[uche001-dev]

Summary

Four self-contained contrib/ reference implementations for the four assigned hard issues, each with a working script, its own test coverage, and a README documenting exact integration steps for a maintainer, per this repo's contribution model (contributor PRs may only touch contrib/).

closes #679
closes #684
closes #685
closes #686

Changes

#679: contrib/mcp-payer-healthcheck/healthcheck.ts spawns the MCP payer binary, sends one JSON-RPC tools/list request over stdio, and resolves with a distinct exit code for healthy (0), unresponsive (1, running but not answering or answering with a JSON-RPC error), and not-running (2, could not be spawned or exited before answering). Verified against five real spawned Node processes exercising each scenario, not mocked.
#684: contrib/bundle-size-budget/check-bundle-size.mjs measures dist/ output size for the root package, packages/cli, and packages/mcp-x402-payer against a configurable per-package budget, failing with a clear per-package message naming which one is over and by how much. Ships with placeholder budgets since no real build could be run in this environment (see test plan); includes an --update-budgets helper that prints the real measured-with-headroom values for a reviewer to paste in after a deliberate increase.
#685: contrib/x402-latency-benchmark/benchmark.ts times the quote, sign, and submit phases of the x402 payment flow against a local fixture, using the real dependency-injection seams Payer.quote()/PayerDeps.signer/PayerDeps.fetchImpl already expose rather than refactoring production call structure. Reports the median of several iterations and appends results to a committed, append-only NDJSON file. Its README documents how the sign-phase measurement relates to the V-13 signature-window floor from the security audit.
#686: contrib/api-surface-diff/api-surface-diff.mjs extracts the named export surface from a .d.ts file (handling re-exports, declared functions/consts/classes, interfaces, and type aliases) and diffs two surfaces into added/removed/changed/unchanged, with a --from-npm flag that fetches the previously published version directly. Verified against the real, currently-published vellar-sdk@0.6.2 package (via npm pack): diffing it against itself correctly reports zero changes across 38 detected exports, and diffing it against a deliberately modified copy correctly detects the added/removed exports and exits non-zero. Its README documents the one real limitation: a bundled re-export can only be detected as present/removed, not changed, since its real declaration is hidden behind an opaque chunk reference; a fully structural diff would need a TypeScript compiler API pass, out of scope here.

Test plan

Could not run the project's real npm test/vitest/tsc in this environment: node_modules were not installed in this clone, and the development machine is currently under heavy memory pressure (confirmed via vm_stat/top showing near-exhausted physical memory and active swapping from other work running in parallel), so a fresh install was not attempted to avoid an OOM crash.

Instead, verified every piece of real, working logic directly:

• [hard] Add a health-check script for an uptime monitor against a running MCP payer instance #679: ran the actual spawn/stdio logic against 5 real temporary Node scripts covering all three exit codes plus a missing-binary case, with node --max-old-space-size=256, all passing.
• [hard] Add a build-size regression budget for each workspace package dist output #684: ran the real size-measurement logic against real temporary files and directories (under budget, over budget, missing dist, nested files), all passing. Also smoke-tested the CLI entrypoint directly against this repo's own (currently unbuilt) dist/ directories.
• [hard] Add a benchmark suite tracking x402 payment flow latency across releases #685: ran the real benchmark/fixture logic end to end against real setTimeout-based delays and real file I/O for the NDJSON append, all passing.
• [hard] Add an API surface diff check between releases to catch accidental breaking changes #686: ran the real diff logic against the actual published vellar-sdk@0.6.2 package fetched via npm pack, both self-diffed (0 changes) and against a deliberately modified copy (correctly detected 2 added, 1 removed, exit code 1), plus the full unit test suite's individual assertions run directly.

Every test file in this PR is a faithful copy of what was actually run, not retroactively written to match an assumed-correct implementation. Flagging the missing vitest run specifically, rather than claiming a CI-green result that didn't happen.

[vercel]

Someone is attempting to deploy a commit to the david's projects Team on Vercel.

A member of the Team first needs to authorize it.