feat: harden service resources and refresh ChainTracks resilience

.github/codeql/codeql-config.yml

@@ -17,3 +17,5 @@ paths-ignore:
   - infra/chaintracks-server/src/security/edgePolicy.ts
   - packages/overlays/overlay-express/src/security/edgePolicy.ts
   - packages/wallet/wallet-toolbox/src/storage/remoting/edgePolicy.ts
+  - infra/uhrp-server-cloud-bucket/src/resourceLimits.ts
+  - infra/wallet-infra/src/KnexPaymentReplayStore.ts

.github/workflows/ci.yml

@@ -60,6 +60,7 @@ jobs:
         run: |
           node scripts/sync-service-rate-limit-policy.mjs --check
           node scripts/sync-service-edge-policy.mjs --check
+          node scripts/sync-service-runtime-copies.mjs --check
 
       - name: Enforce inventory, exception, baseline, and contract ratchets
         run: >-
@@ -714,8 +715,23 @@ jobs:
           name: build-outputs
           path: .ci-artifacts
       - run: tar --extract --gzip --file .ci-artifacts/build-outputs.tar.gz
-      - name: Verify packed mobile consumer with Metro and Hermes
-        run: pnpm --filter @bsv/wallet-toolbox-mobile run test:mobile
+      - name: Verify packed mobile consumer with Metro and Hermes and retain source coverage
+        run: |
+          pnpm --filter @bsv/wallet-toolbox-mobile run test:mobile
+          pnpm --filter @bsv/wallet-toolbox-mobile run test:coverage
+          node scripts/normalize-lcov-paths.mjs \
+            packages/wallet/wallet-toolbox/mobile/coverage/lcov.info \
+            packages/wallet/wallet-toolbox
+          mkdir -p .coverage-output
+          cp packages/wallet/wallet-toolbox/mobile/coverage/lcov.info \
+            .coverage-output/wallet-mobile.lcov.info
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: coverage-wallet-mobile
+          path: .coverage-output/
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 1
 
   coverage-sdk:
     name: Coverage / SDK
@@ -1045,13 +1061,15 @@ jobs:
       (needs.coverage-did.result == 'success' || needs.coverage-did.result == 'skipped') &&
       (needs.coverage-wallet.result == 'success' || needs.coverage-wallet.result == 'skipped') &&
       (needs.coverage-wallet-monitor.result == 'success' || needs.coverage-wallet-monitor.result == 'skipped') &&
+      (needs.wallet-mobile-platform.result == 'success' || needs.wallet-mobile-platform.result == 'skipped') &&
       (needs.coverage-verifast.result == 'success' || needs.coverage-verifast.result == 'skipped')
     needs:
       - prepare
       - coverage-sdk
       - coverage-did
       - coverage-wallet
       - coverage-wallet-monitor
+      - wallet-mobile-platform
       - coverage-verifast
       - coverage-other
     runs-on: ubuntu-latest

.sonarcloud.properties

@@ -10,7 +10,7 @@ sonar.exclusions=packages/verifast/src/wasm/bdk-core.*,conformance/generated/**,
 # into self-contained Docker/package build contexts and checked byte-for-byte
 # in CI. Analyze the code for issues, but do not report intentional generated
 # copies as source duplication.
-sonar.cpd.exclusions=**/*.test.ts,**/*.test.tsx,**/*.spec.ts,**/*.spec.tsx,**/*.man.test.ts,**/__test__/**,**/__tests__/**,**/test/**,**/tests/**,**/*.vectors.ts,**/eslint.config.js,infra/wab/src/security/rateLimitPolicy.ts,infra/uhrp-server-basic/src/security/rateLimitPolicy.ts,infra/uhrp-server-cloud-bucket/src/security/rateLimitPolicy.ts,infra/message-box-server/src/security/rateLimitPolicy.ts,infra/uhrp-server-basic/src/security/edgePolicy.ts,infra/uhrp-server-cloud-bucket/src/security/edgePolicy.ts,infra/message-box-server/src/security/edgePolicy.ts,infra/chaintracks-server/src/security/edgePolicy.ts,packages/overlays/overlay-express/src/security/edgePolicy.ts,packages/wallet/wallet-toolbox/src/storage/remoting/edgePolicy.ts
+sonar.cpd.exclusions=**/*.test.ts,**/*.test.tsx,**/*.spec.ts,**/*.spec.tsx,**/*.man.test.ts,**/__test__/**,**/__tests__/**,**/test/**,**/tests/**,**/*.vectors.ts,**/eslint.config.js,infra/wab/src/security/rateLimitPolicy.ts,infra/uhrp-server-basic/src/security/rateLimitPolicy.ts,infra/uhrp-server-cloud-bucket/src/security/rateLimitPolicy.ts,infra/message-box-server/src/security/rateLimitPolicy.ts,infra/uhrp-server-basic/src/security/edgePolicy.ts,infra/uhrp-server-cloud-bucket/src/security/edgePolicy.ts,infra/message-box-server/src/security/edgePolicy.ts,infra/chaintracks-server/src/security/edgePolicy.ts,packages/overlays/overlay-express/src/security/edgePolicy.ts,packages/wallet/wallet-toolbox/src/storage/remoting/edgePolicy.ts,infra/uhrp-server-cloud-bucket/src/resourceLimits.ts,infra/wallet-infra/src/KnexPaymentReplayStore.ts
 # Narrow compatibility exceptions are registered with owner, evidence, review
 # dates, and objective removal conditions in repository-health/exceptions.json.
 sonar.issue.ignore.multicriteria=werrProtocolNames,curveSingletonAlias,curveSingletonReturn,scriptOpcodeDispatch

