Update/fix 01

.github/ISSUE_TEMPLATE/bug.yml

@@ -1,63 +1,46 @@
-name: Report Bug 🪲
-description: Create a bug report
-labels:
-  - bug
+name: Bug report
+description: Report a reproducible corebc.js problem
+labels: [bug]
 body:
   - type: markdown
     attributes:
-      value: |
-        Please, provide as much details as possible to make proper evaluation and in the end resolve the bug report faster.
-
-  - type: markdown
-    attributes:
-      value: |
-        Software specific details.
-
+      value: Never include private keys, seed phrases, wallet passwords, or RPC credentials.
   - type: input
-    id: os
+    id: version
     attributes:
-      label: OS and version
-      description: Name and version of OS used.
-      placeholder: OS
+      label: corebc version
+      placeholder: 1.0.0 or commit hash
     validations:
       required: true
-
-  - type: textarea
-    id: bug
+  - type: input
+    id: environment
     attributes:
-      label: Bug
-      description: Describe the Bug.
-      placeholder: Bug description
+      label: Runtime and operating system
+      description: Node.js or browser version, OS, and bundler if applicable.
     validations:
       required: true
-
+  - type: dropdown
+    id: format
+    attributes:
+      label: Package format
+      options: [ESM, CommonJS, Browser bundle]
   - type: textarea
     id: reproduce
     attributes:
-      label: Reproduce Bug
-      description: Steps to reproduce the behavior.
-      placeholder: 1. Step 1
+      label: Minimal reproduction
+      description: Include runnable code, steps, network ID, and CIP number when relevant. Use disposable test keys only.
     validations:
       required: true
-
   - type: textarea
     id: expected
     attributes:
       label: Expected behavior
-      description: Describe the result you are expecting.
-      placeholder: Result
     validations:
       required: true
-
-  - type: input
-    id: hash
-    attributes:
-      label: Commit hash
-      description: Commit hash if known.
-      placeholder: baf2aab0128f07262b564214ec70fc07befc6bb3
-
   - type: textarea
-    id: additional
+    id: actual
     attributes:
-      label: Additional context
-      description: Please, place additional content or screenshots.
+      label: Actual behavior and error output
+      description: Remove secrets and identifying information from logs.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature.yml

@@ -1,43 +1,31 @@
-name: Feature request 🔮
-description: Suggest an idea for this project
-labels:
-  - feature
+name: Feature request
+description: Propose an improvement to corebc.js
+labels: [enhancement]
 body:
-  - type: markdown
-    attributes:
-      value: |
-        Suggest an idea for this project and developers will consider the integration.
-
   - type: textarea
     id: problem
     attributes:
-      label: Problem
-      description: Is your feature request related to a problem? Please describe.
+      label: Problem or use case
     validations:
       required: true
-
   - type: textarea
     id: solution
     attributes:
-      label: Solution
-      description: Describe the solution you'd like.
+      label: Proposed API or behavior
+      description: Include a TypeScript example if possible.
     validations:
       required: true
-
   - type: textarea
     id: alternatives
     attributes:
-      label: Alternatives
-      description: Describe alternatives you've considered.
-
-  - type: textarea
-    id: implementation
+      label: Alternatives considered
+  - type: input
+    id: cip
     attributes:
-      label: Implementation
-      description: Describe implementation with example of the code.
-
+      label: Related CIP or implementation
+      description: Link the specification or a compatible implementation.
   - type: textarea
-    id: additional
+    id: compatibility
     attributes:
-      label: Additional context
-      description: Please, place additional content or screenshots.
+      label: Compatibility and testing
+      description: Describe effects on existing callers, Node.js, browsers, and expected tests.

.github/workflows/nodejs.yml

@@ -1,36 +1,28 @@
-name: Node.js CI
-
+name: Package checks
 on:
   push:
-    branches:
-      - master
-
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
-
-  test-build:
-
+  check:
     runs-on: ubuntu-latest
-
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
-        node-version: [ 16.x, 18.x, 20.x ]
-
+        node: ["22.12.0", "24", "26"]
     steps:
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: ${{ matrix.node-version }}
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Checkout repository
-        uses: actions/checkout@v2
-
-      - name: Install dependencies
-        run: npm install
-
-      - name: Build CommonJS and ESM (from TypeScript)
-        run: npm run build-all
-
-      - name: Run written tests
-        run: npm run test
+          node-version: ${{ matrix.node }}
+          package-manager-cache: false
+      - run: npm install
+      - run: npm run check
+      - run: npm audit --audit-level=high

.github/workflows/publish-npm.yml

@@ -1,21 +1,46 @@
-name: Publish to NPM
+name: Publish to npm
 on:
   release:
     types: [published]
+permissions:
+  contents: read
+concurrency:
+  group: npm-publish
+  cancel-in-progress: false
 jobs:
-  build:
+  publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Setup Node
-        uses: actions/setup-node@v3
+      - uses: actions/checkout@v6
         with:
-          node-version: latest
-          registry-url: 'https://registry.npmjs.org'
-      - name: Install & Build 🔧
-        run: npm i && npm run build
-      - name: Publish package on NPM 📦
-        run: npm publish --access public
+          ref: ${{ github.event.release.tag_name }}
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+      - name: Set up npm trusted publishing
+        run: npm install --global npm@11.19.0
+      - name: Check release version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          node --input-type=module -e 'import fs from "node:fs"; const p = JSON.parse(fs.readFileSync("package.json")); if (process.env.RELEASE_TAG.replace(/^v/, "") !== p.version) throw new Error("Release tag must match package.json version");'
+      - run: npm install
+      - run: npm run check
+      - run: npm audit --audit-level=high
+      - name: Pack validated artifacts
+        run: npm pack --ignore-scripts
+      - name: Publish validated archive
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          if [ "$PRERELEASE" = "true" ]; then
+            npm publish corebc-*.tgz --access public --provenance --tag next
+          else
+            npm publish corebc-*.tgz --access public --provenance --tag latest
+          fi

