chore(deps): update dependencies, expand catalogs, add knip + remove dead code by venables · Pull Request #114 · agentcommercekit/ack

venables · 2026-06-20T13:38:07Z

Summary

Dependency/maintenance pass across the monorepo. (The CRITICAL credential-forgery security fix that came out of this work is in a separate PR (#113) for focused review.)

Dependencies

@agentcommercekit/keys crypto majors (the one published-package change): @noble/curves 1→2 (real API migration — .js subpaths, p256 from nist.js, randomSecretKey, Point.fromBytes), @solana/codecs-strings 2→6, multiformats 13→14, uint8arrays 5→6. Public API unchanged; 111 keys tests pass.
uuid 11→14, @hono/node-server 1→2, drizzle 0.45, @libsql/client 0.17, vite-tsconfig-paths 6, @inquirer/prompts 8, wrap-ansi 10, plus all safe minor/patch bumps (hono, jose, valibot, viem, turbo, vitest, changesets, tsx…). Bumped the root engines.node to >=22.13.0 to match the new floor.
Held back, deliberately: zod 3→4 (published peer; intentional dual v3/v4 support), did-resolver (did-jwt pins ^4), @a2a-js/sdk 0.3 + express 5 (the SDK pins express 4 — express 5's path-to-regexp v8 breaks the demo's empty-path route), AI SDK v6 / Solana kit v6 (major rewrites), TS 6 / oxlint 1.70 / oxfmt / @types/node 26 (tooling churn / lint-rule churn / lockfile instability). Each can be its own follow-up.

Catalogs

Already comprehensive — every cross-package dependency is cataloged. Refreshed all catalog versions.

knip

Added knip + knip.json + a pnpm knip script, then removed what it found: unused deps (jose, safe-stable-stringify, @solana-program/system, @types/figlet), dead code, redundant exports, and two vestigial broken main fields. Exits clean.

⚠️ Security hardening included

fix(api-utils): gate unsigned-payload bypass behind explicit opt-in flag — the signed-payload validator's unsigned-payload dev bypass was gated on NODE_ENV=development (which the issuer example ships by default), so the reference issuer ran with an auth bypass enabled by default. It now requires an explicit, default-off ALLOW_UNSIGNED_PAYLOADS flag and logs a loud warning when used. Nothing in the repo sends X-Payload-Issuer, so no flow/test depends on it.

Verification

Full pnpm run check (build + types + lint + test, 47 tasks) is green; knip and manypkg check are clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Added ALLOW_UNSIGNED_PAYLOADS="true" to allow unsigned request payloads for local testing, using X-Payload-Issuer; signature verification is only bypassed when explicitly enabled.
Dependencies
- Upgraded cryptographic and related libraries to newer major versions for improved compatibility.
- Updated various tooling and demo dependencies (including Ethereum client utilities).
Documentation
- Updated the issuer authentication docs and .env.example to reflect the new flag-based unsigned-payload flow.
Refactor
- Reduced exported surface in demos by removing a few exported demo helpers/exports.
Chores
- Added Knip configuration and updated repository tooling scripts/versions.

