improve some utils function and a bunch of tests

[cedricfung]

No description provided.

[Copilot]

🔵 Needs a closer look

Binary transaction, authentication, and financial utility changes warrant final human validation despite the expanded tests.

Pull request overview

Improves SDK utility correctness, request handling, and test reliability while separating live integration tests.

Changes:

• Fixes mutation, validation, precision, invoice, and payload issues.
• Adds broad unit coverage for clients, codecs, webviews, and transactions.
• Adds coverage reporting and opt-in integration testing.

File summaries

File	Description
.gitignore	Ignores coverage output.
package.json	Adds coverage/integration scripts and provider.
package-lock.json	Locks coverage dependencies.
vitest.config.js	Configures coverage thresholds.
src/client/circle.ts	Corrects circle payload fields.
src/client/http.ts	Supports zero options and preserves authorization.
src/client/utxo.ts	Avoids mutating receiver arrays.
src/client/utils/amount.ts	Broadens BigNumber-compatible types.
src/client/utils/computer.ts	Validates unsigned user IDs.
src/client/utils/decoder.ts	Improves decoding precision and symmetry.
src/client/utils/encoder.ts	Validates integers and avoids input mutation.
src/client/utils/invoice.ts	Validates invoice references.
src/client/utils/multisigs.ts	Strengthens threshold validation.
src/client/utils/nfo.ts	Preserves token ID zero.
src/client/utils/safe.ts	Filters UTXOs and validates transactions.
src/client/utils/uniq.ts	Avoids mutating member arrays.
test/address.test.ts	Gates address integration tests.
test/blaze.test.ts	Tests Blaze encoding and socket behavior.
test/integration.ts	Adds integration-suite gating helper.
test/nft.test.ts	Gates NFT integration tests.
test/user.test.ts	Gates user integration tests.
test/webview.test.ts	Expands bridge and cleanup tests.
test/mixin/auth.test.ts	Tests authentication utilities.
test/mixin/client-utils.test.ts	Tests client construction.
test/mixin/clients.test.ts	Tests circle payloads.
test/mixin/code.test.ts	Gates code integration tests.
test/mixin/codec.test.ts	Tests transaction codecs and precision.
test/mixin/computer.test.ts	Tests computer utility boundaries.
test/mixin/http.test.ts	Tests HTTP metadata and errors.
test/mixin/invoice.test.ts	Tests invoice validation.
test/mixin/message.test.ts	Tests message serialization and forwarding.
test/mixin/network.test.ts	Gates network integration tests.
test/mixin/nfo.test.ts	Covers token ID zero.
test/mixin/safe-utils.test.ts	Tests safe transaction utilities.
test/mixin/user.test.ts	Gates authenticated user tests.
test/mixin/utils.test.ts	Verifies non-mutating member hashing.
test/mixin/utxo.test.ts	Tests UTXO client behavior.

Review details

• Files reviewed: 35/37 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Encoder hex validation and user-ID validation still accept malformed inputs that can encode unintended values.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

src/client/utils/encoder.ts:185

• The byte-length check does not guarantee that the entire mask is valid hex: Buffer.from ignores an odd trailing nibble or invalid suffix, so malformed input can still produce 32 bytes and be accepted as a different mask. Validate the full 64-character string before decoding.

    const mask = maskHex ? Buffer.from(maskHex, 'hex') : Buffer.alloc(32, 0);
    if (mask.byteLength !== 32) throw new Error(`invalid output mask ${o.mask}`);

• Files reviewed: 39/41 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

Runtime user-ID validation and fixed-width hexadecimal validation still accept malformed inputs.

Review details

Suppressed comments (3)

src/client/utils/computer.ts:16

• This guard only validates strings, so JavaScript callers can still pass a number (for example, userIdToBytes(1)) and it will be accepted by BigNumber, despite this function requiring a uint64 decimal string. Reject non-string values in the same condition so runtime behavior matches the public contract.

  if (typeof uid === 'string' && !/^\d+$/.test(uid)) {
    throw new Error(`invalid user id: ${uid}`);
  }

src/client/utils/encoder.ts:180

• Checking only the decoded byte length does not fully validate the key: Node stops hex decoding at an invalid suffix, so a value such as 64 valid hex characters followed by zz still produces 32 bytes and is accepted. Require exactly 64 hex characters before decoding.

      const kb = Buffer.from(k, 'hex');
      if (kb.byteLength !== 32) throw new Error(`invalid output key ${k}`);
      this.write(kb);

src/client/utils/encoder.ts:186

• The byte-length check accepts masks with an invalid trailing nibble or suffix because Buffer.from(..., 'hex') silently truncates at that point; 64 valid hex characters followed by invalid text still yields 32 bytes. Validate the complete non-empty mask as exactly 64 hex characters.

    const maskHex = o.mask || '';
    const mask = maskHex ? Buffer.from(maskHex, 'hex') : Buffer.alloc(32, 0);
    if (mask.byteLength !== 32) throw new Error(`invalid output mask ${o.mask}`);
    this.write(mask);

• Files reviewed: 39/41 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[cedricfung]

NFO is deprecated, we better just remove it @YeungKC