chore(smart-contracts): remove unused commerce-payments git dependency#1734
Conversation
The commerce-payments package (git+https://github.com/base/commerce-payments.git) is a Solidity-only package with no TypeScript/JavaScript imports anywhere in the codebase. All needed interfaces are already copied locally in src/contracts/interfaces/. Removing it allows re-enabling blockExoticSubdeps for stronger supply-chain attack protection.
Greptile SummaryThis PR removes the unused
Confidence Score: 5/5Safe to merge — removes a genuinely unused git dependency and snapshots the NEAR GraphQL schema locally with no behavioral changes at runtime. The No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[yarn install] -->|before| B[Resolves commerce-payments\ngit+https://github.com/base/commerce-payments.git#v1.0.0]
A -->|after| C[No exotic git dep\nblockExoticSubdeps re-enabled]
D[build:sol - Hardhat compile] -->|before & after| E[Reads IAuthCaptureEscrow.sol\nfrom local src/contracts/interfaces/]
E --> F[81 contracts compile cleanly]
G[graphql-codegen NEAR] -->|before| H[Fetches schema from\nremote Studio URL]
G -->|after| I[Reads schema from\nsrc/thegraph/queries/near/schema.graphql]
I --> J[Generates graphql-near.ts\nwith correct types]
Reviews (2): Last reviewed commit: "fix(payment-detection): use local schema..." | Re-trigger Greptile |
The hosted subgraph at api.studio.thegraph.com/query/67444/request-payments-near-testnet no longer exists, breaking codegen and the TypeScript build. Switch to a local schema SDL file (matching the existing pattern used by the TRON codegen) so the build is not gated on an external endpoint being live.
Summary
commerce-paymentsgit dependency (git+https://github.com/base/commerce-payments.git#v1.0.0) from@requestnetwork/smart-contractscommerce-payments removal
The package is a Solidity-only repo with no npm publication; it was listed as a runtime dependency but has zero TypeScript/JavaScript imports anywhere in the codebase. All interfaces needed by
ERC20CommerceEscrowWrapper.solare already copied locally atsrc/contracts/interfaces/IAuthCaptureEscrow.sol. Removing it allows re-enablingblockExoticSubdepsfor stronger supply-chain attack protection.NEAR GraphQL codegen fix
codegen-near.ymlwas fetching the GraphQL schema live fromhttps://api.studio.thegraph.com/query/67444/request-payments-near-testnet/version/latest, which no longer exists. This caused codegen to fail,graphql-near.tsto never be generated, and the TypeScript build for@requestnetwork/payment-detectionto break.Fix follows the existing pattern used by the TRON codegen: a local
schema.graphqlSDL file is committed to the repo (src/thegraph/queries/near/schema.graphql) so the build is fully offline and not gated on an external endpoint being live.Test plan
yarn workspace @requestnetwork/smart-contracts build:sol— 81 Solidity files compiled successfullyyarn workspace @requestnetwork/payment-detection codegen— all four codegen targets pass (graphql.ts, graphql-superfluid.ts, graphql-near.ts, graphql-tron.ts)yarn workspace @requestnetwork/payment-detection build— TypeScript build passes cleanlyyarn install— lockfile updates cleanly