@perspectivefi/addresses 0.2.5 → 0.2.6

package/README.md

@@ -181,7 +181,7 @@ spectra-addresses check <paths...> [--mode off|enforce] [--allow <json file>]...
 - **Mode**: `--mode`, else env `ADDRESS_GATE`. There are two modes. `off` prints the full report and always exits 0. `enforce` exits 1 on any violation. If `VERCEL_ENV=production` and the mode is unset or invalid, the check exits 1 ("ADDRESS_GATE must be set to off or enforce in production"), so a missing setting can never silently disable protection. Outside production an unset or invalid mode means `off`. `enforce` is not downgraded on preview builds.
 - **Tagged blocks first**: every `$spectraAddresses` block (from `/keys`, `/prod/keys`, the runtime datasets and the runtime denylist) is found, also when its JSON is escaped inside a JS string. For each `(chain, address)` in a block, the exact entry for **that chain** must be `safe` in the latest registry and not denylisted. The report names key and chain. A block that cannot be parsed, or carries anything besides the fields we emit, is a violation. The runtime denylist block is accepted only for addresses the registry itself denylists.
 - **Then bare addresses**: the blocks are cut out and the rest of the file is scanned for EVM addresses and Stellar contract ids. A bare address passes only if it is on an `--allow` list, **or** every registry entry with that address (on any chain) is `safe` and it is denylisted on no chain. Otherwise it is a violation, and the report says which chain made it fail (`blocked`, `unsafe`, `denylisted`, or `not in registry`). A denylisted address fails even if it is on an `--allow` list.
-- **Latest registry**: the check does not use the version your lockfile pins. It fetches the latest `dist/registry.json` from jsDelivr (`https://cdn.jsdelivr.net/npm/@perspectivefi/addresses@latest/dist/registry.json`), then from unpkg (`https://unpkg.com/@perspectivefi/addresses@latest/dist/registry.json`), 10 second timeout each. `--registry <url-or-file>` or env `ADDRESS_REGISTRY_URL` replaces both (the flag wins). The output says which dataset was used.
+- **Latest registry**: the check does not use the version your lockfile pins. jsDelivr and unpkg cache `@latest` URLs for hours, so it first asks npm for the exact latest version (`https://registry.npmjs.org/@perspectivefi/addresses/latest`, printed as `latest published version: x.y.z`) and then fetches `dist/registry.json` of that version from jsDelivr (`https://cdn.jsdelivr.net/npm/@perspectivefi/addresses@<version>/dist/registry.json`), then from unpkg (`https://unpkg.com/@perspectivefi/addresses@<version>/dist/registry.json`), 10 second timeout each. If the npm lookup fails it prints a warning and uses the `@latest` CDN URLs instead. `--registry <url-or-file>` or env `ADDRESS_REGISTRY_URL` replaces all of this (the flag wins; no npm lookup). The output says which dataset was used.
 - **If no source loads**: in `off` the check prints a `WARNING` and uses the dataset bundled in the installed package. In `enforce` it exits 1 ("cannot verify against the latest registry"). `--offline` skips the fetch and uses the bundled dataset on purpose; in `enforce` it prints a loud warning that the run is only as fresh as the installed version.
 - Scans files recursively (skips `*.map`, `cache` and `node_modules` dirs, and binary files over 5 MB).
 - Always allowed: the zero address and `0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE`. `--allow` takes JSON files with an array of address strings (or objects with an `address` field). Use it for token-list addresses. It applies to bare addresses only.

package/dist/cli.js

@@ -30,12 +30,14 @@ var BUILTIN_ALLOW = [
 ];
 var TAG = "$spectraAddresses";
 var DATASET_FIELDS = /* @__PURE__ */ new Set(["chain", "key", "address", "kind", "status", "inherit"]);
-var DEFAULT_REGISTRY_URLS = [
-  "https://cdn.jsdelivr.net/npm/@perspectivefi/addresses@latest/dist/registry.json",
-  "https://unpkg.com/@perspectivefi/addresses@latest/dist/registry.json"
+var NPM_LATEST_URL = "https://registry.npmjs.org/@perspectivefi/addresses/latest";
+var registryUrls = (version) => [
+  `https://cdn.jsdelivr.net/npm/@perspectivefi/addresses@${version}/dist/registry.json`,
+  `https://unpkg.com/@perspectivefi/addresses@${version}/dist/registry.json`
 ];
+var SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var FETCH_TIMEOUT_MS = 1e4;
-var BUNDLED_VERSION = true ? "0.2.5" : "dev";
+var BUNDLED_VERSION = true ? "0.2.6" : "dev";
 var USAGE = `Usage: spectra-addresses check <paths...> [--mode off|enforce] [--allow <json file>]... [--registry <url|file>] [--offline]
 
   --mode    off or enforce. Falls back to env ADDRESS_GATE, then to off.
@@ -45,7 +47,7 @@ var USAGE = `Usage: spectra-addresses check <paths...> [--mode off|enforce] [--a
   --allow   JSON file: array of address strings, or objects with an "address" field.
             Repeatable. Typical use: the token-list addresses. Applies to bare addresses only.
   --registry  Registry dataset to check against: URL or JSON file. Falls back to env
-            ADDRESS_REGISTRY_URL, then the latest published package (jsDelivr, then unpkg).
+            ADDRESS_REGISTRY_URL, then the latest published package (version from npm, read via jsDelivr, then unpkg).
             If no source can be loaded: off warns and uses the bundled dataset, enforce fails.
   --offline Skip the fetch and use the dataset bundled in this package.`;
 var VIOLATIONS = ["not-safe", "denied", "unknown", "malformed"];
@@ -140,6 +142,15 @@ function parseDataset(json) {
   });
   return json;
 }
+async function resolveLatestVersion(fetchFn) {
+  const res = await fetchFn(NPM_LATEST_URL, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const version = (await res.json())?.version;
+  if (typeof version !== "string" || !SEMVER_RE.test(version)) {
+    throw new Error('no valid "version" in the response');
+  }
+  return version;
+}
 async function loadFromSource(source, cwd, fetchFn) {
   if (!/^https?:\/\//i.test(source)) {
     return parseDataset(JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path.resolve)(cwd, source), "utf8")));
@@ -306,16 +317,27 @@ ${USAGE}`);
     }
   } else {
     const override = args.registry ?? (env.ADDRESS_REGISTRY_URL?.trim() || void 0);
-    const sources = override ? [override] : DEFAULT_REGISTRY_URLS;
+    const fetchFn = opts.fetch ?? globalThis.fetch;
     const failures = [];
+    let sources;
+    if (override) {
+      sources = [override];
+    } else {
+      try {
+        const version = await resolveLatestVersion(fetchFn);
+        out(`latest published version: ${version}`);
+        sources = registryUrls(version);
+      } catch (e) {
+        out(
+          `WARNING: could not resolve the latest version on npm (${e.message}); falling back to the @latest CDN URLs, which can be cached for hours.`
+        );
+        sources = registryUrls("latest");
+      }
+    }
     let loaded;
     for (const source of sources) {
       try {
-        dataset = await loadFromSource(
-          source,
-          cwd,
-          opts.fetch ?? globalThis.fetch
-        );
+        dataset = await loadFromSource(source, cwd, fetchFn);
         loaded = source;
         break;
       } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@perspectivefi/addresses",
-    "version": "0.2.5",
+    "version": "0.2.6",
     "description": "Contract address registry for Spectra: one list of every address, each with a status. Prod only accepts `safe`.",
     "main": "./dist/index.js",
     "module": "./dist/index.mjs",