@sorandomains/owner 0.12.0 → 0.12.1

package/README.md

@@ -5,11 +5,13 @@
 > [release status](https://docs.soran.domains/reference/release-status) for package and service availability.
 
 
-Version 0.12.0 targets Stellar SDK17 (`>=17 <18`). ASCII names
+Version 0.12.1 targets Stellar SDK17 (`>=17 <18`). ASCII names
 and labels are validated before lowercase normalization; Unicode lookalikes are
 rejected. Writes continue to target the owning Registry/Registrar/Resolver. Universal
 Lookup is the read entry point in `@sorandomains/lookup` 0.10.0 or later.
 
+Version 0.12.1 rejects simulated transactions whose source, operation, contract, method, arguments or authorization differ from the requested legacy account-signed write. Unexpected authorizers and nested calls are rejected before signing.
+
 Releases older than 0.11.0 (and any built against Lookup 0.6.0 to 0.9.0) default to the retired 5 and 6 September 2026 testnet stacks; upgrade rather than pinning a retired Registry. See [Older versions and retired stacks](../../README.md#older-versions-and-retired-stacks).
 
 Ownership, issuer, holder and treasury inputs remain G/C account or contract

package/dist/funding-reader.d.ts

@@ -23,7 +23,6 @@ export declare class FundingReader {
         ledger: number;
     }>;
     configuration(): Promise<{
-        ledger: number;
         registry: string;
         nativeAsset: string;
         lookup: string;
@@ -31,6 +30,7 @@ export declare class FundingReader {
         governance: string;
         paused: boolean;
         revision: bigint;
+        ledger: number;
     }>;
     currentPosition(namespace: string): Promise<{
         id: string;

package/dist/index.d.ts

@@ -352,8 +352,15 @@ export declare class SoranOwner {
      * auth demands an address the envelope signature cannot satisfy.
      */
     private assertSatisfiableAuth;
-    /** Authorize exactly the selected policy with no additional child operations. */
-    private assertChainPolicyIntent;
+    /**
+     * (SR-01 / SW-05) Default-deny for every legacy write: this source account, one invoke-contract operation on the
+     * intended contract, function and arguments, and exactly one source-account authorization whose root is that same
+     * call with NO sub-invocations. Every owner writer is a single call (issue, issue_batch, reclaim, renew,
+     * set_treasury, make_permanent, namespace transfers, set_resolver, set_chain_policy, set_subname_policy). The
+     * Registrar an owner talks to can be upgraded by whoever owned the namespace before them, so the callee is not a
+     * safe assumption: a recorded `token.transfer(owner -> attacker)` child call must never be signed.
+     */
+    private assertExactIntent;
     private attempt;
     private restore;
     private confirm;

