fix(ci): add --access public to npm publish for scoped packages (#16)

The v0.2.0 release workflow failed because scoped packages with npm
provenance require --access public to be set explicitly. The GitHub
release was created but npm publish failed.

This PR:
- Fixes the release workflow to include --access public
- Bumps to v0.3.0 (v0.2.0 tag exists but was never published to npm)
- Removes thin viem wrappers (passage, weth, witness helpers) per SDK scope
- Documents direct viem usage patterns in README

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: prestwich

.github/workflows/release.yml

@@ -57,8 +57,8 @@ jobs:
           else
             echo "New release needed"
             gh release create "$PKG_VER" -t "$PKG_VER" --generate-notes
-            # publish to npm
-            pnpm publish --no-git-checks
+            # publish to npm (--access public required for scoped packages with provenance)
+            pnpm publish --no-git-checks --access public
             # Add the release information to the github actions summary
             echo "# New Release Created" >> $GITHUB_STEP_SUMMARY
             echo "Tag: [$PKG_VER](https://github.com/${{ github.repository }}/releases/tag/${PKG_VER})" >> $GITHUB_STEP_SUMMARY

CHANGELOG.md

@@ -19,7 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Breaking:** `needsWethWrap(symbol, direction, flow)` now requires a `flow` parameter to distinguish between Passage (direct ETH entry) and Orders (Permit2, requires WETH) flows
 
-## [0.2.0] - 2026-02-05
+## [0.3.0] - 2026-02-05
 
 ### Added
 
@@ -28,17 +28,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Bundle serialization helpers (`serializeEthBundle`, `serializeCallBundle`)
 - Order feasibility checking (`checkOrderFeasibility`)
 - Tx-cache client (`createTxCacheClient`) for submitting orders and bundles
-- Passage helpers (`enter`, `enterToken`) for bridging to Signet
-- WETH helpers (`wrapEth`, `unwrapEth`) for wrapping/unwrapping ETH
-- Permit2 approval helpers (`getPermit2Allowance`, `approvePermit2`, `ensurePermit2Approval`)
+- Permit2 approval helpers (`ensurePermit2Approval`)
 - Token registry with USDC/USDT addresses for Mainnet and Parmigiana
 - Viem chain definitions (`signetRollup`, `parmigianaRollup`, `parmigianaHost`)
-- New subpath exports: `/client`, `/passage`, `/weth`, `/permit2`
+- New subpath exports: `/client`, `/permit2`
 
 ### Changed
 
 - Expanded token mapping utilities (`getTokenAddress`, `resolveTokenSymbol`, `mapTokenCrossChain`)
 
+### Fixed
+
+- Release workflow now correctly publishes scoped packages to npm with `--access public`
+
+### Note
+
+- v0.2.0 was tagged but never published to npm due to a CI issue
+
 ## [0.1.0] - 2026-01-15
 
 ### Added

CLAUDE.md

@@ -63,3 +63,21 @@ Releases are automated via GitHub Actions. To release:
 2. Move `[Unreleased]` entries to a new version section in `CHANGELOG.md`
 3. Commit and push to `main`
 4. CI creates GitHub release and publishes to npm
+
+## SDK Scope
+
+The SDK focuses on:
+
+- Types and type definitions
+- Contract ABIs
+- EIP-712 signing logic
+- Chain constants and addresses
+- Complex operations that add real value (validation, aggregation, edge case handling)
+
+The SDK should NOT include:
+
+- Thin wrappers around viem's `readContract`/`writeContract`
+- Simple parameter rearrangement helpers
+- Functions that just inject a constant into a viem call
+
+Instead, export the ABIs and constants, then document direct viem usage patterns in README.

README.md

@@ -96,86 +96,106 @@ console.log(`Order submitted with ID: ${id}`);
 
 ### On-Chain Operations
 
-The SDK provides helpers for common on-chain operations:
+The SDK exports ABIs and constants for on-chain operations. Use viem directly for contract interactions:
 
