@x1id/resolve 0.19.0 → 0.19.2

package/dist/adminMarket.d.ts

@@ -44,9 +44,20 @@ export declare const NAMESPACE_MAX_LEN = 16;
 export type NamespaceStatus = "Active" | "Paused" | "Retired";
 export interface CreateNamespaceParams {
     readonly programId: AddressLike;
-    /** admin — signs AND pays rent; writable. */
-    readonly admin: AddressLike;
+    /** The creator — signs AND pays rent + the creation fee; writable.
+     *  Permissionless: any wallet, not an admin. (Was mis-named `admin` and
+     *  built with too few accounts, so the ix failed AccountNotEnoughKeys 3005 —
+     *  W169.) */
+    readonly payer: AddressLike;
     readonly config: AddressLike;
+    /** `Config.treasury` — receives the creation fee; writable. */
+    readonly treasury: AddressLike;
+    /** The creator's chosen payout wallet, recorded on the namespace for future
+     *  75% primary/secondary cuts. An arbitrary pubkey; never signs. */
+    readonly creatorPayout: AddressLike;
+    /** `["reserved_namespace", label]` PDA — the denylist shadow the handler
+     *  refuses creation against if it exists; read-only, never written. */
+    readonly reserved: AddressLike;
     /** `["namespace", label]` PDA — init, writable. */
     readonly namespace: AddressLike;
     /** Canonical ASCII label (a-z 0-9 -), 1..=16 bytes — an instruction ARG. */

package/dist/adminMarket.js

@@ -111,9 +111,14 @@ export function buildCreateNamespaceIx(p) {
         throw new Error(`label must be 1..=${NAMESPACE_MAX_LEN} chars`);
     }
     const data = concat([CREATE_NAMESPACE_DISCRIMINATOR, borshString(p.label)]);
+    // Account order matches the program's `CreateNamespace` context exactly:
+    // payer, config, treasury, creator_payout, reserved, namespace, system.
     const keys = [
-        { pubkey: toBase58(p.admin, "admin"), isSigner: true, isWritable: true },
+        { pubkey: toBase58(p.payer, "payer"), isSigner: true, isWritable: true },
         { pubkey: toBase58(p.config, "config"), isSigner: false, isWritable: false },
+        { pubkey: toBase58(p.treasury, "treasury"), isSigner: false, isWritable: true },
+        { pubkey: toBase58(p.creatorPayout, "creatorPayout"), isSigner: false, isWritable: false },
+        { pubkey: toBase58(p.reserved, "reserved"), isSigner: false, isWritable: false },
         { pubkey: toBase58(p.namespace, "namespace"), isSigner: false, isWritable: true },
         { pubkey: toBase58(p.systemProgram ?? SYSTEM_PROGRAM_ID, "systemProgram"), isSigner: false, isWritable: false },
     ];

package/dist/base58.js

@@ -65,5 +65,13 @@ export function decodeBase58_32(s) {
         out[i] = Number(n & 255n);
         n >>= 8n;
     }
+    // W167: reject anything that isn't the canonical base58 of EXACTLY these 32
+    // bytes. Without this, a short valid-base58 string ("notakey") decodes to a
+    // small number and is silently LEFT-PADDED into a bogus 32-byte "address",
+    // so builders / sign-in / resolve / MCP prepare_register accept garbage as a
+    // pubkey. The round-trip also correctly accepts a real key with leading zero
+    // bytes (encodeBase58 re-emits its leading '1's).
+    if (encodeBase58(out) !== s)
+        return null;
     return out;
 }

