Production dependency audit

npm audit --omit=dev was run for the packed dependency graph of this SDK and its peer @gala-chain/gala-core-sdk and reports zero vulnerabilities. Signing is not in this package: the signing primitives live in @gala-chain/gala-core-sdk (src/utils/signing.ts) on the audited, pure-JS @noble/curves and @noble/hashes, with no dependency on @gala-chain/api (and so none on elliptic, secp256k1 native bindings, bn.js or class-validator). Core's golden-vector suites (tests/signing-golden.test.ts, tests/signing.test.ts) pin every serialization, signature and prefix byte-for-byte to the Gala Wallet and @gala-chain/api outputs. @gala-chain/api remains a devDependency only, for those cross-checks.

Set DEBUG=GSWAP_SDK (or localStorage.debug = 'GSWAP_SDK' in a browser) only while debugging in a trusted environment. Read logging prints backend request URLs and response data, which can include quote amounts and other application-sensitive values. It does not log private keys or signed write bodies.