refactor: replace unmaintained partisia rpc package with a native reader client - #120
Merged
Merged
Conversation
|
Total Coverage: 90.01% Coverage Report
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
`partisia-blockchain-applications-rpc` was last published 2024-03-18 and is
no longer maintained. It contributed 33 of the 45 advisories in the partisia
dependency subtrees -- axios (30), form-data (critical + high) and
follow-redirects -- for what are plain GET/POST/PUT calls against the reader
REST API.
Only six of its methods were ever used, and the SDK already talks to that same
API directly through `helpers/client.ts` and `AvlClient`. This adds
`helpers/sharded-client.ts` covering those six against the same endpoints:
deriveShardId int32be at offset 17 of the address, mod shards
getNonce GET {shard}/blockchain/account/{address}
fetchCoins POST {global}/blockchain/accountPlugin/global
getTransaction GET {shard}/blockchain/transaction/{hash}
broadcastTransaction PUT {shard}/blockchain/transaction
getTransactionEventTrace recursive walk over spawned events
`helpers/client.ts` gains `postRequest` and `putRequestOnce` siblings to
`getRequest`. All three go through the existing abort-on-timeout fetch wrapper,
so the new calls inherit the same 30s ceiling as the read path.
`getTransaction` with no shard queries every shard and takes the first hit, as
the rpc package did -- a transaction hash does not encode its shard, and the
event-trace walker depends on that behaviour.
Two behavioural notes:
- `getTransactionForce` looped forever waiting for finality. The replacement
polls 30 times at 1s and then throws, so a stuck transaction surfaces instead
of hanging the caller.
- Broadcasting uses `putRequestOnce`, which does not retry. `promiseRetry`
around a PUT would resubmit the transaction.
`IContractInfo` is replaced by a local `ContractInfo` interface; only `abi` and
`serializedContract` were ever read from it.
Production dependency graph 122 -> 107 packages, axios and mime-db among them.
Bundled with esbuild (--bundle --minify --format=esm --splitting), total bytes
across all chunks 1,192,467 -> 915,298 (-277,169, -23.2%); the 280 KB shared
chunk holding axios is gone. The entry chunk is unchanged at ~343 KB, since
after #119 the rpc client only reached the lazily loaded signing chunks.
21 suites / 269 tests pass against live testnet.
yeboster
force-pushed
the
refactor/official-partisia-client
branch
from
August 29, 2026 09:09
fa1bbef to
bb6d0e5
Compare
|
Total Coverage: 90.67% Coverage Report
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This was referenced Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
partisia-blockchain-applications-rpcwas last published 2024-03-18 and is unmaintained. It is not an official Partisia package — the official, actively maintained ones are the@partisiablockchain/*scope (abi-client 6.198.0, published 2026-07-02), which this SDK already depends on.It accounted for 33 of the 45 advisories across the partisia dependency subtrees:
axiosform-datafollow-redirects…for what are plain GET/POST/PUT calls against the reader REST API.
What
Only six of its methods were ever used, and the SDK already talks to the same reader API directly via
helpers/client.tsandAvlClient. This addshelpers/sharded-client.tscovering those six against the identical endpoints:deriveShardIdgetNonceGET {shard}/blockchain/account/{address}fetchCoinsPOST {global}/blockchain/accountPlugin/globalgetTransactionGET {shard}/blockchain/transaction/{hash}broadcastTransactionPUT {shard}/blockchain/transactiongetTransactionEventTracegetRequestgainedpostRequestandputRequestOncesiblings. All three now route through the same abort-on-timeout fetch wrapper the read path already used, so the new write calls inherit the 30s ceiling rather than being able to hang.IContractInfois replaced by a localContractInfointerface — onlyabiandserializedContractwere ever read from it.Behaviour changes, deliberate
getTransactionwith no shard queries every shard and takes the first hit, matching the rpc package. A transaction hash does not encode its shard, and the event-trace walker depends on this.getTransactionForcelooped forever; the replacement polls 30× at 1s then throws, so a stuck transaction surfaces instead of hanging the caller.putRequestOnce— wrapping a PUT inpromiseRetrywould resubmit the transaction.Measured
Rebased onto current
main(with #115–#119 in), re-measured against it.Production dependency graph,
npm ls --omit=dev --all:main15 removed, none added:
partisia-blockchain-applications-rpc,axios,mime-db,mime-types,form-data,follow-redirects,combined-stream,delayed-stream,asynckit,agent-base,https-proxy-agent,proxy-from-env,es-set-tostringtag,debug,ms.Bundle, esbuild
--bundle --minify --format=esm --splitting --platform=node:mainThe 280,009-byte shared chunk holding axios is gone entirely. The entry chunk is unchanged at ~343 KB: after #119 the rpc client was only reachable from the lazily loaded signing chunks, so this shrinks what a signing consumer downloads, not what a read-only one does.
Test status
npx tsc --noEmitclean,eslintclean,yarn buildclean,npx jest -i— 21 suites / 269 tests pass against the live testnet, including the signing, registration and record-update suites that exercise every replaced method end to end.Remaining production advisories are all
elliptic/bn.jsbeneath the official@partisiablockchain/abi-client. Theresolutionsblock already pinselliptic ^6.6.1, which clears the critical; that entry should also gain"bn.js": "^5.2.3".Not in this PR
partisia-blockchain-applications-crypto(11 advisories, 5 critical) stays. Replacing it with the officialBlockchainTransactionClient/SenderAuthenticationKeyPairis the next step, written up inPLAN-drop-unmaintained-partisia-deps.md.partisia-blockchain-applications-sdkstays too — it is the browser wallet connector and has no official replacement.https://claude.ai/code/session_01GceWCwGXu66D1xEBDxZWBb