names: /name says whether the holder is where a migration grant sent the name

coinos.io's v3 bridge forwards a migrated legacy account's incoming
payments to the v3 wallet only on proof: the holder is the legacy
account's own key, or the wallet its session named via /migrate-grant
(granted: true).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_011bvzKaZosXGHkigcGcSzAR

1 files changed, 9 insertions, 1 deletions

diff --git a/names/server.js b/names/server.js
index 82d00ec..e17ca05 100644
--- a/names/server.js
+++ b/names/server.js
@@ -1171,7 +1171,15 @@ Bun.serve({
     if (m && req.method === 'GET') {
       const domain = (url.searchParams.get('domain') || DOMAIN).toLowerCase();
       const rec = state.names[`${m[1]}@${domain}`];
-      if (rec) return json({ name: m[1], domain, taken: true, pubkey: rec.pubkey, manager: rec.manager || null, uri: rec.uri, noffer: rec.noffer?.raw || null, lno: rec.lno || null });
+      // granted: the record's holder is where the legacy coinos.io account's
+      // own session sent the name (/migrate-grant) — coinos.io's v3 bridge
+      // forwards that account's incoming payments here only on such proof
+      if (rec) {
+        const g = domain === 'coinos.io' && (state.migrations || {})[`${m[1]}@coinos.io`];
+        const keys = [rec.pubkey, rec.manager].filter(Boolean);
+        const granted = !!g && (keys.includes(g.pubkey) || (!!g.manager && keys.includes(g.manager)));
+        return json({ name: m[1], domain, taken: true, pubkey: rec.pubkey, manager: rec.manager || null, uri: rec.uri, noffer: rec.noffer?.raw || null, lno: rec.lno || null, granted });
+      }
       const reserved = RESERVED.has(m[1]) || !NAME_RE.test(m[1]) || await takenByCoinosUser(domain, m[1]);
       return json({ name: m[1], domain, taken: reserved, reserved });
     }