package/dist/index.js

@@ -930,25 +930,30 @@ export class SoranOwner {
                 : `${fn}: this operation must be authorized by ${required}, but the signer is ${pub} — use that account's signer`, contractId, fn);
         }
     }
-    /** Authorize exactly the selected policy with no additional child operations. */
-    assertChainPolicyIntent(prepared, pub, contractId, fn, args) {
-        if (!["set_chain_policy", "set_subname_policy"].includes(fn))
-            return;
+    /**
+     * (SR-01 / SW-05) Default-deny for every legacy write: this source account, one invoke-contract operation on the
+     * intended contract, function and arguments, and exactly one source-account authorization whose root is that same
+     * call with NO sub-invocations. Every owner writer is a single call (issue, issue_batch, reclaim, renew,
+     * set_treasury, make_permanent, namespace transfers, set_resolver, set_chain_policy, set_subname_policy). The
+     * Registrar an owner talks to can be upgraded by whoever owned the namespace before them, so the callee is not a
+     * safe assumption: a recorded `token.transfer(owner -> attacker)` child call must never be signed.
+     */
+    assertExactIntent(prepared, pub, contractId, fn, args) {
         if (prepared.source !== pub || prepared.operations.length !== 1)
-            throw new OwnerError("unexpected chain policy transaction", contractId, fn);
+            throw new OwnerError(`${fn}: unexpected transaction source or operation count`, contractId, fn);
         const op = prepared.operations[0];
         if (op.type !== "invokeHostFunction" || (op.source !== undefined && op.source !== pub) || op.func.type !== "hostFunctionTypeInvokeContract")
-            throw new OwnerError("unexpected chain policy operation", contractId, fn);
+            throw new OwnerError(`${fn}: unexpected operation`, contractId, fn);
         const call = op.func.invokeContract;
         if (Address.fromScAddress(call.contractAddress).toString() !== contractId || call.functionName.toString() !== fn ||
             call.args.length !== args.length || call.args.some((value, i) => value.toXDR("base64") !== args[i].toXDR("base64")))
-            throw new OwnerError("chain policy operation differs from selected intent", contractId, fn);
+            throw new OwnerError(`${fn}: operation differs from selected intent`, contractId, fn);
         if (!op.auth || op.auth.length !== 1 || op.auth[0].credentials.type !== "sorobanCredentialsSourceAccount")
-            throw new OwnerError("chain policy requires exactly the source owner authorization", contractId, fn);
+            throw new OwnerError(`${fn}: requires exactly the source owner authorization`, contractId, fn);
         const root = op.auth[0].rootInvocation;
         if (root.function.type !== "sorobanAuthorizedFunctionTypeContractFn" || root.subInvocations.length ||
             root.function.contractFn.toXDR("base64") !== call.toXDR("base64"))
-            throw new OwnerError("chain policy authorization differs from selected intent", contractId, fn);
+            throw new OwnerError(`${fn}: authorization differs from selected intent (unexpected nested authorization)`, contractId, fn);
     }
     async attempt(contractId, fn, args, errNames) {
         const pub = await this.signer.publicKey();
@@ -980,7 +985,7 @@ export class SoranOwner {
         const prepared = rpc.assembleTransaction(tx, sim).build();
         this.assertNetworkFee(prepared.fee, fn);
         this.assertSatisfiableAuth(prepared, pub, contractId, fn);
-        this.assertChainPolicyIntent(prepared, pub, contractId, fn, args);
+        this.assertExactIntent(prepared, pub, contractId, fn, args);
         // The hash is fixed before signatures — compute it now so every failure
         // past this point can carry it (the "re-check before retrying" contract).
         const txHash = toHex(prepared.hash()); // (SDK17) hash() is Uint8Array

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sorandomains/owner",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Run your Soran namespace on Stellar: configure claims, issue names and manage namespace policies.",
   "type": "module",
   "engines": {
@@ -16,7 +16,7 @@
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "tsc",
     "check:browser": "esbuild dist/index.js --bundle --platform=browser --external:@stellar/stellar-sdk --outfile=browser-check.js --legal-comments=none --log-level=error && node -e \"const fs=require('fs');const s=fs.readFileSync('browser-check.js','utf8');fs.unlinkSync('browser-check.js');if(/\\bBuffer\\b/.test(s)){console.error('FAIL: bare Buffer reference in browser bundle');process.exit(1)}console.log('browser bundle clean')\"",
-    "test": "node --import tsx test/decode-failure.test.mts && node --import tsx --test test/integration.test.mts test/hardening.test.mts test/error-codes.test.mts test/native-*.test.mts && node --import tsx --test test/funding.test.mts test/funding-history.test.mts test/funding-bounds.test.mts && node --import tsx --test test/multichain.test.mts && node --import tsx --test test/subnames.test.mts",
+    "test": "node --import tsx test/decode-failure.test.mts && node --import tsx --test test/integration.test.mts test/hardening.test.mts test/error-codes.test.mts test/nested-authorization.test.mts test/native-*.test.mts && node --import tsx --test test/funding.test.mts test/funding-history.test.mts test/funding-bounds.test.mts && node --import tsx --test test/multichain.test.mts && node --import tsx --test test/subnames.test.mts",
     "test:hardening": "node --import tsx --test test/hardening.test.mts"
   },
   "license": "MIT",
@@ -42,10 +42,10 @@
   },
   "devDependencies": {
     "@stellar/stellar-sdk": "^17.0.1",
-    "@types/node": "^22.20.1",
-    "esbuild": "^0.25.0",
+    "@types/node": "^26.6.3",
+    "esbuild": "^0.28.2",
     "tsx": "^4.19.2",
-    "typescript": "^5.7.3"
+    "typescript": "^7.0.2"
   },
   "exports": {
     ".": {