Feature/bee wallet

.cargo/config.toml

@@ -1,2 +1,21 @@
+[build]
+# Required by `dark_dex_halo2_private_witness_export_lib` → acki-nacki
+# `telemetry_utils` (calls `RuntimeMetrics::spawned_tasks_count`, gated
+# behind tokio's unstable cfg). Without this flag, the live witness
+# export crate fails to build.
+rustflags = ["--cfg", "tokio_unstable"]
+
+# NOTE: do NOT switch the linker to ld64.lld here. The dep-graph pulls in
+# two tvm-sdk versions (via ackinacki-kit and via acki-nacki/node) whose
+# `tvm_client` crates both export the same `extern "C"` symbols
+# (`tc_create_context`, `tc_request_*`, ...). Apple's system ld64 silently
+# picks one; ld64.lld errors out on duplicate symbols. Stick with ld64.
+
+# NOTE: `rustc-wrapper = "sccache"` is intentionally not configured here.
+# sccache is a personal/CI-side speedup; baking it into the project config
+# breaks builds for contributors who don't have sccache installed (cargo
+# fails if the wrapper binary is missing). Put it in your own
+# `~/.cargo/config.toml` instead.
+
 [net]
 git-fetch-with-cli = true

.github/workflows/ci.yml

@@ -10,8 +10,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  rust:
-    name: Rust Check, Clippy, Tests
+  lint:
+    name: Lint
     runs-on: ubuntu-latest
     env:
       CARGO_TERM_COLOR: always
@@ -21,31 +21,89 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup Rust
+      # nightly is only for `cargo fmt` (rustfmt.toml uses nightly-only options).
+      # stable is installed last, so it is the default for build/clippy.
+      - name: Setup Rust (nightly, rustfmt only)
+        uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rustfmt
+      - name: Setup Rust (stable)
         uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
 
+      # `gosh_tls_lib` is a private dependency (bee_wallet -> tls_connect); fetch
+      # it over https with a read-only token. `dodex-sdk` is a dev-dependency used
+      # only by the `dex_flows` integration tests (not run in CI) and pulls a heavy
+      # halo2 graph, so strip it to keep the resolve light. Every other git
+      # dependency is public.
+      - name: Configure git for private dep
+        env:
+          PAT: ${{ secrets.GH_PAT }}
+        run: |
+          git config --global url."https://oauth2:${PAT}@github.com/".insteadOf "ssh://git@github.com/"
+          sed -i '/^dodex-sdk = /d' bee_wallet/Cargo.toml
+
       - name: Cache Rust
         uses: Swatinem/rust-cache@v2
 
-      - name: Cargo check (workspace except verifier)
-        run: cargo check --workspace --exclude bee-verifier
+      - name: Check formatting
+        run: cargo +nightly fmt --all -- --check
+
+      # bee-sdk is the wasm aggregator (forces single-wasm on its deps, which leaks
+      # wasm-only code into native builds via feature unification); bee-verifier
+      # targets wasm32-wasip2. Both are covered on their own targets below.
+      - name: Cargo check (workspace, native)
+        run: cargo check --workspace --exclude bee-sdk --exclude bee-verifier
 
       - name: Cargo check (verifier)
         run: cargo check -p bee-verifier
 
       - name: Cargo check (miner wasm feature)
         run: cargo check -p bee-miner --no-default-features --features wasm
 
-      - name: Cargo clippy (workspace)
-        run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: Cargo check (sdk, wasm target)
+        run: |
+          rustup target add wasm32-unknown-unknown
+          cargo check -p bee-sdk --target wasm32-unknown-unknown
+
+      - name: Clippy
+        run: cargo clippy --workspace --exclude bee-sdk --exclude bee-verifier --lib -- -D warnings -A clippy::result_large_err
+
+  test:
+    name: Test (unit)
+    runs-on: ubuntu-latest
+    env:
+      CARGO_TERM_COLOR: always
+      CARGO_TARGET_DIR: target
+      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Configure git for private dep
+        env:
+          PAT: ${{ secrets.GH_PAT }}
+        run: |
+          git config --global url."https://oauth2:${PAT}@github.com/".insteadOf "ssh://git@github.com/"
+          sed -i '/^dodex-sdk = /d' bee_wallet/Cargo.toml
+
+      - name: Cache Rust
+        uses: Swatinem/rust-cache@v2
 
-      - name: Cargo test (workspace native)
-        run: cargo test --workspace --exclude bee-verifier --exclude bee-sdk
+      # `--lib` only: bee_wallet's integration tests hit shellnet / need local
+      # halo2 params, so they are run manually, not in CI.
+      - name: Cargo test (workspace libs)
+        run: cargo test --workspace --exclude bee-sdk --exclude bee-verifier --lib
 
