@x1id/resolve 0.14.0 → 0.15.1

package/README.md

@@ -366,10 +366,22 @@ export async function POST(req: Request) {           // any server runtime with
 }
 ```
 
-Fail-closed by default (re-throws if the decision can't be obtained; pass
-`{ onError: "allow" }` to fail-open). `checkGate()` is the lower-level client for
-the full decision; pass a stored policy's `gp_…` id as the policy to reuse a named
-policy. The hosted check is keyed/metered — see `services/dev-api`'s README.
+Fail-closed by default (re-throws if the decision can't be obtained). `onError:
+"deny"` fails closed without throwing (clean `allowed: false`). `checkGate()` is
+the lower-level client for the full decision; pass a stored policy's `gp_…` id as
+the policy to reuse a named policy. The hosted check is keyed/metered — see
+`services/dev-api`'s README.
+
+> **⚠️ Never use `onError: "allow"` on a real gate.** It FAILS OPEN: on *any*
+> error — a network blip, a timeout, a 5xx, an auth failure, a malformed
+> response — it fabricates a `passed: true` decision and admits the caller
+> **unverified**. Anyone who can make your gate call fail (trivially: induce a
+> timeout) then bypasses the gate completely, so it is worse than no gate at all
+> for anything it protects — a route, a mint, an airdrop, a write, an allowlist.
+> It exists ONLY for soft, non-security personalization where a missing
+> verification must not degrade UX (e.g. optionally showing a "verified"
+> flourish). Using it logs a one-time `console.warn`. If the decision gates
+> anything, use the default `"throw"` or `"deny"`.
 
 ## What works today
 

package/dist/connect.d.ts

@@ -0,0 +1,174 @@
+/**
+ * X1ID Connect — the TRANSACTION-signature sign-in client (#8452, verify-tx).
+ *
+ * # Why a transaction, not a message
+ *
+ * The message path ({@link import("./signin.js").signInWithX1ID}) asks the
+ * wallet to `signMessage` the challenge bytes. Two real wallets break that on
+ * X1:
+ *   - a Ledger (via Phantom/Backpack) REFUSES off-chain message signing; and
+ *   - Backpack on X1 returns `signMessage` signatures that DO NOT verify under
+ *     the wallet's own pubkey, even though its TRANSACTION signatures are valid
+ *     on-chain.
+ *
+ * So this flow proves wallet control a different, robust way: the wallet signs a
+ * throwaway MEMO TRANSACTION — one SPL-Memo instruction carrying
+ * `x1id-verify:<nonce>`, fee-paid by the wallet, never broadcast. The hosted
+ * `POST /v1/auth/verify-tx` endpoint deserializes the signed artifact, asserts
+ * it is EXACTLY that memo (no disguised transfer/approval), that the fee payer
+ * is the wallet, that the memo binds our single-use nonce, and verifies the
+ * ed25519 transaction signature. A valid proof mints the same Bearer session the
+ * message path does.
+ *
+ * This is the WALLET-control (no primary `@handle`) path — the app.x1id.io model
+ * where the connected wallet IS the identity, with the `@handle` as optional
+ * metadata. A handle-gated sign-in keeps the full on-chain control proof.
+ *
+ * # web3.js is injected, not depended on
+ *
+ * `@solana/web3.js` is an OPTIONAL peer dependency of this package (see
+ * scoped.ts / universalSns.ts). {@link buildVerifyTxChallenge} therefore takes
+ * the `{ Transaction, TransactionInstruction, PublicKey }` constructors as an
+ * injected {@link VerifyTxWeb3} rather than importing them — the SDK core stays
+ * free of a hard web3 dependency and tests can supply a fake.
+ */
+/** Memo prefix the verify-tx proof binds to. The signed memo instruction's
+ *  UTF-8 data MUST be EXACTLY `x1id-verify:<nonce>` — the server rejects any
+ *  other data, which is what kills replay of an unrelated signed transaction. */
+export declare const VERIFY_TX_MEMO_PREFIX: "x1id-verify:";
+/** Canonical SPL Memo program id — the program the challenge memo rides on. */
+export declare const MEMO_PROGRAM_ID: "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr";
+/** The exact memo string for a given challenge nonce. */
+export declare function verifyTxMemo(nonce: string): string;
+/** The slice of a web3.js `PublicKey` used here. */
+export interface PublicKeyInstance {
+    toBytes(): Uint8Array;
+    toBase58(): string;
+}
+export interface PublicKeyCtor {
+    new (value: string | Uint8Array): PublicKeyInstance;
+}
+/** The slice of a web3.js `TransactionInstruction` constructor used here. */
+export interface TransactionInstructionCtor {
+    new (args: {
+        keys: ReadonlyArray<{
+            pubkey: PublicKeyInstance;
+            isSigner: boolean;
+            isWritable: boolean;
+        }>;
+        programId: PublicKeyInstance;
+        data: Uint8Array;
+    }): unknown;
+}
+/** The slice of a web3.js legacy `Transaction` instance used here. */
+export interface TransactionInstance {
+    add(instruction: unknown): TransactionInstance;
+    feePayer: PublicKeyInstance | null | undefined;
+    recentBlockhash: string | undefined;
+    /** Serialize the fully-signed transaction to raw bytes. */
+    serialize(options?: unknown): Uint8Array;
+}
+export interface TransactionCtor {
+    new (): TransactionInstance;
+}
+/** The three web3.js constructors {@link buildVerifyTxChallenge} needs. Pass the
+ *  module (`import * as web3 from "@solana/web3.js"`) or a `{ Transaction,
+ *  TransactionInstruction, PublicKey }` subset — exactly as the scoped deriver
+ *  takes `web3`. */
+export interface VerifyTxWeb3 {
+    readonly Transaction: TransactionCtor;
+    readonly TransactionInstruction: TransactionInstructionCtor;
+    readonly PublicKey: PublicKeyCtor;
+}
+/** 32 zero-bytes in base58 — a structurally valid blockhash. The transaction is
+ *  NEVER broadcast, so a placeholder blockhash is fine; a wallet that insists on
+ *  a fresh one can pass its own in {@link BuildVerifyTxChallengeParams.blockhash}. */
+export declare const PLACEHOLDER_BLOCKHASH: "11111111111111111111111111111111";
+export interface BuildVerifyTxChallengeParams {
+    /** The single-use nonce from the tx-mode challenge. */
+    readonly nonce: string;
+    /** The memo the server returned (`x1id-verify:<nonce>`). Optional — derived
+     *  from `nonce` when omitted; when supplied it MUST equal that, or the build
+     *  throws (catches a client that paired the wrong nonce/memo). */
+    readonly memo?: string;
+    /** The signing wallet, base58 — becomes the fee payer AND the memo signer. */
+    readonly feePayer: string;
+    /** A recent blockhash. Defaults to {@link PLACEHOLDER_BLOCKHASH} (the tx is
+     *  never submitted). */
+    readonly blockhash?: string;
+}
+/**
+ * Build the memo-only challenge transaction the wallet signs for verify-tx.
+ *
+ * The result is a legacy `Transaction` with EXACTLY one instruction: an SPL-Memo
+ * instruction whose data is the UTF-8 bytes of `x1id-verify:<nonce>`, with the
+ * fee payer listed as a required signer on that instruction. Nothing else — no
+ * transfer, no compute-budget, no durable nonce — so the signed artifact can
+ * only ever be a sign-in proof, never a disguised value-moving transaction. The
+ * server enforces the same shape on receipt.
