feat(wallet-toolbox): add BRC-177 noSend expiry

[ty-everett]

Keep this pull request in draft until local validation is complete. After
every push, wait for all applicable checks on the exact head to finish and
fix every failure before requesting review or calling the work complete.

Program and scope

• Tracker or issue: BRC-177: Wallet-Enforced Expiry for noSend Actions BRCs#239 (BRC-177 draft)
• Program gate(s) advanced: reference implementation and default Toolbox-wallet support for BRC-177 expiring noSend transactions
• Why this change is needed: applications can release signed noSend transactions without leaving wallet value hostage indefinitely; the wallet durably pre-signs and coordinates a reclaim that invalidates an unbroadcast target after expiry.
• Explicitly out of scope: npm publication, BRC repository changes, and application-specific delivery of the signed target transaction.
• Exact head SHA reviewed: 3dffbdd7a21687373e4aefc605a81252d0167d1f

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages/services and intended patch versions (publication occurs only
through the release workflow after approval):

• @bsv/wallet-toolbox@2.11.0
• @bsv/wallet-toolbox-client@2.11.0
• @bsv/wallet-toolbox-mobile@2.11.0

Verification

• Local commands and results:
  • pnpm build: passed
  • pnpm test: passed across the complete workspace; Wallet Toolbox 221/221 suites, 2,099 passed and 1 skipped
  • focused BRC-177 parser, signer, permissions, storage, sync, RPC, migration, monitor, and end-to-end suites passed, including 21 lifecycle flows
  • pnpm lint, pnpm format:check, pnpm health:check, wallet typecheck: passed
  • pnpm check-versions, pnpm license:release-check, pnpm license:pack-check: passed
  • pnpm audit:security: passed; two pre-governed high advisories remain ignored, with no dependency or lockfile change
• Hosted CI run: 33358994269 passed on this exact head; 25 jobs succeeded and 7 scope-based jobs were correctly skipped
• Conformance evidence: 6,690 vectors parsed; TypeScript runner 6,479 passed / 211 skipped
• Coverage delta: new unit, storage-provider, RPC, permission-module, migration, sync-race, restart/device, monitor, and end-to-end coverage added; hosted aggregate patch coverage passed at 94.04% (1,609/1,711 changed line/branch points; target 90.00%); Codecov patch coverage passed at 90.49505%
• Lint/typecheck delta: local lint, formatting, build, and Wallet Toolbox typecheck passed with no new warning or suppression
• Browser/mobile/packed-consumer evidence:
  • browser Vite and esbuild checks passed
  • mobile Metro and Hermes checks passed
  • node, client, and mobile pack:check passed against clean consumers
  • exact release tarballs and CycloneDX evidence verified by package-release-artifacts.mjs
• Performance or bundle-size delta:
  • Vite raw/gzip/Brotli: 1,658,802 / 388,052 / 304,787 bytes
  • esbuild raw/gzip/Brotli: 1,294,883 / 354,950 / 284,733 bytes
  • Metro raw/gzip/Brotli: 1,707,158 / 429,877 / 334,010 bytes
  • Hermes raw/gzip/Brotli: 3,465,269 / 1,404,044 / 1,088,905 bytes
  • measured budgets and release notes updated to the nearest governed headroom
• I self-reviewed the complete diff for correctness, security,
  compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any
  scope-based skip is expected and validated by the merge gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and
  audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings
  (including accepted or false-positive issue states) and zero unreviewed hotspots;
  Sonar's aggregate Quality Gate passed verdict alone is not merge evidence
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date,
  and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

No dependency or lockfile changes.

• Release notes and necessity: not applicable
• Runtime, build, and peer compatibility: all three affected package artifacts passed clean-consumer checks
• Deduplicated lockfile: unchanged
• Audit and CodeQL: local governed audit and exact-head CodeQL passed
• Package and consumer tests: complete workspace tests and all affected pack checks passed
• Bundle and performance impact: measured above and recorded in governed budgets
• Affected public package versions: 2.11.0 for node, client, and mobile Wallet Toolbox packages

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the
  controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

Completion evidence

• The linked tracker is updated only for work fully proved by merged code,
  passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• Documentation, changelog, migration notes, release notes, and operator
  guidance are current or concretely not applicable
• No pending, failed, stale, cancelled, or unexpectedly skipped check is
  being handed to another contributor as “complete”
• One qualified maintainer approval is sufficient; no last-pusher
  restriction is assumed

[codecov]

Codecov Report

❌ Patch coverage is 90.49505% with 96 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...olbox/src/storage/methods/noSendExpiryLifecycle.ts	85.54%	6 Missing and 30 partials ⚠️
...box/src/signer/methods/createNoSendExpiryAction.ts	85.71%	10 Missing and 7 partials ⚠️
...allet-toolbox/src/storage/methods/processAction.ts	71.42%	4 Missing and 10 partials ⚠️
...wallet-toolbox/src/storage/methods/noSendExpiry.ts	95.00%	4 Missing and 5 partials ⚠️
...wallet-toolbox/src/storage/methods/createAction.ts	88.23%	4 Missing and 4 partials ⚠️
...x/src/storage/schema/entities/EntityTransaction.ts	96.66%	0 Missing and 3 partials ⚠️
...allet/wallet-toolbox/src/mockchain/MockServices.ts	85.71%	0 Missing and 2 partials ⚠️
...es/wallet/wallet-toolbox/src/storage/StorageIdb.ts	90.00%	0 Missing and 2 partials ⚠️
...allet-toolbox/src/storage/schema/KnexMigrations.ts	91.66%	1 Missing and 1 partial ⚠️
...let/wallet-toolbox/src/WalletPermissionsManager.ts	96.96%	0 Missing and 1 partial ⚠️
... and 2 more

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud