Standardize wallet platform builds and Open BSV licensing

[ty-everett]

Closes the wallet browser/mobile platform-profile portion of #324 and completes the remaining first-party Open BSV licensing consistency work.

What changed

• Replaced the wallet client/mobile source-only builds with explicit dual ESM/CJS packages, matching declarations, source maps, conditional exports, sideEffects: false, and complete health-profile scripts.
• Added deterministic public-contract and BlockHeader type-guard tests with strict lint/type/format gates and 100% coverage for the new guard tests.
• Added installed-consumer gates that pack local @bsv/sdk plus the wallet package, install into a clean project, and validate:
  • browser bundles with Vite and esbuild;
  • React Native bundles with Metro and optimized Hermes bytecode;
  • exports, module composition, runtime references, source maps, and raw/gzip/Brotli budgets.
• Added parallel browser/mobile CI lanes to the stable aggregate check and made the same gates mandatory before npm release.
• Removed static Node require('node:crypto') fallbacks from SDK browser/mobile paths while retaining Web Crypto and the guarded Node 22+ process.getBuiltinModule fallback.
• Rewrote namespace re-exports into Metro-compatible import/export forms without changing the public SDK namespace API.
• Corrected wallet mobile exports and BlockHeader type guards (cumulative, BlockHeader predicate, and chainWork).
• Kept Storage service access public/configurable by default and documented CORS/CSP/auth responsibilities for browser, WUI, extension, hybrid, and mobile consumers.
• Moved live CDN downloads into the repository's *.man.test.ts convention so normal CI remains deterministic without deleting live coverage.
• Fixed the StorageKnex query-builder type regression present on current main after fix: align consensus verification and optimize large-data paths #349.
• Standardized all first-party licensing on the canonical Open BSV License Version 6 policy. All 46 first-party manifests/copies and all 30 public tarballs are verified byte-for-byte; the WAB Marketplace image label now derives the governed Version 6 identifier instead of hard-coding Version 4.
• Reduced the repository-health baseline from 108 to 94 findings, with zero control errors.

Consumer impact

The browser and mobile packages now have stable import/require contracts that are verified as installed tarballs in their actual target toolchains. Bundle-size regressions, server-module leakage, broken source maps, missing declarations, and platform-incompatible SDK syntax will fail CI before release.

No package versions are changed and no npm release is performed in this PR.

Validation

• pnpm install --frozen-lockfile --ignore-scripts
• full pnpm build across 37 projects; 100 documentation HTML files/link graph validated
• full root pnpm test before rebase; exact-main SDK: 144 suites / 5,707 passed; wallet: 143 suites / 1,281 passed
• browser installed consumer: Vite + esbuild contracts and budgets
• mobile installed consumer: Metro + Hermes contracts and budgets
• client/mobile strict lint, typecheck, format, tests, and 100% targeted coverage
• all present package artifact checks (publint, strict type resolution, clean ESM/CJS/CLI consumers)
• pnpm audit:security: no known vulnerabilities
• pnpm health:check: 37 projects, 30 public packages, 94 findings, 11 active exceptions, 0 errors
• pnpm license:check: 46 manifests/copies on Open BSV License Version 6
• pnpm license:pack-check: 30 public tarballs carry canonical LICENSE.txt
• version and SDK peer-contract checks

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​hermes-compiler@​260318099.0.1
	npm/​metro-config@​0.87.0
	npm/​metro@​0.87.0
	npm/​@​react-native/​babel-preset@​0.86.1

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer approval-in-substance (ty-everett) for exact head 1e0c7d6fedb32454cda71cdb0c335c6a7eef5ecb.

I reviewed the full diff and all final-head evidence. The complete build/test/coverage/platform matrix, merge gate, CodeQL (Actions and JavaScript/TypeScript), dependency review, Socket, SonarCloud, repository health, docs, conformance, package/tarball licensing, and security audit are green. SonarCloud reports 0 open issues and 0 security hotspots; Codecov reports all modified and coverable lines are covered; there are no unresolved review threads.

I approve this exact head for squash merge. GitHub does not permit the PR author to submit a formal approving review, so this exact-head maintainer record is the approval artifact and the merge will use the authorized admin path without waiting for unrelated requested reviewers.