chore: modernize, harden, and release the TypeScript stack

[ty-everett]

Outcome

Reconciles the public TypeScript stack onto one tested dependency, toolchain, correctness, and release baseline. Draft PR #306 remains excluded, and no Sonar organization setting is changed.

Highlights

• refreshes compatible direct dependencies and canonicalizes first-party links as workspace:^ while preserving public peer ranges
• removes obsolete overrides and retains one documented brace-expansion advisory override
• standardizes TypeScript linting on Oxlint and removes redundant ESLint/ts-standard configuration
• fixes PushDrop OP_16, X-Topics interoperability, overlay proof persistence, stable HTTP validation errors, fixed-width Schnorr proofs, and preservation of pre-signed inputs
• adds the remote StorageClient tenant-scope regression and corrects the auth middleware configuration name with a compatibility alias
• documents the Node 24.11 / pnpm 10 / TypeScript 6 baseline, accepted moderate/low upstream holds, release procedure, and all 30 package versions

Verification

• frozen install and cross-package version contracts pass
• audit: 0 high or critical; 4 moderate and 2 low documented upstream/tooling holds
• full workspace build passes
• full SDK suite: 144 suites, 5,693 passed, 3 skipped
• full wallet-toolbox suite: 138 passed suites, 1,244 passed tests, 27 skipped
• overlay-express: 11 passed suites, 216 passed tests
• auth middleware: 3 suites, 21 tests
• conformance: 74 files, 6,650 vectors, 0 parse errors
• docs: frontmatter, source links, 95-page static render, Pagefind, and built-link validation pass

Release and rollback

After merge, tag release/v2026-July-25 to publish only manifests ahead of npm through OIDC. Validate dist-tags, provenance, tarball imports, and then merge the generated version-sync PR. Rollback is package-specific npm deprecation/dist-tag correction; no workstation publication is used.

Closes #20
Closes #29
Closes #65
Closes #69
Closes #70
Closes #71
Closes #72
Closes #158
Closes #168
Closes #189
Closes #269
Closes #277
Closes #282
Closes #301

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​jest-fetch-mock@​3.2.0
	npm/​@​shikijs/​rehype@​4.3.1
	npm/​@​libp2p/​pnet@​3.0.25
	npm/​puppeteer-core@​24.43.1
	npm/​vitest@​4.1.10
	npm/​vite-react-ssg@​0.9.2
	npm/​@​rspack/​core@​2.1.5
	npm/​@​types/​node@​26.1.1
	npm/​vite@​8.1.5
	npm/​react@​18.3.1 ⏵ 19.2.8	+1
	npm/​@​rspack/​cli@​2.1.5
	npm/​@​libp2p/​interface@​3.2.5
	npm/​fs-extra@​11.4.0
	npm/​@​libp2p/​crypto@​5.1.21
	npm/​@​libp2p/​peer-id@​6.0.12
	npm/​@​vitejs/​plugin-react@​6.0.4
	npm/​react-dom@​18.3.1 ⏵ 19.2.8	+1		+1
	npm/​@​libp2p/​ping@​3.1.9
	npm/​@​libp2p/​tcp@​11.0.24
	npm/​mermaid@​11.16.0
	npm/​webpack-bundle-analyzer@​5.3.1
	npm/​@​libp2p/​kad-dht@​16.4.0
	npm/​webpack-cli@​7.2.1
	npm/​@​libp2p/​bootstrap@​12.0.27
	npm/​ws@​8.21.1
	npm/​libp2p@​3.3.6
	npm/​@​libp2p/​identify@​4.1.10

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/vite@8.1.5 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm puppeteer-core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: packages/verifast/package.json → npm/puppeteer-core@24.43.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/puppeteer-core@24.43.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/ts-loader@9.6.2 → npm/webpack@5.109.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[ty-everett]

Socket warning review (final dependency graph):

• @emnapi/runtime@1.11.1 is the maintained native/WASM runtime reached only through Vite 8 tooling.
• puppeteer-core@24.43.1 is a direct VeriFast development dependency used for the real-browser verification suite; it is not shipped as a runtime dependency of the published package.
• webpack@5.109.0 is a direct development dependency used only to produce the authsocket-client UMD bundle.

These are heuristic obfuscation warnings on current, expected build/test tools rather than vulnerability or install-script alerts. Both Socket checks pass. I am leaving the warnings visible rather than applying ignore/ignore-all, so future version changes continue to receive review.

[codecov]

Codecov Report

❌ Patch coverage is 96.42857% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ges/overlays/overlay-express/src/OverlayExpress.ts	91.66%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud