Package API, Declarations, and Migration Ledger

This page is generated from all 38 public manifests, package documentation, and governance/package-release-notes.json. It records source candidates without publishing them. CI rejects a version change unless its release classification, summary, and migration guidance are updated at the same time.

The declaration targets below describe the packed manifest contract. The package pages remain the human API and usage authority; generated declarations and clean-consumer tests remain the executable type authority.

Current release boundary

Package	npm baseline	Source	Candidate	API	Migration
`@bsv/402-pay`	`0.3.5`	`0.3.5`	none	API and usage	Custom clients must send a strictly framed BRC-95 Atomic BEEF envelope whose subject is the payment transaction; plain BEEF is no longer accepted. Legacy Atomic BEEF containing unrelated branches remains compatible because the server reduces it to the declared subject and dependency closure. The default replay store is bounded and process-local; production services with more than one serving process or node must inject the same durable atomic PaymentReplayStore everywhere. Low-level validators should retain one wallet object or pass an explicit store. Applications that relied on implicit console diagnostics must supply the optional structured logger. Treat an unchallenged 503 after payment submission as ambiguous and reconcile the transaction before requesting another payment. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/air-gap`	`0.1.3`	`0.1.3`	none	API and usage	No migration is required for valid BRC-141 v1 senders or decoders. Malformed, oversized, duplicate-heavy, or adversarial high-degree sessions now fail closed or are evicted within the documented limits instead of consuming unbounded resources.
`@bsv/amountinator`	`2.1.9`	`2.1.9`	none	API and usage	Valid finite inputs retain the public API. Currency identifiers are trimmed and normalized to uppercase; callers that passed non-finite values, empty currencies, coercive options, invalid decimal precision, or non-finite converter results must normalize or reject them before calling because those values now fail closed. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/auth`	`0.1.8`	`0.1.8`	none	API and usage	No valid proof bytes or public API shape changes. Client and server must use the same protocol tuple; security levels 0, 1, and 2 remain supported and select wallet consent policy while the explicit counterparty scopes derivation at every level. Proof and wallet adapters must supply plain own data fields and dense byte arrays; inherited, accessor-backed, sparse, or malformed runtime shapes fail closed. Structured bodies containing non-finite numbers or negative zero must be normalized to an unambiguous wire representation before signing. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/auth-express-middleware`	`2.3.0`	`2.3.0`	none	API and usage	No BRC100 call, wire or wallet-data migration. Configure and validate transport header limits at the HTTP server, CDN, proxy or WAF; maxRequestBytes no longer caps received headers. Clients needing larger signed responses require corresponding client capacity, including SDK 2.8.5. Published 2.2.8 is verified against protected release 36052862859 and its immutable source artifacts. Upgrade the required SDK peer to 2.8.5; custom ExpressTransport/Peer setups should pass maxGeneralPayloadBytes=null when the HTTP layer owns payload capacity. SDK consumers may retain ^2.8.5 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. No BRC-103/104 wire or request-shape migration. Clients that already retry authentication after 401 recover from a server nonce they cannot verify. Clients that treated HTTP 500 as a permanent internal failure for this case now receive 401. Either this middleware or the SDK 4.0.1 hotfix stops the lock-out; deploy both when they are published. This source candidate is not publication. No change for ordinary routes. Guarded routes explicitly call guardAuthenticatedResponse after authentication and before sending; acquire the application durable fence, recheck current authorization and targets, and synchronously enqueue under it. Native Node HTTP/1 transport is required without compression/deferred response wrappers. Replacements are complete responses limited to64KiB and must preserve required CORS/capability headers. No production rate-limiting or transport defaults change. SDK consumers may retain ^2.8.5 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. No migration for the owned-byte correction; current authorization and synchronous enqueue remain the guard owner's responsibility. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. No API, authentication, wire or request-replay migration for response promise ownership.
`@bsv/authsocket`	`2.1.11`	`2.1.11`	none	API and usage	No API or wire migration is required for valid JSON events. Existing numeric-key objects under byte-like names are unchanged; typed payment protocols recover historical byte objects at their explicit fields. Outbound non-JSON or ambiguous runtime values, including negative zero, nested undefined, sparse arrays, accessors, hidden/extra properties, and serialization hooks, now fail closed before signing. requestedCertificates is an SDK allowlist, not an application authorization verdict. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/authsocket-client`	`2.1.10`	`2.1.10`	none	API and usage	No API or wire migration is required for valid JSON events. Existing numeric-key objects under byte-like names are unchanged; typed payment protocols recover historical byte objects at their explicit fields. Outbound non-JSON or ambiguous runtime values, including negative zero, nested undefined, sparse arrays, accessors, hidden/extra properties, and serialization hooks, now fail closed before signing. The connect event/connected property report Socket.IO transport state, not completed BRC-103 authentication; wait for verified application traffic when local behavior requires a known unpinned server. Distributors who copy the UMD file must keep THIRD_PARTY_NOTICES.md and LICENSES/ with it. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/btms`	`1.2.6`	`1.2.6`	none	API and usage	Existing local, mainnet, testnet, and number-array behavior is unchanged. TTN consumers select networkPreset teratestnet; all consumers should upgrade to @bsv/sdk 2.4.1 or later for byte-boundary compatibility. Valid canonical token amounts remain compatible. Audit historical tokens for signed, exponent, leading-zero, non-positive, or greater-than-9007199254740991 amount fields before rebuilding wallet state; public number-based operations now fail closed when an aggregate cannot be represented exactly. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/btms-permission-module`	`1.2.4`	`1.2.4`	none	API and usage	Valid canonical BTMS flows remain compatible. Custom prompts must return literal true, authorization maps may contain at most 1,024 entries, and callers must provide dense signatures, safe exact totals, and canonical preimages; coercive or trailing-byte forms now fail closed. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/chirp`	`0.1.6`	`0.1.6`	none	API and usage	No API, codec, object identifier, service schema, or wire-format migration. Use @bsv/chirp 0.1.3 with SDK 2.8.9 or later and Cloud Bucket 0.2.48 or Lite 0.1.45 for authenticated binary uploads, including full 4 MiB chunks. Custom authenticated transports must send the supplied owned byte body unchanged and supply ordinary HTTP framing; Content-Type remains signed through AuthFetch. Earlier service entrypoints do not parse staged binary bytes before authentication and require this service patch. Existing stored objects, sessions, advertisements and leases remain unchanged. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/color-permission-module`	`0.1.1`	`0.2.0`	minor	API and usage	0.1.1 restores numeric module balance queries for established clients. Wallet hosts use SDK4.0.1 or newer and register the color scheme with the underlying wallet, a ColorOverlayProvider and a prompt callback. Exact accounting and value movement enumerate outputs; numeric summaries above 2^53 may round. Published inventory scope and wallet data remain unchanged. 0.2.0: No migration for hosts that register no profiles: behaviour is 0.1.1's (numeric balances, SDK ^4.0.1, #1338 suffix tags and inputBEEF recovery). ColorOverlayProvider.submit receives an optional third offChainValues argument; existing providers ignore it. Hosts that register profiles must supply a durable ColorModuleStore, submit plain-noSend hand-overs and pending receipts themselves, and call markSettled(txid) once the overlay admitted them. For every host, each consent message now carries seekPermission and a declined request throws ColorConsentDeclinedError, whose message is the 0.1.0 text prefixed with [ColorConsentDeclinedError]. 0.1.1 advertised brc207-color=5; 0.2.0 advertises brc207-color=4, the discovery value the pinned BRC-207 revision defines, so apps that check for 4 discover the module.
`@bsv/did`	`0.3.2`	`0.3.2`	none	API and usage	DID0.3 is a breaking pre-1.0 candidate: compressed identity-key input only; remote document/lifecycle options rejected. Use original signed BRC52 binary for envelopes, or explicitly verified compatible structured core. Wire authenticated BRC103/104 payload/control, durable atomic replay, consent, issuer/schema/purpose reliance and local status policy; callbacks alone are not full transport conformance. See docs/guides/identity-did-vc-migration.md. Proposed custom W3C mechanisms remain unregistered. Import BRC52 APIs/types from @bsv/did/brc52; identity-key DID and independent SD-JWT helpers stay at @bsv/did. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/ecpm-permission-module`	`0.1.4`	`0.1.4`	none	API and usage	Valid ecpm requests remain compatible. Authorization callbacks must return literal true; inherited, accessor-backed, malformed, or oversized inputs now fail closed. Hosts must keep grants below 1,024 entries and avoid more than 64 concurrently pending new authorization prompts per module instance. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/eqc`	`0.1.0`	`0.1.0`	none	API and usage	No consumer migration is required; this is the first release of a new additive package. Existing LookupResolver, MessageBoxClient, overlay, and message box server routes are unchanged. Requires @bsv/sdk ^2.8.0, ^3.0.0 or ^4.0.1; 2.8.0 is the first SDK2 release whose AuthFetch accepts bounded transport options and whose SLAP advertisements are canonical https, wss or js8 URIs. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/fund-wallet`	`1.5.5`	`1.5.5`	none	API and usage	No public API migration is required for conforming wallets. Custom WalletInterface adapters must return the literal accepted: true verdict after successful internalization; refusals and malformed or coercive results now throw instead of being reported as success. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/gasp`	`1.3.10`	`1.3.10`	none	API and usage	No API or wire migration is required. In bidirectional mode, the receiver must already have the parent of a pushed child, request it during a subsequent synchronization round, or reject the graph because GASP v1 submitNode does not transmit the spentBy parent outpoint. Pull-only operation avoids that assumption. Custom storage and remote adapters must preserve exact request/node binding and bounded responses. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/group-messaging`	`0.1.0`	`0.1.0`	none	API and usage	No migration is required: this is the package's first appearance in ts-stack and it has not been published to npm before. Consumers supply their own wallet, storage and transport. @bsv/sdk is a required peer dependency. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/lch`	`0.3.0`	`0.3.0`	none	API and usage	Replace buyer.quote(endpoint, request, issuer, keyGrants) with buyer.quote(verifiedSignedOffer, request, expectedSeller, keyGrants). JavaScript callers that still pass an endpoint string fail before transport I/O. Persist the returned plan and every partial settlement proof, retry with the same funded transaction, and configure a profile-aware agreementEvaluator before completion or recovery. Low-level unverified recovery results must not authorize key storage or content access. DNS endpoints require an address-pinning connector outside trusted browser environments. Distributors must retain THIRD_PARTY_NOTICES.md with the package; published BRC-170 remains authoritative if the implementation and standard differ. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. The optional overlay-acquisition and overlay-covenant entries require the coordinated SDK3.3.0 output and revenue-listing companions; existing root peer ranges remain unchanged. Ordinary BRC-170 imports and SDK2 consumers remain unchanged. Decoded acquisition context and entitlement fingerprints remain explicitly unverified. Opt-in callers must install local proof sources and protected immutable-object custody before funding. LCHOverlayPaidDomain performs the concrete fixed-render/direct-collector checks; unsupported policy terms and profiles fail before funding. Ordinary BRC-170 imports, CORE_CAPABILITIES and SDK2 peers stay unchanged. The minor candidate adds APIs and a locally qualified authenticated native paid-lookup recovery flow. The current native covenant acquisition reference examples are implemented; their selectors and complete final-source gates are recorded in the checkpoint inventory. The browser workbench separately demonstrates progressive and live lookup. Install LCHOverlayPaidSeller only with the protected coordinator, actual read-only native credit reconciliation and complete original CEKs; financial effects remain owned by the coordinator and native adapters. Opt-in covenant callers must compose the terms adapter with actual complete genesis/Script/purchase, role and release verification; terms validation alone cannot issue a License or authorize decryption. Preserve the buyer-free standing Offer and exact original signed Request on every retry. Import LCHOverlayCovenantDomain through @bsv/lch/overlay-covenant, reserve original and positive-verification custody before financial work, and install actual full lineage/purchase/release proof ports. A decoded portable package, signed settlement or entitlement fingerprint alone cannot authorize playback. Public disclosed native fixtures compose the current covenant, encrypted custody, native wallet, seller and authenticated admission/recovery; full checkpoint qualification remains required. Install LCHOverlayCovenantSeller with actual full verifiers and the protected purchase coordinator; the advertised finite request/response limits must reserve the complete future C context before preparation. Issuance requires the complete retained candidate passed by the current coordinator, independently assessed release and original private material. Catalogue withdrawal does not replace that obligation. Combined wallet-backed topical-admission and native reference demonstrations are implemented; complete final-source qualification remains required. The opt-in covenant domain accepts complete plain BEEF selected by the original explicit wallet txid, independent of proof-record order; present Atomic BEEF markers must match. All original independent material, Script, lineage and licence checks remain. Ordinary BRC-170 behavior and persisted formats are unchanged. Existing BRC170 and paid-lookup behavior is unchanged. The approved pre-adoption C profile replacement requires purchaseCommitment in its signed settlement and in installed purchase verifier results; return the full authenticated input-zero SHA256d digest with an owned synchronous checkCurrent guard. Never infer it from equal outputs or transport claims. Preserve original signed release, License, settlement and protected obligations; currentAlias is separate unverified transport evidence. Qualify the replacement family, immutable collector terms, protected child wallet and native alias custody before advertising C. No existing ordinary content or paid-lookup stored format is reinterpreted. For current C representation, select decodeLCHCollectorRevenueProfile/bindLCHCollectorRevenueProfile and supply the exact immutable schedule and expiryHeight. New preparations require independently verified active stage and installed current height below expiry; retained obligations do not repeat that new-work predicate. These helpers do not authenticate Offers, verify ancestry/currentness or migrate historical owners; the current reference composition installs those independent responsibilities explicitly. Authenticate current C with validateLCHOverlayCovenantProfileTerms and retain its original consent; validateLCHOverlayCovenantProfilePromise validates a frozen obligation, while validateLCHOverlayCovenantProfileWindow is for new work. Independently verify authorized current-family lineage, roles, active stage and installed chain height before financial work. These terms interfaces perform no wallet action and do not migrate the historical buyer/seller/native alias owners. Select decodeLCHOverlayCovenantProfilePurchaseEvidence and bindLCHOverlayCovenantProfileSettlement for the current immutable descriptor. Representation and signed commitment binding do not establish actual Bitcoin history, Script execution, roles, release satisfaction, License validity or native alias ownership; retain independent full verification and historical entitlement checks. Select LCHOverlayCovenantProfileDomain for the current immutable collector. Initialize protected custody and retain/recheck fundingPreflight immediately before financial effects. Install actual complete current lineage, original funded and released transaction proof, and release-policy ports. Existing historical domain IDs/formats/defaults remain unchanged; retained delivery and offline playback never repeat a new-funding expiry predicate. The current reference composition separately installs native alias/action custody and the current seller; neither responsibility is supplied by the buyer domain alone. Select LCHOverlayCovenantProfileSeller for current immutable seller material. Its distinct installation identity does not reinterpret historical custody. Supply complete actual reserve/activation/purchase/release verifiers; retain and recheck the preparation guard before promising material. Original historical seller interfaces/IDs/formats/defaults remain. The current reference composition separately installs coordinator commitment packets and native alias/action/admission/HTTP owners; the seller domain alone supplies none of those authorities. Omit verification.candidate to preserve the prior installation identity and absent binding capability. Installing it selects a distinct full-commitment domain before buyer creation or reopen; its verification ID must bind complete independently selected algorithms. Provide the full ProfilePurchase verifier and same-context guard, retain original protected custody, and assess current alias placement separately on the buyer's own chain. Historical new-funding cutoffs do not re-gate this read-only verification. These additive components remain under native, packed and platform qualification; no full checkpoint claim. Conforming dense integer-byte wallet results remain compatible. Custom wallet adapters must return every plaintext/ciphertext byte as an own data value; missing or accessor-backed bytes fail with ERR_LCH_KEY rather than being synthesized. The additive seller assessment companion retains pending-finality or pending-evidence before financial reservation. Installing verification.assessPurchase selects a distinct material binding. Complete original consent, roles, Script/domain and release checks remain mandatory; pending evidence cannot fulfill compensation or issue a License. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/message-box-client`	`2.7.0`	`2.7.0`	none	API and usage	No migration required for the new fields: the PeerMessage paymentOutcome and retained payment are optional, and messages without a payment are unchanged. To avoid losing payments, store any returned payment (validate it first; it is the raw envelope value) before acknowledging its message. Install @bsv/sdk 2.8.6 or later alongside this package; payments refused on earlier SDKs remain pending in the message box and can be accepted after upgrading. No BRC100 wire or wallet-data change. SDK consumers may retain ^2.8.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. The live-socket repairs require no API, wire or wallet-data migration. They are client-only and need no coordinated deployment: client and server can be deployed in either order. Two behaviour notes for consumers that worked around the previous defects: getJoinedRooms() reports the rooms joined on the current socket, and mutating that set no longer cancels a rejoin, so call leaveRoom instead; and a dropped socket is kept while Socket.IO reconnects, so code that assumed a drop cleared the socket and that the next call built a fresh one now reuses the existing one. sendLiveMessage now falls back to HTTP instead of throwing when the socket cannot be established, authenticated or joined; a conflicting WebSocket identity pin still throws. Under managerOptions.reconnection: false a drop disposes the socket and nothing rebuilds on its own, so a subscriber that makes no further calls does not recover; that remains the host's choice. A live message is now delivered a tick after it arrives rather than synchronously; that was already the case for an encrypted message, and a consumer asserting synchronous delivery in a test has to let the microtask run. Reading the server's answer to a join corrects the client's record only against a server that names the room on joinFailed, which ships alongside this release; against any other server the client records joins exactly as it did before. The package CHANGELOG lists the rest, for example leaveRoom releasing its room while disconnected. onLiveStatus is additive; nothing that compiled before needs changing. It reports the socket only: listMessages polling stays required for correctness whatever the status says, because a live message reaches only the sockets held by the server process that served the send and a paid message is never pushed. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/output-knowledge`	`0.1.0`	`0.1.0`	none	API and usage	New opt-in package requiring SDK ^3.3.0, which introduces the output-protocol APIs; SDK3.0–3.2 do not provide these APIs. Preserve wallet custody and explicit action authorization; do not infer spending from source membership changes. New journals seal configured currentness rules in local frame v3 with canonical assessment ordering. Existing v1/v2 journals retain their encoding and replay behavior when read or extended. Adopting v3 for an older journal or changing policies requires a new namespace; retain the old journal for audit and recovery. Body-only proposal journal entries retain their bytes and retry keys. Upgrade all SQLite proposal writers before relying on reserved completion capacity; capacity limits are sealed, and older pending jobs do not gain retroactive guarantees. ProposalService requires durable context/capacity storage, an authenticated transport, a current host access policy and idempotent durable topic admission. SDKProposalEvidence verifies exact BEEF/Script against an installed immutable chain view; it does not replace topic rules or establish unspentness. Legacy proposal-service/1 records remain readable; rich evidence reservations use local proposal-service/2, so upgrade readers before writing v2. Context-required admission cannot synthesize missing legacy material. Reservation verification and actual durable topic assessment remain distinct. Import workflow control storage from ./operations or ./operations/sqlite. These local CAS cells do not replace receipt journals or validate protocol transitions. Use explicit create only for new workflow identities; recover existing storage with open, and treat absence as lost state. Existing exports and journal formats remain unchanged. Import the live adapter from ./sources/live-lookup. Create its durable control cell once before network I/O, recover that exact cell after restart, and reuse the source instance across cancelled or uncertain connection attempts. Its local control format is output-live-lookup-source/1. Lost continuity requires an explicit new source generation; a local reset never manufactures a successful cursor or Bitcoin spend. Existing finite adapters and their browser entry are unchanged. Import the optional revenue-listing entry explicitly and supply the authenticated fixed program plus an installed immutable chain view. Its historical verdict does not establish asset authority, currentness, acquisition association or private fulfillment. No existing root export, wire format or journal migration. The optional revenue-listing authority port requires explicit dedicated key custody and installed consent policy; it never extracts a wallet funding root key or substitutes BRC-100 derived identities. Its signature checks do not establish full-transaction validity, lineage or fulfillment, and it introduces no existing stored-format migration. Root storage is opt-in through root-eviction types and root-eviction/sqlite. Explicit creation uses a new database file; recovery never creates missing state or changes its sealed identity, chain or capacities. All service instances and serving adapters must share the same durable gate. The journal does not install requester authority, validate advertisement BEEF/Script, implement broader bans or expiry scheduling, or mount HTTP handlers. Current authorization, evidence policy, index integration and final middleware enqueue qualification remain service responsibilities; do not advertise the full BRC-199 profile from this component alone. Import SDKRootEvictionEvidence from root-eviction/evidence with an installed immutable chain resolver and owned verification context. Its verified facts do not authorize suppression/restoration or establish currentness, and operator references are not fetched or automatically authorized. No existing wire or stored-format migration. Existing deterministic root methods and stored format remain unchanged. The optional RootEvictionCheckedStorage companion requires synchronous trusted clock/access/context callbacks that share the same physical gate or an independently coherent local port. Retain the returned observed head through signing and recheck it at final enqueue. These methods do not install network authentication, chain currentness or operator policy. RootEvictionContracts requires the original retained selector on recovery. Its record must be persisted atomically with first intake; the portable helper does not itself store that record; use the optional coordinated journal for atomic intake. RootEvictionCoordinatedStorage is an optional companion. Existing configurations retain exact root-eviction/1 behavior. New coordination configurations use root-eviction/2 and a sealed bounded original-contract byte capacity; upgrade existing files only through upgradeCoordination with the same root, chain and prior capacities. Already-open old connections fail after upgrade. Preserve backups and all history; missing legacy selections remain unavailable and cannot be invented from current discovery. HTTP, broader local bans, scheduling and all serving adapters remain separate requirements. SQLiteRootEvictionMaintenance opens an existing root journal with its exact sealed configuration; no new format or implicit creation. Install synchronous root-maintenance authorization and a trusted clock. Schedule bounded startup and periodic scan passes, restarting without a cursor at each pass end. Maintenance does not grant requester status access, process peer decisions or restore eligibility. RootEvictionRecoveryStorage preserves existing interfaces and formats. Authorize its worker guard independently of requester status access; missing original selections remain unavailable. Run maintenance expiry even when current chain/context checks prevent richer recovery. New service installations pass strictly decoded received UTF-8 text and an available manifest snapshot; third-party coordinated adapters implement its text-intake contract. Returned observations still require the native final-enqueue revision and current-access guard. Existing parsed packet calls and lookup defaults remain unchanged. RootEvictionScheduler is opt-in and defaults to manual/advisory expiry. Use maintenance and recovery ports for the same sealed journal; install automatic policy and guarded authority explicitly. Observe its lifetime and reports, stop intake and await physical drain before closing injected storage. No existing interface, stored format or default route changes. SQLiteRootEvictionLocalRules requires coordination plus explicit localRules configuration. Preserve formats1/2; upgrade format2 only with upgradeLocalRules, preserving exact prior capacities and fencing older connections. Install trusted rule evaluation and operator attribution separately, report unknown results as null and complete projection before serving. Local active rules reserve future lift records/epochs/revisions; permanent history is never silently reclaimed. The optional evidence entry adds SDKRootAdvertisementEvidence; the existing signed-request verifier and its authority checks remain compatible. Existing proposal journal bytes and methods are unchanged. Opt into responseEnqueue only with a transport guard that runs after signing and supplies exact response/record, original-contract, retention and current-access validation. All authorization writers require the same gate or explicit coherence; callbacks are synchronous and cannot reenter. Responses are bounded to 4 MiB, with smaller selected-contract limits enforced by disclosure. Track actual enqueue independently: a subsequent error cannot undo delivery or authorize a replacement response. The new ProposalResponseDisclosure companion is opt-in and runs with ProposalJournalSend after signing; current host access must share its policy domain. Retrying an older recorded publication returns its original acknowledgement without replacing the current head; no stored-format migration. Existing journal constructor behavior is preserved. Use create only for intentional installation and open for restart; missing sealed state fails rather than resetting the namespace. Observe the optional scheduler lifetime and drain stop before closing dependencies. These additions neither compact terminal fences nor initiate new finalizations. No existing schema, wire or default behavior migration. Opt in with the same sessions/contracts/current authorization and an explicit synchronous control policy. All relevant writers must share the durable guard protocol; native callbacks cannot await, close or reenter storage. Existing workers may omit nextInvalidation. Installed deadline hooks must be pure and paired with durable invalidation in advance; applications still retire previously displayed activity at its deadline. Existing expired-assessment behavior and stored/wire formats remain unchanged. Await setContext before treating a new verification context as committed; flush does not complete a pending context write. No new wire or storage migration. Use a new journal namespace when enabling proposal acceptance or changing its reader/source/policy installation. Existing default local frames and unaccepted proposal-group behavior remain unchanged; no implicit upgrade or downgrade. Install same-name source/proposal services under the existing observation contract. Authenticated proposal heads are signed variants, not a current-channel selection; provider states remain reports and do not authorize Bitcoin or application effects. A separately registered query/projection and current private authorization remain necessary. Existing stores may omit the new pure reducer deadline hook; a due hook requires durable worker invalidation before reads, including historical publication. The runtime permits one bounded recovery when expiry crosses after worker return. The SQLite journal/index refactor preserves existing constructors, namespace formats and default behavior. Internal shared transaction and savepoint domains coordinate SQL with staged journal caches; they are not public raw-SQL or authorization ports. Independently opened adapters are not atomic compound writers. Failed rollback retires uncertain connections; preserve the original operation for durable recovery. The shared primitive alone does not enable the optional compound profile. Install the query and exact source/reader policy explicitly; wrap an already connected durable BRC103 live source and project only published core input. Current intent does not establish complete history or effect authority. Legacy manual views lack required order/generation facts. Empty completed generations retire prior state. Select the separately sealed compound owner explicitly; the client components do not install it automatically. Import the Node-only factory from ./proposals/channels-sqlite. Initial create is atomic; recovery open requires all original components and sealed limits. Route every producer through its journal or bounded batch commit, and use its feed/sessions for lookup. Fresh authorization must include the mandatory policy visibility guard returned by authorizeLookup, in addition to current host access guards. A pure optional readVisibility descriptor preserves read continuity only when equal values mean identical permissions for every principal; omitted hooks conservatively compare the full signed body. No standalone format migration or automatic compaction is introduced. Retain all service-identity history and fences when capacity is exhausted. The transient signature cache retains no payloads or durable decisions; no wire or storage migration is needed. The protected ledger requires explicit exclusive creation, stable external store identity/custody and consistent whole-database/key backup. It has no remote mutation endpoint or automatic initialization/compaction; complete qualification of the publication and acquisition compositions remains required. The in-memory root signature cache changes no persisted or wire format. Preserve the authoritative private database and its separate indexing/encryption custody; opening never creates replacement state. No existing application behavior changes. The private lineage implementation extraction requires no consumer, wire or storage migration; existing revenue-listing imports and verification decisions are unchanged. Existing private storage calls and version-1 records retain their behavior. Verified staging is an explicit optional installation and uses version-2 fences with the original contract; missing legacy context requires explicit reconciliation. The optional Node private publication entry requires an explicitly created or reopened seller/chain domain, protected custody, installed domain validation and current access/chain policy. Existing ordinary imports, two-argument publication storage and version-1 fences retain their behavior. Metadata-backed unavailable status preserves original obligations and never recreates material; restoration is explicit. Drain reconciliation and physical coordinator work before closing custody. HTTP publication remains separate from private lookup acquisition and purchase release. The paid-acquisition composition preserves existing stored formats and commits funding fences with progress atomically. Original quote/material ownership, wallet recovery, release policy and guarded HTTP delivery are coordinated through the installed private/node service. The native acquisition owner adds no migration of existing stored formats. Preserve original custody and all outstanding obligations; the local batch option is explicit and the existing default/SDK wire ceiling is unchanged. Domain/release verification, wallet reconciliation and final authenticated HTTP composition remain required. Install original-obligation domain policies and a durable wallet controller explicitly; worker authority does not bypass buyer or domain permission. Drain actual work before closing custody. The wallet package remains a development-only dependency; runtime applications explicitly supply the durable controller. Existing entries remain compatible; new applications explicitly install the private/node acquisition ports and follow the acquisition/recovery guide. Protected control state is opt-in through operations/protected; preserve original wallet custody and reserve complete ciphertext capacity. Large delivered results require their own owner. Operation objects are opt-in through operations/objects and operations/objects/sqlite, with dedicated original storage and supplied custody. No existing store, export or wire migration. Reserve every promised object before financial effects; logical capacity does not replace physical quota, backup or whole-store rollback policy. Reads never recreate missing state and retained first bytes cannot be replaced. New private/buyer installations must provide preflight alongside verify and usable. This newly introduced entry changes no existing wire or custody records; preflight cannot perform financial effects. RevenueListingPurchaseVerifier is opt-in through revenue-listing; it adds no stored or wire migration. Preserve original request/terms and independently select the seller and chain context. Historical domain verification does not authorize funding, admission, release or usability; these remain separate durable workflows. Private purchase custody is opt-in through private/node and adds separate typed records without migrating existing acquisition/publication state. Install domain validation, actual retained topic admission, selected release-policy verification, protected material and current authenticated disclosure explicitly; custody primitives alone do not establish those premises. Preserve original database, keys, request fences and outstanding obligations. Refusal reasons are local diagnostics, not wire/global verdicts. Compose real covenant/domain validation and retained admission before enabling the optional purchase workflow; controlled lifecycle fixtures do not establish Bitcoin truth. Stop and drain the coordinator before closing protected custody. Existing four-argument private purchase issue adapters remain compatible; new complete-evidence issuers require the retained candidate supplied by the updated coordinator. No persisted or wire format changes. New covenant buyers explicitly create or reopen protected owners with privatePurchaseBuyerBinding, six immutable slots and a 16384-byte control envelope. Supply independent preflight/verify/usable and synchronous current permission. Install the structural native action owner and exact family/selected chain context through private/purchase-wallet; use the existing maxOutputsPerAction1/migrationInputsPerAction0 managed-change profile to fit the covenant layout. Preserve refused prepared intents for explicit wallet recovery/abort; timeout never chooses another transaction. recover performs no new funding/signing/submission; advance alone authorizes original work, and retained finalized bytes may fulfill their original recovery promise after construction cutoff. Stop/drain owners before storage shutdown. Native synthetic tests establish actual Script/genesis and lost-reply custody; complete exact-source qualification of the authenticated topic/admission/release/LCH workbench remains required. Install the cumulative evidence owner before new BRC-196 preparations using the original native domain and sealed limits. Existing obligations retain their original owner; missing proof custody is never automatically initialized during recovery. Omitted-companion behavior remains compatible. Choose native-observation-v1 only when installing new private purchase custody; retained state authenticates the original profile, and mismatched or older readers refuse opt-in records. Existing obligations require their original profile until reconciled. This local persistence choice changes no signed terms, wire packet, financial identity, deadline or payment authority. Native planning callbacks are synchronous local calculation only, with owned bounded plans, current authority rechecks and unchanged CAS/capacity guards. Plain revenue BEEF is selected by its explicit declared txid and requires that raw subject independently of record order. Any Atomic BEEF marker must match; complete bounded Script, economic and authorized-genesis checks remain required. This changes no wire or persisted format. Import RootAdvertisementServing and RootLookupServingDisclosure explicitly from ./root-eviction/serving. The original coordination entry preserves every prior export and browser budget; these newly introduced unpublished helpers have their own measured entry. Install RootAdvertisementServing only with the native root-serving-send/1 gate and a complete bounded positive inventory. RootLookupServingDisclosure preserves provider-then-root lock order; stale whole signed responses require a new identifier-free control. PrivatePublicationLookupContext requires explicit current recipient rules in the protected domain and request-local Engine hydration; it neither charges nor issues material. Existing asynchronous root enqueue, publication status and legacy public lookup remain compatible. No existing schema, receipt or wire changes are required. Owned-value copying introduces no API, wire, storage or custody migration; callers still explicitly validate schemas and current authority. The internal validation extraction changes no private purchase wire or persisted schema, authority freshness, financial effect, context clock or disclosure behavior; no caller migration is required. The proposal read ownership guard requires no caller, wire or persisted-format migration. Installed synchronous policy callbacks must not reenter journal operations; sequential reads and independently opened writers remain supported. No caller, wire or schema migration is required for bounded standalone proposal replay. Its synchronous ownership gate and existing policy, storage-integrity and authority checks remain in force. Select RevenueListingProfileLineageVerifier, RevenueListingProfilePurchaseVerifier and parseRevenueListingProfileLineagePackage for the current PR295 immutable family. Earlier non-Profile names retain the historical pre-replacement contract and are not current-family qualification. This additive component requires no existing wire/store migration; the separate current private wallet, alias custody and LCH integrations require complete exact-source qualification. Existing purchase buyers may omit fundingPreflight without migration. Current domains bind the selected companion in their validation installation ID, return an owned synchronous stable checkCurrent guard and recheck it immediately before effects through the supplied wallet callback. This companion does not implement native alias reconciliation or reinterpret stored obligations. Select the commitment owner before preparation and bind its complete verifier/guard contract in the installation identity. The historical five-argument store constructor, pin method and version-one declarations remain unchanged. The owners refuse cross-profile custody; no automatic migration or alias reconciliation is introduced. Pair SQLitePrivatePurchaseCommitmentStore with the explicit fourth full-purchase-commitment-v1 argument to PrivatePurchaseAccess; the three-argument access constructor retains exact historical state1 behavior. Profile mismatches fail before private request policy reads. No automatic custody migration or alias authority is introduced. Select PrivatePurchaseBuyer candidateProfile before calculating the storage binding, provide the independent complete candidateBinding verifier, and reserve seven protected objects including the bounded original identity. Omitted mode keeps six original reservations and exact-txid defaults. Signed alias representation remains received until independent released-subject and usable-rights verification; historical recovery retains the first protected identity and never allocates a replacement wallet action. Select WalletToolboxProfilePurchasePayment explicitly with the current RevenueListingProfile and original recoverable action owner. Preserve its separately bound format-two plans and both program hashes; never reinterpret historical format-one custody or create another financial intent after a missing reply. The current reference composition installs native listing funding, protected fixed-child remittance, alias reconciliation and authenticated HTTP as separate responsibilities. Select RevenueListingProfileAuthority from the optional revenue-listing entry for the current family. Supply an independently chosen identity, explicit originator and synchronous current authorization fence; await actual child signing preflight before genesis funding. Independently approve the complete funded plan, lineage and roles. The adapter creates no funds or transaction and cannot undo an already produced wallet signature. Historical authority APIs, defaults, wire formats and custody remain unchanged; the current native all-route and combined release composition is implemented, with complete final-source qualification required. The optional local objectReadProfile joint-custody-v1 requires a qualified readMany object-store companion; omit it to retain existing individual reads. This read strategy changes no wire packet, original binding or persisted custody format. New acquisitions may explicitly install SQLitePrivatePurchaseAliasStore and PrivatePurchaseAliasCoordinator with SQLitePrivatePurchaseAliases on the same domain/contracts and select alias-custody-v1 access. Prepay complete terminal result and selected/pending alias capacity before exposing terms. State3 and the request-fence profile are distinct; never reinterpret old rows. Native constructors are in private/node; portable SDKPrivatePurchaseAliasCurrentness and PrivatePurchaseBuyerAliasCurrentness are in private/purchase-buyer. Install PrivatePurchaseAliasDisclosure through the optional Overlay Express prepareAsync hook. Buyer currentAlias performs only free recovery and independent domain/chain assessment; it never replaces a retained License/key or wallet intent. Missing currentness cannot re-gate historical rights. Source checks are not native, whole-mutation, packed/browser, exact-head or Checkpoint2 qualification. See docs/guides/private-purchase-alias-custody.md. Native protected-payload boundary optimization requires no API, wire, persisted-format or custody migration: every call still resolves current custody, derives its key afresh and authenticates the original binding. Independent original Buffer-key framing remains readable, and newly written envelopes remain readable by the original framing. Shared native decoding retains all original bytes, hashes, validation, custody and authority checks; portable SDK decoder return types and defaults remain unchanged. No caller, wire or persisted-data migration is required. This internal native conversion preserves custody formats, accepted encoding and bounds, errors and currentness checks; no migration is required. No result, alias, ledger or clock-profile migration is required by this completion correction. Native header inventory framing requires no API, wire or persisted-format migration; the original ordered digest and all refusal boundaries are retained. Alias-coordinator method metadata changes no public declaration, installation selection, wire packet or stored custody format; no caller migration is required. The direct alias-coordinator method checks require no API, wire, stored-data or consumer migration. Every property identity and current authorization is checked afresh; no input, key or currentness verdict is cached. Fixed protected-envelope field names require no API, wire, stored-data or consumer migration; every field and current custody decision remains freshly checked. Native scalar inspection requires no public-interface, stored-data or recovery migration; no record or authorization verdict is cached. Full current-head runtime and mutation qualification remains required. The inlined string-field serializer is opt-in; native private payload/ledger aliases select it. Ordinary SDK serialization, stored bytes, errors and resource limits are unchanged; no migration or input/verdict cache is introduced. Complete current-head runtime and mutation qualification remain required. Ordinary ownership stays unchanged; the protected native ledger explicitly selects the additive companion with all representation/resource and authority checks retained, without input or verdict caching. No migration for these native import selections: wire bytes, storage, ownership, error observations, resource bounds and portable/ordinary SDK defaults remain unchanged; exact-head runtime and full mutation qualification remain required. These explicit bindings retain every public interface, stored format and original guard; no migration is required. These additional import bindings require no public API, wire, persisted-record or consumer migration. Fresh validation remains mandatory on every call; full hosted properties and mutation qualification remain required. Existing signatures and wire encodings remain unchanged. Text/byte purchase inputs retain the general parser, object inputs select fresh independent ownership, and native alias records use the general mixed-value parser. Three explicit purchase parser companions add root SDK exports, alongside one internal deep-module schema export. Ordinary purchase parsing retains its previous path; native callers explicitly opt in. No input or verdict cache is introduced; full hosted qualification remains required. Native purchase contracts explicitly select additive inline companions for capability selection and retention, packet digests and verification, and signed purchase terms. Each invocation owns and validates its complete input afresh. Historical capability restoration still checks the recorded selection time, original signature, selected endpoint, identity, chain, selector, installed rules and digest. Current caller authorization and actual operation deadlines remain separate checks. Ordinary SDK entry points, wire text and bytes, canonical encodings, resource limits, error identities and custody formats retain their existing behavior. No input, parsed packet, shape, secret, currentness or authority verdict is cached; only the existing bounded mathematical signature facts and fixed grammar are shared. This is an implementation choice with identical protocol semantics, not a new advertised protocol profile. Hosted property and full mutation qualification remain required. Current native private-state imports explicitly select the owned-record and recursive inline implementations. No wire, persistence, caller-interface, resource-limit or authority migration is required; representation ownership remains separate from schema, signature and current-operation checks. Existing ordinary and opt-in SDK entries remain available; full hosted qualification is required. No new export, caller, wire, persistence, signature, authority or resource-limit migration is required for these import bindings; each representation is independently checked and owned anew. Complete exact-head hosted runtime and mutation qualification remain required. No public interface, wire, protected-envelope or stored-record migration. The native codec selects the representation companions internally; original readers remain available and all original tests and ledger engines are preserved. Hosted runtime and complete mutation qualification remain required. Current profile validation accepts ordinary Bitcoin-final Script/domain-valid transitions. Explicit pending-candidate custody and journaled rejection recovery preserve original commitment, terms, recipient, deadlines and all prior operations/decisions. Historical installations and formats are not silently migrated. Fresh eligible recovery must consult durable topical history before any external effect. No interface, wire, storage or configuration migration is required for clock-initialization failure recovery; retry the same worker and store after repairing the installed clock. No migration is required for wallet source clock-failure recovery. Retry the same source after repairing the clock; non-cancellable wallet I/O retains its existing capacity until it settles. With SDK4, call module balance queries separately from WalletOutputSource; decimal balance aggregates are not output-discovery pages. Wallet output enumeration requires an inventory query; read balance summaries separately. No automatic fallback or wallet-data migration. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/overlay`	`2.7.0`	`2.7.0`	none	API and usage	No wire, API, or database migration. Deploy the reviewed patch through the protected release workflow; retain existing validation and configured resource bounds. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. For UMP lineage, deploy this engine patch together with overlay-topics 2.0.1 or an equivalent custom UMP history decider. Existing selector decisions and resource bounds remain unchanged. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. Overlay names: names accepted before are still accepted; no migration is required. No wire, API, or database migration. Deploy the reviewed patch through the protected release workflow; retain existing validation and configured resource bounds. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. For UMP lineage, deploy this engine patch together with overlay-topics 2.0.1 or an equivalent custom UMP history decider. Existing selector decisions and resource bounds remain unchanged. None for existing consumers. To retain provenance for new commits, explicitly construct MongoOverlayStorage or MongoAdmissionStorage with retainAdmissionHistory: true. Existing receipts are not rewritten or retroactively certified; history remains unresolved when binding material is absent. Readers must authorize and project private multi-topic results. Disable the option to return to legacy writes; saved metadata remains compatible with legacy receipt readers. No database schema migration or deployment is performed. The new proposal-admission entry requires the SDK3.3.0 candidate or a compatible later3.x release, explicit retained-history storage and an installed immutable service/topic/rules binding. Existing root exports and SDK peer floors remain unchanged. Use it only behind ProposalService durable reservation, exact policy/transaction verification and authenticated access; missing history stays unresolved, and old receipts are not synthesized. Drain recovery calls before replacing Engine/storage/topic configuration. The new private-publication-admission entry requires SDK3, retained-history storage, an explicit public-history reuse policy and independent publisher/schema/Bitcoin validation plus durable reservation. It does not enable private HTTP, lookup readiness or paid delivery. Existing public submission and proposal behavior remain unchanged; no stored receipt is rewritten. Ordinary receipt and storage formats remain unchanged. Retained Mongo history reads the immutable committed operation timestamp. Legacy history providers may omit it; profiles requiring original time remain unavailable until that provenance exists, with no automatic reconstruction. Install the purchase-admission entry explicitly with topic rules, domain profile and admitted successor index. It requires independent domain validation and a reserved private intent; legacy receipt histories without original commit time cannot establish this stronger premise. Opt into retainedBEEF with a complete positive byte budget at most4MiB when original public ancestry is required. Older records without manifests preserve older reads; missing or damaged promised manifests fail closed. GASP historicalOutputs requires an explicit installed history port and supplies no current-membership or unspentness claim. Every root-serving source writer must invalidate affected eligibility before effects and reassess/reconcile afterwards; no stored/wire migration is automatic. OverlayPurchaseAdmission.assessRecovery is a read-only bridge to exact retained topical acceptance. It uses a guarded local full commitment, never submits or accounts a sale, and cannot treat mining alone as admission. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. Existing Engine construction, STEAK shapes, wire formats, and storage behavior are unchanged; set engine.onTopicFailed only where per-topic failure observability is wanted. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/overlay-discovery-services`	`2.2.9`	`2.2.9`	none	API and usage	No wire, API, or database migration. Deploy the reviewed patch through the protected release workflow; retain existing validation and configured resource bounds. SDK consumers may retain ^2.4.0 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. Overlay names: names accepted before are still accepted; no migration is required. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/overlay-express`	`2.8.0`	`2.8.0`	none	API and usage	No wire, API, or database migration. Deploy the reviewed patch through the protected release workflow; retain existing validation and configured resource bounds. SDK consumers may retain ^2.4.0 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. No migration is required for registerRouter; it is additive and existing servers are unchanged. Call it before start(). No migration for existing routes. New lookup support requires SDK 3.3.0, a durable provider companion, a signed matching capability manifest, current authorization and explicitly configured browser origins. Import the standalone adapter from @bsv/overlay-express/output-lookup, or call configureOutputLookup before start. The legacy root loads the adapter lazily. One service binds each concrete base path; do not advertise unsupported profiles. Storage lifecycle and TLS, proxy deadlines and physical authentication capacity remain host responsibilities. Package publication and deployment remain separate authorized actions. The optional root-eviction-response entry requires middleware 2.3.0 and SDK 3.3.0. Capture the shared root revision before reading the complete response, list every disclosed advertisement and install current synchronous data/control access checks. All decision/access writers must share the durable gate. The transport companion resets stale candidates in full; it does not infer targets, mount root routes or retrofit existing lookup/cache/live/GASP paths. No existing route or stored-format migration. The new root-eviction entry is explicitly mounted before generic parsers, compression and caches, with the same origin authentication instance and durable journal as its shared RootEvictionService. Omitted origins preserve credential-free wildcard CORS; explicit arrays opt into exact origins. Native configureRootEviction before start verifies the server wallet identity, inherits host origin policy unless explicitly overridden and clamps bytes to host bounds. The application retains journal/worker lifecycle ownership. Capability publication, scheduler and all serving/admission/GASP fences are separate host obligations. No default route or behavior changes. The new proposals entry requires SDK 3.3.0 and auth middleware 2.3. Supply the same durable journal to the service and response gate and a current synchronous disclosure policy; mount before parsers and transformations. configureProposals shares host authentication, origin policy and edge bounds. Capability publication and storage/expiry/admission workers remain caller-owned; no default route changes. SDK consumers may retain ^2.4.0 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Lookup send-time protection is opt-in through disclosure on the standalone router or configureOutputLookup, requiring BRC103 and middleware2.3. Existing routes and omitted-option behavior remain unchanged. Import private-publication explicitly with SDK3.3.0 and auth middleware2.3; mount before generic parsers or transformations using the same origin authentication instance. Supply the coordinated durable service and disclosure owner; the router does not create a database, start a reconciler, advertise capabilities or install payment handlers. Credential-free CORS remains the default, with explicit origins optional. Existing root imports and routes remain unchanged. No legacy startup change. Configure private services before start with the matching authentication wallet and installed native disclosure owner. Acquisition-configured hosts select a 128-KiB header ceiling; align reverse-proxy limits. The application owns private custody and worker shutdown. Use configurePrivatePurchase or the private-purchase router before body parsers, and supply a durable coordinator/disclosure owner. The application drains its outstanding work before closing protected custody. Basic transport refusal precedes authentication and private work. Omitted prepareAsync keeps existing disclosure behavior. The explicit alias adapter prepares optional evidence before HTTP signing and uses prepareGuarded against the same native disclosure view; it cannot perform a nested ledger read or change signed response bytes at enqueue. Revalidate alias guards at actual physical disclosure. Changed or unavailable reports may be omitted on a fresh request while preserving historical grant recovery. Existing authentication, mutual-auth identity, BRC105 behavior and legacy routes remain unchanged. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/overlay-topics`	`2.0.3`	`2.0.3`	none	API and usage	Topics2 is a breaking retirement candidate. Remove DIDTopicManager/createDIDLookupService/DIDRecord/DIDQuery and tm_did/ls_did usage. Resolve immutable identity-key DIDs offline; explicitly configured tm_identity/ls_identity supplies certificate discovery, not DID-document mutation or automatic trust. Preserve existing database/history and plan service rollout without automatic replacement installation. See docs/guides/identity-did-vc-migration.md. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Mandala is a clean break with no data migration: the old MandalaToken/MandalaAdmin wire format is no longer admitted and 1.x Mandala rows are not read or converted, so start Mandala on a new database with new deploys (existing on-chain outputs are not spent or deleted). MandalaTopicManager drops adminWallet, adminProtocolID and stateStore.isAdminOutpoint and requires trustedIssuers (non-empty compressed lowercase public keys) and engineOutputs, with optional membership, membershipExempt and onOwnerRepair; pass the same MandalaStorageManager (a MandalaStateStore) to admission and lookup. Refusals are MandalaReject { code, reason } from the Reasons catalog; do not match on old error text. MandalaLinkagePayload is replaced by MandalaEnvelope with encodeEnvelope/decodeEnvelope; the register action is replaced by a deploy at output 0 with a deploySig. foldAction, defaultAssetState, AssetAdminState, FoldContext and MandalaTokenRecord use tokenId (_0) instead of assetId, drop issuerIdentityKey and add feeRatePerKb. Persisted schema (section 6.6): new mandalaOwners and mandalaAuthorities collections; mandalaTokens, mandalaMetadata, mandalaAssetStates and mandalaAdminHistory are keyed by tokenId, metadata holds the decoded deploy payload, and history rows store kind, detailsHex, commitment and delta (plus optional frozenAmount/frozenOwner on freezes). De-trusting an issuer key revokes the authority coins it holds; rotate keys by moving authority coins first. Operators register tm_mandala_registry/ls_mandala_registry explicitly. The infra/overlay-server wiring follows after publication (P1b). The prior 2.0.0 contracts above are the published baseline. This 2.0.1 UMP patch has no API, wire or schema migration; deploy with overlay 2.6.4 to retain history past confirmation. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/paymail`	`2.4.12`	`2.5.0`	minor	API and usage	None. All additions are new exports; existing capabilities, routes, client methods, defaults and discovery documents are unchanged except that a host configured with only the new BRC-235 routes and no requestSenderValidation omits the sender-validation flag. Previous release: None. ESM consumers are unaffected. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/payment-express-middleware`	`2.1.11`	`2.1.11`	none	API and usage	No BRC100 call, wire or wallet-data migration. maxPaymentHeaderBytes is now ignored, including existing explicit values: move transport policy to the HTTP server, CDN, proxy or WAF and remove the deprecated option. Validate the complete HTTP route for supported payment proofs. Published 2.1.8 is verified against protected release 36052862859 and its immutable source artifacts. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/sdk`	`4.0.1`	`4.0.1`	none	API and usage	For pre-construction conflict recovery, upgrade the desktop wallet Toolbox parser and the application SDK together, and use the existing structured JSON API before starting financial operations. Binary wire framing remains unchanged and cannot carry review evidence; never retry an ambiguous binary failure. No schema or BRC-100 call migration. SDK3 is a separate breaking retirement candidate: remove identity/DIDTokenValidation imports and use @bsv/did BRC202 identity-key resolution plus optional @bsv/did/brc52 original-signature envelopes. Retain historical data and recover authenticated identity bindings; do not relabel serial DIDs. Existing acquisition-result validation fixes remain. First-party SDK3 peer alternatives require complete packed qualification and owner coordination; preserved SDK2 ranges are not silently narrowed. See docs/guides/identity-did-vc-migration.md. The additive authorization callback requires independently verified local policy; wallet-returned labels or fields are not authority. The completeBoundAction.outputAuthorizationVersion function property allows compatible consumers to detect support without importing a missing named export from older ESM peers. No BRC100 wire or persistence migration is introduced by this addition. Identity search recovery is opt-in: useContacts true with contactErrorMode fallback bounds contact enrichment at 2000ms by default, or an explicit integer deadline from1 to60000ms. Use onContactError for partial-result warnings and handle public lookup errors separately from empty results. Legacy booleans and defaults remain compatible. A contact deadline does not cancel wallet requests or permission prompts. Applications must update their bundled SDK and search component; this source candidate does not update deployed apps. The splice-operand change is a consensus alignment with SV Node v1.2.3 and needs no API change; spends whose OP_SUBSTR, OP_LEFT or OP_RIGHT operands are longer than nine bytes, or whose ninth byte carries magnitude bits, were accepted by node v1.2.2 and are now rejected by both the node and the SDK. SDK4.0.1: totalOutputs remains a number for existing arithmetic and comparisons. Existing numeric clients and default binary connections retain the deployed contract. Only explicitly selected spendability extensions require support at both ends. First-party packages add an SDK4 peer alternative and keep their SDK2 and SDK3 ranges. Overlay names: every name accepted before is still accepted; no migration is required. Certificate compatibility: upgrade app and wallet binary adapters for legacy types. Listing/proof keep existing storage RPCs; legacy relinquishment requires the storage runtime to use the updated SDK reference validator. Ordinary encodings and app API shapes are unchanged. See specs/wallet/legacy-certificate-wire.md. No API, wire, or wallet-data migration. Callers that treated a thrown ERR_INVALID_HMAC from verifyNonce as the invalid-nonce result must use the returned false. Callers that already branch on the boolean, including Peer, keep their behavior. A true result still does not prove freshness or single use. This source candidate is not publication. MerklePath: None for a proof a node or this SDK can produce, including fromCoinbaseTxidAndHeight. A one-level BUMP whose only leaf is not at offset 0 was previously accepted and now throws Missing hash for index at height 0 at parse and root computation. combine() no longer keeps a merged path whose root differs from the paths it merged. No API, wire, or wallet-data migration. For pre-construction conflict recovery, upgrade the desktop wallet Toolbox parser and the application SDK together, and use the existing structured JSON API before starting financial operations. Binary wire framing remains unchanged and cannot carry review evidence; never retry an ambiguous binary failure. No schema or BRC-100 call migration. SDK3 is a separate breaking retirement candidate: remove identity/DIDTokenValidation imports and use @bsv/did BRC202 identity-key resolution plus optional @bsv/did/brc52 original-signature envelopes. Retain historical data and recover authenticated identity bindings; do not relabel serial DIDs. Existing acquisition-result validation fixes remain. First-party SDK3 peer alternatives require complete packed qualification and owner coordination; preserved SDK2 ranges are not silently narrowed. See docs/guides/identity-did-vc-migration.md. The additive authorization callback requires independently verified local policy; wallet-returned labels or fields are not authority. The completeBoundAction.outputAuthorizationVersion function property allows compatible consumers to detect support without importing a missing named export from older ESM peers. No BRC100 wire or persistence migration is introduced by this addition. Identity search recovery is opt-in: useContacts true with contactErrorMode fallback bounds contact enrichment at 2000ms by default, or an explicit integer deadline from1 to60000ms. Use onContactError for partial-result warnings and handle public lookup errors separately from empty results. Legacy booleans and defaults remain compatible. A contact deadline does not cancel wallet requests or permission prompts. Applications must update their bundled SDK and search component; this source candidate does not update deployed apps. The splice-operand change is a consensus alignment with SV Node v1.2.3 and needs no API change; spends whose OP_SUBSTR, OP_LEFT or OP_RIGHT operands are longer than nine bytes, or whose ninth byte carries magnitude bits, were accepted by node v1.2.2 and are now rejected by both the node and the SDK. SDK4.0.1: totalOutputs remains a number for existing arithmetic and comparisons. Existing binary applications and wallets can upgrade independently; no ordinary listOutputs wire migration is required. Only callers that explicitly select WalletWireTransceiver listOutputsEncoding spendable need an extension-aware processor; JSON also carries non-spendable module inventory. Default WalletClient connections retain the historical format. No automatic retry or ambiguous response-format detection is used. First-party packages add an SDK4 peer alternative and keep their SDK2 and SDK3 ranges. SDK3 is a separate breaking retirement candidate: remove identity/DIDTokenValidation imports and use @bsv/did BRC202 identity-key resolution plus optional @bsv/did/brc52 original-signature envelopes. Retain historical data and recover authenticated identity bindings; do not relabel serial DIDs. Existing acquisition-result validation fixes remain. First-party SDK3 peer alternatives require complete packed qualification and owner coordination; preserved SDK2 ranges are not silently narrowed. See docs/guides/identity-did-vc-migration.md. The opt-in output APIs preserve existing overlay endpoints and lookup defaults. Select the new versioned profiles explicitly; the accompanying output-knowledge runtime provides durable application state above the SDK. Retained capability records are local replay material: persist them atomically with operations and independently enforce current authorization and operation deadlines. Use allowPayments: false for unpaid authenticated requests. Select requireMutualAuth to disable ordinary HTTP fallback, or expectedIdentityKey to additionally pin the canonical provider key before application dispatch; verify capability/profile bindings separately. Use HTTPS for confidentiality. Omitted controls preserve existing behavior. OutputLookupTransport is opt-in: persist the original opening before dispatch, and atomically commit each batch with its cursor before reading further. Full durable service/runtime integration is separate; no default legacy behavior changes. Import @bsv/sdk/script/templates/RevenueListing explicitly and supply the pinned program bytes; recognition does not establish lineage, currentness, valid spending or fulfillment. The new revenue codec does not alter existing root imports. Opt into RevenueListingPlan/RevenueListingSpend only after domain lineage checks. Supply complete funding predecessors, preserve the planned BRC-100 two-phase layout, obtain raw ALL\|FORKID signatures from explicit authorities, and verify the finalized transaction separately; the module never funds, signs or broadcasts by itself. Release-evidence helpers are opt-in: supply independently retained chain, transaction and release policy. Processor verification proves that selected processor signed the exact acceptance statement, not mining or delivery. Mined release still requires authenticated inclusion, selected-chain ancestry and a same-context commit check. No existing wire or stored-data migration. Purchase codecs preserve legacy STEAK and never fund or admit. Authenticate terms against the separately retained request and selected seller, persist them before construction, and supply the exact constructed transaction ID when checking reserved responses. Durable admission, domain/release eligibility and recipient usability remain separate checks. BRC-195 quote/status codecs require authenticated transport and an independently retained selected contract. They do not implement protected storage, wallet internalizeOnce, transaction/release eligibility or secret usability; legacy BRC-105 and lookup context are unchanged. Payment funding inspection requires an independently derived seller payment key, selected chain and retained quote; it does not establish Bitcoin acceptance, reserve an acquisition or internalize wallet value. Enforce total HTTP header limits and use a separate durable idempotent wallet adapter before acknowledging credit. Root-eviction helpers are opt-in and require independently authenticated context, the original signed request and retained evaluation policy. Check clocks only when accepting new requests; retained outcomes remain recoverable under current access policy. Evidence verification, local authority, durable tombstones and every serving/replay guard remain service obligations. Existing SHIP/SLAP, lookup and GASP behavior is unchanged. No migration for existing lookup consumers. Persist original root operation/selection/policy together before constructing OutputRootEvictionTransport; supply trusted root/base/chain/rules and a wallet. The client retries that operation or reads its original status without discovery, persistence, automatic polling or payment. Current access and all serving/evidence decisions remain separate server obligations. Persist the exact proposal request and fresh selected contract before constructing OutputProposalTransport. Each send retries only that saved request. Finalize returns response plus matchesRequest: a different existing reservation is not fulfillment of the requested transaction. Local transport errors remain distinct from authenticated OutputProposalServiceError; domain/evidence verification, current authority, persistence and new-operation freshness remain explicit caller and provider obligations. Existing AuthFetch defaults stay unchanged. Select the new transport explicitly and retain original contracts and payment bytes in a durable owner; see the paid lookup client guide. Existing verification and freshness/authority APIs are unchanged; callers still perform every role, expiry, policy and current-context check. The bounded caches have no persistent data or migration. OutputPurchaseTransport is explicitly selected and requires retained original capability/request/terms and a recipient authentication wallet. Compose durable custody and explicit new-work authorization separately; finite transport never constructs, pays, signs, broadcasts or validates Script/usable private material. The additive ownOutputJSON utility accepts JavaScript values, including strings as values; use parseOutputJSON for incoming JSON text or UTF-8 bytes. Schema, current authorization, wire and storage contracts remain unchanged. The response-waiter lifecycle correction changes no wire format, public API, deadline, automatic payment or session-recovery defaults. Updated opt-in BRC-197 purchases require purchaseCommitment in every reserved result and POTATOES. Pass the independently verified full preimage digest to verifyOutputPurchaseEnvelope as its optional fourth argument; this never relaxes historical txid checks. Independently verify currentAlias BEEF and chain placement before assessing currentness. Other domains and ordinary SDK behavior remain compatible. Public child derivation alone cannot authorize signing, activation or wallet remittance; see docs/guides/revenue-listing-commitments.md. The additive authorization callback requires independently verified local policy; wallet-returned labels or fields are not authority. The completeBoundAction.outputAuthorizationVersion function property allows compatible consumers to detect support without importing a missing named export from older ESM peers. No BRC100 wire or persistence migration is introduced by this addition. New exemplar constructors must use explicit activation or active stages, an immutable initialRevenue schedule without revision, and mandatory expiryHeight. The separately added RevenueListingProfile entry does not reinterpret older descriptors or persisted records, authorize activation or qualify the retained legacy planner; see docs/guides/revenue-listing-profile.md. For the current exemplar, select the ProfilePlan/ProfileSpend entries explicitly, retain mandatory height expiry and immutable schedules, provide complete funding predecessors and at most one final P2PKH change output, and sign only the fixed seller child through the exact protected BRC100 protocol. Planning and construction do not establish signed activation ancestry, Bitcoin/chain acceptance or private release. The earlier single-program/six-route helpers remain historical compatibility interfaces, not the current specification. Current exemplar installations use the separate two-stage Profile interfaces described in docs/guides/revenue-listing-profile.md. Existing verifyOutputPurchaseEnvelope and omitted transport options retain exact-txid behavior. Select commitmentBinding explicitly for submit/recover with matching original signed domain and retained complete original funded candidate. Preparation cannot select it; no request body or HTTP payment changes. Independently verify both complete transactions and their same full commitment before accepting rights; SDK transport binding does not establish Script, alias, chain or secret usability, or migrate native buyer/wallet custody. The additive OutputPurchaseTermsVerifier is optional. Its verify method repeats all response checks and retains no response or verification verdict. The existing verifyOutputPurchaseTerms signature and checks remain unchanged; current domain, authorization and fulfillment checks remain separate. The internal typed digest/verification-key and ASCII serialization paths change no public preimage representation, signature, wire, persisted data, validation rule or output digest; no migration is required. Verification still validates the complete packet and signer before the existing bounded successful-mathematics cache; it never caches authorization or currentness. Encoding inspection is additive. Ordinary parsing, canonical bytes, errors and defaults are unchanged; validate endpoint schemas and current authority separately. Identity search recovery is opt-in: useContacts true with contactErrorMode fallback bounds contact enrichment at 2000ms by default, or an explicit integer deadline from1 to60000ms. Use onContactError for partial-result warnings and handle public lookup errors separately from empty results. Legacy booleans and defaults remain compatible. A contact deadline does not cancel wallet requests or permission prompts. Applications must update their bundled SDK and search component; this source candidate does not update deployed apps. This private framing and ownership refactor requires no public API, wire, storage or consumer migration; full current-source qualification remains required. Existing closedOutputObject calls remain dynamic; createClosedOutputObjectValidator deliberately captures field names at construction. No wire or data migration. The splice-operand change is a consensus alignment with SV Node v1.2.3 and needs no API change; spends whose OP_SUBSTR, OP_LEFT or OP_RIGHT operands are longer than nine bytes, or whose ninth byte carries magnitude bits, were accepted by node v1.2.2 and are now rejected by both the node and the SDK. The private traversal and fixed primitive-name comparator require no API, wire, persisted-data or consumer migration. Every caller graph and returned response is still validated afresh; no input or authority verdict is cached. The representation allocation changes require no API, consumer, wire or persisted-data migration. Every input is checked afresh with the same acceptance, decoded bytes, errors and limits; no value or authority verdict is cached. Canonical primitive validation explicitly rejects trailing line terminators before decoder normalization. Valid canonical Base64 bytes, allocation bounds, padding-bit rules and public signatures remain unchanged; noncanonical terminator-bearing input is rejected. Fixed decoder configuration and fresh ASCII evidence require no API, wire, stored-data or consumer migration; no input or validation verdict is retained. The scalar-record inspector is opt-in; existing consumers, wire bytes and stored data require no migration. Other shapes/refusals preserve the original inspector and one observation of caller limits/byteLength. Endpoint schemas, authentication, custody and current authority remain separate. The inlined string-field serializer is opt-in; native private payload/ledger aliases select it. Ordinary SDK serialization, stored bytes, errors and resource limits are unchanged; no migration or input/verdict cache is introduced. Complete current-head runtime and mutation qualification remain required. Ordinary ownership stays unchanged; the protected native ledger explicitly selects the additive companion with all representation/resource and authority checks retained, without input or verdict caching. Existing signatures and wire encodings remain unchanged. Text/byte purchase inputs retain the general parser, object inputs select fresh independent ownership, and native alias records use the general mixed-value parser. Three explicit purchase parser companions add root SDK exports, alongside one internal deep-module schema export. Ordinary purchase parsing retains its previous path; native callers explicitly opt in. No input or verdict cache is introduced; full hosted qualification remains required. Native purchase contracts explicitly select additive inline companions for capability selection and retention, packet digests and verification, and signed purchase terms. Each invocation owns and validates its complete input afresh. Historical capability restoration still checks the recorded selection time, original signature, selected endpoint, identity, chain, selector, installed rules and digest. Current caller authorization and actual operation deadlines remain separate checks. Ordinary SDK entry points, wire text and bytes, canonical encodings, resource limits, error identities and custody formats retain their existing behavior. No input, parsed packet, shape, secret, currentness or authority verdict is cached; only the existing bounded mathematical signature facts and fixed grammar are shared. This is an implementation choice with identical protocol semantics, not a new advertised protocol profile. Hosted property and full mutation qualification remain required. Current native private-state imports explicitly select the owned-record and recursive inline implementations. No wire, persistence, caller-interface, resource-limit or authority migration is required; representation ownership remains separate from schema, signature and current-operation checks. Existing ordinary and opt-in SDK entries remain available; full hosted qualification is required. Existing canonical serializers and portable browser/wallet selections are unchanged. Native imports opt in to direct-record text emission with identical wire bytes, persisted formats, resource limits and refusal behavior. Each invocation validates afresh; no graph, encoding, shape, secret or authority verdict is cached. Hosted runtime and full mutation qualification remain required. The internal deep-module owned-record grammar factory retains callbacks only, never supplied input or any verdict. Existing defaults, standalone parsers, root exports, wire and stored formats remain unchanged; hosted complete qualification is required and no speedup is established by static checks. validateOutputByteEncoding is an additive SDK export for fresh canonical standard Base64 validation without decoded-array allocation. The private fixed owned-record grammar selects it only after complete fresh parent ownership. Existing decoder and ordinary schema callbacks, defaults, refusal order, wire bytes and persisted data remain unchanged; no consumer migration or input/verdict cache is introduced. Representation validation is separate from schema, signature, custody and current authority. External authentication arrays are descriptor-checked and copied once per operation; subsequent byte shape checks operate only on that completed private snapshot. No SDK3.3.0 public, wire, storage, budget or default migration is required. Original composed qualification remains required. Network wrapper message, name and stack behavior remain compatible; the optional cause preserves the original thrown value and does not authorize replay or payment. For pre-construction conflict recovery, upgrade the desktop wallet Toolbox parser and the application SDK together, and use the existing structured JSON API before starting financial operations. Binary wire framing remains unchanged and cannot carry review evidence; never retry an ambiguous binary failure. No schema or BRC-100 call migration. The additive preparePreservingHeader construction companion retains exact alternative headers without asserting finality or Script/domain validity. Recommended defaults and existing callers remain unchanged. SDK4.0.1 hotfix: existing numeric arithmetic compiles again. Established SDK2/3 clients retain numeric counts and balances and the deployed binary layout without an upgrade. The explicitly selected and acknowledged listOutputsEncoding spendable extension from #674 remains available. No separate profile for the defective 4.0.0 layout is introduced. Enumerate outputs for exact accounting and value movement; numeric summaries above 2^53 may round. Existing legacy validator bounds remain unchanged. No automatic retry or encoding detection. Existing HMAC tags and persisted HMAC-derived identifiers remain unchanged; no HMAC encoding mode, alternate verification or data migration is introduced. No migration is required for timeout configuration. Existing calls retain their defaults. To extend SLAP discovery, configure trackerTimeoutMs and a sufficient whole-query deadlineMs; to extend authenticated calls, configure responseTimeoutMs alongside transport requestTimeoutMs in the existing fifth constructor argument. Other certificate, session and operation deadlines remain independent. Reconcile an ambiguous financial request before resubmission.
`@bsv/simple`	`0.7.2`	`0.7.2`	none	API and usage	Simple0.7 is a breaking pre-1.0 candidate. Remove mutable DID/resolver/provider configuration, proxy handlers and DIDError/types; use DID.fromIdentityKey/resolve and wallet.getDID. CredentialIssuer.issue returns {credential,keyringForSubject}; verify accepts exact JSON or UTF8 bytes and returns structured cryptographic results. The HTTP verify route now requires {credential: originalEnvelopeJson} with original text as a string; parsed objects return HTTP400. Web request decoding rejects duplicate members and invalid UTF8, and custom parsed-body adapters must establish equivalent strict decoding. Preserve received text and inspect verification.verified, not HTTP success. Local revocation record status is retained/unknown, not inferred chain revocation. See docs/guides/identity-did-vc-migration.md. Replace createServerWalletHandler() deployments with createServerWalletHandler({ authorize: async ({ action, headers }) => authenticatedSessionCanUseAction(headers, action) }). The callback must return literal true for each status, create, request, receive, balance, outputs, or reset action; omission now returns HTTP 403 for every action. Roll out the authentication layer and callback with the package, update anonymous probes or automation, and apply the same policy to every replica. Do not emulate the old public behavior with an unconditional authorize: () => true callback. Valid recipient derivations and authenticated Message Box peers remain supported; malformed, wrong-owner, or transaction-mutated flows now fail closed. New CredentialSchema and Certifier records use canonical 32-byte types. Current SDK wallet methods reject historical short types, so do not put migration aliases in wallet list, acquire, prove, or relinquish calls. Export affected records through the storage version that created them, authenticate them offline against the exact locally configured identifier, and reissue/import canonical replacements; no legacy certificate is rewritten automatically. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/. Persisted local field ordering requires no migration; transport adapters preserve original certificate signing bytes. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/templates`	`2.1.1`	`2.2.0`	minor	API and usage	Breaking. Removed exports: MandalaToken, MandalaTokenDecoded, MandalaAdmin, ADMIN_PROTOCOL, MandalaAdminDecoded, MandalaActionDetails, MandalaActionKind, MandalaAdminLockParams, MandalaAdminUnlockParams and AssetMetadata. Removed subpath @bsv/templates/mandala-signing.ts. The @bsv/templates/mandala-encoding.ts subpath keeps only createMinimallyEncodedScriptChunk, decodeScriptNum and decodeScriptNumChunk; encodeScriptNum, encodeAssetId and decodeAssetId are removed. Replace MandalaToken/MandalaAdmin with Bsv21Binary: deploy, authority and value outputs are lock(tokenId \| null, amount, pubKeyHash, payload?) with bigint amounts and _0 token ids (tokenIdFromString/tokenIdToString), decoded with Bsv21Binary.decode. Mandala admin actions are committed by sha256 of strict-CBOR details in the authority output payload, not by a commitment-derived key. This is a clean break with no data migration: tokens and admin chains in the old format are not readable by 2.0.0. @bsv/overlay-topics 2.0.0 consumes this format; the infra/overlay-server wiring follows after publication. SDK consumers may retain ^2.1.6 or install the SDK3 candidate; SDK3 removes the obsolete DID token API (see docs/guides/identity-did-vc-migration.md). Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. The Bsv21Binary names are unchanged; new code may import OneColor. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. 2.2.0 is additive and keeps 2.1.1's SDK peer range; no migration is required. tokenIdFromString and tokenIdToString remain 32-byte only; new 1Color code should use oneColorTokenIdFromString and oneColorTokenIdToString.
`@bsv/teranode-listener`	`1.1.9`	`1.1.9`	none	API and usage	No API migration is required for valid consumers: raw callbacks remain the default and decoding is opt-in with decodeMessages: true. Configuration arrays and callbacks are snapshotted at construction, boolean controls must be literal booleans, and malformed or duplicate topics, addresses, keys, and unsupported properties now fail closed. usePrivateDHT: false now actually omits the DHT service. The published mainnet PNET value is transport compatibility data, not a publisher credential; decoded sender and payload fields remain untrusted and security-critical claims require independent validation. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/verifast`	`0.3.9`	`0.3.9`	none	API and usage	Valid typed verification calls and worker protocols remain compatible. Custom module factories and WASM adapters must return the exact documented binary and boolean shapes; coercive network, height, flag, byte, batch, verdict, lifecycle, or disposed-instance values now fail closed. Keep THIRD_PARTY_NOTICES.md and LICENSES/ with every JavaScript and WebAssembly distribution. SDK consumers may retain ^2.1.8 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/wallet-helper`	`0.1.11`	`0.1.11`	none	API and usage	getAddress now derives with forSelf: true and returns the caller-owned side of the bilateral relationship. Applications that stored or coordinated the previous peer-owned result must regenerate and exchange the corrected address before sending value. Amount must be an integer from 1 through 1,000 and counterparties must be valid public keys. Valid canonical transaction-builder flows remain supported; malformed, ambiguous, or wallet-mutated results now fail closed. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/wallet-relay`	`0.7.0`	`0.7.0`	none	API and usage	No API migration is required for allowLocalNetworkHttp: the default transport policy is unchanged, except that all of 127.0.0.0/8 and, on the mobile pairing boundary, *.localhost now count as loopback. To pair a phone with a development backend on a LAN IP address, set allowLocalNetworkHttp: true on WalletRelayService, on WalletRelayClient or useWalletRelayClient, and in the wallet's parsePairingUri and WalletPairingSession calls, for example behind a developer setting; a wallet without it rejects such QR codes. Never enable it in production: an on-path attacker can rewrite the plaintext session lookup and relay URL of an HTTP origin. The WalletPairingSession and WalletRelayClient transport errors are reworded to 'Pairing origin must be HTTPS, except for loopback development' and 'Relay API URL requires HTTPS, except for loopback development.', and a server or desktop private-network rejection names allowLocalNetworkHttp; callers that matched the previous text must update the match. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`@bsv/wallet-toolbox`	`2.15.1`	`2.15.1`	none	API and usage	None. Arcade API keys are configured as before, through createDefaultWalletServicesOptions arcadeApiKey or arcadeConfig.apiKey. No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. For ordinary callers, no public API, wire, database, or consumer migration is required. Recovery adoption requires SDK 3.3.0, explicit auxiliary schema installation in the active local SQLite wallet, stable operation IDs and a committed workspace. Reopen retained state after restart; never silently reinstall a missing journal. These journals are outside legacy entity snapshots, BRC-38/39 export, ordinary sync, IndexedDB and remote providers. Back up the whole consistent wallet database plus keys and test restoration. For rollback, stop new adoption and reconcile outstanding operations with the original controller before removing it; preserve journals and keys. Local receipts do not establish quote-time capacity, settlement, domain authority or protected delivery. The private encoder extraction requires no caller or stored-format migration; complete canonical mutation qualification covers every helper. Existing callers can omit checkNewSigning. The optional callback returns void synchronously or throws, and cannot undo or timestamp already-started storage effects; reconcile the original operation after uncertainty. This internal ownership refactor changes no accepted bytes, public action API, stored schema, errors or caller defaults; no additional migration is required and context is never retained between calls. BRC-197 integrations must explicitly select getBrc197InternalizationCapabilities and internalizeBrc197Action with the literal fixed remittance fields; do not Base64-encode them or route them through ordinary internalizeAction. Validate every recipient and the complete protected activation/signing, lineage, chain, fee and resource prerequisites before funding a listing. See docs/guides/brc197-fixed-child-wallet.md for the local-only boundary and outstanding qualification gates. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply. No API, wire or schema migration is required for the IndexedDB filter fix. Empty optional arrays now behave like omitted filters. Applications still receive only records allowed by their user and partial predicates; nonempty arrays retain their restrictions. No public API, wire or database migration is required for internalization broadcast. Upgrade the active storage implementation. Recipients receive a review-actions error when broadcast is rejected and must inspect that result before retrying; no recipient outputs are stored on rejection. Existing proven transactions retain their no-rebroadcast path. No API, wire, or schema migration is required for the IndexedDB confirmed-internalize fix. Upgrade the active storage implementation, including the browser client. An invalid proof, or a missing or malformed header, still rejects before any proven transaction, transaction, or output is stored. No API, wire or database migration. Upgrade the wallet parser with an application SDK that validates pre-construction review evidence against requested inputs. Use the existing JSON error transport for recovery; binary framing is unchanged. Parsing alone does not authorize retry or prove competing transaction validity. For restart-safe WAB registration, persist token bytes through pendingRegistrationTokenSaver before funding, load them with loadPendingRegistrationToken before authentication after restart, and retain them until an authenticated snapshot is saved and hasPendingRegistrationToken returns false. Recover older pending registrations without checkpoints using the original wallet state; do not redeem again with a new root. Upgrade the wallet manager package used by the host. This fixes failed-update bookkeeping, not the underlying factor-decryption error. After a post-publication profile-restoration error, inspect listProfiles before retrying: the profile change has already committed. A failed restoration may leave the default profile active. Newly internalized normal-basket customInstructions are encrypted once, matching createAction. Values already stored under the previous double encryption remain ciphertext after one listOutputs decrypt. Chain gains the 'regtest' member, so a consumer with an exhaustive switch over Chain needs a case for it. Header validation helpers gain an optional trailing chain parameter; omitting it keeps the mainnet limit, and the 'tstn' chain is unchanged. No API or schema migration is required. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. No additional caller or schema migration: the local journal passes only optional provisional-header retry classification through its commit callback, retains ownership of the SQL fence, and commits acquisition, ownership and both completion receipts in one transaction. Existing ordinary internalization keeps its lease and retry controls. Existing three-argument and fourth-argument receipt-fence internalizeAction calls require no migration. PR-local funding recovery callers use internalizeActionWithRecovery(storage, auth, args, recovery, receipt?) instead. No API, wire, or schema migration for provided unlocking-script sizing; unlockingScriptLength already meant bytes. Upgrade the signer package; storage is unchanged. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. No public API, wire or database migration for promise ownership fixes; failed bulk-file persistence is now reported to the caller. No migration is required for remote-storage timeout configuration; omission preserves the SDK defaults and all existing SDK peer alternatives. The responseTimeoutMs option requires the SDK release containing it; configure it alongside requestTimeoutMs for a longer authenticated operation. Other certificate, session and operation deadlines remain independent. Reconcile an ambiguous financial request before resubmission.
`@bsv/wallet-toolbox-client`	`2.15.1`	`2.15.1`	none	API and usage	None. Arcade API keys are configured as before, through createDefaultWalletServicesOptions arcadeApiKey or arcadeConfig.apiKey. No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. For ordinary callers, no public API, wire, database, or consumer migration is required. Existing SDK peer ranges and browser/mobile/remote provider capabilities remain unchanged. The core local SQLite recovery guides do not grant IndexedDB, mobile or remote recovery guarantees. Do not replace durable core recovery with wrapper retries or entity-only backups; preserve any core journals and keys through rollback. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply. No API, wire or schema migration is required for the IndexedDB filter fix. Empty optional arrays now behave like omitted filters. Applications still receive only records allowed by their user and partial predicates; nonempty arrays retain their restrictions. No public API, wire or database migration is required for internalization broadcast. Upgrade the active storage implementation. Recipients receive a review-actions error when broadcast is rejected and must inspect that result before retrying; no recipient outputs are stored on rejection. Existing proven transactions retain their no-rebroadcast path. No API, wire, or schema migration is required for the IndexedDB confirmed-internalize fix. Upgrade the active storage implementation, including the browser client. An invalid proof, or a missing or malformed header, still rejects before any proven transaction, transaction, or output is stored. No API, wire or database migration. Upgrade the wallet parser with an application SDK that validates pre-construction review evidence against requested inputs. Use the existing JSON error transport for recovery; binary framing is unchanged. Parsing alone does not authorize retry or prove competing transaction validity. For restart-safe WAB registration, persist token bytes through pendingRegistrationTokenSaver before funding, load them with loadPendingRegistrationToken before authentication after restart, and retain them until an authenticated snapshot is saved and hasPendingRegistrationToken returns false. Recover older pending registrations without checkpoints using the original wallet state; do not redeem again with a new root. Upgrade the wallet manager package used by the host. This fixes failed-update bookkeeping, not the underlying factor-decryption error. After a post-publication profile-restoration error, inspect listProfiles before retrying: the profile change has already committed. A failed restoration may leave the default profile active. Newly internalized normal-basket customInstructions are encrypted once, matching createAction. Values already stored under the previous double encryption remain ciphertext after one listOutputs decrypt. Chain gains the 'regtest' member, so a consumer with an exhaustive switch over Chain needs a case for it. Header validation helpers gain an optional trailing chain parameter; omitting it keeps the mainnet limit, and the 'tstn' chain is unchanged. No API or schema migration is required. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. No API, wire, or schema migration for provided unlocking-script sizing; unlockingScriptLength already meant bytes. Upgrade the signer package; storage is unchanged. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. No migration is required for remote-storage timeout configuration; omission preserves the SDK defaults and all existing SDK peer alternatives. The responseTimeoutMs option requires the SDK release containing it; configure it alongside requestTimeoutMs for a longer authenticated operation. Other certificate, session and operation deadlines remain independent. Reconcile an ambiguous financial request before resubmission.
`@bsv/wallet-toolbox-mobile`	`2.15.1`	`2.15.1`	none	API and usage	None. Arcade API keys are configured as before, through createDefaultWalletServicesOptions arcadeApiKey or arcadeConfig.apiKey. No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. For ordinary callers, no public API, wire, database, or consumer migration is required. Existing SDK peer ranges and browser/mobile/remote provider capabilities remain unchanged. The core local SQLite recovery guides do not grant IndexedDB, mobile or remote recovery guarantees. Do not replace durable core recovery with wrapper retries or entity-only backups; preserve any core journals and keys through rollback. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply. No public API, wire or database migration is required for internalization broadcast. Upgrade the active storage implementation. Recipients receive a review-actions error when broadcast is rejected and must inspect that result before retrying; no recipient outputs are stored on rejection. Existing proven transactions retain their no-rebroadcast path. No API, wire, or schema migration is required for the IndexedDB confirmed-internalize fix. Upgrade the active storage implementation, including the browser client. An invalid proof, or a missing or malformed header, still rejects before any proven transaction, transaction, or output is stored. No API, wire or database migration. Upgrade the wallet parser with an application SDK that validates pre-construction review evidence against requested inputs. Use the existing JSON error transport for recovery; binary framing is unchanged. Parsing alone does not authorize retry or prove competing transaction validity. For restart-safe WAB registration, persist token bytes through pendingRegistrationTokenSaver before funding, load them with loadPendingRegistrationToken before authentication after restart, and retain them until an authenticated snapshot is saved and hasPendingRegistrationToken returns false. Recover older pending registrations without checkpoints using the original wallet state; do not redeem again with a new root. Upgrade the wallet manager package used by the host. This fixes failed-update bookkeeping, not the underlying factor-decryption error. After a post-publication profile-restoration error, inspect listProfiles before retrying: the profile change has already committed. A failed restoration may leave the default profile active. Newly internalized normal-basket customInstructions are encrypted once, matching createAction. Values already stored under the previous double encryption remain ciphertext after one listOutputs decrypt. Chain gains the 'regtest' member, so a consumer with an exhaustive switch over Chain needs a case for it. Header validation helpers gain an optional trailing chain parameter; omitting it keeps the mainnet limit, and the 'tstn' chain is unchanged. No API or schema migration is required. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. No API, wire, or schema migration for provided unlocking-script sizing; unlockingScriptLength already meant bytes. Upgrade the signer package; storage is unchanged. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. No migration is required for remote-storage timeout configuration; omission preserves the SDK defaults and all existing SDK peer alternatives. The responseTimeoutMs option requires the SDK release containing it; configure it alongside requestTimeoutMs for a longer authenticated operation. Other certificate, session and operation deadlines remain independent. Reconcile an ambiguous financial request before resubmission.
`@bsv/webrtpay`	`0.2.3`	`0.2.3`	none	API and usage	No consumer migration required. Public exports, dependency ranges, relay readiness and browser behavior remain unchanged. React Native answerers can accept unlimited reliable channels reported with native sentinel values. Use the attested 0.2.2 artifact for verified releases. No consumer migration required. Offer code bytes, encoded expiry, timeout errors and handshake behavior are unchanged. Offers remain available until their encoded expiry even when a timer wakes early. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.
`create-bsv-app`	`1.2.0`	`1.2.0`	none	API and usage	No consumer migration is required. --yes and --file resolve exactly as before and still need --frontend or --backend for a new project. Interactive users who want the previous minimal project deselect the frontend, backend, or capabilities they do not need; scripts that set the helpers directory should pass --bsv-dir. The package exports no public API. Release order: generated projects depend on @bsv/wallet-relay ^0.7.0, so @bsv/wallet-relay 0.7.0 must be published before create-bsv-app 1.2.0. Projects generated before this release keep @bsv/wallet-relay ^0.2.0 until they update it themselves; newly generated production servers must set an HTTPS SERVER_ORIGIN. To pair a phone over LAN HTTP in development, enable the wallet's local-network HTTP option (for example a developer setting); generated production servers and client builds leave allowLocalNetworkHttp off. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package.