-#### Bridging with Passage
-
-Enter Signet from the host chain:
+#### Permit2 Approvals
 
 ```typescript
-import { enter, enterToken, MAINNET } from "@signet-sh/sdk";
-import { createWalletClient, http } from "viem";
-import { mainnet } from "viem/chains";
+import { PERMIT2_ADDRESS } from "@signet-sh/sdk";
+import { erc20Abi, maxUint256 } from "viem";
 
-const client = createWalletClient({
-  account,
-  chain: mainnet,
-  transport: http(),
+// Approve Permit2 to spend your tokens (one-time per token)
+await walletClient.writeContract({
+  address: tokenAddress,
+  abi: erc20Abi,
+  functionName: "approve",
+  args: [PERMIT2_ADDRESS, maxUint256],
 });
 
-// Bridge native ETH
-const hash = await enter(client, {
-  passage: MAINNET.hostPassage,
-  recipient: "0x...",
-  amount: 1000000000000000000n, // 1 ETH
+// Check current allowance
+const allowance = await publicClient.readContract({
+  address: tokenAddress,
+  abi: erc20Abi,
+  functionName: "allowance",
+  args: [ownerAddress, PERMIT2_ADDRESS],
+});
+```
+
+For tokens like USDT that require resetting allowance to zero before setting a new value, use `ensurePermit2Approval`:
+
+```typescript
+import { ensurePermit2Approval } from "@signet-sh/sdk";
+
+// Handles USDT-style tokens automatically
+const { approved, txHash } = await ensurePermit2Approval(
+  walletClient,
+  publicClient,
+  {
+    token: usdtAddress,
+    owner: account.address,
+    amount: 1000000n,
+  }
+);
+```
+
+#### Bridging with Passage
+
+```typescript
+import { passageAbi, MAINNET } from "@signet-sh/sdk";
+
+// Bridge native ETH to Signet
+await walletClient.writeContract({
+  address: MAINNET.hostPassage,
+  abi: passageAbi,
+  functionName: "enter",
+  args: [recipientAddress],
+  value: 1000000000000000000n, // 1 ETH
 });
 
-// Bridge ERC20 tokens (requires prior approval)
-const hash = await enterToken(client, {
-  passage: MAINNET.hostPassage,
-  rollupChainId: MAINNET.rollupChainId,
-  recipient: "0x...",
-  token: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", // USDC
-  amount: 1000000n, // 1 USDC
+// Bridge ERC20 tokens to Signet (requires prior token approval to Passage)
+await walletClient.writeContract({
+  address: MAINNET.hostPassage,
+  abi: passageAbi,
+  functionName: "enterToken",
+  args: [MAINNET.rollupChainId, recipientAddress, tokenAddress, amount],
 });
 ```
 
 #### WETH Wrapping
 
-Convert between ETH and WETH:
-
 ```typescript
-import { wrapEth, unwrapEth, getTokenAddress, MAINNET } from "@signet-sh/sdk";
+import { wethAbi, getTokenAddress, MAINNET } from "@signet-sh/sdk";
 
 const wethAddress = getTokenAddress("WETH", MAINNET.hostChainId, MAINNET)!;
 
 // Wrap ETH → WETH
-await wrapEth(client, { weth: wethAddress, amount: 1000000000000000000n });
+await walletClient.writeContract({
+  address: wethAddress,
+  abi: wethAbi,
+  functionName: "deposit",
+  value: 1000000000000000000n, // 1 ETH
+});
 
 // Unwrap WETH → ETH
-await unwrapEth(client, { weth: wethAddress, amount: 1000000000000000000n });
+await walletClient.writeContract({
+  address: wethAddress,
+  abi: wethAbi,
+  functionName: "withdraw",
+  args: [1000000000000000000n], // 1 WETH
+});
 ```
 
-#### Permit2 Approvals
-
-Manage ERC20 approvals for Permit2:
+#### Reading Output Witness
 
 ```typescript
-import {
-  getPermit2Allowance,
-  approvePermit2,
-  ensurePermit2Approval,
-} from "@signet-sh/sdk";
+import { rollupOrdersAbi, MAINNET } from "@signet-sh/sdk";
 
-// Check current allowance
-const allowance = await getPermit2Allowance(publicClient, {
-  token: usdcAddress,
-  owner: account.address,
+const { witnessHash, witnessTypeString } = await publicClient.readContract({
+  address: MAINNET.rollupOrders,
+  abi: rollupOrdersAbi,
+  functionName: "outputWitness",
+  args: [outputs],
 });
-
-// Approve Permit2 (max by default)
-await approvePermit2(walletClient, { token: usdcAddress });
-
-// Smart approval - handles USDT-style tokens that require reset to zero
-const { approved, txHash } = await ensurePermit2Approval(
-  walletClient,
-  publicClient,
-  {
-    token: usdtAddress,
-    owner: account.address,
-    amount: 1000000n,
-  }
-);
 ```
 
