From fd89b8be6c74145187b72c12b55677b9936cfb0b Mon Sep 17 00:00:00 2001
From: Rob Konsdorf <rob@facings.io>
Date: Thu, 16 Jul 2026 11:04:31 -0400
Subject: [PATCH] chore: make npm publish build dist and gate on the
 npm-publish environment

A bare npm publish ships a tarball whose main and types point at dist/index.js
and dist/index.d.ts, but the deprecated prepublish hook does not run on
npm publish or npm pack under modern npm, so a maintainer who tags and
publishes without a local dist/ around ships a broken package. Replacing it
with prepack (build) and prepublishOnly (test) restores that guarantee on
every pack and publish. The tsconfig exclude for spec files stops compiled
test specs riding along in dist as tarball bloat, and the engines field and
README pin the supported Node baseline to the versions CI actually runs
against. The publish workflow ties a pushed vX.Y.Z tag to a required-reviewer
npm-publish environment so the first and every subsequent publish needs
maintainer sign-off before npm ever sees a token.
---
 .github/workflows/publish.yml | 55 +++++++++++++++++++++++++++++++++++
 README.md                     |  2 +-
 package.json                  |  6 +++-
 tsconfig.json                 |  2 +-
 4 files changed, 62 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..376239d
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,55 @@
+name: Publish
+
+# Tag-triggered publish to npm. A pushed v* tag starts the run, but the
+# publish step is gated on maintainer sign-off through the npm-publish
+# environment and authenticates with that environment's NPM_TOKEN secret.
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    # Required-reviewer environment: a pushed tag queues the publish until a
+    # maintainer approves the run, and the environment scopes the NPM_TOKEN
+    # secret so no other workflow can read it. id-token stays enabled for
+    # npm provenance attestation.
+    environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+          cache: yarn
+
+      - name: Upgrade npm
+        # Trusted publishing (OIDC) needs npm >= 11.5.1; the Node 22 image
+        # ships npm 10.x.
+        run: npm install -g npm@latest
+
+      - name: Verify tag matches package version
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match package.json version $version" >&2
+            exit 1
+          fi
+
+      - name: Install
+        run: yarn install --frozen-lockfile
+
+      - name: Build
+        run: yarn run build
+
+      - name: Test
+        run: yarn run test
+
+      - name: Publish
+        run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/README.md b/README.md
index 9652e0a..2220d94 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ The focus of VeRT is on the better compatibility than the performance, so it can
 ## Requirement
 
 - WebAssembly binary with exported memory
-- Nodejs v16 or higher (JavaScript runtime with WebAssembly BigInt support)
+- Nodejs v20 or higher (JavaScript runtime with WebAssembly BigInt support)
 
 ## Chain compatibility
 
diff --git a/package.json b/package.json
index 3f6713c..c1613c3 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,9 @@
   "description": "Testing library for Antelope smart contracts, with per-chain host function parity",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "engines": {
+    "node": ">=20"
+  },
   "files": [
     "dist",
     "src"
@@ -14,7 +17,8 @@
     "build-web": "webpack",
     "start": "node dist/index",
     "test": "mocha src/**/*.spec.ts -r ts-node/register && yarn --cwd examples",
-    "prepublish": "npm run test && npm run build"
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run test"
   },
   "author": "Jeeyong Um <conr2d@gmail.com>",
   "license": "MIT",
diff --git a/tsconfig.json b/tsconfig.json
index 17380bf..010497d 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -11,5 +11,5 @@
     "experimentalDecorators": true
   },
   "lib": ["es2020"],
-  "exclude": [ "examples/**/*" ]
+  "exclude": [ "examples/**/*", "src/**/tests/**", "**/*.spec.ts" ]
 }