opm push

Sign, scan, publish, register on-chain, write ENS records.

opm push

The full publish pipeline: sign your package, scan with 3 AI agents, publish to npm, register on-chain, upload audit report, and write ENS text records.

Usage

Basic

opm push

What Happens

1. Pack & sign

   Creates tarball via npm pack, computes SHA-256 checksum, signs with ECDSA using OPM_SIGNING_KEY.

2. Resolve ENS

   Resolves your wallet to an ENS name (Sepolia → Mainnet fallback).

3. AI scan

   3 agents (Claude, Gemini, DeepSeek) analyze in parallel. Each submits a risk score on-chain.

4. Risk gate

   Aggregate score ≥ 80 or CRITICAL → publish blocked.

5. Publish to npm

   Publishes tarball to the npm registry.

6. Register on-chain

   Calls OPMRegistry.registerPackage() with checksum, signature, ENS name.

7. Upload report

   Formatted markdown report uploaded to Fileverse (IPFS-backed, encrypted).

8. Write ENS records

   Sets opm.version, opm.checksum, opm.fileverse, opm.risk_score, and more on your ENS name. Creates package subname (e.g. express.djpai.eth) if you own the parent. Sets contenthash to Fileverse IPFS CID.

Required Environment Variables

Variable	Purpose
OPM_SIGNING_KEY	Ethereum private key for ECDSA signing
OPENROUTER_API_KEY or OPENAI_API_KEY	AI agent scanning
AGENT_PRIVATE_KEY	Agent wallet for on-chain score submission (needs Base Sepolia ETH)

Optional

Variable	Purpose
NPM_TOKEN	npm automation token (alternative to --token flag)
FILEVERSE_API_KEY	Audit report uploads

Packages with risk score ≥ 80 are blocked. The scan fails, npm publish is skipped, and no on-chain registration occurs.

Output

Every transaction shows a clickable BaseScan link: score submissions, package registration, ENS record writes. Plus the Fileverse report URI and npm package URL.

See ENS Text Records for the full list of records written during push.