sdk(typescript,v4): P0-4 — align @klickd/core with v4 GA strict schema

[Davincc77]

Summary

P0-4 brings the TypeScript SDK (@klickd/core) into V4 GA alignment, mirroring the surface introduced for the Python SDK in PR #43 (merged 4136282). No package version bump; no publish.

• New runtime API. validate(payload, { strict, target }) and validateIterErrors(payload, { strict, target }) mirror Python klickd.validate exactly — same target enum ("payload" | "unified"), same strict default (true), same KlickdError(KLICKD_E_SCHEMA) shape and 8-issue summary format.
• Schemas bundled. All four v4 schemas (payload + unified × strict + preview) are copied byte-identically from schemas/ and schema/ into packages/@klickd/core/src/schemas/. getBundledSchema(key) and listBundledSchemas() expose them programmatically.
• ajv is an optional peer dependency (>=8.12, Draft 2020-12 via ajv/dist/2020.js). Callers that never call validate() keep the v3 crypto-only dependency surface. Missing-ajv raises KLICKD_E_SCHEMA with a clear install hint.
• Types extended. KlickdPayload now carries the additive v4 GA fields, plus the v1-frozen sub-types KlickdMediaProfileEntry, KlickdGateEntry, KlickdGateLevel, KlickdHumanVetoPolicy, KlickdClaimSources, KlickdMigrationV1, KlickdVerificationGatesV1, KlickdMediaProfileV1 — parity with packages/pypi/klickd/src/klickd/_types.py.
• Jest matrix (v4-ga-strict.test.ts) mirrors the Python pytest matrix:
  • 5 personas × {strict payload, strict unified, preview payload} = 15 validation cases
  • 5 personas × {single round-trip, double round-trip} = 10 preservation cases
  • 6 negative cases (unknown gate level, missing media hash, unknown modality, unsupported version, missing field, missing envelope kdf)
  • structured + flat gate forms accepted; flat form with unknown level rejected
  • preview ↔ GA cross-acceptance
  • v3.x non-regression (v3 payload still saves/loads; v3 schema_version fails v4 strict)
  • gaming / créateur média / chef de projet personas explicitly covered
  • unknown-field preservation under validation (SPEC.md §33.7)
  • validateIterErrors empty-on-valid + {path, message} shape
  • KlickdError.code = 'KLICKD_E_SCHEMA' + httpStatus = 400
• Build. tsup invocation updated with --external ajv --loader .json=copy so the bundled schemas ship in dist/ and ajv stays optional at install time.

No changes to decode.ts, encode.ts, errors.ts, or to the Python SDK. No release/tag/Zenodo, no npm publish.

Test plan

• npm test in packages/@klickd/core → 61/61 Jest tests pass (3 suites)
• python -m pytest tests/ -q in packages/pypi/klickd → 63/63 pass (no regression on the Python side)
• python3 verify_vectors.py → 59/59 vectors pass (v2.5 + v3.0 + adversarial + v4.0-preview)
• node verify_vectors.mjs (with npm install at repo root for hash-wasm) → 42/42 vectors pass, 0 skipped
• python3 scripts/validate_v4_schemas.py → all persona/unified/payload/vector/negative cases OK
• CI @klickd/core — package integrity check step run locally → OK (required deps present, source files present, version unchanged at 4.0.0-preview.1)

Argon2id CI skip note (not in scope here)

node verify_vectors.mjs skips v3.0 / v4.0-preview vectors when hash-wasm is absent. The existing workflow runs npm install first, so it is unaffected in CI. No change to verify_vectors.mjs or workflows in this PR. If a future PR wants zero-skip in environments without a root node_modules/, a minimal option would be to lazy-load hash-wasm from packages/@klickd/core/node_modules as a fallback — left as a separate change.

Governance

• No GitHub release/tag.
• No npm publish, no PyPI publish, no Zenodo deposit.
• No package version bump (still 4.0.0-preview.1).
• Files touched are limited to packages/@klickd/core/{package.json, src/types.ts, src/index.ts, src/validate.ts (new), src/schemas/*.json (new), src/__tests__/v4-ga-strict.test.ts (new)}.

🤖 Generated with Claude Code