CodeQL actions/missing-workflow-permissions: lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
* chore(papi): commit the sources behind the four polkadot-api packages
papi-utils, bizinikiwi-bindings, metadata-builders and merkleize-metadata
held only dist/ builds, and no repository held their source. Every
source map in dist/ embeds the TypeScript it was compiled from; that is
now committed as src/ (59 files), and it matches upstream polkadot-api
(MIT) exactly once @polkadot-api/* imports are renamed:
papi-utils @polkadot-api/utils 0.2.0
bizinikiwi-bindings @polkadot-api/substrate-bindings 0.16.6
metadata-builders @polkadot-api/metadata-builders 0.13.0-0.13.2
merkleize-metadata @polkadot-api/merkleize-metadata 1.1.21-1.1.23
scripts/check-papi-sources.mjs, run in the lint job, fails unless the
source embedded in dist/ is exactly the committed src/. tsconfig.json
excludes these src/ trees; ESLint already skipped the packages. Each
README now states the upstream package and version.
* chore(papi): keep the upstream sources in upstream-src/
The pezkuwi-dev build treats any package with a src/ directory as its
own: it requires our license header on every file and builds it. These
are upstream files that must stay byte-identical to the source embedded
in dist/, so they live in upstream-src/ instead, which neither the build
nor the root tsconfig picks up.
braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.
Lockfile only. The 4 open Dependabot alerts matched versions still pinned in yarn.lock. `yarn up -R` moves http-cache-semantics to a fixed version within range; terser-webpack-plugin 5.6 no longer depends on serialize-javascript. After: 0 matching.
- @pezkuwi/dev, dev-test, dev-ts ^0.86.3; disable directives renamed
for the new rule names, or removed where the rule no longer reports
- rethrown errors carry the original as `cause` (13 sites)
- optional chains where a guard expression tested the same value
- Init: the registry cache settles with the creator's own promise,
dropping the entry in finally(), instead of re-wrapping it
- Combinator: a typed call instead of `Function`
- checkTypes.manual: synchronous checks run outside Promise.all
- sortValues, createTypeUnsafe: initial values that were never read
- typegen util: load docs.js for its side effect (it registers the
`docs` Handlebars partial) now that its types are re-exported
type-only
- MockProvider keeps its Header assertion: the package's own build
does not load api-augment, so createType returns a plain Codec there
- Decorate keeps `delete queue[i]`: the hole marks a fired queue and
later indexes must not shift
Nothing proposes updates to the workflow actions: several still declare
the Node 20 runtime, which runners already force to Node 24 with a warning
on every run. Dependabot now checks them monthly and groups all action
updates into one pull request.
Carries the tx generator fix (struct and enum arguments keep their object
input) on top of 16.5.38. All packages and their exact internal pins move
to 16.5.39.
The tx generator rebranded each argument's lookup name (SpWeightsWeightV2Weight
to PezspWeightsWeightV2Weight) before asking getSimilarTypes for its inputs.
The registry knows the type only by its metadata name, so for every lookup
type the class checks found nothing and the generated signature was the bare
type: multisig.asMulti took `maxWeight: PezspWeightsWeightV2Weight` with no
`{ refTime?: any; proofSize?: any }`, and a timepoint without
`{ height?: any; index?: any }`. Passing a plain object, as every caller
does, was a type error.
getSimilarTypes and formatType now get the metadata name, as the query
generator already does for storage keys, and return rebranded names
themselves; the rebranded name is what goes into the imports and the
used-type list. The augment is regenerated (yarn build:metadata, 1070
passed). Only tx.ts files change; enum variant names are untouched.
Carries the typegen fix for types that contain an account (a0b19f4) and the
api-augment regenerated with it; nothing else changed since 16.5.37
(2a35891). All packages and their exact internal pins move to 16.5.38.
getSimilarTypes widened lookup types by name before its class checks, with
type.includes('AccountId32') and type.includes('MultiAddress'). Those also
match every type that only contains one: Vec<AccountId32>,
Option<AccountId32>, ITuple<[AccountId32, u32]>, Vec<MultiAddress>. They
were widened like a bare account and returned before reaching the Vec,
Option or Tuple branch, so the generated augment typed
multisig.asMulti(otherSignatories) as `Vec<AccountId32> | string |
Uint8Array` (no string[]), an Option<AccountId32> argument without null,
and a tuple key without its tuple form.
