@revealui/revealcoin-manifest

On-chain truth manifest for RevealCoin (RVC) — a Solana Token-2022 hybrid utility/governance/reward token issued by RevealUI Studio.

This package exports the chain-derived addresses (mint, multisig authority, allocation wallets) for every Solana network on which RVC is deployed. It is the canonical source of truth for those values; all other RevealUI Suite packages (notably @revealui/contracts/revealcoin) consume them from here rather than hardcoding base58 strings.

Why a separate package

@revealui/contracts/revealcoin declares the human-decided parameters of the token (name, symbol, decimals, total supply, allocation percentages + vesting descriptions, discount rates). Those values are decided in the white paper and don't change unless governance votes change them.

This package declares the chain-derived values (mint address per network, multisig authority per network, allocation wallet addresses). Those values come from running keypair generation + on-chain deploy in this repo's deploy flow; they are emitted once per deploy and pinned to a published version.

The split exists so that the manual console.log("[ ] Update RVC_MINT_ADDRESSES in @revealui/contracts") reminders in this repo's deploy scripts can go away — the dependency becomes declarative instead of human-tracked.

Status

Pre-mainnet (0.x). Devnet addresses are real (deployed). Mainnet and testnet entries are empty strings — populated by the emitter (packages/scripts/src/emit-manifest.ts in this repo) at mainnet deploy time and re-published as 1.0.0.

This package follows SemVer 2.0.0. Pre-1.0 minor bumps may include breaking changes (new fields renamed, schema shape changes); post-1.0 follows strict major-on-break.

Install

pnpm add @revealui/revealcoin-manifest

Usage

import {
	getNetworkManifest,
	getAllocationManifest,
	REVEALCOIN_MANIFEST,
} from "@revealui/revealcoin-manifest";

// Look up a network's mint address (returns undefined when not deployed)
const devnet = getNetworkManifest("devnet");
console.log(devnet?.mintAddress);
// => "4Ysb1gkz21FD2B9P8P5Pm8bHh4CAMKYU1L528e1MigPo"

// Look up an allocation wallet by name
const ecosystem = getAllocationManifest("Ecosystem Rewards");
console.log(ecosystem?.wallet);
// => "HRpDTX76PSRiXpgct2aTPbCfzoSzoJs9XyhY3SZEkx93"

// Inspect provenance
console.log(REVEALCOIN_MANIFEST.metadata);
// => {
//      emittedAt: "...",
//      emitter: "@revealui/[email protected]",
//      commit: "abc1234",         // optional, set when emitted from a git checkout
//      contentHash: "sha256:..."  // canonical hash, see "Hash verification" below
//    }

// Optional: verify the manifest's content hash matches the embedded one
// (Node-only — uses node:crypto)
import { computeManifestHash } from "@revealui/revealcoin-manifest";
const ok = REVEALCOIN_MANIFEST.metadata.contentHash === computeManifestHash(REVEALCOIN_MANIFEST);

Schema

See src/types.ts for the complete TypeScript interface.

interface RevealcoinManifest {
	readonly schemaVersion: 1;
	readonly networks: ReadonlyArray<NetworkManifest>;       // mint + authority per network
	readonly allocations: ReadonlyArray<AllocationManifest>; // wallet per named allocation
	readonly metadata: ManifestMetadata;                     // provenance + contentHash
}

Hash verification

Every emitted manifest carries a metadata.contentHash of the form sha256:<hex>. The hash is computed over a canonical projection of the manifest with the contentHash field itself blanked, so hand-edits to any other field invalidate the hash.

This repo's CI runs pnpm verify-manifest on every PR — it recomputes the hash and fails the build on mismatch. The check requires no keypair material; the keys themselves stay in revvault and are only loaded at deploy time when the operator runs pnpm emit-manifest --network <X> to regenerate the file.

External consumers can recompute the hash via computeManifestHash(REVEALCOIN_MANIFEST) (Node-only — uses node:crypto).

Security posture

• Mainnet addresses published here are already public on-chain by construction; this package mirrors them, it does not reveal anything new.
• This package never carries secrets. Mainnet keypair files stay in revvault under revealcoin/ per the suite's secret-management rule.
• Address mismatch between this manifest and on-chain reality at consumer time = real-money loss. Consumers SHOULD pin a specific manifest version (@revealui/revealcoin-manifest@<x.y.z>) and verify with npm view before deploying changes.

License

MIT.