@x1id/resolve 0.19.2 → 0.22.0

package/README.md

@@ -605,8 +605,10 @@ const requirements = buildX402Requirements({
   buyer: buyerAddress, // x1id v1 is self-sponsored: buyer pays their own fee, no facilitator
   network: X1_MAINNET_NETWORK, // defaults to mainnet; a server on another cluster
                                // should pass x402NetworkForGenesis(await getGenesisHash)
-  memo: "invoice-42",
+  reference: invoiceReference, // a unique base58 reference per invoice (the payment carries it)
 });
+// Buyer side for api.x1id.io: sign x402RedeemMessage(reference) with the paying
+// wallet and send it as payload.payerSig next to payload.signature.
 ```
 
 This package only builds the requirements object — it does not build, sign,
@@ -620,6 +622,86 @@ of this zero-dependency package). Use the MCP server's `prepare_x402_payment`
 > `confirmed` gets a `402 "payment not yet confirmed; finalize it and retry"`.
 > Poll the signature to `finalized` before the retry.
 
+## Sign in with Solana
+
+Sign a user in with any [Wallet Standard](https://github.com/wallet-standard/wallet-standard)
+wallet that implements `solana:signIn` (SIWS), against the hosted X1ID Connect
+API. You get back a Bearer session proving **wallet control**; the wallet's
+primary `@handle`, if it has one, comes along as metadata.
+
+```ts
+import { signInWithSolana, SiwsError } from "@x1id/resolve";
+
+try {
+  const session = await signInWithSolana({
+    wallet,                 // a Wallet Standard wallet object (e.g. from getWallets().get())
+    apiKey: "x1id_…",       // your integrator key from developers.x1id.io
+    // domain defaults to location.host. It must be on your deployment's SIWS allowlist.
+    statement: "Sign in to Example.",
+  });
+  // session.token (send as `Authorization: Bearer …`), session.address, session.handle
+} catch (e) {
+  if (e instanceof SiwsError) {
+    // e.code: "wallet-unsupported" | "user-rejected" | "domain-not-allowed"
+    //       | "nonce-expired" | "invalid-params" | "wallet-timeout" | "wallet-error" | "network" | "api-error"
+  }
+}
+```
+
+### With fallbacks: `signInWithWallet`
+
+Some wallets lack `solana:signIn` or implement it badly, and a Ledger refuses
+message signing. `signInWithWallet` takes the same arguments and tries, in the
+developers.x1id.io order:
+
+1. SIWS (`solana:signIn`);
+2. a signed, **never-sent** memo transaction (`solana:signTransaction`) whose
+   only instruction is an SPL-Memo carrying the server's
+   `x1id-verify:<audience>:<nonce>`;
+3. `solana:signMessage` over the server's
+   `x1id-connect:v2:wallet-control:<audience>:<address>:<nonce>`.
+
+```ts
+import { signInWithWallet, X1ID_MAINNET_SIGNIN_FEE_PAYER } from "@x1id/resolve";
+
+const { method, ...session } = await signInWithWallet({
+  wallet,
+  apiKey: "x1id_…",
+  rpcUrl: "https://rpc.mainnet.x1.xyz",           // optional: recent blockhash for the memo tx
+  signinFeePayer: X1ID_MAINNET_SIGNIN_FEE_PAYER,   // optional: no-fee layout (api.x1id.io mainnet)
+});
+```
+
+A user rejection or a wallet timeout stops the chain, so the user is never
+prompted twice after saying no. The audience (your key id) is part of every
+signed string, and the SDK signs the server's strings verbatim. It refuses to
+sign a memo or challenge that is not bound to an audience. Without
+`signinFeePayer` the user is the memo transaction's fee payer, which every
+deployment accepts. The transaction is never sent either way. Outside a
+browser, pass `domain` or set `methods: ["memo-tx", "sign-message"]`.
