[rokso]

Release 0.2.0-alpha.1: the slotdiff command line, plus the release and security setup around it.

What's in it

• CLI: slotdiff <old> <new>, each side a contract from your build info (Foundry, Hardhat 2, Hardhat 3) or an address (a proxy, read as the implementation it runs now, or an implementation). Three checks: storage layout (OpenZeppelin), ERC-7201 slots (the slot the code really uses, compared with the annotation and with the deployed code), and OpenZeppelin's safety rules. Exit 0 only when every check ran and passed, 1 when one failed, 2 when something could not be checked.
• Library: findBuildInfo, analyzeSource, checkNamespaces.
• Output: colors and a banner on an interactive terminal only; plain in pipes and CI (NO_COLOR, FORCE_COLOR honored).
• Security fix: explorer errors no longer repeat fetch's error text, which could quote the API key.
• Project: CI (Node 22.13.0, 24, 26), OpenSSF Scorecard, Dependabot, SECURITY.md, and a publish workflow using npm trusted publishing with staged releases and provenance.
• Breaking: Node 22.13+ (was 22.12+).

Commits

• fix(explorer): never echo fetch error text
• feat: add build-info reader
• feat: add cli with safety rules check
• feat: check erc-7201 slots against annotations
• feat(cli): add colors and banner
• chore: add ci, scorecard and trusted publishing
• style: unwrap markdown prose (mechanical: Prettier proseWrap: never)
• chore: release 0.2.0-alpha.1

Verification

• Each commit passes lint, typecheck, tests and build on its own; 245 tests at the tip.
• Every fix has a test that fails without it (checked by mutation).
• Real runs: Foundry, Hardhat 2 and 3 projects, anvil, OpenZeppelin contracts-upgradeable 5.6.1, and mainnet proxies.
• Three rounds of independent review (correctness, design, new user, and a pre-release pass).