@perspectivefi/addresses 0.2.5 → 0.2.7

package/README.md

@@ -100,7 +100,7 @@ Each step is a PR that changes one `status` line (plus the fields it needs).
 
 `source` and `audit` are required for `role-unsafe`, and for `safe` unless the entry's `approval.basis` is something other than `audit` (`prod-baseline`, `external-integration`, `governance`; the evidence is then in the PR, see [POLICY.md](./POLICY.md)).
 
-The on-chain role check reads `owner()`, the EIP-1967 admin slot (and the owner of that admin contract if it is one), and `authority()` for OpenZeppelin AccessManager (`hasRole(0, governance[i])` must be true for at least one governance address, and `hasRole(0, deployer)` must be false). RPC failures on a `safe` entry fail the run.
+The on-chain role check reads `owner()`, the EIP-1967 admin slot (and the owner of that admin contract if it is one), and `authority()` for OpenZeppelin AccessManager (`hasRole(0, governance[i])` must be true for at least one governance address, and `hasRole(0, deployer)` must be false). An owner or proxy-admin owner that is itself an AccessManager, and an AccessManaged proxy admin (it has `authority()` instead of `owner()`), are judged the same way. RPC failures on a `safe` entry fail the run.
 
 Every other check, on every PR:
 
@@ -181,7 +181,7 @@ spectra-addresses check <paths...> [--mode off|enforce] [--allow <json file>]...
 - **Mode**: `--mode`, else env `ADDRESS_GATE`. There are two modes. `off` prints the full report and always exits 0. `enforce` exits 1 on any violation. If `VERCEL_ENV=production` and the mode is unset or invalid, the check exits 1 ("ADDRESS_GATE must be set to off or enforce in production"), so a missing setting can never silently disable protection. Outside production an unset or invalid mode means `off`. `enforce` is not downgraded on preview builds.
 - **Tagged blocks first**: every `$spectraAddresses` block (from `/keys`, `/prod/keys`, the runtime datasets and the runtime denylist) is found, also when its JSON is escaped inside a JS string. For each `(chain, address)` in a block, the exact entry for **that chain** must be `safe` in the latest registry and not denylisted. The report names key and chain. A block that cannot be parsed, or carries anything besides the fields we emit, is a violation. The runtime denylist block is accepted only for addresses the registry itself denylists.
 - **Then bare addresses**: the blocks are cut out and the rest of the file is scanned for EVM addresses and Stellar contract ids. A bare address passes only if it is on an `--allow` list, **or** every registry entry with that address (on any chain) is `safe` and it is denylisted on no chain. Otherwise it is a violation, and the report says which chain made it fail (`blocked`, `unsafe`, `denylisted`, or `not in registry`). A denylisted address fails even if it is on an `--allow` list.
-- **Latest registry**: the check does not use the version your lockfile pins. It fetches the latest `dist/registry.json` from jsDelivr (`https://cdn.jsdelivr.net/npm/@perspectivefi/addresses@latest/dist/registry.json`), then from unpkg (`https://unpkg.com/@perspectivefi/addresses@latest/dist/registry.json`), 10 second timeout each. `--registry <url-or-file>` or env `ADDRESS_REGISTRY_URL` replaces both (the flag wins). The output says which dataset was used.
+- **Latest registry**: the check does not use the version your lockfile pins. jsDelivr and unpkg cache `@latest` URLs for hours, so it first asks npm for the exact latest version (`https://registry.npmjs.org/@perspectivefi/addresses/latest`, printed as `latest published version: x.y.z`) and then fetches `dist/registry.json` of that version from jsDelivr (`https://cdn.jsdelivr.net/npm/@perspectivefi/addresses@<version>/dist/registry.json`), then from unpkg (`https://unpkg.com/@perspectivefi/addresses@<version>/dist/registry.json`), 10 second timeout each. If the npm lookup fails it prints a warning and uses the `@latest` CDN URLs instead. `--registry <url-or-file>` or env `ADDRESS_REGISTRY_URL` replaces all of this (the flag wins; no npm lookup). The output says which dataset was used.
 - **If no source loads**: in `off` the check prints a `WARNING` and uses the dataset bundled in the installed package. In `enforce` it exits 1 ("cannot verify against the latest registry"). `--offline` skips the fetch and uses the bundled dataset on purpose; in `enforce` it prints a loud warning that the run is only as fresh as the installed version.
 - Scans files recursively (skips `*.map`, `cache` and `node_modules` dirs, and binary files over 5 MB).
 - Always allowed: the zero address and `0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE`. `--allow` takes JSON files with an array of address strings (or objects with an `address` field). Use it for token-list addresses. It applies to bare addresses only.
@@ -245,7 +245,7 @@ What this package guarantees, and what it does not.
 After each successful publish, the workflow posts the registry changes to Slack (#nt-deployment-addresses-announcements), most important first:
 
 1. **✅ Approved for prod**: entries whose status changed to `safe` (or that were added as `safe`), with the entry's `approval` reason (string, or `approval.basis`) when it has one.
-2. **⛔ Blocked**: status changes to `blocked` and additions that are `blocked` (these are not repeated under the additions).
+2. **⛔ Blocked**: status changes to `blocked`, additions that are `blocked` (these are not repeated under the additions), and denylist additions and removals (`denylist + 0x…` / `denylist - 0x…`, with the reason). An entry that moved to the denylist is reported here, not as a removal.
 3. New addresses grouped by chain and domain.
 4. Address changes, other status changes, and removals.