Bump non-breaking dependency versions across the catalog and workspace: - catalog: hono 4.12.2->4.12.26, jose 6.1.3->6.2.3, valibot 1.2.0->1.4.1, viem 2.46.3->2.52.2, @hono/standard-validator 0.1.5->0.2.2, standard-parse 0.4.0->0.5.0 - root: @changesets/cli 2.29.8->2.31.0, @changesets/changelog-github 0.5.2->0.7.0, tsx 4.21.0->4.22.4, turbo 2.8.10->2.9.18, vitest 4.0.18->4.1.9 - cli-tools: figlet 1.10.0->1.11.0, strip-ansi 7.1.2->7.2.0 Annotate demos/payments publicClient with an explicit PublicClient type to avoid TS7056 (inferred type too large to serialize) introduced by the viem bump. oxlint/oxlint-tsgolint intentionally held back: the latest versions enable new default rules (vitest plugin + type-aware) that surface 75 errors and 121 warnings against the repo's existing intentional patterns (branded-type assertions, established test style). Adopting them belongs in a dedicated PR. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Bump @agentcommercekit/keys cryptographic dependencies: - @noble/curves 1.9.1 -> 2.2.0 - @solana/codecs-strings 2.1.1 -> 6.10.0 - multiformats 13.4.2 -> 14.0.0 - uint8arrays 5.1.0 -> 6.1.1 Migrate the curve modules to the @noble/curves v2 API: - subpath imports now require the .js extension (@noble/curves/ed25519 -> @noble/curves/ed25519.js) - the P-256 curve moved to the nist entry point (@noble/curves/p256 -> import { p256 } from "@noble/curves/nist.js") - utils.randomPrivateKey() -> utils.randomSecretKey() - ExtendedPoint/ProjectivePoint -> Point, and .fromHex(bytes) -> .fromBytes(bytes) for public-key validation All 111 keys tests pass; full monorepo check is green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- catalog: uuid 11.1.0 -> 14.0.0 (v4 API unchanged) - catalog: @hono/node-server 1.19.9 -> 2.0.5 (serve API compatible) Full check is green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- examples/issuer: drizzle-orm 0.43.1->0.45.2, drizzle-kit 0.31.9->0.31.10, @libsql/client 0.15.15->0.17.4, vite-tsconfig-paths 5.1.4->6.1.1 - demos/identity-a2a: express 4.21.2->5.2.1 (aligns with already-v5 @types/express) - tools/cli-tools: @inquirer/prompts 7.5.1->8.5.2, wrap-ansi 9.0.0->10.0.0 Full monorepo check (build + types + lint + test) is green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

@deprecated

Add knip (with a monorepo-aware knip.json) and a `pnpm knip` script, then act on its findings: Unused dependencies removed: - demos/identity-a2a: jose, safe-stable-stringify (code uses native JSON.stringify) - demos/payments: @solana-program/system (only @solana-program/token is used) - tools/cli-tools: @types/figlet (figlet 1.11 ships its own types) Dead code removed: - demos/identity-a2a: unused isRpcSuccessResponse helper - demos/skyfire-kya: unused SkyFireKYAPayload interface (+ now-unused JwtPayload import) Unnecessary exports demoted to local (used only within their own file): - BankClientAgent, issuerDidDocument (identity-a2a), skyfireKyaJwtPayloadSchema (skyfire-kya) Vestigial broken package.json "main" fields removed (pointed at nonexistent files; packages are consumed via subpath exports / tsconfig extends): - tools/api-utils (main -> ./src/index.ts), tools/typescript-config (main -> ./base.js) The two remaining knip "duplicate exports" are intentional @deprecated public aliases in @agentcommercekit/keys (bytesToJwk, jwkToBytes); the duplicates rule is set to "warn" so knip still exits 0. Full check + manypkg are green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- demos/identity: pin zod to the catalog (3.25.4). The viem 2.46->2.52 bump introduced an optional viem<->zod peer that pnpm resolved to zod 4.4.3, which the AI SDK packages (zod ^3 peers) were then grouped onto — a peer violation. Pinning zod 3 in the demo makes @ai-sdk/* resolve their zod peer correctly. (flagged by codex [MEDIUM] + claude [LOW]) - root: raise engines.node ">=22" -> ">=22.13.0" to reflect the real floor introduced by @inquirer/prompts 8 (^22.13.0) and knip (>=22.12.0). (flagged by codex [MEDIUM]) - keys: fix copy-paste JSDoc on secp256r1 isValidPublicKey ("secp256k1" -> "secp256r1"). (flagged by opencode [LOW]) Foregone: opencode's "knip only covers examples/*" — a misread; knip scans all workspaces by default, the config only customizes entry points for examples (that is how it found the unused demo exports). knip exits 0; full check green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Panel review round 2 flagged that bumping the identity-a2a demo to express 5 (done in 14f4195) is unsafe: @a2a-js/sdk@0.2.2 declares `express ^4.21.2` and its `A2AExpressApp.setupRoutes` registers `app.post(baseUrl, ...)` — with the demo's empty baseUrl that is `app.post("", ...)`, an empty-path route that express 5's path-to-regexp v8 handles differently and can throw on at startup, leaving `pnpm demo:identity-a2a` dead on arrival. The express 5 bump adds no value to a demo running against an express-4-pinned SDK, so revert to 4.21.2 (restoring the known-green baseline). express 5 for this demo should wait until @a2a-js/sdk supports it. (flagged by claude [MEDIUM]; opencode NO_FINDINGS; codex timed out mid-review) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Security hardening (MEDIUM): the signed-payload validator's dev escape hatch — accept an unsigned payload with an attacker-supplied `X-Payload-Issuer` header, skipping signature verification — was gated on `NODE_ENV === "development"`. `examples/issuer/.env.example` ships `NODE_ENV="development"`, so the reference issuer ran with this authentication bypass enabled by default, and any deploy that sets/defaults `NODE_ENV` to "development" would be fully bypassable. Decouple the bypass from `NODE_ENV` and require an explicit, default-off `ALLOW_UNSIGNED_PAYLOADS="true"` flag, and log a loud SECURITY warning whenever the bypass path is taken. Nothing in the repo sends `X-Payload-Issuer`, so no automated flow or test depends on it. Documented the flag (off) in the issuer .env.example. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-06-20T13:39:17Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 785cedff-d769-445b-be81-ee6ca7341103

