +2327,15 @@ interface PendingUserOpEntry {
          * sponsored lock because the on-chain amount the user burns/mints
          * differs between variants.
          *
-         * Audit PACI5-21 — pre-fix `handleMobileSubmit.bindUserOpHash`
-         * always bound the submitted userOpHash to the SPONSORED lockId,
-         * even when the user submitted the fallback variant. The
-         * bundler-receipt fallback in `handleRedeemStatus` then resolved
-         * the sponsored credit (`amount - fee`) against the on-chain
-         * burn of the FULL `amount` — every fee-bearing fallback redeem
-         * permanently under-credited the user by exactly the fee. Surface
-         * the fallback lockId here so submit can route the bind to the
-         * correct ledger row.
+         * If `handleMobileSubmit.bindUserOpHash` bound the submitted
+         * userOpHash to the SPONSORED lockId even when the user submitted
+         * the fallback variant, the bundler-receipt fallback in
+         * `handleRedeemStatus` would resolve the sponsored credit
+         * (`amount - fee`) against the on-chain burn of the FULL `amount`
+         * — every fee-bearing fallback redeem would permanently
+         * under-credit the user by exactly the fee. Surface the fallback
+         * lockId here so submit can route the bind to the correct ledger
+         * row.
          */
         lockId?: string;
     };
@@ -2506,12 +2506,13 @@ interface PreparedUserOp {
  *   (paymaster signature mismatch) and/or AA24 (sender signature
  *   mismatch) — opaque failures that take hours to debug.
  *
- *   Splitting "merge" and "hash" into two free functions invited
- *   exactly this bug — each call site reinvented the merge logic,
- *   and one was already drifting (see audit M-02). Returning all
- *   three pieces (`userOp`, `userOpHash`, `typedData`) from a single
- *   call makes "hash before merge" structurally impossible: there is
- *   no intermediate userOp to compute a stale hash over.
+ *   Splitting "merge" and "hash" into two free functions invites
+ *   exactly this bug: each call site has to reinvent the merge logic,
+ *   and any drift between sites silently produces stale hashes.
+ *   Returning all three pieces (`userOp`, `userOpHash`, `typedData`)
+ *   from a single call makes "hash before merge" structurally
+ *   impossible: there is no intermediate userOp to compute a stale
+ *   hash over.
  *
  * Behaviour:
  *   - When `paymasterFields` is undefined (paymaster declined / Path
@@ -2564,12 +2565,12 @@ interface PrepareMobileUserOpParams {
      * fallback variant (PTRedeemHandler reserves
      * `amount` for fallback vs `amount - fee` for sponsored).
      *
-     * Audit PACI5-21 — when omitted, `handleMobileSubmit` binds the
-     * fallback userOpHash to the outer sponsored `lockId`, which made
+     * When omitted, `handleMobileSubmit` binds the fallback userOpHash
+     * to the outer sponsored `lockId`, which makes
      * `handleRedeemStatus`'s bundler-receipt fallback resolve the
      * SMALLER sponsored credit against the on-chain burn of the FULL
-     * amount. Every fee-bearing fallback redeem permanently
-     * under-credited the user by exactly the fee. Pass the fallback
+     * amount — every fee-bearing fallback redeem then permanently
+     * under-credits the user by exactly the fee. Pass the fallback
      * lockId here so submit can route the bind to the correct row.
      */
     lockIdFallback?: string;
@@ -2689,8 +2690,8 @@ interface HandleMobilePrepareParams {
     /**
      * Optional separate lock id for the fallback path. Required when the
      * upstream handler (e.g. PTRedeemHandler) reserves a DIFFERENT
-     * ledger row for the fallback variant. See audit PACI5-21 +
-     * `prepareMobileUserOp` for the full rationale.
+     * ledger row for the fallback variant. See `prepareMobileUserOp`
+     * for the full rationale.
      */
     lockIdFallback?: string;
     /**
@@ -3178,7 +3179,7 @@ interface IssuerServiceConfig {
          * If `true`, the factory calls `indexer.start()` before returning.
          * Default: `false` — the caller decides when to begin polling.
          *
-         * **SAFETY (H-04):** in a multi-replica deployment, ALWAYS pair
+         * **SAFETY:** in a multi-replica deployment, ALWAYS pair
          * `autoStart: true` with `singletonLock` below. Without leader
          * election, every replica starts its own indexer fleet and races
          * against the others — see `ISingletonLock` docs for the
@@ -3805,7 +3806,7 @@ interface RequestPaymasterParams {
     /** Target contract (typically the PointToken). */
     pointTokenAddress: Address;
     /**
-     * Function name to surface in audit / paymaster context. Defaults to
+     * Function name to surface in logs / paymaster context. Defaults to
      * a per-scenario sensible value (`mint` / `burn` / `swap` / generic
      * scenario name).