.gitignore

@@ -1,10 +1,25 @@
-node_modules/**
-output/**
-misc/**
+# Installed dependencies and generated build outputs
+node_modules/
+/dist/
+/lib.esm/
+/lib.commonjs/
+/types/
+/output/
+/coverage/
+.nyc_output/
+*.tsbuildinfo
+
+# Local tooling and temporary files
+/misc/
+.cache/
+.history/
+.env
+.env.*
+!.env.example
+!.env.*.example
 
 **/*.swp
 **/*.tgz
-dist/*.gz
 
 # Logs
 logs
@@ -22,10 +37,13 @@ lerna-debug.log*
 .yarn/install-state.gz
 .pnp.*
 
-# lock files (excluding will cause npm ci inaccessible)
+# This library does not commit package-manager lockfiles.
 package-lock.json
+npm-shrinkwrap.json
 yarn.lock
 pnpm-lock.yaml
+bun.lock
+bun.lockb
 
 # Optional npm cache directory
 .npm

.prettierrc.json

@@ -0,0 +1 @@
+{ "useTabs": true }

CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## 1.0.0
+
+- Support the updated Noble hashes, TypeScript 7, Node types, and Rollup dependencies.
+- Require Node.js 22.12 or newer; regenerate CommonJS through Rollup for ESM dependencies.
+- Correct byte-array signing-key input and use Ed448 for shared secrets and point addition.
+- Fix AES 3 keystore integration and browser crypto parity; bound wallet KDF resources and compare all MAC bytes.
+- Synchronize the exported runtime version with the npm package version.
+- Add typed CIP-150, CIP-151, and CIP-152 helpers, bounded IPFS JSON loading, and exact Core custom-unit balances.
+- Add regression tests, package and browser smoke checks, npm dependency checks, issue forms, and validated npm trusted-publishing workflows.
+- Update package documentation and contributor instructions.
+- Remove committed build artifacts and lockfiles; generate npm distributions from source and use `npm install` in CI and releases.

CONTRIBUTING.md

@@ -0,0 +1,34 @@
+# Contributing to corebc.js
+
+Use Node.js 22.12 or newer (Node.js 24 is used for releases) and npm. Install dependencies with `npm install`. This library does not commit lockfiles; npm may create an ignored local lockfile. CI resolves dependencies from `package.json` on each fresh runner.
+
+```sh
+npm install
+npm run check
+```
+
+Edit TypeScript in `src.ts/`. Use tabs for indentation; `npm run format` applies the repository's Prettier configuration. Add regression tests under `src.ts/_tests/test-*.ts` for behavior changes. Keep private keys and RPC credentials out of issues and logs; test vectors must use disposable keys.
+
+`npm run check` builds ESM, CommonJS, browser bundles, and declarations, checks formatting, runs both Node module test suites, and installs a packed archive into a temporary project to check public exports and TypeScript consumers. It also exercises browser bundles without Node globals. Build outputs are ignored by Git and generated from source for validation and npm publication. Do not commit `dist/`, `lib.esm/`, `lib.commonjs/`, `types/`, or package-manager lockfiles. `npm run clean` removes generated outputs and `npm run build-all` restores them.
+
+The live fee-data test is optional because it depends on an external node:
+
+```sh
+COREBC_RPC_URL=https://your-node.example npm test
+```
+
+Use a node with the Core `xcb_*` RPC API. Ordinary tests need no live blockchain. The package smoke check downloads production dependencies into a temporary directory and therefore needs registry access. Run `npm audit` to inspect dependency advisories.
+
+For CIP changes, link the [proposal](https://cip.coreblockchain.net/), describe supported operations and interoperability vectors, and update the README. Current helpers follow the CIP-150/151/152 and custom-unit work introduced in core_web3dart commit `ec787c8`, with subsequent history reviewed through `e472746`. Custom units are a Core application convention and are not presented as a numbered CIP. Keep token amounts and Unix seconds as `bigint`; use an explicit block reference when related reads need a consistent snapshot.
+
+Open a pull request explaining the problem, changed behavior, and validation. Bug and feature forms are available under GitHub Issues.
+
+## Releases
+
+1. Update `package.json` and `src.ts/_version.ts` to the intended version, install dependencies with `npm install`, and document changes in `CHANGELOG.md`.
+2. Run `npm run check` and commit source, configuration, and documentation changes.
+3. Create a GitHub release whose tag is the version, optionally prefixed with `v`.
+
+The release workflow checks the tag against the package version, reruns validation and the dependency audit, and publishes the validated npm archive with provenance. Both workflows use `npm install` with package-manager caching disabled; npm creates an ephemeral runner lockfile for the dependency audit. GitHub prereleases use the `next` dist-tag; normal releases use `latest`.
+
+Before the first automated release, a package owner must configure an npm trusted publisher for `CorePass/corebc.js`, workflow `publish-npm.yml`. This is an npm account setting, not a repository secret. See [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/). Publishing a GitHub release triggers publication; CI on pull requests does not publish.