fix(amountinator): enforce package artifact contract

[ty-everett]

Program scope

Advances #324 Wave 10 and the remaining npm package-artifact portion of Wave 6. This is the first profile-by-profile quality slice after the completed licensing wave.

What changed

• repairs @bsv/amountinator packaging: the previous manifest exposed out/src/index.js without an export map even though its emitted module syntax and implicit CommonJS package mode were incompatible;
• emits matching Node.js 22 ESM, CommonJS, and declaration entry points with an explicit conditional export map;
• introduces a reusable actual-tarball verifier that runs publint, the strict @arethetypeswrong/core analyzer, payload policy checks, and clean ESM/CommonJS consumer installs;
• makes implemented package-artifact checks blocking after CI builds and before release-plan resolution;
• gives Amountinator real format:check, zero-warning lint, coverage, typecheck, and pack:check scripts;
• replaces the unexplained skipped network-style test with a deterministic behavioral test;
• records the repository-health improvement from 137 to 131 findings, including zero remaining missing-export findings; and
• corrects the Amountinator documentation source links and documents its package compatibility contract.

The verifier checks the exact pnpm pack artifact with lifecycle scripts disabled. It rejects tests, uncompiled TypeScript, compiler caches, and lockfiles; validates package identity and required root files; resolves declarations under every strict Node/bundler mode; and imports/requires the installed tarball from a clean consumer.

Dependency Review initially identified eight low-Scorecard development transitive packages. Human review traced six to the ATTW presentation CLI, so the implementation now calls the same latest 0.18.5 core analyzer directly and fails on every reported problem. This removes 25 unnecessary packages and leaves only three reviewed build/check-tool transitive warnings (publint → sade/mri, and tsdown → tree-kill), with zero known vulnerabilities and no runtime dependencies added.

Impact

Consumers receive working, typed ESM and CommonJS entry points instead of the previous ambiguous package shape. Future packages can adopt the same pack:check contract incrementally, while CI and release workflows automatically enforce every implemented check.

No package version was bumped, tagged, or published. Release versions remain deferred to the coordinated final program release train. No service runtime, CORS, CSP, or public-origin behavior changed.

Validation

• pnpm --filter @bsv/amountinator build
• pnpm --filter @bsv/amountinator format:check
• pnpm --filter @bsv/amountinator lint
• pnpm --filter @bsv/amountinator typecheck
• pnpm --filter @bsv/amountinator test:coverage — 11/11 tests, 0 skipped; 77.41% statements, 71.68% branches
• pnpm --filter @bsv/amountinator pack:check — payload, publint, strict ATTW core, clean ESM/CJS consumers
• dependency-free clean-room payload-policy test — 2/2
• pnpm health:check — 24/24 controls; 131 known findings, 0 control errors
• pnpm build — all 36 non-root workspace projects
• pnpm -r --if-present --filter '!@bsv/ts-stack' run pack:check
• pnpm conformance — 74 files / 6,650 vectors, 0 parse/structure errors
• pnpm docs:build — 95 routes / 100 built HTML files
• pnpm check-versions
• pnpm license:check
• pnpm license:pack-check — all 30 public package tarballs
• pnpm audit --audit-level=low — no known vulnerabilities
• all workflow YAML parsed; git diff --check

Local pnpm codegen:check cannot complete on this Mac because uv is unavailable after the OpenAPI TypeScript generation step; the hosted reproducible Codegen workflow remains required before merge.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​arethetypeswrong/​core@​0.18.5
	npm/​publint@​0.3.22
	npm/​tsdown@​0.22.14

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[ty-everett]

Hosted CI found one dependency-order issue in the new unit test: the repository-health job intentionally runs before dependency installation, while the verifier imported publint at module load time. Commit 68df00eb1 lazy-loads publint only for actual tarball checks, preserving dependency-free pure policy tests without weakening the runtime verifier.

Reproduced locally by copying only the verifier and its test into a fresh directory with no node_modules: 2/2 tests pass. Full pnpm health:check remains 24/24 and the real Amountinator tarball/publint/ATTW/ESM/CJS check also passes. Fresh hosted checks are running.

[ty-everett]

Two quality follow-ups are now pushed:

• de825667b responds to Dependency Review’s low-Scorecard annotations by replacing the ATTW presentation CLI with the same v0.18.5 core analyzer in strict all-problems mode. This removes 25 unnecessary development packages and six of eight initial annotations. The remaining three unique low-Scorecard transitive packages are build/check-only (publint → sade/mri; tsdown → tree-kill), while Socket rates all three direct tools 98–100 for supply-chain/vulnerability posture and pnpm audit --audit-level=low is clean.
• Sonar’s passing aggregate gate still exposed two new issues (critical S3776 complexity 16/15 and major S7785). a5c4bb6ae decomposes the payload validator into focused policies and uses top-level await; both findings were fixed rather than accepted or deferred.

Clean-room dependency-free tests, all 24 repository controls, the real strict tarball/ESM/CJS check, and the low-severity audit pass locally. Fresh hosted analysis is required to show zero Sonar issues before merge.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Maintainer review by ty-everett: approved in substance for merge. I reviewed the final diff, dependency annotations, strict package-artifact behavior, local validation, all hosted checks, and direct Sonar API state. The final head has no review threads or requested reviewers; CodeQL, Dependency Review, Socket, coverage, CI/merge gate, conformance, codegen, docs, and infrastructure lanes pass; Sonar reports 0 open issues and 0 security hotspots. The three low-Scorecard annotations are development-only transitives of the selected package build/check tools, have no known vulnerability, and are documented rather than silently ignored. GitHub does not allow an author to submit a formal approval on their own PR, so this comment records the administrator-directed maintainer approval before authorized admin merge. No package or image is published by this PR.

[ty-everett]

The ready-for-review transition exposed Codecov patch coverage at 55.56% (four partially covered changed conditional lines). Commit 746279b18 adds behavioral coverage for unknown currency prefixes, tiny BSV formatting, and decimal strings inferred as BSV. The changed formatter branches are now 100% covered locally; Amountinator is 12/12 tests with 80.68% line and 76.1% branch coverage, and format/lint/typecheck pass. No production behavior or coverage threshold was changed. Fresh hosted checks are running before merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Final maintainer review by ty-everett for head 746279b18: approved in substance after the coverage follow-up. All current GitHub, CodeQL, Dependency Review, Socket, Sonar, conformance, codegen, docs, coverage-shard, aggregate, infrastructure, and merge-gate checks pass. Sonar is 0 open issues / 0 hotspots. Codecov has completed the current report at 100% patch coverage (9 hits, 0 misses, 0 partials). There are no requested reviewers or review threads. GitHub cannot record author self-approval, so this is the final administrator-directed approval record for the exact head being merged.