+ */
+export declare function buildVerifyTxChallenge(web3: VerifyTxWeb3, params: BuildVerifyTxChallengeParams): TransactionInstance;
+/** Default hosted X1ID /v1 base URL. */
+export declare const DEFAULT_CONNECT_BASE_URL = "https://api.x1id.io";
+export interface ConnectClientConfig {
+    /** Your X1ID API key (`x1id_…` / `x1idlive_…`) — identifies the dapp. */
+    readonly apiKey: string;
+    /** Base URL of the /v1 API. Defaults to {@link DEFAULT_CONNECT_BASE_URL}. */
+    readonly baseUrl?: string;
+    /** Inject a `fetch` (tests, non-global-fetch runtimes). */
+    readonly fetchImpl?: typeof fetch;
+    /** Per-request timeout in ms (default 15_000). */
+    readonly timeoutMs?: number;
+}
+/** The Bearer session verify-tx mints — identical shape to the message path. */
+export interface ConnectSession {
+    readonly token: string;
+    readonly token_type: string;
+    readonly expires_at: number;
+    readonly handle: string | null;
+    readonly address: string;
+    readonly verified: readonly string[];
+    readonly source: string;
+    readonly proves: string;
+    readonly disclaimer: string;
+}
+/** The tx-mode challenge response (the fields this flow uses). */
+export interface TxChallenge {
+    readonly nonce: string;
+    readonly memo: string;
+    readonly handle: string | null;
+    readonly expires_at: number;
+}
+/** Thrown when sign-in could not complete (network, auth, a typed service
+ *  error, a wallet failure, or tx-mode being unavailable for this wallet). */
+export declare class ConnectError extends Error {
+    readonly code: string;
+    readonly status?: number | undefined;
+    constructor(code: string, message: string, status?: number | undefined);
+}
+export interface SigninWithTxParams {
+    /** Injected web3.js constructors (see {@link VerifyTxWeb3}). */
+    readonly web3: VerifyTxWeb3;
+    /** The connected wallet's address, base58 — the fee payer / identity. */
+    readonly wallet: string;
+    /**
+     * The wallet's transaction signer. Takes the memo transaction built here and
+     * returns it fully signed (the wallet's `signTransaction`). The returned
+     * object must `serialize()` to the signed transaction bytes.
+     */
+    readonly signTransaction: (tx: TransactionInstance) => Promise<TransactionInstance>;
+    /** Optional recent blockhash; defaults to {@link PLACEHOLDER_BLOCKHASH}. */
+    readonly blockhash?: string;
+}
+/**
+ * Sign in with a transaction-signature proof of wallet control.
+ *
+ * Requests a tx-mode challenge, builds the memo transaction, has the caller's
+ * wallet sign it, and posts the signed artifact to `POST /v1/auth/verify-tx`,
+ * returning the minted session. Throws {@link ConnectError} on any failure.
+ *
+ * The wallet must have NO primary `@handle` for the tx path (it proves wallet
+ * control only); if it has one, the challenge comes back without a memo and this
+ * throws `TX_MODE_UNAVAILABLE` (use the handle-gated message path instead).
+ */
+export declare function signinWithTx(cfg: ConnectClientConfig, params: SigninWithTxParams): Promise<ConnectSession>;

package/dist/connect.js

@@ -0,0 +1,193 @@
+/**
+ * X1ID Connect — the TRANSACTION-signature sign-in client (#8452, verify-tx).
+ *
+ * # Why a transaction, not a message
+ *
+ * The message path ({@link import("./signin.js").signInWithX1ID}) asks the
+ * wallet to `signMessage` the challenge bytes. Two real wallets break that on
+ * X1:
+ *   - a Ledger (via Phantom/Backpack) REFUSES off-chain message signing; and
+ *   - Backpack on X1 returns `signMessage` signatures that DO NOT verify under
+ *     the wallet's own pubkey, even though its TRANSACTION signatures are valid
+ *     on-chain.
+ *
+ * So this flow proves wallet control a different, robust way: the wallet signs a
+ * throwaway MEMO TRANSACTION — one SPL-Memo instruction carrying
+ * `x1id-verify:<nonce>`, fee-paid by the wallet, never broadcast. The hosted
+ * `POST /v1/auth/verify-tx` endpoint deserializes the signed artifact, asserts
+ * it is EXACTLY that memo (no disguised transfer/approval), that the fee payer
+ * is the wallet, that the memo binds our single-use nonce, and verifies the
+ * ed25519 transaction signature. A valid proof mints the same Bearer session the
+ * message path does.
+ *
+ * This is the WALLET-control (no primary `@handle`) path — the app.x1id.io model
+ * where the connected wallet IS the identity, with the `@handle` as optional
+ * metadata. A handle-gated sign-in keeps the full on-chain control proof.
+ *
+ * # web3.js is injected, not depended on
+ *
+ * `@solana/web3.js` is an OPTIONAL peer dependency of this package (see
+ * scoped.ts / universalSns.ts). {@link buildVerifyTxChallenge} therefore takes
+ * the `{ Transaction, TransactionInstruction, PublicKey }` constructors as an
+ * injected {@link VerifyTxWeb3} rather than importing them — the SDK core stays
+ * free of a hard web3 dependency and tests can supply a fake.
+ */
+/** Memo prefix the verify-tx proof binds to. The signed memo instruction's
+ *  UTF-8 data MUST be EXACTLY `x1id-verify:<nonce>` — the server rejects any
+ *  other data, which is what kills replay of an unrelated signed transaction. */
+export const VERIFY_TX_MEMO_PREFIX = "x1id-verify:";
+/** Canonical SPL Memo program id — the program the challenge memo rides on. */
+export const MEMO_PROGRAM_ID = "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr";
+/** The exact memo string for a given challenge nonce. */
+export function verifyTxMemo(nonce) {
+    return VERIFY_TX_MEMO_PREFIX + nonce;
+}
+/** 32 zero-bytes in base58 — a structurally valid blockhash. The transaction is
+ *  NEVER broadcast, so a placeholder blockhash is fine; a wallet that insists on
+ *  a fresh one can pass its own in {@link BuildVerifyTxChallengeParams.blockhash}. */
+export const PLACEHOLDER_BLOCKHASH = "11111111111111111111111111111111";
+/**
+ * Build the memo-only challenge transaction the wallet signs for verify-tx.
+ *
+ * The result is a legacy `Transaction` with EXACTLY one instruction: an SPL-Memo
+ * instruction whose data is the UTF-8 bytes of `x1id-verify:<nonce>`, with the
+ * fee payer listed as a required signer on that instruction. Nothing else — no
+ * transfer, no compute-budget, no durable nonce — so the signed artifact can
+ * only ever be a sign-in proof, never a disguised value-moving transaction. The
+ * server enforces the same shape on receipt.
+ */
+export function buildVerifyTxChallenge(web3, params) {
+    const { nonce, feePayer, blockhash } = params;
+    if (typeof nonce !== "string" || nonce.length === 0)
+        throw new Error("nonce is required");
+    if (typeof feePayer !== "string" || feePayer.length === 0)
+        throw new Error("feePayer is required");
+    const memo = params.memo ?? verifyTxMemo(nonce);
+    if (memo !== verifyTxMemo(nonce)) {
+        throw new Error(`memo must be exactly "${verifyTxMemo(nonce)}" for this nonce`);
+    }
+    const payer = new web3.PublicKey(feePayer);
+    const memoProgram = new web3.PublicKey(MEMO_PROGRAM_ID);
+    const ix = new web3.TransactionInstruction({
+        // The signer must appear in the instruction keys for the memo to be a
+        // "signed memo" and for the wallet to require THIS key's signature.
+        keys: [{ pubkey: payer, isSigner: true, isWritable: false }],
+        programId: memoProgram,
+        data: new TextEncoder().encode(memo),
+    });
+    const tx = new web3.Transaction();
+    tx.add(ix);
+    tx.feePayer = payer;
+    tx.recentBlockhash = blockhash ?? PLACEHOLDER_BLOCKHASH;
+    return tx;
+}
+// -----------------------------------------------------------------------------
+// signinWithTx — one call: tx-mode challenge -> sign -> verify-tx -> session
+// -----------------------------------------------------------------------------
+/** Default hosted X1ID /v1 base URL. */
+export const DEFAULT_CONNECT_BASE_URL = "https://api.x1id.io";
+/** Thrown when sign-in could not complete (network, auth, a typed service
+ *  error, a wallet failure, or tx-mode being unavailable for this wallet). */
+export class ConnectError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.name = "ConnectError";
+    }
+}
+function baseUrlOf(cfg) {
+    return (cfg.baseUrl ?? DEFAULT_CONNECT_BASE_URL).replace(/\/+$/, "");
+}
+function bytesToBase64(bytes) {
+    let bin = "";
+    const CHUNK = 0x8000;
+    for (let i = 0; i < bytes.length; i += CHUNK) {
+        bin += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+    }
+    // `btoa` is available in browsers and Node 18+ (the SDK's floor). register.ts
+    // already relies on the sibling `atob`.
+    return btoa(bin);
+}
+async function postJson(cfg, path, body) {
+    const doFetch = cfg.fetchImpl ?? globalThis.fetch;
+    if (typeof doFetch !== "function")
+        throw new ConnectError("NO_FETCH", "no fetch available; pass fetchImpl in the config");
+    if (!cfg.apiKey)
+        throw new ConnectError("NO_API_KEY", "an X1ID apiKey is required");
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), cfg.timeoutMs ?? 15_000);
+    let res;
+    try {
+        res = await doFetch(`${baseUrlOf(cfg)}${path}`, {
+            method: "POST",
+            headers: { "content-type": "application/json", "x-api-key": cfg.apiKey },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+    }
+    catch (e) {
+        throw new ConnectError("REQUEST_FAILED", `request to ${path} failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    let parsed;
+    try {
+        parsed = await res.json();
+    }
+    catch {
+        throw new ConnectError("BAD_RESPONSE", `${path} returned non-JSON (HTTP ${res.status})`, res.status);
+    }
+    if (!res.ok) {
+        const b = (parsed ?? {});
+        throw new ConnectError(b.code ?? "HTTP_ERROR", b.message ?? `${path} returned HTTP ${res.status}`, res.status);
+    }
+    return parsed;
+}
+/**
+ * Sign in with a transaction-signature proof of wallet control.
+ *
+ * Requests a tx-mode challenge, builds the memo transaction, has the caller's
+ * wallet sign it, and posts the signed artifact to `POST /v1/auth/verify-tx`,
+ * returning the minted session. Throws {@link ConnectError} on any failure.
+ *
+ * The wallet must have NO primary `@handle` for the tx path (it proves wallet
+ * control only); if it has one, the challenge comes back without a memo and this
+ * throws `TX_MODE_UNAVAILABLE` (use the handle-gated message path instead).
+ */
+export async function signinWithTx(cfg, params) {
+    const challenge = await postJson(cfg, "/v1/auth/challenge", {
+        wallet: params.wallet,
+        mode: "tx",
+    });
+    if (!challenge.memo || !challenge.nonce) {
+        throw new ConnectError("TX_MODE_UNAVAILABLE", "the transaction sign-in path is for a wallet with no primary @handle; this wallet returned no tx memo");
+    }
+    const tx = buildVerifyTxChallenge(params.web3, {
+        nonce: challenge.nonce,
+        memo: challenge.memo,
+        feePayer: params.wallet,
+        ...(params.blockhash !== undefined ? { blockhash: params.blockhash } : {}),
+    });
+    let signed;
+    try {
+        signed = await params.signTransaction(tx);
+    }
+    catch (e) {
+        throw new ConnectError("WALLET_ERROR", `wallet failed to sign the challenge transaction: ${String(e)}`, undefined);
+    }
+    let signedTransaction;
+    try {
+        signedTransaction = bytesToBase64(signed.serialize());
+    }
+    catch (e) {
+        throw new ConnectError("WALLET_ERROR", `could not serialize the signed transaction: ${String(e)}`);
+    }
+    return postJson(cfg, "/v1/auth/verify-tx", {
+        nonce: challenge.nonce,
+        signedTransaction,
+    });
+}

package/dist/gateClient.d.ts

@@ -80,14 +80,16 @@ export interface GuardResult {
  * silently admitting an unverified caller. `onError: "deny"` instead resolves to
  * a clean `allowed: false` (fail-closed without a throw).
  *
- * ⚠️ SECURITY — `onError: "allow"` FAILS OPEN. On ANY error (network blip,
- * timeout, 5xx, auth failure, a malformed response) it fabricates a
- * `passed: true` decision and admits the caller UNVERIFIED. NEVER use it for a
- * real access gate — anyone who can make your gate call fail (trivial: induce a
- * timeout) then bypasses it completely. It exists ONLY for soft, non-security
- * personalization where a missing verification must not degrade UX (e.g.
- * optionally showing a "verified" flourish). If the gate protects anything —
- * a route, a mint, an airdrop, a write — use the default `"throw"` or `"deny"`.
+ * ⚠️ SECURITY — `onError: "allow"` FAILS OPEN, and is NEVER acceptable on a real
+ * gate. On ANY error (network blip, timeout, 5xx, auth failure, a malformed
+ * response) it fabricates a `passed: true` decision and admits the caller
+ * UNVERIFIED — so anyone who can make your gate call fail (trivial: induce a
+ * timeout) bypasses it completely. That makes it strictly WORSE than no gate for
+ * anything it is supposed to protect: a route, a mint, an airdrop, a write, an
+ * allowlist. It exists ONLY for soft, non-security personalization where a
+ * missing verification must not degrade UX (e.g. optionally showing a "verified"
+ * flourish). Constructing a guard with it logs a one-time `console.warn`. If the
+ * decision gates ANYTHING, use the default `"throw"` or `"deny"` (fail-closed).
  *
  * @example
  * ```ts

package/dist/gateClient.js

@@ -81,14 +81,16 @@ export async function checkGate(cfg, subject, policy) {
  * silently admitting an unverified caller. `onError: "deny"` instead resolves to
  * a clean `allowed: false` (fail-closed without a throw).
  *
- * ⚠️ SECURITY — `onError: "allow"` FAILS OPEN. On ANY error (network blip,
- * timeout, 5xx, auth failure, a malformed response) it fabricates a
- * `passed: true` decision and admits the caller UNVERIFIED. NEVER use it for a
- * real access gate — anyone who can make your gate call fail (trivial: induce a
- * timeout) then bypasses it completely. It exists ONLY for soft, non-security
- * personalization where a missing verification must not degrade UX (e.g.
- * optionally showing a "verified" flourish). If the gate protects anything —
- * a route, a mint, an airdrop, a write — use the default `"throw"` or `"deny"`.
+ * ⚠️ SECURITY — `onError: "allow"` FAILS OPEN, and is NEVER acceptable on a real
+ * gate. On ANY error (network blip, timeout, 5xx, auth failure, a malformed
+ * response) it fabricates a `passed: true` decision and admits the caller
+ * UNVERIFIED — so anyone who can make your gate call fail (trivial: induce a
+ * timeout) bypasses it completely. That makes it strictly WORSE than no gate for
+ * anything it is supposed to protect: a route, a mint, an airdrop, a write, an
+ * allowlist. It exists ONLY for soft, non-security personalization where a
+ * missing verification must not degrade UX (e.g. optionally showing a "verified"
+ * flourish). Constructing a guard with it logs a one-time `console.warn`. If the
+ * decision gates ANYTHING, use the default `"throw"` or `"deny"` (fail-closed).
  *
  * @example
  * ```ts
@@ -106,6 +108,10 @@ export async function checkGate(cfg, subject, policy) {
  */
 export function requireGate(cfg, policy, opts = {}) {
     const onError = opts.onError ?? "throw";
+    // Warn HARD (once) the moment a fail-open guard is built — `onError: "allow"`
+    // admits unverified callers on any error and must never guard anything real.
+    if (onError === "allow")
+        warnFailOpenOnce();
     return async (subject) => {
         try {
             const decision = await checkGate(cfg, subject, policy);
@@ -126,3 +132,16 @@ export function requireGate(cfg, policy, opts = {}) {
         }
     };
 }
+/** Process-wide latch so the fail-open warning fires at most once, not on every
+ *  guard construction. */
+let failOpenWarned = false;
+function warnFailOpenOnce() {
+    if (failOpenWarned)
+        return;
+    failOpenWarned = true;
+    // eslint-disable-next-line no-console
+    console.warn("[@x1id/resolve] requireGate({ onError: \"allow\" }) FAILS OPEN: on any gate-call " +
+        "error it admits the caller UNVERIFIED. Never use it to protect a route, mint, " +
+        "airdrop, write, or allowlist — use the default \"throw\" or \"deny\" instead. " +
+        "(This warning is for soft personalization-only uses; it logs once.)");
+}

package/dist/index.d.ts

@@ -51,6 +51,7 @@ export * from "./clearRecords.js";
 export * from "./commitReveal.js";
 export * from "./pnftTransfer.js";
 export * from "./signin.js";
+export * from "./connect.js";
 export * from "./domainProof.js";
 export { scopedTldCandidate, namespaceIsActive, makeScopedHandleDeriver, type ScopedCandidate, type ScopedHandleDeriver, } from "./scoped.js";
 import { type Chain, type Resolved } from "./types.js";

package/dist/index.js

@@ -58,6 +58,7 @@ export * from "./clearRecords.js";
 export * from "./commitReveal.js";
 export * from "./pnftTransfer.js";
 export * from "./signin.js";
+export * from "./connect.js";
 export * from "./domainProof.js";
 // Named (not `export *`): `NAMESPACE_MAX_LEN` is already exported by
 // adminMarket.js, and two `export *` sharing a name would make it ambiguous

package/dist/signin.js

@@ -78,6 +78,14 @@ export class SignInError extends Error {
