Enforce cross-package TypeScript compatibility

[ty-everett]

Program and scope

• Tracker: [Program] Complete TypeScript stack health, security, standardization, testing, docs, and performance #324
• Program gates advanced: TypeScript profile enforcement, cross-package declaration compatibility, CI/release quality gates
• Explicitly out of scope: TypeScript 7 adoption remains blocked by ts-jest's <7 peer range; no package publication or version bump is performed here

What changed

• Add a root pnpm typecheck contract that runs every workspace project's governed typecheck after package outputs are built.
• Run that contract in both pull-request CI and the protected npm release workflow.
• Require the root and docs-site typecheck scripts through repository-health profiles.
• Add a governance regression test proving CI and release retain post-build typechecking.
• Fix Fund Wallet's reproduced SDK nominal-type conflict by loading and typing the CommonJS SDK condition used by its CommonJS Wallet Toolbox dependency. This keeps both the runtime module and private-field type identity aligned while preserving the SDK's valid ESM and CommonJS package contracts.
• Document the cross-package typecheck and contributor command.

Root cause

Fund Wallet is ESM, while Wallet Toolbox is currently CommonJS. A normal ESM import of @bsv/sdk selected the SDK's ESM declarations, while Wallet Toolbox's public constructor selected the CommonJS declarations. SDK classes such as BigNumber contain private fields, so TypeScript correctly treated those two conditional declaration graphs as distinct nominal identities. The existing per-package build and manifest peer checks did not compile the fully built workspace declaration graph, allowing the mismatch to escape CI.

Validation

• pnpm install --frozen-lockfile --ignore-scripts; pnpm rebuild esbuild
• pnpm build
• pnpm typecheck — all governed workspace typechecks pass, including Fund Wallet
• pnpm lint
• pnpm test — full workspace suite passes
• pnpm health:check — 38 tests pass; 37 projects, 30 public packages, 0 contract findings
• pnpm audit:security — no known vulnerabilities
• pnpm check-versions
• pnpm test:governance — 550 required test files, 25 property suites, governed skips unchanged
• pnpm codegen:check — 9 generated files current
• pnpm format:check
• pnpm --filter @bsv/fund-wallet test:coverage — 15 tests; 91.89% statements / 93.15% branches / 92.3% lines
• pnpm --filter @bsv/fund-wallet test:property — 3 property tests pass
• pnpm --filter @bsv/fund-wallet pack:check — clean installed CLI consumer passes
• pnpm --filter @bsv/sdk pack:check — strict ESM/CommonJS types and clean consumers pass
• built fund-metanet --help executes successfully

Release and security

• Public package source changed: @bsv/fund-wallet; a future protected release should patch it from 1.4.1 to 1.4.2.
• No dependency, lockfile, override, advisory dismissal, suppression, skipped test, or workflow-permission change.
• No npm publication was performed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Maintainer review completed by ty-everett at exact head b33aa1f3af7e2fd0cddaba5f68cfd2525699c79b.

I reviewed the root post-build typecheck contract and the Fund Wallet dual-package boundary fix. The runtime and declaration conditions are deliberately aligned to the CommonJS SDK condition used by Wallet Toolbox, avoiding the private-field nominal-identity split without weakening the SDK’s valid ESM/CommonJS type exports. CI and release both enforce the root typecheck after build, and repository-health tests guard the ordering.

All hosted checks are green, including full build/typecheck/lint/policy, package and platform tests, every coverage shard, Codecov patch, CodeQL security-extended analysis, Dependency Review, Socket, infrastructure jobs, Sonar, and merge-gate. Sonar reports an OK gate, 0 open/confirmed PR issues, and 0 security hotspots. The PR has 0 review threads or change requests; CodeQL has 0 open source findings; Dependabot and secret scanning are both at 0.

GitHub does not permit an author to formally approve their own PR. Per the repository governance recorded in #324 and the operator’s explicit authorization, admin facilitation will cross only that impossible self-review condition after this exact-head attestation. No version or publication is included in this PR.