+
+The steps are also exported on their own, for wallets you drive yourself:
+
+| function | does |
+|---|---|
+| `requestSignInChallenge({ apiKey, wallet, apiBase? })` | `POST /v1/auth/challenge {wallet, mode:"signin"}` → `{ nonce, expires_at, … }` |
+| `buildSignInInput({ domain?, address, nonce, statement?, uri?, issuedAt? })` | the `solana:signIn` input: domain, address, statement, uri, version `"1"`, nonce, issuedAt |
+| `verifySolanaSignIn({ apiKey, nonce, signedMessage, signature, apiBase? })` | `POST /v1/auth/verify-signin` (signed bytes as base64, signature as base58) → session |
+| `buildSignInMessageText(input)` | the SIWS message text a wallet renders from that input |
+| `requestConnectChallenge({ apiKey, wallet, mode? })` | challenge for `"signin"`, `"tx"` (adds `memo`), or signMessage (no mode) |
+| `buildSignInMemoTransaction({ user, memo, blockhash?, feePayer? })` | the unsigned memo-only legacy transaction (no web3.js) |
+| `verifySignInTransaction({ apiKey, nonce, signedTransaction })` | `POST /v1/auth/verify-tx` |
+| `verifySignInMessage({ apiKey, nonce, signature, signer })` | `POST /v1/auth/verify` |
+
+The server checks that line 1 is `<domain> wants you to sign in with your Solana account:`
+with an allowed domain, that line 2 is the challenged wallet, that a `Nonce:` line
+carries the single-use challenge nonce, and the ed25519 signature (raw bytes or
+the SIMD-0048 off-chain envelope). A nonce is single-use and expires, so on
+`nonce-expired` call `signInWithSolana` again.
+
+This is the hosted-session flow. For a server-less proof your own backend
+verifies, see `signInWithX1ID` in [SIGNIN.md](./SIGNIN.md).
+
 ## Errors
 
 `ResolveError` carries a `code` a UI can branch on:

package/dist/adminConfig.d.ts

@@ -44,6 +44,18 @@ export declare const SET_LEASE_GRACE_PERIOD_DISCRIMINATOR: Uint8Array;
 export declare const SET_RECOVERY_TIMELOCK_DISCRIMINATOR: Uint8Array;
 export declare const SET_MIN_COMMITMENT_AGE_DISCRIMINATOR: Uint8Array;
 export declare const SET_MAX_COMMITMENT_AGE_DISCRIMINATOR: Uint8Array;
+/** `sha256("global:set_namespace_creation_fee")[0..8]` — sets
+ *  `Config.namespace_creation_fee_lamports` (u64, the permissionless
+ *  `create_namespace` TLD creation fee paid to treasury). */
+export declare const SET_NAMESPACE_CREATION_FEE_DISCRIMINATOR: Uint8Array;
+/** Byte offset of `Config.namespace_creation_fee_lamports` (u64 LE) in the
+ *  Config account data, including the 8-byte Anchor discriminator — mirrors
+ *  `Config::NAMESPACE_CREATION_FEE_LAMPORTS_OFFSET` (state.rs). */
+export declare const NAMESPACE_CREATION_FEE_LAMPORTS_OFFSET = 436;
+/** Decode `Config.namespace_creation_fee_lamports` from raw Config account
+ *  data. Returns null for a Config too short to carry the field (pre-v6
+ *  layout) — never a guessed default. */
+export declare function decodeNamespaceCreationFeeLamports(configData: Uint8Array): bigint | null;
 /** Map an admin config action name → its discriminator (for a relay executor
  *  that dispatches on the action string). set_admin/set_attestor intentionally
  *  absent — those are owner-gated, never dispatched here. */
@@ -54,10 +66,12 @@ export interface AdminScalarParams {
     readonly config: AddressLike;
     /** The discriminator for the specific setter (from ADMIN_SCALAR_DISCRIMINATORS). */
     readonly discriminator: Uint8Array;
-    /** The integer arg (u64/i64 encoding is identical for a non-negative value). */
-    readonly value: number | bigint;
+    /** The integer arg (u64/i64 encoding is identical for a non-negative value).
+     *  A string must be plain decimal digits (lamports amounts beyond JS's safe
+     *  integer range arrive from the admin queue as decimal strings). */
+    readonly value: number | bigint | string;
 }
 /** Build any one-integer-arg AdminOnly setter (lease rate divisor, lease grace,
- *  recovery timelock, min/max commitment age). disc(8) + value as little-endian
+ *  recovery timelock, min/max commitment age, namespace creation fee). disc(8) + value as little-endian
  *  u64(8). The value must be a non-negative integer that fits u64. */
 export declare function buildAdminScalarSetterIx(p: AdminScalarParams): BuiltInstruction;

package/dist/adminConfig.js

@@ -84,6 +84,22 @@ export const SET_LEASE_GRACE_PERIOD_DISCRIMINATOR = Uint8Array.from([212, 2, 110
 export const SET_RECOVERY_TIMELOCK_DISCRIMINATOR = Uint8Array.from([178, 183, 148, 243, 155, 166, 79, 6]);
 export const SET_MIN_COMMITMENT_AGE_DISCRIMINATOR = Uint8Array.from([181, 20, 114, 43, 51, 23, 47, 248]);
 export const SET_MAX_COMMITMENT_AGE_DISCRIMINATOR = Uint8Array.from([163, 106, 196, 206, 146, 156, 79, 249]);
+/** `sha256("global:set_namespace_creation_fee")[0..8]` — sets
+ *  `Config.namespace_creation_fee_lamports` (u64, the permissionless
+ *  `create_namespace` TLD creation fee paid to treasury). */
+export const SET_NAMESPACE_CREATION_FEE_DISCRIMINATOR = Uint8Array.from([158, 152, 239, 141, 143, 5, 75, 198]);
+/** Byte offset of `Config.namespace_creation_fee_lamports` (u64 LE) in the
+ *  Config account data, including the 8-byte Anchor discriminator — mirrors
+ *  `Config::NAMESPACE_CREATION_FEE_LAMPORTS_OFFSET` (state.rs). */
+export const NAMESPACE_CREATION_FEE_LAMPORTS_OFFSET = 436;
+/** Decode `Config.namespace_creation_fee_lamports` from raw Config account
+ *  data. Returns null for a Config too short to carry the field (pre-v6
+ *  layout) — never a guessed default. */
+export function decodeNamespaceCreationFeeLamports(configData) {
+    if (configData.length < NAMESPACE_CREATION_FEE_LAMPORTS_OFFSET + 8)
+        return null;
+    return new DataView(configData.buffer, configData.byteOffset, configData.byteLength).getBigUint64(NAMESPACE_CREATION_FEE_LAMPORTS_OFFSET, true);
+}
 /** Map an admin config action name → its discriminator (for a relay executor
  *  that dispatches on the action string). set_admin/set_attestor intentionally
  *  absent — those are owner-gated, never dispatched here. */
@@ -93,11 +109,18 @@ export const ADMIN_SCALAR_DISCRIMINATORS = {
     set_recovery_timelock: SET_RECOVERY_TIMELOCK_DISCRIMINATOR,
     set_min_commitment_age: SET_MIN_COMMITMENT_AGE_DISCRIMINATOR,
     set_max_commitment_age: SET_MAX_COMMITMENT_AGE_DISCRIMINATOR,
+    set_namespace_creation_fee: SET_NAMESPACE_CREATION_FEE_DISCRIMINATOR,
 };
 /** Build any one-integer-arg AdminOnly setter (lease rate divisor, lease grace,
- *  recovery timelock, min/max commitment age). disc(8) + value as little-endian
+ *  recovery timelock, min/max commitment age, namespace creation fee). disc(8) + value as little-endian
  *  u64(8). The value must be a non-negative integer that fits u64. */
 export function buildAdminScalarSetterIx(p) {
+    if (typeof p.value === "string" && !/^\d{1,20}$/.test(p.value)) {
+        throw new Error(`value ${JSON.stringify(p.value)} is not a non-negative decimal integer`);
+    }
+    if (typeof p.value === "number" && !Number.isSafeInteger(p.value)) {
+        throw new Error(`value ${p.value} is not a safe integer`);
+    }
     const raw = typeof p.value === "bigint" ? p.value : BigInt(p.value);
     if (raw < 0n || raw > 0xffffffffffffffffn) {
         throw new Error(`value ${p.value} is out of u64 range`);

package/dist/connect.d.ts

@@ -13,7 +13,7 @@
  *
  * So this flow proves wallet control a different, robust way: the wallet signs a
  * throwaway MEMO TRANSACTION — one SPL-Memo instruction carrying
- * `x1id-verify:<nonce>`, fee-paid by the wallet, never broadcast. The hosted
+ * `x1id-verify:<audience>:<nonce>`, fee-paid by the wallet, never broadcast. The hosted
  * `POST /v1/auth/verify-tx` endpoint deserializes the signed artifact, asserts
  * it is EXACTLY that memo (no disguised transfer/approval), that the fee payer
  * is the wallet, that the memo binds our single-use nonce, and verifies the
@@ -33,13 +33,19 @@
  * free of a hard web3 dependency and tests can supply a fake.