📥 Commits

Reviewing files that changed from the base of the PR and between 08f895e and 844da04.

📒 Files selected for processing (1)

.changeset/keys-noble-curves-v2.md

✅ Files skipped from review due to trivial changes (1)

.changeset/keys-noble-curves-v2.md

Walkthrough

This PR migrates @agentcommercekit/keys to the @noble/curves v2 API (new import paths, randomSecretKey, Point.fromBytes), replaces the NODE_ENV-based unsigned-payload bypass in signedPayloadValidator with an explicit ALLOW_UNSIGNED_PAYLOADS environment variable, adds Knip dead-code tooling, removes Knip-flagged unused exports and dependencies across demos, and bumps a wide range of catalog and package-level dependencies.

Changes

@noble/curves v2 migration

Layer / File(s)	Summary
Dependency bumps and changeset `packages/keys/package.json`, `.changeset/keys-noble-curves-v2.md`	Pins `@noble/curves` to 2.2.0, `@solana/codecs-strings` to 6, `multiformats` to 14, `uint8arrays` to 6, and adds the patch changeset entry.
Curve API migration `packages/keys/src/curves/ed25519.ts`, `packages/keys/src/curves/secp256k1.ts`, `packages/keys/src/curves/secp256r1.ts`	Updates all three curve modules to `.js` entrypoints, `utils.randomSecretKey()` for key generation, and `Point.fromBytes()` for public-key validation.

ALLOW_UNSIGNED_PAYLOADS bypass flag

Layer / File(s)	Summary
Middleware logic, docs, and package cleanup `tools/api-utils/src/middleware/signed-payload-validator.ts`, `tools/api-utils/package.json`, `examples/issuer/.env.example`, `examples/issuer/README.md`	Replaces the `NODE_ENV === "development"` bypass with `ALLOW_UNSIGNED_PAYLOADS === "true"`, adds `v.safeParse` validation and `console.warn`, documents the flag in `.env.example` and README, and removes the stale `main` field from `api-utils/package.json`.

Knip tooling, export cleanup, and dependency updates

Layer / File(s)	Summary
Knip config and monorepo script `knip.json`, `package.json`	Adds `knip.json` with workspace entry globs and a `duplicates` warn rule; adds the `knip` script and bumps root `devDependencies` including `knip` and node engine floor to `>=22.13.0`.
Knip-flagged export and dep removals `demos/identity-a2a/src/...`, `demos/skyfire-kya/src/...`, `demos/identity/package.json`, `demos/payments/...`	Removes unused exports (`BankClientAgent`, `issuerDidDocument`, `isRpcSuccessResponse`, `SkyFireKYAPayload`, `skyfireKyaJwtPayloadSchema`), drops unused deps (`jose`, `safe-stable-stringify`, `@solana-program/system`), adds explicit `PublicClient` type annotation, and adds `zod` to `demos/identity`.
Catalog and package dep bumps `pnpm-workspace.yaml`, `examples/issuer/package.json`, `tools/cli-tools/package.json`, `tools/typescript-config/package.json`	Bumps catalog entries (`hono`, `jose`, `valibot`, `viem`, etc.), issuer example deps (`@libsql/client`, `drizzle-orm`, `drizzle-kit`, `vite-tsconfig-paths`), cli-tools deps, removes `@types/figlet`, and removes the `main` field from `tools/typescript-config`.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

