Standardize SDK and foundation runtime package contracts

[ty-everett]

Summary

Advances #324 Wave 10 with one dependency-coherent foundation/runtime pass across:

• @bsv/sdk
• @bsv/verifast
• @bsv/wallet-toolbox
• @bsv/gasp
• @bsv/teranode-listener
• @bsv/wallet-relay

Repository-health debt falls from 45 to 24 findings with 0 control errors.

What changed

• Adds the missing format, zero-warning lint, typecheck, coverage, exact-tarball, and browser contracts required by each package profile.
• Hardens exact npm artifacts with files allowlists, honest ESM/CommonJS conditional exports, mode-correct declarations, strict type-resolution checks, clean installed consumers, and non-mutating publish hooks.
• Adds reusable exact-artifact checker support for allowlisted scaffold source, peer-aware consumers, ESM-only entrypoints, and explicitly untyped raw asset entrypoints.
• Gives the SDK and Wallet Relay independently bundled Vite/esbuild browser checks, Node/server-dependency rejection, source-map validation, and measured raw/gzip/Brotli budgets. The SDK UMD bundle no longer retains a static node:https dependency.
• Expands deterministic coverage for VeriFast entrypoints/batches, Teranode listener/subtrees, Wallet Relay clients/components, and Wallet Toolbox CDN ingestion. Removes the Wallet Toolbox test's live CDN dependency.
• Consolidates Teranode listener lifecycle and legacy startup behavior, adds clean shutdown/reconnect cleanup, and validates subtree inputs/removal indexes.
• Preserves Relay as a public multi-application service by default, with opt-in CORS/origin allowlists and deployment-owned CSP guidance. Authentication, topic validation, QR signatures, tokens, and encrypted pairing remain enforced independently of CORS.
• Corrects stale package documentation and records the deterministic/manual-test, distribution, consumer, browser, and release contracts.

Validation

Exact head: 89372b13db947bb9b88d74fffd357533b40cf81e

• All six format:check, lint, and typecheck commands pass.
• All six pack:check commands pass against exact generated tarballs.
• SDK: 145 suites; 5,738 passed / 3 skipped; 91.95% statements, 83.56% branches, 94.54% functions, 92.81% lines.
• Wallet Toolbox: 143 suites passed / 5 skipped; 1,285 passed / 26 skipped; 69.12% statements, 59.09% branches, 72.83% functions, 71.06% lines.
• GASP: 21/21 tests; 91.56% statements, 82.75% branches, 89.65% functions, 92.12% lines.
• Teranode Listener: 21/21 tests; 95.69% statements, 80.32% branches, 95.16% functions, 97.65% lines.
• Wallet Relay: 138/138 tests; 80.54% statements, 72.13% branches, 77.77% functions, 82.74% lines.
• VeriFast: 72/72 tests plus real ESM, CommonJS, worker, browser-bundler, and WASM consumers.
• SDK browser tarball: Vite 706,745 raw / 171,756 gzip / 138,548 Brotli; esbuild 533,021 / 155,324 / 128,894; UMD 528,186 / 150,755 / 125,193.
• Wallet Relay client browser tarball: Vite 200,000 / 62,783 / 51,595; esbuild 167,054 / 60,853 / 51,266.
• pnpm health:check: 31/31 control tests; 37 projects, 30 public packages, 24 findings, 11 active exceptions, 0 errors.
• pnpm audit --audit-level=high: no known vulnerabilities.
• git diff --check: clean.

Release and scope

• No npm package version was changed and no artifact was published.
• Licensing was not changed.
• Draft PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306 and BDK issue refactor(sdk): reduce cognitive complexity in Hash.ts (#44) #49 remain out of scope.
• Sonar organization-side configuration is unchanged; repository-side CI analysis remains authoritative.

[codecov]

Codecov Report

❌ Patch coverage is 91.37056% with 119 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/sdk/src/script/Spend.ts	92.19%	9 Missing and 12 partials ⚠️
packages/network/ts-p2p/src/subtrees.ts	91.12%	6 Missing and 9 partials ⚠️
packages/sdk/src/primitives/Point.ts	75.86%	11 Missing and 3 partials ⚠️
packages/sdk/src/kvstore/GlobalKVStore.ts	80.32%	2 Missing and 10 partials ⚠️
packages/sdk/src/primitives/Hash.ts	78.57%	4 Missing and 5 partials ⚠️
packages/sdk/src/overlay-tools/LookupResolver.ts	84.90%	5 Missing and 3 partials ⚠️
packages/sdk/src/primitives/Curve.ts	62.50%	5 Missing and 1 partial ⚠️
packages/network/ts-p2p/src/index.ts	93.90%	1 Missing and 4 partials ⚠️
...ackages/sdk/src/primitives/TransactionSignature.ts	79.16%	0 Missing and 5 partials ⚠️
packages/sdk/src/transaction/MerklePath.ts	80.76%	0 Missing and 5 partials ⚠️
... and 8 more

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.5% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer/admin exact-head approval — ty-everett

I reviewed and approve exact head 89372b13db947bb9b88d74fffd357533b40cf81e for squash merge.

Evidence reviewed:

• CI run 30222294279: all required build, lint, policy, artifact, test, coverage, browser/mobile, dependency-review, docs, health-contract, and merge-gate jobs passed.
• CodeQL run 30222294265: JavaScript/TypeScript and Actions analyses passed; no open CodeQL alerts.
• Conformance run 30222294253: passed.
• Codecov patch coverage is 91.37% (1,260 hits, 45 misses, 74 partials), resolving the earlier stale 83.33% bot report without reducing the 90% gate.
• SonarCloud quality gate is OK with 0 open/confirmed issues and 0 unreviewed security hotspots.
• Socket project and pull-request checks passed.
• Dependabot has 0 open alerts; secret scanning has 0 open alerts. The only open code-scanning alerts are the two existing Scorecard posture items (ci(sonar): exclude tests from duplication via .sonarcloud.properties #202 fuzzing and fix(release): drop cross-ref/infra rewrites from #203, keep only version bumps #204 CII Best Practices), not CodeQL defects introduced here.
• There are no review threads, human change requests, or unresolved review comments.

GitHub does not permit a pull-request author to submit a formal approving review on their own PR, so this comment records my substantive maintainer approval. I will use the authorized admin merge solely to satisfy that formal self-review restriction; no red or pending quality gate is being bypassed.