chore(sdk): 0.14.1 -> 0.14.2 across all five packages - #24
Merged
Conversation
… audit (#25) The bump PR shipped documentation that teaches code which cannot work, plus three defects no test could see. Nothing crashed, which is why it landed. False claims, each verified against the pinned SDK: - The refusal a pre-flip dApp receives names its version. ConnectClient has sent `sdkVersion` in the handshake since 0.10.1, so a 0.13.1 client is refused with `actualSdk: "0.13.1"`, not `null`. The docs presented the null/"unknown (not reported)" case as what an old dApp sees, and the browser and backend-auth tests were written around that unreachable branch. A reader branching on `actualSdk == null` gets dead code. - "Every pre-0.14 name still fires" is wrong. The flip removed 38 event names and gave 16 an adapter; the other 26 are accepted by `subscribe` and then never emit. 24 of them were live emitters in 0.13.1 — every `invoice:*`, every `swap:*`, `sync:started`/`:error`/`:provider` and more. CONNECT.md now carries the full removed-with-no-adapter table. - `payment_request:accepted` and `:response` were not fabrications: both are declared in 0.13.1's SphereEventType, and `:response` is emitted by PaymentsModule. They were removed by the flip without an adapter. Defects: - badgeFor painted an in-flight `submitted` transfer with the success green, as it did any payload with no `status`. Colour is now driven by the settled set (confirmed/delivered/completed) rather than a blocklist, so an unknown or absent status can no longer answer "did it go through?" with yes. - The bot registered its `inventory:updated` listener after the mint and after the first `assets()` round trip, so the credit event it exists to catch could fire with nobody attached. Subscribe first, mint second, read third — the boot read now goes through the same epoch guard. - mockSphere's paymentsV2 lacked `requests`, which the host dereferences in `sphere.paymentsV2?.requests.list()` — the optional chain guards paymentsV2, not requests, so the first live `payment_request:updated` would throw a TypeError inside ConnectHost. Masked only by `on` being a no-op stub. Also: - sendSafety.test.ts could not detect a code the SDK ADDS, which is the direction that costs money. It now sweeps the whole SphereErrorCode universe through the SDK predicate, with a type-level guard that fails `tsc` and names any code a future SDK adds. - formatAssets moved to bot/src/balance.ts so it is reachable by tests at all; index.ts calls main() at module scope. - nodejs describeConnectFailure and backend-auth describeVersionFloor each handled one of the three handshake-refusal shapes. Both now cover the SDK floor, the protocol floor and the 4008 network mismatch — the last being what a dApp that omits `network` actually hits. The latter is renamed describeHandshakeRefusal to match what it does. - CI runs npm ci instead of npm install. The comment justifying npm install described a file: link that no lockfile carries any more, and npm install will not fail when package.json and package-lock.json disagree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the pinned SDK to the current npm
latest. All five packages pin exactly, no caret.0.14.1was already one release behind on the day #23 merged, and the local Sphere walletruns
0.14.2.What 0.14.2 adds over 0.14.1
Four substantive commits, both in surface these examples demonstrate:
connectionStatus()getter on the payments-v2 facade, so a late subscriber can seed itsinitial state instead of waiting for the next
connection:statusevent (sphere#473 P1).PeerInfogains an optional
network, read off the raw event.Neither is breaking.
PeerInfo.networkis additive, and the host's built-in SDK floor isunchanged at
0.14.1-0, so nothing about the handshake moves.Scope
Only the pin was bumped, not the floor. Statements about hosts enforcing
0.14.1-0,the
≥ 0.14.1requirements and the tests asserting0.14.1-0are all still correct and areleft alone — rewriting them to 0.14.2 would make the docs lie about the floor.
package.json+ lockfilesverified against 0.14.xprose headers inbot/srcVerification
npm cinpm ciwas run separately in all five to confirmpackage.jsonandpackage-lock.jsonagree.