fix(ci): use npm publish for OIDC token exchange; remove conflux-cas refs; fix docs

Author: SPCFXDA

.env.example

@@ -2,8 +2,8 @@
 # Copy to .env and fill in real values. Never commit .env.
 #
 # This file is read by:
-#   - conflux-contracts/hardhat.config.ts   (dotenv path: '../.env')
-#   - conflux-cas/scripts/deploy.ts         (dotenv path: '../../.env')
+#   - devtools/contracts/hardhat.config.ts   (dotenv path: '../.env')
+#   - devtools/contracts/scripts/deploy.ts   (dotenv path: '../../.env')
 #
 # ─── Deployer wallet ──────────────────────────────────────────────────────────
 # 0x-prefixed private key for the account that will deploy contracts.

.github/workflows/release.yml

@@ -107,29 +107,28 @@ jobs:
           name: build-artifacts
 
       # ── 1. Publish all @cfxdevkit/* library packages ───────────────────────
-      # pnpm handles topological publish order (respects workspace:* deps).
-      # --no-git-checks skips the "working tree must be clean" check that
-      # fails on tag checkouts.
+      # IMPORTANT: Use `npm publish` (not `pnpm publish`) so the npm CLI can
+      # automatically exchange the GitHub OIDC token for a short-lived npm
+      # credential. `pnpm publish` does NOT trigger the OIDC token exchange,
+      # which causes "Access token expired" + E404 even when trusted publishing
+      # is correctly configured on npmjs.com.
+      #
       # Provenance attestation is generated automatically by npm when publishing
       # via OIDC trusted publishing — no --provenance flag needed.
       - name: Publish @cfxdevkit/* packages
         run: |
-          pnpm publish \
-            --filter './packages/*' \
-            --recursive \
-            --access public \
-            --no-git-checks \
-            --report-summary
+          for pkg_dir in packages/*/; do
+            pkg_name=$(node -p "require('./${pkg_dir}package.json').name")
+            echo "\n--- Publishing ${pkg_name} ---"
+            npm publish "${pkg_dir}" --access public
+          done
 
       # ── 2. Publish the conflux-devkit CLI ──────────────────────────────────
-      # Published separately (after the scoped packages) because its package.json
-      # lists workspace:* deps that pnpm rewrites to real versions at publish time.
-      # The CLI bundles all @cfxdevkit/* code via tsup noExternal so npm users
-      # get a standalone binary — @cfxdevkit/* are in devDependencies, not deps.
-      - name: Publish conflux-devkit CLI
+      # `pnpm pack` normalises workspace:* dependency versions in package.json
+      # to real semver before creating the tarball so the published package.json
+      # is clean. We then hand the tarball to `npm publish` so the OIDC token
+      # exchange still happens via the npm CLI.
+      - name: Pack + Publish conflux-devkit CLI
         run: |
-          pnpm publish \
-            --filter conflux-devkit \
-            --access public \
-            --no-git-checks \
-            --report-summary
+          pnpm pack -C devtools/devkit --pack-destination .
+          npm publish ./conflux-devkit-*.tgz --access public

.gitignore

@@ -50,7 +50,7 @@ Thumbs.db
 ._ignore/
 
 # ── Certificates (local dev TLS) ─────────────────────────────────────────────
-conflux-cas/frontend/certificates/
+# (project-specific TLS certs or frontend artifacts)
 
 # ── Dev-only artifacts (not part of submission) ───────────────────────────────
-conflux-cas/docs/DEVIATIONS.md
+# (project-specific deviation notes)

