chore: remove dead code/stray files, add CI typecheck+lint+build gates, CodeQL, and Dependabot

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -6,9 +6,12 @@ on:
   pull_request:
     branches: [ '**' ]
 
+permissions:
+  contents: read
+
 jobs:
-  test:
-    name: Run tests
+  build:
+    name: Typecheck, lint, test, build
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -23,5 +26,14 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Type check
+        run: npx tsc --noEmit
+
+      - name: Lint
+        run: npm run lint
+
       - name: Run tests
-        run: npm test --if-present
+        run: npm test -- --ci
+
+      - name: Build
+        run: npm run build

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ '**' ]
+  schedule:
+    - cron: '17 3 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (javascript-typescript)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:javascript-typescript'

.gitignore

@@ -1,4 +1,5 @@
 node_modules/
 .next/
 .env.local
-./node_modules/
+./node_modules/
+*.tsbuildinfo

src/app/layout.tsx

@@ -11,6 +11,7 @@ import { I18nProvider } from '@/i18n';
 import { NetworkProvider } from '@/context/NetworkContext';
 import { SocketIOProvider } from '@/context/SocketIOContext';
 import DevWalletSwitcher from '@/components/DevWalletSwitcher';
+import { ErrorProvider } from '@/components/ErrorModal';
 
 const inter = Inter({ subsets: ['latin'] });
 

src/components/AuditSessionTimer/__tests__/AuditSessionTimer.test.tsx

@@ -1,5 +1,4 @@
 import { act, fireEvent, render, screen } from '@testing-library/react';
-import { describe, expect, it, jest, afterEach, beforeEach } from '@jest/globals';
 import AuditSessionTimer from '../AuditSessionTimer';
 import {
   formatDuration,

src/components/ContractTimeTraveler/__tests__/ContractTimeTraveler.test.tsx

@@ -1,5 +1,4 @@
 import { fireEvent, render, screen } from '@testing-library/react';
-import { describe, expect, it } from '@jest/globals';
 import ContractTimeTraveler from '../ContractTimeTraveler';
 import {
   appendSnapshot,

src/components/IPFSDocViewer/__tests__/IPFSDocViewer.test.tsx

@@ -1,5 +1,4 @@
 import { fireEvent, render, screen } from '@testing-library/react';
-import { describe, expect, it } from '@jest/globals';
 import IPFSDocViewer from '../IPFSDocViewer';
 import { buildGatewayUrl, IPFS_GATEWAY, isValidIpfsHash } from '../ipfsDocViewer';
 

src/components/MultiSigPreviewer/__tests__/MultiSigPreviewer.test.tsx

@@ -1,6 +1,5 @@
 import * as StellarSdk from '@stellar/stellar-sdk';
 import { fireEvent, render, screen, waitFor } from '@testing-library/react';
-import { describe, expect, it, jest } from '@jest/globals';
 import { MultiSigPreviewer } from '../MultiSigPreviewer';
 import {
   computeThreshold,
@@ -31,11 +30,11 @@ function buildTestXdr(): string {
 const VALID_XDR = buildTestXdr();
 
 function makeServer(result: Record<string, unknown>): (url: string) => SorobanServer {
-  return () => ({ simulateTransaction: jest.fn<() => Promise<Record<string, unknown>>>().mockResolvedValue(result) });
+  return () => ({ simulateTransaction: jest.fn().mockResolvedValue(result) });
 }
 
 function makeErrorServer(error: Error): (url: string) => SorobanServer {
-  return () => ({ simulateTransaction: jest.fn<() => Promise<never>>().mockRejectedValue(error) });
+  return () => ({ simulateTransaction: jest.fn().mockRejectedValue(error) });
 }
 
 // ---------------------------------------------------------------------------

src/components/MultiSigPreviewer/multiSigPreviewer.ts

@@ -28,7 +28,7 @@ export interface SignerThreshold {
 }
 
 export interface SorobanServer {
-  simulateTransaction(tx: StellarSdk.Transaction): Promise<Record<string, unknown>>;
+  simulateTransaction(tx: StellarSdk.Transaction): Promise<unknown>;
 }
 
