@assinafy/sdk 2.1.1 → 2.2.0

package/docs/RELEASING.md

@@ -9,7 +9,7 @@ event, and the workflow intentionally does not depend on one.
 
 | Runtime | Release responsibility |
 | --- | --- |
-| Bun 1.3.14 | Locked install, tests, build, audit, and packaging |
+| Bun 1.4.0 | Locked install, tests, build, contract checks, and packaging |
 | Node.js 22 | Minimum supported consumer runtime |
 | Node.js 24 LTS | Packaging and registry publishing runtime |
 | Node.js 26 Current | Forward-compatibility consumer test |
@@ -29,12 +29,16 @@ publisher using these repository coordinates:
 | Organization or user | `assinafy` |
 | Repository | `typescript-sdk` |
 | Workflow filename | `release.yml` |
-| Environment | Leave unset unless the workflow is updated to use one |
+| Environment | `release` |
+| Allowed actions | `npm publish` |
 
 The `publish-npm` job grants only `contents: read` and `id-token: write`.
 Modern npm exchanges GitHub's short-lived OIDC identity for publish credentials;
 no long-lived `NPM_TOKEN` is required. Test trusted publishing before deleting a
 legacy token, then remove that token from repository and organization secrets.
+Keep package access **public** and select npm's most restrictive publishing
+access option: **Require two-factor authentication and disallow bypass 2FA
+tokens**. Trusted-publisher OIDC remains compatible with that setting.
 
 ### GitHub Packages
 
@@ -43,11 +47,33 @@ The `publish-gh` job uses the workflow-scoped `GITHUB_TOKEN` with
 the `@assinafy` scope and that the package remains linked to this repository.
 No separate personal access token should be stored.
 
+### Sandbox integration environment
+
+Create a protected GitHub environment named `sandbox`. Restrict deployments to
+the mirrored `main` branch, require reviewer approval, and store these required
+environment secrets:
+
+- `ASSINAFY_API_KEY`
+- `ASSINAFY_ACCOUNT_ID`
+
+The `disposable-full` mode also requires `ASSINAFY_TEST_EMAIL_PRIMARY` and
+`ASSINAFY_TEST_EMAIL_SECONDARY`. Optional coverage uses
+`ASSINAFY_TEST_WEBHOOK_URL`, `ASSINAFY_TEST_LOGIN_EMAIL`,
+`ASSINAFY_TEST_LOGIN_PASSWORD`, `ASSINAFY_SIGNER_ACCESS_CODE`,
+`ASSINAFY_SIGNER_OTP`, and `ASSINAFY_PUBLIC_DOCUMENT_ID`.
+
+Keep secret values out of repository variables, files, and logs. Run the manual
+**Sandbox integration** workflow from mirrored `main`; use `read-only` first
+and select `disposable-full` only for a deliberate reversible test run.
+
 ### Mirror and tag protection
 
 The GitLab push mirror must include tags and be able to update the GitHub
-repository. Protect release tags in GitLab so only release maintainers can
-create patterns matching `v*`. GitHub Actions must be enabled on the mirror.
+repository. Protect `v*` tags in GitLab so only release maintainers can create
+them, and add a GitHub tag ruleset that restricts creating, updating, and
+deleting the same pattern to the mirror/release maintainers. Protect the GitHub
+`release` environment with required reviewers and a deployment tag rule for
+`v*`. GitHub Actions must be enabled on the mirror.
 
