@x1id/resolve 0.19.1 → 0.21.0

package/dist/transfer.js

@@ -0,0 +1,56 @@
+/**
+ * `transfer` — hand an UNTOKENIZED handle to a new owner (a direct gift /
+ * reassignment of `handle.owner`). This is the plain-handle counterpart to a
+ * tokenized handle's pNFT transfer: a tokenized handle's ownership IS its NFT,
+ * so the program REFUSES `transfer` on one (`HandleIsTokenized`) — move the
+ * pNFT instead (see `pnftTransfer.ts`).
+ *
+ * Signed by the handle's CURRENT owner (`has_one = owner` on-chain). The
+ * program also refuses the move if the handle is locked (`require_unlocked`)
+ * or a live auction on it still has bids. It is NOT gated by the registry
+ * pause, so a treasury gift can be made even while registration is paused.
+ *
+ * Hand-rolled like the rest of this package — no Anchor client, no web3.js.
+ * PDAs are NOT derived here (see delegate.ts's module docs); derive
+ * `["handle", name]` and `["auction", handle]` with your runtime's canonical
+ * `findProgramAddress` and pass them in.
+ */
+import { encodeBase58, decodeBase58_32 } from "./base58.js";
+/** Anchor instruction discriminator: `sha256("global:transfer")[0..8]`. */
+export const TRANSFER_DISCRIMINATOR = Uint8Array.from([
+    0xa3, 0x34, 0xc8, 0xe7, 0x8c, 0x03, 0x45, 0xba,
+]);
+function toBytes32(v, what) {
+    if (typeof v === "string") {
+        const b = decodeBase58_32(v);
+        if (!b)
+            throw new Error(`${what} is not a valid base58 address`);
+        return b;
+    }
+    if (v.length !== 32)
+        throw new Error(`${what} must be exactly 32 bytes`);
+    return v;
+}
+function toBase58(v, what) {
+    return encodeBase58(toBytes32(v, what));
+}
+/**
+ * Build `transfer(new_owner)`. The data is the 8-byte discriminator followed by
+ * the 32-byte new owner; the accounts are `owner` (signer), `handle` (writable)
+ * and the read-only `["auction", handle]` PDA, plus any scoped-TLD
+ * remaining-accounts. Returns an UNSIGNED instruction — sign with `owner`.
+ */
+export function buildTransferIx(p) {
+    const data = new Uint8Array(8 + 32);
+    data.set(TRANSFER_DISCRIMINATOR, 0);
+    data.set(toBytes32(p.newOwner, "newOwner"), 8);
+    const keys = [
+        { pubkey: toBase58(p.owner, "owner"), isSigner: true, isWritable: false },
+        { pubkey: toBase58(p.handle, "handle"), isSigner: false, isWritable: true },
+        { pubkey: toBase58(p.auction, "auction"), isSigner: false, isWritable: false },
+    ];
+    for (const a of p.remainingAccounts ?? []) {
+        keys.push({ pubkey: toBase58(a, "remainingAccount"), isSigner: false, isWritable: false });
+    }
+    return { programId: toBase58(p.programId, "programId"), keys, data };
+}

package/dist/types.d.ts

@@ -94,6 +94,10 @@ export interface Resolved {
 export type Chain = "X1" | "SOL" | "ETH" | "BTC";
 export declare const CHAIN_COIN_TYPE: Readonly<Record<Chain, number>>;
 export type ResolveErrorCode = "unrecognized" | "ambiguous" | "invalid-handle" | "invalid-domain" | "not-found" | "no-record-for-chain" | "rpc-error"
+/** A caller passed a malformed value to an SDK primitive (e.g. a gate that
+ *  isn't "any-verified"/{kind}/{anyOf}) — a programming error, surfaced as a
+ *  typed ResolveError rather than a raw TypeError. */
+ | "invalid-input"
 /**
  * A reachable namespace exists for this name, but the adapter that would
  * resolve it is not configured on this deployment (e.g. no `ETH_RPC_URL` for