 /** Decode an unsigned XDR envelope and extract proposal metadata. */
@@ -85,7 +85,7 @@ export async function simulateProposal(
     const server: SorobanServer = serverFactory
       ? serverFactory(sorobanRpcUrl)
       : new StellarSdk.SorobanRpc.Server(sorobanRpcUrl);
-    const result = await server.simulateTransaction(tx);
+    const result = (await server.simulateTransaction(tx)) as Record<string, unknown>;
     if (result['error']) {
       return { success: false, fee: tx.fee, error: String(result['error']) };
     }

src/components/OnboardingTour/OnboardingTour.tsx

@@ -2,7 +2,7 @@
 
 import { useEffect, useRef } from 'react';
 import { useTranslation } from 'react-i18next';
-import { buildTourSteps, hasTourBeenSeen, markTourSeen } from './onboardingTour';
+import { buildTourSteps, hasTourBeenSeen, markTourSeen, type ShepherdButton } from './onboardingTour';
 
 interface OnboardingTourProps {
   /** Force the tour to start regardless of localStorage flag (for testing/demo). */
@@ -42,7 +42,7 @@ export function OnboardingTour({ autoStart = false, createTour }: OnboardingTour
 
       steps.forEach((step, index) => {
         const isLast = index === steps.length - 1;
-        const buttons: Shepherd.Step.StepOptionsButton[] = [];
+        const buttons: ShepherdButton[] = [];
 
         if (index > 0) {
           buttons.push({ text: t('tour.back'), action: () => tour.back(), secondary: true });

src/components/OnboardingTour/onboardingTour.ts

@@ -1,14 +1,32 @@
-import type Shepherd from 'shepherd.js';
-
 export const TOUR_SEEN_KEY = 'vero_onboarding_seen';
 
+export type TourStepPlacement = 'top' | 'bottom' | 'left' | 'right';
+
 export interface TourStep {
   id: string;
-  attachTo?: { element: string; on: string };
+  attachTo?: { element: string; on: TourStepPlacement };
   title: string;
   text: string;
 }
 
+/**
+ * Minimal local shape covering only the subset of shepherd.js's Tour API
+ * this module actually calls, so this file doesn't need to know which
+ * shepherd.js version's exact types are installed.
+ */
+export interface ShepherdTourLike {
+  getCurrentStep(): { id: string } | undefined;
+  back(): void;
+  next(): void;
+  complete(): void;
+}
+
+export interface ShepherdButton {
+  text: string;
+  action: () => void;
+  secondary?: boolean;
+}
+
 export function buildTourSteps(t: (key: string) => string): TourStep[] {
   return [
     {
@@ -60,11 +78,11 @@ export function markTourSeen(): void {
 }
 
 export function buildShepherdButtons(
-  tour: Shepherd.Tour,
+  tour: ShepherdTourLike,
   isLast: boolean,
   t: (key: string) => string,
-): Shepherd.Step.StepOptionsButton[] {
-  const buttons: Shepherd.Step.StepOptionsButton[] = [];
+): ShepherdButton[] {
+  const buttons: ShepherdButton[] = [];
   if (tour.getCurrentStep()?.id !== 'welcome') {
     buttons.push({ text: t('tour.back'), action: () => tour.back(), secondary: true });
   }

src/components/ProofViewer/ProofHistoryTable.tsx

@@ -1,6 +1,7 @@
 import React, { useEffect, useState } from 'react';
 import { Download, Copy } from 'lucide-react';
-import { fetchProofHistory, type ProofRecord } from '@/services/proofService';
+import { fetchProofHistory } from '@/services/proofService';
+import type { ProofRecord } from '@/types/proof';
 import { useTranslation } from 'react-i18next';
 
 /**