@x1id/resolve 0.17.0 → 0.19.0

package/README.md

@@ -415,8 +415,11 @@ holds keys. Every discriminator and account order matches the deployed program.
 ```ts
 import { fetchRecords, liveRecords, valueToAddress } from "@x1id/resolve";
 
-// handleAccount = the ["handle", name] PDA; registeredAt from the handle account
-const records = await fetchRecords(rpc, programId, handleAccount, registeredAt);
+// handleAccount = the ["handle", name] PDA; registeredAt + recordsClearedAt
+// both from the handle account (recordsClearedAt gates the #8139 stale-record
+// rule — see fetchRecords' signature; a tokenized handle also passes its
+// holderEpoch to fetchAttestations).
+const records = await fetchRecords(rpc, programId, handleAccount, registeredAt, recordsClearedAt);
 for (const r of liveRecords(records)) {
   console.log(r.chain, valueToAddress(r.chain, r.value));
 }
@@ -561,6 +564,11 @@ const createIx = buildCreateRecordIx({
   programId, payer, owner, handle, record,
   coinType: 60, // ETH, per SLIP-44
   value: ethAddressBytes,
+  // TOKENIZED handle (the default)? pass the holder's NFT associated token
+  // account too, or create_record fails NotCurrentAuthority (6018). The verify
+  // builders below take the same `holderTokenAccount`. Omit for an untokenized
+  // handle. (A delegated writer passes `recordDelegate` instead.)
+  holderTokenAccount, // = getAssociatedTokenAddressSync(nftMint, owner)
 });
 
 // 2. build the challenge and have the wallet sign it (personal_sign)

package/dist/index.js

@@ -234,7 +234,7 @@ export function createResolver(config) {
         // behind by a previous registration of the same name is never resolved,
         // and a stale `verified: true` is never surfaced.
         if (chain !== "X1" && chain !== "SOL") {
-            const live = liveRecords(await fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt));
+            const live = liveRecords(await fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt, handle.holderEpoch));
             const record = live.find((r) => r.coinType === CHAIN_COIN_TYPE[chain]);
             if (!record) {
                 throw new ResolveError("no-record-for-chain", `@${canonical} has no ${chain} record`, input);
@@ -341,7 +341,7 @@ export function createResolver(config) {
         if (chain !== "X1" && chain !== "SOL") {
             // ETH/BTC addresses live in per-chain `Record` accounts — same staleness
             // rule as a bare handle (fetchRecords → liveRecords).
-            const live = liveRecords(await fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt));
+            const live = liveRecords(await fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt, handle.holderEpoch));
             const record = live.find((r) => r.coinType === CHAIN_COIN_TYPE[chain]);
             if (!record) {
                 throw new ResolveError("no-record-for-chain", `${display} has no ${chain} record`, input);
@@ -645,7 +645,7 @@ export function createResolver(config) {
             throw new ResolveError("unrecognized", `per-chain records exist only for @handles, not .${parsed.namespace} domains`, input);
         }
         const { pda, handle } = await fetchHandle(parsed.canonical, input);
-        return fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt);
+        return fetchRecords(rpc, programBase58, pda, handle.registeredAt, handle.recordsClearedAt, handle.holderEpoch);
     }
     async function resolve(input, opts) {
         const chain = opts?.chain ?? "X1";

package/dist/recordWrite.d.ts

@@ -83,7 +83,7 @@ export declare function splitBtcSignature(sig65: Uint8Array): {
     header: number;
     signature: Uint8Array;
 };
-export interface CreateRecordParams {
+export interface CreateRecordParams extends RecordEditAuthorityParams {
     readonly programId: AddressLike;
     readonly payer: AddressLike;
     readonly owner: AddressLike;

package/dist/recordWrite.js

@@ -171,6 +171,12 @@ export function buildCreateRecordIx(p) {
         { pubkey: toBase58(p.record, "record"), isSigner: false, isWritable: true },
         { pubkey: SYSTEM_PROGRAM, isSigner: false, isWritable: false },
     ];
+    // W165: create_record uses the same `require_current_authority` check as the
+    // verify builders, so a TOKENIZED handle (the default) needs the holder's NFT
+    // token account (and/or the record-delegate PDA) in the trailing accounts —
+    // without it create_record fails NotCurrentAuthority (6018). This was the one
+    // record builder missing the tail; now it matches buildVerifyRecord*Ix.