The names are now matched whole. The augment is regenerated
(yarn build:metadata); for these types it now matches what upstream
generates, e.g. `Vec<AccountId32> | (AccountId32 | string | Uint8Array)[]`.
metadata/util/testUtil.ts is used only by the Metadata specs, but it sat
under util/ and was built and exported as
@pezkuwi/types/metadata/util/testUtil. It reads fixture JSON through
import.meta.url, so requiring it from the CJS build failed. It moves to
metadata/test/, which the build leaves out like every other test path.
- metadataMd located @pezkuwi/api-derive with import.meta.resolve at
module load. import.meta is a syntax error in the CJS output, so
require('@pezkuwi/typegen/metadataMd') failed. The directory now comes
from api-derive's packageInfo, which the build fills for each format
(package root for ESM, cjs/ for CommonJS), and is looked up only when
the derive docs are written.
- writeFile creates the output directory; the CLI used to die with an
unhandled ENOENT unless docs/<chain> and docs/derives already existed.
- the endpoint examples in the CLI help pointed at
wss://dicle-rpc.pezkuwi.io, which does not exist; they show
wss://rpc.pezkuwichain.io.
From the installed packages, the ESM bin and require(...).main() now
write the same eight files, identical to what the ESM bin wrote before.
The bound was 100 ms and the test failed once inside the full suite.
The regex it guards against needs about 9 s on that input and the
linear check about 1 ms, so 1 s still fails on the regex and does not
fail on a busy runner.
- @pezkuwi/typegen requires handlebars ^4.7.9; 4.7.8 and earlier are
affected by the open handlebars advisories
- yarn.lock: tar, ip-address, brace-expansion, fast-uri, js-yaml,
node-forge, postcss, lodash, ws and the other flagged transitive
packages resolve to patched releases within their declared ranges
The flagged packages still on an affected version are reached only
through the @pezkuwi/dev tool chain (webpack-dev-server 4, eslint 8,
gh-release), which pins their major versions; they are development
tools and are not part of any published package.
- typegen formatType: the inline-struct shortcut test /^{.+:.+}/ has two
unbounded wildcards and backtracks quadratically on input such as
'{{a:a:a:...' (370 ms at 20k repetitions). isInlineStruct checks the
same thing with indexOf: an opening brace, a colon at index 2 or later
and a closing brace at least two characters after it, all on the
first line. 500k random inputs give the same answer as the regex; a
test keeps it under 100 ms at 100k repetitions and goes red on the
regex.
- PortableRegistry: the type definition cache was a plain object
written as typeDefs[lookupIndex][key]. lookupIndex is always a number,
but nothing in the shape said so; it is now a Map, and the definition
is filled through its own reference.
Most are object keys out of order after the rename (dicle, pezkuwi,
bizinikiwi, teyrchains and zagros sort differently from the names they
replaced); they are sorted, behaviour is unchanged. The rest:
- createClass: header.hash is already the BlockHash type; the
`as any` cast is removed
- ScProvider: WellKnownChain is a string union in @bizinikiwi/connect,
so `string | WellKnownChain` was `string`; the spec parameter says so
- ScProvider: the jsonRpcResponses loop is a named async function whose
rejection (chain removed, client terminated) is caught explicitly
instead of a floating promise
- the fake chain in the spec no longer needs a non-null assertion
- Extrinsic.hash: redundant non-null assertion removed
- metadata-get.mjs writes the 2026 header
The packages/*/package.json files were the manifests the build writes
into build/, committed back over the source ones: exports maps of
thousands of entries pointing at ./cjs/* files, main at ./cjs/index.js,
module and types set. pezkuwi-dev-build-ts generates those fields
itself; in the source they pointed at files that only existed because
build output had been committed too. main, module, types, exports,
browser, react-native and sideEffects are back in the source form of
the upstream manifests; every other field is unchanged.
- @pezkuwi/* common dependencies 14.0.25 -> 14.0.26 (wasm-crypto 7.5.20
underneath, with working ed25519 and secp256k1)
- the root resolutions forcing common 14.0.25 and wasm 7.5.4 onto the
whole tree are removed; only the typescript pin remains
- @pezkuwi/dev, dev-test and dev-ts ^0.85.12
- the deno script is removed
- version 16.5.37
The rename replaced the sp_*, frame_* and polkadot_runtime_common paths
in PATHS_ALIAS and in the extrinsic and event-record lookups with their
pezsp_*, pezframe_* and pezkuwi_runtime_common forms. Live Pezkuwi
chains expose the pez* paths, but metadata built from upstream
Substrate (including every metadata fixture in types-support) exposes
the original ones, and for those the registry no longer resolved
Weight, MultiAddress, AccountId32, the unchecked extrinsic or the event
record: 26 tests failed and the api suite hung.
Every alias now matches both forms, and the extrinsic and event-record
lookups fall back from the pez* name to the upstream one. The augment
interfaces are regenerated from the fixtures with the restored aliases
(AccountId32, EthereumAddress, MultiAddress, ... instead of the raw
path names), which is also what the registry hands out at runtime.
The manual and e2e tables for pezkuwi, dicle and zagros were the
Polkadot, Kusama and Westend runtime-upgrade histories copied under new
names, keyed by genesis hashes that belong to no Pezkuwi chain. Pezkuwi
and Zagros have no runtime history before metadata v14, so they need no
pre-v14 upgrade table: both are empty, dicle (never launched) is
removed, and the e2e generator targets the live pezkuwi and zagros
endpoints. The spec asserts the exported list is empty.
Packages had their compiled output checked in next to src/: .js,
.d.ts and cjs/ trees at the package root, 251 symlinks into build/,
root copies of typegen generate/ and templates/ and of types-support
json/, and a LICENSE per package. The build writes all of these into
build/ itself; in the source tree they shadowed src/ for anything
resolving the package root and drifted from it.
- every matrix step (lint, test, build) must pass; nothing is allowed
to fail silently
- after build, scripts/check-built-manifests.py checks the package.json
each build/ directory holds, which is what npm receives: entry points
must exist, no ./build/ or ./cjs/cjs/ paths, no string spread into
exports, no workspace:/link: ranges
- the tree must be unchanged after the step: `yarn lint` runs
eslint --fix and `yarn build` regenerates the augment interfaces, so
both used to pass on a tree they had rewritten
- the dot-notation exclusion had been renamed from kusama to zagros
(no such directory) instead of dicle; with the dicle augmentation in
the lint program, eslint --fix rewrote api.query['registrar'] style
accesses that the build cannot compile
- the four compiled-only packages (bizinikiwi-bindings,
merkleize-metadata, metadata-builders, papi-utils) have no sources
here and are not linted
- the auto-approve and auto-merge bots are removed
- .prettierrc.cjs uses @pezkuwi/dev
test-compare.mjs, test-extrinsic-hex.mjs, test-transfer.mjs and
test-transfer-e2e.mjs were ad-hoc scripts run by hand against a node.
They are not part of any package or test suite, and they embed the
mnemonic of a test wallet in plain text. That wallet is retired.
Root resolutions were pinned to 14.0.11, preventing yarn from
resolving to the latest published versions. Updated resolutions
and all package.json dependencies to 14.0.25 which includes
native bizinikiwi signing context via @pezkuwi/scure-sr25519.
- Published from build/ directories for correct npm structure
- Updated common dependencies to 14.0.25
- Added AuthorizeCall signed extension support
- All packages now have index.js at root level
- Update genesis hash to mainnet value
- Remove npmAuthToken from .yarnrc.yml (use GitHub Secrets instead)
- Add pezsp_* and pezframe_* path support in PortableRegistry
- @pezkuwi/papi-utils (rebrand of @polkadot-api/utils)
- @pezkuwi/bizinikiwi-bindings (rebrand of @polkadot-api/substrate-bindings)
- @pezkuwi/metadata-builders (rebrand of @polkadot-api/metadata-builders)
- @pezkuwi/merkleize-metadata (rebrand of @polkadot-api/merkleize-metadata)
All @polkadot-api references replaced with @pezkuwi equivalents.
