0.32.10 — take the two Polymarket SDK majors, on one verified baseline

[VickyXAI]

Both Polymarket SDK majors had been sitting unreviewed. Franklin's port of this
module just took them in 3.38.0, so landing them here puts the two repos back on
a single baseline — the source is byte-faithful between them, and only the pins
had diverged.

Neither upgrade adds a transitive dependency: clob-client-v2's dependency set is
identical between the two versions, and builder-signing-sdk's is strictly smaller
(it drops tslib and a stale @types/node ^18 that should never have been a
runtime dependency).

@polymarket/clob-client-v2 1.0.8 → 1.1.0

postOrder gained waitForResolvedTrades: a matched order now gets the
settlement transaction hashes of its fills back-filled, and the return type
tightens from Promise<any> to Promise<OrderResponse>. orders.ts already
read transactionsHashes and tradeIDs off the response, so this makes an
existing display path more often correct rather than changing it — filled and
the tx: line now resolve on matched orders instead of only when the server
happened to include them.

This is the order path and no test here places an order, so it was verified
against the shipped bundle rather than the release notes:

case	result
unmatched order (tradeIDs empty)	returned untouched, zero polls, zero added latency — the resting-limit path is unaffected
response already carries hashes	short-circuits, no poll
matched order	transactionsHashes filled from the resolved trade
FAILED trade	excluded — a failed fill can never be reported as a settlement hash
getTrades failing persistently (worst case)	measured 30.1 s, then degrades and returns the placed order rather than throwing

The added latency lands only on matched orders and is bounded by
RESOLVE_TRADES_TIMEOUT_MS (30 s, 250 ms poll).

@polymarket/builder-signing-sdk 0.0.8 → 1.0.0, with an override

1.0.0 is a pure CJS→ESM port: every non-import change in the bundle is
exports.X → export boilerplate, and the HMAC signing logic is untouched.

It needs an overrides entry because @polymarket/builder-relayer-client still
pins ^0.0.8, and a caret on 0.0.x is patch-only under npm semver — so without
it npm installs a second copy, and both BuilderConfig declarations carry a
private ensureValid, which TypeScript compares nominally.

Collapsing to one copy is safe for a specific reason worth recording:
builder-relayer-client never requires the signing SDK at runtime. It is a
type-only dependency, consumed by duck-typing
(builderConfig.generateBuilderHeaders(), .isValid()), with no instanceof
check anywhere in its bundle — and nothing else in the tree requires it either.
The CJS/ESM seam was then exercised for real: a 1.0.0 BuilderConfig handed to
the CJS RelayClient produced correct POLY_BUILDER_* headers across the
boundary.

One caveat recorded in the CHANGELOG: npm overrides do not propagate to
consumers, so an installed @blockrun/mcp gets both copies on disk. Harmless for
the same reason — nothing loads the nested one.

Verification

• npm run typecheck — clean
• npm run build — clean
• npm test — 250/250
• node dist/index.js --version → 0.32.10, exit 0 (a broken module graph is
  exactly the class of failure 0.32.3 shipped)
• runtime seam check against the installed bundles — no order signed, no relayer
  transaction sent