  */
 /** Memo prefix the verify-tx proof binds to. The signed memo instruction's
- *  UTF-8 data MUST be EXACTLY `x1id-verify:<nonce>` — the server rejects any
- *  other data, which is what kills replay of an unrelated signed transaction. */
+ *  UTF-8 data MUST be EXACTLY `x1id-verify:<audience>:<nonce>` — the server
+ *  rejects any other data, which is what kills replay of an unrelated signed
+ *  transaction. The AUDIENCE (your API key id, or developers.x1id.io for the
+ *  Developer Portal) is returned by the challenge as `audience` and binds the
+ *  signature to the application it was made for (R3-L2P-1); the hosted API no
+ *  longer accepts the unbound `x1id-verify:<nonce>`. */
 export declare const VERIFY_TX_MEMO_PREFIX: "x1id-verify:";
 /** Canonical SPL Memo program id — the program the challenge memo rides on. */
 export declare const MEMO_PROGRAM_ID: "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr";
-/** The exact memo string for a given challenge nonce. */
-export declare function verifyTxMemo(nonce: string): string;
+/** The exact memo string for a challenge nonce and its audience. Without an
+ *  audience this is the legacy unbound form, which the current hosted API
+ *  REJECTS — always pass the challenge's `audience` (or use its `memo`). */
+export declare function verifyTxMemo(nonce: string, audience?: string): string;
 /** The slice of a web3.js `PublicKey` used here. */
 export interface PublicKeyInstance {
     toBytes(): Uint8Array;
@@ -87,10 +93,14 @@ export declare const PLACEHOLDER_BLOCKHASH: "11111111111111111111111111111111";
 export interface BuildVerifyTxChallengeParams {
     /** The single-use nonce from the tx-mode challenge. */
     readonly nonce: string;
-    /** The memo the server returned (`x1id-verify:<nonce>`). Optional — derived
-     *  from `nonce` when omitted; when supplied it MUST equal that, or the build
+    /** The memo the server returned (`x1id-verify:<audience>:<nonce>`) —
+     *  RECOMMENDED: pass it verbatim. When omitted it is derived from `nonce` +
+     *  `audience`. When supplied it MUST be an `x1id-verify:` memo for THIS
+     *  nonce (and, if `audience` is given, for that audience), or the build
      *  throws (catches a client that paired the wrong nonce/memo). */
     readonly memo?: string;
+    /** The challenge's `audience` (R3-L2P-1). */
+    readonly audience?: string;
     /** The signing wallet, base58 — becomes the fee payer AND the memo signer. */
     readonly feePayer: string;
     /** A recent blockhash. Defaults to {@link PLACEHOLDER_BLOCKHASH} (the tx is
@@ -101,7 +111,7 @@ export interface BuildVerifyTxChallengeParams {
  * Build the memo-only challenge transaction the wallet signs for verify-tx.
  *
  * The result is a legacy `Transaction` with EXACTLY one instruction: an SPL-Memo
- * instruction whose data is the UTF-8 bytes of `x1id-verify:<nonce>`, with the
+ * instruction whose data is the UTF-8 bytes of `x1id-verify:<audience>:<nonce>`, with the
  * fee payer listed as a required signer on that instruction. Nothing else — no
  * transfer, no compute-budget, no durable nonce — so the signed artifact can
  * only ever be a sign-in proof, never a disguised value-moving transaction. The
@@ -136,6 +146,8 @@ export interface ConnectSession {
 export interface TxChallenge {
     readonly nonce: string;
     readonly memo: string;
+    /** The audience the memo names (R3-L2P-1); absent from older deployments. */
+    readonly audience?: string;
     readonly handle: string | null;
     readonly expires_at: number;
 }

package/dist/connect.js

@@ -13,7 +13,7 @@
  *
  * So this flow proves wallet control a different, robust way: the wallet signs a
  * throwaway MEMO TRANSACTION — one SPL-Memo instruction carrying
- * `x1id-verify:<nonce>`, fee-paid by the wallet, never broadcast. The hosted
+ * `x1id-verify:<audience>:<nonce>`, fee-paid by the wallet, never broadcast. The hosted
  * `POST /v1/auth/verify-tx` endpoint deserializes the signed artifact, asserts
  * it is EXACTLY that memo (no disguised transfer/approval), that the fee payer
  * is the wallet, that the memo binds our single-use nonce, and verifies the
@@ -33,14 +33,26 @@
  * free of a hard web3 dependency and tests can supply a fake.