conformance/generated/messaging/types.gen.d.ts

@@ -633,6 +633,8 @@ export interface operations {
                     limit?: number;
                     /** @default 0 */
                     offset?: number;
+                    /** @description Compatibility alias for offset; both must match if supplied together. */
+                    skip?: number;
                 };
             };
         };
@@ -649,6 +651,8 @@ export interface operations {
                         messages: components["schemas"]["StoredMessage"][];
                         limit: number;
                         offset: number;
+                        /** @description Offset for the next page; unchanged when the result is empty. */
+                        nextOffset: number;
                         hasMore: boolean;
                     };
                 };

conformance/runner/reports/report.json

@@ -1,7 +1,7 @@
 {
-  "timestamp": "2026-07-24T22:49:48.768Z",
-  "totalVectors": 6650,
-  "totalFiles": 74,
+  "timestamp": "2026-08-06T03:52:21.445Z",
+  "totalVectors": 6681,
+  "totalFiles": 75,
   "parseErrors": 0,
   "suites": [
     {
@@ -28499,6 +28499,166 @@
         }
       ]
     },
+    {
+      "name": "transport/air-gap-optical",
+      "cases": [
+        {
+          "name": "transport.air-gap-optical.crc32.1",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.length.2",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.length.3",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.length.4",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.5",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.6",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.7",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.8",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.9",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.10",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.11",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.12",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.13",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.14",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.encode.15",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.decode.16",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.decode.17",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.decode.18",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.session.19",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.session.20",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.session.21",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.session.22",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.reject.23",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.reject.24",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.reject.25",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.reject.26",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.reject.27",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.reject.28",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.reject.29",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.reject.30",
+          "pass": true,
+          "error": null
+        },
+        {
+          "name": "transport.air-gap-optical.reject.31",
+          "pass": true,
+          "error": null
+        }
+      ]
+    },
     {
       "name": "wallet/brc100/abortaction",
       "cases": [
@@ -33625,4 +33785,4 @@
       ]
     }
   ]
-}
+}

conformance/runner/reports/results.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<testsuites name="bsv-conformance" tests="6650" failures="0" errors="0" skipped="0">
+<testsuites name="bsv-conformance" tests="6681" failures="0" errors="0" skipped="0">
   <testsuite name="auth/brc31-handshake" tests="16" failures="0" errors="0" skipped="0">
     <testcase name="auth.brc31-handshake.1" classname="auth/brc31-handshake" time="0"/>
     <testcase name="auth.brc31-handshake.2" classname="auth/brc31-handshake" time="0"/>
@@ -5743,6 +5743,39 @@
     <testcase name="sync.gasprotocol.19" classname="sync/gasp-protocol" time="0"/>
     <testcase name="sync.gasprotocol.20" classname="sync/gasp-protocol" time="0"/>
   </testsuite>
+  <testsuite name="transport/air-gap-optical" tests="31" failures="0" errors="0" skipped="0">
+    <testcase name="transport.air-gap-optical.crc32.1" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.length.2" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.length.3" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.length.4" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.5" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.6" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.7" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.8" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.9" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.10" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.11" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.12" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.13" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.14" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.encode.15" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.decode.16" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.decode.17" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.decode.18" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.session.19" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.session.20" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.session.21" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.session.22" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.reject.23" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.reject.24" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.reject.25" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.reject.26" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.reject.27" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.reject.28" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.reject.29" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.reject.30" classname="transport/air-gap-optical" time="0"/>
+    <testcase name="transport.air-gap-optical.reject.31" classname="transport/air-gap-optical" time="0"/>
+  </testsuite>
   <testsuite name="wallet/brc100/abortaction" tests="8" failures="0" errors="0" skipped="0">
     <testcase name="wallet.brc100.abortaction.1" classname="wallet/brc100/abortaction" time="0"/>
     <testcase name="wallet.brc100.abortaction.2" classname="wallet/brc100/abortaction" time="0"/>

docs/examples/kubernetes/resource-profiles/message-box-hpa.yaml

@@ -0,0 +1,40 @@
+# Prerequisites: shared MySQL sessions/replay/quota state and a shared gateway
+# rate limit. Disable WebSockets or provide sticky routing / shared Socket.IO
+# pub-sub before increasing replicas.
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: message-box-server
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: message-box-server
+  minReplicas: 2
+  maxReplicas: 8
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 60
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Percent
+          value: 25
+          periodSeconds: 60
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 60
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: 70