chore: migrate to pnpm, bump Node matrix to 22/24/26, fix audit vulns

.changeset/typescript-rewrite.md

@@ -0,0 +1,11 @@
+---
+'@evervault/sdk': major
+---
+
+Rewrite the SDK in TypeScript. The package now ships a compiled `dist/` bundle with dual ESM and CommonJS entry points plus bundled type declarations (built with `tsup`), replacing the previously shipped JavaScript source and the `tsc`-generated `types/` directory.
+
+The public API is unchanged: `require('@evervault/sdk')` still returns the `EvervaultClient` class, `import Evervault from '@evervault/sdk'` works for ESM consumers, and every client method keeps the same signature and runtime behaviour (including the on-the-wire encryption formats). This is released as a major version only because the package's internal file layout and `exports` map changed, which can affect consumers that imported internal file paths directly.
+
+Type declarations are resolved per export condition: CommonJS consumers get `export = EvervaultClient` (matching the `module.exports = EvervaultClient` runtime), and ESM consumers get a default export. This keeps `new Evervault(...)` type-checking for plain JavaScript consumers using `// @ts-check` or editor IntelliSense.
+
+Remove unused internal modules (`labs`, `dataHelper`, `environment`) and their dead dependency reference (`big.js` was imported but never installed). Move test-only dependencies `crc-32` to `devDependencies`. Removed dependency on uuid.

.envrc

@@ -0,0 +1 @@
+use flake

.github/workflows/codeql.yml

@@ -32,17 +32,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ['javascript']
+        language: ['javascript-typescript']
         # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
         # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +55,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@v3
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -68,6 +68,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/e2e.yml

@@ -14,24 +14,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [18, 20, 22]
+        node-version: [22, 24, 26]
         os: [ubuntu-latest]
         include:
           - perform-attestation: true
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v4
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node-version }}
-      - run: npm install
-      - run: npm run lint
-      - run: npm run test:e2e
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run format
+      - run: pnpm run test:e2e
         env:
           EV_APP_UUID: ${{ secrets.EV_APP_UUID_V5 }}
           EV_API_KEY: ${{ secrets.EV_API_KEY_V5 }}

.github/workflows/release.yml

@@ -10,15 +10,18 @@ jobs:
       should_publish: ${{ steps.check_release.outputs.should_publish }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Get tags
         run: git fetch --tags origin
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v5
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
-          node-version: '24'
+          node-version-file: '.nvmrc'
+          cache: 'pnpm'
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Create Release Pull Request
         id: changesets
         uses: changesets/action@v1
@@ -31,7 +34,7 @@ jobs:
         id: check_release
         if: steps.changesets.outputs.hasChangesets == 'false'
         run: |
-          npx changeset tag && git push origin --tags
+          pnpm exec changeset tag && git push origin --tags
           COMMIT_TAG=$(git tag --points-at HEAD)
           if [ -n "$COMMIT_TAG" ]; then
             echo "A tag is attached to HEAD. Creating a new release..."
@@ -64,13 +67,16 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v5
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
-          node-version: '24'
+          node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
+          cache: 'pnpm'
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Publish to npm
-        run: npm publish
+        run: pnpm publish --no-git-checks

.github/workflows/test.yml

@@ -12,27 +12,27 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [18, 20, 22]
+        node-version: [22, 24, 26]
         os: [ubuntu-latest]
         include:
           - perform-attestation: true
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v4
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node-version }}
-      - run: npm install
-      - run: npm run lint
-      - run: npm run test:coverage
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run format
+      - run: pnpm run typecheck
+      - run: pnpm run build
+      - run: pnpm run test:coverage
       - run: |
           sudo apt-get update ; sudo apt-get install -y libfaketime
-          LD_PRELOAD=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1 npm run test:filter attestGA
+          # Run mocha directly rather than via `pnpm run`: pnpm hangs when
+          # launched under libfaketime, so only the test process is wrapped.
+          LD_PRELOAD=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1 ./node_modules/.bin/mocha 'tests/**/*.test.js' --grep attestGA
         env:
           FAKETIME: '2023-09-22 11:24:32'
         if: ${{ matrix.perform-attestation }}

.gitignore

@@ -1,4 +1,5 @@
 types
+.direnv
 
 # Logs
 logs

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/bin/sh
 . "$(dirname "$0")/_/husky.sh"
 
-npx lint-staged
+pnpm format

.mocharc.json

@@ -0,0 +1,4 @@
+{
+  "timeout": 30000,
+  "import": "tsx"
+}

.nvmrc

@@ -0,0 +1 @@
+v22.23.1

.prettierignore

@@ -0,0 +1,4 @@
+dist
+node_modules
+coverage
+pnpm-lock.yaml

.prettierrc

@@ -3,6 +3,5 @@ tabWidth: 2
 semi: true
 singleQuote: true
 bracketSpacing: true
-jsxBracketSameLine: false
 arrowParens: 'always'
 insertPragma: false

CONTRIBUTING.md

@@ -8,16 +8,18 @@ Bug reports and pull requests are welcome on GitHub at https://github.com/everva
 
 To make life easier, this module features a code formatter/linter.
 
+This repo uses [pnpm](https://pnpm.io/) as its package manager. If you have [Nix](https://nixos.org/) installed, `nix develop` will drop you into a shell with the correct Node.js and pnpm versions. Otherwise, install pnpm via [Corepack](https://pnpm.io/installation#using-corepack) (`corepack enable pnpm`), which will pick up the pinned version from the `packageManager` field in `package.json`.
+
 You will first need to install all of the dependencies with
 
 ```shell
-npm install
+pnpm install
 ```
 
 after that is done, there are git hooks which need to be installed using [husky](https://github.com/typicode/husky), which can be done through
 
 ```shell
-npm run prepare
+pnpm run prepare
 ```
 
 We use one hook: `pre-commit`.
@@ -28,13 +30,13 @@ The `pre-commit` hook ensures that code is formatted correctly. We use [prettier
 
 It should be possible to configure your editor to run prettier on save, which should make your life easier - have a look at [editor support](https://prettier.io/docs/en/editors.html).
 
-There is a test that is run whenever a pull request is made (`npm run lint`), so please ensure that your code is formatted correctly before committing!
+There is a test that is run whenever a pull request is made (`pnpm run format`), so please ensure that your code is formatted correctly before committing!
 
 ## Commit Formatting & Releases
 
 We use [changesets](https://github.com/changesets/changesets) to version manage in this repo.
 
-When creating a pr that needs to be rolled into a version release, do `npx changeset`, select the level of the version bump required and describe the changes for the change logs. DO NOT select major for releasing breaking changes without team approval.
+When creating a pr that needs to be rolled into a version release, do `pnpm exec changeset`, select the level of the version bump required and describe the changes for the change logs. DO NOT select major for releasing breaking changes without team approval.
 
 To release:
 

flake.nix

@@ -0,0 +1,27 @@
+{
+  description = "Development environment for the Evervault Node.js SDK";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          packages = [
+            pkgs.nodejs_22
+            pkgs.pnpm
+          ];
+        };
+      });
+    };
+}

lib/config.js → lib/config.ts

@@ -1,4 +1,5 @@
-const { version } = require('../package.json');
+import { version } from '../package.json';
+import type { MasterConfig } from './types';
 
 const DEFAULT_API_URL = 'https://api.evervault.com';
 const DEFAULT_TUNNEL_HOSTNAME = 'https://relay.evervault.com:443';
@@ -9,8 +10,7 @@ const DEFAULT_MAX_FILE_SIZE_IN_MB = 25;
 const DEFAULT_ATTEST_POLL_INTERVAL = 120;
 const DEFAULT_PCR_PROVIDER_POLL_INTERVAL = 60;
 
-/** @type {import('./types').MasterConfig} */
-module.exports = {
+const config: MasterConfig = {
   http: {
     baseUrl: process.env.EV_API_URL || DEFAULT_API_URL,
     userAgent: `evervault-node/${version}`,
@@ -61,3 +61,5 @@ module.exports = {
     },
   },
 };
+
+export = config;

lib/core/attestationDoc.js → lib/core/attestationDoc.ts

@@ -1,7 +1,23 @@
-const RepeatedTimer = require('./repeatedTimer');
+import RepeatedTimer from './repeatedTimer';
+import type { HttpClient } from './http';
+import type { MasterConfig } from '../types';
 
 class AttestationDoc {
-  constructor(config, http, enclaves, appUuid, hostname) {
+  appUuid: string;
+  http: HttpClient;
+  enclaves: string[];
+  config: MasterConfig;
+  polling: ReturnType<typeof RepeatedTimer> | null;
+  attestationDocCache: Record<string, string> | null;
+  hostname: string;
+
+  constructor(
+    config: MasterConfig,
+    http: HttpClient,
+    enclaves: string[],
+    appUuid: string,
+    hostname: string
+  ) {
     this.appUuid = appUuid.replace(/_/g, '-');
     this.http = http;
     this.enclaves = enclaves;
@@ -25,21 +41,21 @@ class AttestationDoc {
     return null;
   };
 
-  loadAttestationDoc = async (name) => {
+  loadAttestationDoc = async (name: string) => {
     try {
       const response = await this.http.getAttestationDoc(
         name,
         this.appUuid,
         this.hostname
       );
-      this.attestationDocCache[name] = response.attestation_doc;
+      this.attestationDocCache![name] = response.attestation_doc;
     } catch (e) {
       console.warn(`Couldn't load attestation doc for ${name} ${e}`);
     }
   };
 
-  get = (name) => {
-    const doc = this.attestationDocCache[name];
+  get = (name: string) => {
+    const doc = this.attestationDocCache![name];
     if (!doc) {
       console.warn(`No attestation doc found for ${name}`);
     }
@@ -65,10 +81,10 @@ class AttestationDoc {
   _getAttestationDocs = async () => {
     await Promise.all(
       this.enclaves.map(async (name) => {
-        await this.loadAttestationDoc(name, this.appUuid);
+        await this.loadAttestationDoc(name);
       })
     );
   };
 }
 
-module.exports = AttestationDoc;
+export default AttestationDoc;