@kasufinance/kasu-sdk 2.3.0 → 2.4.0

package/.github/workflows/gitleaks.yml

@@ -0,0 +1,22 @@
+name: gitleaks
+
+on:
+  push:
+    branches: [main, master, develop]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks
+          ./gitleaks git --redact --no-banner .

package/.github/workflows/main.yml

@@ -1,4 +1,8 @@
-name: Publish to npm
+name: Verify release tag
+
+# npm publishes are intentionally manual (policy: always run `npm publish`
+# locally as a kasu_finance org member). This workflow only verifies the
+# pushed tag matches package.json — it does NOT publish.
 
 on:
   push:
@@ -8,14 +12,13 @@ on:
   workflow_dispatch:
 
 jobs:
-  publish:
+  verify:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Get tag version
         id: tag_version
@@ -32,16 +35,7 @@ jobs:
       - name: Ensure tag matches package.json
         run: |
           if [ "${{ steps.tag_version.outputs.TAG_VERSION }}" != "${{ steps.package_version.outputs.PACKAGE_VERSION }}" ]; then
-            echo "Tag version ${{ steps.tag_version.outputs.TAG_VERSION }} does not match package.json version ${{ steps.package_version.outputs.PACKAGE_VERSION }}."
+            echo "Tag ${{ steps.tag_version.outputs.TAG_VERSION }} does not match package.json ${{ steps.package_version.outputs.PACKAGE_VERSION }}."
             exit 1
           fi
-
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 18
-          registry-url: https://registry.npmjs.org/
-          scope: '@kasufinance'
-
-      - run: npm install && npm run build-tc && npm run build && npm run rollup-build && npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+          echo "Tag ${{ steps.tag_version.outputs.TAG_VERSION }} matches package.json. Run 'npm publish' locally to release."

package/.gitleaksignore

@@ -0,0 +1,19 @@
+# Baseline: historical findings triaged 2026-08-11 (real ones rotated, rest false positives).
+# New findings will still fail CI. Format: commit:file:rule:line
+0a13e5c82c4b0dea51a1bca2bcffd4dbe7d9e9c8:src/config/sdk/mainnet.config.ts:generic-api-key:9
+0a13e5c82c4b0dea51a1bca2bcffd4dbe7d9e9c8:src/config/sdk/testnet.config.ts:generic-api-key:9
+1a0e64886602fdbb0789b72e3be80460dfb2a9bc:src/tests/sample.test.ts:generic-api-key:18
+41992e186efdd602e49a07a9cfaa17a046194afd:src/tests/sample.test.ts:generic-api-key:20
+61345a2c016dd28bd3fe647b01ae92321f4e6797:src/config/sdk/mainnet.config.ts:generic-api-key:9
+61345a2c016dd28bd3fe647b01ae92321f4e6797:src/config/sdk/testnet.config.ts:generic-api-key:9
+678e94f28e9894246569775e06b7bfc145c90db9:src/config/sdk/mainnet.config.ts:generic-api-key:9
+678e94f28e9894246569775e06b7bfc145c90db9:src/config/sdk/testnet.config.ts:generic-api-key:9
+76241c92f25050ca6b73e77ce0514abc8c5038d8:src/config/sdk/mainnet.config.ts:generic-api-key:9
+76241c92f25050ca6b73e77ce0514abc8c5038d8:src/config/sdk/testnet.config.ts:generic-api-key:9
+aa4522559522cf1f207b834fbd0318ef96f1f635:src/app/api/kyc-challenge/route.ts:generic-api-key:5
+c65a422c4f96ba302c047fe1a4e3d6d74dcc2744:src/facade/chain-configs.ts:generic-api-key:18
+cee7050d62ae95f1b6d88592de8eaff576719d28:src/tests/sample.test.ts:generic-api-key:18
+f085d18b3b818f5853a934aee12ce1611afc738e:src/config/sdk/mainnet.config.ts:generic-api-key:9
+f085d18b3b818f5853a934aee12ce1611afc738e:src/config/sdk/testnet.config.ts:generic-api-key:9
+f92e12c74df7990a519eec7c4940a655cbaa3160:src/actions/getTokenPrice.ts:generic-api-key:52
+fc75e2491f414032d69a352f7a0e1fcd3f515f99:.env.local:generic-api-key:2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@kasufinance/kasu-sdk",
-    "version": "2.3.0",
+    "version": "2.4.0",
     "description": "",
     "main": "dist/bundle.cjs.js",
     "module": "dist/bundle.esm.js",

package/src/services/DataService/data-service.ts

@@ -352,6 +352,7 @@ export class DataService {
 
                     return {
                         id: tranche.id,
+                        balance: tranche.balance,
                         apy: baseApy.toString(),
                         minApy: minApy.toString(),
                         maxApy: maxApy.toString(),
@@ -445,6 +446,7 @@ export class DataService {
                     lendingPoolDirectus?.poolName ??
                     lendingPoolSubgraph.name,
                 subheading: lendingPoolDirectus?.subheading,
+                operatingSince: lendingPoolDirectus?.operatingSince,
                 totalValueLocked: {
                     total: (
                         parseFloat(lendingPoolSubgraph.balance) +

package/src/services/DataService/directus-types.ts

@@ -34,6 +34,7 @@ export interface PoolOverviewDirectus {
     id: string;
     poolName?: string;
     subheading?: string;
+    operatingSince?: string;
     enabled: boolean;
     oversubscribed: boolean;
     security: string[];

package/src/services/DataService/types.ts

@@ -6,6 +6,11 @@ import {
 export interface PoolOverview {
     poolName: string;
     subheading?: string;
+    /**
+     * Month/year the strategy began operating, editor-authored in Directus.
+     * Absent until the CMS column is populated.
+     */
+    operatingSince?: string;
     id: string;
     enabled: boolean;
     isOversubscribed: boolean;
@@ -87,6 +92,11 @@ export interface RiskPerformance {
 
 export interface TrancheData {
     id: string;
+    /**
+     * Current amount lent through this tranche, in the pool's stable-asset
+     * units, from the subgraph tranche entity.
+     */
+    balance: string;
     minApy: string;
     maxApy: string;
     apy: string;