      */
@@ -3951,7 +3952,7 @@ declare class IssuerStateError extends PafiSdkError {
  * Caching:
  *   - `PointToken.issuer()` — memoized for the process lifetime (immutable)
  *   - Full state (registry + totalSupply) — 10s TTL per PointToken
- *     (was 30s pre-audit PACI5-3; see `ISSUER_RECORD_TTL_MS` comment)
+ *     (see `ISSUER_RECORD_TTL_MS` comment)
  *   - Burst calls while a fetch is in-flight share the same Promise
  *     (thundering-herd protection)
  *   - Operators can call `invalidate()` after admin txs land to bust
@@ -3975,7 +3976,7 @@ declare class IssuerStateValidator {
     /**
      * Invalidate cached state for one PointToken, or everything if omitted.
      * Call after admin txs that change registry or cap settings — closes
-     * the split-brain window described in audit PACI5-3 ahead of the
+     * the split-brain window described
      * passive TTL. Idempotent: safe to call when no entry exists.
      */
     invalidate(pointToken?: Address): void;
@@ -4062,7 +4063,7 @@ declare const REDEMPTION_HISTORY_WINDOW_SEC: number;
 /**
  * In-memory IRedemptionHistoryStore for tests + the bundled NestJS
  * example. Production issuers should implement this against their
- * existing burn/audit table — sumRedeemedSince is hot path on every
+ * existing burn/journal table — sumRedeemedSince is hot path on every
  * redemption preview.
  */
 declare class MemoryRedemptionHistoryStore implements IRedemptionHistoryStore {

package/dist/index.js

@@ -1139,9 +1139,9 @@ function createPafiEstimatorClient(config) {
 var InMemoryCursorStore = class _InMemoryCursorStore {
   cursor;
   /**
-   * Child stores keyed by `forKey()`. Each child has its own cursor
-   * (the H-05 fix), so a single InMemoryCursorStore can back N
-   * PointIndexers in tests / single-process callers.
+   * Child stores keyed by `forKey()`. Each child has its own cursor,
+   * so a single InMemoryCursorStore can back N PointIndexers in tests
+   * / single-process callers.
    */
   children = /* @__PURE__ */ new Map();
   async load() {
@@ -2151,7 +2151,7 @@ var PTRedeemHandler = class {
     if (!config.supportedTokens) {
       throw new PTRedeemError(
         "UNSUPPORTED_POINT_TOKEN",
-        "PTRedeemHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+        "PTRedeemHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts)."
       );
     }
     this.supportedTokens = config.supportedTokens;
@@ -2165,7 +2165,7 @@ var PTRedeemHandler = class {
     if (this.signatureDeadlineSeconds * 1e3 > maxAllowedSignatureMs) {
       throw new PTRedeemError(
         "INVALID_AMOUNT",
-        `PTRedeemHandler config: signatureDeadlineSeconds (${this.signatureDeadlineSeconds}s) must be at most redeemLockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (redeemLockDurationMs=${this.redeemLockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS / 1e3}s). See audit M-11.`
+        `PTRedeemHandler config: signatureDeadlineSeconds (${this.signatureDeadlineSeconds}s) must be at most redeemLockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (redeemLockDurationMs=${this.redeemLockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS / 1e3}s).`
       );
     }
     if (config.redemptionService) {
@@ -2509,7 +2509,7 @@ async function handleClaimStatus(params) {
         if (receipt.success && receipt.txHash) {
           if (!lock.tokenAddress) {
             params.onWarning?.(
-              `handleClaimStatus: lock ${lock.lockId} has no tokenAddress; falling back to status-only flip (PACI5-24 defence degraded). Migrate the ledger to the multi-token schema.`
+              `handleClaimStatus: lock ${lock.lockId} has no tokenAddress; falling back to status-only flip \u2014 atomic debit+flip cannot run on a legacy single-token row. Migrate the ledger to the multi-token schema.`
             );
             await params.ledger.updateMintStatus(lock.lockId, "MINTED", receipt.txHash).catch((err) => {
               params.onWarning?.(
@@ -2763,8 +2763,8 @@ async function prepareMobileUserOp(params) {
       verificationGasLimit: fallback.userOp.verificationGasLimit.toString(),
       preVerificationGas: fallback.userOp.preVerificationGas.toString(),
       userOpHash: fallback.userOpHash,
-      // Audit PACI5-21 — carry the fallback-specific lockId so submit
-      // can bind the fallback userOpHash to the correct ledger row.
