fix(publish): never send JSON null for Hermes chain metadata

Servers treat an explicit null in the optional string fields as invalid
("Expected baseHash string" on 2.22.0/2.22.1 when no base was used). Send
only the fields that are known; absent fields are accepted by strict,
tolerant and pre-2.22 servers alike.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: sunnylqm

src/versions.ts

@@ -468,23 +468,30 @@ async function describePpkBundle(
   ppkPath: string,
   base?: HermesBaseMeta,
 ): Promise<Record<string, unknown>> {
+  // Only known values are sent: the server's optional-field parsers treat an
+  // explicit JSON null as invalid (that contract broke 2.22.0/2.22.1 publishes
+  // with "Expected baseHash string"), and omitting a field is what every
+  // server version — strict, tolerant or too old to know the field — accepts.
   const meta: Record<string, unknown> = {};
   try {
     const bundle = await extractBundleFromArchive(ppkPath);
     if (bundle) {
       meta.bundleHash = sha256Hex(bundle);
-      const hbcVersion = getHbcVersion(bundle);
-      meta.bytecodeVersion = hbcVersion ?? base?.bytecodeVersion ?? null;
+      const hbcVersion = getHbcVersion(bundle) ?? base?.bytecodeVersion;
+      if (hbcVersion != null) meta.bytecodeVersion = hbcVersion;
       await cachePut(bundle).catch(() => {});
     }
   } catch {
     // best effort: metadata never blocks a publish
   }
-  meta.baseVersionId = base?.baseVersionId ?? null;
-  meta.baseHash = base?.baseHash ?? null;
+  if (base?.baseVersionId != null) meta.baseVersionId = base.baseVersionId;
+  if (base?.baseHash) meta.baseHash = base.baseHash;
   return meta;
 }
 
+/** Exported for tests: the version/create fields derived from a ppk + base. */
+export const describePpkBundleForTests = describePpkBundle;
+
 export const versionCommands = {
   publish: async ({
     args,

tests/hermes-base.test.ts

@@ -526,3 +526,34 @@ describe.if(hasHermesc)('with a real hermesc', () => {
     );
   });
 });
+
+describe('publish metadata never sends JSON null', () => {
+  test('describePpkBundle omits unknown chain fields', async () => {
+    const { describePpkBundleForTests } = await import('../src/versions');
+    const dir = mkTemp('rnu-publish-meta-');
+    try {
+      const ppk = path.join(dir, 'v.ppk');
+      await writeZip(ppk, { 'index.bundlejs': fakeHbc(98, 'meta') });
+      const noBase = await describePpkBundleForTests(ppk, undefined);
+      expect(noBase.bundleHash).toBe(sha256Hex(fakeHbc(98, 'meta')));
+      expect(noBase.bytecodeVersion).toBe(98);
+      expect('baseVersionId' in noBase).toBe(false);
+      expect('baseHash' in noBase).toBe(false);
+      expect(Object.values(noBase).some((v) => v === null)).toBe(false);
+      const withBase = await describePpkBundleForTests(ppk, {
+        bytecodeVersion: 98,
+        baseVersionId: 7,
+        baseHash: 'objkey',
+      });
+      expect(withBase.baseVersionId).toBe(7);
+      expect(withBase.baseHash).toBe('objkey');
+      // plain JS bundle: no bytecodeVersion at all rather than null
+      const js = path.join(dir, 'js.ppk');
+      await writeZip(js, { 'index.bundlejs': Buffer.from('var a = 1;') });
+      const plain = await describePpkBundleForTests(js, undefined);
+      expect('bytecodeVersion' in plain).toBe(false);
+    } finally {
+      fs.removeSync(dir);
+    }
+  });
+});