@integraledger/lcp-binding-evm-common 0.18.0 → 0.18.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +72 -0
  2. package/package.json +6 -6
package/CHANGELOG.md CHANGED
@@ -1,5 +1,77 @@
1
1
  # @integraledger/lcp-binding-evm-common
2
2
 
3
+ ## 0.18.2
4
+
5
+ ### Patch Changes
6
+
7
+ - Eight published CHANGELOGs name a private repository; this supersedes them
8
+
9
+ `0.18.1` is on the registry carrying the name of a private repository in eight packages' `CHANGELOG.md`.
10
+ Measured against the published tarballs rather than the tree — one occurrence each in
11
+ `binding-evm-common`, `binding-evm-escrow`, `binding-evm-mpp`, `binding-evm-x402`, `binding-stellar`,
12
+ `binding-sui`, `discovery` and `evidence`, against a control of **0** in `lcp-kernel`, which is not among
13
+ the eight. The query discriminates; the eight is a measurement.
14
+
15
+ `CHANGELOG.md` is in every one of those packages' `files`, so npm packs it. A consumer holding the
16
+ tarball meets a repository they cannot open — a reference that cannot be followed, and a disclosure that
17
+ the repository exists.
18
+
19
+ ⛔ **A published version cannot be recalled, only superseded.** The text is corrected in the tree, but
20
+ `0.18.1` keeps what it shipped: anyone pinning that version still gets it. This bump is the only thing
21
+ that puts a clean CHANGELOG where `latest` resolves.
22
+
23
+ ⭐ **No gate could have caught this, and the reason is worth stating.** `check:published-parity` compares
24
+ only files under a declared SOURCE directory — `CHANGELOG.md` is outside its subject set by design, since
25
+ comparing build output and generated prose would make it noisy rather than sharper. So parity reports
26
+ `31 of 31, byte for byte` and is *correct* while the disclosure sits in the artifact. `no-private-referents`
27
+ now sweeps CHANGELOGs in the tree, which stops the next one; neither gate reads a published tarball.
28
+
29
+ ⇒ The class that remains open: **a disclosure that exists only in a published artifact is measured by
30
+ nothing here.** The tree is clean, parity is green, and the registry is not.
31
+
32
+ Patch, and the whole `@integraledger/lcp-*` line moves with it — that is what the `fixed` group is for.
33
+ Nothing in any package's behaviour, exports or types changes.
34
+ - @integraledger/lcp-authority@0.18.2
35
+ - @integraledger/lcp-binding-core@0.18.2
36
+ - @integraledger/lcp-kernel@0.18.2
37
+
38
+ ## 0.18.1
39
+
40
+ ### Patch Changes
41
+
42
+ - The line converges on one `zod`, one `viem`, one `@mysten/sui` and one `@stellar/stellar-sdk`
43
+
44
+ The catalogue moved in `75ec0f4` and nothing was released from it, which left the published line
45
+ declaring one set of versions and this repository's source declaring another. Seven packages carry those
46
+ four names in their **published** manifests, so the bump is a change to what consumers must resolve —
47
+ not an internal one:
48
+
49
+ ```
50
+ @stellar/stellar-sdk 17.0.0 -> 17.0.1 lcp-binding-stellar
51
+ @mysten/sui 2.26.2 -> 2.29.0 lcp-binding-sui
52
+ zod 4.4.3 -> 4.5.4 lcp-discovery
53
+ viem 2.55.19 -> 2.56.3 lcp-binding-evm-{common,escrow,mpp,x402}
54
+ ```
55
+
56
+ ⭐ **A PATCH, and the choice is load-bearing rather than cosmetic.** Consumers declare these packages as
57
+ `^0.18.0` peers, and a caret on a `0.x` range is MINOR-LOCKED: `^0.18.0` accepts `0.18.1` and refuses
58
+ `0.19.0`. A minor would therefore force every consumer to edit its peer floor before it could resolve at
59
+ all — turning a dependency convergence into a breaking-change sweep across two repositories. Nothing in
60
+ the public surface changed; only the versions these packages ask their host to supply.
61
+
62
+ ⛔ **WHY IT HAD TO BE RELEASED RATHER THAN LEFT.** A private downstream consumer runs a shared-pin gate,
63
+ which compares its catalogue against what the **published** `@integraledger/*` tarballs declare, read out
64
+ of `node_modules`. With the catalogue moved here and nothing published, that gate reported the line at two
65
+ versions of each name and its `protocol-integration` job went red **with no commit landing in that
66
+ repository to explain it**. Two copies of `zod` in one tree is not a bookkeeping complaint: schemas built
67
+ by one copy fail `instanceof` against the other, and no type-checker sees it.
68
+
69
+ Measured before cutting this: with the catalogue converged, that repository's whole gate passes against
70
+ this line — every stage, 2013 + 731 tests. The divergence was the only finding.
71
+ - @integraledger/lcp-authority@0.18.1
72
+ - @integraledger/lcp-binding-core@0.18.1
73
+ - @integraledger/lcp-kernel@0.18.1
74
+
3
75
  ## 0.18.0
4
76
 
5
77
  ### Patch Changes
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@integraledger/lcp-binding-evm-common",
3
- "version": "0.18.0",
3
+ "version": "0.18.2",
4
4
  "description": "Shared EVM machinery for LCP rail bindings: typed-data construction and signature verification.",
5
5
  "keywords": [
6
6
  "lcp",
@@ -43,15 +43,15 @@
43
43
  },
44
44
  "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/binding-evm-common#readme",
45
45
  "dependencies": {
46
- "@integraledger/lcp-authority": "0.18.0",
47
- "@integraledger/lcp-binding-core": "0.18.0",
48
- "@integraledger/lcp-kernel": "0.18.0",
49
- "viem": "2.55.19"
46
+ "@integraledger/lcp-authority": "0.18.2",
47
+ "@integraledger/lcp-binding-core": "0.18.2",
48
+ "@integraledger/lcp-kernel": "0.18.2",
49
+ "viem": "2.56.3"
50
50
  },
51
51
  "devDependencies": {
52
52
  "@types/node": "24.13.3",
53
53
  "fast-check": "4.9.0",
54
- "vitest": "4.1.11"
54
+ "vitest": "5.0.0"
55
55
  },
56
56
  "license": "Apache-2.0",
57
57
  "engines": {