perf: optimize transaction, BEEF, and Toolbox pipelines

[ty-everett]

Summary

Implements the transaction-performance items 2–6 across @bsv/sdk and Wallet Toolbox:

• shares BIP143 signature-hash components across every input during signing and script verification, eliminating per-input filtering/reconstruction;
• invalidates standalone Spend signature-hash caches before every validation while retaining externally owned, transaction-scoped cache reuse;
• replaces recursive spend-chain serialization/proof linking with iterative work queues and cursor-based traversal;
• adds copy-safe one-copy parsing plus explicit zero-copy/lazy transaction and BEEF view APIs;
• fixes transaction cache invalidation when outputs are added;
• deprecates the historically mis-typed Transaction.toBEEFUint8Array() while preserving its runtime number[] behavior, and adds Transaction.toBEEFBytes() as the correct typed replacement;
• indexes BEEF transaction/proof lookups and replaces repeated graph scans with stable O(V+E) topological processing;
• reuses parsed BEEF across createAction/signAction/internalization, keeps typed bytes through persistence boundaries, and removes redundant parsing/allocation;
• fetches independent ancestor frontiers and allocated-change proofs with bounded concurrency and deterministic merge order;
• negotiates compact base64 JSON-RPC binary transport across Node, browser, and mobile while keeping first-request and legacy-peer numeric-array compatibility.

This prepares @bsv/sdk 2.1.8 and the Node/client/mobile Toolbox packages in lockstep at 2.4.2.

Compatibility and correctness

• Existing public methods and legacy numeric-array wire behavior remain available.
• Reused standalone Spend instances reject output, input-sequence, sibling-input, and lock-time mutation; externally supplied caches are documented as valid only for one immutable transaction pass.
• fromBinary remains copy-safe; zero-copy behavior is opt-in through explicit *View APIs with documented caller immutability requirements.
• Legacy BEEF ordering, prefix parsing, explicit-removal ordering, and lazy post-parse transaction mutation behavior have regression coverage.
• The old toBEEFUint8Array() runtime shape is deliberately unchanged to avoid a breaking change.
• New binary RPC clients send a legacy-compatible first body, then switch only after server capability negotiation; old clients receive legacy responses from new servers.
• Node Buffer, browser native base64, and pure mobile fallback codec paths are covered.

Retained-baseline benchmarks

Apple Silicon, Node.js v25.9.0, identical generated workloads and benchmark code:

Workload (median)	main	This branch	Improvement
4.17 MB cold Atomic BEEF serialize	150.80 ms	16.11 ms	89.3% faster
4.17 MB warm Atomic BEEF serialize	132.47 ms	1.46 ms	98.9% faster
4.17 MB copy-safe structural parse	3.77 ms	0.95 ms	74.8% faster
4.17 MB zero-copy structural parse	unavailable	0.51 ms	86.4% vs baseline copy parse
4.17 MB linked Atomic BEEF parse	13.60 ms	12.62 ms	7.2% faster
1,000-link spend-chain verification	1.82 ms	0.73 ms	60.0% faster
4.17 MB parse + topological sort	12.40 ms	5.71 ms	54.0% faster
1,000-input P2PKH sign	1,266.19 ms	1,161.64 ms	8.3% faster
1,000-input P2PKH verify	2,090.32 ms	1,213.03 ms	42.0% faster
32 independent ancestors, 10 ms service latency	358.55 ms	54.34 ms	84.8% faster / 6.6x throughput

A representative 1 MiB binary RPC value drops from 3,743,755 JSON bytes to 1,398,147 bytes (62.7% smaller). The optimized default 2,000-link/4.24 MB pipeline completes the measured serialize/parse/link/verify/sort stages in about 69 ms; main overflows the JavaScript stack at that depth. The branch has an automated 3,000-link regression.

Reproduction commands and full measurements are in packages/sdk/docs/performance.md.

Validation

• @bsv/sdk build (ESM/CJS/types/UMD): pass
• SDK full suite: 137 suites, 5,618 passed, 3 skipped, snapshot pass
• Wallet Toolbox Node/client/mobile TypeScript build: pass
• Wallet Toolbox full non-manual suite: 125 suites, 1,143 passed, 27 skipped, including the authenticated StorageClient integration
• focused createAction/createAction2/internalize/managed-change/ancestor/binary negotiation suites: pass
• changed SDK and Toolbox TypeScript files: ts-standard pass
• pnpm check-versions: pass
• git diff --check: pass
• SDK and Toolbox npm pack --dry-run: pass
• docs build and link validation: 93 HTML pages pass
• benchmark reproduction: pass against retained clean main and branch builds

The repository-wide SDK lint target still reports pre-existing errors in unrelated identity, KV-store, overlay, BigNumber, and script-error files; every file changed here passes the same linter. The full Toolbox suite now includes and passes StorageClient.test.ts; this caught and verified the AuthFetch-intercepted response-header fix in addition to the deterministic Node, browser, and mobile codec tests.

[sonarqubecloud]

Quality Gate passed

Issues
14 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 93.90756% with 29 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/sdk/src/transaction/Transaction.ts	91.40%	11 Missing ⚠️
packages/sdk/src/transaction/Beef.ts	97.37%	6 Missing ⚠️
packages/sdk/src/transaction/BeefTx.ts	91.22%	5 Missing ⚠️
packages/sdk/src/primitives/ReaderUint8Array.ts	69.23%	4 Missing ⚠️
...ackages/sdk/src/script/templates/SignatureUtils.ts	75.00%	2 Missing ⚠️
packages/sdk/src/primitives/WriterUint8Array.ts	75.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!