fix(deps): resolve @percolatorct/sdk from a pinned git tarball, not a local sibling path (#232)

[dcccrypto]

Addresses #232 at the dependency level, and as a consequence also #234 (Docker) and the permanently-red Vercel check on every api PR.

Problem

package.json on main declares:

"@percolatorct/sdk": "file:../../percolator-sdk",

That only resolves on a machine that happens to have the SDK checked out two levels up. Every clean checkout fails at install, before a single test runs:

ENOENT: no such file or directory, scandir '<root>/percolator-sdk'
exit 254

This bites in three places, not one:

Surface	Status today
GitHub Actions build-and-test	ENOENT — ~25 open PRs unverified since ~2026-06-26
Vercel	ENOENT — I pulled the logs on dpl_FEKrAtDVDs3g3TH7CN78x9GVw4QH, same error at pnpm install
Docker (#234)	Dockerfile COPYs only package.json + lockfiles, so the sibling can never be in the build context

Fix

Pin the SDK to a git tarball at the same commit its origin/main ships (673bc47, v3.0.0) — the exact form already used for @percolator/shared on the line directly above:

-"@percolatorct/sdk": "file:../../percolator-sdk",
+"@percolatorct/sdk": "github:dcccrypto/percolator-sdk#673bc4717480f54f678c0f07246b26b84d703212",

dcccrypto/percolator-sdk is public and commits its dist/, so this needs no npm publish, no lockfile regeneration on a special machine, and no extra checkout step.

Regenerating the lockfile also cleared the transitive file: path that @percolatorct/shared was carrying. The lockfile now has zero local-path references (the one remaining file: hit is the unrelated excludeLinksFromLockfile: setting key).

Diff is 2 files: package.json (1 line) and pnpm-lock.yaml.

Verification

Run in a scratch tree shaped exactly like the runner (work/percolator-api/percolator-api) with no sibling SDK present:

$ ls ../../percolator-sdk
ls: ../../percolator-sdk: No such file or directory

$ pnpm install --frozen-lockfile   → exit 0
$ pnpm build                       → exit 0
$ pnpm test                        → 293 passed, 2 failed

Those 2 failures are pre-existing and not caused by this change — they are the same two tests/sdk-smoke.test.ts cases #233 reports and fixes. Identical counts to #233 (293 passed, 2 failed), because this pins the same SDK revision #233 checks out (ref: main == 673bc47).

Docker is fixed by construction (no local path left for --frozen-lockfile to chase) but I could not run docker build to prove it — no Docker daemon on this machine. Worth confirming in CI.

Relationship to #233

Complementary, not competing — they touch disjoint files and will not conflict.

• ci: check out percolator-sdk as a sibling so pnpm install can resolve it (#232) #233 touches .github/workflows/ci.yml + tests/sdk-smoke.test.ts
• this touches package.json + pnpm-lock.yaml

#233's test fix is still needed — it is what makes pnpm test green, and this PR does not duplicate it.

#233's ci.yml sibling-checkout steps become unnecessary once this merges, and they only ever fixed Actions — not Vercel, not Docker. Suggest dropping that hunk from #233 (or in a follow-up) and keeping its test fix. Merging both as-is is harmless, just dead weight in the workflow.

Not fixed here

Several api PRs (#231, #224, #194, …) fail Vercel with Authorization required to deploy rather than a build error — their Vercel builds never ran at all. That is a GitHub↔Vercel contributor-authorization gate and needs a human on the Vercel team to approve. Unrelated to this change.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the Percolator SDK dependency reference to a pinned version to improve build consistency.
• Tests
  • Adjusted the SDK smoke test to reflect v17 “fail closed” behavior, conditionally asserting program ID retrieval based on whether v17 programs are deployed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
percolator-api	Ready	Preview, Comment	Jul 21, 2026 1:34am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7c2eff38-6ad1-4b72-b639-ba412fbaacde

📥 Commits

Reviewing files that changed from the base of the PR and between 663eb3a and c41fb52.

📒 Files selected for processing (1)

• tests/sdk-smoke.test.ts

---

📝 Walkthrough

Walkthrough

The package manifest pins @percolatorct/sdk to a GitHub commit. SDK smoke tests use V17_PROGRAMS_DEPLOYED to validate either fail-closed errors or valid devnet program IDs.

