Move to the fixed crypto stack and patched dependencies; run quality CI on hosted runners (#47)

- Move backend and root transitive deps to patched versions
- Upgrade web to react-router 7.18 and patched vitest/dompurify
- Move the sign app to vite 6.4.3
- Depend on the fixed crypto stack in web, sign and backend
- sign: typecheck the shared code it compiles
- ci: run the quality jobs on GitHub-hosted runners, and build sign
- Move to @pezkuwi/api 16.5.39
- ci: run CodeQL for JavaScript/TypeScript on a GitHub-hosted runner

.github/workflows/codeql.yml

@@ -21,7 +21,7 @@ concurrency:
 jobs:
   analyze:
     name: Analyze ${{ matrix.language }}
-    runs-on: pwap-runner
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:

.github/workflows/quality-gate.yml

@@ -33,7 +33,7 @@ jobs:
   # ========================================
   web:
     name: Web App
-    runs-on: pwap-runner
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
@@ -93,14 +93,11 @@ jobs:
   # ========================================
   # BACKEND - INDEXER SERVICE (lint/smoke/audit)
   # No build step exists (plain ESM node service); we lockfile-enforce install,
-  # syntax-check the entry point, and audit. The audit is currently non-blocking
+  # syntax-check the entry point, and audit.
-  # because the express@5 + sqlite3(node-gyp) trees carry transitive advisories
-  # that need a broader dependency upgrade; flip continue-on-error off once the
-  # tree is clean.
   # ========================================
   backend:
     name: Backend Indexer
-    runs-on: pwap-runner
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
@@ -138,7 +135,36 @@ jobs:
 
       - name: npm audit (high + critical, production deps)
         working-directory: ./backend
-        continue-on-error: true
+        run: npm audit --audit-level=high --omit=dev
+
+  # ========================================
+  # SIGN - MULTISIG SIGNING PORTAL (typecheck + build)
+  # sign/ compiles ../shared/lib with tsc before vite builds it, so this is also
+  # the check that shared/ still typechecks against the chain's augmented API.
+  # ========================================
+  sign:
+    name: Signing Portal
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        working-directory: ./sign
+        run: npm ci
+
+      - name: Typecheck and build
+        working-directory: ./sign
+        run: npm run build
+
+      - name: npm audit (high + critical, production deps)
+        working-directory: ./sign
         run: npm audit --audit-level=high --omit=dev
 
   # ========================================
@@ -1090,7 +1116,7 @@ jobs:
   # ========================================
   security-audit:
     name: Security Audit
-    runs-on: pwap-runner
+    runs-on: ubuntu-latest
     needs: [web]
 
     steps:
@@ -1235,8 +1261,8 @@ jobs:
 
   ci-gate:
     name: CI Gate ✅
-    runs-on: pwap-runner
+    runs-on: ubuntu-latest
-    needs: [web, backend, security-audit, migration-test, workflow-guard]
+    needs: [web, backend, sign, security-audit, migration-test, workflow-guard]
     if: always()
 
     steps:

