[Kinkytech]

Closes #677
Closes #678
Closes #669

#677: CLI startup banner

Added packages/cli/src/banner.ts: a program.hook("preAction", ...) that prints the resolved network/facilitator for whichever subcommand was invoked, naming whether each came from a flag, an environment variable, or the built-in default.

commander's own getOptionValueSource only distinguishes "cli" from "default" here, since every --network/--facilitator option bakes its env var read into the default value expression (process.env.VELLAR_NETWORK ?? "testnet") rather than using commander's .env() hook, so the env source is re-derived by checking the env var directly.

Suppressible with a new --quiet flag (and with VELLAR_LOG_LEVEL above "info", wiring it into #678's shared convention below). Omits options a given subcommand doesn't define (quote takes neither --network nor --facilitator). 8 tests in banner.test.ts covering flag/env/default resolution, precedence, --quiet, and commands with no resolvable options.

#678: shared log-level configuration

Added src/log-level.ts (published as vellar-sdk/log-level): the VELLAR_LOG_LEVEL convention (debug/info/warn/error/silent) and shouldLog(level), shared across all 3 workspace packages.

Wired into packages/mcp-x402-payer/src/output.ts's existing log() (previously always wrote regardless of level) and into the new CLI banner above. Per issue #416, the MCP payer's log() already writes exclusively to stderr, never stdout; this change only gates whether that stderr write happens, adding no new write path, so it cannot affect the stdout-safety constraint (verified: packages/mcp-x402-payer/test/stdout-discipline.test.ts, which statically scans for console.*/process.stdout usage, still passes).

The rest of the CLI's console.log/console.error calls are primary output (results, user-facing errors), not diagnostics, so they are left as-is, gating them behind a log level would break the tool's actual job.

9 tests in src/log-level.test.ts for the level-comparison logic itself, 5 in packages/mcp-x402-payer/test/log-level-gating.test.ts for output.ts's log() consulting it.

The SDK root (src/) must stay Node-free per tsconfig.json's types: [] (ambient @types/node would silently change what every other SDK file typechecks against), so log-level.ts reads process.env through globalThis, same pattern already used for globalThis.crypto/globalThis.performance elsewhere in this package, rather than referencing a bare process identifier.

#669: CDN SRI docs + generation script

Added scripts/generate-sri-hashes.mjs, generating a sha384 SRI hash for every file in dist/ (dist/sri-hashes.json, included in the published tarball since dist/ is already in package.json's files). Wired into .github/workflows/publish.yml right after npm run build, writing the same output to the workflow's job summary so it's auditable without downloading the package.

Added website/content/docs/reference/subresource-integrity.md (registered in website/lib/docs-registry.ts) explaining why a CDN-loaded SDK needs SRI, how to fetch or recompute the hash for a pinned version, and how to use it in a <script integrity=...> tag or an import map.

9 tests in generate-sri-hashes.test.ts using a temp fixture directory (never depends on an actual npm run build having happened): hash determinism, detecting a changed/added file against previously recorded hashes, and the missing-sri-hashes.json failure mode.

Plumbing

Added vellar-sdk/log-level to tsup.config.ts's entry map and package.json's exports (mirroring every other subpath export's source/import/require shape), and a paths entry in both packages/cli/tsconfig.json and packages/mcp-x402-payer/tsconfig.json (mirroring their existing vellar-sdk/x402-* entries) so tsc resolves it to source rather than a dist/ that doesn't exist until a successful build.

Validation

• Typecheck clean for all 3 packages (packages/cli/tsconfig.json, packages/mcp-x402-payer/tsconfig.json excluding the pre-existing src/x402-signer.ts syntax error noted below, and the root).
• vitest run for the whole workspace: 33 failed / 321 passed test files with this change vs 36 failed / 318 passed on a clean checkout (confirmed via git stash). The delta is exactly my own 4 new passing test files; zero regressions in any pre-existing file.

Pre-existing, unrelated to this change (confirmed via git stash before/after on a clean checkout)

src/x402-signer.ts has a syntax error (stray doc-comment asterisks escaped the block, breaking every file that transitively imports it, including 3 mcp-x402-payer test files and the whole-repo esbuild-based npm run build) that blocks both tsup's full build and any tsc invocation that resolves vellar-sdk to the index.ts facade. 33 test files fail repo-wide for reasons unrelated to this PR (contrib/ example scripts expecting stdout that a child process doesn't produce in this sandboxed environment, etc.).

[vercel]

@davedumto is attempting to deploy a commit to the david's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Thanks for the contribution — but contributor PRs may only change files inside contrib/.

This PR touches file(s) outside that folder:

• .github/workflows/publish.yml
• package.json
• packages/cli/src/banner.test.ts
• packages/cli/src/banner.ts
• packages/cli/src/bin.ts
• packages/cli/tsconfig.json
• packages/mcp-x402-payer/src/output.ts
• packages/mcp-x402-payer/test/log-level-gating.test.ts
• packages/mcp-x402-payer/tsconfig.json
• scripts/generate-sri-hashes.mjs
• scripts/generate-sri-hashes.test.ts
• src/log-level.test.ts
• src/log-level.ts
• tsup.config.ts
• website/content/docs/reference/subresource-integrity.md
• website/lib/docs-registry.ts

Please open a new PR with your changes scoped to contrib/ only, targeting dev. See CONTRIBUTING.md and contrib/README.md. If your assigned issue genuinely needs changes elsewhere, say so on the issue first — don't open a PR outside contrib/.

Questions? Ask in the Telegram group.

[github-actions]

This pull request has been automatically closed because its diff matches one or more Wave malware advisory indicators.

Matched indicators:

• Adds curl/wget fetch in website/content/docs/reference/subresource-integrity.md

If you believe this is a false positive, please contact a maintainer directly instead of reopening the PR.

[github-actions]

This pull request has been automatically closed because its diff matches one or more Wave malware advisory indicators.

Matched indicators:

• Adds curl/wget fetch in website/content/docs/reference/subresource-integrity.md

If you believe this is a false positive, please contact a maintainer directly instead of reopening the PR.

[github-actions]

Thanks for the contribution — but contributor PRs may only change files inside contrib/.

This PR touches file(s) outside that folder:

• .github/workflows/publish.yml
• package.json
• packages/cli/src/banner.test.ts
• packages/cli/src/banner.ts
• packages/cli/src/bin.ts
• packages/cli/tsconfig.json
• packages/mcp-x402-payer/src/output.ts
• packages/mcp-x402-payer/test/log-level-gating.test.ts
• packages/mcp-x402-payer/tsconfig.json
• scripts/generate-sri-hashes.mjs
• scripts/generate-sri-hashes.test.ts
• src/log-level.test.ts
• src/log-level.ts
• tsup.config.ts
• website/content/docs/reference/subresource-integrity.md
• website/lib/docs-registry.ts

Please open a new PR with your changes scoped to contrib/ only, targeting dev. See CONTRIBUTING.md and contrib/README.md. If your assigned issue genuinely needs changes elsewhere, say so on the issue first — don't open a PR outside contrib/.

Questions? Ask in the Telegram group.