Production dependency audit

npm audit --omit=dev was run for the packed SDK dependency graph and reports zero vulnerabilities. Signing no longer depends on @gala-chain/api (and so no longer on elliptic, secp256k1 native bindings, bn.js or class-validator): the SDK owns its signing primitives in src/utils/signing.ts on the audited, pure-JS @noble/curves and @noble/hashes. The golden-vector suites (tests/signing-golden.test.ts, tests/signing.test.ts) pin every serialization, signature and prefix byte-for-byte to the Gala Wallet and @gala-chain/api outputs. @gala-chain/api remains a devDependency only, for those cross-checks.

Set GSWAP_SDK=* only while debugging in a trusted environment. Read logging prints backend request URLs and response data, which can include quote amounts and other application-sensitive values. It does not log private keys or signed write bodies.