@totemsdk/root-identity 1.0.8 → 1.0.9

package/dist/UnifiedIdentityWallet.js

@@ -282,8 +282,13 @@ class UnifiedIdentityWallet {
     getRootUses() { return this.rootUses; }
     /** Restore root watermark from a previously persisted value. */
     setRootUses(uses) {
-        if (uses < 0)
-            throw new Error('uses must be non-negative');
+        if (!Number.isSafeInteger(uses) || uses < 0)
+            throw new Error('uses must be a non-negative safe integer');
+        // RFC-020 C1: the cursor may only advance — lowering it would re-expose
+        // already-spent WOTS leaves.
+        if (uses < this.rootUses) {
+            throw new Error(`Refusing to lower root uses from ${this.rootUses} to ${uses} (would reuse a WOTS leaf)`);
+        }
         this.rootUses = uses;
     }
     /** Number of times child `index` has signed (for persistence). */
@@ -294,8 +299,12 @@ class UnifiedIdentityWallet {
     /** Restore child watermark from a previously persisted value. */
     setChildUses(index, uses) {
         this.assertChildIndex(index);
-        if (uses < 0)
-            throw new Error('uses must be non-negative');
+        if (!Number.isSafeInteger(uses) || uses < 0)
+            throw new Error('uses must be a non-negative safe integer');
+        const current = this.childUsesMap.get(index) ?? 0;
+        if (uses < current) {
+            throw new Error(`Refusing to lower child ${index} uses from ${current} to ${uses} (would reuse a WOTS leaf)`);
+        }
         this.childUsesMap.set(index, uses);
     }
     /** Number of child addresses configured for this wallet. */
@@ -323,17 +332,34 @@ class UnifiedIdentityWallet {
      * across sessions. Out-of-range or invalid entries are silently skipped.
      */
     restoreWatermarkState(state) {
-        if (typeof state?.rootUses === 'number' && state.rootUses >= 0) {
-            this.rootUses = Math.floor(state.rootUses);
+        // RFC-020 C1: restore is forward-only. A stale or tampered snapshot that
+        // moves a cursor backwards would re-expose spent leaves, so it throws.
+        const nextRoot = typeof state?.rootUses === 'number'
+            && Number.isSafeInteger(state.rootUses)
+            && state.rootUses >= 0
+            ? state.rootUses
+            : undefined;
+        if (nextRoot !== undefined && nextRoot < this.rootUses) {
+            throw new Error(`Refusing to restore root uses below the current cursor (${nextRoot} < ${this.rootUses})`);
         }
+        const childNext = [];
         if (state?.childUses && typeof state.childUses === 'object') {
             for (const [key, uses] of Object.entries(state.childUses)) {
                 const index = Number(key);
-                if (Number.isInteger(index) && index >= 0 && index < this.childCount && typeof uses === 'number' && uses >= 0) {
-                    this.childUsesMap.set(index, Math.floor(uses));
+                if (Number.isInteger(index) && index >= 0 && index < this.childCount
+                    && typeof uses === 'number' && Number.isSafeInteger(uses) && uses >= 0) {
+                    const current = this.childUsesMap.get(index) ?? 0;
+                    if (uses < current) {
+                        throw new Error(`Refusing to restore child ${index} uses below the current cursor (${uses} < ${current})`);
+                    }
+                    childNext.push([index, uses]);
                 }
             }
         }
+        if (nextRoot !== undefined)
+            this.rootUses = nextRoot;
+        for (const [index, uses] of childNext)
+            this.childUsesMap.set(index, uses);
     }
     // ── Private helpers ──────────────────────────────────────────────────────────
     assertChildIndex(index) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@totemsdk/root-identity",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "Single root identity controlling up to 64 on-chain addresses — all cryptographically linked via full independent 3-level TreeKeys",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -21,7 +21,7 @@
     "LICENSE"
   ],
   "peerDependencies": {
-    "@totemsdk/core": "^1.2.8"
+    "@totemsdk/core": "^1.2.11"
   },
   "peerDependenciesMeta": {
     "@totemsdk/core": {
@@ -41,7 +41,7 @@
     "jest": "^30.4.2",
     "ts-jest": "^29.0.0",
     "typescript": "^7.0.2",
-    "@totemsdk/core": "^1.2.8"
+    "@totemsdk/core": "^1.2.11"
   },
   "keywords": [
     "totem",
@@ -59,13 +59,13 @@
   ],
   "author": "Totem SDK",
   "license": "MIT",
-  "homepage": "https://totem.ing",
+  "homepage": "https://docs.totem.ing",
   "bugs": {
-    "url": "https://github.com/totem-sdk/totem-sdk/issues"
+    "url": "https://github.com/Totem-Edge/totem-sdk/issues"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/totem-sdk/totem-sdk.git",
+    "url": "git+https://github.com/Totem-Edge/totem-sdk.git",
     "directory": "packages/root-identity"
   },
   "scripts": {

package/rust/pkg/package.json

@@ -9,7 +9,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/totem-sdk/totem-sdk"
+    "url": "https://github.com/Totem-Edge/totem-sdk"
   },
   "files": [
     "root_identity_wasm_bg.wasm",

package/rust/pkg-node/package.json

@@ -8,7 +8,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/totem-sdk/totem-sdk"
+    "url": "https://github.com/Totem-Edge/totem-sdk"
   },
   "files": [
     "root_identity_wasm_bg.wasm",