backend/package.json

@@ -12,30 +12,31 @@
   "overrides": {
     "tar": "^7.5.22",
     "ws": "^8.21.1",
-    "@pezkuwi/api": "^16.5.23",
+    "@pezkuwi/api": "^16.5.39",
-    "@pezkuwi/api-augment": "^16.5.23",
+    "@pezkuwi/api-augment": "^16.5.39",
-    "@pezkuwi/api-base": "^16.5.23",
+    "@pezkuwi/api-base": "^16.5.39",
-    "@pezkuwi/api-derive": "^16.5.23",
+    "@pezkuwi/api-derive": "^16.5.39",
-    "@pezkuwi/rpc-augment": "^16.5.23",
+    "@pezkuwi/rpc-augment": "^16.5.39",
-    "@pezkuwi/rpc-core": "^16.5.23",
+    "@pezkuwi/rpc-core": "^16.5.39",
-    "@pezkuwi/rpc-provider": "^16.5.23",
+    "@pezkuwi/rpc-provider": "^16.5.39",
-    "@pezkuwi/types": "^16.5.23",
+    "@pezkuwi/types": "^16.5.39",
-    "@pezkuwi/types-augment": "^16.5.23",
+    "@pezkuwi/types-augment": "^16.5.39",
-    "@pezkuwi/types-codec": "^16.5.23",
+    "@pezkuwi/types-codec": "^16.5.39",
-    "@pezkuwi/types-create": "^16.5.23",
+    "@pezkuwi/types-create": "^16.5.39",
-    "@pezkuwi/types-known": "^16.5.23",
+    "@pezkuwi/types-known": "^16.5.39",
-    "@pezkuwi/types-support": "^16.5.23",
+    "@pezkuwi/types-support": "^16.5.39",
-    "@pezkuwi/keyring": "^14.0.13",
+    "@pezkuwi/keyring": "^14.0.26",
-    "@pezkuwi/util": "^14.0.13",
+    "@pezkuwi/util": "^14.0.26",
-    "@pezkuwi/util-crypto": "^14.0.13",
+    "@pezkuwi/util-crypto": "^14.0.26",
-    "@pezkuwi/networks": "^14.0.13",
+    "@pezkuwi/networks": "^14.0.26",
-    "@pezkuwi/x-bigint": "^14.0.13",
+    "@pezkuwi/x-bigint": "^14.0.26",
-    "@pezkuwi/x-randomvalues": "^14.0.13"
+    "@pezkuwi/x-randomvalues": "^14.0.26",
+    "@tootallnate/once": "^2.0.1"
   },
   "dependencies": {
-    "@pezkuwi/api": "^16.5.23",
+    "@pezkuwi/api": "^16.5.39",
-    "@pezkuwi/util": "^14.0.13",
+    "@pezkuwi/util": "^14.0.26",
-    "@pezkuwi/util-crypto": "^14.0.13",
+    "@pezkuwi/util-crypto": "^14.0.26",
     "@supabase/supabase-js": "^2.45.0",
     "cors": "^2.8.5",
     "dotenv": "^17.2.3",
@@ -47,7 +48,7 @@
     "sqlite3": "^5.1.7"
   },
   "devDependencies": {
-    "@pezkuwi/keyring": "^14.0.13",
+    "@pezkuwi/keyring": "^14.0.26",
     "supertest": "^7.0.0"
   }
 }

package-lock.json

@@ -103,15 +103,15 @@
       "license": "MIT"
     },
     "node_modules/concurrently": {
-      "version": "9.2.1",
+      "version": "9.2.4",
-      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-9.2.1.tgz",
+      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-9.2.4.tgz",
-      "integrity": "sha512-fsfrO0MxV64Znoy8/l1vVIjjHa29SZyyqPgQBwhiDcaW8wJc2W3XWVOGx4M3oJBnv/zdUZIIp1gDeS98GzP8Ng==",
+      "integrity": "sha512-TZ0CEhyzvFjgtAvHTusDMgj7wNdihCh7LLLrzdUOXIhdlnL2JBBGA9eJxR24rtqgmdjh3OA3hrN1rCHj6HM8qA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "chalk": "4.1.2",
         "rxjs": "7.8.2",
-        "shell-quote": "1.8.3",
+        "shell-quote": "1.9.0",
         "supports-color": "8.1.1",
         "tree-kill": "1.2.2",
         "yargs": "17.7.2"
@@ -195,9 +195,9 @@
       }
     },
     "node_modules/shell-quote": {
-      "version": "1.8.3",
+      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
-      "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==",
+      "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
       "dev": true,
       "license": "MIT",
       "engines": {