 ### Chain Configurations
@@ -199,10 +219,8 @@ console.log(PARMIGIANA.rollupChainId); // 88888n
 import { MAINNET, PARMIGIANA } from "@signet-sh/sdk/constants";
 import { UnsignedOrder } from "@signet-sh/sdk/signing";
 import type { SignedOrder } from "@signet-sh/sdk/types";
-import { rollupOrdersAbi } from "@signet-sh/sdk/abi";
+import { rollupOrdersAbi, passageAbi, wethAbi } from "@signet-sh/sdk/abi";
 import { createTxCacheClient } from "@signet-sh/sdk/client";
-import { enter, enterToken } from "@signet-sh/sdk/passage";
-import { wrapEth, unwrapEth } from "@signet-sh/sdk/weth";
 import { ensurePermit2Approval } from "@signet-sh/sdk/permit2";
 ```
 
@@ -379,12 +397,6 @@ const balances = await Promise.all(
 - `serializeEthBundle(bundle)` - Serialize bundle for JSON-RPC
 - `serializeCallBundle(bundle)` - Serialize call bundle for JSON-RPC
 - `createTxCacheClient(url)` - Create a tx-cache client for bundle submission
-- `enter(client, params)` - Bridge native ETH to Signet via Passage
-- `enterToken(client, params)` - Bridge ERC20 tokens to Signet via Passage
-- `wrapEth(client, params)` - Wrap native ETH into WETH
-- `unwrapEth(client, params)` - Unwrap WETH back to native ETH
-- `getPermit2Allowance(client, params)` - Get ERC20 allowance for Permit2
-- `approvePermit2(client, params)` - Approve Permit2 to spend ERC20
 - `ensurePermit2Approval(walletClient, publicClient, params)` - Smart Permit2 approval with USDT handling
 - `getTokenDecimals(symbol, config?)` - Get token decimals with chain-specific overrides
 - `needsWethWrap(symbol, direction, flow)` - Check if ETH needs wrapping for operation
@@ -407,6 +419,13 @@ const balances = await Promise.all(
 - `MAINNET` - Mainnet chain configuration
 - `PARMIGIANA` - Parmigiana testnet configuration
 
+### ABIs
+
+- `passageAbi` - Passage bridge contract ABI
+- `wethAbi` - WETH contract ABI
+- `rollupOrdersAbi` - Rollup orders contract ABI
+- `permit2Abi` - Permit2 contract ABI
+
 ## Compatibility
 
 This SDK produces signed orders that are byte-for-byte compatible with the Rust `signet-types` crate. The order hash computation matches exactly, ensuring interoperability between TypeScript and Rust implementations.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signet-sh/sdk",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "TypeScript SDK for Signet Orders - create, sign, and verify orders compatible with signet-types",
   "type": "module",
   "main": "./dist/index.js",
@@ -36,14 +36,6 @@
       "import": "./dist/client/index.js",
       "types": "./dist/client/index.d.ts"
     },
-    "./passage": {
-      "import": "./dist/passage/index.js",
-      "types": "./dist/passage/index.d.ts"
-    },
-    "./weth": {
-      "import": "./dist/weth/index.js",
-      "types": "./dist/weth/index.d.ts"
-    },
     "./permit2": {
       "import": "./dist/permit2/index.js",
       "types": "./dist/permit2/index.d.ts"

src/index.ts

@@ -119,7 +119,6 @@ export {
   eip712SigningHash,
   encodeFillPermit2,
   encodeInitiatePermit2,
-  getOutputWitness,
   hasPermit2Approval,
   isNonceUsed,
   nonceFromSeed,
@@ -169,15 +168,5 @@ export type { TxCacheClient } from "./client/index.js";
 
 export { createTxCacheClient } from "./client/index.js";
 
-// Passage
-export { enter, enterToken } from "./passage/index.js";
-
-// WETH
-export { wrapEth, unwrapEth } from "./weth/index.js";
-
 // Permit2 approvals
-export {
-  getPermit2Allowance,
-  approvePermit2,
-  ensurePermit2Approval,
-} from "./permit2/index.js";
+export { ensurePermit2Approval } from "./permit2/index.js";