Repository navigation
Publish readiness, CLI exit codes and audit hardening - #6
Merged
Merged
Conversation
…cans Package and CI - publishConfig (public, provenance); prepack/build use a cross-platform node script; prepublishOnly fails without LICENSE, NOTICE or a built dist/ - publish.yml: manual (release published or dispatch, dry run by default), pinned actions, id-token for provenance, NPM_TOKEN by name only - engines.node >=20 (global WebCrypto + fetch); the bin falls back to dist/ on a Node without type stripping; @types/node pinned exactly - CI: package job packs the tarball, installs it in an empty project and runs the bin and the offline example on Node 20 and 24 CLI - --verify-signature without Ed25519 exits 2 (signature_unverified) - --signer must be a base58 32-byte address (usage error, exit 2) - --max-signatures takes plain decimal digits only - CHARTRUNNER_RPC_URL when --rpc is absent; --rpc wins - bad_signature and tx_mismatch are mismatches (exit 1); table in README SDK - canonicalJson rejects arrays, null, primitives and class instances as rows - checkEquivocation: a signature entry without a reported memo ends the scan as scan_incomplete instead of reading every transaction serially Docs: live figures marked as of their date; SPEC 8 and READMEs say proof mode binds count only as an upper bound. No hash, serialization or vector changed.
…ent; plain rows from another realm publish.yml: a real publish (release or a dispatch with dry_run off) refuses unless the release targets main or the dispatch runs on main; the job runs in the 'npm' environment so the owner can require a reviewer. canonicalJson accepts an object literal from another realm (vm, iframe), whose Object.prototype differs; class instances are still refused. Review follow-ups on #6.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #5. Retarget to
mainonce #5 merges. This addresses the non-blocking findings from the 2026-11-03 audit. No change to SPEC v1 hashing or serialization;test-vectors/v1.jsonis byte-identical.Publish readiness
publishConfigsetsaccess: publicandprovenance: true.prepublishOnlyfails if LICENSE or NOTICE is missing or differs from the root copies, or ifdistis missing. The cross-platformpack-files.mjsreplacescpandrm -rf.publish.yml:workflow_dispatch(a dry run by default) plus release published. It checks that the tag matches the version, and runs withid-token: writeand actions pinned by SHA. The npm token is referenced only assecrets.NPM_TOKEN, which the owner adds. Publishing is manual and owner-only.packagejob: it packs on Node 24, then installs the tarball and runs--helpand an example on Node 20 and on Node 24.enginesis>=20, which the tarball run checks.CLI
bad_signatureandtx_mismatchmove here, because the signed bytes contradict the RPC.signature_unverified, returned when--verify-signaturewas asked for but no Ed25519 is available.--signermust decode to 32 bytes of base58.--max-signaturesmust be a plain positive integer.CHARTRUNNER_RPC_URLenvironment variable;--rpcoverrides it.SDK
canonicalJsonrejects array, null, primitive and class-instance rows. SPEC §3 already requires a flat object.memo, the result isscan_incomplete, instead of up to 100k serialgetTransactioncalls.rpc.test.tscases:Docs
countonly as an upper bound (SPEC §8 and both READMEs).@types/nodeis pinned.Checks: 246 tests (up from 233), build, lint, typecheck,
vectors:check,examples, and the public-repo leak scan all pass.