Changes

SDK compatibility

Layer / File(s)	Summary
Pin SDK dependency package.json	@percolatorct/sdk now resolves from a specific GitHub commit instead of file:../../percolator-sdk.
Gate v17 program-ID smoke tests tests/sdk-smoke.test.ts	Imports V17_PROGRAMS_DEPLOYED and conditionally expects devnet program-ID lookups to throw or return valid PublicKey values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• dcccrypto/percolator-keeper#389 — Addresses v17 SDK and deployment compatibility in the SDK smoke tests.
• dcccrypto/percolator-keeper#326 — Concerns Git-based pinning of the @percolatorct/sdk dependency.
• dcccrypto/percolator-sdk#356 — Relates to the pinned SDK commit and v17 program-ID exports used by the tests.
• dcccrypto/percolator-api#232 — Addresses the local SDK dependency installation blocker replaced by the pinned GitHub reference.

Possibly related PRs

• dcccrypto/percolator-api#233 — Updates the same smoke-test assertions based on V17_PROGRAMS_DEPLOYED.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main dependency change: switching @percolatorct/sdk from a local sibling path to a pinned GitHub reference.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/api-232-sdk-git-tarball

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dcccrypto]

CI result on first run — exactly as predicted, with one bonus.

Vercel → pass. First green Vercel deployment on this repo in ~33 days. Its last success was 36d ago; every deployment since (Preview and Production) was ● Error. This confirms the ENOENT was the cause and that fixing it at the dependency level fixes Vercel, which a workflow-level checkout cannot.

build-and-test → fail, but the install and build both succeeded. From the run log:

Test Files  1 failed | 24 passed (25)
     Tests  2 failed | 293 passed (295)

FAIL tests/sdk-smoke.test.ts > getProgramId returns a valid PublicKey for devnet
FAIL tests/sdk-smoke.test.ts > getMatcherProgramId returns a valid PublicKey for devnet

No ENOENT, no exit 254, no TS errors — pnpm install --frozen-lockfile and pnpm build passed in CI for the first time since ~2026-06-26. The only red is the 2 pre-existing sdk-smoke cases, byte-identical to what #233 documents and fixes.

So this PR is red on its own and that is expected. Suggested sequencing:

1. Merge ci: check out percolator-sdk as a sibling so pnpm install can resolve it (#232) #233 first — its tests/sdk-smoke.test.ts fix is what turns pnpm test green, and this PR deliberately does not duplicate it.
2. Then this one. Rebased on that main, all of build-and-test + Vercel + docker should be green together.

The two PRs touch disjoint files and will not conflict. Once both are in, the ci.yml sibling-checkout hunk from #233 is dead weight and can be dropped — it only ever fixed Actions, not Vercel or Docker.

[dcccrypto]

CI failure here is a real SDK bug, not a defect in this PR

build-and-test fails 2/295: getProgramId("devnet") and getMatcherProgramId("devnet") throw
"Percolator v17 program is not deployed for devnet".

Root cause is upstream — percolator-sdk's committed dist/ is stale at main. At 673bc47:

• src/config/program-ids.ts:65 → V17_PROGRAMS_DEPLOYED = true
• dist/index.js:2186 → V17_PROGRAMS_DEPLOYED = false

SDK commit #326 flipped the flag in src/ and never rebuilt dist/. Filed as
dcccrypto/percolator-sdk#356.

This PR resolves the SDK from a git tarball, which is what real git-dep consumers get — so it
consumes dist/ and correctly surfaces the drift. #233 resolves via sibling checkout to src/
and is green only because it tests source that no consumer actually installs.

Blocked on percolator-sdk#356. Once dist/ is rebuilt at main, I repin the tarball here and
this should go green with no change to the test — the assertions are correct as written.

[dcccrypto]

Pushed c41fb52: build-and-test is now green (295/295 tests, 25/25 files).

Pinning the SDK to a git tarball fixed pnpm install, but surfaced two genuine test failures — the v17 SDK fails closed and throws from getProgramId()/getMatcherProgramId() while V17_PROGRAMS_DEPLOYED === false, rather than returning a legacy address that can't decode v17 payloads. Ported the test fix from #233 so the smoke test asserts the gate itself.

This makes #238 a complete fix for #232 on its own, and supersedes #233 — the tarball pin removes the need for that PR's CI sibling-checkout workaround (rm -rf ../../percolator-sdk + mv outside GITHUB_WORKSPACE).

Note for the other open API PRs (#237, #236, #235, #231): they fail on the same ENOENT ... scandir '<runner>/work/percolator-sdk' install error and will need a rebase onto main once this lands.