perf(wallet): accelerate createAction funding pipeline

[ty-everett]

What

• plan legacy createAction funding completely in memory before inserting its transaction row
• claim every selected managed-change input atomically in one storage transaction, with guarded conflict detection and bounded replanning
• share the exact unreserved managed-change predicate with action batches
• add a composite Knex funding-selection index and IndexedDB v3 user/basket + outpoint indexes
• remove IndexedDB's per-output transaction-status lookup and batch storage reads/status checks
• hydrate offloaded scripts once per source transaction outside the write lock
• fetch distinct source BEEFs concurrently, cache unchanged SDK BEEF dependency sorts, and avoid eagerly indexing large known-txid histories
• add privacy-safe spans for validation, candidate scan, planning, claim, persistence, source hydration, BEEF fetch/merge/trim, serialization, and known-txid preparation
• stage @bsv/sdk@2.2.18 and Wallet Toolbox/client/mobile 2.4.22

Why

Recent successful wallet telemetry showed createAction around 2.16 s p50, with storage planning/creation around 2.145 s p50 and BEEF merging around 1.795 s p50. The old allocator performed one storage transaction per selected input; fragmented wallets could therefore turn a single action into hundreds of queries and more than 100 write transactions. It also inserted a transaction before proving economic sufficiency.

This keeps the historical exact / least-over / largest-under selection policy and fee model, but separates read-only planning from one atomic claim.

Measured impact

Identical SQLite benchmark against unmodified c212b5ee7:

Case	Baseline	This PR
20 candidates / 6 selected	10.48 ms, 46 queries, 6 DB tx	6.34 ms, 17 queries, 1 DB tx
147 candidates / 102 selected	107.34 ms, 622 queries, 102 DB tx	8.63 ms, 17 queries, 1 DB tx

The representative fragmented case is 12.4x faster locally, with storage work flat as selected-input count grows. The retained SDK benchmark also reduces 50 unchanged sorts of a 20k-transaction BEEF from a 235.86 ms median to 9.72 ms (24.3x); cold-sort behavior is unchanged.

Compatibility and privacy

There are no changes to:

• BRC-103/104 wire formats or handshake/message behavior
• AuthFetch request/response behavior or headers
• Auth Express Middleware
• AuthSocket or AuthSocket Client
• JSON-RPC/remoting contracts
• wallet result shapes or fee/selection semantics

Trace context remains local to existing telemetry carriers/sinks. Attributes are bounded counts, sizes, flags, fees, and timings only—never txids, outpoints, scripts, payloads, identity keys, or secrets. Existing external storage providers remain source-compatible through concrete fallback methods.

Storage migrations

• Knex: 2026-08-02-001 add createAction funding selection index
• IndexedDB: schema v2 → v3, with automatic in-place upgrade
• migration tests verify creation, query-plan use, upgrade behavior, and rollback

Verification

• SDK: 151 suites / 5,835 tests passed
• Wallet Toolbox: 180 suites / 1,550 passed / 1 skipped
• Auth: 34 tests passed
• Auth Express Middleware: 104 tests passed
• AuthSocket: 41 tests passed
• AuthSocket Client: 39 tests passed
• SDK AuthFetch property suites passed
• wallet action-batch property suite passed
• client build, 17 tests, and browser consumer contract passed
• mobile build, 18 tests, and Metro/Hermes consumer contract passed
• SDK + Wallet Toolbox pack/typecheck passed
• SDK browser artifact contract passed; compressed budgets unchanged
• repository health, generated docs, release governance, lint, formatting, and focused migration/performance tests passed
• retained fragmented-funding benchmark passes its ≤20-query / one-transaction guard

pnpm check-versions still reports four existing declaration-dependency findings for Paymail, Auth Express, Payment Express, and Wallet Relay. The same four findings reproduce on untouched origin/main; this PR does not expand into unrelated dependency declarations.

Dependency evidence

• Release notes and necessity: Release notes and migration guidance document the createAction performance work and required patch releases; the manifest changes stage those governed releases.
• Runtime, build, and peer compatibility: Runtime and peer ranges are unchanged; Node, browser, React Native, BRC-103/104, AuthFetch, Auth Express, AuthSocket, JSON-RPC, pack, and consumer-contract checks pass.
• Deduplicated lockfile: No dependency graph or lockfile change; the four package manifests change only their own package version fields.
• Audit and CodeQL: Hosted Dependency Review and both Socket checks pass; the exact-head CodeQL and zero-new-Sonar gates remain mandatory before this PR is marked ready.
• Package and consumer tests: SDK, Wallet Toolbox, Auth, Auth Express, AuthSocket, AuthSocket Client, browser-client, Metro/Hermes mobile, property, migration, pack, and typecheck suites listed above pass.
• Bundle and performance impact: UMD grows 1,329 raw bytes, 265 gzip bytes, and 447 Brotli bytes; compressed budgets remain unchanged. The 102-input funding benchmark is 12.4x faster and repeated 20k-BEEF sorting is 24.3x faster.
• Affected public package versions: @bsv/sdk 2.2.17→2.2.18; @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile 2.4.21→2.4.22.

[codecov]

Codecov Report

❌ Patch coverage is 87.71930% with 42 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...wallet-toolbox/src/storage/methods/createAction.ts	85.12%	7 Missing and 22 partials ⚠️
...es/wallet/wallet-toolbox/src/storage/StorageIdb.ts	90.19%	2 Missing and 3 partials ⚠️
packages/sdk/src/transaction/Beef.ts	90.00%	0 Missing and 3 partials ⚠️
...s/wallet/wallet-toolbox/src/storage/StorageKnex.ts	87.50%	0 Missing and 2 partials ⚠️
...lbox/src/storage/methods/availableManagedChange.ts	75.00%	0 Missing and 2 partials ⚠️
...llet/wallet-toolbox/src/storage/StorageProvider.ts	93.33%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.7% Duplication on New Code

See analysis details on SonarQube Cloud