@x1id/resolve 0.16.0 → 0.18.0

package/README.md

@@ -415,8 +415,11 @@ holds keys. Every discriminator and account order matches the deployed program.
 ```ts
 import { fetchRecords, liveRecords, valueToAddress } from "@x1id/resolve";
 
-// handleAccount = the ["handle", name] PDA; registeredAt from the handle account
-const records = await fetchRecords(rpc, programId, handleAccount, registeredAt);
+// handleAccount = the ["handle", name] PDA; registeredAt + recordsClearedAt
+// both from the handle account (recordsClearedAt gates the #8139 stale-record
+// rule — see fetchRecords' signature; a tokenized handle also passes its
+// holderEpoch to fetchAttestations).
+const records = await fetchRecords(rpc, programId, handleAccount, registeredAt, recordsClearedAt);
 for (const r of liveRecords(records)) {
   console.log(r.chain, valueToAddress(r.chain, r.value));
 }

package/dist/index.js

@@ -234,7 +234,7 @@ export function createResolver(config) {
         // behind by a previous registration of the same name is never resolved,
         // and a stale `verified: true` is never surfaced.
         if (chain !== "X1" && chain !== "SOL") {
-            const live = liveRecords(await fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt));
+            const live = liveRecords(await fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt, handle.holderEpoch));
             const record = live.find((r) => r.coinType === CHAIN_COIN_TYPE[chain]);
             if (!record) {
                 throw new ResolveError("no-record-for-chain", `@${canonical} has no ${chain} record`, input);
@@ -341,7 +341,7 @@ export function createResolver(config) {
         if (chain !== "X1" && chain !== "SOL") {
             // ETH/BTC addresses live in per-chain `Record` accounts — same staleness
             // rule as a bare handle (fetchRecords → liveRecords).
-            const live = liveRecords(await fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt));
+            const live = liveRecords(await fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt, handle.holderEpoch));
             const record = live.find((r) => r.coinType === CHAIN_COIN_TYPE[chain]);
             if (!record) {
                 throw new ResolveError("no-record-for-chain", `${display} has no ${chain} record`, input);
@@ -645,7 +645,7 @@ export function createResolver(config) {
             throw new ResolveError("unrecognized", `per-chain records exist only for @handles, not .${parsed.namespace} domains`, input);
         }
         const { pda, handle } = await fetchHandle(parsed.canonical, input);
-        return fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt);
+        return fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt, handle.holderEpoch);
     }
     async function resolve(input, opts) {
         const chain = opts?.chain ?? "X1";

package/dist/integrator.d.ts

@@ -34,7 +34,7 @@
  *   {@link integratorAccountsForRegister} / {@link integratorAccountsForCreateVoucher}
  *   to build the pair.
  * - The rate is read from the on-chain `AllowlistEntry`, never trusted from
- *   the transaction. It is capped at {@link MAX_INTEGRATOR_RATE_BPS} (40%);
+ *   the transaction. It is capped at {@link MAX_INTEGRATOR_RATE_BPS} (20%);
  *   {@link DEFAULT_INTEGRATOR_RATE_BPS} (20%) applies when `add_integrator`
  *   omits a rate.
  */
@@ -43,8 +43,12 @@ import type { AddressLike, BuiltInstruction, InstructionKey } from "./delegate.j
 export declare const INTEGRATOR_SEED = "integrator";
 /** Default integrator share when `add_integrator` omits a rate: 20%. */
 export declare const DEFAULT_INTEGRATOR_RATE_BPS = 2000;
-/** Hard cap on an integrator's share of a mint fee: 40%. */
-export declare const MAX_INTEGRATOR_RATE_BPS = 4000;
+/** Hard cap on an integrator's share of a mint fee: 20%. Mirrors the program's
+ *  `MAX_INTEGRATOR_RATE_BPS` (lib.rs) — the admin `register_integrator` /
+ *  `set_integrator_rate` paths `require!(rate <= MAX_INTEGRATOR_RATE_BPS)` and
+ *  REJECT anything higher, so a looser SDK cap only builds txs the program
+ *  refuses. (Self-service paths clamp down to it instead of rejecting.) */
+export declare const MAX_INTEGRATOR_RATE_BPS = 2000;
 /** Anchor instruction discriminator `sha256("global:add_integrator")[0..8]`. */
 export declare const ADD_INTEGRATOR_DISCRIMINATOR: Uint8Array;
 /** Anchor instruction discriminator `sha256("global:set_integrator_rate")[0..8]`. */

package/dist/integrator.js

@@ -34,7 +34,7 @@
  *   {@link integratorAccountsForRegister} / {@link integratorAccountsForCreateVoucher}
  *   to build the pair.
  * - The rate is read from the on-chain `AllowlistEntry`, never trusted from
- *   the transaction. It is capped at {@link MAX_INTEGRATOR_RATE_BPS} (40%);
+ *   the transaction. It is capped at {@link MAX_INTEGRATOR_RATE_BPS} (20%);
  *   {@link DEFAULT_INTEGRATOR_RATE_BPS} (20%) applies when `add_integrator`
  *   omits a rate.
