[ty-everett]

Advances #324 by completing the repository-health distribution profile for @bsv/authsocket and @bsv/authsocket-client.

What changed

• replaces legacy project-reference/tsconfig-to-dual-package builds with tsdown ESM and CommonJS outputs and module-specific declarations
• removes obsolete webpack/server build plumbing, source publication, redundant configs, a live-port pseudo-test, and unused test/build dependencies
• validates exact packed artifacts with publint, strict ESM/CommonJS type resolution, and clean consumer installs
• validates the browser client exact tarball with Vite, esbuild, and UMD builds under measured raw/gzip/brotli budgets
• adds strict typecheck, zero-warning lint, formatting, artifact, and browser gates
• raises both packages to 100% statement, branch, function, and line coverage across 20 tests
• documents package installation, release gates, distribution formats, and configurable public-by-default CORS guidance
• reduces the repository-health baseline from 66 to 59 findings

Security and compatibility

• no restrictive CORS behavior is added; public services remain accessible by default and deployments can opt into Socket.IO origin allowlists
• @bsv/sdk remains a peer dependency and cross-package version checks pass
• pnpm audit reports no known vulnerabilities
• Open BSV License Version 6 remains canonical in every manifest and all 30 public packed artifacts
• no package version is changed or published in this PR

Local verification

• package format, zero-warning lint, and strict typecheck: pass
• 20 tests: pass; both packages 100% statements/branches/functions/lines
• both builds and strict pack checks: pass
• Vite/esbuild/UMD exact-tarball browser contract: pass
• repository health: 59 findings, 11 documented exceptions, 0 control errors
• license policy: 46 manifests and 30 public tarballs pass
• high/critical audit, workspace version references, SDK peer contract, and diff check: pass
• full workspace build passed before the final package-only validation; CI will repeat the frozen full-workspace matrix

The local code-generation parity command cannot run on this macOS host because uv is not installed; the unchanged codegen workflow remains authoritative in CI.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

APPROVAL-IN-SUBSTANCE by ty-everett for exact head 2c73346. I reviewed the full diff and release contract; all exact-head CI, SonarCloud (0 new issues, 0 hotspots), CodeQL, Socket, dependency review, Codecov patch coverage, packed-consumer, browser, license, and repository-health gates are green, with zero unresolved review threads. GitHub does not permit an author to submit a formal APPROVE review on their own pull request, so this records the requested maintainer approval before authorized admin merge.