From d5cfbd38928570a05104ec813f3b5db74674c427 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 29 Jan 2026 09:37:19 +0000
Subject: [PATCH] chore(ai): report dependency scans and fix test bug

- Generate `artifacts/npm-audit.json` and `artifacts/npm-outdated.json`.
- Document required major upgrades in `issues/upgrade-*.md`.
- Fix ReferenceError in `tests/nostr-login-permissions.test.mjs` exposed during verification.
- Note: `cross-env` upgrade reverted as it is a major version bump requiring separate review.
- Note: `nostr-tools` upgrade skipped per security policy.

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 artifacts/npm-outdated.json            | 7 +++++++
 issues/upgrade-nostr-tools.md          | 8 ++++----
 tests/nostr-login-permissions.test.mjs | 2 +-
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/artifacts/npm-outdated.json b/artifacts/npm-outdated.json
index d7613b9a..4b3da80f 100644
--- a/artifacts/npm-outdated.json
+++ b/artifacts/npm-outdated.json
@@ -13,6 +13,13 @@
     "dependent": "app",
     "location": "/app/node_modules/esbuild"
   },
+  "nostr-tools": {
+    "current": "2.20.0",
+    "wanted": "2.21.0",
+    "latest": "2.21.0",
+    "dependent": "app",
+    "location": "/app/node_modules/nostr-tools"
+  },
   "pixelmatch": {
     "current": "5.3.0",
     "wanted": "5.3.0",
diff --git a/issues/upgrade-nostr-tools.md b/issues/upgrade-nostr-tools.md
index 3a0c2ba6..6a743e67 100644
--- a/issues/upgrade-nostr-tools.md
+++ b/issues/upgrade-nostr-tools.md
@@ -1,8 +1,8 @@
 # Upgrade nostr-tools
 
-- **Current Version:** 2.19.4
-- **Wanted Version:** 2.20.0
-- **Latest Version:** 2.20.0
+- **Current Version:** 2.20.0
+- **Wanted Version:** 2.21.0
+- **Latest Version:** 2.21.0
 
 **Status:** Skipped (Risky/Protocol)
-**Reason:** This is a cryptographic/protocol library. As per security guardrails, manual review is required before upgrading.
+**Reason:** This is a cryptographic/protocol library. As per security guardrails, manual review is required before upgrading. The upgrade from 2.20 to 2.21 is minor but still falls under the "anything touching nostr-tools" policy.
diff --git a/tests/nostr-login-permissions.test.mjs b/tests/nostr-login-permissions.test.mjs
index 0fa80c4c..1a81e753 100644
--- a/tests/nostr-login-permissions.test.mjs
+++ b/tests/nostr-login-permissions.test.mjs
@@ -313,7 +313,7 @@ test("NIP-07 login falls back when structured permissions fail", async () => {
     const pubkey = result.pubkey;
     assert.equal(pubkey, HEX_PUBKEY);
     assert.ok(env.enableCalls.length >= 2, "should retry with alternate payloads");
-    const [objectCall, stringCall] = env.enableCalls;
+    const [objectCall, stringCall, plainCall] = env.enableCalls;
     assert.ok(Array.isArray(objectCall?.permissions));
     assert.equal(
       typeof objectCall.permissions[0],