  */
@@ -43,8 +43,12 @@ import { encodeBase58, decodeBase58_32 } from "./base58.js";
 export const INTEGRATOR_SEED = "integrator";
 /** Default integrator share when `add_integrator` omits a rate: 20%. */
 export const DEFAULT_INTEGRATOR_RATE_BPS = 2_000;
-/** Hard cap on an integrator's share of a mint fee: 40%. */
-export const MAX_INTEGRATOR_RATE_BPS = 4_000;
+/** Hard cap on an integrator's share of a mint fee: 20%. Mirrors the program's
+ *  `MAX_INTEGRATOR_RATE_BPS` (lib.rs) — the admin `register_integrator` /
+ *  `set_integrator_rate` paths `require!(rate <= MAX_INTEGRATOR_RATE_BPS)` and
+ *  REJECT anything higher, so a looser SDK cap only builds txs the program
+ *  refuses. (Self-service paths clamp down to it instead of rejecting.) */
+export const MAX_INTEGRATOR_RATE_BPS = 2_000;
 /** Anchor instruction discriminator `sha256("global:add_integrator")[0..8]`. */
 export const ADD_INTEGRATOR_DISCRIMINATOR = Uint8Array.from([85, 249, 72, 201, 17, 187, 227, 38]);
 /** Anchor instruction discriminator `sha256("global:set_integrator_rate")[0..8]`. */

package/dist/records.d.ts

@@ -95,7 +95,7 @@ export interface HandleRecord {
  * so a handle-only memcmp scan DOES return them — they are rejected here by
  * tag and size, not by luck.
  */
-export declare function decodeRecord(raw: Uint8Array, account: string, registeredAt: bigint, recordsClearedAt: bigint): HandleRecord | null;
+export declare function decodeRecord(raw: Uint8Array, account: string, registeredAt: bigint, recordsClearedAt: bigint, holderEpoch?: bigint): HandleRecord | null;
 /** The records the CURRENT owner actually has — `stale` ones excluded. This
  *  is the list to resolve against, display to a visitor, and count. */
 export declare function liveRecords(records: readonly HandleRecord[]): HandleRecord[];
@@ -127,4 +127,4 @@ export declare function valueToAddress(chain: Chain | null, value: Uint8Array):
  * left behind; anything that resolves, displays to a visitor, or counts
  * takes `liveRecords(...)`.
  */
-export declare function fetchRecords(rpc: RpcFn, programId: string, handleAccount: string, registeredAt: bigint, recordsClearedAt: bigint): Promise<HandleRecord[]>;
+export declare function fetchRecords(rpc: RpcFn, programId: string, handleAccount: string, registeredAt: bigint, recordsClearedAt: bigint, holderEpoch?: bigint): Promise<HandleRecord[]>;

package/dist/records.js

@@ -72,7 +72,17 @@ export function chainForCoinType(coinType) {
  * so a handle-only memcmp scan DOES return them — they are rejected here by
  * tag and size, not by luck.
  */
-export function decodeRecord(raw, account, registeredAt, recordsClearedAt) {
+export function decodeRecord(raw, account, registeredAt, recordsClearedAt, 
+// W122: a record written before the CURRENT holder's epoch belongs to a
+// previous holder and must not resolve. `holder_epoch` (H5 / PR #466) is
+// bumped by a NATIVE tokenized sale (buy_handle) INSTEAD of registered_at
+// (which must not move on a tokenized sale), so without this a transferred
+// tokenized name kept the old holder's verified pay-to records live — a
+// payment-misrouting risk. Mirrors the attestation staleness rule exactly.
+// (Defaults 0n: untokenized names and callers that don't track it are
+// unaffected; an EXTERNAL/plain Metaplex transfer stamps NOTHING, so it is
+// NOT covered here — see the module header / docs caveat.)
+holderEpoch = 0n) {
     if (raw.length !== RECORD_LEN)
         return null;
     for (let i = 0; i < 8; i++) {
@@ -95,7 +105,8 @@ export function decodeRecord(raw, account, registeredAt, recordsClearedAt) {
     const verified = raw[o] === 1;
     o += 1;
     const updatedAt = dv.getBigInt64(o, true);
-    const stale = updatedAt < registeredAt || updatedAt < recordsClearedAt;
+    const epoch = registeredAt > holderEpoch ? registeredAt : holderEpoch;
+    const stale = updatedAt < epoch || updatedAt < recordsClearedAt;
     const chain = chainForCoinType(coinType);
     return {
         account,
@@ -164,7 +175,10 @@ function hexToBytes(hex) {
  * left behind; anything that resolves, displays to a visitor, or counts
  * takes `liveRecords(...)`.
  */
-export async function fetchRecords(rpc, programId, handleAccount, registeredAt, recordsClearedAt) {
+export async function fetchRecords(rpc, programId, handleAccount, registeredAt, recordsClearedAt, 
+// W122 — pass the handle's `holderEpoch` so a native tokenized holder change
+// stales the previous holder's records (see decodeRecord). Defaults 0n.
+holderEpoch = 0n) {
     const res = (await rpc("getProgramAccounts", [
         programId,
         {
@@ -183,7 +197,7 @@ export async function fetchRecords(rpc, programId, handleAccount, registeredAt,
         const raw = new Uint8Array(bin.length);
         for (let i = 0; i < bin.length; i++)
             raw[i] = bin.charCodeAt(i);
-        const r = decodeRecord(raw, a.pubkey, registeredAt, recordsClearedAt);
+        const r = decodeRecord(raw, a.pubkey, registeredAt, recordsClearedAt, holderEpoch);
         // Defence in depth: the memcmp filter should guarantee the handle match,
         // but a wrong offset would silently attribute someone else's record to
         // this handle. A malformed account is skipped, not fatal to the list.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@x1id/resolve",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Resolve @handles and X1NS names on X1. Never silently picks between namespaces.",
   "type": "module",
   "main": "./dist/index.js",