Commit dc2a204f authored by imtase's avatar imtase
Browse files

chore: modernize build and docs publication 

- preserve native dynamic imports for strict CSP runtime artifacts
- build browser bundle from emitted JavaScript and remove tsify
- add release, CSP and package tarball guardrails
- publish VitePress root assets, sitemap, social metadata and Blurt branding
parent 7acdf0b7

.gitignore

+1 −1
Original line number Diff line number Diff line
@@ -7,4 +7,4 @@ coverage/ 
.vscode

site/.vitepress/dist/

site/.vitepress/cache/

public/
 
/public/

.gitlab-ci.yml

+3 −1
Original line number Diff line number Diff line
@@ -22,7 +22,9 @@ sdk:validate: 
    - npm run build

    - npx mocha --exit --reporter tap --require ts-node/register -r test/_node.js $(find test -maxdepth 1 -name '*.ts' ! -name '*_smoke.ts' ! -name 'crypto_real_integration.ts' -print | sort)

    - npm run docs:check:ci

    - npm pack --dry-run --json

    - npm run docs:ai:check

    - npm run csp:check

    - npm run package:check



pages:

  stage: deploy

MIGRATION_MATRIX.md

+1 −1
Original line number Diff line number Diff line
@@ -41,7 +41,7 @@ Status values: 
| Assets / Price | Not directly; remains dblurt-owned | Not changed by transport migration | Existing build/typecheck only in this phase | Numeric precision and string formatting | No migration target for blurt-rpc-core | Not Started |

| Chain model types (`Account`, `Block`, `Comment`, `Proposal`, `Witness`, operations) | Not directly; remains dblurt-owned | Not changed by transport migration | Existing build/typecheck only in this phase | Type drift from node responses; no runtime validation | No migration target for blurt-rpc-core | Not Started |

| Utils retryingFetch | Legacy only after extraction | N/A for core path; still supports LegacyRpcTransport | Legacy contract tests exercise via LegacyRpcTransport | Eventually dead code if LegacyRpcTransport is removed | Keep until legacy removal criteria are met | In Progress |

| Package dependency strategy | Dynamic optional import today; no committed local `file:` dependency | N/A | Typecheck works because the core module is dynamically imported via `new Function` and injectable in tests | Runtime `rpcTransport: 'core'` requires `@beblurt/blurt-rpc-core` to be installed/published or a preloaded `coreModule` | Decide dependency/peer/workspace policy before release | In Progress |

| Package dependency strategy | Runtime dependency with lazy native dynamic import; no committed local `file:` dependency | N/A | Typecheck and package checks cover the dependency path; `coreModule` remains injectable in tests and advanced consumers | Runtime `rpcTransport: 'core'` requires `@beblurt/blurt-rpc-core` to be installed/published or a preloaded `coreModule` | Preserve lazy loading and CSP guardrails when changing package/build policy | In Progress |

| Public docs and migration guidance | Docs added for current phase | Medium; docs reflect current tests and known divergence | Manual review plus test commands in status doc | Docs can drift quickly during later phases | Keep `MIGRATION_STATUS.md` as source of truth | In Progress |



## Cross-cutting migration boundaries

Makefile

+4 −6
Original line number Diff line number Diff line
@@ -18,17 +18,15 @@ lib: $(SRC_FILES) node_modules 
	echo "$$VERSION_TEMPLATE" > lib/version.js

	touch lib



dist/%.js: lib

	browserify $(filter-out $<,$^) --debug \

		--standalone dblurt --plugin tsify \

dist/dblurt.js: lib/index-browser.js node_modules

	mkdir -p dist

	browserify lib/index-browser.js --debug \

		--standalone dblurt \

		| derequire > $@

	uglifyjs $@ \

		--source-map "content=inline,url=$(notdir $@).map,filename=$@.map" \

		--compress "dead_code,collapse_vars,reduce_vars,keep_infinity,drop_console,passes=2" \

		--output $@ || rm $@



dist/dblurt.js: src/index-browser.ts



dist/dblurt.d.ts: $(SRC_FILES) node_modules scripts/generate-dts.js

	node scripts/generate-dts.js

	perl -i -pe"s@'dblurt/index'@'dblurt'@g" dist/dblurt.d.ts

SECURITY.md

+3 −7
Original line number Diff line number Diff line
@@ -54,14 +54,10 @@ Maintainers should: 


## Release guidance



Before publishing a security-sensitive release, maintainers should run at least:

Before publishing a security-sensitive release, maintainers should run the side-effect-free release preflight:



```bash

npm run lint

npm run typecheck

npm test

npm run docs:check

npm pack --dry-run

npm run release:check

```



For npm publication, also perform dependency/security audit and package-content review in an environment where audit tooling is available.
 
For npm publication, also perform dependency/security audit and package-content review in an environment where audit tooling is available. `release:check` includes runtime CSP scanning and a packed-package consumer smoke test, but it does not replace maintainer review of generated artifacts or release provenance.