+    pushAuthorityTail(keys, p.programId, p);
     return { programId: toBase58(p.programId, "programId"), keys, data };
 }
 export function buildVerifyRecordEthIx(p) {

package/dist/records.d.ts

@@ -95,7 +95,7 @@ export interface HandleRecord {
  * so a handle-only memcmp scan DOES return them — they are rejected here by
  * tag and size, not by luck.
  */
-export declare function decodeRecord(raw: Uint8Array, account: string, registeredAt: bigint, recordsClearedAt: bigint): HandleRecord | null;
+export declare function decodeRecord(raw: Uint8Array, account: string, registeredAt: bigint, recordsClearedAt: bigint, holderEpoch?: bigint): HandleRecord | null;
 /** The records the CURRENT owner actually has — `stale` ones excluded. This
  *  is the list to resolve against, display to a visitor, and count. */
 export declare function liveRecords(records: readonly HandleRecord[]): HandleRecord[];
@@ -127,4 +127,4 @@ export declare function valueToAddress(chain: Chain | null, value: Uint8Array):
  * left behind; anything that resolves, displays to a visitor, or counts
  * takes `liveRecords(...)`.
  */
-export declare function fetchRecords(rpc: RpcFn, programId: string, handleAccount: string, registeredAt: bigint, recordsClearedAt: bigint): Promise<HandleRecord[]>;
+export declare function fetchRecords(rpc: RpcFn, programId: string, handleAccount: string, registeredAt: bigint, recordsClearedAt: bigint, holderEpoch?: bigint): Promise<HandleRecord[]>;

package/dist/records.js

@@ -72,7 +72,17 @@ export function chainForCoinType(coinType) {
  * so a handle-only memcmp scan DOES return them — they are rejected here by
  * tag and size, not by luck.
  */
-export function decodeRecord(raw, account, registeredAt, recordsClearedAt) {
+export function decodeRecord(raw, account, registeredAt, recordsClearedAt, 
+// W122: a record written before the CURRENT holder's epoch belongs to a
+// previous holder and must not resolve. `holder_epoch` (H5 / PR #466) is
+// bumped by a NATIVE tokenized sale (buy_handle) INSTEAD of registered_at
+// (which must not move on a tokenized sale), so without this a transferred
+// tokenized name kept the old holder's verified pay-to records live — a
+// payment-misrouting risk. Mirrors the attestation staleness rule exactly.
+// (Defaults 0n: untokenized names and callers that don't track it are
+// unaffected; an EXTERNAL/plain Metaplex transfer stamps NOTHING, so it is
+// NOT covered here — see the module header / docs caveat.)
+holderEpoch = 0n) {
     if (raw.length !== RECORD_LEN)
         return null;
     for (let i = 0; i < 8; i++) {
@@ -95,7 +105,8 @@ export function decodeRecord(raw, account, registeredAt, recordsClearedAt) {
     const verified = raw[o] === 1;
     o += 1;
     const updatedAt = dv.getBigInt64(o, true);
-    const stale = updatedAt < registeredAt || updatedAt < recordsClearedAt;
+    const epoch = registeredAt > holderEpoch ? registeredAt : holderEpoch;
+    const stale = updatedAt < epoch || updatedAt < recordsClearedAt;
     const chain = chainForCoinType(coinType);
     return {
         account,
@@ -164,7 +175,10 @@ function hexToBytes(hex) {
  * left behind; anything that resolves, displays to a visitor, or counts
  * takes `liveRecords(...)`.
  */
-export async function fetchRecords(rpc, programId, handleAccount, registeredAt, recordsClearedAt) {
+export async function fetchRecords(rpc, programId, handleAccount, registeredAt, recordsClearedAt, 
+// W122 — pass the handle's `holderEpoch` so a native tokenized holder change
+// stales the previous holder's records (see decodeRecord). Defaults 0n.
+holderEpoch = 0n) {
     const res = (await rpc("getProgramAccounts", [
         programId,
         {
@@ -183,7 +197,7 @@ export async function fetchRecords(rpc, programId, handleAccount, registeredAt,
         const raw = new Uint8Array(bin.length);
         for (let i = 0; i < bin.length; i++)
             raw[i] = bin.charCodeAt(i);
-        const r = decodeRecord(raw, a.pubkey, registeredAt, recordsClearedAt);
+        const r = decodeRecord(raw, a.pubkey, registeredAt, recordsClearedAt, holderEpoch);
         // Defence in depth: the memcmp filter should guarantee the handle match,
         // but a wrong offset would silently attribute someone else's record to
         // this handle. A malformed account is skipped, not fatal to the list.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@x1id/resolve",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Resolve @handles and X1NS names on X1. Never silently picks between namespaces.",
   "type": "module",
   "main": "./dist/index.js",