chore(build): improve ci scripts, allowScripts, reduce publish size via files

.github/workflows/test.yml

@@ -22,10 +22,10 @@ jobs:
         run: npm install --package-lock-only && git diff --exit-code package-lock.json
 
       - name: Check formatting
-        run: npm run format:check
+        run: npm run format:ci
 
       - name: Run tests
         run: npm run test
 
       - name: Type check
-        run: npx tsc
+        run: npm run typecheck:ci

.gitignore

@@ -1,2 +1,5 @@
 /node_modules/
 npm-debug.log
+
+# Generated at publish time by prepublishOnly, shipped via package.json files
+index.d.ts.map

.nvmrc

@@ -1 +1 @@
-24.16.0
+24.19.0

CLAUDE.md

@@ -9,14 +9,18 @@ This is the Atomic Transact JavaScript SDK, a browser-based SDK that enables int
 ## Development Commands
 
 - **Test**: `npm test` - Runs Vitest test suite
-- **Build TypeScript definitions**: `npx tsc` - Generates TypeScript declaration files from JavaScript source
-- **Publish**: `npm run publish-it` - Compiles TypeScript definitions and publishes to npm
+- **Format**: `npm run format` - Rewrites `index.js` with Prettier (`npm run format:ci` checks without writing)
+- **Build TypeScript definitions**: `npm run typecheck` - Runs `tsc` to generate declarations from JSDoc comments (`npm run typecheck:ci` also fails if the committed `index.d.ts` is out of date)
+- **Publish**: Publishing is driven by GitHub Releases, not a local command. See [docs/RELEASE.md](docs/RELEASE.md).
+
+Node must satisfy the version in `.nvmrc`; `devEngines` in `package.json` makes npm fail otherwise.
 
 ## Architecture
 
 ### Core Structure
 - **index.js**: Main SDK implementation - single file containing the complete SDK
-- **index.d.ts**: TypeScript definitions (auto-generated from index.js via JSDoc comments)
+- **index.d.ts**: TypeScript definitions (auto-generated from index.js via JSDoc comments). Committed to the repository so public API changes are reviewable, and verified by `typecheck:ci`. Regenerate with `npm run typecheck` and commit the result whenever the API surface changes.
+- **index.d.ts.map**: Not committed. It tracks line offsets in `index.js`, so it is generated at publish time by `prepublishOnly` and shipped via the `files` array.
 - **test/index.spec.js**: Vitest test suite with snapshots
 
 ### SDK Architecture
@@ -28,7 +32,7 @@ The SDK follows a simple pattern:
 ### Key Components
 - **iframe Management**: Creates and styles iframe elements, supports both modal and container modes
 - **PostMessage Communication**: Bidirectional communication with Transact iframe using postMessage API
-- **Event Callbacks**: onInteraction, onDataRequest, onFinish, onClose callbacks for different SDK events
+- **Event Callbacks**: onInteraction, onDataRequest, onFinish, onClose, onOpenUrl callbacks for different SDK events
 - **Product Constants**: Predefined product types (DEPOSIT, VERIFY, IDENTIFY, WITHHOLD)
 
 ### Configuration
@@ -44,4 +48,4 @@ The SDK follows a simple pattern:
 
 ## SDK Version Management
 
-The SDK version is hardcoded in index.js:52 and should be kept in sync with package.json version. This version is sent to Transact servers as part of platform metadata.
+The SDK version in `index.js` is a `__VERSION__` placeholder that `scripts/update-version.js` replaces with the release version at publish time. This version is sent to Transact servers as part of platform metadata.

docs/RELEASE.md

@@ -16,9 +16,9 @@ When a release is published, the [publish workflow](../.github/workflows/publish
 
 1. **Set version** - `npm version` updates `package.json` to match the release tag.
 2. **Install dependencies** - `npm ci` installs dependencies from the lockfile.
-3. **Publish to npm** - `npm publish` publishes the package. Before publishing, the `prepublishOnly` script automatically:
+3. **Publish to npm** - `npm publish` publishes the package. Before packing, the `prepublishOnly` script:
    - Runs `scripts/update-version.js` to replace the `__VERSION__` placeholder in `index.js` with the release version.
-   - Runs `tsc` to generate TypeScript declaration files.
+   - Runs `tsc` to emit `index.d.ts.map`, which lets editors navigate from the published declarations into `index.js`.
 
 ## npm Trusted Publishing
 

package.json

@@ -3,22 +3,31 @@
   "name": "@atomicfi/transact-javascript",
   "description": "Atomic Transact Javascript SDK.",
   "main": "index.js",
+  "types": "index.d.ts",
+  "type": "commonjs",
   "scripts": {
     "test": "vitest run",
-    "format:check": "prettier --check index.js",
     "format": "prettier --write index.js",
+    "format:ci": "prettier --check index.js",
+    "typecheck": "tsc",
+    "typecheck:ci": "npm run typecheck && git diff --exit-code HEAD -- index.d.ts",
     "audit:fix": "npm audit fix --min-release-age=0",
-    "prepublishOnly": "node scripts/update-version.js && npx tsc"
+    "prepublishOnly": "node scripts/update-version.js && npm run typecheck"
   },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "index.d.ts.map"
+  ],
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": ">=24.16.0",
+      "version": ">=24.19.0",
       "onFail": "error"
     },
     "packageManager": {
       "name": "npm",
-      "version": ">=11.13.0",
+      "version": ">=11.17.0",
       "onFail": "error"
     }
   },
@@ -36,6 +45,9 @@
     "typescript": "^4.6.4",
     "vitest": "^4.1.0"
   },
+  "allowScripts": {
+    "fsevents": false
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/atomicfi/atomic-transact-javascript.git"

tsconfig.json

@@ -10,7 +10,8 @@
     // only output d.ts files
     "emitDeclarationOnly": true,
     // go to js file when using IDE functions like
-    // "Go to Definition" in VSCode
+    // "Go to Definition" in VSCode. Generated at publish
+    // time rather than committed, since it tracks line offsets
     "declarationMap": true,
     "lib": ["ES2015", "DOM"]
   }