perf(wallet): bring createAction under remote latency budgets

[ty-everett]

Keep this pull request in draft until local validation is complete. After
every push, wait for all applicable checks on the exact head to finish and
fix every failure before requesting review or calling the work complete.

Program and scope

• Tracker or issue: Operator-requested createAction latency program (no separate issue).
• Program gate(s) advanced: normal authenticated remote p50 <100 ms; 153-input authenticated remote p95 <500 ms; direct storage p50 <150 ms; patch coverage >=90%.
• Why this change is needed: createAction routinely took multiple seconds. The successful path repeated proof reads/merges, key derivation, verification serialization, output writes, and authenticated session persistence instead of batching the work.
• Explicitly out of scope: changing BRC-103/104 wire semantics; AuthFetch headers or behavior; Auth Express middleware; AuthSocket; publishing packages; downstream wallet releases; production deployment.
• Exact head SHA reviewed: 8659dfbe0d7372a2047bbd217ceed32049df9d6d

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages/services and intended patch versions (publication occurs only through the release workflow after approval):

• @bsv/sdk 2.3.0: additive batch BEEF/key-derivation APIs and optimized validated Merkle/P2PKH paths.
• @bsv/wallet-toolbox 2.5.0: atomic set-based createAction persistence, proof batching, signing/verification batching, storage indexes, session-touch coalescing, and privacy-safe spans.
• @bsv/wallet-toolbox-client 2.5.0 and @bsv/wallet-toolbox-mobile 2.5.0: coordinated compatible candidates and measured platform budgets.

Verification

• Local commands and results: full SDK coverage (152 suites, 5,842 tests); full Wallet Toolbox coverage (183 suites, 1,594 pass, one existing skip); full workspace property suite; selected wallet-action-batch mutation score 89.91% (policy 88%); root lint, health, docs, format, frozen install, audit, build/typecheck, package/license policy, and diff checks all pass.
• Hosted CI run: CI 30802989765 and CodeQL 30802989757 are terminal and successful on exact head 8659dfbe0d7372a2047bbd217ceed32049df9d6d; CI finished with 29 successful jobs and five expected scope skips.
• Conformance evidence: Auth core 37, Auth Express 108, AuthSocket 52, and AuthSocket Client 50 tests pass; SDK AuthFetch is included in the full SDK suite. No production AuthFetch/Auth Express/AuthSocket file changed.
• Coverage delta: exact repository patch gate is 93.34% (1,248/1,337 changed line/branch points; target 90%); external Codecov patch coverage is 90.42% (755/835 executable diff lines; target 90%). Type-only .interfaces.ts declarations are excluded because they emit no Istanbul entry; fail-closed executable-file behavior remains tested.
• Lint/typecheck delta: zero findings; all affected projects build and typecheck.
• Browser/mobile/packed-consumer evidence: SDK Vite/esbuild/UMD budgets pass; wallet client Vite/esbuild and mobile Metro/Hermes contracts pass; SDK/wallet/client/mobile packs pass; eight compiled consumer examples using exact tarballs pass.
• Performance or bundle-size delta: synthetic storage benchmark fell from 622 queries / 102 transactions / 107.3 ms to 17 / 1 / 14.2 ms. PXC authenticated remote, 20 runs: normal one-input p50 78.6 ms, p95 105.6 ms; 153-input p50 376.0 ms, p95 461.6 ms. Direct 153-input p50 99.3 ms, p95 137.4 ms. A selective production-shaped clone with 110 inputs measured direct p50 75.5 ms, p95 155.4 ms. All 3,080 measured signatures verified with zero failures.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any scope-based skip is expected and validated by the merge gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings (including accepted or false-positive issue states) and zero unreviewed hotspots; Sonar's aggregate Quality Gate passed verdict alone is not merge evidence
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date, and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: wallet benchmark now directly exercises the existing workspace VeriFast backend so the optimized digest-verification path remains measurable; release notes cover all four candidate packages.
• Runtime, build, and peer compatibility: @bsv/verifast is a workspace-only devDependency used by the retained benchmark. No runtime dependency or peer range changed. Additive SDK APIs retain older compatible peer behavior through the sequential proof-merge fallback.
• Deduplicated lockfile: one importer link was added; frozen-lockfile install passes with no registry snapshot churn.
• Audit and CodeQL: high-severity audit reports no known vulnerabilities; exact-head hosted CodeQL passed with no new alerts.
• Package and consumer tests: all affected pack checks, platform contracts, full package suites, property/mutation tests, and exact-tarball consumer examples pass.
• Bundle and performance impact: measured SDK/client/mobile budgets pass; hosted wallet-client Vite raw size is 1,524,413 bytes against the unchanged 1,525,000-byte ceiling; performance evidence is listed above.
• Affected public package versions: SDK 2.3.0; Wallet Toolbox, Client, and Mobile 2.5.0.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

The exact governed Node 24.18.0 release path staged, checksum/SBOM-verified, and dry-run-published all four candidate tarballs. Actual publication remains exclusively in the approved release workflow. Knex migrations are reversible and passed fresh up/down/up tests; IndexedDB advances additively to schema version 3. Rollback is the prior package set plus the down migration. No service image or live deployment is part of this draft.

Completion evidence

• The linked tracker is updated only for work fully proved by merged code, passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• No pending, failed, stale, cancelled, or unexpectedly skipped check is being handed to another contributor as “complete”
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[codecov]

Codecov Report

❌ Patch coverage is 90.41916% with 80 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...wallet-toolbox/src/storage/methods/createAction.ts	70.79%	21 Missing and 12 partials ⚠️
...s/wallet/wallet-toolbox/src/storage/StorageKnex.ts	82.35%	0 Missing and 9 partials ⚠️
packages/sdk/src/transaction/MerklePath.ts	87.50%	1 Missing and 5 partials ⚠️
packages/wallet/wallet-toolbox/src/Wallet.ts	68.42%	1 Missing and 5 partials ⚠️
...-toolbox/src/signer/methods/verifyUnlockScripts.ts	95.62%	1 Missing and 5 partials ⚠️
packages/sdk/src/transaction/Beef.ts	94.84%	2 Missing and 3 partials ⚠️
...es/wallet/wallet-toolbox/src/storage/StorageIdb.ts	87.87%	1 Missing and 3 partials ⚠️
...llet/wallet-toolbox/src/storage/StorageProvider.ts	88.88%	2 Missing and 1 partial ⚠️
...olbox/src/storage/methods/getBeefForTransaction.ts	97.87%	0 Missing and 2 partials ⚠️
...allet-toolbox/src/storage/methods/processAction.ts	87.50%	0 Missing and 2 partials ⚠️
... and 3 more

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.8% Duplication on New Code

See analysis details on SonarQube Cloud