CI hardening, type safety improvements, and DX gaps (11 fixes)

[Copilot]

Addresses 11 medium-priority gaps spanning CI reliability, type safety, and developer experience across both SDKs.

CI/CD

• Feature parity checker now exits non-zero when parity is missing — previously always exited 0, silently passing CI
• Version sync checker now validates all three sources: package.json, pyproject.toml, and __init__.py
• Python matrix lowered from 3.14-only to ["3.11", "3.12", "3.13"]; requires-python updated to >=3.11
• Node.js matrix expanded from 20-only to ["18", "20", "22"] to match declared engines.node range
• softprops/action-gh-release bumped from v1 (Node 16) to v2
• Coverage enforcement: Python CI now fails below 80% (--cov-fail-under=80; currently at 87%); TypeScript gets vitest.config.ts with v8 coverage via new test:coverage script
• Workflow permissions explicitly set to contents: read (principle of least privilege)

Type Safety

• AssetTree index signature [key: string]: unknown replaced with extra?: Record<string, unknown> — the index signature was disabling excess property checking across the entire interface
• Timestamp precision documented on Commit.timestamp (seconds) and IntegrityProof.created_at (milliseconds) in both SDKs to eliminate the ambiguity between API and proof timestamps

Architecture

• Hardcoded service URLs are now overridable via CaptureOptions in both SDKs — enables staging/custom environments without forking:

const capture = new Capture({
  token: '...',
  assetSearchApiUrl: 'https://staging-search.example.com',
  historyApiUrl: 'https://staging-history.example.com',
})

capture = Capture(token="...", asset_search_api_url="https://staging-search.example.com")

Developer Experience

• py.typed marker added (python/numbersprotocol_capture/py.typed) — pyproject.toml already declared Typing :: Typed but the PEP 561 marker was missing
• TypeScript test coverage expanded: new errors.test.ts (25 tests), crypto.test.ts (8 tests); client.test.ts extended with get(), update(), register(), searchNft(), and URL-override tests (58 total)
• Python test coverage improved from 71% → 87% via new test_client_api.py and test_verify.py

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Feature][Medium] CI pipeline hardening, type safety improvements, and developer experience gaps</issue_title>
<issue_description>## Summary

Multiple medium-priority improvements to CI reliability, type safety, and developer experience across both SDKs.

CI/CD Pipeline Issues

1. Feature parity checker never exits non-zero

• scripts/check-feature-parity.py:212-219
• The main() function always exits 0 regardless of parity result. The CI step passes even when features are missing.
• Fix: Add sys.exit(1) when parity is not achieved.

2. sync-versions.py ignores __init__.py version

• scripts/sync-versions.py:103-117
• Only compares package.json and pyproject.toml versions. Does not check __init__.py.__version__, allowing stale runtime version strings.
• Fix: Add third version check for python/numbersprotocol_capture/__init__.py.

3. Python CI tests only Python 3.14 (not yet stable)

• .github/workflows/ci.yml:73-74
• pyproject.toml declares requires-python = ">=3.14" which is aggressive. Code uses no 3.14-specific features.
• Fix: Lower minimum to 3.11+, add matrix ["3.11", "3.12", "3.13"].

4. TypeScript CI tests only Node.js 20

• .github/workflows/ci.yml:52-55
• package.json declares "engines": {"node": ">=18.0.0"} but CI only tests Node 20.
• Fix: Add matrix ["18", "20", "22"].

5. Deprecated softprops/action-gh-release@v1

• .github/workflows/release.yml:122
• v1 depends on Node.js 16 runners that GitHub is phasing out.
• Fix: Update to softprops/action-gh-release@v2.

6. No coverage enforcement or reporting

• .github/workflows/ci.yml
• Python runs pytest without --cov-fail-under. TypeScript has no coverage configured.
• Fix: Add --cov-fail-under=80 for Python; add vitest coverage for TypeScript.

Type Safety & Architecture

7. TypeScript AssetTree index signature undermines type safety

• ts/src/types.ts:144
• [key: string]: unknown disables excess property checking on the entire interface.
• Fix: Replace with extra?: Record<string, unknown> field (matching the Python SDK pattern).

8. Ambiguous timestamp precision undocumented

• ts/src/crypto.ts:29 and python/numbersprotocol_capture/crypto.py:44
• created_at uses milliseconds in integrity proofs, but Commit.timestamp from API uses seconds. No documentation clarifies which.
• Fix: Document in type definitions. Add helper getCreatedDate() method.

9. Hardcoded service URLs not configurable

• ts/src/client.ts:24-31 and python/numbersprotocol_capture/client.py:33-37
• Five different service URLs are hardcoded. Users cannot point to staging environments.
• Fix: Add optional URL overrides in CaptureOptions with current values as defaults.

Developer Experience

10. Missing py.typed marker for PEP 561

• python/numbersprotocol_capture/ directory
• Despite pyproject.toml declaring "Typing :: Typed", the PEP 561 marker file is missing.
• Fix: Create empty python/numbersprotocol_capture/py.typed.

11. TypeScript test coverage significantly lags Python

• ts/src/client.test.ts
• Only tests constructor validation and searchAsset. Zero tests for register(), update(), get(), getHistory(), getAssetTree(), searchNft().
• Fix: Create errors.test.ts, crypto.test.ts, and expand client.test.ts with mock-based tests.

---

Generated by Health Monitor with Omni</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Feature][Medium] CI pipeline hardening, type safety improvements, and developer experience gaps #25

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.