ci.yml

name: SDK Integrity Check

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  validate:
    name: Validate SDK
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [20, 22]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}

      - name: Install dependencies
        run: npm install --ignore-scripts

      - name: Verify all imports resolve
        run: |
          node --input-type=module <<'SCRIPT'
          import fs from 'fs';
          import path from 'path';
          import { fileURLToPath } from 'url';

          const __dirname = path.dirname(fileURLToPath(import.meta.url));
          const root = process.cwd();
          let errors = 0;
          let checked = 0;

          function walk(dir) {
            const files = [];
            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
              const full = path.join(dir, entry.name);
              if (entry.name === 'node_modules' || entry.name === '.git') continue;
              if (entry.isDirectory()) files.push(...walk(full));
              else if (full.endsWith('.js') || full.endsWith('.mjs')) files.push(full);
            }
            return files;
          }

          for (const file of walk(root)) {
            const content = fs.readFileSync(file, 'utf8');
            const lines = content.split('\n');
            for (let i = 0; i < lines.length; i++) {
              const line = lines[i];
              // Skip comments (JSDoc examples)
              if (line.trimStart().startsWith('*') || line.trimStart().startsWith('//')) continue;

              const match = line.match(/from\s+['"](\.\.[^'"]+|\.\/[^'"]+)['"]/);
              if (!match) continue;
              checked++;

              const importPath = match[1];
              const resolved = path.resolve(path.dirname(file), importPath);
              if (!fs.existsSync(resolved)) {
                const rel = path.relative(root, file);
                console.error(`MISSING IMPORT: ${rel} -> ${importPath}`);
                console.error(`  Expected at: ${path.relative(root, resolved)}`);
                errors++;
              }
            }
          }

          console.log(`\nChecked ${checked} relative imports across ${walk(root).length} files`);
          if (errors > 0) {
            console.error(`\n${errors} MISSING IMPORT(S) FOUND — commit is broken`);
            process.exit(1);
          } else {
            console.log('All relative imports resolve correctly');
          }
          SCRIPT

      - name: Verify index.js loads all exports
        run: |
          node --input-type=module <<'SCRIPT'
          try {
            const m = await import('./index.js');
            const count = Object.keys(m).length;
            console.log(`index.js loaded successfully: ${count} exports`);
            if (count < 100) {
              console.error(`Expected 100+ exports, got ${count} — modules may be missing`);
              process.exit(1);
            }
          } catch (e) {
            console.error('FAILED to load index.js:', e.message);
            if (e.code === 'ERR_MODULE_NOT_FOUND') {
              console.error('Missing module:', e.url || e.message);
            }
            process.exit(1);
          }
          SCRIPT

      - name: Verify critical function signatures
        run: |
          node --input-type=module <<'SCRIPT'
          const sdk = await import('./index.js');
          const ai = await import('./ai-path/index.js');
          const critical = {
            // SDK core functions must be functions
            connect: sdk.connectDirect, disconnect: sdk.disconnect,
            connectAuto: sdk.connectAuto, listNodes: sdk.queryOnlineNodes,
            createWallet: sdk.createWallet, getBalance: sdk.getBalance,
            broadcast: sdk.broadcast, preflight: sdk.preflight,
            // AI Path functions
            aiConnect: ai.connect, aiDisconnect: ai.disconnect,
            aiStatus: ai.status, aiCreateWallet: ai.createWallet,
            aiGetBalance: ai.getBalance, aiDiscover: ai.discoverNodes,
            aiRecommend: ai.recommend, aiSetup: ai.setup,
          };
          let failed = 0;
          for (const [name, fn] of Object.entries(critical)) {
            if (typeof fn !== 'function') {
              console.error(`MISSING FUNCTION: ${name} is ${typeof fn}`);
              failed++;
            }
          }
          if (failed > 0) { console.error(`${failed} critical functions missing`); process.exit(1); }
          else console.log(`All ${Object.keys(critical).length} critical functions verified`);
          SCRIPT

      - name: Verify package.json files exist
        run: |
          node --input-type=module <<'SCRIPT'
          import fs from 'fs';
          const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
          let errors = 0;

          for (const entry of (pkg.files || [])) {
            // Skip glob patterns (*.js, **/*.ts) — npm handles these, not filesystem checks
            if (entry.includes('*')) continue;
            const clean = entry.replace(/\/$/, '');
            if (!fs.existsSync(clean)) {
              console.error(`MISSING: package.json "files" references "${entry}" but it does not exist`);
              errors++;
            }
          }

          // Verify main and exports
          if (pkg.main && !fs.existsSync(pkg.main)) {
            console.error(`MISSING: package.json "main" points to "${pkg.main}" but it does not exist`);
            errors++;
          }

          if (pkg.exports) {
            for (const [key, val] of Object.entries(pkg.exports)) {
              const target = typeof val === 'string' ? val : val.default || val.import;
              if (target && !fs.existsSync(target)) {
                console.error(`MISSING: package.json exports["${key}"] points to "${target}" but it does not exist`);
                errors++;
              }
            }
          }

          if (errors > 0) {
            console.error(`\n${errors} package.json reference(s) broken`);
            process.exit(1);
          } else {
            console.log(`All package.json file references valid (${(pkg.files || []).length} entries)`);
          }
          SCRIPT

