@easy1staking/cip113-sdk-ts 0.3.0 → 0.4.0

package/README.md

@@ -60,6 +60,26 @@ await client.awaitTx(txHash);
 
 ## Examples
 
+> ### ⚠ The examples do not currently run. Do not follow this section yet.
+>
+> Two things are wrong with it, both known and neither hidden:
+>
+> 1. **The scripts target a superseded protocol.** They are written against a CIP-113 **0.3.x**
+>    deployment on preprod. This SDK now targets **0.5.0-alpha.2**, in which
+>    `programmable_logic_global` no longer exists and `DeploymentParams` has a different shape.
+>    The scripts cannot work against that deployment, and the deployment cannot be represented
+>    by this SDK.
+> 2. **`.env.example` does not exist.** The `cp` below has never worked.
+>
+> **Nothing here is covered by CI** — `examples/` is a separate package, outside the root
+> typecheck and outside the test suite, so neither defect can fail a build.
+>
+> Choosing a replacement target is an open decision (a local devnet, or a freshly deployed
+> preprod instance); it is tracked in `PLAN.md` under workstream **W-E, slice S-7**. Until it is
+> made, the working end-to-end reference is the **devnet suite** — `npm run test:devnet` — which
+> exercises bootstrap, register, mint, transfer, third-party transfer and an in-place upgrade
+> against a live chain. See `docs/devnet.md`.
+
 The `examples/` directory contains runnable scripts for the full token lifecycle:
 
 ```bash

package/blueprints/standard/v0.3.0/UPSTREAM_PIN.json

@@ -0,0 +1,30 @@
+{
+  "artifact": "plutus.json",
+  "sha256": "b4f54412c84dc8d6c1e03892a9c45750d0e7da2669e0150d95e8f0fa38274284",
+  "declares": {
+    "title": "iohk/programmable-tokens",
+    "version": "0.3.0",
+    "compiler": "Aiken v1.1.21+42babe5",
+    "validators": 16
+  },
+  "upstream": {
+    "repo": "https://github.com/cardano-foundation/cip113-programmable-tokens",
+    "note": "Same repository; it was named iohk/programmable-tokens until the 0.3.0 -> 0.4.0 bump (renamed between 2026-04-28 and 2026-06-24). Not a separate protocol lineage.",
+    "commit": null
+  },
+  "blueprint_reproduced": false,
+  "provenance": "UNVERIFIED",
+  "verified": {
+    "date": "2026-08-14",
+    "findings": [
+      "This file matches NO commit in upstream's plutus.json history, searched across every commit touching that path on all refs fetched locally (main, pull/99/head, pull/102/head). It is not any upstream release or intermediate commit.",
+      "Scope caveat: unfetched upstream PR branches were not searched. The defensible claim is unverifiable provenance, NOT that the file was fabricated.",
+      "It IS internally consistent with the deployment this repo ships: all 6 derivable script hashes reproduce examples/shared/deployment-preprod.ts exactly (see assertDeploymentScripts). The artifact is unattested, not wrong.",
+      "For contrast, the abandoned dev/bafin-substandard branch carried a different plutus.json under this same v0.3.0 directory name, byte-identical to upstream commit 81438534f83550789e13961db17b59d606cf8a8e. Four of eight validator hashes differ between the two."
+    ]
+  },
+  "reproduce": {
+    "requires": "Aiken v1.1.21+42babe5",
+    "note": "The installed toolchain is machine-global and currently v1.1.22 (needed for upstream 0.5.0-alpha.1). Reproducing this artifact requires a toolchain switch, which is arbitrated - do not run aikup unilaterally."
+  }
+}

package/blueprints/standard/v0.5.0-alpha.2/UPSTREAM_PIN.json

@@ -0,0 +1,33 @@
+{
+  "artifact": "plutus.json",
+  "sha256": "bd297f36e9e955d814fb3a67fbc7e51c2344b54d952d38b03ef9f32c1d43b9ad",
+  "declares": {
+    "title": "cardano-foundation/cip113-programmable-tokens",
+    "version": "0.5.0-alpha.2",
+    "compiler": "Aiken v1.1.23+8949565",
+    "validators": 27
+  },
+  "upstream": {
+    "repo": "https://github.com/cardano-foundation/cip113-programmable-tokens",
+    "commit": "9db7e0629a1509cc9d41d069f0ef0ed251601173",
+    "ref": "main",
+    "note": "PINNED TO THE COMMIT, NOT THE VERSION STRING. Upstream publishes NO git tags at all (`git ls-remote --tags` returns nothing); \"0.5.0-alpha.2\" is a `version` field inside plutus.json on a MOVING branch, so it will eventually name two different programs. The commit is the identity; the version string is a label. See PLAN.md D-11."
+  },
+  "blueprint_reproduced": true,
+  "provenance": "VERIFIED",
+  "reproduce": {
+    "requires": "Aiken v1.1.23+8949565",
+    "command": "git clone https://github.com/cardano-foundation/cip113-programmable-tokens && git checkout 9db7e0629a1509cc9d41d069f0ef0ed251601173 && aikup install v1.1.23 && aiken build",
+    "note": "`aikup install v1.1.23` with the version explicit, never bare `aikup install`, which follows latest and will stop reproducing this artifact the moment v1.1.24 ships."
+  },
+  "verified": {
+    "date": "2026-08-24",
+    "method": "REPRODUCED FROM SOURCE",
+    "findings": [
+      "OBSERVED: `aiken build` at upstream commit 9db7e06, with Aiken v1.1.23+8949565, produced a plutus.json BYTE-IDENTICAL to the one upstream commits at that same commit. Both sha256 bd297f36e9e955d814fb3a67fbc7e51c2344b54d952d38b03ef9f32c1d43b9ad, both 114406 bytes, `cmp` clean. The build ran in an isolated extraction (`git archive`), not in a working tree that already contained the artifact; upstream's committed copy was moved aside before the build so it could not be mistaken for output.",
+      "This is the first blueprint this repository ships whose provenance is OBSERVED rather than asserted. Contrast blueprints/standard/v0.3.0, pinned UNVERIFIED with commit null: it matches NO commit in upstream's plutus.json history.",
+      "OBSERVED: the toolchain requirement is exact, not a floor. The machine-global Aiken was v1.1.22+39d6b04 and was moved to v1.1.23+8949565 to perform this build (reversible: `aikup install v1.1.22`). The artifact's own preamble declares v1.1.23+8949565.",
+      "DERIVED: because the pin is keyed to a commit on a moving branch, re-running `aiken build` against `main` at a LATER date will legitimately produce a different artifact. That is not drift in this pin — it is a new pin. Do not update this file's sha256 to make a newer build pass; add a new directory."
+    ]
+  }
+}