       - name: Cargo test (verifier lib)
         run: cargo test -p bee-verifier --lib
 
+      # Skip the deep-link test: it drives wasm-bindgen futures that panic when
+      # the wasm feature is exercised on the host target (run it under wasm-pack
+      # instead). release.yml skips the same test.
       - name: Cargo test (miner wasm feature on host)
-        run: cargo test -p bee-miner --no-default-features --features wasm --lib
+        run: cargo test -p bee-miner --no-default-features --features wasm --lib -- --skip core::keys::tests::gen_mining_keys_generates_keys_and_valid_deep_link

.github/workflows/gitleaks.yml

@@ -0,0 +1,31 @@
+name: Gitleaks
+
+on:
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: gitleaks-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # full history so the scan covers every commit, not just the tip
+          fetch-depth: 0
+
+      # The gitleaks tool is open source (MIT); we run its public image directly.
+      # We deliberately do NOT use `gitleaks/gitleaks-action`, whose wrapper
+      # requires a paid GITLEAKS_LICENSE for organization-owned repositories.
+      # Rules live in `.gitleaks.toml` (same config the team uses elsewhere).
+      - name: Run gitleaks
+        run: |
+          docker run --rm -v "${{ github.workspace }}:/repo" -w /repo \
+            ghcr.io/gitleaks/gitleaks:latest \
+            detect --config .gitleaks.toml --redact --verbose

.github/workflows/release-rc.yml

@@ -46,6 +46,17 @@ jobs:
         with:
           components: clippy
 
+      # `gosh_tls_lib` is a private dependency (bee_wallet -> tls_connect); fetch
+      # it over https with a read-only token. `dodex-sdk` is a dev-dependency for
+      # the `dex_flows` integration tests only (not built here) and pulls a heavy
+      # halo2 graph, so strip it. Every other git dependency is public.
+      - name: Configure git for private dep
+        env:
+          PAT: ${{ secrets.GH_PAT }}
+        run: |
+          git config --global url."https://oauth2:${PAT}@github.com/".insteadOf "ssh://git@github.com/"
+          sed -i '/^dodex-sdk = /d' bee_wallet/Cargo.toml
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
@@ -58,20 +69,20 @@ jobs:
       - name: Install wasm-pack
         run: cargo install wasm-pack --locked
 
-      - name: Cargo check (workspace except verifier)
-        run: cargo check --workspace --exclude bee-verifier
+      - name: Cargo check (workspace, native)
+        run: cargo check --workspace --exclude bee-sdk --exclude bee-verifier
 
       - name: Cargo check (verifier)
         run: cargo check -p bee-verifier
 
       - name: Cargo check (miner wasm feature)
         run: cargo check -p bee-miner --no-default-features --features wasm
 
-      - name: Cargo clippy (workspace)
-        run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: Cargo clippy (workspace libs)
+        run: cargo clippy --workspace --exclude bee-sdk --exclude bee-verifier --lib -- -D warnings -A clippy::result_large_err
 
-      - name: Cargo test (workspace native)
-        run: cargo test --workspace --exclude bee-verifier --exclude bee-sdk
+      - name: Cargo test (workspace libs)
+        run: cargo test --workspace --exclude bee-sdk --exclude bee-verifier --lib
 
       - name: Cargo test (verifier lib)
         run: cargo test -p bee-verifier --lib
@@ -84,9 +95,11 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          VERSION="$(grep -E '^version\s*=' bee_sdk/Cargo.toml | head -n1 | sed -E 's/version\s*=\s*"([^"]+)"/\1/')"
+          # bee_sdk inherits its version from [workspace.package] in the root
+          # Cargo.toml, so resolve it there.
+          VERSION="$(grep -E '^version\s*=' Cargo.toml | head -n1 | sed -E 's/version\s*=\s*"([^"]+)"/\1/')"
           if [ -z "${VERSION}" ]; then
-            echo "Failed to resolve bee-sdk version from bee_sdk/Cargo.toml"
+            echo "Failed to resolve workspace version from Cargo.toml"
             exit 1
           fi
 

.github/workflows/release.yml

@@ -46,6 +46,17 @@ jobs:
         with:
           components: clippy
 
+      # `gosh_tls_lib` is a private dependency (bee_wallet -> tls_connect); fetch
+      # it over https with a read-only token. `dodex-sdk` is a dev-dependency for
+      # the `dex_flows` integration tests only (not built here) and pulls a heavy
+      # halo2 graph, so strip it. Every other git dependency is public.
+      - name: Configure git for private dep
+        env:
+          PAT: ${{ secrets.GH_PAT }}
+        run: |
+          git config --global url."https://oauth2:${PAT}@github.com/".insteadOf "ssh://git@github.com/"
+          sed -i '/^dodex-sdk = /d' bee_wallet/Cargo.toml
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
@@ -58,20 +69,20 @@ jobs:
       - name: Install wasm-pack
         run: cargo install wasm-pack --locked
 
