sdk%feat: extend TypeId to support arguments, harden CodeQL lockfile enforcement, drop all dependencies from dash-pow, minor cleanups and doc fixes

README.md

@@ -33,15 +33,18 @@
 > [!NOTE]
 > Solid lines are build dependencies. Dotted lines are test dependencies.
 
+<!-- --8<-- [start:crate-graph] -->
+
 ```mermaid
+%%{init: { "flowchart": { "curve": "basis" } } }%%
 graph LR
   subgraph " "
     types[dash-types]
     num[dash-num]
+    pow[dash-pow]
   end
   subgraph "  "
     script[dash-script]
-    pow[dash-pow]
     pkc[dash-pkc]
   end
   subgraph "   "
@@ -52,24 +55,17 @@ graph LR
 
   types --> num
   types --> script
-  types --> pkc
-  types --> primitives
-  types --> p2p_core
-  num --> pow
   num --> pkc
   num --> primitives
-  num --> params
-  num --> p2p_core
   script --> primitives
-  script --> p2p_core
   pkc --> p2p_core
   pow --> primitives
-  pow -.-> params
   primitives --> params
-  primitives --> p2p_core
   params --> p2p_core
 ```
 
+<!-- --8<-- [end:crate-graph] -->
+
 ## Features
 
 All crates support these standard features:
@@ -85,7 +81,7 @@ Specific crates define additional features:
 
 | Feature | Description | Crates |
 |---------|-------------|--------|
-| `k256` | Enable secp256k1 support | [pkc](./pkgs/pkc) |
+| `ecdsa` | Enable secp256k1 support | [pkc](./pkgs/pkc) |
 | `bls` | Enable standard and legacy BLS support | [pkc](./pkgs/pkc) |
 | `aes_hw` | Enable hardware-accelerated AES on supported platforms | [pow](./pkgs/pow) |
 | `simd` | Use SIMD backends (requires nightly) | [pow](./pkgs/pow) |

contrib/codeql/codeql-config.yml

@@ -1,2 +1,5 @@
+disable-default-queries: true
 paths-ignore:
   - public
+queries:
+  - uses: ./contrib/codeql

contrib/lint/lint_codeql.py

@@ -124,11 +124,28 @@ def _print_csv_diagnostics(results_path: Path) -> int:
   return count
 
 
-def _search_suite(parser: argparse.ArgumentParser, name: str) -> str:
-  """Validate CodeQL suite *name* and return its query-suite reference."""
-  if not re.fullmatch(r"[A-Za-z0-9._-]+", name):
-    parser.error(f"invalid --with-suite name: {name!r}")
-  return f"codeql/rust-queries:codeql-suites/{name}.qls"
+def _locked_pack(pack: str) -> str:
+  """Return *pack* pinned to the version the lock file records."""
+  lock_file = root_dir() / "contrib" / "codeql" / "codeql-pack.lock.yml"
+  if not lock_file.is_file():
+    raise ValueError(f"missing lock file {lock_file}")
+  text = lock_file.read_text(encoding="latin-1")
+  match = re.search(
+    rf"^\s+{re.escape(pack)}:\s*$\n\s+version:\s*(\S+)\s*$",
+    text,
+    re.MULTILINE,
+  )
+  if not match:
+    raise ValueError(f"no pinned version for {pack} in {lock_file}")
+  return f"{pack}@{match.group(1)}"
+
+
+def _search_suites(pack: str, names: list[str]) -> list[str]:
+  """Return query-suite references under the pinned *pack*."""
+  for name in names:
+    if not re.fullmatch(r"[A-Za-z0-9._-]+", name):
+      raise ValueError(f"invalid --with-suite name: {name!r}")
+  return [f"{pack}:codeql-suites/{name}.qls" for name in names]
 
 
 @contextlib.contextmanager
@@ -181,9 +198,7 @@ def _parse_args(argv: list[str]) -> argparse.Namespace:
     metavar="NAME",
     help=("run a 'codeql/rust-queries' suite by name (default: none)"),
   )
-  args = parser.parse_args(argv)
-  args.suites = [_search_suite(parser, name) for name in args.suites]
-  return args
+  return parser.parse_args(argv)
 
 
 def main(argv: list[str] | None = None) -> int:
@@ -244,6 +259,12 @@ def main(argv: list[str] | None = None) -> int:
       )
       return RETCODE_ERR
 
+  try:
+    suites = _search_suites(_locked_pack("codeql/rust-queries"), args.suites)
+  except ValueError as e:
+    print(f"error: {e}", file=sys.stderr)
+    return RETCODE_ERR
+
   # Install CodeQL pack dependencies.
   subprocess.run(  # noqa: S603
     [codeql_bin, "pack", "install", "--no-strict-mode", str(query_dir)],
@@ -294,7 +315,7 @@ def main(argv: list[str] | None = None) -> int:
         "analyze",
         str(active_db),
         *[str(q) for q in queries],
-        *args.suites,
+        *suites,
         "--format=csv",
         f"--output={results_path}",
         f"--threads={usable_threads()}",