 ## Preparing a release
 
@@ -66,8 +92,8 @@ create patterns matching `v*`. GitHub Actions must be enabled on the mirror.
    bun run audit:api
    ```
 
-5. For API changes, run the live audit against a dedicated sandbox. Start
-   read-only:
+5. For API changes, run the sandbox smoke script against a dedicated account.
+   Start read-only:
 
    ```sh
    ASSINAFY_API_KEY='...' \
@@ -105,9 +131,10 @@ create patterns matching `v*`. GitHub Actions must be enabled on the mirror.
 The workflow serializes releases repository-wide and performs these steps:
 
 1. verify that the tag and `package.json` versions match;
-2. install from `bun.lock`, run `verify` and `audit`, and build once;
+2. install from `bun.lock`, run `verify`, dependency and API-contract checks,
+   and build once;
 3. create one `.tgz` with lifecycle scripts disabled and record its SHA-256;
-4. upload that archive and checksum as a one-day workflow artifact;
+4. upload that archive and checksum as a seven-day workflow artifact;
 5. verify and publish the archive to npm through trusted-publisher OIDC; and
 6. verify and publish the **same bytes** to GitHub Packages using
    `GITHUB_TOKEN`.
@@ -120,15 +147,19 @@ contract and must be preserved when editing the workflow.
 ## Verification and recovery
 
 After publishing, confirm that the expected version appears on npm and GitHub
-Packages and that a clean Node.js consumer can import both the ESM and CommonJS
-entrypoints. Compare the downloaded artifacts when registry tooling permits.
+Packages, that a clean Node.js consumer can import both the ESM and CommonJS
+entrypoints, and that registry downloads have the expected checksum.
 
 If packaging or npm publishing fails, fix the source, increment or retain the
 version as registry state allows, and create a new tag only after review. Never
 move a tag that has published a package.
 
+Do not rerun an old release after changing its workflow or trusted-publisher
+coordinates: GitHub reruns use the original commit and ref. Merge the fix and
+create a reviewed new version and tag instead.
+
 If npm succeeds and GitHub Packages fails, rerun only the failed job while the
-original one-day workflow artifact is retained. This preserves the exact
+original seven-day workflow artifact is retained. This preserves the exact
 archive already published to npm. Do not repack an approximation or unpublish a
 released npm version. If the artifact has expired, stop and review recovery with
 the maintainers before changing workflow dependencies or registry state.

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@assinafy/sdk",
-    "version": "2.1.1",
-    "packageManager": "bun@1.3.14",
+    "version": "2.2.0",
+    "packageManager": "bun@1.4.0",
     "description": "TypeScript SDK for Assinafy API - Digital signature platform",
     "type": "commonjs",
     "main": "dist/index.js",
@@ -32,7 +32,7 @@
         "audit:api": "bun scripts/api-contract-audit.ts",
         "prepack": "bun run build",
         "prepublishOnly": "bun run verify && bun run audit",
-        "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.scripts.json && tsc --noEmit -p tsconfig.tests.json",
+        "typecheck": "bun ./node_modules/@typescript/native/bin/tsc --noEmit && bun ./node_modules/@typescript/native/bin/tsc --noEmit -p tsconfig.scripts.json && bun ./node_modules/@typescript/native/bin/tsc --noEmit -p tsconfig.tests.json",
         "verify": "bun run typecheck && bun run lint && bun run test:coverage && bun run build && bun run lint:pkg"
     },
     "keywords": [
@@ -67,19 +67,20 @@
     "devDependencies": {
         "@arethetypeswrong/cli": "^0.18.5",
         "@eslint/js": "^10.0.1",
-        "@types/bun": "^1.3.14",
+        "@types/bun": "^1.4.0",
         "@types/node": "^22.20.1",
-        "eslint": "^10.8.0",
-        "publint": "^0.3.23",
+        "@typescript/native": "npm:typescript@^7.0.2",
+        "eslint": "^10.9.1",
+        "publint": "^0.3.24",
         "tsup": "^8.5.1",
         "typescript": "^6.0.3",
-        "typescript-eslint": "^8.66.0"
+        "typescript-eslint": "^8.68.0"
     },
     "dependencies": {
-        "axios": "^1.19.0"
+        "axios": "^1.20.0"
     },
     "overrides": {
-        "esbuild": "0.28.1",
+        "esbuild": "0.28.2",
         "brace-expansion": "5.0.9"
     },
     "files": [