Regenerating the lockfile picked up a newer @cardano-sdk/crypto release that
dropped its errant npm-CLI runtime dependency, clearing the critical tar
advisory and 42 other advisories that traced back to it (44 -> 1, the
remainder a dev-only esbuild low). A defensive overrides pin on tar and
brace-expansion is retained per plan but is empirically not what resolved
this - documented honestly in README.md and the task report.
engines.node raised to >=22 everywhere (root + all three packages), matching
the CI workflow's node-version and the Dockerfile's node:22-alpine base
(both already agreed; no discrepancy to reconcile).
postinstall no longer symlinks libsodium with `ln -sf ... || true`, which
silently no-opped on Windows and left a runtime ERR_MODULE_NOT_FOUND.
scripts/link-libsodium.mjs copies the file cross-platform instead, logs one
line, and exits non-zero on genuine failure.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The signer's security claim is that it cannot reach the network, not that it
chooses not to. test/boundary.test.ts enforces that mechanically over both the
import graph and the manifest.
packages/builder is publishable (private:false) but depended on the
private workspace package at runtime - a published manifest would
advertise an unresolvable dependency. tsup's noExternal inlines it into
the bundle, so devDependencies is the correct home.
Also removes the root tsconfig.json, which still pointed at the deleted
src/, and corrects two README paths the move invalidated.
Pure file moves plus import repointing at the shared package. Removes
duplicated endpoint constants and formatting helpers that were copied
across three files. Verified: 23 tools with identical schemas.
npm install regenerated package-lock.json for the workspaces conversion.
Without it, npm ci on a fresh clone cannot resolve the workspace layout
and CI fails.
