chore: sync published workspace versions

[github-actions]

Program and scope

• Tracker or issue: protected release run 33116721128
• Program gate(s) advanced: published-version reconciliation and reproducible OCI release inputs
• Why this change is needed: synchronize first-party package floors and standalone infrastructure locks after protected npm publication.
• Explicitly out of scope: product behavior beyond consuming the already-reviewed package artifacts.
• Exact head SHA reviewed: generated sync commit; hosted checks bind validation to the PR head.

Impact

• No public package source or manifest changed
• Infrastructure source, dependency, image, or deployment configuration changed
• Security-sensitive boundary changed

Affected services and intended patch versions are the changed infra package manifests in this PR.

Verification

• Local commands and results: generated by protected release run 33116721128 after successful npm publication.
• Hosted CI run: pending for this exact head.
• Conformance evidence: Not selected because no conformance input changed.
• Coverage delta: No product source changed.
• Lint/typecheck delta: Pending hosted affected-graph validation.
• Browser/mobile/packed-consumer evidence: The protected release passed package, clean-consumer, browser, and mobile verification before publication.
• Performance or bundle-size delta: No product source or bundle composition changed.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any scope-based skip is expected and validated by the merge gate

Security and dependencies

• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed by the protected release
• No new override, advisory dismissal, quality suppression, or skipped test
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: The protected release already validated the coordinated package release notes and migration guidance.
• Runtime, build, and peer compatibility: The release verified the governed Node, browser, mobile, runtime, and peer-dependency contracts.
• Deduplicated lockfile: Workspace and standalone npm locks were regenerated once from the published first-party versions without lifecycle scripts.
• Audit and CodeQL: The release rejected high and critical package findings; exact-head CodeQL runs on this PR.
• Package and consumer tests: The release passed full builds, typecheck, package artifacts, clean consumers, browser, mobile, registry signatures, provenance, and reconciliation.
• Bundle and performance impact: No bundle composition changed; affected releases retain their documented compatibility contracts.
• Affected public package versions: Derived from the published workspace manifests synchronized by this exact commit.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented by the protected infrastructure release
• Documentation, changelog, migration, and operational guidance are current

The protected infrastructure release builds Linux/amd64 images, rejects high and critical findings, publishes immutable GHCR tags, and attaches SBOM, provenance, and signature evidence after merge. Existing immutable tags remain the rollback path.

Completion evidence

• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​bsv/​message-box-client@​2.4.1 ⏵ 2.4.2			+1		-20
	npm/​@​bsv/​wallet-toolbox@​2.10.3 ⏵ 2.10.4				+1
	npm/​@​bsv/​sdk@​2.4.1 ⏵ 2.4.2	+1
	npm/​@​bsv/​authsocket@​2.1.6 ⏵ 2.1.7				+1
	npm/​@​bsv/​overlay-express@​2.6.0 ⏵ 2.6.1
	npm/​@​bsv/​overlay-discovery-services@​2.2.0 ⏵ 2.2.1	+1			+1
	npm/​@​bsv/​overlay-topics@​1.7.0 ⏵ 1.7.1				+1
	npm/​@​bsv/​payment-express-middleware@​2.1.5 ⏵ 2.1.6	+4		+1	+1
	npm/​@​bsv/​overlay@​2.3.0 ⏵ 2.3.1	+2		+1
	npm/​@​bsv/​auth-express-middleware@​2.2.1 ⏵ 2.2.3	+1			+1
	npm/​@​bsv/​wallet-toolbox-client@​2.10.3 ⏵ 2.10.4				+1

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[raspi-user]

I reviewed the current head 5299ab7597be692eae1ed615c4ec004d5115ddac.

No blocking issues found. This looks like a straightforward published-version sync across the infra packages and docs/reference/stack-facts.md.

Checks I performed:

• Confirmed PR is open, non-draft, mergeable.
• Confirmed changed files are limited to infra package.json, infra package-lock.json, and the stack facts inventory.
• Checked manifest versions match lockfile root versions for each touched infra package.
• Checked @bsv/* dependency ranges in each touched manifest match the installed versions recorded in the corresponding lockfile.
• Verified current public npm versions for the changed dependencies, including @bsv/sdk@2.4.2, @bsv/wallet-toolbox@2.10.4, @bsv/wallet-toolbox-client@2.10.4, @bsv/auth-express-middleware@2.2.3, @bsv/payment-express-middleware@2.1.6, @bsv/authsocket@2.1.7, @bsv/message-box-client@2.4.2, and the overlay packages.
• Ran git diff --check; no whitespace errors.

One minor process note: GitHub currently shows the PR green for Socket/Sonar, but I did not see the full workspace CI matrix on this PR view. Given this touches runtime infra dependency locks, I would want either the normal infra/package CI evidence or confirmation that this automation PR intentionally only requires the scanner checks.

Subject to that CI/process confirmation, this looks fine to merge.