agentcommercekit/ack#47: Previously switched the issuer example from better-sqlite3 to @libsql/client; this PR bumps @libsql/client from 0.15.15 to 0.17.4 in the same examples/issuer/package.json.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the primary changes: dependency updates, catalog expansion, knip tooling addition, and dead code removal. It is specific and directly reflects the changeset's scope.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch organize-share-repo

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/keys/package.json`:
- Around line 59-62: The dependencies "`@noble/curves`", "`@solana/codecs-strings`",
"multiformats", and "uint8arrays" in packages/keys/package.json are using pinned
version numbers instead of the workspace catalog specifier. Replace each raw
version string (e.g., "2.2.0", "6.10.0", "14.0.0", "6.1.1") with the "catalog:"
prefix to ensure version consistency across the monorepo and maintain the
workspace dependency management flow.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d6c00c4b-6afe-4421-a9e0-d84b52375f75

📥 Commits

Reviewing files that changed from the base of the PR and between 87d1de4 and 08f895e.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (24)

.changeset/keys-noble-curves-v2.md
demos/identity-a2a/package.json
demos/identity-a2a/src/bank-client-agent.ts
demos/identity-a2a/src/issuer.ts
demos/identity-a2a/src/utils/response-parsers.ts
demos/identity/package.json
demos/payments/package.json
demos/payments/src/constants.ts
demos/skyfire-kya/src/kya-token.ts
demos/skyfire-kya/src/skyfire-kya-ack-id.ts
examples/issuer/.env.example
examples/issuer/README.md
examples/issuer/package.json
knip.json
package.json
packages/keys/package.json
packages/keys/src/curves/ed25519.ts
packages/keys/src/curves/secp256k1.ts
packages/keys/src/curves/secp256r1.ts
pnpm-workspace.yaml
tools/api-utils/package.json
tools/api-utils/src/middleware/signed-payload-validator.ts
tools/cli-tools/package.json
tools/typescript-config/package.json

💤 Files with no reviewable changes (5)

demos/identity-a2a/src/utils/response-parsers.ts
demos/payments/package.json
demos/identity-a2a/package.json
tools/api-utils/package.json
demos/skyfire-kya/src/skyfire-kya-ack-id.ts

Swapping the bundled crypto implementation across four dependency majors warrants a minor bump even though the public API is unchanged, so downstream consumers notice. (panel review #114) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

venables and others added 9 commits June 19, 2026 21:58

chore(deps): bump uuid and @hono/node-server to latest majors

506aa0a

- catalog: uuid 11.1.0 -> 14.0.0 (v4 API unchanged) - catalog: @hono/node-server 1.19.9 -> 2.0.5 (serve API compatible) Full check is green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore: add changeset for keys crypto dependency upgrade

08f895e

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coderabbitai Bot reviewed Jun 20, 2026

View reviewed changes

Comment thread packages/keys/package.json

venables mentioned this pull request Jun 20, 2026

fix(vc,ack-pay): bind credential verification to the verified proof (credential forgery) #113

Merged

venables merged commit e5c6951 into main Jun 20, 2026
3 checks passed

venables deleted the organize-share-repo branch June 20, 2026 17:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependencies, expand catalogs, add knip + remove dead code#114

chore(deps): update dependencies, expand catalogs, add knip + remove dead code#114
venables merged 10 commits into
mainfrom
organize-share-repo

venables commented Jun 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 20, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

venables commented Jun 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Dependencies

Catalogs

knip

⚠️ Security hardening included

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

venables commented Jun 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 20, 2026 •

edited

Loading