@learncard/create-http-bridge 1.1.251 → 1.1.253

package/README.md

@@ -15,10 +15,10 @@ https://docs.learncard.com
 
 ## Install
 
--   Clone this repo
--   Set up AWS CLI
--   Add a .env file exporting a wallet seed (e.g. `WALLET_SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`)
--   Run `bun run serverless-deploy`
+- Clone this repo
+- Set up AWS CLI
+- Add a .env file exporting a wallet seed (e.g. `WALLET_SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`)
+- Run `bun run serverless-deploy`
 
 ## Local VC-API conformance testing
 
@@ -34,8 +34,12 @@ bun --cwd ../../../../packages/plugins/didkit run build
 
 Stop and restart any running bridge after rebuilding; it loads the DIDKit WASM during
 initialization.
-When intentionally rebuilding DIDKit, review the new binary and update
-`EXPECTED_DIDKIT_SHA256` in `scripts/sync-didkit.ts`. To test an unreviewed local artifact
+When intentionally rebuilding DIDKit, review the new binary and run
+`bun scripts/sync-didkit.ts --update-integrity` from this package. Commit the updated
+`EXPECTED_DIDKIT_SHA256` guard together with the plugin artifact. The repository's
+`build-wasm-from-submodules.sh` helper does this explicitly after generation, and the
+WASM update automation includes the guard and artifacts in its PR. Ordinary builds only verify
+the pin; they never update it. To test an unreviewed local artifact
 without changing that pin, set `LOCAL_DIDKIT_PATH` as described below.
 
 Start the LearnCard HTTP bridge in the first terminal:

package/dist/index.js

@@ -416,7 +416,7 @@ const App = ({ name = "LearnCardHTTPBridge" }) => {
 };
 
 var name = "@learncard/create-http-bridge";
-var version = "1.1.251";
+var version = "1.1.253";
 var description = "Instantly create and deploy a Learn Card Bridge HTTP API via AWS Lambda!";
 var main = "dist/index.js";
 var bin = "dist/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/create-http-bridge",
-    "version": "1.1.251",
+    "version": "1.1.253",
     "description": "Instantly create and deploy a Learn Card Bridge HTTP API via AWS Lambda!",
     "main": "dist/index.js",
     "bin": "dist/index.js",
@@ -14,8 +14,8 @@
     "author": "Learning Economy Foundation (www.learningeconomy.io)",
     "license": "MIT",
     "dependencies": {
-        "@learncard/init": "2.4.12",
-        "@learncard/types": "5.18.2",
+        "@learncard/init": "2.4.13",
+        "@learncard/types": "5.18.3",
         "@rollup/plugin-json": "^4.1.0",
         "commander": "^9.3.0",
         "cors": "^2.8.5",

package/scripts/sync-didkit.ts

@@ -1,20 +1,42 @@
 import { createHash } from 'crypto';
 import { readFile, writeFile } from 'fs/promises';
 
-const EXPECTED_DIDKIT_SHA256 = '60efb6027699fda135db0d817f7a541bbd660ae88bec9cbec9796feeb3740b96';
+const EXPECTED_DIDKIT_SHA256 = 'a058bcc6f5e9f037c26e1b29d81dfc8ac94c8e4593ce39fa78f3c2f810796c2e';
 const sourceUrl = new URL(
     '../../plugins/didkit/src/didkit/pkg/didkit_wasm_bg.wasm',
     import.meta.url
 );
 const destinationUrl = new URL('../src/didkit_wasm_bg.wasm', import.meta.url);
+const args = process.argv.slice(2);
+const updateIntegrity = args.length === 1 && args[0] === '--update-integrity';
+
+if (args.length > 0 && !updateIntegrity) {
+    throw new Error('Usage: bun scripts/sync-didkit.ts [--update-integrity]');
+}
+if (updateIntegrity && process.env.LOCAL_DIDKIT_PATH) {
+    throw new Error('Unset LOCAL_DIDKIT_PATH before updating the canonical DIDKit integrity pin.');
+}
+
 if (!process.env.LOCAL_DIDKIT_PATH) {
     const didkit = await readFile(sourceUrl);
     const actualHash = createHash('sha256').update(didkit).digest('hex');
 
-    if (actualHash !== EXPECTED_DIDKIT_SHA256) {
+    if (updateIntegrity && actualHash !== EXPECTED_DIDKIT_SHA256) {
+        // Only intentional artifact generation/review may change the committed guard.
+        const scriptUrl = new URL(import.meta.url);
+        const script = await readFile(scriptUrl, 'utf8');
+        const declaration = `const EXPECTED_DIDKIT_SHA256 = '${EXPECTED_DIDKIT_SHA256}';`;
+        if (!script.includes(declaration)) {
+            throw new Error('Could not locate the DIDKit integrity pin to update.');
+        }
+        await writeFile(
+            scriptUrl,
+            script.replace(declaration, `const EXPECTED_DIDKIT_SHA256 = '${actualHash}';`)
+        );
+    } else if (actualHash !== EXPECTED_DIDKIT_SHA256) {
         throw new Error(
             `DIDKit WASM hash changed: expected ${EXPECTED_DIDKIT_SHA256}, received ${actualHash}. ` +
-                'Review the rebuilt artifact and update EXPECTED_DIDKIT_SHA256 intentionally.'
+                'Review the rebuilt artifact, then run sync-didkit.ts --update-integrity intentionally.'
         );
     }
 

package/tsconfig.json

@@ -1,4 +1,5 @@
 {
+    "extends": "../../tsconfig.library.json",
     "compilerOptions": {
         "lib": ["es2017"],
         "module": "esnext",