Add framework integrations for Astro, Nuxt, Remix, and SvelteKit#11
Merged
FractionEstate merged 4 commits intomainfrom Jan 24, 2026
Merged
Add framework integrations for Astro, Nuxt, Remix, and SvelteKit#11FractionEstate merged 4 commits intomainfrom
FractionEstate merged 4 commits intomainfrom
Conversation
…g framework Major additions: - Smart contract templates: Flash Loan and Staking Rewards Pool (18/18 complete) - CIP implementations: CIP-45 (Extended Token Metadata), CIP-88 (Token Policy Registration), CIP-95 (Governance Extension), CIP-100 (Governance Metadata) - Framework adapters: Nuxt 3 module, SvelteKit adapter, Remix adapter, Astro integration - Contract testing framework: property-based testing, fuzzing, and time-travel utilities https://claude.ai/code/session_017rJrzaQ2sVoNEGtEuQ5V2P
…nd devnet controls The @cardano-devkit/vscode extension provides: - Syntax highlighting for Aiken (.ak) and Plutus (.hs, .plutus) - IntelliSense completions for all DevKit APIs - 20+ code snippets for common patterns (send ADA, mint NFT, escrow, etc.) - Hover validation for Cardano addresses, tx hashes, and policy IDs - Devnet management commands (start/stop/restart/status) - Status bar with network indicator and devnet status - Tree views for UTxOs, transactions, and devnet info - Scaffold commands for contracts and dApps - Wallet commands (top up, balance, connect) https://claude.ai/code/session_017rJrzaQ2sVoNEGtEuQ5V2P
@cardano-devkit/hardware-wallet provides Phase 1 (read-only) hardware wallet support: - Ledger wallet integration with WebHID/WebUSB transport - Trezor wallet integration with TrezorConnect - Address derivation (BIP44/CIP-1852 compliant) - Public key retrieval - Transaction preview on device display - Support for base, enterprise, reward, and pointer addresses - Comprehensive error handling (connection, transport, user cancellation) - Type-safe derivation path utilities Phase 2 will add transaction signing support. https://claude.ai/code/session_017rJrzaQ2sVoNEGtEuQ5V2P
…cking - Add Monaco-based Playground component for in-browser code editing - Create Tutorial component with step-by-step progress, hints, and solutions - Implement 3 comprehensive tutorials: - First Transaction: Build and submit your first Cardano transaction - Mint NFT: Create NFTs with CIP-25 metadata - Smart Contract Basics: EUTXO model and escrow contracts - Add Learning Center page with tutorial cards and difficulty levels - Progress persistence via localStorage for returning users - Add dependencies: monaco-editor, framer-motion, lucide-react, zustand https://claude.ai/code/session_017rJrzaQ2sVoNEGtEuQ5V2P
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| // Adjust URL for testnet | ||
| if (network !== "Mainnet" && explorerUrl.includes("cardanoscan.io")) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
In general, to fix incomplete URL substring sanitization, you should parse the URL and compare its host against a known, explicit value (or a small whitelist), rather than using includes on the whole URL string. This ensures that only the intended domain (and optionally well‑defined subdomains) matches, and prevents attackers from embedding the trusted domain string in other parts of the URL.
Here, the best fix without changing intended functionality is:
- Parse
explorerUrlas a URL. - Check that its hostname is exactly
cardanoscan.iobefore applying the network‑specific replacement. - If parsing fails or the hostname is not
cardanoscan.io, skip the replacement and leaveurlas originally built.
Concretely, in packages/vscode-extension/src/extension.ts:
- Add a small helper (or inline logic) that tries to construct a
URLobject fromexplorerUrl. BecauseexplorerUrlmay be configured without a scheme (e.g.cardanoscan.io), normalize it by prefixinghttps://if no scheme is present before parsing. - Replace the line
if (network !== "Mainnet" && explorerUrl.includes("cardanoscan.io")) {with logic that:- Parses
explorerUrl(after normalizing the scheme if necessary). - Checks
parsed.hostname === "cardanoscan.io".
- Parses
- Only then perform the
url = url.replace("cardanoscan.io", ...)adjustment.
This keeps all existing behaviors for the default https://cardanoscan.io value and any custom Cardanoscan URL whose host is exactly cardanoscan.io, while preventing arbitrary URLs that merely contain that substring from being treated as Cardanoscan URLs.
Suggested changeset
1
packages/vscode-extension/src/extension.ts
| @@ -112,8 +112,21 @@ | ||
| } | ||
|
|
||
| // Adjust URL for testnet | ||
| if (network !== "Mainnet" && explorerUrl.includes("cardanoscan.io")) { | ||
| url = url.replace("cardanoscan.io", `${network.toLowerCase()}.cardanoscan.io`); | ||
| if (network !== "Mainnet") { | ||
| try { | ||
| // Ensure we have a scheme so that URL parsing works even if the user omits it | ||
| const normalizedExplorerUrl = | ||
| explorerUrl.startsWith("http://") || explorerUrl.startsWith("https://") | ||
| ? explorerUrl | ||
| : `https://${explorerUrl}`; | ||
| const parsed = new URL(normalizedExplorerUrl); | ||
|
|
||
| if (parsed.hostname === "cardanoscan.io") { | ||
| url = url.replace("cardanoscan.io", `${network.toLowerCase()}.cardanoscan.io`); | ||
| } | ||
| } catch { | ||
| // If explorerUrl is not a valid URL, skip hostname-based adjustment | ||
| } | ||
| } | ||
|
|
||
| await vscode.env.openExternal(vscode.Uri.parse(url)); |
Copilot is powered by AI and may make mistakes. Always verify output.
| await fs.promises.access(dtsFullPath); | ||
|
|
||
| // Read the file and try to find the symbol | ||
| const content = await fs.promises.readFile(dtsFullPath, "utf-8"); |
Check failure
Code scanning / CodeQL
Potential file system race condition High
| // Email validation | ||
| if (metadata.email) { | ||
| const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; | ||
| if (!emailRegex.test(metadata.email)) { |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data High
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR introduces comprehensive framework integrations for the Cardano DevKit, enabling seamless Cardano dApp development across four major web frameworks: Astro, Nuxt 3, Remix, and SvelteKit.
Key Changes
New Packages
Implementation Details
Astro Integration:
window.__CARDANO_CONFIG__initCardano(),connectWallet(),getWalletBalance()Nuxt Module:
useCardano()anduseWallet()Remix Adapter:
createCardanoLoader()andcreateCardanoAction()helpers for type-safe server functionsbalanceLoaderandutxosLoaderuseCardano(),useWallet(),useOptimisticTransaction()parseAdaAmount(),validateAddressField()SvelteKit Adapter:
balanceAda,truncatedAddress,isReadyCommon Features Across All Integrations
Configuration
Each integration follows framework conventions:
astro.config.mjsintegrationnuxt.config.tsmodule configurationAll packages are versioned at 0.1.0 and depend on workspace packages
@cardano-devkit/coreand@cardano-devkit/wallet, plus@lucid-evolution/lucid^0.4.29.