package/dist/gate.js

@@ -15,6 +15,7 @@
  * attestor-signed `Attestation` account.
  */
 import { fetchAttestations, isHandleVerified, ATTESTATION_KIND_DNS, ATTESTATION_KIND_SOCIAL, ATTESTATION_KIND_X, ATTESTATION_KIND_DISCORD, ATTESTATION_KIND_GITHUB, ATTESTATION_KIND_TELEGRAM, } from "./attestation.js";
+import { ResolveError } from "./types.js";
 /** Named platform kinds, re-exported so callers gate without magic numbers. */
 export const GateKind = {
     dns: ATTESTATION_KIND_DNS,
@@ -29,7 +30,16 @@ export const GateKind = {
 export function attestationsPassGate(attestations, gate) {
     if (gate === "any-verified")
         return isHandleVerified(attestations);
-    const kinds = "kind" in gate ? [gate.kind] : gate.anyOf;
+    // W171: a malformed gate (null, a string other than "any-verified", or an
+    // object with neither `kind` nor `anyOf`) otherwise threw a raw
+    // `TypeError: Cannot use 'in' operator…`. Surface it as a typed ResolveError.
+    if (gate === null || typeof gate !== "object") {
+        throw new ResolveError("invalid-input", 'gate must be "any-verified", { kind } or { anyOf: [...] }', String(gate));
+    }
+    const kinds = "kind" in gate ? [gate.kind] : "anyOf" in gate ? gate.anyOf : null;
+    if (kinds === null) {
+        throw new ResolveError("invalid-input", "gate object needs a `kind` or `anyOf`", JSON.stringify(gate));
+    }
     return attestations.some((a) => !a.stale && !a.holderMismatch && kinds.includes(a.kind));
 }
 /** Fetch a handle's attestations and test the gate in one call. `handleAccount`,

package/dist/index.d.ts

@@ -42,6 +42,7 @@ export * from "./integrator.js";
 export * from "./voucher.js";
 export * from "./agent.js";
 export * from "./register.js";
+export * from "./transfer.js";
 export * from "./adminConfig.js";
 export * from "./lease.js";
 export * from "./accounts.js";

package/dist/index.js

@@ -42,6 +42,7 @@ export * from "./integrator.js";
 export * from "./voucher.js";
 export * from "./agent.js";
 export * from "./register.js";
+export * from "./transfer.js";
 export * from "./adminConfig.js";
 export * from "./lease.js";
 // Was previously imported here for internal use only, never re-exported —