none means the source manifest matches the recorded npm baseline. Any other value records source ahead of that baseline; it does not establish the current registry state. initial with a null published baseline identifies a new package with no recorded published baseline; it does not invent an npm version or waive publication checks. Publication, tags, releases, registry reconciliation, and infrastructure dependency synchronization remain separate, explicitly authorized operations.

Package entry points

@bsv/402-pay

Package documentation: docs/packages/middleware/402-pay.md
Source: packages/middleware/402-pay
Release note: Adds an exact-tarball Vite and esbuild contract for the browser-safe client entry point, including a bundle-size ratchet and an assertion that server exports never leak into browser consumers. Retains the hash-pinned pre-uniformization Open BSV License version 4 grant as a scoped continuity notice. Standardizes first-party author metadata on the current BSV Association name. Binds BRC-121 pricing and internalization to the transaction declared by the BRC-95 Atomic BEEF subject, removes unrelated included branches, rejects trailing bytes and non-atomic envelopes, and requires affirmative wallet acceptance before serving paid content. Adds independent bounded atomic transaction replay claims so conforming BRC-100 wallets that omit the non-public isMerge detail cannot authorize duplicate access, preserves actual overpayments in middleware receipts, uses fixed bounded wallet descriptions, makes diagnostics opt-in, and returns an unchallenged 503 after ambiguous wallet or replay-store failures to avoid inducing a second spend. Aligns the development-only Vitest runner and V8 coverage provider at 4.1.11. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: Custom clients must send a strictly framed BRC-95 Atomic BEEF envelope whose subject is the payment transaction; plain BEEF is no longer accepted. Legacy Atomic BEEF containing unrelated branches remains compatible because the server reduces it to the declared subject and dependency closure. The default replay store is bounded and process-local; production services with more than one serving process or node must inject the same durable atomic PaymentReplayStore everywhere. Low-level validators should retain one wallet object or pass an explicit store. Applications that relied on implicit console diagnostics must supply the optional structured logger. Treat an unchallenged 503 after payment submission as ambiguous and reconcile the transaction before requesting another payment. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs` `./dist/index.cjs`	`./dist/index.d.mts` `./dist/index.d.cts`
`./server`	`./dist/server.mjs` `./dist/server.cjs`	`./dist/server.d.mts` `./dist/server.d.cts`
`./client`	`./dist/client.mjs` `./dist/client.cjs`	`./dist/client.d.mts` `./dist/client.d.cts`

@bsv/air-gap

Package documentation: docs/packages/helpers/air-gap.md
Source: packages/helpers/air-gap
Release note: Bounds BRC-141 decoder state, scanned strings, duplicate tracking, pending mixes, fountain indices, and high-degree work while replacing sparse O(K) index materialization with bounded mapping. Systematic and degree-one frames remain available under pressure and valid wire-v1 payloads retain their bytes.
Migration: No migration is required for valid BRC-141 v1 senders or decoders. Malformed, oversized, duplicate-heavy, or adversarial high-degree sessions now fail closed or are evicted within the documented limits instead of consuming unbounded resources.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs` `./dist/index.cjs`	`./dist/index.d.mts` `./dist/index.d.cts`

@bsv/amountinator

Package documentation: docs/packages/helpers/amountinator.md
Source: packages/helpers/amountinator
Release note: Validates finite monetary values, normalized nonempty currency codes, integer decimal precision, grouping flags, converter rates, and conversion results, and formats negative sub-unit amounts from their absolute magnitude without losing the sign. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: Valid finite inputs retain the public API. Currency identifiers are trimmed and normalized to uppercase; callers that passed non-finite values, empty currencies, coercive options, invalid decimal precision, or non-finite converter results must normalize or reject them before calling because those values now fail closed. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs` `./dist/index.cjs`	`./dist/index.d.mts` `./dist/index.d.cts`

@bsv/auth

Package documentation: docs/packages/middleware/auth.md
Source: packages/middleware/auth
Release note: Adopts the governed strict TypeScript profile and repository-wide zero-warning lint and formatting contract. Snapshots canonical own-data proof fields, dense signature bytes, bodies, protocols, wallet identities, and exact wallet verdicts before asynchronous work; rejects accessor/inherited authority and ambiguous JSON numbers; and retains exact nonce-consumption replay claims. Standardizes first-party author metadata on the current BSV Association name. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No valid proof bytes or public API shape changes. Client and server must use the same protocol tuple; security levels 0, 1, and 2 remain supported and select wallet consent policy while the explicit counterparty scopes derivation at every level. Proof and wallet adapters must supply plain own data fields and dense byte arrays; inherited, accessor-backed, sparse, or malformed runtime shapes fail closed. Structured bodies containing non-finite numbers or negative zero must be normalized to an unambiguous wire representation before signing. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs` `./dist/index.cjs`	`./dist/index.d.mts` `./dist/index.d.cts`

@bsv/auth-express-middleware

Package documentation: docs/packages/middleware/auth-express-middleware.md
Source: packages/middleware/auth-express-middleware
Release note: Removes middleware header byte/count ceilings and excludes received HTTP headers from authenticated request-body budgets, preserving signed header bytes. HTTP server and edge layers own transport capacity. Canonical framing, authentication, invalid-header rejection, body budgets and response signing remain. Requires SDK 2.8.5 and delegates its Peer general-payload capacity to the HTTP layer, avoiding an indirect SDK envelope ceiling for received headers. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. General-message processing classifies an unverifiable nonce or HMAC as 401 ERR_AUTH_FAILED. The classification covers ERR_INVALID_HMAC and the message HMAC is not valid, in addition to the existing nonce, signature, session, and auth-version text. Unrelated processing failures remain 500. AuthFetch therefore discards the stale session and re-handshakes. Adds optional final authenticated HTTP response admission after BRC-104 signing, with native synchronous enqueue, one bounded re-signed replacement and deadline/disconnect cancellation. Ordinary response behavior, peer ranges and wire representation are preserved. Existing bounded integration fixtures retain their development-only rate limiter. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Guarded candidate and replacement bytes now retain independent snapshots for Buffer as well as Uint8Array inputs. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound. Response interception forwards unexpected response-builder promise failures to the existing Express error handler while retaining synchronous send/json/text return values and authenticated-response signing.
Migration: No BRC100 call, wire or wallet-data migration. Configure and validate transport header limits at the HTTP server, CDN, proxy or WAF; maxRequestBytes no longer caps received headers. Clients needing larger signed responses require corresponding client capacity, including SDK 2.8.5. Published 2.2.8 is verified against protected release 36052862859 and its immutable source artifacts. Upgrade the required SDK peer to 2.8.5; custom ExpressTransport/Peer setups should pass maxGeneralPayloadBytes=null when the HTTP layer owns payload capacity. SDK consumers may retain ^2.8.5 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. No BRC-103/104 wire or request-shape migration. Clients that already retry authentication after 401 recover from a server nonce they cannot verify. Clients that treated HTTP 500 as a permanent internal failure for this case now receive 401. Either this middleware or the SDK 4.0.1 hotfix stops the lock-out; deploy both when they are published. This source candidate is not publication. No change for ordinary routes. Guarded routes explicitly call guardAuthenticatedResponse after authentication and before sending; acquire the application durable fence, recheck current authorization and targets, and synchronously enqueue under it. Native Node HTTP/1 transport is required without compression/deferred response wrappers. Replacements are complete responses limited to64KiB and must preserve required CORS/capability headers. No production rate-limiting or transport defaults change. SDK consumers may retain ^2.8.5 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. No migration for the owned-byte correction; current authorization and synchronous enqueue remain the guard owner's responsibility. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. No API, authentication, wire or request-replay migration for response promise ownership.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/mod.mjs` `./dist/mod.cjs`	`./dist/mod.d.mts` `./dist/mod.d.cts`
`./package.json`	`./package.json`	—

@bsv/authsocket

Package documentation: docs/packages/messaging/authsocket.md
Source: packages/messaging/authsocket
Release note: Contains authentication and application callback failures, caps per-socket authentication concurrency, gates every concurrently received first-session event and routing decision on one completed authenticated-connection activation, snapshots strict JSON before signing, serializes real typed arrays portably, and preserves supported signed event JSON exactly. Retains the hash-pinned pre-uniformization Open BSV License version 4 grant as a scoped continuity notice. Standardizes first-party author metadata on the current BSV Association name. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No API or wire migration is required for valid JSON events. Existing numeric-key objects under byte-like names are unchanged; typed payment protocols recover historical byte objects at their explicit fields. Outbound non-JSON or ambiguous runtime values, including negative zero, nested undefined, sparse arrays, accessors, hidden/extra properties, and serialization hooks, now fail closed before signing. requestedCertificates is an SDK allowlist, not an application authorization verdict. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/mod.mjs` `./dist/mod.cjs`	`./dist/mod.d.mts` `./dist/mod.d.cts`
`./package.json`	`./package.json`	—

@bsv/authsocket-client

Package documentation: docs/packages/messaging/authsocket-client.md
Source: packages/messaging/authsocket-client
Release note: Contains authentication and application callback failures, caps authentication concurrency, snapshots strict JSON before signing, serializes real typed arrays portably, preserves supported signed event JSON exactly, and ships the complete SDK incorporated-material notice archive with a retained UMD notice banner. Standardizes first-party author metadata on the current BSV Association name. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No API or wire migration is required for valid JSON events. Existing numeric-key objects under byte-like names are unchanged; typed payment protocols recover historical byte objects at their explicit fields. Outbound non-JSON or ambiguous runtime values, including negative zero, nested undefined, sparse arrays, accessors, hidden/extra properties, and serialization hooks, now fail closed before signing. The connect event/connected property report Socket.IO transport state, not completed BRC-103 authentication; wait for verified application traffic when local behavior requires a known unpinned server. Distributors who copy the UMD file must keep THIRD_PARTY_NOTICES.md and LICENSES/ with it. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/mod.js` `./dist/mod.cjs`	`./dist/mod.d.ts` `./dist/mod.d.cts`
`./package.json`	`./package.json`	—

@bsv/btms

Package documentation: docs/packages/wallet/btms.md
Source: packages/wallet/btms
Release note: Adds TerraTestNet and preserves token settlement and refund transaction bytes across number-array, Uint8Array, and historical numeric-key JSON wallet runtimes. Standardizes first-party author metadata on the current BSV Association name. Rejects non-canonical or unsafe token amounts, applies exact checked arithmetic to financial aggregates, and enforces value conservation for custom change strategies. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: Existing local, mainnet, testnet, and number-array behavior is unchanged. TTN consumers select networkPreset teratestnet; all consumers should upgrade to @bsv/sdk 2.4.1 or later for byte-boundary compatibility. Valid canonical token amounts remain compatible. Audit historical tokens for signed, exponent, leading-zero, non-positive, or greater-than-9007199254740991 amount fields before rebuilding wallet state; public number-based operations now fail closed when an aggregate cannot be represented exactly. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs` `./dist/index.cjs`	`./dist/index.d.mts` `./dist/index.d.cts`

@bsv/btms-permission-module

Package documentation: docs/packages/wallet/btms-permission-module.md
Source: packages/wallet/btms-permission-module
Release note: Requires literal authorization verdicts, bounds authorization state, validates dense signature bytes and safe-integer totals, and binds BTMS signing to an exact canonical BIP143 preimage with no trailing data. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: Valid canonical BTMS flows remain compatible. Custom prompts must return literal true, authorization maps may contain at most 1,024 entries, and callers must provide dense signatures, safe exact totals, and canonical preimages; coercive or trailing-byte forms now fail closed. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs`	`./dist/index.d.mts`