-      - name: Cargo check (workspace except verifier)
-        run: cargo check --workspace --exclude bee-verifier
+      - name: Cargo check (workspace, native)
+        run: cargo check --workspace --exclude bee-sdk --exclude bee-verifier
 
       - name: Cargo check (verifier)
         run: cargo check -p bee-verifier
 
       - name: Cargo check (miner wasm feature)
         run: cargo check -p bee-miner --no-default-features --features wasm
 
-      - name: Cargo clippy (workspace)
-        run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: Cargo clippy (workspace libs)
+        run: cargo clippy --workspace --exclude bee-sdk --exclude bee-verifier --lib -- -D warnings -A clippy::result_large_err
 
-      - name: Cargo test (workspace native)
-        run: cargo test --workspace --exclude bee-verifier --exclude bee-sdk
+      - name: Cargo test (workspace libs)
+        run: cargo test --workspace --exclude bee-sdk --exclude bee-verifier --lib
 
       - name: Cargo test (verifier lib)
         run: cargo test -p bee-verifier --lib
@@ -84,9 +95,11 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          VERSION="$(grep -E '^version\s*=' bee_sdk/Cargo.toml | head -n1 | sed -E 's/version\s*=\s*"([^"]+)"/\1/')"
+          # bee_sdk inherits its version from [workspace.package] in the root
+          # Cargo.toml, so resolve it there.
+          VERSION="$(grep -E '^version\s*=' Cargo.toml | head -n1 | sed -E 's/version\s*=\s*"([^"]+)"/\1/')"
           if [ -z "${VERSION}" ]; then
-            echo "Failed to resolve bee-sdk version from bee_sdk/Cargo.toml"
+            echo "Failed to resolve workspace version from Cargo.toml"
             exit 1
           fi
 

.gitignore

@@ -28,3 +28,6 @@ target
 
 Cargo.lock
 pkg/
+
+# halo2 SRS + prover cache (~0.5 GB) for the dex_flows tests — never commit
+bee_wallet/params/

.gitleaks.toml

@@ -0,0 +1,71 @@
+title = "Gitleaks Config"
+
+[detect]
+redact = true
+
+# ======== Generic Rules ========
+
+[[rules]]
+id = "generic-api-key"
+description = "Generic API Key"
+regex = '''(?i)(api[_-]?key|secret|token|auth)[=:]["']?[0-9a-zA-Z-_]{16,}["']?'''
+tags = ["key", "API"]
+
+[[rules]]
+id = "github-token"
+description = "GitHub Personal Access Token"
+regex = '''ghp_[0-9A-Za-z]{36}'''
+tags = ["github", "token"]
+
+[[rules]]
+id = "gitlab-token"
+description = "GitLab Personal Access Token"
+regex = '''glpat-[0-9a-zA-Z\-\_]{20,}'''
+tags = ["gitlab", "token"]
+
+[[rules]]
+id = "slack-token"
+description = "Slack Token"
+regex = '''xox[baprs]-[0-9A-Za-z-]{10,48}'''
+tags = ["slack", "token"]
+
+[[rules]]
+id = "aws-access-key"
+description = "AWS Access Key ID"
+regex = '''AKIA[0-9A-Z]{16}'''
+tags = ["AWS", "key"]
+
+[[rules]]
+id = "aws-secret-key"
+description = "AWS Secret Access Key"
+regex = '''(?i)aws(.{0,20})?(secret|private)?(.{0,20})?(key|token)['"][0-9a-zA-Z\/+=]{40}['"]'''
+tags = ["AWS", "key"]
+
+[[rules]]
+id = "private-key"
+description = "Private Key (PEM)"
+regex = '''-----BEGIN (RSA|DSA|EC|OPENSSH|PGP) PRIVATE KEY-----'''
+tags = ["key", "private"]
+
+[[rules]]
+id = "db-connection-string"
+description = "Database Connection String"
+regex = '''(?i)(?:postgres|mysql|mongodb|redis|sqlserver):\/\/([^ \n]+)'''
+tags = ["database", "credentials"]
+
+# ======== Allowlist ========
+
+[allowlist]
+description = "Ignore common non-sensitive locations"
+paths = [
+    '''.*tests?/.*''',
+    '''.*examples?/.*''',
+    '''target/.*''',
+    '''docs?/.*''',
+    '''\.git/.*''',
+    '''\.idea/.*''',
+    '''\.vscode/.*''',
+]
+regexes = [
+    '''(?i)dummy|example|sample|test|placeholder|mock''',
+]