package/dist/register.js

@@ -16,6 +16,7 @@
  * field this builder needs (the treasury address every registration pays).
  */
 import { encodeBase58, decodeBase58_32 } from "./base58.js";
+import { normalizeHandle } from "./parse.js";
 /** Anchor instruction discriminator: `sha256("global:register")[0..8]`. */
 export const REGISTER_DISCRIMINATOR = Uint8Array.from([
     211, 124, 67, 15, 211, 194, 178, 240,
@@ -73,6 +74,16 @@ export function buildRegisterIx(p) {
     if (!Number.isInteger(p.handleType) || p.handleType < 0 || p.handleType > 3) {
         throw new Error("handleType must be 0 (Human), 1 (Merchant), 2 (Org) or 3 (Agent)");
     }
+    // W171: the Handle PDA is derived from the CANONICAL name, so a non-canonical
+    // name (uppercase, surrounding space, …) builds an instruction the chain
+    // rejects with an opaque ConstraintSeeds (2006). normalizeHandle validates the
+    // grammar (ASCII, length, no leading/trailing/double hyphen, not all-digit)
+    // AND lowercases; require the caller to pass that canonical form so `handle`
+    // and the encoded name agree.
+    const canonical = normalizeHandle(p.name);
+    if (canonical !== p.name) {
+        throw new Error(`name must be the canonical handle "${canonical}" (got "${p.name}") — normalizeHandle() it and derive \`handle\` from the same value`);
+    }
     const nameBytes = new TextEncoder().encode(p.name);
     if (nameBytes.length < 1 || nameBytes.length > 32) {
         throw new Error("name must be 1..=32 bytes (UTF-8)");
@@ -123,6 +134,16 @@ export function buildRegisterReservedIx(p) {
     if (!Number.isInteger(p.handleType) || p.handleType < 0 || p.handleType > 3) {
         throw new Error("handleType must be 0 (Human), 1 (Merchant), 2 (Org) or 3 (Agent)");
     }
+    // W171: the Handle PDA is derived from the CANONICAL name, so a non-canonical
+    // name (uppercase, surrounding space, …) builds an instruction the chain
+    // rejects with an opaque ConstraintSeeds (2006). normalizeHandle validates the
+    // grammar (ASCII, length, no leading/trailing/double hyphen, not all-digit)
+    // AND lowercases; require the caller to pass that canonical form so `handle`
+    // and the encoded name agree.
+    const canonical = normalizeHandle(p.name);
+    if (canonical !== p.name) {
+        throw new Error(`name must be the canonical handle "${canonical}" (got "${p.name}") — normalizeHandle() it and derive \`handle\` from the same value`);
+    }
     const nameBytes = new TextEncoder().encode(p.name);
     if (nameBytes.length < 1 || nameBytes.length > 32) {
         throw new Error("name must be 1..=32 bytes (UTF-8)");
@@ -194,6 +215,16 @@ export function buildRegisterWithFortiIx(p) {
     if (!Number.isInteger(p.handleType) || p.handleType < 0 || p.handleType > 3) {
         throw new Error("handleType must be 0 (Human), 1 (Merchant), 2 (Org) or 3 (Agent)");
     }
+    // W171: the Handle PDA is derived from the CANONICAL name, so a non-canonical
+    // name (uppercase, surrounding space, …) builds an instruction the chain
+    // rejects with an opaque ConstraintSeeds (2006). normalizeHandle validates the
+    // grammar (ASCII, length, no leading/trailing/double hyphen, not all-digit)
+    // AND lowercases; require the caller to pass that canonical form so `handle`
+    // and the encoded name agree.
+    const canonical = normalizeHandle(p.name);
+    if (canonical !== p.name) {
+        throw new Error(`name must be the canonical handle "${canonical}" (got "${p.name}") — normalizeHandle() it and derive \`handle\` from the same value`);
+    }
     const nameBytes = new TextEncoder().encode(p.name);
     if (nameBytes.length < 1 || nameBytes.length > 32) {
         throw new Error("name must be 1..=32 bytes (UTF-8)");

package/dist/subname.js

@@ -173,6 +173,12 @@ export function buildCreateSubnameIx(p) {
     if (labelBytes.length === 0 || labelBytes.length > SUBNAME_LABEL_MAX_LEN) {
         throw new Error(`label must be 1..=${SUBNAME_LABEL_MAX_LEN} bytes`);
     }
+    // W171: a subname label follows handle-label grammar — a label like
+    // "Bad Label" (space, uppercase) otherwise builds and is only rejected on
+    // chain. Lowercase a-z / 0-9 with interior single hyphens only.
+    if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(p.label) || p.label.includes("--")) {
+        throw new Error("label must be lowercase a-z, 0-9 and interior single hyphens only (no spaces, uppercase, or leading/trailing/double hyphen)");
+    }
     const encLabel = encVec(labelBytes);
     const data = new Uint8Array(8 + encLabel.length);
     data.set(CREATE_SUBNAME_DISCRIMINATOR, 0);

package/dist/textRecords.js

@@ -297,6 +297,13 @@ function checkKey(key) {
     if (bytes.length === 0 || bytes.length > TEXT_KEY_MAX_LEN) {
         throw new Error(`key must be 1..=${TEXT_KEY_MAX_LEN} bytes of UTF-8`);
     }
+    // W171: reject keys with spaces / control chars / non-ASCII — a key like
+    // "BAD KEY!" otherwise builds and only fails loosely downstream. Record keys
+    // are dotted identifiers (e.g. "agent.manifest", "com.twitter"): visible
+    // ASCII, no whitespace.
+    if (!/^[\x21-\x7e]+$/.test(key)) {
+        throw new Error('key must be visible ASCII with no spaces (e.g. "agent.manifest")');
+    }
     return bytes;
 }
 function checkValue(value) {