+      // Carry the fallback-specific lockId so submit can bind the
+      // fallback userOpHash to the correct ledger row.
       lockId: params.lockIdFallback
     };
   }
@@ -3041,7 +3041,7 @@ var PTClaimHandler = class {
     if (!config.supportedTokens) {
       throw new PTClaimError(
         "UNSUPPORTED_POINT_TOKEN",
-        "PTClaimHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+        "PTClaimHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts)."
       );
     }
     const lockDurationMs = config.lockDurationMs ?? DEFAULT_LOCK_MS;
@@ -3050,7 +3050,7 @@ var PTClaimHandler = class {
     if (signatureDeadlineSeconds * 1e3 > maxAllowedSignatureMs) {
       throw new PTClaimError(
         "VALIDATION_FAILED",
-        `PTClaimHandler config: signatureDeadlineSeconds (${signatureDeadlineSeconds}s) must be at most lockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (lockDurationMs=${lockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS2 / 1e3}s). See audit M-11.`,
+        `PTClaimHandler config: signatureDeadlineSeconds (${signatureDeadlineSeconds}s) must be at most lockDurationMs - safety margin = ${maxAllowedSignatureMs / 1e3}s (lockDurationMs=${lockDurationMs / 1e3}s, safety=${M11_SAFETY_MARGIN_MS2 / 1e3}s).`,
         {
           lockDurationMs,
           signatureDeadlineSeconds,
@@ -3164,6 +3164,13 @@ var PTClaimHandler = class {
             callData: previewUserOp.callData
           }
         }) : 0n;
+        if (feeAmount > 0n && feeAmount >= request.amount) {
+          throw new PTClaimError(
+            "INVALID_AMOUNT",
+            `fee (${feeAmount}) must be strictly less than claim amount (${request.amount})`,
+            { feeAmount: feeAmount.toString(), amount: request.amount.toString() }
+          );
+        }
         const domainName = await this.cfg.domainResolver.resolve(
           request.pointTokenAddress
         );
@@ -4894,7 +4901,7 @@ async function createIssuerService(config) {
   const sharedCursorWithMultipleTokens = baseCursorStore !== void 0 && typeof baseCursorStore.forKey !== "function" && tokenAddresses.length > 1;
   if (sharedCursorWithMultipleTokens) {
     console.warn(
-      `[@pafi-dev/issuer] cursorStore lacks forKey() and ${tokenAddresses.length} PointTokens are configured. All PointIndexers will share one cursor row, causing token-skipping (audit finding H-05). Implement IIndexerCursorStore.forKey to return per-token derived stores. This permissive path will be removed in a future major release.`
+      `[@pafi-dev/issuer] cursorStore lacks forKey() and ${tokenAddresses.length} PointTokens are configured. All PointIndexers will share one cursor row, causing token-skipping. Implement IIndexerCursorStore.forKey to return per-token derived stores. This permissive path will be removed in a future major release.`
     );
   }
   const indexers = /* @__PURE__ */ new Map();
@@ -4985,7 +4992,7 @@ async function createIssuerService(config) {
     const lock = config.indexer.singletonLock;
     if (!lock) {
       console.warn(
-        "[@pafi-dev/issuer] indexer.autoStart=true without singletonLock \u2014 this is UNSAFE in multi-replica deployments (audit finding H-04). Either set replicas=1 + INDEXER_AUTOSTART=false on non-leader pods, or pass `singletonLock: makePostgresSingletonLock(dataSource)`. This permissive path will be removed in a future major release."
+        "[@pafi-dev/issuer] indexer.autoStart=true without singletonLock \u2014 this is UNSAFE in multi-replica deployments. Either set replicas=1 + INDEXER_AUTOSTART=false on non-leader pods, or pass `singletonLock: makePostgresSingletonLock(dataSource)`. This permissive path will be removed in a future major release."
       );
       for (const idx of indexers.values()) {
         idx.start();
@@ -5045,7 +5052,7 @@ var IssuerStateValidator = class _IssuerStateValidator {
   /**
    * Invalidate cached state for one PointToken, or everything if omitted.
    * Call after admin txs that change registry or cap settings — closes
-   * the split-brain window described in audit PACI5-3 ahead of the
+   * the split-brain window described 
    * passive TTL. Idempotent: safe to call when no entry exists.
    */
   invalidate(pointToken) {
@@ -5219,7 +5226,7 @@ var MemoryRedemptionHistoryStore = class {
 };
 
 // src/index.ts
-var PAFI_ISSUER_SDK_VERSION = true ? "0.34.0" : "dev";
+var PAFI_ISSUER_SDK_VERSION = true ? "0.35.0" : "dev";
 export {
   AdapterMisconfiguredError,
   AuthError,