README.md

@@ -12,12 +12,15 @@ clients through to production-ready React components.
 packages/            Framework packages — all publishable to npm as @cfxdevkit/*
   core/              @cfxdevkit/core           — RPC clients, contracts, HD wallet
   services/          @cfxdevkit/services       — encryption, keystore, Swappi DEX
-  wallet/            @cfxdevkit/wallet         — re-export of wallet API from core
+  wallet/            @cfxdevkit/wallet         — focused wallet re-exports (session keys, batching)
   compiler/          @cfxdevkit/compiler       — runtime solc-js + contract templates
   devnode/           @cfxdevkit/devnode        — local @xcfx/node lifecycle (dev only)
+  contracts/         @cfxdevkit/contracts      — generated ABI, bytecode, addresses
+  protocol/          @cfxdevkit/protocol       — raw on-chain artifacts (ABIs + bytecode)
+  executor/          @cfxdevkit/executor      — on-chain execution/keeper runtime primitives
+  defi-react/        @cfxdevkit/defi-react     — React helpers for DeFi (pool tokens, pairs)
   react/             @cfxdevkit/react          — headless React components + hooks
   wallet-connect/    @cfxdevkit/wallet-connect — wagmi v2 + ConnectKit + SIWE
-  contracts/         @cfxdevkit/contracts      — generated ABI, bytecode, addresses
 
 devtools/            Private developer tooling — never published as framework packages
   contracts/         @cfxdevkit/contracts-dev  — Hardhat project: Solidity sources,
@@ -44,15 +47,18 @@ docs/                API reference and architecture docs
 | Package | What it gives you |
 |---|---|
 | `@cfxdevkit/services` | AES-256 encryption, encrypted HD keystore (file-based), Swappi DEX swap |
-| `@cfxdevkit/wallet` | Focused re-export of `core`'s wallet API |
+| `@cfxdevkit/wallet` | Focused re-export of `core`'s wallet API (session keys, batching, embedded wallet) |
 | `@cfxdevkit/compiler` | Runtime Solidity compiler (solc-js), pre-built contract templates |
 | `@cfxdevkit/devnode` | Local `@xcfx/node` lifecycle: start/stop/mine/faucet — **dev and test only** |
 | `@cfxdevkit/contracts` | Generated ABI, bytecode, and deployed addresses for production contracts |
+| `@cfxdevkit/protocol` | Low-level on-chain artifacts (ABIs + bytecode) for tooling and scripts |
+| `@cfxdevkit/executor` | Keeper / execution primitives for on-chain strategy execution (Limit/DCA/TWAP) |
 
 ### Layer 2 — React UI
 
 | Package | What it gives you |
 |---|---|
+| `@cfxdevkit/defi-react` | DeFi-specific React hooks: pool token resolution, balance enrichment, helpers |
 | `@cfxdevkit/wallet-connect` | wagmi v2 + ConnectKit + SIWE: `<WalletConnect>`, `AuthProvider`, chain constants |
 | `@cfxdevkit/react` | Headless render-prop components: `<ConnectButton>`, `<AccountCard>`, `<ContractReader>`, `<ContractWriter>`, `<SwapWidget>` |
 
@@ -136,6 +142,10 @@ pnpm add @cfxdevkit/core                 # foundation — always needed
 pnpm add @cfxdevkit/services             # encryption, keystore, swap
 pnpm add @cfxdevkit/wallet               # wallet without full RPC layer
 pnpm add @cfxdevkit/compiler             # runtime Solidity compilation
+pnpm add @cfxdevkit/contracts            # generated ABIs + addresses
+pnpm add @cfxdevkit/protocol             # low-level on-chain artifacts (bytecode + ABIs)
+pnpm add @cfxdevkit/executor             # on-chain execution primitives (keepers)
+pnpm add @cfxdevkit/defi-react           # DeFi React hooks + helpers
 pnpm add @cfxdevkit/devnode -D           # local dev node (dev/test only)
 pnpm add @cfxdevkit/wallet-connect wagmi viem connectkit @tanstack/react-query
 pnpm add @cfxdevkit/react

devtools/contracts/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cfxdevkit/contracts-dev",
   "version": "0.1.0",
-  "description": "Solidity smart contracts for conflux-cas automation — Hardhat project with @wagmi/cli codegen for SDK",
+  "description": "Solidity smart contracts for Conflux DevKit automation — Hardhat project with @wagmi/cli codegen for SDK",
   "private": true,
   "scripts": {
     "compile": "hardhat compile",