package/dist/voucher.d.ts

@@ -22,8 +22,8 @@
  *   escrows the mint price (a snapshot of the live price) into
  *   `["voucher", name]` and reserves the voucher slot. `recipient` bound ⇒ the
  *   claim registers the handle to that wallet no matter who submits; `null` ⇒
- *   open-code (the claimer owns it) and `claimSecretHash` (= `sha256(secret)`)
- *   is REQUIRED (M72) — the claimer must present the matching `secret`. An optional integrator referrer (the same trailing accounts as
+ *   a bound recipient (audit S6 — open/recipient-less vouchers were removed as
+ *   front-runnable; `claimSecretHash` is vestigial and rejected). An optional integrator referrer (the same trailing accounts as
  *   `register`, from `integrator.ts`) is snapshotted so the claim can split
  *   the escrow. `expiresAt` must be strictly in the future.
  * - `claim_voucher(name)` registers the handle, drawing the fee from the

package/dist/voucher.js

@@ -22,8 +22,8 @@
  *   escrows the mint price (a snapshot of the live price) into
  *   `["voucher", name]` and reserves the voucher slot. `recipient` bound ⇒ the
  *   claim registers the handle to that wallet no matter who submits; `null` ⇒
- *   open-code (the claimer owns it) and `claimSecretHash` (= `sha256(secret)`)
- *   is REQUIRED (M72) — the claimer must present the matching `secret`. An optional integrator referrer (the same trailing accounts as
+ *   a bound recipient (audit S6 — open/recipient-less vouchers were removed as
+ *   front-runnable; `claimSecretHash` is vestigial and rejected). An optional integrator referrer (the same trailing accounts as
  *   `register`, from `integrator.ts`) is snapshotted so the claim can split
  *   the escrow. `expiresAt` must be strictly in the future.
  * - `claim_voucher(name)` registers the handle, drawing the fee from the
@@ -171,8 +171,19 @@ export function decodePrepaidVoucher(data) {
 export function buildCreateVoucherIx(p) {
     const name = encString(p.name);
     const recipient = p.recipient ?? null;
+    // Audit S6: the program now REFUSES a recipient-less voucher (the claim tx
+    // reveals the secret in cleartext, so an open voucher is front-runnable —
+    // error 6106 VoucherMustBeBound). `claimSecretHash` is NO LONGER a second
+    // factor: with a recipient mandatory the program stores None and ignores any
+    // hash. Throw on both so no integrator believes either still works.
+    if (recipient === null) {
+        throw new Error("a voucher must bind its recipient (open secret-code vouchers are front-runnable and were disabled on-chain)");
+    }
+    if (p.claimSecretHash != null) {
+        throw new Error("claimSecretHash is removed — vouchers are recipient-bound and carry no claim secret (the program ignores it)");
+    }
     const recBytes = recipient === null ? Uint8Array.from([0]) : Uint8Array.from([1, ...toBytes32(recipient, "recipient")]);
-    const hashBytes = encOption32(p.claimSecretHash ?? null);
+    const hashBytes = encOption32(null); // S6: always None (a supplied hash throws above)
     const data = new Uint8Array(8 + name.length + 1 + recBytes.length + 8 + hashBytes.length);
     let o = 0;
     data.set(CREATE_VOUCHER_DISCRIMINATOR, o);

package/dist/x402.js

@@ -60,6 +60,14 @@ export const X402_VERSION = 2;
  * and let the buyer fetch their own — the spec allows either).
  */
 export function buildX402Requirements(p) {
+    // W171: payTo / asset / buyer are REQUIRED base58 pubkeys — a missing one
+    // otherwise sails through (payTo: undefined) straight into the requirements.
+    const PUBKEY_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+    for (const [field, value] of [["payTo", p.payTo], ["asset", p.asset], ["buyer", p.buyer]]) {
+        if (!PUBKEY_RE.test((value ?? "").trim())) {
+            throw new Error(`${field} must be a base58 address (32-44 chars); got ${value === undefined ? "undefined" : `"${value}"`}`);
+        }
+    }
     if (!/^\d+$/.test(p.amount)) {
         throw new Error("amount must be a decimal string of smallest units (e.g. \"1000000\")");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@x1id/resolve",
-  "version": "0.19.1",
+  "version": "0.21.0",
   "description": "Resolve @handles and X1NS names on X1. Never silently picks between namespaces.",
   "type": "module",
   "main": "./dist/index.js",