Regenerating the lockfile picked up a newer @cardano-sdk/crypto release that
dropped its errant npm-CLI runtime dependency, clearing the critical tar
advisory and 42 other advisories that traced back to it (44 -> 1, the
remainder a dev-only esbuild low). A defensive overrides pin on tar and
brace-expansion is retained per plan but is empirically not what resolved
this - documented honestly in README.md and the task report.
engines.node raised to >=22 everywhere (root + all three packages), matching
the CI workflow's node-version and the Dockerfile's node:22-alpine base
(both already agreed; no discrepancy to reconcile).
postinstall no longer symlinks libsodium with `ln -sf ... || true`, which
silently no-opped on Windows and left a runtime ERR_MODULE_NOT_FOUND.
scripts/link-libsodium.mjs copies the file cross-platform instead, logs one
line, and exits non-zero on genuine failure.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The signer's security claim is that it cannot reach the network, not that it
chooses not to. test/boundary.test.ts enforces that mechanically over both the
import graph and the manifest.
