Wave 38: complete release readiness

.github/workflows/ci.yml

@@ -321,8 +321,6 @@ jobs:
           cache: pnpm
       - name: Install frozen dependencies
         run: pnpm install --frozen-lockfile --ignore-scripts
-      - name: Rebuild the audited workspace build tool
-        run: pnpm rebuild esbuild
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: build-outputs
@@ -431,6 +429,7 @@ jobs:
       - name: Verify affected exact-tarball browser consumers
         env:
           BROWSER_PACKAGES: ${{ needs.prepare.outputs.browser-packages }}
+          BROWSER_COMPOSITION_DIRECTORY: ${{ github.workspace }}/.browser-composition
           PREBUILT_PACKAGE_OUTPUTS: '1'
         run: |
           packages=()
@@ -455,6 +454,14 @@ jobs:
           else
             echo "No affected browser packages in this shard."
           fi
+      - name: Retain exact browser composition evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: browser-composition-${{ matrix.shard }}
+          path: .browser-composition/
+          if-no-files-found: ignore
+          retention-days: 30
 
   wallet-browser-platform:
     name: Platform / wallet browser
@@ -477,7 +484,17 @@ jobs:
           path: .ci-artifacts
       - run: tar --extract --gzip --file .ci-artifacts/build-outputs.tar.gz
       - name: Verify packed browser consumer with Vite and esbuild
+        env:
+          BROWSER_COMPOSITION_DIRECTORY: ${{ github.workspace }}/.browser-composition
         run: pnpm --filter @bsv/wallet-toolbox-client run test:browser
+      - name: Retain wallet browser composition evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: browser-composition-wallet
+          path: .browser-composition/
+          if-no-files-found: ignore
+          retention-days: 30
 
   wallet-mobile-platform:
     name: Platform / wallet mobile
@@ -524,6 +541,7 @@ jobs:
       - run: tar --extract --gzip --file .ci-artifacts/build-outputs.tar.gz
       - name: Generate SDK coverage and verify the packed browser consumer
         env:
+          BROWSER_COMPOSITION_DIRECTORY: ${{ github.workspace }}/.browser-composition
           PREBUILT_PACKAGE_OUTPUTS: '1'
         run: |
           pnpm --filter @bsv/sdk exec node \
@@ -535,6 +553,14 @@ jobs:
           node scripts/normalize-lcov-paths.mjs packages/sdk/coverage/lcov.info packages/sdk
           mkdir -p .coverage-output
           cp packages/sdk/coverage/lcov.info .coverage-output/sdk.lcov.info
+      - name: Retain SDK browser composition evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: browser-composition-sdk
+          path: .browser-composition/
+          if-no-files-found: ignore
+          retention-days: 30
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: coverage-sdk
@@ -691,16 +717,27 @@ jobs:
       - run: tar --extract --gzip --file .ci-artifacts/build-outputs.tar.gz
       - name: Generate VeriFast coverage and run packaged-consumer checks
         env:
+          BROWSER_COMPOSITION_DIRECTORY: ${{ github.workspace }}/.browser-composition
           PREBUILT_PACKAGE_OUTPUTS: '1'
         run: |
           pnpm --filter @bsv/verifast exec node \
             "$GITHUB_WORKSPACE/scripts/run-prebuilt-package-script.mjs" \
             --script test:coverage
           pnpm --filter @bsv/verifast exec node scripts/test-node-consumers.mjs
           pnpm --filter @bsv/verifast exec node scripts/test-browser-bundler.mjs
+          pnpm --filter @bsv/verifast exec node \
+            "$GITHUB_WORKSPACE/scripts/check-browser-package.mjs" .
           node scripts/normalize-lcov-paths.mjs packages/verifast/coverage/lcov.info packages/verifast
           mkdir -p .coverage-output
           cp packages/verifast/coverage/lcov.info .coverage-output/verifast.lcov.info
+      - name: Retain VeriFast browser composition evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: browser-composition-verifast
+          path: .browser-composition/
+          if-no-files-found: ignore
+          retention-days: 30
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: coverage-verifast
@@ -727,6 +764,11 @@ jobs:
           node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Restore the immutable MongoDB test binary
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: ${{ runner.temp }}/mongodb-binaries
+          key: mongodb-memory-server-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: build-outputs
@@ -828,6 +870,14 @@ jobs:
           fi
           echo "files=$FILES" >> "$GITHUB_OUTPUT"
 