devtools/contracts/scripts/check-wallet.ts

@@ -6,7 +6,7 @@
  * funded.
  *
  * Usage:
- *   pnpm --filter @conflux-cas/contracts check-wallet
+ *   pnpm --filter @cfxdevkit/contracts-dev check-wallet
  *
  * No --network flag needed — the script creates its own providers.
  */

devtools/contracts/scripts/verify.ts

@@ -5,9 +5,9 @@
  * Reads deployed addresses from env vars (set after running deploy.ts).
  *
  * Usage (testnet):
- *   pnpm --filter @conflux-cas/contracts verify
+ *   pnpm --filter @cfxdevkit/contracts-dev verify
  * Usage (mainnet):
- *   pnpm --filter @conflux-cas/contracts verify:mainnet
+ *   pnpm --filter @cfxdevkit/contracts-dev verify:mainnet
  *
  * Required env vars:
  *   AUTOMATION_MANAGER_ADDRESS

devtools/contracts/wagmi.config.ts

@@ -6,7 +6,7 @@ import type { Plugin } from '@wagmi/cli';
 
 // ─── Deployment registry ─────────────────────────────────────────────────────
 // deployments.json is the single source of truth for deployed contract
-// addresses. Updated by conflux-cas/scripts/deploy.ts after each deploy.
+// addresses. Updated by devtools/contracts/scripts/deploy.ts after each deploy.
 // Committing this file tracks the canonical on-chain state per network.
 interface DeploymentRegistry {
   [chainId: string]: { [contractName: string]: string };
@@ -47,7 +47,7 @@ const wagmiDeployments = toWagmiDeployments(deploymentRegistry, CONTRACT_NAMES);
 
 /**
  * Custom plugin — appends `as const` bytecode exports for each contract so
- * that `@cfxdevkit/sdk-automation` can expose them for programmatic deploys
+ * that `@cfxdevkit/core/automation` can expose them for programmatic deploys
  * without pulling in Hardhat as a dependency.
  */
 function hardhatBytecodePlugin(contractNames: string[]): Plugin {
@@ -57,7 +57,7 @@ function hardhatBytecodePlugin(contractNames: string[]): Plugin {
       const lines: string[] = [
         '',
         '// ─── Deployment bytecode ─────────────────────────────────────────────────────',
-        '// Used by conflux-cas/scripts/deploy.ts via viem deployContract.',
+        '// Used by devtools/contracts/scripts/deploy.ts via viem deployContract.',
         '// Regenerate with: pnpm contracts:codegen',
       ];
       for (const name of contractNames) {
@@ -87,7 +87,7 @@ function hardhatBytecodePlugin(contractNames: string[]): Plugin {
  * Pipeline:
  *   pnpm contracts:codegen   (from monorepo root)
  *   = hardhat compile → wagmi generate
- *   → conflux-sdk/src/automation/generated.ts
+ *   → packages/contracts/src/generated.ts
  *
  * After a new deployment, update deployments.json then re-run codegen to
  * bake the new addresses into the SDK.

docs/PACKAGES.md

@@ -12,8 +12,9 @@
 UI Components  ─── @cfxdevkit/react          @cfxdevkit/wallet-connect
 Wallet logic   ─── @cfxdevkit/wallet         @cfxdevkit/core/wallet
 Services       ─── @cfxdevkit/services
-RPC / Contracts─── @cfxdevkit/core
-Domain tools   ─── @cfxdevkit/compiler       @cfxdevkit/contracts
+RPC / Contracts─── @cfxdevkit/core            @cfxdevkit/contracts
+Domain tools   ─── @cfxdevkit/compiler       @cfxdevkit/protocol
+Execution      ─── @cfxdevkit/executor      @cfxdevkit/defi-react
 Dev tools      ─── @cfxdevkit/devnode        conflux-devkit (npx)
 ```