package/dist/transfer.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `transfer` — hand an UNTOKENIZED handle to a new owner (a direct gift /
+ * reassignment of `handle.owner`). This is the plain-handle counterpart to a
+ * tokenized handle's pNFT transfer: a tokenized handle's ownership IS its NFT,
+ * so the program REFUSES `transfer` on one (`HandleIsTokenized`) — move the
+ * pNFT instead (see `pnftTransfer.ts`).
+ *
+ * Signed by the handle's CURRENT owner (`has_one = owner` on-chain). The
+ * program also refuses the move if the handle is locked (`require_unlocked`)
+ * or a live auction on it still has bids. It is NOT gated by the registry
+ * pause, so a treasury gift can be made even while registration is paused.
+ *
+ * Hand-rolled like the rest of this package — no Anchor client, no web3.js.
+ * PDAs are NOT derived here (see delegate.ts's module docs); derive
+ * `["handle", name]` and `["auction", handle]` with your runtime's canonical
+ * `findProgramAddress` and pass them in.
+ */
+import type { AddressLike, BuiltInstruction } from "./delegate.js";
+/** Anchor instruction discriminator: `sha256("global:transfer")[0..8]`. */
+export declare const TRANSFER_DISCRIMINATOR: Uint8Array;
+export interface TransferParams {
+    /** The registry program id. */
+    readonly programId: AddressLike;
+    /** The handle's CURRENT owner — must equal `handle.owner` on-chain. Signer. */
+    readonly owner: AddressLike;
+    /** The `["handle", name]` (or scoped `["handle", label, name]`) PDA. Must be
+     *  UNTOKENIZED; a tokenized handle is moved by transferring its pNFT. */
+    readonly handle: AddressLike;
+    /** The `["auction", handle]` PDA — read-only; the program reads it only to
+     *  refuse a transfer while a live auction still has bids. Pass the derived
+     *  address even if no auction account exists there. */
+    readonly auction: AddressLike;
+    /** The address to hand the handle to. */
+    readonly newOwner: AddressLike;
+    /** Scoped (under-TLD) handles only: the account(s) `verify_handle_pda` needs
+     *  to re-derive `["handle", label, name]`. Omit for a bare `@handle`. */
+    readonly remainingAccounts?: readonly AddressLike[];
+}
+/**
+ * Build `transfer(new_owner)`. The data is the 8-byte discriminator followed by
+ * the 32-byte new owner; the accounts are `owner` (signer), `handle` (writable)
+ * and the read-only `["auction", handle]` PDA, plus any scoped-TLD
+ * remaining-accounts. Returns an UNSIGNED instruction — sign with `owner`.
+ */
+export declare function buildTransferIx(p: TransferParams): BuiltInstruction;