@bsv/chirp

Package documentation: docs/packages/network/chirp.md
Source: packages/network/chirp
Release note: Fixes authenticated CHIRP object uploads: omit explicit Content-Length and Content-Encoding application headers that AuthFetch rejects, while HTTP transport generates the correct length and absent encoding preserves identity bytes. Adds a real mutually authenticated client/server regression that verifies raw object bytes, automatic HTTP framing, object identifiers, caller identity, and successful commit. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No API, codec, object identifier, service schema, or wire-format migration. Use @bsv/chirp 0.1.3 with SDK 2.8.9 or later and Cloud Bucket 0.2.48 or Lite 0.1.45 for authenticated binary uploads, including full 4 MiB chunks. Custom authenticated transports must send the supplied owned byte body unchanged and supply ordinary HTTP framing; Content-Type remains signed through AuthFetch. Earlier service entrypoints do not parse staged binary bytes before authentication and require this service patch. Existing stored objects, sessions, advertisements and leases remain unchanged. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

CLI entry points: {"chirp":"./dist/cli.js"}.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.js` `./dist/index.js`	`./dist/index.d.ts`
`./openapi`	`./dist/openapi.js` `./dist/openapi.js`	`./dist/openapi.d.ts`
`./package.json`	`./package.json`	—

@bsv/color-permission-module

Package documentation: docs/packages/wallet/color-permission-module.md
Source: packages/wallet/color-permission-module
Release note: Introduces the BRC-207 color wallet module for BRC-162 fungible tokens: receipt verification against the asset overlay, token sends funded from per-asset baskets with token change and signed during signAction, BRC-177 handoffs with an exact-amount split, a p color tag holding the SHA-256 of the derivation suffix on every output it files, inputBEEF for the token inputs the module selects (merged with the caller's, read by suffix tag in one listing per asset basket or bounded pagination when distinct payments share a suffix), input records bound to the action reference between createAction and signAction so signing does not list the wallet's outputs, createSignature for app-built transactions, and the p color assets and p color balance views. Assets first deployed as BRC-161 JSON, at any output index, are handled in BRC-162 form. 0.2.0 builds on the published 0.1.1 and includes all of its fixes: numeric p color balance summaries (summed exactly as a bigint, then one Number conversion), the unchanged inventory view (every held output, reserved ones listed with spendable false and color_state_reserved), the #1338 suffix tags and input BEEF recovery (outputs filed without a suffix tag are not selected or spendable through the module) and the SDK ^4.0.1 peer floor. 0.2.0 adds required processing profiles: a fail-closed handler registry (profiles option, with a required durable ColorModuleStore under color.v1. keys) in which every required profile must be registered with its version and handlers only restrict. Their hooks check descriptors and ext, route each asset to its own overlay provider, resolve unknown deploys, restrict holder operations, check plan profileData, supply BRC-22 submission data (passed to ColorOverlayProvider.submit as an optional third offChainValues argument) and, through admitReceipt, decide each receipt of their asset as settled or pending in place of the overlay spendability check. A pending receipt and the token change of a plain-noSend hand-over (sendPolicy plain-nosend: noSend required, change kept in the transaction, never submitted by the module) are tagged color_offline in the views until the host calls the in-process markSettled(txid), which is not a BRC-100 method. Receipts carry BRC-207 custody instructions only: any receipt profileData is rejected with the 0.1.0 error and the 1000-byte limit holds. actionConsent and transactionConsent take the token reader (and actionConsent the hand-over flag) in a trailing options object (ActionConsentOptions, TransactionConsentOptions); their 0.1.0 calls are unchanged. New error classes ProfileParamsError, ProfileDataError and ColorConsentDeclinedError carry a [ClassName] message prefix, and every consent message carries seekPermission. Plans also cover deploys, mints, burns and authority operations. Module-built deploys that require profiles, BRC-161 JSON outputs held by the wallet, BRC-209, and createSignature for assets whose profiles define sendPolicy, submissionData or checkPlanData fail explicitly in this version, as does a plain-noSend hand-over signed with options.noSend false or a sendWith batch. The module advertises brc207-color=4, the BRC-207 revision it implements. The pending balance (p color balance with tags ['color_offline']) is a number in totalOutputs, like every balance; color_offline outputs stay listed in the inventory with their computed color_state tag. The browser budget is 0.1.1's (Vite raw/gzip/brotli 1375000/345000/270000, esbuild 1060000/310000/255000 bytes), which covers the measured 0.2.0 bundle (Vite 1281058/317875/251521, esbuild 989064/288967/234125).
Migration: 0.1.1 restores numeric module balance queries for established clients. Wallet hosts use SDK4.0.1 or newer and register the color scheme with the underlying wallet, a ColorOverlayProvider and a prompt callback. Exact accounting and value movement enumerate outputs; numeric summaries above 2^53 may round. Published inventory scope and wallet data remain unchanged. 0.2.0: No migration for hosts that register no profiles: behaviour is 0.1.1's (numeric balances, SDK ^4.0.1, #1338 suffix tags and inputBEEF recovery). ColorOverlayProvider.submit receives an optional third offChainValues argument; existing providers ignore it. Hosts that register profiles must supply a durable ColorModuleStore, submit plain-noSend hand-overs and pending receipts themselves, and call markSettled(txid) once the overlay admitted them. For every host, each consent message now carries seekPermission and a declined request throws ColorConsentDeclinedError, whose message is the 0.1.0 text prefixed with [ColorConsentDeclinedError]. 0.1.1 advertised brc207-color=5; 0.2.0 advertises brc207-color=4, the discovery value the pinned BRC-207 revision defines, so apps that check for 4 discover the module.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs`	`./dist/index.d.mts`

@bsv/did

Package documentation: docs/packages/helpers/did.md
Source: packages/helpers/did
Release note: Fixes the CommonJS build of the DID key, signature and multibase helpers. The CommonJS build imported @bsv/sdk classes through bundler Node-mode interop, which bound each default import to the whole SDK module, so require() consumers failed at first use with ".default is not a constructor". SDK classes are now imported by name from the SDK barrels; the ESM build, public API and browser bundle size are unchanged. Adds proposed BRC202 exact compressed identity-key DID resolution and BRC203 original-byte verified envelopes, authorized recipient-bound selected disclosure and explicit status/privacy adapters. Preserves the independently named SD-JWT format. BRC52 adapters use an explicit optional @bsv/did/brc52 entry, preserving the original DID-only browser budget. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: DID0.3 is a breaking pre-1.0 candidate: compressed identity-key input only; remote document/lifecycle options rejected. Use original signed BRC52 binary for envelopes, or explicitly verified compatible structured core. Wire authenticated BRC103/104 payload/control, durable atomic replay, consent, issuer/schema/purpose reliance and local status policy; callbacks alone are not full transport conformance. See docs/guides/identity-did-vc-migration.md. Proposed custom W3C mechanisms remain unregistered. Import BRC52 APIs/types from @bsv/did/brc52; identity-key DID and independent SD-JWT helpers stay at @bsv/did. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/mod.js` `./dist/mod.cjs`	`./dist/mod.d.ts` `./dist/mod.d.cts`
`./*.ts`	`./dist/src/.js` `./dist/src/.cjs`	`./dist/src/.d.ts` `./dist/src/.d.cts`
`./brc52`	`./dist/brc52.js` `./dist/brc52.cjs`	`./dist/brc52.d.ts` `./dist/brc52.d.cts`

@bsv/ecpm-permission-module

Package documentation: docs/packages/wallet/ecpm-permission-module.md
Source: packages/wallet/ecpm-permission-module
Release note: Hardens the BRC-98 ecpm boundary with plain-own-data arguments, exact key, point, protocol, and counterparty validation, immutable configuration snapshots, originator binding, and bounded grant and pending-authorization state. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: Valid ecpm requests remain compatible. Authorization callbacks must return literal true; inherited, accessor-backed, malformed, or oversized inputs now fail closed. Hosts must keep grants below 1,024 entries and avoid more than 64 concurrently pending new authorization prompts per module instance. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs`	`./dist/index.d.mts`

@bsv/eqc

Package documentation: docs/packages/overlays/eqc.md
Source: packages/overlays/eqc
Release note: Introduces the Economic Query Client for BRC-178 race-settled collection markets: SLAP-bootstrapped host discovery, a client-judged race over BRC-77 attestations, one square-root-weighted BRC-29 payout transaction, hash-verified collection, BRC-136 topic-anchor consistency reporting, local host reputation, and framework-agnostic host handlers with overlay-lookup, message-list, and byte providers. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No consumer migration is required; this is the first release of a new additive package. Existing LookupResolver, MessageBoxClient, overlay, and message box server routes are unchanged. Requires @bsv/sdk ^2.8.0, ^3.0.0 or ^4.0.1; 2.8.0 is the first SDK2 release whose AuthFetch accepts bounded transport options and whose SLAP advertisements are canonical https, wss or js8 URIs. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs` `./dist/index.cjs`	`./dist/index.d.mts` `./dist/index.d.cts`
`./host`	`./dist/host.mjs` `./dist/host.cjs`	`./dist/host.d.mts` `./dist/host.d.cts`

@bsv/fund-wallet

Package documentation: docs/packages/helpers/fund-wallet.md
Source: packages/helpers/fund-wallet
Release note: Requires the funding wallet's internalizeAction result to contain accepted: true before reporting a funded transaction as successfully internalized. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Rejects a listOutputs result whose totalOutputs is not a number. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No public API migration is required for conforming wallets. Custom WalletInterface adapters must return the literal accepted: true verdict after successful internalization; refusals and malformed or coercive results now throw instead of being reported as success. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

CLI entry points: {"fund-metanet":"./dist/index.mjs"}.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	—	—

@bsv/gasp

Package documentation: docs/packages/overlays/gasp.md
Source: packages/overlays/gasp-core
Release note: Validates and correlates every GASP page, outpoint, node, raw transaction, metadata field, requested-input map, and completion result; caps page, graph, metadata and concurrency work; prevents prototype-sensitive records, quadratic replies, stale-watermark advancement, and non-progressing pagination. Retains the positional constructor and v1 wire contract while documenting the parent-availability assumption of the bidirectional push half. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No API or wire migration is required. In bidirectional mode, the receiver must already have the parent of a pushed child, request it during a subsequent synchronization round, or reject the graph because GASP v1 submitNode does not transmit the spentBy parent outpoint. Pull-only operation avoids that assumption. Custom storage and remote adapters must preserve exact request/node binding and bounded responses. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/esm/mod.js` `./dist/cjs/mod.js`	`./dist/types/mod.d.ts` `./dist/cjs/mod.d.ts`
`./*.ts`	`./dist/esm/src/.js` `./dist/cjs/src/.js`	`./dist/types/src/.d.ts` `./dist/cjs/src/.d.ts`

@bsv/group-messaging

Package documentation: docs/packages/messaging/group-messaging.md
Source: packages/messaging/group-messaging
Release note: Initial migration into ts-stack of end-to-end encrypted group messaging for BRC-100 wallets, with MLS (RFC 9420) group state by way of ts-mls and each member's MLS credential bound to their wallet's secp256k1 identity so a peer cannot join under a name that is not theirs. Ships storage backends for Map, SQL and IndexedDB, and transport backends for an in-process hub and @bsv/message-box-client with optional live socket delivery over a polling backstop. The library opens no database and no network connection of its own beyond the socket a caller explicitly asks for, and never stores private KeyPackage material. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No migration is required: this is the package's first appearance in ts-stack and it has not been published to npm before. Consumers supply their own wallet, storage and transport. @bsv/sdk is a required peer dependency. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs` `./dist/index.cjs`	`./dist/index.d.mts` `./dist/index.d.cts`
`./package.json`	`./package.json`	—

@bsv/lch

Package documentation: docs/packages/content/lch.md
Source: packages/content/lch
Release note: Hardens the BRC-170 Licensed Content Header implementation with deterministic malformed-input handling, URL-canonical SSRF protection including IPv4-mapped IPv6 literals, bounded DAG composition, authenticated settlement evidence, replay-safe receipts, recovery-safe multipay state, and signed-Offer agreement binding. Removes the endpoint-only quote overload because it cannot authenticate the Asset, Policy, Agreement, seller, or key-delivery terms. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an optional overlay-acquisition entry with strict BRC-198 binding, collector schedule, typed evidence and exact CBOR/JCS representation checks, without installing new profiles through ordinary imports. Adds a concrete opt-in fixed-render/direct-collector paid domain: original signed Offer/Request and canonical ODRL consent, selected mechanisms, independent payment/listing/release verification, exact License and BRC-78 key grants, protected immutable original/verification custody, and offline playback from an already verified entitlement. Additive License extension options leave ordinary bodies unchanged when omitted. Adds a concrete seller domain retaining original protected CEKs, independently reconciling native credit and issuing exact signed settlement, derived Agreement and recipient-bound License. Authenticated native buyer/seller recovery survives a lost paid reply, custody restart, Offer expiry and catalogue withdrawal without another charge. Adds reusable standing-Offer covenant terms with exact initial revenue/anchor/family and selected topic-mechanism binding, individual signed buyer consent, and frozen purchase/recovery promises. Paid and covenant modes share unchanged accepted-policy, human-term, mechanism and original Request-byte checks. Adds a separate optional overlay-covenant buyer domain with original protected consent, complete independently installed purchase/release verification, exact C settlement and License bindings, native entitlement reopen and authenticated playback. Paid and covenant domains share the existing complete License, role, Agreement and recipient-key checks. Adds a concrete optional covenant seller with independently installed complete genesis/Script/purchase and selected-release verification, retained private CEKs, original bounded delivery capacity, exact collector settlement and recipient License/key grants. Native coordinator issuance receives an additive trailing owned retained-candidate argument; existing four-argument adapters remain compatible. Aligns the optional unpublished C settlement to BRC PR295 with a mandatory full purchase commitment bound to reserved result/POTATOES and independently installed buyer/seller verifier results. Pins owned synchronous digest assessments across asynchronous issuance. Excludes independently assessed current-alias transport evidence from historical entitlement fingerprints without granting new rights or online playback dependencies. The current reference composition integrates the replacement family with protected child authority, native wallet and alias custody, per-transaction admission, authenticated HTTP and LCH; complete exact-source qualification remains required. Adds independently selected immutable collector decoding, complete descriptor binding and strict active-stage/new-preparation expiry predicates for current BRC198 C. Existing historical collector and covenant domain APIs retain their prior behavior. Adds separately selected current immutable covenant terms, promise and window validation through one shared complete consent pipeline, retaining the historical public interfaces and error identities. Adds separately selected immutable current settlement/evidence representation and binding interfaces using the complete shared settlement pipeline. Existing public settlement wrappers and all consent/signature/historical-release/POTATOES checks remain. Adds an explicitly selected immutable current buyer domain over the complete shared buyer core, preserving historical public interfaces and installation identities. Current funding returns an owned synchronous active-stage/height/time fence; actual original funded and released subjects require independently verified identical full purchase commitments before protected entitlement, License and playback. Adds an explicitly selected immutable current seller over the complete shared issuance pipeline. Owned active-stage/height and same-view/Offer/preparation-time fences protect new promises; retained issuance keeps the original complete purchase/release/role/CEK/License and full-commitment checks without reapplying new-work expiry. Adds an explicitly installed complete-candidate verification port to the current immutable covenant domain. Its optional candidateBinding capability verifies the original funded subject and recovery aliases without inventing release evidence or accepting a License. Copies wallet encryption/decryption byte results through bounded own data values, rejecting missing bytes and accessors without custom iteration or changes to valid BRC-78 bytes and key identities. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: Replace buyer.quote(endpoint, request, issuer, keyGrants) with buyer.quote(verifiedSignedOffer, request, expectedSeller, keyGrants). JavaScript callers that still pass an endpoint string fail before transport I/O. Persist the returned plan and every partial settlement proof, retry with the same funded transaction, and configure a profile-aware agreementEvaluator before completion or recovery. Low-level unverified recovery results must not authorize key storage or content access. DNS endpoints require an address-pinning connector outside trusted browser environments. Distributors must retain THIRD_PARTY_NOTICES.md with the package; published BRC-170 remains authoritative if the implementation and standard differ. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. The optional overlay-acquisition and overlay-covenant entries require the coordinated SDK3.3.0 output and revenue-listing companions; existing root peer ranges remain unchanged. Ordinary BRC-170 imports and SDK2 consumers remain unchanged. Decoded acquisition context and entitlement fingerprints remain explicitly unverified. Opt-in callers must install local proof sources and protected immutable-object custody before funding. LCHOverlayPaidDomain performs the concrete fixed-render/direct-collector checks; unsupported policy terms and profiles fail before funding. Ordinary BRC-170 imports, CORE_CAPABILITIES and SDK2 peers stay unchanged. The minor candidate adds APIs and a locally qualified authenticated native paid-lookup recovery flow. The current native covenant acquisition reference examples are implemented; their selectors and complete final-source gates are recorded in the checkpoint inventory. The browser workbench separately demonstrates progressive and live lookup. Install LCHOverlayPaidSeller only with the protected coordinator, actual read-only native credit reconciliation and complete original CEKs; financial effects remain owned by the coordinator and native adapters. Opt-in covenant callers must compose the terms adapter with actual complete genesis/Script/purchase, role and release verification; terms validation alone cannot issue a License or authorize decryption. Preserve the buyer-free standing Offer and exact original signed Request on every retry. Import LCHOverlayCovenantDomain through @bsv/lch/overlay-covenant, reserve original and positive-verification custody before financial work, and install actual full lineage/purchase/release proof ports. A decoded portable package, signed settlement or entitlement fingerprint alone cannot authorize playback. Public disclosed native fixtures compose the current covenant, encrypted custody, native wallet, seller and authenticated admission/recovery; full checkpoint qualification remains required. Install LCHOverlayCovenantSeller with actual full verifiers and the protected purchase coordinator; the advertised finite request/response limits must reserve the complete future C context before preparation. Issuance requires the complete retained candidate passed by the current coordinator, independently assessed release and original private material. Catalogue withdrawal does not replace that obligation. Combined wallet-backed topical-admission and native reference demonstrations are implemented; complete final-source qualification remains required. The opt-in covenant domain accepts complete plain BEEF selected by the original explicit wallet txid, independent of proof-record order; present Atomic BEEF markers must match. All original independent material, Script, lineage and licence checks remain. Ordinary BRC-170 behavior and persisted formats are unchanged. Existing BRC170 and paid-lookup behavior is unchanged. The approved pre-adoption C profile replacement requires purchaseCommitment in its signed settlement and in installed purchase verifier results; return the full authenticated input-zero SHA256d digest with an owned synchronous checkCurrent guard. Never infer it from equal outputs or transport claims. Preserve original signed release, License, settlement and protected obligations; currentAlias is separate unverified transport evidence. Qualify the replacement family, immutable collector terms, protected child wallet and native alias custody before advertising C. No existing ordinary content or paid-lookup stored format is reinterpreted. For current C representation, select decodeLCHCollectorRevenueProfile/bindLCHCollectorRevenueProfile and supply the exact immutable schedule and expiryHeight. New preparations require independently verified active stage and installed current height below expiry; retained obligations do not repeat that new-work predicate. These helpers do not authenticate Offers, verify ancestry/currentness or migrate historical owners; the current reference composition installs those independent responsibilities explicitly. Authenticate current C with validateLCHOverlayCovenantProfileTerms and retain its original consent; validateLCHOverlayCovenantProfilePromise validates a frozen obligation, while validateLCHOverlayCovenantProfileWindow is for new work. Independently verify authorized current-family lineage, roles, active stage and installed chain height before financial work. These terms interfaces perform no wallet action and do not migrate the historical buyer/seller/native alias owners. Select decodeLCHOverlayCovenantProfilePurchaseEvidence and bindLCHOverlayCovenantProfileSettlement for the current immutable descriptor. Representation and signed commitment binding do not establish actual Bitcoin history, Script execution, roles, release satisfaction, License validity or native alias ownership; retain independent full verification and historical entitlement checks. Select LCHOverlayCovenantProfileDomain for the current immutable collector. Initialize protected custody and retain/recheck fundingPreflight immediately before financial effects. Install actual complete current lineage, original funded and released transaction proof, and release-policy ports. Existing historical domain IDs/formats/defaults remain unchanged; retained delivery and offline playback never repeat a new-funding expiry predicate. The current reference composition separately installs native alias/action custody and the current seller; neither responsibility is supplied by the buyer domain alone. Select LCHOverlayCovenantProfileSeller for current immutable seller material. Its distinct installation identity does not reinterpret historical custody. Supply complete actual reserve/activation/purchase/release verifiers; retain and recheck the preparation guard before promising material. Original historical seller interfaces/IDs/formats/defaults remain. The current reference composition separately installs coordinator commitment packets and native alias/action/admission/HTTP owners; the seller domain alone supplies none of those authorities. Omit verification.candidate to preserve the prior installation identity and absent binding capability. Installing it selects a distinct full-commitment domain before buyer creation or reopen; its verification ID must bind complete independently selected algorithms. Provide the full ProfilePurchase verifier and same-context guard, retain original protected custody, and assess current alias placement separately on the buyer's own chain. Historical new-funding cutoffs do not re-gate this read-only verification. These additive components remain under native, packed and platform qualification; no full checkpoint claim. Conforming dense integer-byte wallet results remain compatible. Custom wallet adapters must return every plaintext/ciphertext byte as an own data value; missing or accessor-backed bytes fail with ERR_LCH_KEY rather than being synthesized. The additive seller assessment companion retains pending-finality or pending-evidence before financial reservation. Installing verification.assessPurchase selects a distinct material binding. Complete original consent, roles, Script/domain and release checks remain mandatory; pending evidence cannot fulfill compensation or issue a License. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

CLI entry points: {"lch":"./dist/cli.js"}.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.js` `./dist/index.js`	`./dist/index.d.ts`
`./package.json`	`./package.json`	—
`./overlay-acquisition`	`./dist/overlayAcquisition.js` `./dist/overlayAcquisition.js`	`./dist/overlayAcquisition.d.ts`
`./overlay-covenant`	`./dist/overlayCovenant.js` `./dist/overlayCovenant.js`	`./dist/overlayCovenant.d.ts`

@bsv/message-box-client

Package documentation: docs/packages/messaging/message-box-client.md
Source: packages/messaging/message-box-client
Release note: listMessages() and listMessagesLite() report paymentOutcome ('internalized', 'failed', 'skipped' or 'no-wallet-outputs') on each message that carried a payment, and keep that payment on the returned message unless the wallet accepted it (issue #503). Previously the payment envelope was always removed and a failed internalization was only logged, so acknowledging a listed message could delete the only copy of a payment. Both PeerMessage fields are optional and absent on messages without a payment. This release also carries the @bsv/sdk peer-floor raise from ^2.8.0 to ^2.8.6: SDK 2.8.0 through 2.8.5 derive the recipient key in Brc29RemittanceModule.acceptSettlement without forSelf, so PeerPayClient.acceptPayment() and rejectPayment() fail with brc29.internalize_failed for every valid incoming payment, and SDK 2.8.6 fixes acceptance. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Repairs live WebSocket delivery: a transient disconnect no longer discards a socket Socket.IO is still reconnecting; every handler is bound to the socket that owns it, so a replaced socket can no longer authenticate on or close its successor; rooms the consumer asked for are tracked separately from rooms joined on the current socket and are re-emitted after each authentication; live-message handlers are restored exactly once on a rebuilt socket; a server-forced disconnect triggers a rebuild so a subscriber that makes no calls recovers on its own; managerOptions.reconnection: false is read and honoured by disposing on a drop; and leaveRoom releases its room while disconnected instead of returning first. Reads the server's answer to a join, so a refused join no longer leaves the client certain of a room it was never given. Attaches one live-message listener per room per socket, and one acknowledgement listener per room with sends queued behind it, in place of a listener per subscription and per send that the socket wrapper has no way to detach; a message is decrypted once however many subscribers a room has, and a subscriber that throws no longer costs the rest of the room its message. Backs the rebuild after a server-forced disconnect off from one second to a thirty-second cap after the first, which stays immediate. Adds onLiveStatus, which reports what the live socket is doing — connecting, live with the rooms joined on it, reconnecting after a drop something will recover from, or closed with nothing coming — so a consumer no longer has to send a message to find out; a refused join drops its room from the reported status at once. sendLiveMessage falls back to HTTP when the socket cannot be established, authenticated or joined, for example right after a server restart, instead of throwing; a conflicting WebSocket identity pin still throws. Paces room joins to 16 awaiting the server's answer per socket, so a client on more than 32 boxes is no longer dropped by the server after every authentication. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No migration required for the new fields: the PeerMessage paymentOutcome and retained payment are optional, and messages without a payment are unchanged. To avoid losing payments, store any returned payment (validate it first; it is the raw envelope value) before acknowledging its message. Install @bsv/sdk 2.8.6 or later alongside this package; payments refused on earlier SDKs remain pending in the message box and can be accepted after upgrading. No BRC100 wire or wallet-data change. SDK consumers may retain ^2.8.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. The live-socket repairs require no API, wire or wallet-data migration. They are client-only and need no coordinated deployment: client and server can be deployed in either order. Two behaviour notes for consumers that worked around the previous defects: getJoinedRooms() reports the rooms joined on the current socket, and mutating that set no longer cancels a rejoin, so call leaveRoom instead; and a dropped socket is kept while Socket.IO reconnects, so code that assumed a drop cleared the socket and that the next call built a fresh one now reuses the existing one. sendLiveMessage now falls back to HTTP instead of throwing when the socket cannot be established, authenticated or joined; a conflicting WebSocket identity pin still throws. Under managerOptions.reconnection: false a drop disposes the socket and nothing rebuilds on its own, so a subscriber that makes no further calls does not recover; that remains the host's choice. A live message is now delivered a tick after it arrives rather than synchronously; that was already the case for an encrypted message, and a consumer asserting synchronous delivery in a test has to let the microtask run. Reading the server's answer to a join corrects the client's record only against a server that names the room on joinFailed, which ships alongside this release; against any other server the client records joins exactly as it did before. The package CHANGELOG lists the rest, for example leaveRoom releasing its room while disconnected. onLiveStatus is additive; nothing that compiled before needs changing. It reports the socket only: listMessages polling stays required for correctness whatever the status says, because a live message reaches only the sockets held by the server process that served the send and a paid message is never pushed. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/mod.js` `./dist/mod.cjs`	`./dist/mod.d.ts` `./dist/mod.d.cts`
`./package.json`	`./package.json`	—