  */
 /** Memo prefix the verify-tx proof binds to. The signed memo instruction's
- *  UTF-8 data MUST be EXACTLY `x1id-verify:<nonce>` — the server rejects any
- *  other data, which is what kills replay of an unrelated signed transaction. */
+ *  UTF-8 data MUST be EXACTLY `x1id-verify:<audience>:<nonce>` — the server
+ *  rejects any other data, which is what kills replay of an unrelated signed
+ *  transaction. The AUDIENCE (your API key id, or developers.x1id.io for the
+ *  Developer Portal) is returned by the challenge as `audience` and binds the
+ *  signature to the application it was made for (R3-L2P-1); the hosted API no
+ *  longer accepts the unbound `x1id-verify:<nonce>`. */
 export const VERIFY_TX_MEMO_PREFIX = "x1id-verify:";
 /** Canonical SPL Memo program id — the program the challenge memo rides on. */
 export const MEMO_PROGRAM_ID = "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr";
-/** The exact memo string for a given challenge nonce. */
-export function verifyTxMemo(nonce) {
-    return VERIFY_TX_MEMO_PREFIX + nonce;
+/** An audience: a key id (16 base64url chars) or a bare DNS name. */
+const AUDIENCE_RE = /^[A-Za-z0-9._-]{1,253}$/;
+/** The exact memo string for a challenge nonce and its audience. Without an
+ *  audience this is the legacy unbound form, which the current hosted API
+ *  REJECTS — always pass the challenge's `audience` (or use its `memo`). */
+export function verifyTxMemo(nonce, audience) {
+    if (audience === undefined)
+        return VERIFY_TX_MEMO_PREFIX + nonce;
+    if (!AUDIENCE_RE.test(audience))
+        throw new Error(`invalid audience "${audience}"`);
+    return `${VERIFY_TX_MEMO_PREFIX}${audience}:${nonce}`;
 }
 /** 32 zero-bytes in base58 — a structurally valid blockhash. The transaction is
  *  NEVER broadcast, so a placeholder blockhash is fine; a wallet that insists on
@@ -50,7 +62,7 @@ export const PLACEHOLDER_BLOCKHASH = "11111111111111111111111111111111";
  * Build the memo-only challenge transaction the wallet signs for verify-tx.
  *
  * The result is a legacy `Transaction` with EXACTLY one instruction: an SPL-Memo
- * instruction whose data is the UTF-8 bytes of `x1id-verify:<nonce>`, with the
+ * instruction whose data is the UTF-8 bytes of `x1id-verify:<audience>:<nonce>`, with the
  * fee payer listed as a required signer on that instruction. Nothing else — no
  * transfer, no compute-budget, no durable nonce — so the signed artifact can
  * only ever be a sign-in proof, never a disguised value-moving transaction. The
@@ -62,9 +74,20 @@ export function buildVerifyTxChallenge(web3, params) {
         throw new Error("nonce is required");
     if (typeof feePayer !== "string" || feePayer.length === 0)
         throw new Error("feePayer is required");
-    const memo = params.memo ?? verifyTxMemo(nonce);
-    if (memo !== verifyTxMemo(nonce)) {
-        throw new Error(`memo must be exactly "${verifyTxMemo(nonce)}" for this nonce`);
+    const memo = params.memo ?? verifyTxMemo(nonce, params.audience);
+    if (params.audience !== undefined) {
+        const want = verifyTxMemo(nonce, params.audience);
+        if (memo !== want)
+            throw new Error(`memo must be exactly "${want}" for this nonce`);
+    }
+    else {
+        // No audience given: accept the server's audience-bound memo for this
+        // nonce, or the legacy unbound form (older deployments).
+        const rest = memo.startsWith(VERIFY_TX_MEMO_PREFIX) ? memo.slice(VERIFY_TX_MEMO_PREFIX.length) : null;
+        const aud = rest !== null && rest.endsWith(`:${nonce}`) ? rest.slice(0, -(nonce.length + 1)) : null;
+        if (rest !== nonce && !(aud !== null && AUDIENCE_RE.test(aud))) {
+            throw new Error(`memo must be "${VERIFY_TX_MEMO_PREFIX}<audience>:${nonce}" for this nonce`);
+        }
     }
     const payer = new web3.PublicKey(feePayer);
     const memoProgram = new web3.PublicKey(MEMO_PROGRAM_ID);
@@ -169,6 +192,7 @@ export async function signinWithTx(cfg, params) {
     const tx = buildVerifyTxChallenge(params.web3, {
         nonce: challenge.nonce,
         memo: challenge.memo,
+        ...(typeof challenge.audience === "string" ? { audience: challenge.audience } : {}),
         feePayer: params.wallet,
         ...(params.blockhash !== undefined ? { blockhash: params.blockhash } : {}),
     });

package/dist/index.d.ts

@@ -55,6 +55,7 @@ export * from "./pnftTransfer.js";
 export * from "./payment.js";
 export * from "./signin.js";
 export * from "./connect.js";
+export * from "./siws.js";
 export * from "./domainProof.js";
 export { scopedTldCandidate, namespaceIsActive, makeScopedHandleDeriver, type ScopedCandidate, type ScopedHandleDeriver, } from "./scoped.js";
 import { type Chain, type Resolved } from "./types.js";
@@ -125,4 +126,5 @@ export interface Resolver {
 export declare function createResolver(config: ResolverConfig): Resolver;
 export * from "./adminMarket.js";
 export * from "./namespaceOverride.js";
+export * from "./namespacePricing.js";
 export * from "./universal.js";

package/dist/index.js

@@ -62,6 +62,7 @@ export * from "./pnftTransfer.js";
 export * from "./payment.js";
 export * from "./signin.js";
 export * from "./connect.js";
+export * from "./siws.js";
 export * from "./domainProof.js";
 // Named (not `export *`): `NAMESPACE_MAX_LEN` is already exported by
 // adminMarket.js, and two `export *` sharing a name would make it ambiguous
@@ -815,6 +816,7 @@ export function createResolver(config) {
 }
 export * from "./adminMarket.js";
 export * from "./namespaceOverride.js";
+export * from "./namespacePricing.js";
 // The X1ID Universal Resolver (#8475): cross-namespace resolution (.sol via SNS,
 // .eth via ENS) alongside the native path. Additive — the native resolver above
 // is untouched; `createUniversalResolver` composes it with external adapters.