package/dist/transfer.js

@@ -0,0 +1,56 @@
+/**
+ * `transfer` — hand an UNTOKENIZED handle to a new owner (a direct gift /
+ * reassignment of `handle.owner`). This is the plain-handle counterpart to a
+ * tokenized handle's pNFT transfer: a tokenized handle's ownership IS its NFT,
+ * so the program REFUSES `transfer` on one (`HandleIsTokenized`) — move the
+ * pNFT instead (see `pnftTransfer.ts`).
+ *
+ * Signed by the handle's CURRENT owner (`has_one = owner` on-chain). The
+ * program also refuses the move if the handle is locked (`require_unlocked`)
+ * or a live auction on it still has bids. It is NOT gated by the registry
+ * pause, so a treasury gift can be made even while registration is paused.
+ *
+ * Hand-rolled like the rest of this package — no Anchor client, no web3.js.
+ * PDAs are NOT derived here (see delegate.ts's module docs); derive
+ * `["handle", name]` and `["auction", handle]` with your runtime's canonical
+ * `findProgramAddress` and pass them in.
+ */
+import { encodeBase58, decodeBase58_32 } from "./base58.js";
+/** Anchor instruction discriminator: `sha256("global:transfer")[0..8]`. */
+export const TRANSFER_DISCRIMINATOR = Uint8Array.from([
+    0xa3, 0x34, 0xc8, 0xe7, 0x8c, 0x03, 0x45, 0xba,
+]);
+function toBytes32(v, what) {
+    if (typeof v === "string") {
+        const b = decodeBase58_32(v);
+        if (!b)
+            throw new Error(`${what} is not a valid base58 address`);
+        return b;
+    }
+    if (v.length !== 32)
+        throw new Error(`${what} must be exactly 32 bytes`);
+    return v;
+}
+function toBase58(v, what) {
+    return encodeBase58(toBytes32(v, what));
+}
+/**
+ * Build `transfer(new_owner)`. The data is the 8-byte discriminator followed by
+ * the 32-byte new owner; the accounts are `owner` (signer), `handle` (writable)
+ * and the read-only `["auction", handle]` PDA, plus any scoped-TLD
+ * remaining-accounts. Returns an UNSIGNED instruction — sign with `owner`.
+ */
+export function buildTransferIx(p) {
+    const data = new Uint8Array(8 + 32);
+    data.set(TRANSFER_DISCRIMINATOR, 0);
+    data.set(toBytes32(p.newOwner, "newOwner"), 8);
+    const keys = [
+        { pubkey: toBase58(p.owner, "owner"), isSigner: true, isWritable: false },
+        { pubkey: toBase58(p.handle, "handle"), isSigner: false, isWritable: true },
+        { pubkey: toBase58(p.auction, "auction"), isSigner: false, isWritable: false },
+    ];
+    for (const a of p.remainingAccounts ?? []) {
+        keys.push({ pubkey: toBase58(a, "remainingAccount"), isSigner: false, isWritable: false });
+    }
+    return { programId: toBase58(p.programId, "programId"), keys, data };
+}

package/dist/types.d.ts

@@ -94,6 +94,10 @@ export interface Resolved {
 export type Chain = "X1" | "SOL" | "ETH" | "BTC";
 export declare const CHAIN_COIN_TYPE: Readonly<Record<Chain, number>>;
 export type ResolveErrorCode = "unrecognized" | "ambiguous" | "invalid-handle" | "invalid-domain" | "not-found" | "no-record-for-chain" | "rpc-error"
+/** A caller passed a malformed value to an SDK primitive (e.g. a gate that
+ *  isn't "any-verified"/{kind}/{anyOf}) — a programming error, surfaced as a
+ *  typed ResolveError rather than a raw TypeError. */
+ | "invalid-input"
 /**
  * A reachable namespace exists for this name, but the adapter that would
  * resolve it is not configured on this deployment (e.g. no `ETH_RPC_URL` for

package/dist/x402.js

@@ -60,6 +60,14 @@ export const X402_VERSION = 2;
  * and let the buyer fetch their own — the spec allows either).
  */
 export function buildX402Requirements(p) {
+    // W171: payTo / asset / buyer are REQUIRED base58 pubkeys — a missing one
+    // otherwise sails through (payTo: undefined) straight into the requirements.
+    const PUBKEY_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+    for (const [field, value] of [["payTo", p.payTo], ["asset", p.asset], ["buyer", p.buyer]]) {
+        if (!PUBKEY_RE.test((value ?? "").trim())) {
+            throw new Error(`${field} must be a base58 address (32-44 chars); got ${value === undefined ? "undefined" : `"${value}"`}`);
+        }
+    }
     if (!/^\d+$/.test(p.amount)) {
         throw new Error("amount must be a decimal string of smallest units (e.g. \"1000000\")");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@x1id/resolve",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Resolve @handles and X1NS names on X1. Never silently picks between namespaces.",
   "type": "module",
   "main": "./dist/index.js",