@bitsocial/wordfilter-challenge 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/AGENTS.md ADDED
@@ -0,0 +1,40 @@
1
+ # AGENTS Notes
2
+
3
+ Reference source files for this repository:
4
+
5
+ `@pkcprotocol/pkc-js/src/challenges.ts`
6
+ `@pkcprotocol/pkc-js/package.json`
7
+ `@pkcprotocol/pkc-js/docs/protocol/challenge-authoring.md`
8
+ `@pkcprotocol/pkc-js/docs/protocol/challenge-settings.md`
9
+
10
+ Workflow:
11
+
12
+ - Before every commit, run `npm run typecheck` and ensure it passes with no errors.
13
+ - Before every commit, run `npm test` and ensure it passes.
14
+
15
+ Conventions specific to this challenge:
16
+
17
+ - `README.md` is the spec. Behaviour changes belong there first.
18
+ - `src/apply-wordfilters.ts` imports nothing. It runs in a browser, in a publishing client, and its
19
+ behaviour must stay identical to the snippet in the README, which is what most frontends will actually
20
+ copy. They discover the challenge through `community.challenges[i].publicOptions` and never install this
21
+ package.
22
+ - `validateChallengeSettings` is sync and does no network. It runs on every community start, so an async
23
+ validator would turn a third party's outage into a startup problem.
24
+ - `ChallengeFileFactory` never throws. It runs on load as well as on edit, so a throw fails community
25
+ startup rather than the offending edit.
26
+ - Absent publication fields pass. `publication-match` treats a missing property as a failure, which would
27
+ reject every vote. Do not copy that.
28
+
29
+ Releasing:
30
+
31
+ - Releases are automatic. A push to `master` runs CI, and on success `release.yml` runs release-it, which
32
+ bumps the version from the conventional-commit types, tags it, cuts a GitHub release, and publishes to
33
+ npm with provenance.
34
+ - Publishing authenticates with npm trusted publishing (OIDC), not a token. There is no `NPM_TOKEN`
35
+ secret, which is why `release.yml` needs `id-token: write` and why the npm CLI is pinned to `npm@11`.
36
+ - Bootstrapping that is a chicken-and-egg: a trusted publisher is configured under npm's *package*
37
+ settings, so the package has to exist first. The first version was published by hand and has no
38
+ provenance attestation. Every version after it is signed by CI.
39
+ - Never publish by hand once the trusted publisher is configured. A manual publish produces a version
40
+ with no attestation, and the version numbering comes from release-it.