fix(sdk): preserve BRC100 discovery and signed action history

[ty-everett]

Program and scope

new WalletClient('auto', 'app.example') fails to discover an installed HTTP wallet: the version probe omits the configured originator, so WalletWire rejects the caller mismatch before network access. The browser JSON fallback also invokes an unbound native fetch and throws Illegal invocation.

Pass the configured originator through discovery and bind the default JSON fetch receiver. Also restore signed listActions net amounts: the binary transport rejects negative action history accepted by existing JSON validation and older published SDKs. Preserve the historical signed int64 encoding with a field-specific reader; counts, lengths and individual output values retain their unsigned checks. Preserve custom HTTP clients, transport preference, bounded probes, operational timeouts, existing caller binding and response validation. All discovery paths already use a deadline; the helper now requires it and always clears its timer.

• Coordination: BotBoard #586; [BotBoard][closed] ty-everett / Codex — PR 569 review and main integration #585 acknowledged separate SDK patch ownership.
• Scope: SDK discovery/HTTP JSON and signed action history, focused regressions, SDK-only 2.8.3 patch metadata and documentation.
• Out of scope: peer Wallet interoperability: bounded sync and portable recovery (#544) #569 AuthFetch/middleware/Toolbox work, infrastructure changes and consumer deployment.
• Exact head reviewed: fbb1ca1.

Impact

• Public package source/manifest changed: @bsv/sdk 2.8.3 candidate.
• Browser behavior repaired without a new API, wire format or account-data migration.
• Security-sensitive caller binding retained; malformed/foreign-origin checks are not relaxed.
• Documentation, changelog, release notes and generated facts updated.

Verification

• Frozen install with lifecycle scripts denied; workspace build/typecheck, root health/lint/format and security audit pass (no known vulnerabilities).
• Three real-HTTP discovery regressions fail on the old implementation and pass after the fix, covering wire, JSON and secure-JSON endpoint selection, explicit caller binding and subsequent calls. The secure endpoint is mapped to an ephemeral HTTP test server; this does not claim TLS testing.
• Existing RN/XDM discovery deadline, user-approval timing and listener-cleanup regressions pass. A failing CWI provider also falls back with no leaked timer/listener.
• Full SDK coverage: 7,393 tests / 209 suites pass. Repository patch coverage: 100% of changed executable line/branch points (16/16).
• SDK packed consumers and browser Vite/esbuild/UMD checks pass within existing budgets. TypeScript conformance runner: 6,490 tests pass, 211 unchanged governed skips.
• A real Chrome page against an installed native BRC100 wallet reproduces both failures with published SDK 2.8.2; the candidate succeeds through auto-discovered WalletWire and explicit JSON, returning wallet version and mainnet network.
• Signed-history regressions fail before the fix and pass after it; frozen published bytes, supply boundaries, unsafe values, noncanonical encodings, truncated frames and negative individual outputs are covered. Cross-version synthetic tests cover SDK 2.4.0, 2.5.0, 2.7.1, 2.8.1 and 2.8.2 at eight signed/unsigned boundaries: all 40 candidate cases pass and all 32 previously valid cases preserve exact response bytes. The eight known negative-history failures in 2.8.1/2.8.2 are recorded, not claimed as passes.
• Complete diff reviewed for correctness, compatibility, security, package artifacts and deployment implications.
• Every hosted check is terminal and successful on the exact head (validated for fbb1ca1).

Security and dependencies

• No dependency or lockfile change; only the SDK package version advances.
• No override, suppression, skipped test or relaxed quality threshold introduced.
• Custom HTTP clients and existing transport security checks remain intact.
• Exact-head CodeQL has no new alert.
• Exact-head repository gate has zero new Sonar findings and zero unreviewed hotspots.
• Workflow permissions and lifecycle-script policy unchanged.

Release and operations

• No npm publication performed from the workstation or this PR.
• SDK-only patch metadata included; published baseline remains 2.8.2 until verified publication.
• No service/image/deployment change. Publication and provenance verification are separate protected-workflow steps.

Applications affected by these SDK client defects can update their bundled SDK without changing calls. Wallets should include the patch so older clients can read signed action history; applications already using an affected 2.8.x binary client also need the SDK patch. Wallets continue to support the established BRC100 contract; this does not require an ecosystem-wide application migration.

Completion evidence

• Local evidence is recorded above.
• Hosted checks and review conversations resolved.
• Ready for maintainer review/merge on the validated exact head.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer review of exact head fbb1ca135fc57d4d263ee4183580f73cb0098ba6:

• Discovery preserves the configured originator, existing transport order, bounded probes and separate operation timeouts; custom HTTP clients are unchanged. Native browser fetch retains its required receiver.
• The signed-int64 exception is restricted to the action-history net amount. It preserves legacy bytes and existing JSON range semantics. Frame limits, canonical counts/lengths, output-value checks and unsafe-integer rejection remain intact. No public API, data migration or new wire format is introduced.
• Regression evidence includes old-behavior failures, real HTTP and browser/native discovery, 40 synthetic signed-history boundary/interoperability cases, 7,393 SDK tests and 100% changed-code coverage. Older valid callers preserve bytes; the known affected 2.8.x clients are explicitly identified rather than claimed compatible.
• Exact-head repository merge gate, zero-new-Sonar gate, CodeQL, dependent tests, browser/mobile gates, conformance and Codecov all succeeded. Scope-based skips are validated by merge-gate. No unresolved review threads exist.

No blocking finding remains in this review. This is the maintainer's review under the repository's admin-facilitation policy, not a claim of independent reviewer approval. SDK-only protected publication and npm provenance verification remain separate steps; no consumer rollout is claimed by this merge.