chore: dedupe shared schemas, byte-accurate password bound, CI hardening, dep-audit fixes

[willi-d7]

Summary

Backlog cleanup addressing four independent issues — a schema-duplication refactor, a password-validation correctness fix, a CI hardening change, and a dependency-audit remediation. Each is a separate commit.

Issue	Area	Change
#122	modules/*/interface/schemas.ts	Extract duplicated Zod fragments to src/shared/validation/
#121	modules/auth	Enforce the bcrypt 72-byte password limit (was 72 JS characters)
#119	.github/workflows/ci.yml	Add explicit least-privilege permissions: block
#120	package.json / pnpm-lock.yaml	Upgrade Vitest to 3.x, pin patched transitive deps

---

#122 — Deduplicate chainId / transactionResponseSchema (refactor, technical-debt)

chainDeliveryId / chainFleetId (the /^\d+$/ digit-string pattern) and transactionResponseSchema ({ data: { xdr } }) were redefined character-for-character across the deliveries, disputes, escrow, fleet and reputation modules — the same duplication already fixed for stellarAddress (src/shared/validation/stellar-address.ts).

• Adds src/shared/validation/chain-id.ts — exports chainId, named generically because the identical shape backs both chainDeliveryId and chainFleetId.
• Adds src/shared/validation/transaction-response.ts — exports transactionResponseSchema.
• Each module now aliases chainId and re-exports transactionResponseSchema from the shared module instead of defining its own copy. Route modules that import transactionResponseSchema from ./schemas.js are unaffected.
• Module-specific fragments (evidenceHash, amount, senderShareBps, …) are left exactly where they are — this is scoped only to the fragments proven identical.
• interface/ importing from shared/ is already permitted by the eslint-plugin-boundaries rules (eslint.config.js).

Pure extraction, no behaviour change.

#121 — Password length bounded by bytes, not characters (security, validation)

password = z.string().min(8).max(72) justified .max(72) with "bcrypt silently truncates beyond 72 bytes", but Zod's .max() counts UTF-16 code units while bcrypt truncates at 72 bytes. A password using multi-byte UTF-8 characters (emoji, many non-Latin scripts) can sit under 72 JS characters while exceeding 72 bytes — so two distinct such passwords that differ only after their first 72 bytes hash identically.

• Replaces .max(72) with .refine(v => Buffer.byteLength(v, 'utf8') <= 72, …) and updates the inline comment.
• resetPasswordBodySchema.newPassword reuses the same password constant, so registration, login and password-reset all pick up the corrected bound.
• Adds src/modules/auth/interface/schemas.spec.ts: an emoji password under 72 JS chars but over 72 UTF-8 bytes is now rejected with a clear message; a 72-byte pure-ASCII password is still accepted.

#119 — Least-privilege permissions: in ci.yml (ci, security, devops)

None of ci.yml's jobs write to the repo, comment on PRs, or need more than read access to the checked-out code, yet none declared a permissions: block — every job ran with the ambient default GITHUB_TOKEN grant. Adds a top-level permissions: contents: read ceiling, mirroring release.yml (which already scopes itself to the single contents: write it needs). All jobs pass unchanged.

#120 — Dependency-audit remediation (dependencies, security)

pnpm audit reported 31 advisories (3 critical, 17 high) against the committed lockfile:

• vitest ^2.1.4 resolves below the fix for GHSA-5xrq-8626-4rwp (critical — arbitrary file read/execute via the Vitest UI server).
• tar (critical decompression DoS + several high path-traversal advisories) via bcrypt > @mapbox/node-pre-gyp > tar.
• handlebars (critical JS-injection via AST type confusion) via eslint-plugin-boundaries.

Changes:

• Bump vitest / @vitest/coverage-v8 to ^3.2.7 (staying on 3.x per the issue; no vitest.config.ts changes needed).
• Add pnpm.overrides pinning forward-patched tar, handlebars, vite, esbuild, nanoid, js-yaml, fast-uri — all reached only through build/lint/test tooling.
• Document the one residual advisory in docs/SECURITY.md: GHSA-w5hq-g745-h8pq (uuid, reached only via the dev-only autocannon load-tester, moderate so below the --audit-level=high CI gate, no upstream fix available).

Audit before/after:

before:  31 vulnerabilities  (1 low | 10 moderate | 17 high | 3 critical)
after:   pnpm audit --audit-level=high  →  0 findings, exit 0
         (1 moderate remains, below threshold, documented)

---

Testing

• pnpm audit --audit-level=high → clean (exit 0), was 20 high/critical.
• New src/modules/auth/interface/schemas.spec.ts — 4 tests pass.
• Touched schema/interface tests pass; prettier --check and eslint clean on all changed files.
• pnpm test / pnpm typecheck / pnpm build / pnpm lint show no new failures introduced by this branch (verified against a clean upstream/main baseline — the pre-existing failures on main in unrelated modules are untouched and out of scope here).

Closes #122
Closes #121
Closes #120
Closes #119

[drips-wave]

@willi-d7 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits