-
Notifications
You must be signed in to change notification settings - Fork 51
fix(sei-global-wallet): harden consumer integrations #343
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
fac4133
fix(sei-global-wallet): harden consumer integrations
alexander-sei d6c004e
fix(sei-global-wallet): unbreak CI typecheck and coverage
alexander-sei 8428369
Harden Sei Global Wallet release compatibility
alexander-sei c0db1d9
fix(mcp-server): stop CI typecheck OOM from a split zod tree
alexander-sei File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| --- | ||
| '@sei-js/mcp-server': patch | ||
| --- | ||
|
|
||
| Align `zod` with `@modelcontextprotocol/sdk` so both resolve the same schema types. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| --- | ||
| '@sei-js/sei-global-wallet': minor | ||
| --- | ||
|
|
||
| Harden Sei Global Wallet browser, EIP-6963, and packaging behavior without changing what existing installs resolve. | ||
|
|
||
| New exports: `registerEIP6963Provider`, `unregisterEIP6963Provider`, `eip6963ProviderInfo`, and `registerSolanaStandard`. | ||
|
|
||
| - Raise `@dynamic-labs/global-wallet-client` to `^4.96.3`, so applications inherit Dynamic's transitive fixes without waiting for a release here. | ||
| - Initialize Dynamic's required `global` and `process` aliases before loading its modules in browsers and edge-like SSR runtimes, without consumer bundler configuration and without replacing consumer-defined values. `process.env.NODE_ENV` defaults to `production` so libraries loaded afterwards do not take a development branch inside a production bundle. | ||
| - Dispatch the initial EIP-6963 announcement, re-announce on every provider request, expose cleanup helpers, use stable UUIDv4 provider metadata, and replace the non-square wordmark with the unmodified square black mark from the official Sei brand kit. | ||
| - Keep the root, `./eip6963`, and `./ethereum` entrypoints resolvable with no optional peer installed, including for types. | ||
| - Verify real npm and Bun consumers, all five entrypoints, EIP-6963 and Solana registration, ZeroDev resolution, esbuild and Vite browser runtimes, SSR imports, types, audits, and package contents. | ||
|
|
||
| Every optional peer range stays a superset of the 1.4.1 contract, and `@wallet-standard/wallet` stays a direct dependency, so no existing install changes how it resolves. The `events` dependency is present so bundlers can resolve the bare `events` specifier that `@zerodev/sdk` imports; browser builds of the `./zerodev` path fail without it. Dynamic 4.96.3's own peer contract is the version set this release is verified against; it is documented under [Optional peer versions](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#optional-peer-versions) as guidance rather than enforced through narrowed ranges. | ||
|
|
||
| > [!WARNING] | ||
| > This release carries a temporary consumer security waiver: Dynamic transitively pins vulnerable `axios` and `uuid`, and dependency overrides in a library do not propagate to applications. See [Required consumer overrides](https://github.com/sei-protocol/sei-js/blob/main/packages/sei-global-wallet/README.md#required-consumer-overrides) for the exact override blocks and the accepted advisory set. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| name: Sei Global Wallet Consumer Smoke | ||
|
|
||
| on: | ||
| pull_request: | ||
| paths: | ||
| - '.changeset/**' | ||
| - '.github/workflows/sei-global-wallet-smoke.yml' | ||
| - 'bun.lock' | ||
| - 'package.json' | ||
| - 'packages/sei-global-wallet/**' | ||
| - 'scripts/check-sei-global-wallet.ts' | ||
| - 'scripts/dynamic-package-lock*' | ||
| - 'tsconfig.base.json' | ||
| - 'tsconfig.test.json' | ||
| # The publishing commit is the merge of the generated "Version Packages" pull | ||
| # request, so a pull_request-only trigger never gates the release itself. | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| - '.changeset/**' | ||
| - '.github/workflows/sei-global-wallet-smoke.yml' | ||
| - 'bun.lock' | ||
| - 'package.json' | ||
| - 'packages/sei-global-wallet/**' | ||
| - 'scripts/check-sei-global-wallet.ts' | ||
| - 'scripts/dynamic-package-lock*' | ||
| - 'tsconfig.base.json' | ||
| - 'tsconfig.test.json' | ||
| # Consumer installs resolve live registry and advisory data, which drifts | ||
| # without any change in this repository. | ||
| schedule: | ||
| - cron: '17 6 * * *' | ||
| workflow_dispatch: | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | ||
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| consumers: | ||
| name: npm, Bun, edge, and browser consumers | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 20 | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version-file: '.nvmrc' | ||
| registry-url: 'https://registry.npmjs.org' | ||
|
|
||
| - name: Setup Bun | ||
| uses: oven-sh/setup-bun@v2 | ||
| with: | ||
| bun-version: '1.3.14' | ||
|
|
||
| - name: Install workspace dependencies | ||
| run: bun install --frozen-lockfile | ||
|
|
||
| - name: Verify npm and waived Bun consumers | ||
| run: bun run test:sei-global-wallet-release | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[suggestion] The job runs
test:sei-global-wallet-release, which importsscripts/dynamic-package-lock.js(check-sei-global-wallet.ts:8) for the stale-Dynamic-4.96.1 graph assertion — but neitherscripts/dynamic-package-lock.tsnor its test is in this path filter. A PR that changes the dependency-graph enforcement therefore skips the very check it modifies. Add- 'scripts/dynamic-package-lock*'alongside this entry.(Raised by Codex; confirmed.)