sign/package.json

@@ -10,21 +10,23 @@
     "preview": "vite preview"
   },
   "dependencies": {
+    "@pezkuwi/api": "^16.5.39",
+    "@pezkuwi/extension-dapp": "^0.62.27",
+    "@pezkuwi/extension-inject": "^0.62.27",
+    "@pezkuwi/keyring": "^14.0.26",
+    "@pezkuwi/util": "^14.0.26",
+    "@pezkuwi/util-crypto": "^14.0.26",
     "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "react-dom": "^18.3.1"
-    "@pezkuwi/api": "^16.5.36",
-    "@pezkuwi/extension-dapp": "^0.62.20",
-    "@pezkuwi/extension-inject": "^0.62.20",
-    "@pezkuwi/keyring": "^14.0.25",
-    "@pezkuwi/util": "^14.0.25",
-    "@pezkuwi/util-crypto": "^14.0.25"
   },
   "devDependencies": {
+    "@pezkuwi/api-augment": "^16.5.39",
+    "@types/node": "^22.20.5",
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
     "@vitejs/plugin-react-swc": "^3.5.0",
     "typescript": "^5.6.3",
-    "vite": "^5.4.10",
+    "vite": "^6.4.3",
-    "vite-plugin-node-polyfills": "^0.22.0"
+    "vite-plugin-node-polyfills": "^0.25.0"
   }
 }

sign/src/api-augment.d.ts

@@ -0,0 +1,3 @@
+// Types only: gives api.query/api.tx/api.events their chain-specific shapes, as
+// web/src/main.tsx does with a runtime import. Nothing here reaches the bundle.
+import '@pezkuwi/api-augment';

sign/tsconfig.app.json

@@ -24,9 +24,10 @@
     "paths": {
       "@/*": ["./src/*"],
       "@pezkuwi/lib": ["../shared/lib"],
-      "@pezkuwi/lib/*": ["../shared/lib/*"]
+      "@pezkuwi/lib/*": ["../shared/lib/*"],
+      "@pezkuwi/*": ["./node_modules/@pezkuwi/*"]
     },
-    "types": ["vite/client"]
+    "types": ["vite/client", "node"]
   },
   "include": ["src"]
 }

