Merge branch 'feat/sdk-v3'

Author: bayological

.babelrc.json

@@ -0,0 +1,2 @@
+CELO_MAINNET_RPC_URL=
+TEST_SIGNER_PRIVATE_KEY=

.env.example

@@ -0,0 +1,22 @@
+# Dependabot configuration for automated dependency updates
+# See: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
+version: 2
+updates:
+  # npm dependencies
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      dev-dependencies:
+        patterns:
+          - '*'
+        exclude-patterns:
+          - '@mento-protocol/*'
+          - viem
+
+  # GitHub Actions
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.eslintignore

@@ -1,32 +1,54 @@
 name: CI
-on: [push]
+
+env:
+  CELO_MAINNET_RPC_URL: ${{secrets.CELO_MAINNET_RPC_URL}}
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Restrict default permissions for security
+permissions: {}
+
 jobs:
   build:
-    name: Build, lint, and test on Node ${{ matrix.node }} and ${{ matrix.os }}
+    name: Build, lint, and test on Node ${{ matrix.node }}
 
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
-        node: [22.x]
-        os: [ubuntu-latest]
+        node: ['18.x', '20.x', '22.x']
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+        with:
+          version: 9
 
       - name: Use Node ${{ matrix.node }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node }}
+          cache: pnpm
 
-      - name: Install deps
-        run: yarn install
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
 
       - name: Build
-        run: yarn build
+        run: pnpm build
 
       - name: Lint
-        run: yarn lint
+        run: pnpm lint
 
       - name: Test
-        run: yarn test --ci --coverage
+        run: pnpm test:unit
+
+      - name: Check bundle size
+        run: pnpm size

.eslintrc.json

@@ -1,29 +1,87 @@
-name: publish npm package
+name: Publish to npm
 
-on: [workflow_dispatch]
+on: workflow_dispatch
+
+# Restrict default permissions for security
+permissions: {}
 
 jobs:
-  release:
-    name: publish
+  build:
+    name: Build and test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+        with:
+          version: 9
+
+      - name: Install Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '20'
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Test
+        run: pnpm test:unit
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 1
+
+  publish:
+    name: Publish
+    needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # Required for npm OIDC trusted publishing
     steps:
-      - name: Check out the repo
-        uses: actions/checkout@v4
+      - name: Checkout repo
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          cache: yarn
-          node-version: '22'
+          node-version: '20'
           registry-url: https://registry.npmjs.org
 
-      - name: Install the Node.js dependencies
-        run: yarn install --immutable
+      - name: Download build artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: dist
+          path: dist/
 
-      - name: Build the sdk
-        run: yarn build
+      - name: Determine npm tag
+        id: tag
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          if echo "$VERSION" | grep -q "beta"; then
+            echo "tag=beta" >> "$GITHUB_OUTPUT"
+          elif echo "$VERSION" | grep -q "rc"; then
+            echo "tag=rc" >> "$GITHUB_OUTPUT"
+          elif echo "$VERSION" | grep -q "alpha"; then
+            echo "tag=alpha" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          fi
+          echo "Publishing $VERSION with tag: $(cat "$GITHUB_OUTPUT" | grep tag | cut -d= -f2)"
 
-      - name: publish
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.SDK_NPM_AUTH_TOKEN}}
+      - name: Publish to npm
+        run: npm publish --access public --tag ${{ steps.tag.outputs.tag }} --provenance

.github/dependabot.yml

@@ -32,4 +32,11 @@ yarn-error.log*
 # local env files
 .env
 .env.*
-.tool-versions
+!.env.example
+
+# AI files
+.claude/
+.specify/*
+IMPLEMENTATION_PLAN.md
+
+.vscode/

.github/workflows/main.yml

@@ -0,0 +1,3 @@
+# Security: Disable lifecycle scripts during install to mitigate supply-chain attacks
+# See: https://e18e.dev/docs/publishing.html
+ignore-scripts=true

.github/workflows/publish_npm.yml

@@ -1,6 +1,6 @@
 {
   "semi": false,
-  "printWidth": 80,
+  "printWidth": 120,
   "singleQuote": true,
   "tabWidth": 2,
   "trailingComma": "es5"