createSpendPermissionTypedDataWithSeconds: soft production guard (console.warn) should be a hard throw to prevent silent misuse

[Nexory]

File: packages/account-sdk/src/interface/public-utilities/spend-permission/utils.ts
Lines: 109–154 (HEAD 24ab30c)

Summary

createSpendPermissionTypedDataWithSeconds is documented as test-only (@testOnly JSDoc, warning comment). Its production guard (line 126–131) is:

if (process.env.NODE_ENV === 'production') {
  console.warn(
    '⚠️ createSpendPermissionTypedDataWithSeconds is being used. ' +
      'This function is intended for testing purposes only.'
  );
}

The function then continues and returns valid SpendPermissionTypedData regardless of environment. A console.warn in a production bundle is typically invisible to end-users and silently swallowed by logging pipelines. The "guard" does not guard: a developer who accidentally ships a call to this function in production will receive a fully-formed typed-data object that can be signed and submitted on-chain.

Expected behavior

The guard should be a hard throw (or at minimum prevent returning typed data) so that production callers fail fast and loudly:

if (process.env.NODE_ENV === 'production') {
  throw new Error(
    'createSpendPermissionTypedDataWithSeconds is for testing only and must not be called in production.'
  );
}

Why this matters

Spend permissions authorise recurring token withdrawals from user accounts. A test utility that creates permissions with arbitrary second-level periods could be used (accidentally or intentionally) in production, creating permissions with very short periods that drain allowances rapidly and are not supported by the production UX.

No existing issue found (searched createSpendPermissionTypedDataWithSeconds, testOnly production guard, console.warn throw across all states).