Fix stale audit row, add refund test, run cargo doc in CI, commit npm lockfile

Closes #170, closes #174, closes #173, closes #167

- docs/access-control-audit.md: correct the refund permissionless-window
  row, which said the deliberate no-auth path opens "at/after deadline";
  it actually opens at deadline + GRACE_PERIOD since #49 introduced the
  14-day grace period to stop a sponsor from racing permissionless
  refund() against an already-processed release(). Cross-referenced #49.
- contracts/escrow/src/test.rs: add
  test_contribute_rejects_after_already_refunded, mirroring
  test_contribute_rejects_after_already_paid, covering the AlreadyRefunded
  branch of contribute()'s status check that had no test.
- .github/workflows/ci.yml: run cargo doc --workspace --no-deps
  --document-private-items with RUSTDOCFLAGS=-D warnings so broken
  intra-doc links or malformed doc comments fail CI instead of only
  being caught by chance.
- .gitignore / package-lock.json: stop ignoring package-lock.json and
  commit it so @stellar/stellar-sdk's resolved dependency tree (used by
  scripts/deploy.mjs, which deployed the live testnet contracts) is
  reproducible across machines, matching the reproducibility guarantee
  Cargo.lock already gives the Rust side.

Author: SarahDoma

.github/workflows/ci.yml

@@ -25,6 +25,11 @@ jobs:
       - run: cargo clippy --workspace --all-targets -- -D warnings
       - run: cargo test --workspace
 
+      - name: Check documentation (catches broken intra-doc links)
+        env:
+          RUSTDOCFLAGS: "-D warnings"
+        run: cargo doc --workspace --no-deps --document-private-items
+
       - name: Generate and print code coverage
         run: cargo llvm-cov --workspace
 

.gitignore

@@ -24,4 +24,3 @@ test_snapshots/
 
 # deploy script dependencies (scripts/)
 node_modules/
-package-lock.json

contracts/escrow/src/test.rs

@@ -743,6 +743,29 @@ fn test_contribute_rejects_after_already_paid() {
     assert_eq!(err, Err(Ok(Error::AlreadyPaid)));
 }
 
+#[test]
+fn test_contribute_rejects_after_already_refunded() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let (_, _admin, _treasury, client) = setup(&env);
+
+    let token_admin = Address::generate(&env);
+    let (token_addr, asset_client, _token_client) = create_token(&env, &token_admin);
+    let alice = Address::generate(&env);
+    let bob = Address::generate(&env);
+    asset_client.mint(&alice, &10_000i128);
+    asset_client.mint(&bob, &10_000i128);
+
+    env.ledger().set_timestamp(100);
+    client.fund(&106u64, &alice, &token_addr, &5_000i128, &200u64, &None);
+
+    env.ledger().set_timestamp(200 + crate::GRACE_PERIOD);
+    client.refund(&106u64);
+
+    let err = client.try_contribute(&106u64, &bob, &1_000i128);
+    assert_eq!(err, Err(Ok(Error::AlreadyRefunded)));
+}
+
 #[test]
 fn test_contribute_rejects_beyond_max_sponsors() {
     let env = Env::default();

docs/access-control-audit.md

@@ -17,8 +17,8 @@ signature requirement on any particular address.
 | `initialize` | Deployer/authorized setup only (implicit — not written down anywhere) | none | `admin.require_auth()` | **Mismatch, fixed** — see "`initialize` has no access control" below |
 | `fund` | Sponsor-only | `sponsor.require_auth()` | unchanged | Match |
 | `release` | Admin-only | `require_admin(&env)?.require_auth()` | unchanged | Match |
-| `refund` (before `deadline`) | Admin-only | `require_admin(&env)?.require_auth()` | unchanged | Match |
-| `refund` (at/after `deadline`) | Permissionless (deliberate) | none | unchanged | Match — see [refund analysis](./refund-permissionless-analysis.md) |
+| `refund` (before `deadline + GRACE_PERIOD`) | Admin-only | `require_admin(&env)?.require_auth()` | unchanged | Match |
+| `refund` (at/after `deadline + GRACE_PERIOD`) | Permissionless (deliberate) | none | unchanged | Match — see [refund analysis](./refund-permissionless-analysis.md). The permissionless window opens at `deadline + GRACE_PERIOD`, not at `deadline` itself; the 14-day `GRACE_PERIOD` was introduced by [#49](https://github.com/MergeFi/contracts/issues/49) to close a race where a sponsor could call permissionless `refund()` right at `deadline` to claw back funds from a contributor whose `release()` had already landed. |
 | `extend_deadline` (new, this PR) | Sponsor-only, monotonic | n/a | `escrow.sponsor.require_auth()` + `new_deadline` must strictly increase | Match (new function) |
 | `get_escrow` | Permissionless (view) | none | unchanged | Match |
 | `get_admin` | Permissionless (view) | none | unchanged | Match |