package/dist/namespacePricing.d.ts

@@ -0,0 +1,207 @@
+/**
+ * TLD creator pricing (docs/specs/tld-creator-pricing.md): the SDK side of a
+ * TLD creator's own price table for names under their TLD.
+ *
+ * - `["ns_pricing", label]` holds a `NamespacePricing` account: a flat lamport
+ *   price per length band (index = `tier_index(len)`: 0 = 1 char … 8 = 9 chars,
+ *   9 = 10+), written ONLY by the namespace creator via `set_namespace_pricing`.
+ * - `register_under_namespace_v2` (v1's accounts + the pricing PDA as the
+ *   first remaining account) charges that band FLAT (no launch ramp) when
+ *   the account exists, else the legacy root price (`Config.tier_lamports` ×
+ *   the time/volume ramp), and refuses to charge more than the buyer's
+ *   `max_price_lamports`.
+ * - The legacy `register_under_namespace` (v1) fails closed
+ *   (`NamespacePricingRequiresV2`, 6117) on any TLD whose creator opted in.
+ *
+ * {@link quoteScopedName} reproduces the program's price selection exactly, so
+ * pass its `lamports` as `maxPriceLamports` to {@link buildRegisterUnderNamespaceV2Ix}.
+ *
+ * Hand-rolled like the rest of this package: no Anchor client, no
+ * `@solana/web3.js` import, no `@types/node`. PDAs are derived through an
+ * INJECTED `find_program_address` (see {@link PdaFinder}) because this package
+ * never hand-rolls the ed25519 on-curve check.
+ */
+import type { AddressLike, BuiltInstruction } from "./delegate.js";
+import type { RpcFn } from "./accounts.js";
+/** Seed prefix of the `["ns_pricing", label]` PDA. */
+export declare const NAMESPACE_PRICING_SEED = "ns_pricing";
+/** `NAMESPACE_TIER_FLOOR_LAMPORTS`: every creator tier must be >= 1 XNT. */
+export declare const NAMESPACE_TIER_FLOOR_LAMPORTS = 1000000000n;
+/** `NAMESPACE_TIER_MAX_LAMPORTS`: every creator tier must be <= 100,000,000 XNT. */
+export declare const NAMESPACE_TIER_MAX_LAMPORTS: bigint;
+/** Number of length bands (same banding as the root `Config.tier_lamports`). */
+export declare const NAMESPACE_TIER_COUNT = 10;
+/** `sha256("global:set_namespace_pricing")[0..8]`. */
+export declare const SET_NAMESPACE_PRICING_DISCRIMINATOR: Uint8Array;
+/** `sha256("global:register_under_namespace_v2")[0..8]`. */
+export declare const REGISTER_UNDER_NAMESPACE_V2_DISCRIMINATOR: Uint8Array;
+/** `sha256("account:NamespacePricing")[0..8]`. */
+export declare const NAMESPACE_PRICING_ACCOUNT_DISCRIMINATOR: Uint8Array;
+/** `Namespace::PRICING_FLAG_EXT_OFFSET` — the one-byte "creator pricing is on"
+ *  marker past the Anchor-allocated `Namespace` (8 + INIT_SPACE = 107). */
+export declare const NAMESPACE_PRICING_MARKER_OFFSET = 107;
+/** Program error codes added by this feature (6000 + variant index). */
+export declare const NAMESPACE_PRICING_ERRORS: {
+    readonly NamespacePricingMismatch: 6116;
+    readonly NamespacePricingRequiresV2: 6117;
+    readonly PriceExceedsMax: 6118;
+    readonly NamespaceTierBelowFloor: 6119;
+    readonly NamespaceTierAboveMax: 6120;
+};
+/** lib.rs `tier_index`: 1 char -> 0 … 10+ -> 9 (0 clamps to 0). */
+export declare function scopedTierIndex(len: number): number;
+/** lib.rs `price_now` (registration price), in bigint like the program's u128. */
+export declare function rootPriceNow(tierLamports: bigint, launchTs: bigint, nowSecs: bigint, totalHandlesSold: bigint): bigint;
+/** Problems with a creator tier table, or null when the program would accept
+ *  it (exactly `validate_namespace_tiers`). */
+export declare function namespaceTiersProblem(tiers: ReadonlyArray<bigint>): string | null;
+/** `find_program_address` — injected so this package never does curve math
+ *  itself. With web3.js: `(seeds, pid) => PublicKey.findProgramAddressSync(seeds, new PublicKey(pid))[0].toBase58()`. */
+export type PdaFinder = (seeds: Uint8Array[], programId: string) => Promise<string> | string;
+/** The seeds of `["ns_pricing", label]`. */
+export declare function namespacePricingSeeds(label: string): Uint8Array[];
+/** Derive the canonical `["ns_pricing", label]` PDA. */
+export declare function deriveNamespacePricingPda(label: string, programId: AddressLike, find: PdaFinder): Promise<string>;
+/** Decoded `NamespacePricing` account. */
+export interface NamespacePricing {
+    readonly version: number;
+    readonly bump: number;
+    /** Lamports per band, index = {@link scopedTierIndex}(len). */
+    readonly tierLamports: readonly bigint[];
+    readonly updatedAt: bigint;
+    readonly label: string;
+}
+/**
+ * Decode a `NamespacePricing` account's raw data (discriminator included):
+ * disc(8) | version(u8) | bump(u8) | tier_lamports([u64;10]) | updated_at(i64)
+ * | label(String). Returns null when the bytes are not a `NamespacePricing`.
+ */
+export declare function decodeNamespacePricing(data: Uint8Array): NamespacePricing | null;
+/** Whether a raw `Namespace` account carries the "creator pricing is on"
+ *  marker (any nonzero byte at offset 107; a shorter account = off). */
+export declare function namespaceHasPricingMarker(namespaceData: Uint8Array): boolean;
+export interface SetNamespacePricingParams {
+    readonly programId: AddressLike;
+    /** The namespace `creator` (signer, pays rent on first set). */
+    readonly creator: AddressLike;
+    /** `["namespace", label]`. */
+    readonly namespace: AddressLike;
+    /** `["ns_pricing", label]` ({@link deriveNamespacePricingPda}). */
+    readonly namespacePricing: AddressLike;
+    readonly label: string;
+    /** 10 lamport prices, index = {@link scopedTierIndex}(len). */
+    readonly tierLamports: ReadonlyArray<bigint>;
+}
+/**
+ * Build `set_namespace_pricing(label, tier_lamports)`. Accounts IN ORDER
+ * (`SetNamespacePricing`): creator(s,w), namespace(w), namespace_pricing(w),
+ * system_program. Validates the table client-side with the program's exact
+ * bounds so a bad table never reaches a wallet prompt.
+ */
+export declare function buildSetNamespacePricingIx(p: SetNamespacePricingParams): BuiltInstruction;
+export interface RegisterUnderNamespaceV2Params {
+    readonly programId: AddressLike;
+    /** `["ns_pricing", label]` — ALWAYS the canonical PDA, whether or not the
+     *  creator has set pricing (the program decides from its contents). */
+    readonly namespacePricing: AddressLike;
+    readonly payer: AddressLike;
+    readonly owner: AddressLike;
+    readonly config: AddressLike;
+    readonly treasury: AddressLike;
+    readonly namespace: AddressLike;
+    readonly creatorPayout: AddressLike;
+    /** `["handle", [label_len], label, name]`. */
+    readonly handle: AddressLike;
+    readonly mint: AddressLike;
+    readonly ownerTokenAccount: AddressLike;
+    readonly metadata: AddressLike;
+    readonly masterEdition: AddressLike;
+    readonly tokenRecord: AddressLike;
+    readonly collectionMint: AddressLike;
+    readonly collectionMetadata: AddressLike;
+    readonly collectionMasterEdition: AddressLike;
+    readonly collectionAuthority: AddressLike;
+    /** Canonical sub-name (`alice` in `alice.pepe`). */
+    readonly name: string;
+    /** 0 Human, 1 Merchant, 2 Org, 3 Agent. */
+    readonly handleType: number;
+    /** Buyer's ceiling: the tx fails (`PriceExceedsMax`) if the on-chain price
+     *  is higher. Pass {@link quoteScopedName}'s `lamports`. */
+    readonly maxPriceLamports: bigint;
+    /** OPTIONAL referral pair — both or neither. */
+    readonly integrator?: AddressLike;
+    readonly integratorAllowlist?: AddressLike;
+    /** OPTIONAL `["ns_minter", label, payer]` (invite-only, non-creator). */
+    readonly minterAuthorization?: AddressLike;
+}
+/**
+ * Build `register_under_namespace_v2(name, handle_type, max_price_lamports)`.