      - name: Verify published tarball imports cleanly
        # Catches packaging regressions where a directory is imported by index.js
        # but missing from package.json "files" — the regression that broke 2.7.1
        # (auth/ + operator/ unpublished, npm install → ERR_MODULE_NOT_FOUND).
        run: |
          set -e
          npm pack --silent
          TARBALL=$(ls blue-js-sdk-*.tgz | head -1)
          VERIFY_DIR=$(mktemp -d)
          cp "$TARBALL" "$VERIFY_DIR/"
          cd "$VERIFY_DIR"
          npm init -y >/dev/null
          npm install "./$TARBALL" --no-audit --no-fund --ignore-scripts --silent
          node --input-type=module <<'SCRIPT'
          try {
            const m = await import('blue-js-sdk');
            const count = Object.keys(m).length;
            if (count < 100) {
              console.error(`Expected 100+ exports from published tarball, got ${count}`);
              process.exit(1);
            }
            console.log(`Published tarball imports cleanly: ${count} exports`);
          } catch (e) {
            console.error('FAILED to import published tarball:', e.message);
            if (e.code === 'ERR_MODULE_NOT_FOUND') {
              console.error('A directory referenced by index.js is missing from package.json "files".');
              console.error('Add it to the "files" array, then rerun npm pack to verify.');
            }
            process.exit(1);
          }
          // Subpath exports must also resolve from the tarball — 2.7.x shipped
          // without ai-path/ in "files" or "./ai-path" in "exports", breaking
          // every AI-agent consumer (ERR_PACKAGE_PATH_NOT_EXPORTED).
          for (const sub of ['blue-js-sdk/ai-path', 'blue-js-sdk/consumer', 'blue-js-sdk/operator']) {
            try {
              const m = await import(sub);
              console.log(`Subpath OK: ${sub} (${Object.keys(m).length} exports)`);
            } catch (e) {
              console.error(`FAILED to import subpath ${sub}:`, e.message);
              console.error('Check package.json "exports" map AND "files" array — both must include it.');
              process.exit(1);
            }
          }
          SCRIPT

      - name: Verify submodule imports resolve
        run: |
          node --input-type=module <<'SCRIPT'
          const modules = [
            './chain/index.js',
            './wallet/index.js',
            './protocol/index.js',
            './security/index.js',
            './pricing/index.js',
            './state/index.js',
            './config/index.js',
            './errors/index.js',
            './cli/index.js',
          ];

          let passed = 0;
          let failed = 0;

          for (const mod of modules) {
            try {
              await import(mod);
              console.log(`  OK: ${mod}`);
              passed++;
            } catch (e) {
              console.error(`FAIL: ${mod} — ${e.message}`);
              failed++;
            }
          }

          console.log(`\nSubmodules: ${passed} passed, ${failed} failed`);
          if (failed > 0) process.exit(1);
          SCRIPT

      - name: Verify no secrets in source
        run: |
          node --input-type=module <<'SCRIPT'
          import fs from 'fs';
          import path from 'path';

          const patterns = [
            { name: 'Hardcoded wallet address', regex: /sent1[a-z0-9]{38}/ },
            { name: 'Hardcoded mnemonic', regex: /^\s*(?:const|let|var|export)?\s*(?:MNEMONIC|mnemonic)\s*=\s*['"](?:(?!process\.env)[a-z ]{20,})['"]/ },
            { name: 'Local Windows path', regex: /C:\\Users\\[A-Za-z]/ },
          ];

          function walk(dir) {
            const files = [];
            for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
              if (e.name === 'node_modules' || e.name === '.git') continue;
              // Skip test fixtures - they legitimately use placeholder addresses
              if (e.isDirectory() && (e.name === 'test' || e.name === 'tests' || e.name === '__tests__')) continue;
              // Skip files starting with 'test-' (root-level test scripts)
              if (e.isFile() && e.name.startsWith('test-') && e.name.endsWith('.js')) continue;
              const p = path.join(dir, e.name);
              if (e.isDirectory()) files.push(...walk(p));
              else if (p.endsWith('.js')) files.push(p);
            }
            return files;
          }

          let errors = 0;
          for (const file of walk('.')) {
            const lines = fs.readFileSync(file, 'utf8').split('\n');
            for (let i = 0; i < lines.length; i++) {
              const line = lines[i];
              const trimmed = line.trimStart();
              // Skip comments — inline docs may reference paths/addresses as examples
              if (trimmed.startsWith('//') || trimmed.startsWith('*')) continue;
              for (const p of patterns) {
                if (p.regex.test(line)) {
                  console.error(`${p.name}: ${file}:${i + 1}`);
                  console.error(`  ${line.trim()}`);
                  errors++;
                }
              }
            }
          }

          if (errors > 0) {
            console.error(`\n${errors} secret(s) found in source — commit blocked`);
            process.exit(1);
          } else {
            console.log('No secrets found in source');
          }
          SCRIPT