@bsv/output-knowledge

Package documentation: docs/packages/application/output-knowledge.md
Source: packages/application/output-knowledge
Release note: Initial application output knowledge reference runtime, interchangeable durable journals, scoped provider currentness, durable expiry and bounded source equivocation quarantine. Adds an optional installed-proposal policy entry with author-document signature, revision and exact finalization relation checks. Adds pure proposal lifecycle plans for durable reservation, expiry and terminal admission outcomes. Adds bounded Memory and SQLite proposal journals with atomic lifecycle events, admission jobs, cross-channel operation claims and crash recovery. Adds atomic local recovery context and reserved terminal-receipt capacity with shared SQLite limit sealing. Binds retained proposal contracts to exact installed policies and exposes indexed atomic record/context reads. Adds durable proposal service orchestration with current access checks, original contract recovery, receipt/response capacity preflight and a concrete bounded SDK evidence adapter. Adds original evidence-context retention in versioned reservations and a compatible admission recovery argument. Adds optional bounded operation state stores with immutable configuration, atomic compare-and-swap, exact immediate-write recovery and Memory, SQLite and IndexedDB adapters. Adds an optional durable BRC-193 live lookup source with retained opening identity, bounded capture-before-delivery, exact core-receipt cursor gates, progressive snapshot/live ingestion, generation fencing and durable continuity resets. Retains a separate historical bounded full-history revenue-listing verifier with seller-authorized genesis, collect-before-resolve BEEF assembly, both merge parents and explicit covenant execution even for mined transitions. Retains a historical dedicated revenue-listing authority port and software-key implementation that use the same explicit authority identity for seller-authorized genesis and covenant transaction signatures. Adds a separate bounded SQLite root-advertisement journal with signed immutable request retention, independent suppression/restoration bases, frozen action attribution, root-authorized currentness assessments, durable projection intents and a shared cross-process final synchronous enqueue gate. Adds a separate current-format SHIP/SLAP evidence adapter with advertiser authentication, exact consuming-transaction verification and selected-ancestry placement. Adds optional root commit observations with the clock, access, installed policy and external context checked after acquiring the durable gate. Adds portable exact root capability selection and original-manifest recovery with stricter advertised/profile bounds. Adds opt-in atomic original-capability/request retention, narrower result reservations and an explicit transactional root journal format1-to2 upgrade with old-connection fencing. Adds an opt-in Node maintenance companion for bounded pending scans and client-independent expiry under the existing journal gate. Adds optional checked original-contract recovery by durable request digest for installed root workers. Adds opt-in RootEvictionService for received-text intake, original-contract status signing and exact observed-result verification, reusing bounded physical work without changing existing lookup diagnostics. Adds an optional recoverable root scheduler with independent expiry, bounded periodic and wake-driven scans, explicit installed automatic policy and physical shutdown drain. Adds opt-in format3 root-local rule history, complete assessment coverage and reserved lift capacity, with immutable operation fences independent from peer decisions. Direct local advertisement evidence verification shares existing SHIP/SLAP and Bitcoin checks without requiring a peer coordination envelope; currentness and serving policy remain separate. Adds an optional SQLite proposal response enqueue companion, binding a fresh owned channel/proposal read and synchronous disclosure check to the same writer lock through native delivery. Adds optional service-owned proposal response disclosure binding for original request/caller, retained contracts, current authority and exact state at native enqueue. Publication retries now recover an original retained proposal after later channel revisions, under current access and the original deadline. Adds explicit SQLite proposal create/open startup and a private finite maintenance inventory with opt-in bounded expiry/recovery scheduling, physical shutdown drain and retained failure reports. Adds optional LookupResponseDisclosure and a SQLite session native-enqueue port, with original response binding, fresh bounded authorization, durable guards and exclusive expiry after signing. Adds an optional pure worker publication-deadline hook, exact exclusive expiry checks across asynchronous projection work, and owned native response bytes for Node Buffer inputs. Pending context changes now hold publication closed until all overlapping context commits settle, including in-flight workers and projectors. Adds optional proposal source policy, exact-envelope client verification, separate authenticated intent/provider reports, sealed local frame4 replay and durable exclusive expiry across direct reads and runtime publication. Optional proposal implementation stays behind its separate entry. Native IndexedDB tests cover receipt, browser restart and retained expiry. Internal SQLite transaction domains now coordinate journal caches and SQL savepoints without changing existing public constructors or formats. Adds opt-in current-channel query mapping, complete-group authenticated source validation and independent provider/generation projection with additive retained event-order metadata. Providers may accept a narrow domain-owned read/time feed without generic write authority. Adds an optional atomic private proposal/current-feed/session SQLite owner with bounded indexed expiry, reserved future events and complete wire groups, shared monotonic clocks and policy visibility fences. Bounds repeated positive proposal-signature verification to 256 full-envelope identities while preserving every current policy, scope and authorization check. Adds internal encrypted private-service ledger records with authenticated inventory, native atomic capacity/completion reservations and current disclosure guards. Bounds repeated root-request authentication with exact packet/selection identities while preserving every live policy and record check. Adds internal native private-publication storage with retained indexing-key identity, shared protected blobs, independent request fences, ordered admission/binding phases and bounded metadata discovery. Reference demonstrations exercise private admission, authenticated HTTP and acquisition composition; final-source qualification remains a separate gate. Separates complete lineage script-layout and transition validation from graph traversal for bounded full-source qualification, preserving the existing verifier behavior and API. Adds internal exact-output private publication verification, retained signed contracts and atomic native protected lookup binding. Adds optional private/node publication composition with structural storage/admission ports, current verification leases, bounded physical work, original-contract reconciliation, truthful protected-material availability and final native response disclosure. Adds internal paid-acquisition progress, original quote/capability ownership, recipient-safe results, SDK funding evidence and seller/chain funding uniqueness reservations. Adds internal atomic acquisition originals, bounded material/result slots, permanent invoice-prefix reservations and native funding/delivery transitions, plus an explicit bounded local ledger batch option. Adds internal paid-acquisition coordination, native wallet receipt ownership, release-evidence validation, guarded disclosure and opt-in local recovery workers. Exposes opt-in Node-only private acquisition coordination, native custody, release checks, wallet bridging and recovery workers. Adds selected-wallet protected workflow state above existing SQLite/IndexedDB CAS owners, including exact initialization, capacity and lost-ack recovery. Adds explicit immutable native/browser operation-object custody for large original requests, contracts and results, with complete logical reservation and first-byte recovery. Preserves current-channel wire behavior with explicit head/removal grammar and co-locates asynchronous runtime work with its awaited lifecycle. The optional private/buyer entry composes original capability/request custody, complete immutable reservations, explicit one-action payment, unpaid recovery and separate evidence/material usability checks. WalletToolboxBuyerPayment requires an installed durable local action controller and never broadcasts or falls back to ordinary BRC-100 retry. The installed buyer domain policy now performs mandatory original-term and challenge preflight before new quote or financial work, with copied inputs and post-await authority checks; funded recovery remains independent of fresh offer eligibility. Adds optional exact prepared-purchase verification composing BRC-196 original request/terms authentication, predecessor/successor and recipient-bound receipt checks with complete BRC-197 Bitcoin/genesis/Script history verification. Adds optional original BRC-196 purchase contracts and native protected custody with complete request/capability retention, future completion reservations, one transaction/admission intent, exact first signed result and guarded original-term/result enqueue. Purchase verification exposes optional bounded local preparation/ABI diagnostics. Mined release decoding honors the selected caller byte budget while retaining its existing complete-evidence envelope limit. Adds optional staged PrivatePurchaseCoordinator, native recipient access and exact physical response disclosure. Independent installed domain/admission/release ports preserve original reservations, outstanding work and first signed private results across restart. Pure private purchase issuance receives the owned complete candidate BEEF from original native custody as an optional fifth domain argument, enabling independently verified portable C evidence without a transient cache. Adds separate optional private/purchase-buyer and private/purchase-wallet entries: six pre-reserved protected original objects, small durable control state, read-only original wallet/seller recovery, explicit guarded new work and independent delivered usability; concrete native noSend purchase construction independently verifies complete genesis/lineage and refuses complete submission overflow before signing. Old private/buyer exports and size ceilings remain unchanged. Adds optional native cumulative purchase-evidence custody: complete future chunks/updates reserved before preparation, independent incoming and combined validation, exact proof-generation guards at physical effects, and original immutable candidate/result preservation with staged lost-reply recovery. Adds optional synchronous commitPrepared native planning and an explicit installation-bound native-observation-v1 private purchase clock profile, preserving existing commit/default behavior. Adds synchronous native root physical enqueue and composable whole-response root/lookup serving guards, plus an optional protected recipient-authorized publication lookup-context reader. Native independent-root, Mongo/SQLite, authenticated physical-send and public/private isolation examples exercise these optional layers. Isolates the new native root-serving helpers in the explicitly selected portable root-eviction/serving entry, preserving original root coordination exports and budgets. Uses SDK ownOutputJSON for checked value-ownership compositions while preserving raw parsing, current capability and access checks and all wire and persistence contracts. Private purchase progress and retained-record validation use internal helpers with the original ordered checks and failure identities; source-dependent execution plans preserve every complete canonical module and full test selection. Native private ledgers avoid redundant physical head updates within one transaction while preserving fresh authentication, permission and inventory checks, active write-custody validation, pure-read key rotation and durable refusal clocks. Standalone SQLite proposal reads now replay their installed policies within one synchronous read transaction, preserving one metadata/prefix snapshot and rejecting reentry before native connection operations. Standalone SQLite proposal replay now reads bounded 128-entry pages inside one physical snapshot and finishes each native read before invoking installed application policy; an empty delta continues checking persisted entry storage. Adds separately selected immutable-profile lineage and exact purchase verifiers for reserve-stage genesis, public child-link activation, complete raw funding, actual input Script execution and full independently verified purchase commitments. Adds an optional signed-term native buyer fundingPreflight companion that retains an owned synchronous same-view domain guard through planning, custody awaits and the native wallet effect callback. Omitted hooks preserve the complete original preflight and finalized recovery paths. Adds an explicitly selected SQLitePrivatePurchaseCommitmentStore over the complete shared native pipeline, with separately sealed version-two custody and independently verified immutable purchase commitment in every pinned status and signed first delivery. Adds a separately selected commitment access guard that checks sealed custody profile before private policy reads. Adds explicitly selected buyer commitment custody beside the immutable original funded transaction. Private purchase buyers own their normalized original terms request through the additive SDK verifier and repeat every returned packet, association and signature check; domain, access, funding and rights checks remain independent. Adds an explicitly selected WalletToolboxProfilePurchasePayment over the complete shared native noSend intent/funding/layout/recovery pipeline, with both frozen programs, separately bound format-two plans, reserve-stage genesis/activation verification and same-view height eligibility at new financial boundaries. Historical WalletToolboxPurchasePayment options and format-one plans remain compatible; both pin installed owner identities. Adds explicitly selected RevenueListingProfileAuthority for current immutable listing child signing with actual protected-wallet identity, fixed-child and signing preflight, owned asynchronous requests and checked signatures. Retained buyer results are freshly authenticated and missing received-phase commits are healed without a redundant protected-result write. Initial and remote results retain their original custody writes; protected object plans return fresh owned binding copies from their constructor-validated immutable scalar configuration. No public schema, wire, default, authentication/currentness checks or property controls change. Adds internal bounded purchase-alias metadata, encrypted native per-txid custody and same-ledger selected-status projection, with explicit atomic contributions and unchanged exact-txid owners. Native alias effect-owner, coordinator and HTTP integration remain under qualification. Adds an explicitly selected bounded joint native object-read companion while preserving original individual reads, immutable custody, payment and recovery checks; implementation qualification remains in progress. Adds explicit full-commitment alias-custody core3, bounded per-txid admission coordination, independent SDK selected-chain currentness, optional authenticated HTTP alias disclosure inside the same native view, and read-only free buyer alias assessment. Historical signed delivery and currentness remain separate. New whole-runtime companions retain all existing regression sequences and critical mutation controls; controlled fixtures do not qualify the composed financial profile. Native protected-payload cipher calls use fresh secret-key objects and bounded canonical Base64 byte decoding, removing repeated key-brand probing and number-array copies without changing custody checks, authenticated framing or stored envelopes. A shared internal native byte decoder applies the unchanged SDK canonical encoding/limit/refusal contract to retained acquisition chunks and alias storage without intermediate number-array copies; complete helper source remains in the existing critical mutation inventory. Retained purchase access uses the same bounded canonical native byte decoder with the original typed parser representation; every current permission, original request, chunk and policy check remains fresh. First alias result completion derives delivery time at its actual authenticated native commit, accepting normal monotonic clock advancement while retaining head/row conflicts and current authority/placement fences; historical alias and protected result remain one atomic write. Protected ledger plaintext checks canonical encoding during its same complete fresh parse, preserving original UTF-8, resource bounds, noncanonical-record refusal, authenticated record and current custody checks and plaintext zeroing; no record or authority cache is introduced. The protected ledger prepares its fixed record SELECT once per connection; every execution reads current bounded rows and independently authenticates inventory, headers, ciphertext, custody and plaintext. No stored format, reservation, transaction, key-rotation or authorization rule changes. Alias proposals reuse bounded canonical value ownership. Fresh native original-custody restores inspect encoding and pass already canonical owned values to the same closed schema and installed original-contract checks; other accepted encodings retain original normalization. A fresh snapshot serializes only its internally constructed expected binding once while independently checking every stored binding. No custody, schema, key, authority or chain verdict is retained between reads; storage, errors, checks and defaults are unchanged. Fixed private-ledger, alias and purchase grammars retain field names once through the SDK companion. Every input still receives complete fresh ownership, descriptor, scalar, ciphertext, custody, revision, clock and authority checks; legacy/current profile selection and all wire/storage/error contracts are unchanged. No input or validation verdict is cached. Native inventory validates every raw header row with the existing codec, then directly encodes only its private fresh seven-scalar shape in canonical field order; generic caller inventory keeps full JSON validation. Shared aggregate assertions, hash framing, ordering, totals, SQL reads and all current authorization/encryption/custody fences remain unchanged, with no row or verdict cache. Ledger addresses freshly inspect ordinary exact bounded ASCII data records and create new scalar results; proxies retain the original descriptor sequence and all other representations use the original general validator. No caller shape, membership, authorization or validation verdict is cached. Retains immutable alias-coordinator method installation metadata while preserving every fresh property identity check, original getter/short-circuit order and caller authorization boundary. Adds all-installed-method replacement and repeated getter-order regressions; no currentness verdict is cached. Reads every installed alias-coordinator method directly in original order without a per-method callback, preserving cancellation, caller authorization, receiver, short-circuit refusal and all original method identities. The private payload source retains its original six-field grammar and protected-ledger mutant golden. Additional ordinary payload negatives cover every missing, renamed and non-string field without changing original tests. Reuses a frozen six-name protected-payload envelope list while checking each fresh owned string, exact field count, schema, revision, clock, authentication and custody on every open. Original grammar, error ordering and protected-ledger mutant golden are retained. Selects the additive SDK scalar-record inspector through one native ledger import alias for fresh authenticated plaintext while retaining every other ledger byte, custody/authentication/inventory check and stored format. Add an explicitly selected inlined ASCII string-field serializer with fresh original traversal/refusal order and simplify scalar-record grammar without changing canonical bytes. Explicit native ownership uses ownOutputJSONWithInlineStrings for fresh canonical validation and independent data graphs. The current native alias journal and acquisition owner explicitly select fresh inline canonical serialization and one-pass independent ownership; the protected ledger codec selects the canonical companion without changing persisted framing or public interfaces. Alias-state, selection, currentness, coordination and disclosure bindings explicitly select the same existing fresh JSON companions. Purchase contracts retain explicit fresh-copy ownership and canonical JSON companions. Native contract and alias imports explicitly select additive SDK purchase prepare, terms and submit parsing companions; native alias-custody/admission mixed records use the general parser. Public interfaces, stored formats and original tests remain unchanged. Native purchase validation selects fresh inline capability and signed-term companions. Adds explicit owned-record parsing/inspection and recursive canonical/ownership companions, retaining all existing public paths and fresh validation. Extends fresh SDK JSON companion selection through original purchase coordination, custody, cumulative evidence, progress, payload identity and disclosure imports; all native method bodies remain unchanged. Add explicit fresh-ownership purchase-envelope, commitment, POTATOES and release-evidence companions, with original signature/request binding and no retained input or verdict; private-purchase bindings select them through imports while ordinary entry points remain unchanged. Internal explicit schema ownership counts complete canonical bytes without building discarded composite text, retaining all fresh guards and independent copies; qualification remains required. Adds opt-in counted value-only ownership and audited native import bindings; full byte/representation guards, original method bodies and text-requiring paths are retained. Carries explicit purchase and release parsing through fixed nested policy, STEAK and release-evidence companion grammars while retaining ordinary schemas, nested JSON text, complete bounds/refusals and signature/request bindings; internal deep helpers add no root export or input/verdict cache. Nested companion grammars are instantiated lazily as fixed validator configuration so unused browser paths can be removed; every supplied representation and authority check remains fresh. Adds freshly checked exact native protected-envelope lexical ownership and canonical Base64 allocation companions; all nonmatching/refusal forms retain the original readers, custody and authentication remain fresh, and no validation or authority state is cached. Worker passes release their single-pass guard when an installed clock throws before replay, preserving the original failure and allowing the same worker and journal to retry after clock recovery. Wallet source refreshes release their active slot when an installed clock throws before wallet I/O, preserving the original error and allowing the same adapter to retry after clock recovery. Supports SDK4 ordinary numeric output-count pages and refuses module balance aggregates before emitting an empty-scan completion. WalletOutputSource rejects BRC-112 ordinary and module balance queries before invoking the wallet; numeric summaries cannot be mistaken for output-count pages or empty-scan completion. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: New opt-in package requiring SDK ^3.3.0, which introduces the output-protocol APIs; SDK3.0–3.2 do not provide these APIs. Preserve wallet custody and explicit action authorization; do not infer spending from source membership changes. New journals seal configured currentness rules in local frame v3 with canonical assessment ordering. Existing v1/v2 journals retain their encoding and replay behavior when read or extended. Adopting v3 for an older journal or changing policies requires a new namespace; retain the old journal for audit and recovery. Body-only proposal journal entries retain their bytes and retry keys. Upgrade all SQLite proposal writers before relying on reserved completion capacity; capacity limits are sealed, and older pending jobs do not gain retroactive guarantees. ProposalService requires durable context/capacity storage, an authenticated transport, a current host access policy and idempotent durable topic admission. SDKProposalEvidence verifies exact BEEF/Script against an installed immutable chain view; it does not replace topic rules or establish unspentness. Legacy proposal-service/1 records remain readable; rich evidence reservations use local proposal-service/2, so upgrade readers before writing v2. Context-required admission cannot synthesize missing legacy material. Reservation verification and actual durable topic assessment remain distinct. Import workflow control storage from ./operations or ./operations/sqlite. These local CAS cells do not replace receipt journals or validate protocol transitions. Use explicit create only for new workflow identities; recover existing storage with open, and treat absence as lost state. Existing exports and journal formats remain unchanged. Import the live adapter from ./sources/live-lookup. Create its durable control cell once before network I/O, recover that exact cell after restart, and reuse the source instance across cancelled or uncertain connection attempts. Its local control format is output-live-lookup-source/1. Lost continuity requires an explicit new source generation; a local reset never manufactures a successful cursor or Bitcoin spend. Existing finite adapters and their browser entry are unchanged. Import the optional revenue-listing entry explicitly and supply the authenticated fixed program plus an installed immutable chain view. Its historical verdict does not establish asset authority, currentness, acquisition association or private fulfillment. No existing root export, wire format or journal migration. The optional revenue-listing authority port requires explicit dedicated key custody and installed consent policy; it never extracts a wallet funding root key or substitutes BRC-100 derived identities. Its signature checks do not establish full-transaction validity, lineage or fulfillment, and it introduces no existing stored-format migration. Root storage is opt-in through root-eviction types and root-eviction/sqlite. Explicit creation uses a new database file; recovery never creates missing state or changes its sealed identity, chain or capacities. All service instances and serving adapters must share the same durable gate. The journal does not install requester authority, validate advertisement BEEF/Script, implement broader bans or expiry scheduling, or mount HTTP handlers. Current authorization, evidence policy, index integration and final middleware enqueue qualification remain service responsibilities; do not advertise the full BRC-199 profile from this component alone. Import SDKRootEvictionEvidence from root-eviction/evidence with an installed immutable chain resolver and owned verification context. Its verified facts do not authorize suppression/restoration or establish currentness, and operator references are not fetched or automatically authorized. No existing wire or stored-format migration. Existing deterministic root methods and stored format remain unchanged. The optional RootEvictionCheckedStorage companion requires synchronous trusted clock/access/context callbacks that share the same physical gate or an independently coherent local port. Retain the returned observed head through signing and recheck it at final enqueue. These methods do not install network authentication, chain currentness or operator policy. RootEvictionContracts requires the original retained selector on recovery. Its record must be persisted atomically with first intake; the portable helper does not itself store that record; use the optional coordinated journal for atomic intake. RootEvictionCoordinatedStorage is an optional companion. Existing configurations retain exact root-eviction/1 behavior. New coordination configurations use root-eviction/2 and a sealed bounded original-contract byte capacity; upgrade existing files only through upgradeCoordination with the same root, chain and prior capacities. Already-open old connections fail after upgrade. Preserve backups and all history; missing legacy selections remain unavailable and cannot be invented from current discovery. HTTP, broader local bans, scheduling and all serving adapters remain separate requirements. SQLiteRootEvictionMaintenance opens an existing root journal with its exact sealed configuration; no new format or implicit creation. Install synchronous root-maintenance authorization and a trusted clock. Schedule bounded startup and periodic scan passes, restarting without a cursor at each pass end. Maintenance does not grant requester status access, process peer decisions or restore eligibility. RootEvictionRecoveryStorage preserves existing interfaces and formats. Authorize its worker guard independently of requester status access; missing original selections remain unavailable. Run maintenance expiry even when current chain/context checks prevent richer recovery. New service installations pass strictly decoded received UTF-8 text and an available manifest snapshot; third-party coordinated adapters implement its text-intake contract. Returned observations still require the native final-enqueue revision and current-access guard. Existing parsed packet calls and lookup defaults remain unchanged. RootEvictionScheduler is opt-in and defaults to manual/advisory expiry. Use maintenance and recovery ports for the same sealed journal; install automatic policy and guarded authority explicitly. Observe its lifetime and reports, stop intake and await physical drain before closing injected storage. No existing interface, stored format or default route changes. SQLiteRootEvictionLocalRules requires coordination plus explicit localRules configuration. Preserve formats1/2; upgrade format2 only with upgradeLocalRules, preserving exact prior capacities and fencing older connections. Install trusted rule evaluation and operator attribution separately, report unknown results as null and complete projection before serving. Local active rules reserve future lift records/epochs/revisions; permanent history is never silently reclaimed. The optional evidence entry adds SDKRootAdvertisementEvidence; the existing signed-request verifier and its authority checks remain compatible. Existing proposal journal bytes and methods are unchanged. Opt into responseEnqueue only with a transport guard that runs after signing and supplies exact response/record, original-contract, retention and current-access validation. All authorization writers require the same gate or explicit coherence; callbacks are synchronous and cannot reenter. Responses are bounded to 4 MiB, with smaller selected-contract limits enforced by disclosure. Track actual enqueue independently: a subsequent error cannot undo delivery or authorize a replacement response. The new ProposalResponseDisclosure companion is opt-in and runs with ProposalJournalSend after signing; current host access must share its policy domain. Retrying an older recorded publication returns its original acknowledgement without replacing the current head; no stored-format migration. Existing journal constructor behavior is preserved. Use create only for intentional installation and open for restart; missing sealed state fails rather than resetting the namespace. Observe the optional scheduler lifetime and drain stop before closing dependencies. These additions neither compact terminal fences nor initiate new finalizations. No existing schema, wire or default behavior migration. Opt in with the same sessions/contracts/current authorization and an explicit synchronous control policy. All relevant writers must share the durable guard protocol; native callbacks cannot await, close or reenter storage. Existing workers may omit nextInvalidation. Installed deadline hooks must be pure and paired with durable invalidation in advance; applications still retire previously displayed activity at its deadline. Existing expired-assessment behavior and stored/wire formats remain unchanged. Await setContext before treating a new verification context as committed; flush does not complete a pending context write. No new wire or storage migration. Use a new journal namespace when enabling proposal acceptance or changing its reader/source/policy installation. Existing default local frames and unaccepted proposal-group behavior remain unchanged; no implicit upgrade or downgrade. Install same-name source/proposal services under the existing observation contract. Authenticated proposal heads are signed variants, not a current-channel selection; provider states remain reports and do not authorize Bitcoin or application effects. A separately registered query/projection and current private authorization remain necessary. Existing stores may omit the new pure reducer deadline hook; a due hook requires durable worker invalidation before reads, including historical publication. The runtime permits one bounded recovery when expiry crosses after worker return. The SQLite journal/index refactor preserves existing constructors, namespace formats and default behavior. Internal shared transaction and savepoint domains coordinate SQL with staged journal caches; they are not public raw-SQL or authorization ports. Independently opened adapters are not atomic compound writers. Failed rollback retires uncertain connections; preserve the original operation for durable recovery. The shared primitive alone does not enable the optional compound profile. Install the query and exact source/reader policy explicitly; wrap an already connected durable BRC103 live source and project only published core input. Current intent does not establish complete history or effect authority. Legacy manual views lack required order/generation facts. Empty completed generations retire prior state. Select the separately sealed compound owner explicitly; the client components do not install it automatically. Import the Node-only factory from ./proposals/channels-sqlite. Initial create is atomic; recovery open requires all original components and sealed limits. Route every producer through its journal or bounded batch commit, and use its feed/sessions for lookup. Fresh authorization must include the mandatory policy visibility guard returned by authorizeLookup, in addition to current host access guards. A pure optional readVisibility descriptor preserves read continuity only when equal values mean identical permissions for every principal; omitted hooks conservatively compare the full signed body. No standalone format migration or automatic compaction is introduced. Retain all service-identity history and fences when capacity is exhausted. The transient signature cache retains no payloads or durable decisions; no wire or storage migration is needed. The protected ledger requires explicit exclusive creation, stable external store identity/custody and consistent whole-database/key backup. It has no remote mutation endpoint or automatic initialization/compaction; complete qualification of the publication and acquisition compositions remains required. The in-memory root signature cache changes no persisted or wire format. Preserve the authoritative private database and its separate indexing/encryption custody; opening never creates replacement state. No existing application behavior changes. The private lineage implementation extraction requires no consumer, wire or storage migration; existing revenue-listing imports and verification decisions are unchanged. Existing private storage calls and version-1 records retain their behavior. Verified staging is an explicit optional installation and uses version-2 fences with the original contract; missing legacy context requires explicit reconciliation. The optional Node private publication entry requires an explicitly created or reopened seller/chain domain, protected custody, installed domain validation and current access/chain policy. Existing ordinary imports, two-argument publication storage and version-1 fences retain their behavior. Metadata-backed unavailable status preserves original obligations and never recreates material; restoration is explicit. Drain reconciliation and physical coordinator work before closing custody. HTTP publication remains separate from private lookup acquisition and purchase release. The paid-acquisition composition preserves existing stored formats and commits funding fences with progress atomically. Original quote/material ownership, wallet recovery, release policy and guarded HTTP delivery are coordinated through the installed private/node service. The native acquisition owner adds no migration of existing stored formats. Preserve original custody and all outstanding obligations; the local batch option is explicit and the existing default/SDK wire ceiling is unchanged. Domain/release verification, wallet reconciliation and final authenticated HTTP composition remain required. Install original-obligation domain policies and a durable wallet controller explicitly; worker authority does not bypass buyer or domain permission. Drain actual work before closing custody. The wallet package remains a development-only dependency; runtime applications explicitly supply the durable controller. Existing entries remain compatible; new applications explicitly install the private/node acquisition ports and follow the acquisition/recovery guide. Protected control state is opt-in through operations/protected; preserve original wallet custody and reserve complete ciphertext capacity. Large delivered results require their own owner. Operation objects are opt-in through operations/objects and operations/objects/sqlite, with dedicated original storage and supplied custody. No existing store, export or wire migration. Reserve every promised object before financial effects; logical capacity does not replace physical quota, backup or whole-store rollback policy. Reads never recreate missing state and retained first bytes cannot be replaced. New private/buyer installations must provide preflight alongside verify and usable. This newly introduced entry changes no existing wire or custody records; preflight cannot perform financial effects. RevenueListingPurchaseVerifier is opt-in through revenue-listing; it adds no stored or wire migration. Preserve original request/terms and independently select the seller and chain context. Historical domain verification does not authorize funding, admission, release or usability; these remain separate durable workflows. Private purchase custody is opt-in through private/node and adds separate typed records without migrating existing acquisition/publication state. Install domain validation, actual retained topic admission, selected release-policy verification, protected material and current authenticated disclosure explicitly; custody primitives alone do not establish those premises. Preserve original database, keys, request fences and outstanding obligations. Refusal reasons are local diagnostics, not wire/global verdicts. Compose real covenant/domain validation and retained admission before enabling the optional purchase workflow; controlled lifecycle fixtures do not establish Bitcoin truth. Stop and drain the coordinator before closing protected custody. Existing four-argument private purchase issue adapters remain compatible; new complete-evidence issuers require the retained candidate supplied by the updated coordinator. No persisted or wire format changes. New covenant buyers explicitly create or reopen protected owners with privatePurchaseBuyerBinding, six immutable slots and a 16384-byte control envelope. Supply independent preflight/verify/usable and synchronous current permission. Install the structural native action owner and exact family/selected chain context through private/purchase-wallet; use the existing maxOutputsPerAction1/migrationInputsPerAction0 managed-change profile to fit the covenant layout. Preserve refused prepared intents for explicit wallet recovery/abort; timeout never chooses another transaction. recover performs no new funding/signing/submission; advance alone authorizes original work, and retained finalized bytes may fulfill their original recovery promise after construction cutoff. Stop/drain owners before storage shutdown. Native synthetic tests establish actual Script/genesis and lost-reply custody; complete exact-source qualification of the authenticated topic/admission/release/LCH workbench remains required. Install the cumulative evidence owner before new BRC-196 preparations using the original native domain and sealed limits. Existing obligations retain their original owner; missing proof custody is never automatically initialized during recovery. Omitted-companion behavior remains compatible. Choose native-observation-v1 only when installing new private purchase custody; retained state authenticates the original profile, and mismatched or older readers refuse opt-in records. Existing obligations require their original profile until reconciled. This local persistence choice changes no signed terms, wire packet, financial identity, deadline or payment authority. Native planning callbacks are synchronous local calculation only, with owned bounded plans, current authority rechecks and unchanged CAS/capacity guards. Plain revenue BEEF is selected by its explicit declared txid and requires that raw subject independently of record order. Any Atomic BEEF marker must match; complete bounded Script, economic and authorized-genesis checks remain required. This changes no wire or persisted format. Import RootAdvertisementServing and RootLookupServingDisclosure explicitly from ./root-eviction/serving. The original coordination entry preserves every prior export and browser budget; these newly introduced unpublished helpers have their own measured entry. Install RootAdvertisementServing only with the native root-serving-send/1 gate and a complete bounded positive inventory. RootLookupServingDisclosure preserves provider-then-root lock order; stale whole signed responses require a new identifier-free control. PrivatePublicationLookupContext requires explicit current recipient rules in the protected domain and request-local Engine hydration; it neither charges nor issues material. Existing asynchronous root enqueue, publication status and legacy public lookup remain compatible. No existing schema, receipt or wire changes are required. Owned-value copying introduces no API, wire, storage or custody migration; callers still explicitly validate schemas and current authority. The internal validation extraction changes no private purchase wire or persisted schema, authority freshness, financial effect, context clock or disclosure behavior; no caller migration is required. The proposal read ownership guard requires no caller, wire or persisted-format migration. Installed synchronous policy callbacks must not reenter journal operations; sequential reads and independently opened writers remain supported. No caller, wire or schema migration is required for bounded standalone proposal replay. Its synchronous ownership gate and existing policy, storage-integrity and authority checks remain in force. Select RevenueListingProfileLineageVerifier, RevenueListingProfilePurchaseVerifier and parseRevenueListingProfileLineagePackage for the current PR295 immutable family. Earlier non-Profile names retain the historical pre-replacement contract and are not current-family qualification. This additive component requires no existing wire/store migration; the separate current private wallet, alias custody and LCH integrations require complete exact-source qualification. Existing purchase buyers may omit fundingPreflight without migration. Current domains bind the selected companion in their validation installation ID, return an owned synchronous stable checkCurrent guard and recheck it immediately before effects through the supplied wallet callback. This companion does not implement native alias reconciliation or reinterpret stored obligations. Select the commitment owner before preparation and bind its complete verifier/guard contract in the installation identity. The historical five-argument store constructor, pin method and version-one declarations remain unchanged. The owners refuse cross-profile custody; no automatic migration or alias reconciliation is introduced. Pair SQLitePrivatePurchaseCommitmentStore with the explicit fourth full-purchase-commitment-v1 argument to PrivatePurchaseAccess; the three-argument access constructor retains exact historical state1 behavior. Profile mismatches fail before private request policy reads. No automatic custody migration or alias authority is introduced. Select PrivatePurchaseBuyer candidateProfile before calculating the storage binding, provide the independent complete candidateBinding verifier, and reserve seven protected objects including the bounded original identity. Omitted mode keeps six original reservations and exact-txid defaults. Signed alias representation remains received until independent released-subject and usable-rights verification; historical recovery retains the first protected identity and never allocates a replacement wallet action. Select WalletToolboxProfilePurchasePayment explicitly with the current RevenueListingProfile and original recoverable action owner. Preserve its separately bound format-two plans and both program hashes; never reinterpret historical format-one custody or create another financial intent after a missing reply. The current reference composition installs native listing funding, protected fixed-child remittance, alias reconciliation and authenticated HTTP as separate responsibilities. Select RevenueListingProfileAuthority from the optional revenue-listing entry for the current family. Supply an independently chosen identity, explicit originator and synchronous current authorization fence; await actual child signing preflight before genesis funding. Independently approve the complete funded plan, lineage and roles. The adapter creates no funds or transaction and cannot undo an already produced wallet signature. Historical authority APIs, defaults, wire formats and custody remain unchanged; the current native all-route and combined release composition is implemented, with complete final-source qualification required. The optional local objectReadProfile joint-custody-v1 requires a qualified readMany object-store companion; omit it to retain existing individual reads. This read strategy changes no wire packet, original binding or persisted custody format. New acquisitions may explicitly install SQLitePrivatePurchaseAliasStore and PrivatePurchaseAliasCoordinator with SQLitePrivatePurchaseAliases on the same domain/contracts and select alias-custody-v1 access. Prepay complete terminal result and selected/pending alias capacity before exposing terms. State3 and the request-fence profile are distinct; never reinterpret old rows. Native constructors are in private/node; portable SDKPrivatePurchaseAliasCurrentness and PrivatePurchaseBuyerAliasCurrentness are in private/purchase-buyer. Install PrivatePurchaseAliasDisclosure through the optional Overlay Express prepareAsync hook. Buyer currentAlias performs only free recovery and independent domain/chain assessment; it never replaces a retained License/key or wallet intent. Missing currentness cannot re-gate historical rights. Source checks are not native, whole-mutation, packed/browser, exact-head or Checkpoint2 qualification. See docs/guides/private-purchase-alias-custody.md. Native protected-payload boundary optimization requires no API, wire, persisted-format or custody migration: every call still resolves current custody, derives its key afresh and authenticates the original binding. Independent original Buffer-key framing remains readable, and newly written envelopes remain readable by the original framing. Shared native decoding retains all original bytes, hashes, validation, custody and authority checks; portable SDK decoder return types and defaults remain unchanged. No caller, wire or persisted-data migration is required. This internal native conversion preserves custody formats, accepted encoding and bounds, errors and currentness checks; no migration is required. No result, alias, ledger or clock-profile migration is required by this completion correction. Native header inventory framing requires no API, wire or persisted-format migration; the original ordered digest and all refusal boundaries are retained. Alias-coordinator method metadata changes no public declaration, installation selection, wire packet or stored custody format; no caller migration is required. The direct alias-coordinator method checks require no API, wire, stored-data or consumer migration. Every property identity and current authorization is checked afresh; no input, key or currentness verdict is cached. Fixed protected-envelope field names require no API, wire, stored-data or consumer migration; every field and current custody decision remains freshly checked. Native scalar inspection requires no public-interface, stored-data or recovery migration; no record or authorization verdict is cached. Full current-head runtime and mutation qualification remains required. The inlined string-field serializer is opt-in; native private payload/ledger aliases select it. Ordinary SDK serialization, stored bytes, errors and resource limits are unchanged; no migration or input/verdict cache is introduced. Complete current-head runtime and mutation qualification remain required. Ordinary ownership stays unchanged; the protected native ledger explicitly selects the additive companion with all representation/resource and authority checks retained, without input or verdict caching. No migration for these native import selections: wire bytes, storage, ownership, error observations, resource bounds and portable/ordinary SDK defaults remain unchanged; exact-head runtime and full mutation qualification remain required. These explicit bindings retain every public interface, stored format and original guard; no migration is required. These additional import bindings require no public API, wire, persisted-record or consumer migration. Fresh validation remains mandatory on every call; full hosted properties and mutation qualification remain required. Existing signatures and wire encodings remain unchanged. Text/byte purchase inputs retain the general parser, object inputs select fresh independent ownership, and native alias records use the general mixed-value parser. Three explicit purchase parser companions add root SDK exports, alongside one internal deep-module schema export. Ordinary purchase parsing retains its previous path; native callers explicitly opt in. No input or verdict cache is introduced; full hosted qualification remains required. Native purchase contracts explicitly select additive inline companions for capability selection and retention, packet digests and verification, and signed purchase terms. Each invocation owns and validates its complete input afresh. Historical capability restoration still checks the recorded selection time, original signature, selected endpoint, identity, chain, selector, installed rules and digest. Current caller authorization and actual operation deadlines remain separate checks. Ordinary SDK entry points, wire text and bytes, canonical encodings, resource limits, error identities and custody formats retain their existing behavior. No input, parsed packet, shape, secret, currentness or authority verdict is cached; only the existing bounded mathematical signature facts and fixed grammar are shared. This is an implementation choice with identical protocol semantics, not a new advertised protocol profile. Hosted property and full mutation qualification remain required. Current native private-state imports explicitly select the owned-record and recursive inline implementations. No wire, persistence, caller-interface, resource-limit or authority migration is required; representation ownership remains separate from schema, signature and current-operation checks. Existing ordinary and opt-in SDK entries remain available; full hosted qualification is required. No new export, caller, wire, persistence, signature, authority or resource-limit migration is required for these import bindings; each representation is independently checked and owned anew. Complete exact-head hosted runtime and mutation qualification remain required. No public interface, wire, protected-envelope or stored-record migration. The native codec selects the representation companions internally; original readers remain available and all original tests and ledger engines are preserved. Hosted runtime and complete mutation qualification remain required. Current profile validation accepts ordinary Bitcoin-final Script/domain-valid transitions. Explicit pending-candidate custody and journaled rejection recovery preserve original commitment, terms, recipient, deadlines and all prior operations/decisions. Historical installations and formats are not silently migrated. Fresh eligible recovery must consult durable topical history before any external effect. No interface, wire, storage or configuration migration is required for clock-initialization failure recovery; retry the same worker and store after repairing the installed clock. No migration is required for wallet source clock-failure recovery. Retry the same source after repairing the clock; non-cancellable wallet I/O retains its existing capacity until it settles. With SDK4, call module balance queries separately from WalletOutputSource; decimal balance aggregates are not output-discovery pages. Wallet output enumeration requires an inventory query; read balance summaries separately. No automatic fallback or wallet-data migration. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.js` `./dist/index.js`	`./dist/index.d.ts`
`./package.json`	`./package.json`	—
`./sources`	`./dist/sources/index.js` `./dist/sources/index.js`	`./dist/sources/index.d.ts`
`./sources/live-lookup`	`./dist/sources/live-lookup.js` `./dist/sources/live-lookup.js`	`./dist/sources/live-lookup.d.ts`
`./sqlite`	`./dist/storage/SQLiteJournal.js` `./dist/storage/SQLiteJournal.js`	`./dist/storage/SQLiteJournal.d.ts`
`./proposals`	`./dist/proposals/index.js` `./dist/proposals/index.js`	`./dist/proposals/index.d.ts`
`./proposals/sqlite`	`./dist/proposals/SQLiteProposalJournal.js` `./dist/proposals/SQLiteProposalJournal.js`	`./dist/proposals/SQLiteProposalJournal.d.ts`
`./operations`	`./dist/operations/index.js` `./dist/operations/index.js`	`./dist/operations/index.d.ts`
`./operations/sqlite`	`./dist/operations/SQLiteOperationStateStore.js` `./dist/operations/SQLiteOperationStateStore.js`	`./dist/operations/SQLiteOperationStateStore.d.ts`
`./lookup`	`./dist/lookup/index.js` `./dist/lookup/index.js`	`./dist/lookup/index.d.ts`
`./lookup/sqlite`	`./dist/lookup/sqlite.js` `./dist/lookup/sqlite.js`	`./dist/lookup/sqlite.d.ts`
`./revenue-listing`	`./dist/revenue-listing/index.js` `./dist/revenue-listing/index.js`	`./dist/revenue-listing/index.d.ts`
`./root-eviction`	`./dist/root-eviction/index.js` `./dist/root-eviction/index.js`	`./dist/root-eviction/index.d.ts`
`./root-eviction/sqlite`	`./dist/root-eviction/SQLiteRootEvictionStore.js` `./dist/root-eviction/SQLiteRootEvictionStore.js`	`./dist/root-eviction/SQLiteRootEvictionStore.d.ts`
`./root-eviction/evidence`	`./dist/root-eviction/SDKRootEvictionEvidence.js` `./dist/root-eviction/SDKRootEvictionEvidence.js`	`./dist/root-eviction/SDKRootEvictionEvidence.d.ts`
`./proposals/channels-sqlite`	`./dist/proposals/SQLiteProposalChannelStore.js` `./dist/proposals/SQLiteProposalChannelStore.js`	`./dist/proposals/SQLiteProposalChannelStore.d.ts`
`./private/node`	`./dist/private/node.js` `./dist/private/node.js`	`./dist/private/node.d.ts`
`./operations/protected`	`./dist/operations/protected.js` `./dist/operations/protected.js`	`./dist/operations/protected.d.ts`
`./operations/objects`	`./dist/operations/objects.js` `./dist/operations/objects.js`	`./dist/operations/objects.d.ts`
`./operations/objects/sqlite`	`./dist/operations/objects-sqlite.js` `./dist/operations/objects-sqlite.js`	`./dist/operations/objects-sqlite.d.ts`
`./private/buyer`	`./dist/private/buyer.js` `./dist/private/buyer.js`	`./dist/private/buyer.d.ts`
`./private/purchase-buyer`	`./dist/private/purchase-buyer.js` `./dist/private/purchase-buyer.js`	`./dist/private/purchase-buyer.d.ts`
`./private/purchase-wallet`	`./dist/private/purchase-wallet.js` `./dist/private/purchase-wallet.js`	`./dist/private/purchase-wallet.d.ts`
`./root-eviction/serving`	`./dist/root-eviction/serving.js` `./dist/root-eviction/serving.js`	`./dist/root-eviction/serving.d.ts`