+ * Accounts IN ORDER: the exact v1 `RegisterUnderNamespace` list (payer(s,w),
+ * owner, config(w), treasury(w), namespace, creator_payout(w), handle(w),
+ * mint(w), owner_token_account(w), metadata(w), master_edition(w),
+ * token_record(w), collection_mint, collection_metadata(w),
+ * collection_master_edition, collection_authority, token_metadata_program,
+ * token_program, associated_token_program, system_program,
+ * sysvar_instructions), then the three optional slots ALWAYS present
+ * (integrator, integrator_allowlist, minter_authorization — each the program
+ * id when absent, Anchor's "explicitly None"), then `namespace_pricing` as
+ * `remaining_accounts[0]`. The program fails closed if it is missing or
+ * shifted.
+ */
+export declare function buildRegisterUnderNamespaceV2Ix(p: RegisterUnderNamespaceV2Params): BuiltInstruction;
+/** The program's root pricing inputs, read from `Config`. */
+export interface RootPricingInputs {
+    readonly launchTs: bigint;
+    readonly tierLamports: readonly bigint[];
+    readonly totalHandlesSold: bigint;
+}
+/** Read `launch_ts`, `tier_lamports` and `total_handles_sold` from raw Config bytes. */
+export declare function decodeRootPricingInputs(config: Uint8Array): RootPricingInputs | null;
+/**
+ * The price `register_under_namespace_v2` charges, from already-read state —
+ * `scoped_registration_price` in lib.rs: the creator's band flat when a table
+ * exists, else the root band × the ramp.
+ */
+export declare function scopedRegistrationPrice(pricing: NamespacePricing | null, root: RootPricingInputs, nameLen: number, nowSecs: bigint): bigint;
+export interface ScopedQuote {
+    /** Lamports `register_under_namespace_v2` will charge (pass as `maxPriceLamports`). */
+    readonly lamports: bigint;
+    /** `custom` = the creator's table; `fallback` = root tiers × ramp. */
+    readonly source: "custom" | "fallback";
+    readonly tierIndex: number;
+    /** The canonical `["ns_pricing", label]` PDA (pass to the v2 builder). */
+    readonly pricingAccount: string;
+    /** The creator's full table when `source === "custom"`. */
+    readonly pricing: NamespacePricing | null;
+}
+export interface QuoteScopedNameOptions {
+    readonly rpc: RpcFn;
+    readonly programId: AddressLike;
+    readonly find: PdaFinder;
+    /** Unix seconds; defaults to the local clock (the ramp moves per quarter, so
+     *  seconds of skew never matter for a fresh quote). */
+    readonly nowSecs?: bigint;
+}
+/**
+ * Quote `name.label` exactly like the program prices it (pricing-or-fallback).
+ * Throws when Config is missing, or when the pricing account exists but is not
+ * a valid `NamespacePricing` owned by the program (the program would refuse
+ * too), so a caller never shows a price the chain will not honour.
+ */
+export declare function quoteScopedName(label: string, name: string, opts: QuoteScopedNameOptions): Promise<ScopedQuote>;
+/**
+ * The instruction to SIMULATE (never send) to learn whether the deployed
+ * program has this feature: `set_namespace_pricing` with no accounts. An
+ * upgraded program recognizes the discriminator and fails account validation
+ * (e.g. 3005 `AccountNotEnoughKeys`); a pre-upgrade program fails with
+ * Anchor's `InstructionFallbackNotFound` (101). Interpret the simulation's
+ * `err` with {@link interpretNamespacePricingProbe}.
+ */
+export declare function buildNamespacePricingProbeIx(programId: AddressLike): BuiltInstruction;
+/**
+ * Read a `simulateTransaction` result's `value.err` for the probe tx (whose
+ * probe instruction is at `probeIndex`). `true` = the program knows the
+ * instruction; `false` = it does not, or the result is not the shape we
+ * expect (fail closed: hide the feature rather than show a broken button).
+ */
+export declare function interpretNamespacePricingProbe(err: unknown, probeIndex: number): boolean;