Tracking: harden, reconcile, and publish the current TypeScript stack

[ty-everett]

Outcome

Make main the single trustworthy dependency/release baseline, close or deliberately disposition every current issue, and publish the latest compatible @bsv/* stack with reproducible security and quality evidence.

Target date: 2026-08-20 (PT).

Scope decisions

• PRs feat(wallet-toolbox): plan noSend batches locally and commit atomically #289 and Make VeriFast production-ready and accelerate WASM verification #290 are already merged and are part of the baseline.
• PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306 remains explicitly excluded while it is draft/in-progress work; do not merge or fold it into this milestone.
• BDK issue refactor(sdk): reduce cognitive complexity in Hash.ts (#44) #49 is out of scope.
• PR chore(deps): consolidate dependency bumps (#273, #260, #259, #258, #257, #256, #242) #284 was closed as superseded by merged PR chore: harden dependency, analysis, and release governance #313 after preserving its useful Dependabot review feedback.
• No dependency PR is merged solely because it is automated. Lockfile delta, advisory impact, peer compatibility, package builds/tests, Sonar/Codecov, and release order all remain required review inputs.

Phase 1 — governance and trustworthy analysis

• Merge the phase-one hardening PR.
• Enforce pnpm 10 supply-chain policy: explicit lifecycle-script allowlist, release-age delay, provenance downgrade protection, and high/critical audit gate.
• Consolidate Dependabot into one monthly, automatically rebased, one-open-PR maintenance stream across pnpm, infra npm lockfiles, and Actions.
• Add dependency review, a deterministic merge gate, broader coverage collection, CODEOWNERS, and protected npm release controls.
• Resolve the two unsafe pnpm install findings reported on PR feat(wallet-toolbox): horizontally scale Storage with shared async sessions #283.
• Enable Dependabot alerts, grouped-security controls, update-branch support, auto-merge capability, and merged-branch cleanup; deliberately pause automatic security-fix PR generation during the current consolidation after GitHub emitted separate per-directory PRs.
• Install additive repository rules that enforce resolved review threads and the proven status-check set while allowing maintainers/admins to merge without code-owner or last-pusher approval requirements.
• Have a Sonar organization admin disable Automatic Analysis; then enable the CI scanner and enforce the new-code quality gate (zero new issues, Security/Reliability/Maintainability A, reviewed hotspots 100%, duplication <3%, coverage >=90%).
• Verify Dependabot accepts the consolidated configuration after it lands.

Phase 2 — security and correctness blockers

• Use chore(infra): modernize and secure standalone services #293 as the single infrastructure-lock consolidation vehicle, folding in the closed chore(deps): bump @opentelemetry/propagator-jaeger, @opentelemetry/auto-instrumentations-node and @opentelemetry/sdk-node in /infra/wab #311/chore(deps): bump tar from 7.5.15 to 7.5.22 in /infra/wab #312/chore(deps): bump @opentelemetry/propagator-jaeger, @opentelemetry/auto-instrumentations-node and @opentelemetry/sdk-node in /infra/uhrp-server-basic #315/chore(deps): bump axios from 1.16.1 to 1.18.1 in /infra/wab #316/chore(deps): bump fast-xml-parser from 5.8.0 to 5.10.1 in /infra/uhrp-server-cloud-bucket #317 deltas; remediate the current 73 infra alerts (1 critical, 42 high, 29 moderate, 1 low) across all eight manifests.
• Unscoped findOutputBaskets over StorageClient returns other users' basket rows #301 — scope StorageClient basket queries by user.
• Security advisory: malicious AsyncAPI package versions published (Miasma RAT) #282 — remove/replace the compromised AsyncAPI lineage and verify generated artifacts.
• SHIP / SLAP identifyAdmissibleOutputs skips signature verification (missing await) #68 — restore SHIP/SLAP signature verification.
• PushDrop.decode() silently drops a [16] field that PushDrop.lock() encoded as OP_16 #277 — preserve OP_16 through PushDrop decoding.
• X-Topics header format skew: TS TopicBroadcaster sends a JSON array, go-overlay-services comma-splits — cross-implementation submits fail #269 — make X-Topics interoperable across TS and Go.
• Default feeModel is 1 sat/KB — below the 100 every ARC endpoint requires, so default txs don't get mined #180 — correct the unsafe default fee model.
• POST /admin/health-check with empty body leaks a destructuring TypeError as the response message #69 and POST /submit with empty body leaks a V8 TypeError as the response message #71 — stop leaking runtime errors at HTTP boundaries.
• Re-triage [BUG] - ARC Broadcast should return status error when a double spend is detected. #30 and all GitHub/Socket/Dependabot advisories against the current lockfile.
• Reduce the remaining moderate/low audit set through compatible upgrades; document any accepted, dev-only residual risk with expiry.