+      - name: Enforce the repository-owned 90% patch-coverage gate
+        if: github.event_name == 'pull_request'
+        run: >-
+          node scripts/patch-coverage.mjs
+          --base "${{ github.event.pull_request.base.sha }}"
+          --lcov-directory .coverage-artifacts
+          --target 90
+
       - name: Upload coverage to Codecov
         if: steps.cov.outputs.has-coverage == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0

.github/workflows/mutation-tests.yml

@@ -97,9 +97,6 @@ jobs:
       - name: Install frozen dependencies
         run: pnpm install --frozen-lockfile --ignore-scripts
 
-      - name: Rebuild the audited workspace build tool
-        run: pnpm rebuild esbuild
-
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: mutation-build-outputs

conformance/runner/package.json

@@ -16,9 +16,9 @@
     "ajv": "^8.20.0"
   },
   "devDependencies": {
-    "oxlint": "^1.75.0",
-    "prettier": "^3.9.6",
     "@typescript/native": "npm:typescript@7.0.2",
+    "oxlint": "^1.76.0",
+    "prettier": "^3.9.6",
     "typescript": "npm:@typescript/typescript6@6.0.2"
   },
   "license": "SEE LICENSE IN LICENSE.txt"

conformance/runner/ts/package.json

@@ -11,12 +11,12 @@
   "devDependencies": {
     "@bsv/sdk": "workspace:^",
     "@jest/globals": "^30.4.1",
-    "@types/node": "^24.13.3",
+    "@types/node": "^26.1.2",
+    "@typescript/native": "npm:typescript@7.0.2",
     "jest": "^30.4.2",
-    "oxlint": "^1.75.0",
+    "oxlint": "^1.76.0",
     "prettier": "^3.9.6",
     "ts-jest": "^29.4.12",
-    "@typescript/native": "npm:typescript@7.0.2",
     "typescript": "npm:@typescript/typescript6@6.0.2"
   },
   "license": "SEE LICENSE IN LICENSE.txt"

docs-site/package.json

@@ -24,12 +24,13 @@
     "@shikijs/rehype": "^4.3.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
+    "@typescript/native": "npm:typescript@7.0.2",
     "@vitejs/plugin-react": "^6.0.4",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "gray-matter": "^4.0.3",
     "mermaid": "^11.16.0",
-    "oxlint": "^1.75.0",
+    "oxlint": "^1.76.0",
     "pagefind": "^1.5.2",
     "prettier": "^3.9.6",
     "rehype-autolink-headings": "^7.1.0",
@@ -38,7 +39,6 @@
     "remark-gfm": "^4.0.1",
     "remark-mdx-frontmatter": "^5.2.0",
     "rollup": "^4.62.3",
-    "@typescript/native": "npm:typescript@7.0.2",
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "vite": "^8.1.5"
   },

docs/infrastructure/service-edge-security.md

@@ -3,8 +3,8 @@ id: infra-service-edge-security
 title: "Public Service Edge Security"
 kind: reference
 version: "1.0.0"
-last_updated: "2026-07-25"
-last_verified: "2026-07-25"
+last_updated: "2026-07-30"
+last_verified: "2026-07-30"
 review_cadence_days: 30
 status: stable
 tags: [infrastructure, security, cors, rate-limits, authentication, operations]
@@ -69,6 +69,14 @@ JavaScript attempt the same signed or token-authenticated protocol call that a
 mobile or server client can attempt. No service in this inventory uses ambient
 browser cookies as its authorization boundary.
 
