The bound was 100 ms and the test failed once inside the full suite.
The regex it guards against needs about 9 s on that input and the
linear check about 1 ms, so 1 s still fails on the regex and does not
fail on a busy runner.
- @pezkuwi/typegen requires handlebars ^4.7.9; 4.7.8 and earlier are
affected by the open handlebars advisories
- yarn.lock: tar, ip-address, brace-expansion, fast-uri, js-yaml,
node-forge, postcss, lodash, ws and the other flagged transitive
packages resolve to patched releases within their declared ranges
The flagged packages still on an affected version are reached only
through the @pezkuwi/dev tool chain (webpack-dev-server 4, eslint 8,
gh-release), which pins their major versions; they are development
tools and are not part of any published package.
- typegen formatType: the inline-struct shortcut test /^{.+:.+}/ has two
unbounded wildcards and backtracks quadratically on input such as
'{{a:a:a:...' (370 ms at 20k repetitions). isInlineStruct checks the
same thing with indexOf: an opening brace, a colon at index 2 or later
and a closing brace at least two characters after it, all on the
first line. 500k random inputs give the same answer as the regex; a
test keeps it under 100 ms at 100k repetitions and goes red on the
regex.
- PortableRegistry: the type definition cache was a plain object
written as typeDefs[lookupIndex][key]. lookupIndex is always a number,
but nothing in the shape said so; it is now a Map, and the definition
is filled through its own reference.
Most are object keys out of order after the rename (dicle, pezkuwi,
bizinikiwi, teyrchains and zagros sort differently from the names they
replaced); they are sorted, behaviour is unchanged. The rest:
- createClass: header.hash is already the BlockHash type; the
`as any` cast is removed
- ScProvider: WellKnownChain is a string union in @bizinikiwi/connect,
so `string | WellKnownChain` was `string`; the spec parameter says so
- ScProvider: the jsonRpcResponses loop is a named async function whose
rejection (chain removed, client terminated) is caught explicitly
instead of a floating promise
- the fake chain in the spec no longer needs a non-null assertion
- Extrinsic.hash: redundant non-null assertion removed
- metadata-get.mjs writes the 2026 header
The packages/*/package.json files were the manifests the build writes
into build/, committed back over the source ones: exports maps of
thousands of entries pointing at ./cjs/* files, main at ./cjs/index.js,
module and types set. pezkuwi-dev-build-ts generates those fields
itself; in the source they pointed at files that only existed because
build output had been committed too. main, module, types, exports,
browser, react-native and sideEffects are back in the source form of
the upstream manifests; every other field is unchanged.
- @pezkuwi/* common dependencies 14.0.25 -> 14.0.26 (wasm-crypto 7.5.20
underneath, with working ed25519 and secp256k1)
- the root resolutions forcing common 14.0.25 and wasm 7.5.4 onto the
whole tree are removed; only the typescript pin remains
- @pezkuwi/dev, dev-test and dev-ts ^0.85.12
- the deno script is removed
- version 16.5.37
The rename replaced the sp_*, frame_* and polkadot_runtime_common paths
in PATHS_ALIAS and in the extrinsic and event-record lookups with their
pezsp_*, pezframe_* and pezkuwi_runtime_common forms. Live Pezkuwi
chains expose the pez* paths, but metadata built from upstream
Substrate (including every metadata fixture in types-support) exposes
the original ones, and for those the registry no longer resolved
Weight, MultiAddress, AccountId32, the unchecked extrinsic or the event
record: 26 tests failed and the api suite hung.
Every alias now matches both forms, and the extrinsic and event-record
lookups fall back from the pez* name to the upstream one. The augment
interfaces are regenerated from the fixtures with the restored aliases
(AccountId32, EthereumAddress, MultiAddress, ... instead of the raw
path names), which is also what the registry hands out at runtime.
The manual and e2e tables for pezkuwi, dicle and zagros were the
Polkadot, Kusama and Westend runtime-upgrade histories copied under new
names, keyed by genesis hashes that belong to no Pezkuwi chain. Pezkuwi
and Zagros have no runtime history before metadata v14, so they need no
pre-v14 upgrade table: both are empty, dicle (never launched) is
removed, and the e2e generator targets the live pezkuwi and zagros
endpoints. The spec asserts the exported list is empty.
Packages had their compiled output checked in next to src/: .js,
.d.ts and cjs/ trees at the package root, 251 symlinks into build/,
root copies of typegen generate/ and templates/ and of types-support
json/, and a LICENSE per package. The build writes all of these into
build/ itself; in the source tree they shadowed src/ for anything
resolving the package root and drifted from it.
- every matrix step (lint, test, build) must pass; nothing is allowed
to fail silently
- after build, scripts/check-built-manifests.py checks the package.json
each build/ directory holds, which is what npm receives: entry points
must exist, no ./build/ or ./cjs/cjs/ paths, no string spread into
exports, no workspace:/link: ranges
- the tree must be unchanged after the step: `yarn lint` runs
eslint --fix and `yarn build` regenerates the augment interfaces, so
both used to pass on a tree they had rewritten
- the dot-notation exclusion had been renamed from kusama to zagros
(no such directory) instead of dicle; with the dicle augmentation in
the lint program, eslint --fix rewrote api.query['registrar'] style
accesses that the build cannot compile
- the four compiled-only packages (bizinikiwi-bindings,
merkleize-metadata, metadata-builders, papi-utils) have no sources
here and are not linted
- the auto-approve and auto-merge bots are removed
- .prettierrc.cjs uses @pezkuwi/dev
test-compare.mjs, test-extrinsic-hex.mjs, test-transfer.mjs and
test-transfer-e2e.mjs were ad-hoc scripts run by hand against a node.
They are not part of any package or test suite, and they embed the
mnemonic of a test wallet in plain text. That wallet is retired.
Root resolutions were pinned to 14.0.11, preventing yarn from
resolving to the latest published versions. Updated resolutions
and all package.json dependencies to 14.0.25 which includes
native bizinikiwi signing context via @pezkuwi/scure-sr25519.
- Published from build/ directories for correct npm structure
- Updated common dependencies to 14.0.25
- Added AuthorizeCall signed extension support
- All packages now have index.js at root level
- Update genesis hash to mainnet value
- Remove npmAuthToken from .yarnrc.yml (use GitHub Secrets instead)
- Add pezsp_* and pezframe_* path support in PortableRegistry
- @pezkuwi/papi-utils (rebrand of @polkadot-api/utils)
- @pezkuwi/bizinikiwi-bindings (rebrand of @polkadot-api/substrate-bindings)
- @pezkuwi/metadata-builders (rebrand of @polkadot-api/metadata-builders)
- @pezkuwi/merkleize-metadata (rebrand of @polkadot-api/merkleize-metadata)
All @polkadot-api references replaced with @pezkuwi equivalents.