Phase 3 — compatibility upgrades and static-analysis debt

• Execute Breaking dependency upgrades: axios 0→1, firebase-admin, @libp2p/kad-dht 15→16, ajv 5→6, uuid 8→11 #158 as tested compatibility batches (Ajv, Axios, Firebase, libp2p, UUID) rather than a single blind major bump.
• Resolve current peer-range skew (Vite/React SSG and ESLint plugin lines) or replace the incompatible tooling.
• Fix new-code findings first, including PR feat(wallet-toolbox): horizontally scale Storage with shared async sessions #283's StorageProvider complexity finding, then burn down Sonar bulk: auto-fixable code style smells (~1,200 issues) #43, Sonar: 250+ functions exceed cognitive complexity threshold #44, Sonar: 138 issues around error handling, dead code, and TODOs #45, Sonar: duplication — 9,792 duplicated lines (4.8%) across 139 files in 439 blocks #46, and Sonar: long-tail TypeScript smells (~600 issues across 50+ rules) #48 in reviewable batches.
• Remove temporary security overrides as upstream parent ranges become safe.
• Keep Codecov/Sonar path classification aligned for every package that exposes test:coverage.

Phase 4 — functional and interoperability backlog

• Triage/fix Schnorr proof z-scalar: consider fixed 32-byte encoding for cross-SDK interop #20, [FEATURE] Can't set "X-WaitFor" header #23, [BUG] PushDrop Data First #26, [FEATURE REQUEST] - MerklePath.fromTSC() method #31, [BUG] Profile List mismatch across devices #33, [ISSUE] Merge Individual Permission Requests into Active Group Requests #34, and Should the updated merklePath get saved? #72 with regression or conformance tests.
• Decide and execute [ FEATURE ] - WalletClient createAction reference #21, [FEATURE] - Chronicle Update #24, [FEATURE] - Signing function option to skip overwriting existing unlocking scripts #29, [ FEATURE ] utxo selection algo in ts wallet-toolbox #116, and [ FEATURE ] async variants of functions which use sha256 so we can make use of browser's web crypto native code #139.
• Resolve the API/protocol discussions in [DISCUSSION] AuthFetch is super temperamental when used with Certificates. #22, [DISCUSSION] Refine WalletWire HTTP Model to Pure RPC #27, [DISCUSSION] SMOLDER Threshold methods within the SDKs #28, [discussion] PeerPayClient — data and payments #64, Throw if graphID is for a graph the recipient does not want #67, and [DISCUSSION] createNonce / verifyNonce are misleading for auth — and redundant with signatures #168 before making breaking changes.
• Clean up the smaller API defects in Simple arg name conflict #65, No need to pass next to this callback. #66, and POST /lookup unknown-service error has a trailing space in the message #70.

Phase 5 — documentation and issue hygiene

• Resolve Review and improve the developer introduction to the ts stack #36 and [BUG] docs code blocks copy (transferred from ts-sdk) #189 as one coherent developer-introduction/docs pass.
• Reconcile transferred/meta items Implementation tooling visibility #4 and V2 SDK (transferred from wab) #190 with their actual implementation state.
• Decide or close stale product discussions [DISCUSSION] Hardware wallet integration #32 and feature requests that are not part of the supported roadmap.
• Every issue currently open must end in one of: merged fix, documented decision, linked successor, or explicit not-planned closure. No silent bulk closure.

Phase 6 — coordinated publication

• Complete trusted-publishing setup and close OIDC npmjs.org settings to allow this repo to publish npm packages #9 using the protected npm-production environment.
• Produce a leaf-to-root release graph, synchronize first-party ranges, and publish in dependency order.
• Verify every published package from a clean consumer install (ESM, CJS, browser where applicable), provenance, npm dist-tags, and tarball contents.
• Run full conformance, CI, Sonar, Codecov, Socket, and advisory checks on the release commit.
• Publish release notes and a compatibility matrix; confirm downstream repos can install the latest stack.
• Close this milestone only when the latest intended code is on npm and all in-scope issues have a recorded disposition.

Merge standard

A PR is ready only when it is current with main, has no unresolved review thread, passes the protected merge gate and security checks, introduces no new Sonar issue, meets patch coverage, and has an explicit release/rollback note when it changes a published package. Independent review remains preferred when practical, but maintainers/admins may approve or use their authorized bypass to merge; GitHub authors cannot formally approve their own PR.