+`governance/service-edge-browser-policy.json` records this contract and every
+WAB, UHRP, Message Box, Chaintracks, OverlayExpress, and Wallet Storage
+integration. Repository health verifies the public wildcard/no-credentials
+default, opaque-origin support, opt-in exact allowlists and credentials,
+disabled mode, service/global precedence, and the independence of CSP and
+CORS. The canonical tests are synchronized across the reusable Overlay and
+Storage implementations.
+
 ### CSP and other response headers
 
 API responses use `nosniff`, deny framing, no-referrer, a restrictive

docs/packages/helpers/amountinator.md

@@ -3,10 +3,10 @@ id: pkg-amountinator
 title: '@bsv/amountinator'
 kind: package
 domain: helpers
-version: '2.1.3'
+version: '2.1.4'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/amountinator'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/helpers/amountinator'

docs/packages/helpers/create-bsv-app.md

@@ -3,9 +3,9 @@ id: pkg-create-bsv-app
 title: 'create-bsv-app'
 kind: package
 domain: helpers
-version: '1.0.3'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+version: '1.0.4'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/create-bsv-app'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/helpers/create-bsv-app'

docs/packages/helpers/did-client.md

@@ -3,10 +3,10 @@ id: pkg-did-client
 title: '@bsv/did-client'
 kind: package
 domain: helpers
-version: '1.2.2'
+version: '1.2.3'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/did-client'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/helpers/did-client'

docs/packages/helpers/did.md

@@ -3,10 +3,10 @@ id: pkg-did
 title: '@bsv/did'
 kind: package
 domain: helpers
-version: '0.2.3'
+version: '0.2.4'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/did'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/helpers/did'

docs/packages/helpers/fund-wallet.md

@@ -3,10 +3,10 @@ id: pkg-fund-wallet
 title: '@bsv/fund-wallet'
 kind: package
 domain: helpers
-version: '1.4.2'
+version: '1.4.3'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/fund-wallet'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/helpers/fund-wallet'

docs/packages/helpers/simple.md

@@ -3,10 +3,10 @@ id: pkg-simple
 title: '@bsv/simple'
 kind: package
 domain: helpers
-version: '0.4.7'
+version: '0.4.8'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/simple'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/helpers/simple'

docs/packages/helpers/templates.md

@@ -3,10 +3,10 @@ id: pkg-templates
 title: '@bsv/templates'
 kind: package
 domain: helpers
-version: '1.9.4'
+version: '1.9.5'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/templates'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/helpers/ts-templates'

docs/packages/helpers/wallet-helper.md

@@ -3,10 +3,10 @@ id: pkg-wallet-helper
 title: '@bsv/wallet-helper'
 kind: package
 domain: helpers
-version: '0.1.5'
+version: '0.1.6'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/wallet-helper'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/helpers/bsv-wallet-helper'

docs/packages/messaging/authsocket-client.md

@@ -3,10 +3,10 @@ id: pkg-authsocket-client
 title: '@bsv/authsocket-client'
 kind: package
 domain: messaging
-version: '2.1.2'
+version: '2.1.3'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/authsocket-client'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/messaging/authsocket-client'

docs/packages/messaging/authsocket.md

@@ -3,10 +3,10 @@ id: pkg-authsocket
 title: '@bsv/authsocket'
 kind: package
 domain: messaging
-version: '2.1.3'
+version: '2.1.4'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/authsocket'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/messaging/authsocket'

docs/packages/messaging/message-box-client.md

@@ -3,10 +3,10 @@ id: pkg-message-box-client
 title: '@bsv/message-box-client'
 kind: package
 domain: messaging
-version: '2.2.5'
+version: '2.2.6'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/message-box-client'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/messaging/message-box-client'

docs/packages/messaging/paymail.md

@@ -3,10 +3,10 @@ id: pkg-paymail
 title: '@bsv/paymail'
 kind: package
 domain: messaging
-version: '2.4.4'
+version: '2.4.5'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/paymail'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/messaging/ts-paymail'

docs/packages/middleware/402-pay.md

@@ -3,10 +3,10 @@ id: pkg-402-pay
 title: '@bsv/402-pay'
 kind: package
 domain: middleware
-version: '0.2.3'
+version: '0.2.4'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-29'
-last_verified: '2026-07-29'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/402-pay'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/middleware/402-pay'