web/package.json

@@ -25,11 +25,11 @@
     "@noble/ciphers": "^2.1.1",
     "@noble/curves": "^2.0.1",
     "@noble/hashes": "^2.0.1",
-    "@pezkuwi/api": "^16.5.36",
+    "@pezkuwi/api": "^16.5.39",
-    "@pezkuwi/extension-dapp": "^0.62.20",
+    "@pezkuwi/extension-dapp": "^0.62.27",
-    "@pezkuwi/keyring": "^14.0.25",
+    "@pezkuwi/keyring": "^14.0.26",
-    "@pezkuwi/util": "^14.0.25",
+    "@pezkuwi/util": "^14.0.26",
-    "@pezkuwi/util-crypto": "^14.0.25",
+    "@pezkuwi/util-crypto": "^14.0.26",
     "@radix-ui/react-accordion": "^1.2.0",
     "@radix-ui/react-alert-dialog": "^1.1.1",
     "@radix-ui/react-aspect-ratio": "^1.1.0",
@@ -61,9 +61,6 @@
     "@supabase/supabase-js": "^2.49.4",
     "@tanstack/react-query": "^5.56.2",
     "@twa-dev/sdk": "^8.0.2",
-    "@types/dompurify": "^3.0.5",
-    "@types/react-syntax-highlighter": "^15.5.13",
-    "@types/uuid": "^10.0.0",
     "@walletconnect/sign-client": "^2.23.6",
     "@walletconnect/types": "^2.23.6",
     "buffer": "^6.0.3",
@@ -71,7 +68,7 @@
     "clsx": "^2.1.1",
     "cmdk": "^1.0.0",
     "date-fns": "^3.6.0",
-    "dompurify": "^3.4.12",
+    "dompurify": "^3.4.16",
     "embla-carousel-react": "^8.3.0",
     "highlight.js": "^11.9.0",
     "i18next": "^23.7.6",
@@ -87,41 +84,40 @@
     "react-hook-form": "^7.53.0",
     "react-i18next": "^14.0.0",
     "react-resizable-panels": "^2.1.3",
-    "react-router-dom": "^6.26.2",
+    "react-router-dom": "^7.18.4",
     "react-syntax-highlighter": "^16.1.0",
     "recharts": "^2.12.7",
     "sonner": "^1.5.0",
     "tailwind-merge": "^2.5.2",
-    "tailwindcss-animate": "^1.0.7",
     "uuid": "^11.1.0",
     "vaul": "^0.9.3",
     "zod": "^3.23.8"
   },
   "overrides": {
-    "@pezkuwi/api": "^16.5.36",
+    "@pezkuwi/api": "^16.5.39",
-    "@pezkuwi/api-augment": "^16.5.36",
+    "@pezkuwi/api-augment": "^16.5.39",
-    "@pezkuwi/api-base": "^16.5.36",
+    "@pezkuwi/api-base": "^16.5.39",
-    "@pezkuwi/api-derive": "^16.5.36",
+    "@pezkuwi/api-derive": "^16.5.39",
-    "@pezkuwi/rpc-augment": "^16.5.36",
+    "@pezkuwi/rpc-augment": "^16.5.39",
-    "@pezkuwi/rpc-core": "^16.5.36",
+    "@pezkuwi/rpc-core": "^16.5.39",
-    "@pezkuwi/rpc-provider": "^16.5.36",
+    "@pezkuwi/rpc-provider": "^16.5.39",
-    "@pezkuwi/types": "^16.5.36",
+    "@pezkuwi/types": "^16.5.39",
-    "@pezkuwi/types-augment": "^16.5.36",
+    "@pezkuwi/types-augment": "^16.5.39",
-    "@pezkuwi/types-codec": "^16.5.36",
+    "@pezkuwi/types-codec": "^16.5.39",
-    "@pezkuwi/types-create": "^16.5.36",
+    "@pezkuwi/types-create": "^16.5.39",
-    "@pezkuwi/types-known": "^16.5.36",
+    "@pezkuwi/types-known": "^16.5.39",
-    "@pezkuwi/types-support": "^16.5.36",
+    "@pezkuwi/types-support": "^16.5.39",
-    "@pezkuwi/keyring": "^14.0.25",
+    "@pezkuwi/keyring": "^14.0.26",
-    "@pezkuwi/util": "^14.0.25",
+    "@pezkuwi/util": "^14.0.26",
-    "@pezkuwi/util-crypto": "^14.0.25",
+    "@pezkuwi/util-crypto": "^14.0.26",
-    "@pezkuwi/x-bigint": "^14.0.25",
+    "@pezkuwi/x-bigint": "^14.0.26",
-    "@pezkuwi/x-fetch": "^14.0.25",
+    "@pezkuwi/x-fetch": "^14.0.26",
-    "@pezkuwi/x-global": "^14.0.25",
+    "@pezkuwi/x-global": "^14.0.26",
-    "@pezkuwi/x-randomvalues": "^14.0.25",
+    "@pezkuwi/x-randomvalues": "^14.0.26",
-    "@pezkuwi/x-textdecoder": "^14.0.25",
+    "@pezkuwi/x-textdecoder": "^14.0.26",
-    "@pezkuwi/x-textencoder": "^14.0.25",
+    "@pezkuwi/x-textencoder": "^14.0.26",
-    "@pezkuwi/x-ws": "^14.0.25",
+    "@pezkuwi/x-ws": "^14.0.26",
-    "@pezkuwi/networks": "^14.0.25",
+    "@pezkuwi/networks": "^14.0.26",
     "elliptic": "^6.6.1"
   },
   "devDependencies": {
@@ -130,10 +126,13 @@
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.0",
     "@testing-library/user-event": "^14.6.1",
+    "@types/dompurify": "^3.0.5",
     "@types/node": "^22.5.5",
     "@types/qrcode": "^1.5.6",
     "@types/react": "^18.3.3",
     "@types/react-dom": "^18.3.0",
+    "@types/react-syntax-highlighter": "^15.5.13",
+    "@types/uuid": "^10.0.0",
     "@vitejs/plugin-react-swc": "^3.5.0",
     "autoprefixer": "^10.4.20",
     "eslint": "^9.9.0",
@@ -145,11 +144,12 @@
     "jsdom": "^27.2.0",
     "postcss": "^8.5.23",
     "tailwindcss": "^3.4.11",
+    "tailwindcss-animate": "^1.0.7",
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.0.1",
     "vite": "^7.3.1",
     "vite-plugin-node-polyfills": "^0.25.0",
     "vite-plugin-subresource-integrity": "^0.0.12",
-    "vitest": "^4.0.10"
+    "vitest": "^4.1.11"
   }
 }