* docs: generate the API reference for developers.pezkuwichain.io
Add TypeDoc (0.28.20) and `yarn docs`, which builds the reference for the
nine public API packages from src/ into build-docs/, with a landing page
and a getting-started guide whose examples were run against the live
network. The PR workflow builds it so a broken doc comment or config is
caught before merge.
docs/ held only a redirect to polkadot.js.org; it now holds the guide
sources. The README, packages/api/README.md and three CHANGELOG entries
linked to js.pezkuwichain.app, a domain that is not ours and is listed
for sale; they now point to developers.pezkuwichain.io, the Pezkuwi
Portal, or the upstream polkadot.js.org pages the entries came from.
* ci(docs): deploy the reference to developers.pezkuwichain.io
On every master push that changes the generated reference, build it with
`yarn docs` and publish it to the web host the same way pezkuwi-apps
publishes the portal: an approved production environment holds the deploy
key, the bundle is unpacked into releases/<sha>, and going live is one
rename of the current symlink. The switch is checked through nginx for the
public name (deploy sha, index, main.js, search index) and rolled back if
the new release is not served. workflow_dispatch with rollback_to makes an
earlier release live again.
Release-bot version bumps ([CI Skip]) and changes that cannot affect the
output do not ask for an approval.
glob 13.0.0 (GHSA-3g3m-2fjr-6pw4, fixed in 14.0.2) reaches the lockfile only
through node-gyp -> make-fetch-happen -> cacache, which yarn adds for the
optional macOS fsevents build. cacache calls glob(pattern, options) with
'*(content-*|index-*)' and '**' patterns; glob 14.0.2 returns the same paths
for both.
glob 14.0.2 needs minimatch ^11 and @isaacs/nonrecursive-glob-match ^1.0.1;
pin them to 11.0.1 and 1.0.1, the releases at least 14 days old. The
minimatch 10.2.6 used by eslint stays: eslint-plugin-import-x 4.17.1 imports
makeRe, which minimatch 11 removed, so forcing it fails every lint run.
braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.
Lockfile only. The 4 open Dependabot alerts matched versions still pinned in yarn.lock. `yarn up -R` moves http-cache-semantics to a fixed version within range; terser-webpack-plugin 5.6 no longer depends on serialize-javascript. After: 0 matching.
- @pezkuwi/dev, dev-test, dev-ts ^0.86.3; disable directives renamed
for the new rule names, or removed where the rule no longer reports
- rethrown errors carry the original as `cause` (13 sites)
- optional chains where a guard expression tested the same value
- Init: the registry cache settles with the creator's own promise,
dropping the entry in finally(), instead of re-wrapping it
- Combinator: a typed call instead of `Function`
- checkTypes.manual: synchronous checks run outside Promise.all
- sortValues, createTypeUnsafe: initial values that were never read
- typegen util: load docs.js for its side effect (it registers the
`docs` Handlebars partial) now that its types are re-exported
type-only
- MockProvider keeps its Header assertion: the package's own build
does not load api-augment, so createType returns a plain Codec there
- Decorate keeps `delete queue[i]`: the hole marks a fired queue and
later indexes must not shift
Carries the tx generator fix (struct and enum arguments keep their object
input) on top of 16.5.38. All packages and their exact internal pins move
to 16.5.39.
Carries the typegen fix for types that contain an account (a0b19f4) and the
api-augment regenerated with it; nothing else changed since 16.5.37
(2a35891). All packages and their exact internal pins move to 16.5.38.
- @pezkuwi/typegen requires handlebars ^4.7.9; 4.7.8 and earlier are
affected by the open handlebars advisories
- yarn.lock: tar, ip-address, brace-expansion, fast-uri, js-yaml,
node-forge, postcss, lodash, ws and the other flagged transitive
packages resolve to patched releases within their declared ranges
The flagged packages still on an affected version are reached only
through the @pezkuwi/dev tool chain (webpack-dev-server 4, eslint 8,
gh-release), which pins their major versions; they are development
tools and are not part of any published package.
The packages/*/package.json files were the manifests the build writes
into build/, committed back over the source ones: exports maps of
thousands of entries pointing at ./cjs/* files, main at ./cjs/index.js,
module and types set. pezkuwi-dev-build-ts generates those fields
itself; in the source they pointed at files that only existed because
build output had been committed too. main, module, types, exports,
browser, react-native and sideEffects are back in the source form of
the upstream manifests; every other field is unchanged.
- @pezkuwi/* common dependencies 14.0.25 -> 14.0.26 (wasm-crypto 7.5.20
underneath, with working ed25519 and secp256k1)
- the root resolutions forcing common 14.0.25 and wasm 7.5.4 onto the
whole tree are removed; only the typescript pin remains
- @pezkuwi/dev, dev-test and dev-ts ^0.85.12
- the deno script is removed
- version 16.5.37
Root resolutions were pinned to 14.0.11, preventing yarn from
resolving to the latest published versions. Updated resolutions
and all package.json dependencies to 14.0.25 which includes
native bizinikiwi signing context via @pezkuwi/scure-sr25519.
- Published from build/ directories for correct npm structure
- Updated common dependencies to 14.0.25
- Added AuthorizeCall signed extension support
- All packages now have index.js at root level
- Update genesis hash to mainnet value
- Remove npmAuthToken from .yarnrc.yml (use GitHub Secrets instead)
- Add pezsp_* and pezframe_* path support in PortableRegistry
