chore: 2026 Q4 stack upgrade (EMBED-590)

.changeset/README.md

@@ -0,0 +1,5 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`.
+
+Add a changeset with `npm run changeset` before opening a PR that should trigger a release.

.changeset/config.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.0.0/schema.json",
+  "baseBranch": "master",
+  "access": "public",
+  "privatePackages": {
+    "version": false
+  },
+  "updateInternalDependencies": "patch",
+  "fixed": [],
+  "linked": [],
+  "ignore": []
+}

.changeset/embed-590-stack-upgrade.md

@@ -0,0 +1,5 @@
+---
+"@toruslabs/customauth": major
+---
+
+Stack upgrade to torus-scripts 9 / Vite+: Node >=24.22.0, npm >=12, Oxlint/Oxfmt, Changesets. Package `types` now point at `dist/lib.cjs/index.d.ts`. Dropped unused `@babel/runtime` peer. Runtime prerequisite majors (torus.js, broadcast-channel) held pending EMBED-588 / EMBED-586.

.github/CODEOWNERS

@@ -21,6 +21,7 @@
 # Product code
 src/                            @torusresearch/Web3Auth-Product
 test/                           @torusresearch/Web3Auth-Product
+examples/                       @torusresearch/Web3Auth-Product
 
 # Most restrictive — last match wins
 .github/CODEOWNERS              @torusresearch/Web3Auth-Admins

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,7 @@
+## Motivation and Context
+
+<!-- Why is this change needed? What problem does it solve? -->
+
 ## Jira Link
 
 <!-- Link to the Jira ticket (if applicable) -->

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3
+    open-pull-requests-limit: 10
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3

.github/workflows/release-pr.yml

@@ -0,0 +1,39 @@
+name: Create release pull request
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-pr
+  cancel-in-progress: false
+
+jobs:
+  release-pr:
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: .nvmrc
+      - name: Install npm 12
+        run: npm install --global npm@12.2.0
+      - name: Install dependencies
+        run: npm ci
+      # The GitHub API commit mode signs the release commit, which `master` requires.
+      - name: Create or update the release pull request
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
+        with:
+          version-script: npm run version-packages
+          commit-message: "chore: release packages"
+          pr-title: "chore: release packages"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security-code-scanner.yml

@@ -0,0 +1,27 @@
+name: Security code scanner
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  security-scan:
+    uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@becb242930b3cc271c26da0280050db9c157e291 # v2.1.1
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    with:
+      scanner-ref: becb242930b3cc271c26da0280050db9c157e291 # v2.1.1
+      paths-ignored: |
+        **/node_modules/**
+        **/dist/**
+        **/build/**
+        **/coverage/**

.github/workflows/validate.yml

@@ -0,0 +1,94 @@
+name: Validate pull request
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ["24.22.0", "26"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Install npm 12
+        run: npm install --global npm@12.2.0
+      - name: Install dependencies
+        run: npm ci
+      - name: Check dependency hardening
+        run: npm exec --no -- harden check --package-manager npm
+      - name: Check source
+        run: npm run check
+      - name: Build packages
+        run: npm run build
+      - name: Check TypeScript projects
+        run: npm run typecheck
+      - name: Run tests
+        run: npm test
+      - name: Check release notes
+        if: |
+          github.event_name == 'pull_request' &&
+          !startsWith(github.head_ref, 'changeset-release/') &&
+          !startsWith(github.head_ref, 'dependabot/')
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          git fetch --no-tags origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}"
+          npm exec -- changeset status --since="origin/${BASE_REF}"
+      - name: Preview package archive
+        run: npm pack --dry-run --json
+
+  deploy-demo:
+    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
+    needs: validate
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: .nvmrc
+      - name: Install npm 12
+        run: npm install --global npm@12.2.0
+      - name: Install dependencies
+        run: npm ci
+      - name: Build package
+        run: npm run build
+      - name: Start Wiz sensor
+        uses: wiz-sec-public/wiz-sensor-github-action@2fd38e4d101f185b1deb0c313c0adb0a7efdfe62 # v0.9.6
+        continue-on-error: true
+        with:
+          api-token: ${{ secrets.WIZ_SENSOR_TOKEN }}
+      - name: Pack and build example
+        run: |
+          npm pack
+          cd examples/vue-app
+          npm run install:local
+          npm run build
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: ${{ secrets.AWS_REGION_US }}
+      - name: sync s3
+        run: aws s3 sync ./examples/vue-app/dist s3://demo-customauth.web3auth.io --region us-east-1 --no-progress
+      - name: Update AWS Cloudfront Config
+        uses: chaitanyapotti/cloudfront-update-distribution@c5d4a6b318664766f944d11c32544f492fb3027d # v4
+        with:
+          cloudfront-distribution-id: ${{ secrets.AWS_CLOUDFRONT_DISTRIBUTION_ID }}
+          cloudfront-invalidation-required: true
+          cloudfront-invalidation-path: "/*"
+          cloudfront-wait-for-service-update: false

.gitignore

@@ -108,4 +108,4 @@ bundle.min.js
 types2/
 .DS_Store
 
-.npmrc
+.vitest/

.npmrc

@@ -0,0 +1,11 @@
+## Avoid installing packages published in last 3 days.
+min-release-age=3
+
+## Don't install packages from git urls.
+allow-git=none
+
+## Disable installing dependencies from remote URLs.
+allow-remote=none
+
+## Pin allowed scripts to exact versions of dependencies to prevent unexpected script execution.
+allow-scripts-pin=true

.nvmrc

@@ -1 +1 @@
->=24.x
+26

.prettierignore

@@ -1,23 +1,7 @@
-# See https://help.github.com/ignore-files/ for more about ignoring files.
-
-# dependencies
-/node_modules
-
-# testing
-/coverage
-
-#production
-/build
-
-# misc
-.DS_Store
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
-
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-types/
-.github/CODEOWNERS
+dist
+node_modules
+coverage
+examples
+*.tgz
+.changeset
+package-lock.json