Fix/restrict interactive metadata urls

.github/workflows/ci.yml

@@ -11,15 +11,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Lint
         run: bun run lint

.github/workflows/publish.yml

@@ -0,0 +1,123 @@
+name: Publish to npm
+
+on:
+  push:
+    branches:
+      - 'release/**'
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish-beta:
+    if: startsWith(github.ref, 'refs/heads/release/')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Validate
+        run: |
+          bun run lint
+          bun run typecheck
+          bun run test
+
+      - name: Set beta version for this run
+        run: |
+          BASE_VERSION=$(node -p "require('./package.json').version.split('-')[0]")
+          NEXT_VERSION="${BASE_VERSION}-beta.${GITHUB_RUN_NUMBER}"
+          echo "Publishing beta version: ${NEXT_VERSION}"
+          NEXT_VERSION="${NEXT_VERSION}" node - <<'NODE'
+          const fs = require('fs');
+          const path = require('path');
+          const nextVersion = process.env.NEXT_VERSION;
+
+          const pkgPath = path.resolve('package.json');
+          const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+          pkg.version = nextVersion;
+          fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+
+          const lockPath = path.resolve('package-lock.json');
+          if (fs.existsSync(lockPath)) {
+            const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+            lock.version = nextVersion;
+            if (lock.packages && lock.packages['']) {
+              lock.packages[''].version = nextVersion;
+            }
+            fs.writeFileSync(lockPath, JSON.stringify(lock, null, 2) + '\n');
+          }
+          NODE
+
+      - name: Build package
+        run: bun run build
+
+      - name: Publish beta
+        run: npm publish --tag beta --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  publish-latest:
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Validate
+        run: |
+          bun run lint
+          bun run typecheck
+          bun run test
+
+      - name: Verify tag matches package version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PKG_VERSION=$(node -p "require('./package.json').version")
+
+          echo "Tag version: ${TAG_VERSION}"
+          echo "Package version: ${PKG_VERSION}"
+
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "Tag/package version mismatch. Refusing publish."
+            exit 1
+          fi
+
+      - name: Build package
+        run: bun run build
+
+      - name: Publish latest
+        run: npm publish --tag latest --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

ARCHITECTURE.md

@@ -9,15 +9,23 @@ Anchor-Kit is designed to be the "Rails" for Stellar Anchors—opinionated but f
 3.  **Strict State Machines**: Financial transactions follow rigid, unidirectional state transitions to prevent race conditions and double-spending.
 4.  **Developer Experience (DX)**: Inspired by tools like Better-Auth, providing a fluent, clear API.
 
-## Module Breakdown
+## Current Implementation (Foundation)
 
 ### `src/core`
 
-The heart of the SDK.
+- `createAnchor()` and `AnchorInstance` lifecycle (`use`, `init`, plugin registry).
+- `AnchorConfig` for defaults, immutability, and validation.
+- Domain error hierarchy.
 
-- `createAnchor()`: The factory function that initializes the server.
-- **Auth**: SEP-10 implementation details.
-- **Database**: Abstract adapters (Prisma, Postgres) to manage transaction state.
+### `src/types`
+
+- Unified configuration interfaces.
+- Transaction lifecycle and SEP-24 response typing.
+- Foundation and plugin interfaces.
+
+### `src/utils`
+
+- Validation, decimal arithmetic, idempotency handling, crypto/JWT helpers, and Stellar helpers.
 
 ### `src/plugins`
 
@@ -39,11 +47,11 @@ Shared internal services.
 ```
 anchor-kit/
 ├── src/
-│   ├── core/           # Core SDK logic (auth, server factory)
-│   ├── services/       # Shared services (Stellar, Logger, Queue)
+│   ├── core/           # Factory, config, errors, planned protocol stubs
+│   ├── services/       # Planned service layer (currently stubs)
 │   ├── plugins/        # SEP implementations and Rail adapters
-│   ├── utils/          # Helper functions (XDR parsing, etc.)
-│   ├── types/          # TypeScript definitions
+│   ├── utils/          # Runtime utilities
+│   ├── types/          # Public type definitions
 │   └── index.ts        # Public API export
 ├── examples/           # implementing example servers
 ├── tests/              # Vitest test suite