  *  belt-and-suspenders CR/LF guard in {@link createSignInChallenge} mirrors the
  *  `uri`/`statement` fields and is the real anti-injection control. */
 const DOMAIN_RE = /^[A-Za-z0-9.-]{1,253}(:\d{1,5})?$/;
+/** Any character a line-oriented parser could mistake for a boundary: every C0
+ *  control (so `\n`, `\r`, `\t`, and the rest), DEL, and — the trap the old
+ *  `\n`/`\r`-only guard missed — the Unicode line/paragraph separators
+ *  U+2028/U+2029, which `^`/`$` under the regex `m` flag honor just like `\n`
+ *  (see {@link parseSignInChallenge}'s field parser). FORBIDDEN in every value
+ *  interpolated into a challenge line (domain, statement, uri) so a crafted
+ *  value can never forge a second line — challenge-line injection (audit L5). */
+const FORBIDDEN_LINE_CHAR_RE = /[\u0000-\u001f\u007f\u2028\u2029]/;
 /** Nonce charset — ASCII alphanumeric, matching the rest of the SDK's nonces so
  *  it can never contain a separator or a newline. SIWE requires >= 8 chars. */
 const NONCE_RE = /^[0-9A-Za-z]{8,128}$/;
@@ -124,11 +132,14 @@ export function generateSignInNonce(bytes = 16) {
  */
 export function createSignInChallenge(params) {
     const { domain } = params;
-    // Explicit CR/LF guard first — mirrors the `uri`/`statement` fields below and
-    // makes the anti-challenge-injection intent impossible to regress even if the
-    // charset in DOMAIN_RE is ever loosened.
-    if (typeof domain !== "string" || domain.includes("\n") || domain.includes("\r") || !DOMAIN_RE.test(domain)) {
-        throw new SignInError("invalid-params", "domain must be a single DNS host (letters, digits, '.', '-'), no newlines");
+    // Explicit control/line-terminator guard first — mirrors the `uri`/`statement`
+    // fields below and makes the anti-challenge-injection intent impossible to
+    // regress even if the charset in DOMAIN_RE is ever loosened. DOMAIN_RE already
+    // admits only `[A-Za-z0-9.-]` (+ optional `:port`), so this is belt-and-
+    // suspenders — but it is the control that catches EVERY forbidden boundary
+    // char (incl. `\t`, U+2028/U+2029), not just `\n`/`\r` (audit L5).
+    if (typeof domain !== "string" || FORBIDDEN_LINE_CHAR_RE.test(domain) || !DOMAIN_RE.test(domain)) {
+        throw new SignInError("invalid-params", "domain must be a single DNS host (letters, digits, '.', '-'), no control characters");
     }
     if (!decodeBase58_32(params.address)) {
         throw new SignInError("invalid-params", `"${params.address}" is not a valid X1 address`);
@@ -137,12 +148,12 @@ export function createSignInChallenge(params) {
     // the signer and the verifier both compare against.
     const address = encodeBase58(decodeBase58_32(params.address));
     const statement = params.statement ?? null;
-    if (statement !== null && (statement.includes("\n") || statement.includes("\r") || statement.length === 0)) {
-        throw new SignInError("invalid-params", "statement must be a single non-empty line");
+    if (statement !== null && (FORBIDDEN_LINE_CHAR_RE.test(statement) || statement.length === 0)) {
+        throw new SignInError("invalid-params", "statement must be a single non-empty line (no control characters)");
     }
     const uri = params.uri ?? `https://${domain}`;
-    if (uri.includes("\n") || uri.includes("\r")) {
-        throw new SignInError("invalid-params", "uri must be a single line");
+    if (FORBIDDEN_LINE_CHAR_RE.test(uri)) {
+        throw new SignInError("invalid-params", "uri must be a single line (no control characters)");
     }
     const nonce = params.nonce ?? generateSignInNonce();
     if (!NONCE_RE.test(nonce)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@x1id/resolve",
-  "version": "0.14.0",
+  "version": "0.15.1",
   "description": "Resolve @handles and X1NS names on X1. Never silently picks between namespaces.",
   "type": "module",
   "main": "./dist/index.js",