Standardize SDK and foundation runtime package contracts (#362)

* feat: standardize foundation runtime packages

* fix: accept browser-safe SDK HTTP clients

* fix: resolve foundation wave quality findings

* fix: normalize lookup invocation failures

* test: stabilize foundation coverage gates

* test: close foundation patch coverage gaps

Author: ty-everett

governance/repository-health/contract-baseline.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "recordedAt": "2026-07-26",
-  "findingCount": 45,
+  "findingCount": 24,
   "findings": [
     {
       "id": ".::missing-script::format:check",
@@ -39,34 +39,6 @@
       "id": "docs-site::missing-script::test",
       "message": "Profile documentation-site requires script test"
     },
-    {
-      "id": "packages/network/ts-p2p::missing-script::format:check",
-      "message": "Profile node-library requires script format:check"
-    },
-    {
-      "id": "packages/network/ts-p2p::missing-script::lint",
-      "message": "Profile node-library requires script lint"
-    },
-    {
-      "id": "packages/network/ts-p2p::missing-script::pack:check",
-      "message": "Profile node-library requires script pack:check"
-    },
-    {
-      "id": "packages/network/ts-p2p::missing-script::typecheck",
-      "message": "Profile node-library requires script typecheck"
-    },
-    {
-      "id": "packages/overlays/gasp-core::missing-script::format:check",
-      "message": "Profile dual-runtime-library requires script format:check"
-    },
-    {
-      "id": "packages/overlays/gasp-core::missing-script::pack:check",
-      "message": "Profile dual-runtime-library requires script pack:check"
-    },
-    {
-      "id": "packages/overlays/gasp-core::missing-script::typecheck",
-      "message": "Profile dual-runtime-library requires script typecheck"
-    },
     {
       "id": "packages/overlays/overlay-discovery-services::missing-script::format:check",
       "message": "Profile node-library requires script format:check"
@@ -115,50 +87,6 @@
       "id": "packages/overlays/topics::missing-script::typecheck",
       "message": "Profile node-library requires script typecheck"
     },
-    {
-      "id": "packages/sdk::missing-script::format:check",
-      "message": "Profile browser-library requires script format:check"
-    },
-    {
-      "id": "packages/sdk::missing-script::pack:check",
-      "message": "Profile browser-library requires script pack:check"
-    },
-    {
-      "id": "packages/sdk::missing-script::test:browser",
-      "message": "Profile browser-library requires script test:browser"
-    },
-    {
-      "id": "packages/sdk::missing-script::typecheck",
-      "message": "Profile browser-library requires script typecheck"
-    },
-    {
-      "id": "packages/verifast::missing-script::format:check",
-      "message": "Profile wasm-library requires script format:check"
-    },
-    {
-      "id": "packages/verifast::missing-script::lint",
-      "message": "Profile wasm-library requires script lint"
-    },
-    {
-      "id": "packages/verifast::missing-script::pack:check",
-      "message": "Profile wasm-library requires script pack:check"
-    },
-    {
-      "id": "packages/wallet/ts-wallet-relay::missing-script::format:check",
-      "message": "Profile cli-library requires script format:check"
-    },
-    {
-      "id": "packages/wallet/ts-wallet-relay::missing-script::lint",
-      "message": "Profile cli-library requires script lint"
-    },
-    {
-      "id": "packages/wallet/ts-wallet-relay::missing-script::pack:check",
-      "message": "Profile cli-library requires script pack:check"
-    },
-    {
-      "id": "packages/wallet/ts-wallet-relay::missing-script::test:coverage",
-      "message": "Profile cli-library requires script test:coverage"
-    },
     {
       "id": "packages/wallet/wallet-toolbox-examples::missing-script::format:check",
       "message": "Profile examples requires script format:check"
@@ -170,18 +98,6 @@
     {
       "id": "packages/wallet/wallet-toolbox-examples::mutating-check-script::lint",
       "message": "lint must not modify the working tree"
-    },
-    {
-      "id": "packages/wallet/wallet-toolbox::missing-script::format:check",
-      "message": "Profile node-library requires script format:check"
-    },
-    {
-      "id": "packages/wallet/wallet-toolbox::missing-script::pack:check",
-      "message": "Profile node-library requires script pack:check"
-    },
-    {
-      "id": "packages/wallet/wallet-toolbox::missing-script::typecheck",
-      "message": "Profile node-library requires script typecheck"
     }
   ]
 }

packages/messaging/message-box-client/scripts/remove-node-https-fallback.cjs

@@ -1,15 +1,14 @@
 'use strict'
 
 /**
- * The SDK's browser-safe default HTTP client includes a guarded CommonJS
- * `require("node:https")` fallback for old Node runtimes. Webpack leaves that
- * unreachable string in UMD output, where the browser composition gate must
- * reject it. Browser clients use fetch, so remove only this exact fallback.
+ * Older SDK artifacts included a guarded CommonJS `require("node:https")`
+ * fallback for old Node runtimes. Webpack left that unreachable string in UMD
+ * output, where the browser composition gate rejected it. Browser clients use
+ * fetch, so remove only this exact legacy fallback when it is present.
+ *
+ * Newer SDK artifacts already hide the optional Node module identifier from
+ * static browser analysis. Those inputs are safe and require no transformation.
  */
 module.exports = function removeNodeHttpsFallback(source) {
-  const transformed = source.replace(/require\((['"])node:https\1\)/g, 'undefined')
-  if (transformed === source) {
-    throw new Error('Expected the SDK node:https fallback in the browser build input.')
-  }
-  return transformed
+  return source.replace(/require\((['"])node:https\1\)/g, 'undefined')
 }