[ty-everett]

Phase-one closeout update (2026-07-24):

• Follow-up PR fix(ci): allow coverage for example-only package #318 was merged by ty-everett via the authorized admin path as 8c203fb38437d958c26a4df9903b14b94cdce42f. It fixes the only post-chore: harden dependency, analysis, and release governance #313 failure: the full main coverage sweep reached the intentionally testless @bsv/wallet-toolbox-examples package, whose coverage script did not inherit the package’s normal --passWithNoTests behavior.
• Final main CI run https://github.com/bsv-blockchain/ts-stack/actions/runs/30134138631 passed build, lint, the full test sweep, the high/critical audit gate, SDK/DID/Wallet Toolbox/VeriFast/generic coverage, Codecov upload, conformance, and merge-gate on the exact merge commit.
• Standalone conformance run https://github.com/bsv-blockchain/ts-stack/actions/runs/30134138624 and CodeQL run https://github.com/bsv-blockchain/ts-stack/actions/runs/30134138394 also passed on that exact commit.
• Repository governance is confirmed at zero required repository-level approvals, no code-owner review requirement, and no last-pusher approval requirement; resolved review threads and the required automated checks remain enforced. npm-production has ty-everett as sole reviewer with self-review allowed. Maintainers/admins can use the bypass path when appropriate.
• Dependabot alerts remain enabled, but automatic security-fix PR generation is confirmed disabled (enabled: false) after the grouped updater still created per-directory PR noise. Routine version maintenance remains monthly and limited to one open PR. Only consolidation PR chore(infra): modernize and secure standalone services #293 and excluded draft fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306 are open.

Phase one is complete except for the explicitly external Sonar organization-admin switch: disable Automatic Analysis, install the intended new-code quality gate, and then enable SONAR_CI_ENABLED. The next implementation batch is #293 plus the closed infra-update deltas, targeting the 73 remaining infra alerts.

[ty-everett]

End-to-end closeout (2026-07-25):

• Consolidation PR chore: modernize, harden, and release the TypeScript stack #320 merged as 611a103 after the full Node 24 build/lint/test sweep, 6,650 conformance vectors, dependency review, CodeQL, Codecov patch coverage, docs/link validation, Socket, SonarCloud, and merge-gate checks passed. Sonar reported zero new issues, 0.0% new-code duplication, A ratings, and 100% reviewed hotspots; the separate Sonar organization-admin switch was not changed.
• Protected OIDC Release run 30141485027 from release/v2026-July-25 published the coordinated 30-package set. Clean-consumer inspection caught paymail development tools in its runtime graph; PR fix(paymail): remove development tools from runtime installs #322 corrected the manifest/package surface and published @bsv/paymail@2.4.2 through successful run 30142028116.
• All 30 exact npm versions are now latest, have registry integrity metadata, and carry SLSA provenance. A fresh install of the entire set added 450 packages with zero audit findings. Representative SDK, overlay, paymail, wallet-toolbox, and VeriFast loads passed through both ESM and CommonJS.
• Generated sync PR chore: sync published workspace versions #321 was updated to current main, reviewed and formally APPROVED as ty-everett, passed all seven Node 24 infra lanes and every security/quality check, then merged via the authorized admin path as fea4688.
• Infra Release run 30142238112 from infra/v2026-July-25-2 published seven Linux/amd64 images: chaintracks-server:v1.0.10, message-box-server:v1.1.14, overlay-server:v2.1.18, uhrp-server-basic:v0.1.8, uhrp-server-cloud-bucket:v0.2.10, wab:v1.4.10, and wallet-infra:v2.0.13. Every manifest carries the exact source revision/version/repository labels.
• Dependabot now reports six open alerts total: four moderate and two low, all in the workspace lock and all documented upstream/dev/static-site holds. There are zero infra alerts and zero high/critical alerts. Every obsolete override is gone; the sole brace-expansion <=5.0.7 -> 5.0.8 override remains because it is the active fix for GHSA-mh99-v99m-4gvg in Jest's currently incompatible minimatch graph, with an explicit removal condition.
• Every in-scope backlog item has a merged fix or an explicit technical disposition. V2 SDK (transferred from wab) #190 is now closed. Draft PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306 remains untouched and BDK refactor(sdk): reduce cognitive complexity in Hash.ts (#44) #49 remains out of scope.

The two deliberately deferred Sonar-only workstreams are left visible rather than falsely closed: the organization-admin analysis-mode/quality-gate switch and source-debt issues #43, #44, #45, #46, and #48. They are not blockers to this tracker under the operator's stated Sonar exception. The tracker checkboxes now reflect that boundary.