Repository navigation
chore: fix main baseline (tsc 0, tests green, build passes, SEP-53 signature fix) - #574
Merged
Darkvader-ship-it merged 13 commits intoOct 20, 2026
Conversation
PhaseFeatureFlag lost phase-146..153, phase-editions and phase-timed-drops, and SecurityCounterName lost ~50 counters used by merged spikes. Restoring them clears 96 of the 120 tsc errors on main. Also registers phase-159, phase-161, phase-162 and phase-163 for spikes 659, 661, 662 and 663.
…chamber modules 0d14b9a ("fixed") re-encoded several files as cp1252-decoded UTF-8 and prepended a BOM plus // @ts-nocheck. User-facing strings in the chamber (e.g. "Transacción", "…") shipped corrupted, and a few glyphs (●, ”) were lost outright. Files with no later commits are restored from 0d14b9a^; files edited since get only their mojibake comments repaired. 60001c5 (PHASE-STELLAR#33 refactor) moved ChamberLogStream, ChamberCatalogThumb, PhaserLiqTokenLink and the chamber chrome classes out of fusion-chamber into components/chamber/* but never committed those files, and left five one-word "placeholder" files behind. The four modules are recreated verbatim from the code it deleted; the unused placeholder imports and files are removed.
- offers accept route: spike 674 collab-split fan-out (3e4b562), with the splits binding hoisted so the response can actually read it - IpfsDisplayImg: `fallback` prop destructure (b89c4f2) - wash-screening: washScreenReasonForEdition (3e4b562) - viewer-signature: viewerSignatureShort (f9a08b6; removed by 7cc03e4 while three components still import it) - sqlite-db: exhibitions, price_suggestions, moderation_queue and quest_arcs tables (b89c4f2). Their absence failed 27 tests.
Real bugs the type errors were hiding: - nft-index subscribe: validateWebhookUrl accepted https://127.0.0.1 and every 172.16/12, 100.64/10 and 0/8 literal (SSRF). Now a proper IPv4 range check. - lib/stellar.ts settle verification read meta v1/v3 only and called ContractEventV0.contractId(), which no longer exists, so every settle check fell through to SETTLE_EVENT_NOT_FOUND. It now reads meta v4 (protocol 23) and v3 and takes the emitter from ContractEvent. Still fails closed on any mismatch. - artist-attestation passed a string where an ScAddress is required and decoded an already-decoded retval, so attestation never read true. Also: winback route called a nonexistent addNotification (now createNotification with a winback_reactivation type), wallet-provider declared `controller` twice, duplicate `ok` keys in ve-lock, and Buffer/Uint8Array typing in the ipfs and avatar routes. wallet-provider and stellar.ts are also restored from the 0d14b9a encoding damage.
- artist-profile-client imported describe/it from node:test, so vitest
found no suite
- world-roles-rbac seeded worldRoles.json while the store reads
world-roles.json (serverDataJsonPath("worldRoles"))
- avatar-provenance hashed a string through the bytes-only sha256Hex;
encoding first gives the same digest
- forge-pipeline imported bun:test; the APIs it uses are identical in vitest
- viewer-authorization: Buffer typing for Keypair.sign
eslint.config.mjs imports eslint-config-next, which was never installed, so npm run lint failed outright. dotenv is imported by scripts that the root test suite loads (scripts/reset-phase.ts).
- ethnum 1.5.2 -> 1.5.3 in both lockfiles: 1.5.2 fails to compile on rustc 1.97 (E0512 transmute), which broke cargo test for both crates - mock-token test called an associated fn as a method outside a contract context; it now goes through the generated MockTokenClient phase-protocol still does not compile: see the baseline notes. Three merged spikes each claimed PhaseError discriminants from 18 upward.
tsc is at 0 errors and vitest is green on this branch, so both can gate PRs now. docs/investigations/main-baseline-2026-10-17.md records what was fixed and what is blocked (phase-protocol discriminant collision).
…lient) lib/stellar-wallet-kit.ts is loaded by the wallet provider on every route and imported randomUUID from node:crypto. The client polyfill has no randomUUID, so hydration threw and nothing interactive rendered. The nonce path is browser-only, so it now uses globalThis.crypto.randomUUID().
SEP-53 wallets sign SHA256("Stellar Signed Message:\n" + message). Signals,
world roles, avatar ownership and gated-preview viewer auth verified the
raw prefixed bytes instead, so every real Freighter signature was rejected
with "Invalid signature: payload not signed by this wallet". The unit
tests passed only because they signed the same raw bytes.
- lib/viewer-signature.ts: sep53SignedBytes + verifySep53Signature, used
by verifySignalSignature, verifyWorldRoleSignature and the avatar route
- lib/viewer-authorization.ts: viewerSignatureBytes is now the SHA-256
digest the wallet's key actually signs
- tests sign like a wallet; the official SEP-53 spec vectors are a
regression test; tests/viewer-authorization.test.ts used an address
unrelated to its seed and could never pass
Resolve lib/feature-flags.ts: keep the restored phase-146..153, editions and timed-drops members alongside upstream phase-158..161. The spike flags move to their own branches.
ExcelDsigN-tech
added a commit
to ExcelDsigN-tech/Phase
that referenced
this pull request
Oct 18, 2026
ExcelDsigN-tech
added a commit
to ExcelDsigN-tech/Phase
that referenced
this pull request
Oct 18, 2026
ExcelDsigN-tech
added a commit
to ExcelDsigN-tech/Phase
that referenced
this pull request
Oct 18, 2026
ExcelDsigN-tech
added a commit
to ExcelDsigN-tech/Phase
that referenced
this pull request
Oct 18, 2026
This was referenced Oct 18, 2026
Closed
Resolves conflicts in the wallet provider, fusion chamber, security counters, wallet kit, flags and copy. Registers phase-170..173, types the new copy blocks, restores the legal data paths and QR scanner imports, and drops the re-added @ts-nocheck and mojibake.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainat74308a0did not type-check, test, or build. This branch restores it so the spike PRstsc --noEmitvitest runnext buildnpm run linteslint-config-next)cargo testmock-tokencargo testphase-protocolWhat was fixed
PhaseFeatureFlagandSecurityCounterName(94 of the 120 tsc errors).// @ts-nocheck).FusionChamberComponent (122KB Monolith) into Modular Sub-Components #33): missing modules recreated from the deleted code, placeholder files removed.IpfsDisplayImgfallback,washScreenReasonForEdition,viewerSignatureShort, four b89c4f2 tables).lib/stellar-wallet-kit.tsimportedrandomUUIDfromnode:cryptoin browser code. It now usesglobalThis.crypto.randomUUID().SHA256("Stellar Signed Message:\n" + message), so real Freighter signatures were always rejected. All four now useverifySep53Signature, tested against the official SEP-53 vectors. Confirmed live: a Freighter-signedsignals.createon testnet returns 201 withsignature_verified: true.validateWebhookUrl, settle verification inlib/stellar.tsthat could never succeed, artist attestation never readingtrue, a winback route calling a missing function.Needs a maintainer decision
contracts/phase-protocoldoesn't compile: three merged spikes each numbered newPhaseErrorvariants from 18 (economy 18–39, editions 18–21 in 3e4b562, raffle 18–33 in dd3e75c). Fixing it means picking new on-chain error codes for two of the three sets and updatingspikeContractErrorCode, so I left it for you. Which numbering do you want, and is any of these WASMs already deployed?Full write-up:
docs/investigations/main-baseline-2026-10-17.md.Also found, not fixed
phase-142/phase-143are each used for two features.connect-srcblocksapi.coingecko.comandtimeapi.io, so the ticker never loads.