@bsv/overlay

Package documentation: docs/packages/overlays/overlay.md
Source: packages/overlays/overlay
Release note: Maps SQL NULL output block heights to absent confirmation metadata without inventing a height or changing stored state. Strict engine height validation remains unchanged. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Explicit lookup history retains selected confirmed predecessors instead of truncating them at a Merkle proof; unrequested history and ordinary proof serialization are unchanged. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. SHIP/SLAP advertisement validation accepts topic and service names with digits up to 256 bytes, matching the SDK overlay name grammar and the BRC-207 per-asset names. Maps SQL NULL output block heights to absent confirmation metadata without inventing a height or changing stored state. Strict engine height validation remains unchanged. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Explicit lookup history retains selected confirmed predecessors instead of truncating them at a Merkle proof; unrequested history and ordinary proof serialization are unchanged. Adds an optional retained-admission history contract and explicit Mongo retention. New opt-in commits preserve bounded immutable identity alongside the existing public receipt; trusted history reads bind applied topic, policy, context and operation after restart without asserting current unspentness or visibility. Legacy submission, receipt bytes and database validators remain unchanged. Adds the optional proposal-admission entry: an Engine bridge that recovers original retained topic receipts, isolates selected-topic disclosure, bounds physical concurrency and preflights complete result capacity before ordinary submission. Adds the optional private-publication-admission entry, using existing off-chain values and original retained public admission with explicit history-reuse policy, current installed-context guards, finite request/result/concurrency bounds and selected-output membership. Proposal and private adapters share the same original-assessment validator. Trusted opt-in retained admission history now supplies its original atomic server acceptance time, separately from unchanged ordinary receipt bytes; a timed selected-topic companion requires that provenance instead of substituting recovery time. Adds an optional selected-host OverlayPurchaseAdmission bridge restoring the original authenticated selection and original retained topic receipt/time after lost or duplicate submit replies. No private material enters ordinary Engine submission or GASP. Adds explicit bounded public BEEF ancestry retention for new atomic admissions, preserving raw ancestors below a current leaf proof. Adds separate node/topic-scoped historical output reads and opt-in pinned GASP history hydration; ordinary payload/read/serialization defaults stay unchanged. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Adds an optional Engine.onTopicFailed reporter and the exported TopicFailureReporter type so a host can observe each per-topic submit validation failure, which the STEAK otherwise reports identically to a duplicate or an empty admission. The reporter is unset by default, called inside a try/catch, and adds no constructor parameter. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No wire, API, or database migration. Deploy the reviewed patch through the protected release workflow; retain existing validation and configured resource bounds. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. For UMP lineage, deploy this engine patch together with overlay-topics 2.0.1 or an equivalent custom UMP history decider. Existing selector decisions and resource bounds remain unchanged. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. Overlay names: names accepted before are still accepted; no migration is required. No wire, API, or database migration. Deploy the reviewed patch through the protected release workflow; retain existing validation and configured resource bounds. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. For UMP lineage, deploy this engine patch together with overlay-topics 2.0.1 or an equivalent custom UMP history decider. Existing selector decisions and resource bounds remain unchanged. None for existing consumers. To retain provenance for new commits, explicitly construct MongoOverlayStorage or MongoAdmissionStorage with retainAdmissionHistory: true. Existing receipts are not rewritten or retroactively certified; history remains unresolved when binding material is absent. Readers must authorize and project private multi-topic results. Disable the option to return to legacy writes; saved metadata remains compatible with legacy receipt readers. No database schema migration or deployment is performed. The new proposal-admission entry requires the SDK3.3.0 candidate or a compatible later3.x release, explicit retained-history storage and an installed immutable service/topic/rules binding. Existing root exports and SDK peer floors remain unchanged. Use it only behind ProposalService durable reservation, exact policy/transaction verification and authenticated access; missing history stays unresolved, and old receipts are not synthesized. Drain recovery calls before replacing Engine/storage/topic configuration. The new private-publication-admission entry requires SDK3, retained-history storage, an explicit public-history reuse policy and independent publisher/schema/Bitcoin validation plus durable reservation. It does not enable private HTTP, lookup readiness or paid delivery. Existing public submission and proposal behavior remain unchanged; no stored receipt is rewritten. Ordinary receipt and storage formats remain unchanged. Retained Mongo history reads the immutable committed operation timestamp. Legacy history providers may omit it; profiles requiring original time remain unavailable until that provenance exists, with no automatic reconstruction. Install the purchase-admission entry explicitly with topic rules, domain profile and admitted successor index. It requires independent domain validation and a reserved private intent; legacy receipt histories without original commit time cannot establish this stronger premise. Opt into retainedBEEF with a complete positive byte budget at most4MiB when original public ancestry is required. Older records without manifests preserve older reads; missing or damaged promised manifests fail closed. GASP historicalOutputs requires an explicit installed history port and supplies no current-membership or unspentness claim. Every root-serving source writer must invalidate affected eligibility before effects and reassess/reconcile afterwards; no stored/wire migration is automatic. OverlayPurchaseAdmission.assessRecovery is a read-only bridge to exact retained topical acceptance. It uses a guarded local full commitment, never submits or accounts a sale, and cannot treat mining alone as admission. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. Existing Engine construction, STEAK shapes, wire formats, and storage behavior are unchanged; set engine.onTopicFailed only where per-topic failure observability is wanted. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/esm/mod.js` `./dist/cjs/mod.js`	`./dist/types/mod.d.ts` `./dist/cjs/mod.d.ts`
`./*.ts`	`./dist/esm/src/.js` `./dist/cjs/src/.js`	`./dist/types/src/.d.ts` `./dist/cjs/src/.d.ts`
`./storage`	`./dist/esm/src/storage/Storage.js` `./dist/cjs/src/storage/Storage.js`	`./dist/types/src/storage/Storage.d.ts` `./dist/cjs/src/storage/Storage.d.ts`
`./storage/*.ts`	`./dist/esm/src/storage/.js` `./dist/cjs/src/storage/.js`	`./dist/types/src/storage/.d.ts` `./dist/cjs/src/storage/.d.ts`
`./storage/*`	`./dist/esm/src/storage/.js` `./dist/cjs/src/storage/.js`	`./dist/types/src/storage/.d.ts` `./dist/cjs/src/storage/.d.ts`
`./proposal-admission`	`./dist/esm/src/ProposalAdmission.js` `./dist/cjs/src/ProposalAdmission.js`	`./dist/types/src/ProposalAdmission.d.ts` `./dist/cjs/src/ProposalAdmission.d.ts`
`./private-publication-admission`	`./dist/esm/src/PrivatePublicationAdmission.js` `./dist/cjs/src/PrivatePublicationAdmission.js`	`./dist/types/src/PrivatePublicationAdmission.d.ts` `./dist/cjs/src/PrivatePublicationAdmission.d.ts`
`./purchase-admission`	`./dist/esm/src/PurchaseAdmission.js` `./dist/cjs/src/PurchaseAdmission.js`	`./dist/types/src/PurchaseAdmission.d.ts` `./dist/cjs/src/PurchaseAdmission.d.ts`

@bsv/overlay-discovery-services

Package documentation: docs/packages/overlays/overlay-discovery-services.md
Source: packages/overlays/overlay-discovery-services
Release note: Adds the unique MongoDB _id tie breaker to discovery pagination so bounded overflow probes preserve stable ordering. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. isValidTopicOrServiceName, SHIP/SLAP admission, WalletAdvertiser and SHIP/SLAP lookup filters accept topic and service names with digits up to 256 bytes, matching the SDK overlay name grammar and the BRC-207 per-asset names. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No wire, API, or database migration. Deploy the reviewed patch through the protected release workflow; retain existing validation and configured resource bounds. SDK consumers may retain ^2.4.0 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. Overlay names: names accepted before are still accepted; no migration is required. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/esm/mod.js` `./dist/cjs/mod.js`	`./dist/types/mod.d.ts` `./dist/cjs/mod.d.ts`
`./*.ts`	`./dist/esm/src/.js` `./dist/cjs/src/.js`	`./dist/types/src/.d.ts` `./dist/cjs/src/.d.ts`

@bsv/overlay-express

Package documentation: docs/packages/overlays/overlay-express.md
Source: packages/overlays/overlay-express
Release note: Pages built-in discovery overflow probes within the discovery service 1000-row query bound, retaining the configured engine ceiling and explicit overflow failure. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Adds registerRouter so applications can mount routers during start(), after BRC-103 authentication and before the admin routes and 404 handler, inheriting CORS, body parsing, response limits and req.auth. Adds optional progressive and resumable live lookup routes with a structural provider companion, exact signed capability selection, bounded raw request parsing, fresh authenticated principals, no-store responses and cancellation. configureOutputLookup reuses the existing authentication session and server capacity. Legacy routes, finite lookup behavior and default startup remain unchanged; retained-admission history remains opt-in. Add an optional root-advertisement final HTTP send companion with current data/control authorization and bounded signed reset replacement. Adds explicit authenticated root coordination request/status routes with fatal UTF-8 decoding, original raw byte limits, bounded intake and the shared final-send guard. configureRootEviction integrates them before host parsing, sharing wallet/session authentication and request capacity with existing companions. Adds an optional authenticated proposal router and lazy native configureProposals integration with exact retained response disclosure after signing, shared origin authentication and bounded physical service work. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an optional structural lookup disclosure companion for current-session native enqueue after signing, with one separately authorized sanitized replacement and no retry after an enqueue attempt. Adds an optional private-publication router with exact BRC-103/104 selection, raw UTF-8 bounds, current original-result disclosure, fixed public diagnostics and a single synchronous native enqueue. Adds an authenticated private-acquisition entry and opt-in private acquisition/publication host composition with one session owner and bounded payment headers. Adds opt-in BRC-196 prepare/submit/recover endpoints, sharing host authentication and limits while checking exact private response bytes under the native send gate. Covenant routes reject HTTP payment and preserve legacy submission, acquisition and publication. Adds an optional pinned prepareAsync disclosure hook for fresh purchase alias evidence while retaining the existing synchronous preparation path, request work accounting and final physical native enqueue guard. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No wire, API, or database migration. Deploy the reviewed patch through the protected release workflow; retain existing validation and configured resource bounds. SDK consumers may retain ^2.4.0 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. No migration is required for registerRouter; it is additive and existing servers are unchanged. Call it before start(). No migration for existing routes. New lookup support requires SDK 3.3.0, a durable provider companion, a signed matching capability manifest, current authorization and explicitly configured browser origins. Import the standalone adapter from @bsv/overlay-express/output-lookup, or call configureOutputLookup before start. The legacy root loads the adapter lazily. One service binds each concrete base path; do not advertise unsupported profiles. Storage lifecycle and TLS, proxy deadlines and physical authentication capacity remain host responsibilities. Package publication and deployment remain separate authorized actions. The optional root-eviction-response entry requires middleware 2.3.0 and SDK 3.3.0. Capture the shared root revision before reading the complete response, list every disclosed advertisement and install current synchronous data/control access checks. All decision/access writers must share the durable gate. The transport companion resets stale candidates in full; it does not infer targets, mount root routes or retrofit existing lookup/cache/live/GASP paths. No existing route or stored-format migration. The new root-eviction entry is explicitly mounted before generic parsers, compression and caches, with the same origin authentication instance and durable journal as its shared RootEvictionService. Omitted origins preserve credential-free wildcard CORS; explicit arrays opt into exact origins. Native configureRootEviction before start verifies the server wallet identity, inherits host origin policy unless explicitly overridden and clamps bytes to host bounds. The application retains journal/worker lifecycle ownership. Capability publication, scheduler and all serving/admission/GASP fences are separate host obligations. No default route or behavior changes. The new proposals entry requires SDK 3.3.0 and auth middleware 2.3. Supply the same durable journal to the service and response gate and a current synchronous disclosure policy; mount before parsers and transformations. configureProposals shares host authentication, origin policy and edge bounds. Capability publication and storage/expiry/admission workers remain caller-owned; no default route changes. SDK consumers may retain ^2.4.0 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Lookup send-time protection is opt-in through disclosure on the standalone router or configureOutputLookup, requiring BRC103 and middleware2.3. Existing routes and omitted-option behavior remain unchanged. Import private-publication explicitly with SDK3.3.0 and auth middleware2.3; mount before generic parsers or transformations using the same origin authentication instance. Supply the coordinated durable service and disclosure owner; the router does not create a database, start a reconciler, advertise capabilities or install payment handlers. Credential-free CORS remains the default, with explicit origins optional. Existing root imports and routes remain unchanged. No legacy startup change. Configure private services before start with the matching authentication wallet and installed native disclosure owner. Acquisition-configured hosts select a 128-KiB header ceiling; align reverse-proxy limits. The application owns private custody and worker shutdown. Use configurePrivatePurchase or the private-purchase router before body parsers, and supply a durable coordinator/disclosure owner. The application drains its outstanding work before closing protected custody. Basic transport refusal precedes authentication and private work. Omitted prepareAsync keeps existing disclosure behavior. The explicit alias adapter prepares optional evidence before HTTP signing and uses prepareGuarded against the same native disclosure view; it cannot perform a nested ledger read or change signed response bytes at enqueue. Revalidate alias guards at actual physical disclosure. Changed or unavailable reports may be omitted on a fresh request while preserving historical grant recovery. Existing authentication, mutual-auth identity, BRC105 behavior and legacy routes remain unchanged. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/esm/mod.js` `./dist/cjs/mod.js`	`./dist/types/mod.d.ts` `./dist/cjs/mod.d.ts`
`./*.ts`	`./dist/esm/src/.js` `./dist/cjs/src/.js`	`./dist/types/src/.d.ts` `./dist/cjs/src/.d.ts`
`./output-lookup`	`./dist/esm/src/OutputLookupRoutes.js` `./dist/cjs/src/OutputLookupRoutes.js`	`./dist/types/src/OutputLookupRoutes.d.ts` `./dist/cjs/src/OutputLookupRoutes.d.ts`
`./root-eviction-response`	`./dist/esm/src/RootEvictionResponseGuard.js` `./dist/cjs/src/RootEvictionResponseGuard.js`	`./dist/types/src/RootEvictionResponseGuard.d.ts` `./dist/cjs/src/RootEvictionResponseGuard.d.ts`
`./root-eviction`	`./dist/esm/src/RootEvictionRoutes.js` `./dist/cjs/src/RootEvictionRoutes.js`	`./dist/types/src/RootEvictionRoutes.d.ts` `./dist/cjs/src/RootEvictionRoutes.d.ts`
`./proposals`	`./dist/esm/src/ProposalRoutes.js` `./dist/cjs/src/ProposalRoutes.js`	`./dist/types/src/ProposalRoutes.d.ts` `./dist/cjs/src/ProposalRoutes.d.ts`
`./private-publication`	`./dist/esm/src/PrivatePublicationRoutes.js` `./dist/cjs/src/PrivatePublicationRoutes.js`	`./dist/types/src/PrivatePublicationRoutes.d.ts` `./dist/cjs/src/PrivatePublicationRoutes.d.ts`
`./private-acquisition`	`./dist/esm/src/PrivateAcquisitionRoutes.js` `./dist/cjs/src/PrivateAcquisitionRoutes.js`	`./dist/types/src/PrivateAcquisitionRoutes.d.ts` `./dist/cjs/src/PrivateAcquisitionRoutes.d.ts`
`./private-purchase`	`./dist/esm/src/PrivatePurchaseRoutes.js` `./dist/cjs/src/PrivatePurchaseRoutes.js`	`./dist/types/src/PrivatePurchaseRoutes.d.ts` `./dist/cjs/src/PrivatePurchaseRoutes.d.ts`

@bsv/overlay-topics

Package documentation: docs/packages/overlays/overlay-topics.md
Source: packages/overlays/topics
Release note: Accepts SDK StorageDownloader UHRP pages up to 200 rows with deterministic outpoint ordering. Retains selector allowlists and authenticated advertisement admission. Removes serial-DID topic/lookup/storage exports and tm_did/ls_did registrations. Existing BRC189 identity discovery, UORA and all other legitimate topics remain. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Replaces the tm_mandala/ls_mandala admission, lookup and storage API with Mandala on BRC-162 (BSV-21 binary tokens with authority supply, consuming the @bsv/templates 2.0.0 Bsv21Binary codec): typed MandalaReject refusals with ERR_* codes, the v3 envelope, strict-CBOR admin details committed by the authority output, a trusted-issuer set, an append-only owner journal with inline owner-index repair, and the eviction API. Adds the tm_mandala_registry/ls_mandala_registry identity registry topic (RegistryTopicManager, RegistryLookupService). Changes the persisted Mandala schema (spec section 6.6). UMP lookup requests the retained token-update lineage for presentation, recovery and outpoint queries, within the engine traversal budgets. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: Topics2 is a breaking retirement candidate. Remove DIDTopicManager/createDIDLookupService/DIDRecord/DIDQuery and tm_did/ls_did usage. Resolve immutable identity-key DIDs offline; explicitly configured tm_identity/ls_identity supplies certificate discovery, not DID-document mutation or automatic trust. Preserve existing database/history and plan service rollout without automatic replacement installation. See docs/guides/identity-did-vc-migration.md. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Mandala is a clean break with no data migration: the old MandalaToken/MandalaAdmin wire format is no longer admitted and 1.x Mandala rows are not read or converted, so start Mandala on a new database with new deploys (existing on-chain outputs are not spent or deleted). MandalaTopicManager drops adminWallet, adminProtocolID and stateStore.isAdminOutpoint and requires trustedIssuers (non-empty compressed lowercase public keys) and engineOutputs, with optional membership, membershipExempt and onOwnerRepair; pass the same MandalaStorageManager (a MandalaStateStore) to admission and lookup. Refusals are MandalaReject { code, reason } from the Reasons catalog; do not match on old error text. MandalaLinkagePayload is replaced by MandalaEnvelope with encodeEnvelope/decodeEnvelope; the register action is replaced by a deploy at output 0 with a deploySig. foldAction, defaultAssetState, AssetAdminState, FoldContext and MandalaTokenRecord use tokenId (_0) instead of assetId, drop issuerIdentityKey and add feeRatePerKb. Persisted schema (section 6.6): new mandalaOwners and mandalaAuthorities collections; mandalaTokens, mandalaMetadata, mandalaAssetStates and mandalaAdminHistory are keyed by tokenId, metadata holds the decoded deploy payload, and history rows store kind, detailsHex, commitment and delta (plus optional frozenAmount/frozenOwner on freezes). De-trusting an issuer key revokes the authority coins it holds; rotate keys by moving authority coins first. Operators register tm_mandala_registry/ls_mandala_registry explicitly. The infra/overlay-server wiring follows after publication (P1b). The prior 2.0.0 contracts above are the published baseline. This 2.0.1 UMP patch has no API, wire or schema migration; deploy with overlay 2.6.4 to retain history past confirmation. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.js` `./dist/index.js`	`./dist/index.d.ts`

@bsv/paymail

Package documentation: docs/packages/messaging/paymail.md
Source: packages/messaging/ts-paymail
Release note: Adds BRC-235 public profile lookup (0ace65da5987) and reverse lookup (43dcf83ddc5f): ProfileLookupCapability/ProfileReverseLookupCapability, ProfileLookupRoute/ProfileReverseLookupRoute for hosts, PaymailClient.lookupProfiles/resolveProfile/reverseLookupProfile for clients, and createProfileCertificate/verifyProfileCertificate/checkProfileCertificate for self-signed BRC-52 profile certificates. Every certificate a client reads is verified (type, subject equals certifier, zero revocation outpoint, signature, domain, exact paymail, not released) and at most ten lookup results are processed. A router serving only the two BRC-235 routes, with no requestSenderValidation setting, omits the sender-validation flag from .well-known/bsvalias; every other configuration advertises exactly what it did before. PaymailServerResponseError gains an optional responseStatus set by HttpClient for non-2xx answers. Previous release: Fixes the CommonJS build of the P2P signature and PaymailClient key helpers. The CommonJS build imported @bsv/sdk classes through bundler Node-mode interop, which bound each default import to the whole SDK module, so require() consumers failed at first use with ".default is not a constructor". SDK classes are now imported by name from the SDK barrels; the ESM build, public API and browser bundle size are unchanged. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: None. All additions are new exports; existing capabilities, routes, client methods, defaults and discovery documents are unchanged except that a host configured with only the new BRC-235 routes and no requestSenderValidation omits the sender-validation flag. Previous release: None. ESM consumers are unaffected. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/mod.browser.js` `./dist/mod.js` `./dist/mod.cjs`	`./dist/mod.browser.d.ts` `./dist/mod.d.ts` `./dist/mod.d.cts`
`./client`	`./dist/src/paymailClient/index.js` `./dist/src/paymailClient/index.cjs`	`./dist/src/paymailClient/index.d.ts` `./dist/src/paymailClient/index.d.cts`
`./client/*`	`./dist/src/paymailClient/.js` `./dist/src/paymailClient/.cjs`	`./dist/src/paymailClient/.d.ts` `./dist/src/paymailClient/.d.cts`
`./capability`	`./dist/src/capability/index.js` `./dist/src/capability/index.cjs`	`./dist/src/capability/index.d.ts` `./dist/src/capability/index.d.cts`
`./capability/*`	`./dist/src/capability/.js` `./dist/src/capability/.cjs`	`./dist/src/capability/.d.ts` `./dist/src/capability/.d.cts`
`./router`	`./dist/src/paymailRouter/index.js` `./dist/src/paymailRouter/index.cjs`	`./dist/src/paymailRouter/index.d.ts` `./dist/src/paymailRouter/index.d.cts`
`./router/*`	`./dist/src/paymailRouter/.js` `./dist/src/paymailRouter/.cjs`	`./dist/src/paymailRouter/.d.ts` `./dist/src/paymailRouter/.d.cts`
`./errors`	`./dist/src/errors/index.js` `./dist/src/errors/index.cjs`	`./dist/src/errors/index.d.ts` `./dist/src/errors/index.d.cts`
`./errors/*`	`./dist/src/errors/.js` `./dist/src/errors/.cjs`	`./dist/src/errors/.d.ts` `./dist/src/errors/.d.cts`
`./package.json`	`./package.json`	—

@bsv/payment-express-middleware

Package documentation: docs/packages/middleware/payment-express-middleware.md
Source: packages/middleware/payment-express-middleware
Release note: Removes middleware payment-header size rejection so received payments are validated regardless of header size. Retains the deprecated maxPaymentHeaderBytes option as an ignored source-compatibility field. Atomic BEEF framing, canonical base64, derivation verification, pricing, wallet acceptance and atomic replay protection remain. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No BRC100 call, wire or wallet-data migration. maxPaymentHeaderBytes is now ignored, including existing explicit values: move transport policy to the HTTP server, CDN, proxy or WAF and remove the deprecated option. Validate the complete HTTP route for supported payment proofs. Published 2.1.8 is verified against protected release 36052862859 and its immutable source artifacts. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/mod.mjs` `./dist/mod.cjs`	`./dist/mod.d.mts` `./dist/mod.d.cts`
`./package.json`	`./package.json`	—

@bsv/sdk

Package documentation: docs/packages/sdk/bsv-sdk.md
Source: packages/sdk
Release note: HTTPWalletJSON preserves pre-construction double-spend review evidence only for createAction with explicit inputs, one doubleSpend result, no constructed action fields and complete competing transactions spending requested outpoints. Missing, unrelated, malformed and ID-only competing evidence fails closed. WalletClient and the binary BRC-100 wire no longer reject every acquireCertificate issuance: result validation required the returned fields to equal the request's, but issuance sends plaintext values and the certificate comes back with each value encrypted. An issuance result is now bound to exactly the requested field names; a direct acquisition is still bound to its requested encrypted values exactly. Removes the obsolete serial-DID token validation module and deep import. Native identity/certificate, wallet, transaction and authentication behavior is retained. Repairs cold BasePoint/JacobianPoint leaf exports with original-class initialization wrappers and exact declarations. The ESM UMD facade retains the established global effect and canonical class identities; the standalone classic bundle is preserved. Adds caller-installed completeBoundAction additional-output authorization with exact index, script and amount binding; the default external-input restriction and signed-template verification remain unchanged. Adds any-field saved-contact substring matching and contact-only results in parallel identity searches, plus explicit contactErrorMode, contactTimeoutMs and onContactError options for bounded optional-contact recovery. Existing callers retain strict contact errors; public discovery, certificate verification and permission checks remain unchanged. Aligns the Script interpreter with SV Node v1.2.3: OP_SUBSTR, OP_LEFT and OP_RIGHT operands are decoded through the checked int64 script-number path, so an operand longer than nine bytes or outside the signed 64-bit range is a script number overflow instead of being read from its first eight bytes, and OP_SPLIT also rejects a position above INT32_MAX. ListOutputsResult.totalOutputs remains numeric for ordinary counts and BRC-112 balances, with finite nonnegative integer validation and empty outputs/no BEEF for balance queries. Binary listOutputs retains numeric balances and the deployed record layout by default. Topic broadcaster topics and SHIP/SLAP advertisement names accept lowercase letters, digits and single underscores after the tm_ or ls_ prefix, up to 256 bytes, so the BRC-207 per-asset names tm_color_ and ls_color_ are no longer refused; the grammar is exported as isOverlayTopicName, isOverlayLookupServiceName, OVERLAY_TOPIC_NAME_PATTERN, OVERLAY_LOOKUP_SERVICE_NAME_PATTERN and MAX_OVERLAY_NAME_BYTES. Restores bounded historical certificate types through existing BRC-100 APIs while keeping new signing/acquisition strictly 32 bytes; adds opt-in binary compatibility without rewriting stored certificates. verifyNonce returns false when the wallet rejects an HMAC mismatch (ERR_INVALID_HMAC, or an error whose message is exactly HMAC is not valid) instead of throwing, matching its boolean validation contract. Peer then reports an unverifiable nonce. Valid nonces, HMAC cryptography, wire formats, and unrelated wallet failures are unchanged. Refuses a one-level MerklePath whose only leaf is not at offset 0. A block of one transaction contains only its coinbase, at index 0, so any other offset is a missing sibling. fromHex, the constructor (including deferred root validation), and root computation throw Missing hash for index at height 0. combine() recomputes the merged root and leaves the receiver unchanged when that root differs. Offset 0, including fromCoinbaseTxidAndHeight, is unchanged. HTTPWalletJSON preserves pre-construction double-spend review evidence only for createAction with explicit inputs, one doubleSpend result, no constructed action fields and complete competing transactions spending requested outpoints. Missing, unrelated, malformed and ID-only competing evidence fails closed. WalletClient and the binary BRC-100 wire no longer reject every acquireCertificate issuance: result validation required the returned fields to equal the request's, but issuance sends plaintext values and the certificate comes back with each value encrypted. An issuance result is now bound to exactly the requested field names; a direct acquisition is still bound to its requested encrypted values exactly. Removes the obsolete serial-DID token validation module and deep import. Native identity/certificate, wallet, transaction and authentication behavior is retained. Repairs cold BasePoint/JacobianPoint leaf exports with original-class initialization wrappers and exact declarations. The ESM UMD facade retains the established global effect and canonical class identities; the standalone classic bundle is preserved. Adds caller-installed completeBoundAction additional-output authorization with exact index, script and amount binding; the default external-input restriction and signed-template verification remain unchanged. Adds any-field saved-contact substring matching and contact-only results in parallel identity searches, plus explicit contactErrorMode, contactTimeoutMs and onContactError options for bounded optional-contact recovery. Existing callers retain strict contact errors; public discovery, certificate verification and permission checks remain unchanged. Aligns the Script interpreter with SV Node v1.2.3: OP_SUBSTR, OP_LEFT and OP_RIGHT operands are decoded through the checked int64 script-number path, so an operand longer than nine bytes or outside the signed 64-bit range is a script number overflow instead of being read from its first eight bytes, and OP_SPLIT also rejects a position above INT32_MAX. ListOutputsResult.totalOutputs remains numeric for ordinary counts and BRC-112 balances, with finite nonnegative integer validation and empty outputs/no BEEF for balance queries. Default binary listOutputs requests and responses preserve the deployed SDK2/3 bytes and implicit spendable true. A caller-selected spendable encoding appends request extension version 1 after seekPermission; the response acknowledges it with signed VarInt -1 after the success byte, and only that explicit request selects per-output spendability bytes. Legacy requests fail if the result contains a non-spendable record, avoiding false spendability. Module balances remain numeric. Published SDK3.2.1 byte fixtures cover both interoperability directions. Adds opt-in BRC-192–199 protocol representations, exact encodings, capability selection, live lookup boundaries and closed proposal endpoint codecs while preserving all existing overlay APIs. Adds bounded local capability retention and original-contract revalidation for recovery. Adds bounded common service error envelopes and exact BRC-193 status mappings. Adds explicit AuthFetch automatic-payment opt-out, required mutual authentication and expected server identity controls while preserving existing defaults. Adds a bounded retained-contract BRC-193 HTTP client with authenticated selection binding, cancellation, unpaid errors and caller-owned durable cursor progression. WalletClient and the binary BRC-100 wire no longer reject every acquireCertificate issuance: result validation required the returned fields to equal the request's, but issuance sends plaintext values and the certificate comes back with each value encrypted. An issuance result is now bound to exactly the requested field names; a direct acquisition is still bound to its requested encrypted values exactly. Retains a separate historical BRC-197 exact locking-script, descriptor and revenue-state codec that authenticates the frozen executable before use. Retains historical six-route planning and funded transaction construction with exact mandatory outputs, integer revenue quanta, explicit retirement top-up, externally supplied seller and unanimous recipient transaction signatures, and final-layout binding. Protocol JSON maps have null prototypes and ordinary own data properties, preserving accepted keys, attributes and encodings. Adds bounded BRC-195/196 release representations, exact selected-policy binding and registered BRC-77 processor-attestation verification. Adds closed BRC-196 purchase endpoints, signed original-request terms and STEAK/POTATOES status, transaction, recipient and evidence bindings. Adds bounded BRC-195 protected-publication and paid-lookup representations, semantic publication digests and frozen quote, amount, recovery and purchased-output bindings. Adds bounded BRC-195 payment-header parsing, exact single BRC-29 funding-output inspection and proof-independent wallet operation identifiers. Adds bounded BRC-199 signed root request/result and status codecs, exact root/chain/requester and decision bindings, independent restoration bases and explicit new-request clock checks. Adds an opt-in bounded BRC-199 root request/status HTTP client bound to the original signed operation, capability and independently retained policy, with mutual authentication, disabled payments and physical I/O ownership after cancellation. Shares the finite exchange without changing existing lookup transport APIs or diagnostics. Removes the obsolete serial-DID token validation module and deep import. Native identity/certificate, wallet, transaction and authentication behavior is retained. Repairs cold BasePoint/JacobianPoint leaf exports with original-class initialization wrappers and exact declarations. The ESM UMD facade retains the established global effect and canonical class identities; the standalone classic bundle is preserved. Adds the optional retained-operation BRC-194 proposal client with exact publication acknowledgements, signed retrieved author data, active expiry and explicit prior-reservation identity. Adds an explicit authenticated paid-lookup quote/payment/recovery transport with original-operation binding and no automatic payment; malformed bounded payment BEEF is classified invalid. Preserves exact canonical JSON bytes and resource fences while avoiding UTF-8 allocations for printable ASCII chunks and rejecting lone surrogates through Unicode code-point matching; complete Unicode boundary/property evidence remains required. Reuses bounded process-local successful BRC-77 mathematics and canonical valid curve points while rechecking packet representation, digest domain and signer on every call. No packet bodies or authority/currentness decisions are cached. Adds finite authenticated original BRC-196 prepare/submit/recover transport with exact selected recipient/domain/release/transaction bindings and disabled HTTP payments. Its optional identity fence runs inside the existing finite deadline without changing prior paid/lookup/proposal/root behavior. Adds ownOutputJSON for bounded canonical text and independently owned data-only values, preserving all canonical checks and duplicate-aware incoming text/byte parsing. Observes the original authentication response waiter immediately while send is pending, retaining its original timeout, transport failure, exact session removal and listener cleanup. Adds optional purchase commitments and separately retained current-alias evidence to BRC-196 envelopes, with mandatory commitment binding for reserved BRC-197 results and signed POTATOES. Adds full input-zero SHA256d commitment calculation and transparent fixed public child derivation without returning private scalars. These helpers do not establish Script, wallet or acquisition qualification. Adds caller-installed completeBoundAction additional-output authorization with exact index, script and amount binding; the default external-input restriction and signed-template verification remain unchanged. Adds a portable RevenueListingProfile codec for the two literal PR295 programs, immutable public-child slots and 717-byte metadata with mandatory height expiry, matching both unchanged positive wire-corpus locks. Construction and ancestry use the separately selected ProfilePlan/ProfileSpend and lineage interfaces; the codec alone does not establish those checks. Adds separate RevenueListingProfilePlan and RevenueListingProfileSpend entries for immutable activation, purchase, protected-child split, permissionless payout and both retirement routes, with complete source-bound funding, 114/15-value public witnesses and full construction commitments. Complete positive input execution and original 300-run controls cover these components; complete exact-head signed-lineage, native wallet and durable alias qualification remains checkpoint-two work. Adds an explicitly selected local full-purchase-commitment-v1 transport binding, parser and separate commitment-bound envelope verifier, sharing all existing original-term, recipient, policy, signature and historical release-evidence checks. Adds OutputPurchaseTermsVerifier to own the normalization of a retained original request and selected seller while independently parsing and verifying the complete returned packet, association and BRC77 signature on every call. Packet digests and the existing mathematical-verification cache key hash freshly canonicalized typed bytes directly, removing an internal number-array round trip while retaining public owned preimage arrays, exact BRC77 math inputs, digest vectors and validation/error ordering. Canonical JSON emits validated unescaped ASCII and fixed delimiters directly while preserving full escaping, Unicode, structural and byte-limit checks. Adds inspectOutputJSONEncoding: fresh duplicate-aware parsing and canonical-input classification with original UTF-8, Unicode, depth, array/map and input/canonical byte bounds. It preserves ordinary parseOutputJSON acceptance and returns an independently owned mutable value; the flag supplies no schema or authority decision. Keeps ordinary parser bundles free of the optional encoding-inspection implementation. Canonical JSON validates each supplied limit override once and emits each object name with its colon, preserving exact byte bounds, ownership, encodings and refusal order; immutable default limits remain unchanged. Property names are sorted as fresh primitive string arrays with one captured explicit UTF-16 code-unit comparator, preserving the independent canonical digest corpus. Null and boolean values retain their exact literal encodings while numbers keep the existing serialization, including negative zero. Adds any-field saved-contact substring matching and contact-only results in parallel identity searches, plus explicit contactErrorMode, contactTimeoutMs and onContactError options for bounded optional-contact recovery. Existing callers retain strict contact errors; public discovery, certificate verification and permission checks remain unchanged. Bounded parsing decodes values once into fresh private null-prototype records and ordinary array data properties, preserving decoded-key membership, collection counts and strict native string decoding; only complete validation exposes the graph. Canonical fields use ordered traversal without per-field callbacks. Duplicate decoded keys, descriptors, Unicode, numeric/map order, byte/resource bounds and refusal order are preserved, with no validation or authority cache. Bounded protocol JSON string tokens avoid repeated delimiter dispatch and native reparsing of unescaped text. Escaped/control-bearing tokens retain native syntax validation; Unicode, duplicate-key, offset, error and resource contracts remain unchanged, with no cache. String-token recognition uses advancing native quote searches and disjoint backslash-parity scans, preserving bounded linear work for malformed input. Reuses freshly established source/ASCII Unicode facts within the same validation call and constructs missing/unknown-field messages only at their original refusal points. Closed schemas retain one captured Set with indexed SameValueZero membership; fresh primitive canonical names retain one captured explicit UTF-16 comparator. Bounded primitive strings reuse the same fresh Unicode validator directly before the original UTF-8 limit: at most1024 code units cannot reach the JSON structural or4MiB bounds. Type/code-unit/Unicode/UTF-8 refusal identities and order remain unchanged, with independent escaping/control/BMP/surrogate/byte-bound regressions. No string, schema, authority or validation verdict is retained. Representation, refusal order and every authorization check remain unchanged; no schema or authority verdict is cached. Purchase and release parsers retain complete fresh normalization at public and nested boundaries, including canonical property order and zero representation from original raw JSON. Original limits, errors, signatures and main-entry exports remain unchanged; independent caller-mutation, nested ordering/zero, duplicate-key, Unicode, closed-field and confirmation-depth regressions cover the boundary. Canonical JSON uses shared closed functions and a fresh private serialization frame, retaining every representation/resource predicate, refusal identity and descriptor order. Validated safe-integer decimal text and zero canonicalization remain identical; no value or validation result is cached. Incoming JSON source first completes fresh lexical validation with decoded-key Sets and successful-value counts, retaining every syntax, Unicode, integer, duplicate-key, map/array/depth/byte, malformed-value and trailing-data refusal boundary. Only then does native JSON parsing construct an independent data-only graph, followed by a bounded private null-prototype traversal. Own data attributes, special property names and independent ownership remain unchanged; no input or verdict is retained between calls. Retains duplicate-key and map-limit refusal order and uses one captured explicit primitive-string UTF-16 comparator for identical locale-independent canonical output. No schema, authority or ownership behavior changes. Adds a captured closed-object field validator and internally owned fixed protocol grammars, with fresh value checks and unchanged mutable-schema behavior. Fresh JSON framing accumulates bounded immutable text per invocation instead of retaining a chunk array and joining it; all canonical encoding, ownership, descriptor, Unicode and resource checks remain unchanged. Original scalar dispatch and fresh Set ancestor tracking are retained. Fresh primitive-name arrays retain one captured explicit UTF-16 comparator. No input, shape or verdict is cached. All original SDK units, property controls, error order and package ceilings remain required for complete current-source qualification. Shared normalization selects only the exact immutable default limits directly; other overrides remain freshly validated. No value, schema or authority verdict is cached. Aligns the Script interpreter with SV Node v1.2.3: OP_SUBSTR, OP_LEFT and OP_RIGHT operands are decoded through the checked int64 script-number path, so an operand longer than nine bytes or outside the signed 64-bit range is a script number overflow instead of being read from its first eight bytes, and OP_SPLIT also rejects a position above INT32_MAX. Canonical ordering sorts fresh primitive names with one captured explicit UTF-16 comparator, without per-object comparator allocation or locale-sensitive ordering. Program-value ownership constructs an independent graph with native JSON parsing only after complete bounded canonical validation and emission, preserving attributes, null prototypes and negative-zero semantics. Array construction bypasses inherited indexed setters. Canonical serialization uses shared closed module functions with a fresh explicit per-call frame that never reaches caller callbacks or escapes its invocation; original validation predicates, initialization and refusal order remain identical. All validation predicates, caller descriptor/refusal order, fresh ownership and resource limits remain. Three additive boundary cases cover mutation during descriptor inspection, inherited array accessors and early byte-limit refusal. No input, schema, authorization or currentness verdict is cached. Incoming parsed records are constructed directly as fresh private null-prototype data, retaining duplicate-key checks before independent map-item limits and value parsing. Program-value ownership uses a bounded private traversal only on newly parsed unexposed records, never caller objects. All original checks and canonical emissions complete before program-value graph construction; schema normalization discards the temporary generated text afterward. Text-only serialization constructs no graph; incoming text and bytes retain the unchanged duplicate-aware parser. Public encodings, graph attributes, limits and validation/refusal boundaries remain unchanged. Incoming parser records explicitly define ordinary own data properties, preserving all decoded keys and exact attributes without inherited setters. Traverses fresh, completely validated private native JSON graphs with direct dense array iteration and null-prototype own record fields instead of intermediate values-array copies, preserving independent ownership, data attributes and all original refusal boundaries. Preserves complete fresh canonical Base64 syntax and decoded-byte limits while checking final unused sextet bits directly instead of re-encoding the complete decoded value. Preserves fresh Unicode checks and exact bounded string bytes, using code-unit length for ASCII and native encoding otherwise. Appended regression covers every final sextet, decoded-byte boundaries and original refusal ordering; original tests and public declarations remain unchanged. Adds line-terminator syntax and encoded-bound precedence regressions. Strict absolute end assertions reject noncanonical terminator-bearing primitives while retaining canonical bytes, encoded allocation bounds and the original padding-bit routine. Reuses only fixed lazy non-streaming UTF-8 decoder configuration; every byte input retains fresh syntax, duplicate, Unicode, BOM and resource checks and independent ownership. Fresh bounded ASCII evidence establishes Unicode validity and exact bytes directly; non-ASCII strings retain surrogate-before-size refusal order. Adds repeated malformed/valid, BOM/valid and duplicate/valid retry regressions without changing original tests. Adds explicit inspectOutputJSONEncodingWithScalarRecords for fresh complete compact-scalar canonical inspection and independent ownership; ordinary inspection and unsupported-shape/refusal behavior remain unchanged. Native protected-ledger plaintext inspection selects the additive companion without caching input, shape or authority verdicts. Add an explicitly selected inlined ASCII string-field serializer with fresh original traversal/refusal order and simplify scalar-record grammar without changing canonical bytes. Explicit native ownership uses ownOutputJSONWithInlineStrings for fresh canonical validation and independent data graphs. The explicit native ownership companion assembles a private independent graph during its fresh canonical traversal and returns both results only after all checks pass. Ordinary ownership remains unchanged. Appended ordered-reflection, reentrancy, refusal, attribute and recursive 300-case differential tests retain every original test and mutation site. Adds explicit prepare, terms and submit parser companions selecting the internal normalizedWithInlineStrings helper for fresh owned object validation. Ordinary purchase parsers remain unchanged. General normalization and digests retain their existing paths. Native purchase validation selects fresh inline capability and signed-term companions. Adds explicit owned-record parsing/inspection and recursive canonical/ownership companions, retaining all existing public paths and fresh validation. Add explicit fresh-ownership purchase-envelope, commitment, POTATOES and release-evidence companions, with original signature/request binding and no retained input or verdict; private-purchase bindings select them through imports while ordinary entry points remain unchanged. Internal explicit schema ownership counts complete canonical bytes without building discarded composite text, retaining all fresh guards and independent copies; qualification remains required. Adds opt-in counted value-only ownership and audited native import bindings; full byte/representation guards, original method bodies and text-requiring paths are retained. Carries explicit purchase and release parsing through fixed nested policy, STEAK and release-evidence companion grammars while retaining ordinary schemas, nested JSON text, complete bounds/refusals and signature/request bindings; internal deep helpers add no root export or input/verdict cache. Nested companion grammars are instantiated lazily as fixed validator configuration so unused browser paths can be removed; every supplied representation and authority check remains fresh. Initializes lazy fixed companion grammars in standalone statements before returning their validator configuration, preserving fresh input validation, declarations and browser budgets. Compose child grammar checks after complete fresh parent ownership; embedded text keeps full parsing, all bounds and checks remain fresh, and no root export or migration is added. Portable WithInlineStrings schema companions retain the general text/byte parser. Server callers can explicitly choose parseOutputPurchasePrepareWithOwnedRecords, parseOutputPurchaseSubmitWithOwnedRecords, parseOutputPurchaseTermsWithOwnedRecords, parseOutputPurchaseEnvelopeWithOwnedRecords, parseOutputPotatoesWithOwnedRecords, parseOutputPurchaseCommitmentBindingWithOwnedRecords and parseOutputReleaseEvidenceWithOwnedRecords. These additive parsers construct independently owned records during complete lexical traversal of text or UTF-8 bytes and use the same fixed packet grammars and intrinsic checks. Object inputs retain fresh counted ownership. Native server bindings select them through imports; the portable buyer and wallet entries retain their existing dependency paths. This selection adds no wire profile, persisted format, signature verdict or authority rule. Complete fresh syntax, decoded-name duplicates, Unicode, safe integers, depth and input-byte fences remain mandatory; ordinary parser entry points are unchanged. Canonical U64, Hex32, compressed identities, standard base64 and request IDs use strict end-of-input assertions so line terminators cannot be accepted as part of a canonical primitive. Valid canonical representations, defaults, wire bytes and signature/authority checks remain unchanged. No input, graph or verdict is cached. Hosted qualification is still required; source checks establish no speedup. Adds an additive freshly validated direct-record canonical text emitter selected explicitly by native private-state serializers, with parity, refusal and property coverage. Explicit server purchase companions lazily compose fixed grammar after complete fresh input ownership, retaining every field/domain check and ordinary standalone/custom/portable behavior. Authentication byte ownership captures each external array element through its own data descriptor once. Shape validation then checks values in the private arrays produced by the completed bounded snapshot traversal. Sparse arrays, accessors, invalid byte values and all size, depth and node limits retain their existing refusals. Every operation constructs fresh owned data; no caller input or validation verdict is cached. Public declarations, wire bytes, signature and session checks, errors and defaults are unchanged. No consumer migration is required. Complete composed qualification remains required; this implementation change alone establishes no performance improvement. Retains original authenticated fetch network throws in optional Error.cause across runtime realms, without replaying requests. HTTPWalletJSON preserves pre-construction double-spend review evidence only for createAction with explicit inputs, one doubleSpend result, no constructed action fields and complete competing transactions spending requested outpoints. Missing, unrelated, malformed and ID-only competing evidence fails closed. Unused fixed purchase-protocol grammar construction is removable from browser bundles; retained parsers preserve the same validation, deterministic encoding and resource bounds. Profile-witness size estimation reuses the installed Script push encoder with the original conservative bounds; its internal header choice is explicit while public construction defaults and ABI remain unchanged. SDK4.0.1 restores numeric totalOutputs for ordinary counts and BRC-112 balances, preserving DecimalString and existing helper exports. Default binary requests retain SDK2/3 bytes; the explicitly selected and acknowledged spendability extension from #674 remains available. JSON balances are finite nonnegative integer summaries; only binary serialization has a uint64 ceiling. No separate profile for the defective 4.0.0 layout is introduced. Restores the established minimal-length unsigned big-endian X-coordinate encoding for HMAC generation and verification, backing out the unshipped fixed-width change without a second encoding or relaxed verifier. Adds opt-in LookupResolverConfig.trackerTimeoutMs and AuthFetchOptions.responseTimeoutMs while preserving the 5000 ms SLAP discovery and 30000 ms authenticated response-wait defaults and independent host, whole-query and transport deadlines.
Migration: For pre-construction conflict recovery, upgrade the desktop wallet Toolbox parser and the application SDK together, and use the existing structured JSON API before starting financial operations. Binary wire framing remains unchanged and cannot carry review evidence; never retry an ambiguous binary failure. No schema or BRC-100 call migration. SDK3 is a separate breaking retirement candidate: remove identity/DIDTokenValidation imports and use @bsv/did BRC202 identity-key resolution plus optional @bsv/did/brc52 original-signature envelopes. Retain historical data and recover authenticated identity bindings; do not relabel serial DIDs. Existing acquisition-result validation fixes remain. First-party SDK3 peer alternatives require complete packed qualification and owner coordination; preserved SDK2 ranges are not silently narrowed. See docs/guides/identity-did-vc-migration.md. The additive authorization callback requires independently verified local policy; wallet-returned labels or fields are not authority. The completeBoundAction.outputAuthorizationVersion function property allows compatible consumers to detect support without importing a missing named export from older ESM peers. No BRC100 wire or persistence migration is introduced by this addition. Identity search recovery is opt-in: useContacts true with contactErrorMode fallback bounds contact enrichment at 2000ms by default, or an explicit integer deadline from1 to60000ms. Use onContactError for partial-result warnings and handle public lookup errors separately from empty results. Legacy booleans and defaults remain compatible. A contact deadline does not cancel wallet requests or permission prompts. Applications must update their bundled SDK and search component; this source candidate does not update deployed apps. The splice-operand change is a consensus alignment with SV Node v1.2.3 and needs no API change; spends whose OP_SUBSTR, OP_LEFT or OP_RIGHT operands are longer than nine bytes, or whose ninth byte carries magnitude bits, were accepted by node v1.2.2 and are now rejected by both the node and the SDK. SDK4.0.1: totalOutputs remains a number for existing arithmetic and comparisons. Existing numeric clients and default binary connections retain the deployed contract. Only explicitly selected spendability extensions require support at both ends. First-party packages add an SDK4 peer alternative and keep their SDK2 and SDK3 ranges. Overlay names: every name accepted before is still accepted; no migration is required. Certificate compatibility: upgrade app and wallet binary adapters for legacy types. Listing/proof keep existing storage RPCs; legacy relinquishment requires the storage runtime to use the updated SDK reference validator. Ordinary encodings and app API shapes are unchanged. See specs/wallet/legacy-certificate-wire.md. No API, wire, or wallet-data migration. Callers that treated a thrown ERR_INVALID_HMAC from verifyNonce as the invalid-nonce result must use the returned false. Callers that already branch on the boolean, including Peer, keep their behavior. A true result still does not prove freshness or single use. This source candidate is not publication. MerklePath: None for a proof a node or this SDK can produce, including fromCoinbaseTxidAndHeight. A one-level BUMP whose only leaf is not at offset 0 was previously accepted and now throws Missing hash for index at height 0 at parse and root computation. combine() no longer keeps a merged path whose root differs from the paths it merged. No API, wire, or wallet-data migration. For pre-construction conflict recovery, upgrade the desktop wallet Toolbox parser and the application SDK together, and use the existing structured JSON API before starting financial operations. Binary wire framing remains unchanged and cannot carry review evidence; never retry an ambiguous binary failure. No schema or BRC-100 call migration. SDK3 is a separate breaking retirement candidate: remove identity/DIDTokenValidation imports and use @bsv/did BRC202 identity-key resolution plus optional @bsv/did/brc52 original-signature envelopes. Retain historical data and recover authenticated identity bindings; do not relabel serial DIDs. Existing acquisition-result validation fixes remain. First-party SDK3 peer alternatives require complete packed qualification and owner coordination; preserved SDK2 ranges are not silently narrowed. See docs/guides/identity-did-vc-migration.md. The additive authorization callback requires independently verified local policy; wallet-returned labels or fields are not authority. The completeBoundAction.outputAuthorizationVersion function property allows compatible consumers to detect support without importing a missing named export from older ESM peers. No BRC100 wire or persistence migration is introduced by this addition. Identity search recovery is opt-in: useContacts true with contactErrorMode fallback bounds contact enrichment at 2000ms by default, or an explicit integer deadline from1 to60000ms. Use onContactError for partial-result warnings and handle public lookup errors separately from empty results. Legacy booleans and defaults remain compatible. A contact deadline does not cancel wallet requests or permission prompts. Applications must update their bundled SDK and search component; this source candidate does not update deployed apps. The splice-operand change is a consensus alignment with SV Node v1.2.3 and needs no API change; spends whose OP_SUBSTR, OP_LEFT or OP_RIGHT operands are longer than nine bytes, or whose ninth byte carries magnitude bits, were accepted by node v1.2.2 and are now rejected by both the node and the SDK. SDK4.0.1: totalOutputs remains a number for existing arithmetic and comparisons. Existing binary applications and wallets can upgrade independently; no ordinary listOutputs wire migration is required. Only callers that explicitly select WalletWireTransceiver listOutputsEncoding spendable need an extension-aware processor; JSON also carries non-spendable module inventory. Default WalletClient connections retain the historical format. No automatic retry or ambiguous response-format detection is used. First-party packages add an SDK4 peer alternative and keep their SDK2 and SDK3 ranges. SDK3 is a separate breaking retirement candidate: remove identity/DIDTokenValidation imports and use @bsv/did BRC202 identity-key resolution plus optional @bsv/did/brc52 original-signature envelopes. Retain historical data and recover authenticated identity bindings; do not relabel serial DIDs. Existing acquisition-result validation fixes remain. First-party SDK3 peer alternatives require complete packed qualification and owner coordination; preserved SDK2 ranges are not silently narrowed. See docs/guides/identity-did-vc-migration.md. The opt-in output APIs preserve existing overlay endpoints and lookup defaults. Select the new versioned profiles explicitly; the accompanying output-knowledge runtime provides durable application state above the SDK. Retained capability records are local replay material: persist them atomically with operations and independently enforce current authorization and operation deadlines. Use allowPayments: false for unpaid authenticated requests. Select requireMutualAuth to disable ordinary HTTP fallback, or expectedIdentityKey to additionally pin the canonical provider key before application dispatch; verify capability/profile bindings separately. Use HTTPS for confidentiality. Omitted controls preserve existing behavior. OutputLookupTransport is opt-in: persist the original opening before dispatch, and atomically commit each batch with its cursor before reading further. Full durable service/runtime integration is separate; no default legacy behavior changes. Import @bsv/sdk/script/templates/RevenueListing explicitly and supply the pinned program bytes; recognition does not establish lineage, currentness, valid spending or fulfillment. The new revenue codec does not alter existing root imports. Opt into RevenueListingPlan/RevenueListingSpend only after domain lineage checks. Supply complete funding predecessors, preserve the planned BRC-100 two-phase layout, obtain raw ALL|FORKID signatures from explicit authorities, and verify the finalized transaction separately; the module never funds, signs or broadcasts by itself. Release-evidence helpers are opt-in: supply independently retained chain, transaction and release policy. Processor verification proves that selected processor signed the exact acceptance statement, not mining or delivery. Mined release still requires authenticated inclusion, selected-chain ancestry and a same-context commit check. No existing wire or stored-data migration. Purchase codecs preserve legacy STEAK and never fund or admit. Authenticate terms against the separately retained request and selected seller, persist them before construction, and supply the exact constructed transaction ID when checking reserved responses. Durable admission, domain/release eligibility and recipient usability remain separate checks. BRC-195 quote/status codecs require authenticated transport and an independently retained selected contract. They do not implement protected storage, wallet internalizeOnce, transaction/release eligibility or secret usability; legacy BRC-105 and lookup context are unchanged. Payment funding inspection requires an independently derived seller payment key, selected chain and retained quote; it does not establish Bitcoin acceptance, reserve an acquisition or internalize wallet value. Enforce total HTTP header limits and use a separate durable idempotent wallet adapter before acknowledging credit. Root-eviction helpers are opt-in and require independently authenticated context, the original signed request and retained evaluation policy. Check clocks only when accepting new requests; retained outcomes remain recoverable under current access policy. Evidence verification, local authority, durable tombstones and every serving/replay guard remain service obligations. Existing SHIP/SLAP, lookup and GASP behavior is unchanged. No migration for existing lookup consumers. Persist original root operation/selection/policy together before constructing OutputRootEvictionTransport; supply trusted root/base/chain/rules and a wallet. The client retries that operation or reads its original status without discovery, persistence, automatic polling or payment. Current access and all serving/evidence decisions remain separate server obligations. Persist the exact proposal request and fresh selected contract before constructing OutputProposalTransport. Each send retries only that saved request. Finalize returns response plus matchesRequest: a different existing reservation is not fulfillment of the requested transaction. Local transport errors remain distinct from authenticated OutputProposalServiceError; domain/evidence verification, current authority, persistence and new-operation freshness remain explicit caller and provider obligations. Existing AuthFetch defaults stay unchanged. Select the new transport explicitly and retain original contracts and payment bytes in a durable owner; see the paid lookup client guide. Existing verification and freshness/authority APIs are unchanged; callers still perform every role, expiry, policy and current-context check. The bounded caches have no persistent data or migration. OutputPurchaseTransport is explicitly selected and requires retained original capability/request/terms and a recipient authentication wallet. Compose durable custody and explicit new-work authorization separately; finite transport never constructs, pays, signs, broadcasts or validates Script/usable private material. The additive ownOutputJSON utility accepts JavaScript values, including strings as values; use parseOutputJSON for incoming JSON text or UTF-8 bytes. Schema, current authorization, wire and storage contracts remain unchanged. The response-waiter lifecycle correction changes no wire format, public API, deadline, automatic payment or session-recovery defaults. Updated opt-in BRC-197 purchases require purchaseCommitment in every reserved result and POTATOES. Pass the independently verified full preimage digest to verifyOutputPurchaseEnvelope as its optional fourth argument; this never relaxes historical txid checks. Independently verify currentAlias BEEF and chain placement before assessing currentness. Other domains and ordinary SDK behavior remain compatible. Public child derivation alone cannot authorize signing, activation or wallet remittance; see docs/guides/revenue-listing-commitments.md. The additive authorization callback requires independently verified local policy; wallet-returned labels or fields are not authority. The completeBoundAction.outputAuthorizationVersion function property allows compatible consumers to detect support without importing a missing named export from older ESM peers. No BRC100 wire or persistence migration is introduced by this addition. New exemplar constructors must use explicit activation or active stages, an immutable initialRevenue schedule without revision, and mandatory expiryHeight. The separately added RevenueListingProfile entry does not reinterpret older descriptors or persisted records, authorize activation or qualify the retained legacy planner; see docs/guides/revenue-listing-profile.md. For the current exemplar, select the ProfilePlan/ProfileSpend entries explicitly, retain mandatory height expiry and immutable schedules, provide complete funding predecessors and at most one final P2PKH change output, and sign only the fixed seller child through the exact protected BRC100 protocol. Planning and construction do not establish signed activation ancestry, Bitcoin/chain acceptance or private release. The earlier single-program/six-route helpers remain historical compatibility interfaces, not the current specification. Current exemplar installations use the separate two-stage Profile interfaces described in docs/guides/revenue-listing-profile.md. Existing verifyOutputPurchaseEnvelope and omitted transport options retain exact-txid behavior. Select commitmentBinding explicitly for submit/recover with matching original signed domain and retained complete original funded candidate. Preparation cannot select it; no request body or HTTP payment changes. Independently verify both complete transactions and their same full commitment before accepting rights; SDK transport binding does not establish Script, alias, chain or secret usability, or migrate native buyer/wallet custody. The additive OutputPurchaseTermsVerifier is optional. Its verify method repeats all response checks and retains no response or verification verdict. The existing verifyOutputPurchaseTerms signature and checks remain unchanged; current domain, authorization and fulfillment checks remain separate. The internal typed digest/verification-key and ASCII serialization paths change no public preimage representation, signature, wire, persisted data, validation rule or output digest; no migration is required. Verification still validates the complete packet and signer before the existing bounded successful-mathematics cache; it never caches authorization or currentness. Encoding inspection is additive. Ordinary parsing, canonical bytes, errors and defaults are unchanged; validate endpoint schemas and current authority separately. Identity search recovery is opt-in: useContacts true with contactErrorMode fallback bounds contact enrichment at 2000ms by default, or an explicit integer deadline from1 to60000ms. Use onContactError for partial-result warnings and handle public lookup errors separately from empty results. Legacy booleans and defaults remain compatible. A contact deadline does not cancel wallet requests or permission prompts. Applications must update their bundled SDK and search component; this source candidate does not update deployed apps. This private framing and ownership refactor requires no public API, wire, storage or consumer migration; full current-source qualification remains required. Existing closedOutputObject calls remain dynamic; createClosedOutputObjectValidator deliberately captures field names at construction. No wire or data migration. The splice-operand change is a consensus alignment with SV Node v1.2.3 and needs no API change; spends whose OP_SUBSTR, OP_LEFT or OP_RIGHT operands are longer than nine bytes, or whose ninth byte carries magnitude bits, were accepted by node v1.2.2 and are now rejected by both the node and the SDK. The private traversal and fixed primitive-name comparator require no API, wire, persisted-data or consumer migration. Every caller graph and returned response is still validated afresh; no input or authority verdict is cached. The representation allocation changes require no API, consumer, wire or persisted-data migration. Every input is checked afresh with the same acceptance, decoded bytes, errors and limits; no value or authority verdict is cached. Canonical primitive validation explicitly rejects trailing line terminators before decoder normalization. Valid canonical Base64 bytes, allocation bounds, padding-bit rules and public signatures remain unchanged; noncanonical terminator-bearing input is rejected. Fixed decoder configuration and fresh ASCII evidence require no API, wire, stored-data or consumer migration; no input or validation verdict is retained. The scalar-record inspector is opt-in; existing consumers, wire bytes and stored data require no migration. Other shapes/refusals preserve the original inspector and one observation of caller limits/byteLength. Endpoint schemas, authentication, custody and current authority remain separate. The inlined string-field serializer is opt-in; native private payload/ledger aliases select it. Ordinary SDK serialization, stored bytes, errors and resource limits are unchanged; no migration or input/verdict cache is introduced. Complete current-head runtime and mutation qualification remain required. Ordinary ownership stays unchanged; the protected native ledger explicitly selects the additive companion with all representation/resource and authority checks retained, without input or verdict caching. Existing signatures and wire encodings remain unchanged. Text/byte purchase inputs retain the general parser, object inputs select fresh independent ownership, and native alias records use the general mixed-value parser. Three explicit purchase parser companions add root SDK exports, alongside one internal deep-module schema export. Ordinary purchase parsing retains its previous path; native callers explicitly opt in. No input or verdict cache is introduced; full hosted qualification remains required. Native purchase contracts explicitly select additive inline companions for capability selection and retention, packet digests and verification, and signed purchase terms. Each invocation owns and validates its complete input afresh. Historical capability restoration still checks the recorded selection time, original signature, selected endpoint, identity, chain, selector, installed rules and digest. Current caller authorization and actual operation deadlines remain separate checks. Ordinary SDK entry points, wire text and bytes, canonical encodings, resource limits, error identities and custody formats retain their existing behavior. No input, parsed packet, shape, secret, currentness or authority verdict is cached; only the existing bounded mathematical signature facts and fixed grammar are shared. This is an implementation choice with identical protocol semantics, not a new advertised protocol profile. Hosted property and full mutation qualification remain required. Current native private-state imports explicitly select the owned-record and recursive inline implementations. No wire, persistence, caller-interface, resource-limit or authority migration is required; representation ownership remains separate from schema, signature and current-operation checks. Existing ordinary and opt-in SDK entries remain available; full hosted qualification is required. Existing canonical serializers and portable browser/wallet selections are unchanged. Native imports opt in to direct-record text emission with identical wire bytes, persisted formats, resource limits and refusal behavior. Each invocation validates afresh; no graph, encoding, shape, secret or authority verdict is cached. Hosted runtime and full mutation qualification remain required. The internal deep-module owned-record grammar factory retains callbacks only, never supplied input or any verdict. Existing defaults, standalone parsers, root exports, wire and stored formats remain unchanged; hosted complete qualification is required and no speedup is established by static checks. validateOutputByteEncoding is an additive SDK export for fresh canonical standard Base64 validation without decoded-array allocation. The private fixed owned-record grammar selects it only after complete fresh parent ownership. Existing decoder and ordinary schema callbacks, defaults, refusal order, wire bytes and persisted data remain unchanged; no consumer migration or input/verdict cache is introduced. Representation validation is separate from schema, signature, custody and current authority. External authentication arrays are descriptor-checked and copied once per operation; subsequent byte shape checks operate only on that completed private snapshot. No SDK3.3.0 public, wire, storage, budget or default migration is required. Original composed qualification remains required. Network wrapper message, name and stack behavior remain compatible; the optional cause preserves the original thrown value and does not authorize replay or payment. For pre-construction conflict recovery, upgrade the desktop wallet Toolbox parser and the application SDK together, and use the existing structured JSON API before starting financial operations. Binary wire framing remains unchanged and cannot carry review evidence; never retry an ambiguous binary failure. No schema or BRC-100 call migration. The additive preparePreservingHeader construction companion retains exact alternative headers without asserting finality or Script/domain validity. Recommended defaults and existing callers remain unchanged. SDK4.0.1 hotfix: existing numeric arithmetic compiles again. Established SDK2/3 clients retain numeric counts and balances and the deployed binary layout without an upgrade. The explicitly selected and acknowledged listOutputsEncoding spendable extension from #674 remains available. No separate profile for the defective 4.0.0 layout is introduced. Enumerate outputs for exact accounting and value movement; numeric summaries above 2^53 may round. Existing legacy validator bounds remain unchanged. No automatic retry or encoding detection. Existing HMAC tags and persisted HMAC-derived identifiers remain unchanged; no HMAC encoding mode, alternate verification or data migration is introduced. No migration is required for timeout configuration. Existing calls retain their defaults. To extend SLAP discovery, configure trackerTimeoutMs and a sufficient whole-query deadlineMs; to extend authenticated calls, configure responseTimeoutMs alongside transport requestTimeoutMs in the existing fifth constructor argument. Other certificate, session and operation deadlines remain independent. Reconcile an ambiguous financial request before resubmission.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/esm/mod.js` `./dist/cjs/mod.js`	`./dist/types/mod.d.ts` `./dist/cjs/mod.d.ts`
`./*.ts`	`./dist/esm/src/.js` `./dist/cjs/src/.js`	`./dist/types/src/.d.ts` `./dist/cjs/src/.d.ts`
`./primitives`	`./dist/esm/src/primitives/index.js` `./dist/cjs/src/primitives/index.js`	`./dist/types/src/primitives/index.d.ts` `./dist/cjs/src/primitives/index.d.ts`
`./primitives/BasePoint`	`./dist/esm/src/primitives/entries/BasePoint.js` `./dist/cjs/src/primitives/entries/BasePoint.js`	`./dist/types/src/primitives/entries/BasePoint.d.ts` `./dist/cjs/src/primitives/entries/BasePoint.d.ts`
`./primitives/BasePoint.ts`	`./dist/esm/src/primitives/entries/BasePoint.js` `./dist/cjs/src/primitives/entries/BasePoint.js`	`./dist/types/src/primitives/entries/BasePoint.d.ts` `./dist/cjs/src/primitives/entries/BasePoint.d.ts`
`./primitives/JacobianPoint`	`./dist/esm/src/primitives/entries/JacobianPoint.js` `./dist/cjs/src/primitives/entries/JacobianPoint.js`	`./dist/types/src/primitives/entries/JacobianPoint.d.ts` `./dist/cjs/src/primitives/entries/JacobianPoint.d.ts`
`./primitives/JacobianPoint.ts`	`./dist/esm/src/primitives/entries/JacobianPoint.js` `./dist/cjs/src/primitives/entries/JacobianPoint.js`	`./dist/types/src/primitives/entries/JacobianPoint.d.ts` `./dist/cjs/src/primitives/entries/JacobianPoint.d.ts`
`./primitives/*.ts`	`./dist/esm/src/primitives/.js` `./dist/cjs/src/primitives/.js`	`./dist/types/src/primitives/.d.ts` `./dist/cjs/src/primitives/.d.ts`
`./primitives/*`	`./dist/esm/src/primitives/.js` `./dist/cjs/src/primitives/.js`	`./dist/types/src/primitives/.d.ts` `./dist/cjs/src/primitives/.d.ts`
`./script`	`./dist/esm/src/script/index.js` `./dist/cjs/src/script/index.js`	`./dist/types/src/script/index.d.ts` `./dist/cjs/src/script/index.d.ts`
`./script/*.ts`	`./dist/esm/src/script/.js` `./dist/cjs/src/script/.js`	`./dist/types/src/script/.d.ts` `./dist/cjs/src/script/.d.ts`
`./script/*`	`./dist/esm/src/script/.js` `./dist/cjs/src/script/.js`	`./dist/types/src/script/.d.ts` `./dist/cjs/src/script/.d.ts`
`./script/templates`	`./dist/esm/src/script/templates/index.js` `./dist/cjs/src/script/templates/index.js`	`./dist/types/src/script/templates/index.d.ts` `./dist/cjs/src/script/templates/index.d.ts`
`./script/templates/*.ts`	`./dist/esm/src/script/templates/.js` `./dist/cjs/src/script/templates/.js`	`./dist/types/src/script/templates/.d.ts` `./dist/cjs/src/script/templates/.d.ts`
`./script/templates/*`	`./dist/esm/src/script/templates/.js` `./dist/cjs/src/script/templates/.js`	`./dist/types/src/script/templates/.d.ts` `./dist/cjs/src/script/templates/.d.ts`
`./transaction`	`./dist/esm/src/transaction/index.js` `./dist/cjs/src/transaction/index.js`	`./dist/types/src/transaction/index.d.ts` `./dist/cjs/src/transaction/index.d.ts`
`./transaction/*.ts`	`./dist/esm/src/transaction/.js` `./dist/cjs/src/transaction/.js`	`./dist/types/src/transaction/.d.ts` `./dist/cjs/src/transaction/.d.ts`
`./transaction/*`	`./dist/esm/src/transaction/.js` `./dist/cjs/src/transaction/.js`	`./dist/types/src/transaction/.d.ts` `./dist/cjs/src/transaction/.d.ts`
`./transaction/broadcaster`	`./dist/esm/src/transaction/broadcasters/index.js` `./dist/cjs/src/transaction/broadcasters/index.js`	`./dist/types/src/transaction/broadcasters/index.d.ts` `./dist/cjs/src/transaction/broadcasters/index.d.ts`
`./transaction/broadcaster/*.ts`	`./dist/esm/src/transaction/broadcasters/.js` `./dist/cjs/src/transaction/broadcasters/.js`	`./dist/types/src/transaction/broadcasters/.d.ts` `./dist/cjs/src/transaction/broadcasters/.d.ts`
`./transaction/broadcaster/*`	`./dist/esm/src/transaction/broadcasters/.js` `./dist/cjs/src/transaction/broadcasters/.js`	`./dist/types/src/transaction/broadcasters/.d.ts` `./dist/cjs/src/transaction/broadcasters/.d.ts`
`./transaction/broadcasters`	`./dist/esm/src/transaction/broadcasters/index.js` `./dist/cjs/src/transaction/broadcasters/index.js`	`./dist/types/src/transaction/broadcasters/index.d.ts` `./dist/cjs/src/transaction/broadcasters/index.d.ts`
`./transaction/broadcasters/*.ts`	`./dist/esm/src/transaction/broadcasters/.js` `./dist/cjs/src/transaction/broadcasters/.js`	`./dist/types/src/transaction/broadcasters/.d.ts` `./dist/cjs/src/transaction/broadcasters/.d.ts`
`./transaction/broadcasters/*`	`./dist/esm/src/transaction/broadcasters/.js` `./dist/cjs/src/transaction/broadcasters/.js`	`./dist/types/src/transaction/broadcasters/.d.ts` `./dist/cjs/src/transaction/broadcasters/.d.ts`
`./transaction/chaintrackers`	`./dist/esm/src/transaction/chaintrackers/index.js` `./dist/cjs/src/transaction/chaintrackers/index.js`	`./dist/types/src/transaction/chaintrackers/index.d.ts` `./dist/cjs/src/transaction/chaintrackers/index.d.ts`
`./transaction/chaintrackers/*.ts`	`./dist/esm/src/transaction/chaintrackers/.js` `./dist/cjs/src/transaction/chaintrackers/.js`	`./dist/types/src/transaction/chaintrackers/.d.ts` `./dist/cjs/src/transaction/chaintrackers/.d.ts`
`./transaction/chaintrackers/*`	`./dist/esm/src/transaction/chaintrackers/.js` `./dist/cjs/src/transaction/chaintrackers/.js`	`./dist/types/src/transaction/chaintrackers/.d.ts` `./dist/cjs/src/transaction/chaintrackers/.d.ts`
`./transaction/http`	`./dist/esm/src/transaction/http/index.js` `./dist/cjs/src/transaction/http/index.js`	`./dist/types/src/transaction/http/index.d.ts` `./dist/cjs/src/transaction/http/index.d.ts`
`./transaction/http/*.ts`	`./dist/esm/src/transaction/http/.js` `./dist/cjs/src/transaction/http/.js`	`./dist/types/src/transaction/http/.d.ts` `./dist/cjs/src/transaction/http/.d.ts`
`./transaction/http/*`	`./dist/esm/src/transaction/http/.js` `./dist/cjs/src/transaction/http/.js`	`./dist/types/src/transaction/http/.d.ts` `./dist/cjs/src/transaction/http/.d.ts`
`./transaction/fee-model`	`./dist/esm/src/transaction/fee-models/index.js` `./dist/cjs/src/transaction/fee-models/index.js`	`./dist/types/src/transaction/fee-models/index.d.ts` `./dist/cjs/src/transaction/fee-models/index.d.ts`
`./transaction/fee-model/*.ts`	`./dist/esm/src/transaction/fee-models/.js` `./dist/cjs/src/transaction/fee-models/.js`	`./dist/types/src/transaction/fee-models/.d.ts` `./dist/cjs/src/transaction/fee-models/.d.ts`
`./transaction/fee-model/*`	`./dist/esm/src/transaction/fee-models/.js` `./dist/cjs/src/transaction/fee-models/.js`	`./dist/types/src/transaction/fee-models/.d.ts` `./dist/cjs/src/transaction/fee-models/.d.ts`
`./transaction/fee-models`	`./dist/esm/src/transaction/fee-models/index.js` `./dist/cjs/src/transaction/fee-models/index.js`	`./dist/types/src/transaction/fee-models/index.d.ts` `./dist/cjs/src/transaction/fee-models/index.d.ts`
`./transaction/fee-models/*.ts`	`./dist/esm/src/transaction/fee-models/.js` `./dist/cjs/src/transaction/fee-models/.js`	`./dist/types/src/transaction/fee-models/.d.ts` `./dist/cjs/src/transaction/fee-models/.d.ts`
`./transaction/fee-models/*`	`./dist/esm/src/transaction/fee-models/.js` `./dist/cjs/src/transaction/fee-models/.js`	`./dist/types/src/transaction/fee-models/.d.ts` `./dist/cjs/src/transaction/fee-models/.d.ts`
`./messages`	`./dist/esm/src/messages/index.js` `./dist/cjs/src/messages/index.js`	`./dist/types/src/messages/index.d.ts` `./dist/cjs/src/messages/index.d.ts`
`./messages/*.ts`	`./dist/esm/src/messages/.js` `./dist/cjs/src/messages/.js`	`./dist/types/src/messages/.d.ts` `./dist/cjs/src/messages/.d.ts`
`./messages/*`	`./dist/esm/src/messages/.js` `./dist/cjs/src/messages/.js`	`./dist/types/src/messages/.d.ts` `./dist/cjs/src/messages/.d.ts`
`./compat`	`./dist/esm/src/compat/index.js` `./dist/cjs/src/compat/index.js`	`./dist/types/src/compat/index.d.ts` `./dist/cjs/src/compat/index.d.ts`
`./compat/*.ts`	`./dist/esm/src/compat/.js` `./dist/cjs/src/compat/.js`	`./dist/types/src/compat/.d.ts` `./dist/cjs/src/compat/.d.ts`
`./compat/*`	`./dist/esm/src/compat/.js` `./dist/cjs/src/compat/.js`	`./dist/types/src/compat/.d.ts` `./dist/cjs/src/compat/.d.ts`
`./totp`	`./dist/esm/src/totp/index.js` `./dist/cjs/src/totp/index.js`	`./dist/types/src/totp/index.d.ts` `./dist/cjs/src/totp/index.d.ts`
`./totp/*.ts`	`./dist/esm/src/totp/.js` `./dist/cjs/src/totp/.js`	`./dist/types/src/totp/.d.ts` `./dist/cjs/src/totp/.d.ts`
`./totp/*`	`./dist/esm/src/totp/.js` `./dist/cjs/src/totp/.js`	`./dist/types/src/totp/.d.ts` `./dist/cjs/src/totp/.d.ts`
`./wallet`	`./dist/esm/src/wallet/index.js` `./dist/cjs/src/wallet/index.js`	`./dist/types/src/wallet/index.d.ts` `./dist/cjs/src/wallet/index.d.ts`
`./wallet/*.ts`	`./dist/esm/src/wallet/.js` `./dist/cjs/src/wallet/.js`	`./dist/types/src/wallet/.d.ts` `./dist/cjs/src/wallet/.d.ts`
`./wallet/*`	`./dist/esm/src/wallet/.js` `./dist/cjs/src/wallet/.js`	`./dist/types/src/wallet/.d.ts` `./dist/cjs/src/wallet/.d.ts`
`./wallet/substrates`	`./dist/esm/src/wallet/substrates/index.js` `./dist/cjs/src/wallet/substrates/index.js`	`./dist/types/src/wallet/substrates/index.d.ts` `./dist/cjs/src/wallet/substrates/index.d.ts`
`./wallet/substrates/*.ts`	`./dist/esm/src/wallet/substrates/.js` `./dist/cjs/src/wallet/substrates/.js`	`./dist/types/src/wallet/substrates/.d.ts` `./dist/cjs/src/wallet/substrates/.d.ts`
`./wallet/substrates/*`	`./dist/esm/src/wallet/substrates/.js` `./dist/cjs/src/wallet/substrates/.js`	`./dist/types/src/wallet/substrates/.d.ts` `./dist/cjs/src/wallet/substrates/.d.ts`
`./auth`	`./dist/esm/src/auth/index.js` `./dist/cjs/src/auth/index.js`	`./dist/types/src/auth/index.d.ts` `./dist/cjs/src/auth/index.d.ts`
`./auth/*.ts`	`./dist/esm/src/auth/.js` `./dist/cjs/src/auth/.js`	`./dist/types/src/auth/.d.ts` `./dist/cjs/src/auth/.d.ts`
`./auth/*`	`./dist/esm/src/auth/.js` `./dist/cjs/src/auth/.js`	`./dist/types/src/auth/.d.ts` `./dist/cjs/src/auth/.d.ts`
`./auth/certificate`	`./dist/esm/src/auth/certificates/index.js` `./dist/cjs/src/auth/certificates/index.js`	`./dist/types/src/auth/certificates/index.d.ts` `./dist/cjs/src/auth/certificates/index.d.ts`
`./auth/certificate/*.ts`	`./dist/esm/src/auth/certificates/.js` `./dist/cjs/src/auth/certificates/.js`	`./dist/types/src/auth/certificates/.d.ts` `./dist/cjs/src/auth/certificates/.d.ts`
`./auth/certificate/*`	`./dist/esm/src/auth/certificates/.js` `./dist/cjs/src/auth/certificates/.js`	`./dist/types/src/auth/certificates/.d.ts` `./dist/cjs/src/auth/certificates/.d.ts`
`./auth/certificates`	`./dist/esm/src/auth/certificates/index.js` `./dist/cjs/src/auth/certificates/index.js`	`./dist/types/src/auth/certificates/index.d.ts` `./dist/cjs/src/auth/certificates/index.d.ts`
`./auth/certificates/*.ts`	`./dist/esm/src/auth/certificates/.js` `./dist/cjs/src/auth/certificates/.js`	`./dist/types/src/auth/certificates/.d.ts` `./dist/cjs/src/auth/certificates/.d.ts`
`./auth/certificates/*`	`./dist/esm/src/auth/certificates/.js` `./dist/cjs/src/auth/certificates/.js`	`./dist/types/src/auth/certificates/.d.ts` `./dist/cjs/src/auth/certificates/.d.ts`
`./identity`	`./dist/esm/src/identity/index.js` `./dist/cjs/src/identity/index.js`	`./dist/types/src/identity/index.d.ts` `./dist/cjs/src/identity/index.d.ts`
`./identity/*.ts`	`./dist/esm/src/identity/.js` `./dist/cjs/src/identity/.js`	`./dist/types/src/identity/.d.ts` `./dist/cjs/src/identity/.d.ts`
`./identity/*`	`./dist/esm/src/identity/.js` `./dist/cjs/src/identity/.js`	`./dist/types/src/identity/.d.ts` `./dist/cjs/src/identity/.d.ts`
`./overlay-tools`	`./dist/esm/src/overlay-tools/index.js` `./dist/cjs/src/overlay-tools/index.js`	`./dist/types/src/overlay-tools/index.d.ts` `./dist/cjs/src/overlay-tools/index.d.ts`
`./overlay-tools/*.ts`	`./dist/esm/src/overlay-tools/.js` `./dist/cjs/src/overlay-tools/.js`	`./dist/types/src/overlay-tools/.d.ts` `./dist/cjs/src/overlay-tools/.d.ts`
`./overlay-tools/*`	`./dist/esm/src/overlay-tools/.js` `./dist/cjs/src/overlay-tools/.js`	`./dist/types/src/overlay-tools/.d.ts` `./dist/cjs/src/overlay-tools/.d.ts`
`./telemetry`	`./dist/esm/src/telemetry/index.js` `./dist/cjs/src/telemetry/index.js`	`./dist/types/src/telemetry/index.d.ts` `./dist/cjs/src/telemetry/index.d.ts`
`./telemetry/*.ts`	`./dist/esm/src/telemetry/.js` `./dist/cjs/src/telemetry/.js`	`./dist/types/src/telemetry/.d.ts` `./dist/cjs/src/telemetry/.d.ts`
`./telemetry/*`	`./dist/esm/src/telemetry/.js` `./dist/cjs/src/telemetry/.js`	`./dist/types/src/telemetry/.d.ts` `./dist/cjs/src/telemetry/.d.ts`
`./storage`	`./dist/esm/src/storage/index.js` `./dist/cjs/src/storage/index.js`	`./dist/types/src/storage/index.d.ts` `./dist/cjs/src/storage/index.d.ts`
`./storage/*.ts`	`./dist/esm/src/storage/.js` `./dist/cjs/src/storage/.js`	`./dist/types/src/storage/.d.ts` `./dist/cjs/src/storage/.d.ts`
`./storage/*`	`./dist/esm/src/storage/.js` `./dist/cjs/src/storage/.js`	`./dist/types/src/storage/.d.ts` `./dist/cjs/src/storage/.d.ts`
`./kvstore`	`./dist/esm/src/kvstore/index.js` `./dist/cjs/src/kvstore/index.js`	`./dist/types/src/kvstore/index.d.ts` `./dist/cjs/src/kvstore/index.d.ts`
`./kvstore/*.ts`	`./dist/esm/src/kvstore/.js` `./dist/cjs/src/kvstore/.js`	`./dist/types/src/kvstore/.d.ts` `./dist/cjs/src/kvstore/.d.ts`
`./kvstore/*`	`./dist/esm/src/kvstore/.js` `./dist/cjs/src/kvstore/.js`	`./dist/types/src/kvstore/.d.ts` `./dist/cjs/src/kvstore/.d.ts`
`./remittance`	`./dist/esm/src/remittance/index.js` `./dist/cjs/src/remittance/index.js`	`./dist/types/src/remittance/index.d.ts` `./dist/cjs/src/remittance/index.d.ts`
`./remittance/*.ts`	`./dist/esm/src/remittance/.js` `./dist/cjs/src/remittance/.js`	`./dist/types/src/remittance/.d.ts` `./dist/cjs/src/remittance/.d.ts`
`./remittance/*`	`./dist/esm/src/remittance/.js` `./dist/cjs/src/remittance/.js`	`./dist/types/src/remittance/.d.ts` `./dist/cjs/src/remittance/.d.ts`
`./umd`	`./dist/esm/src/umd.js`	`./dist/types/src/umd.d.ts`

@bsv/simple

Package documentation: docs/packages/helpers/simple.md
Source: packages/helpers/simple
Release note: Corrects PushDrop self-derivation ownership, pins Message Box responses to the authenticated peer, hardens wallet, credential, DID, persistence, and transaction boundaries, preserves explicit offline migration identifiers and historical signature verification for pre-0.6 short certificate types while keeping new issuance, remote metadata, and wallet operations canonical 32-byte, and changes the generated server-wallet handler to require explicit authenticated action-level authorization. Preserves original BRC52 signed bytes, including the SDK certificate serializer's existing field order; persisted local field ordering remains a separate concern. Replaces mutable serial DID tooling with offline identity-key DID adapters and copied VC/VP proof wrappers with original-signature-preserving BRC52 envelopes. Retains certificate issuance/acquisition/revocation and persisted data. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Output-count reads reject a listOutputs result whose totalOutputs is not a number. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: Simple0.7 is a breaking pre-1.0 candidate. Remove mutable DID/resolver/provider configuration, proxy handlers and DIDError/types; use DID.fromIdentityKey/resolve and wallet.getDID. CredentialIssuer.issue returns {credential,keyringForSubject}; verify accepts exact JSON or UTF8 bytes and returns structured cryptographic results. The HTTP verify route now requires {credential: originalEnvelopeJson} with original text as a string; parsed objects return HTTP400. Web request decoding rejects duplicate members and invalid UTF8, and custom parsed-body adapters must establish equivalent strict decoding. Preserve received text and inspect verification.verified, not HTTP success. Local revocation record status is retained/unknown, not inferred chain revocation. See docs/guides/identity-did-vc-migration.md. Replace createServerWalletHandler() deployments with createServerWalletHandler({ authorize: async ({ action, headers }) => authenticatedSessionCanUseAction(headers, action) }). The callback must return literal true for each status, create, request, receive, balance, outputs, or reset action; omission now returns HTTP 403 for every action. Roll out the authentication layer and callback with the package, update anonymous probes or automation, and apply the same policy to every replica. Do not emulate the old public behavior with an unconditional authorize: () => true callback. Valid recipient derivations and authenticated Message Box peers remain supported; malformed, wrong-owner, or transaction-mutated flows now fail closed. New CredentialSchema and Certifier records use canonical 32-byte types. Current SDK wallet methods reject historical short types, so do not put migration aliases in wallet list, acquire, prove, or relinquish calls. Export affected records through the storage version that created them, authenticate them offline against the exact locally configured identifier, and reissue/import canonical replacements; no legacy certificate is rewritten automatically. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/. Persisted local field ordering requires no migration; transport adapters preserve original certificate signing bytes. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs` `./dist/index.cjs`	`./dist/index.d.mts` `./dist/index.d.cts`
`./browser`	`./dist/browser.mjs` `./dist/browser.cjs`	`./dist/browser.d.mts` `./dist/browser.d.cts`
`./server`	`./dist/server.mjs` `./dist/server.cjs`	`./dist/server.d.mts` `./dist/server.d.cts`

@bsv/templates

Package documentation: docs/packages/helpers/templates.md
Source: packages/helpers/ts-templates
Release note: Templates 2.0.0 replaces the Mandala token format with BRC-162 (BSV-21 binary) token outputs. Adds Bsv21Binary: an encoder and decoder for the BRC-162 prefix (token id, amount, optional payload) in front of any locking script, with exactly one accepted encoding per value (32-byte id as a direct push; amount OP_0, OP_1..OP_16 or a minimal direct push; amounts as bigint up to 2^64-1), role helpers, 0 token-id strings, lock/lockBRC29 and a P2PKH unlock. Adds a hand-rolled strict DAG-CBOR subset codec (encodeStrictCbor/decodeStrictCbor) with no new runtime dependency, safe in CommonJS and ESM. Includes the 1.10.3 CommonJS interop fix (issue #571): SDK classes are imported by name from the SDK barrels. Removes MandalaToken, MandalaAdmin and ADMIN_PROTOCOL. Also publishes the SDK 3 peer alternative already declared in source (superseded 1.10.4 candidate, PR #729): @bsv/sdk ^2.1.6 || ^3.0.0. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Adds OneColor, the BRC-162 1Color template: the same prefix rules as Bsv21Binary plus 36-byte token ids for assets first deployed under BRC-161 at a nonzero output, rejecting a 36-byte id with vout 0, with tokenIdFromString and tokenIdToString for ids. OneColorError, OneColorDecoded and OneColorRole name the shared error class and types. Bsv21Binary is unchanged. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound. Templates 2.2.0 builds on the published 2.1.1 and includes it (the SDK4 peer floor stays ^4.0.1 alongside the unchanged SDK2/3 alternatives), and adds the BRC-162 1Color attribute reader: readOneColorAttributes classifies a payload as absent, empty, opaque or a strict DAG-CBOR map and reports dec, sym, icon, req and ext as absent, valid or malformed; reqMatchesDeploy compares a repeated req with the deploy's canonical bytes (an absent deploy map is empty); isProfileId checks processing-profile identifiers; OneColor.lockRemainder writes the prefix in front of any locking script, with an explicit OP_0 OP_DROP when the remainder begins with OP_DROP; oneColorTokenIdFromString and oneColorTokenIdToString are the preferred 36-byte-aware id helpers. Bsv21Binary, Bsv21Token and every existing export are unchanged.
Migration: Breaking. Removed exports: MandalaToken, MandalaTokenDecoded, MandalaAdmin, ADMIN_PROTOCOL, MandalaAdminDecoded, MandalaActionDetails, MandalaActionKind, MandalaAdminLockParams, MandalaAdminUnlockParams and AssetMetadata. Removed subpath @bsv/templates/mandala-signing.ts. The @bsv/templates/mandala-encoding.ts subpath keeps only createMinimallyEncodedScriptChunk, decodeScriptNum and decodeScriptNumChunk; encodeScriptNum, encodeAssetId and decodeAssetId are removed. Replace MandalaToken/MandalaAdmin with Bsv21Binary: deploy, authority and value outputs are lock(tokenId | null, amount, pubKeyHash, payload?) with bigint amounts and _0 token ids (tokenIdFromString/tokenIdToString), decoded with Bsv21Binary.decode. Mandala admin actions are committed by sha256 of strict-CBOR details in the authority output payload, not by a commitment-derived key. This is a clean break with no data migration: tokens and admin chains in the old format are not readable by 2.0.0. @bsv/overlay-topics 2.0.0 consumes this format; the infra/overlay-server wiring follows after publication. SDK consumers may retain ^2.1.6 or install the SDK3 candidate; SDK3 removes the obsolete DID token API (see docs/guides/identity-did-vc-migration.md). Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. The Bsv21Binary names are unchanged; new code may import OneColor. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. 2.2.0 is additive and keeps 2.1.1's SDK peer range; no migration is required. tokenIdFromString and tokenIdToString remain 32-byte only; new 1Color code should use oneColorTokenIdFromString and oneColorTokenIdToString.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/mod.js` `./dist/mod.cjs`	`./dist/mod.d.ts` `./dist/mod.d.cts`
`./*.ts`	`./dist/src/.js` `./dist/src/.cjs`	`./dist/src/.d.ts` `./dist/src/.d.cts`

@bsv/teranode-listener

Package documentation: docs/packages/network/teranode-listener.md
Source: packages/network/ts-p2p
Release note: Adds optional bounded decoding for Teranode's two-layer JSON message envelope and typed topic payload interfaces. Hardens the network boundary with canonical PNET, multiaddr, topic, configuration, callback, and numeric validation; immutable caller-owned inputs; exact runtime controls; coalesced retry-safe lifecycle transitions; and a working DHT-disable control. Replaces the internal placeholder subtree hash with the canonical Bitcoin Merkle root and verifies exact uint64 values, dimensions, totals, conflicts, framing, and resource ceilings before accepting serialized subtree state. Refreshes the compatible libp2p dependency set while retaining the imported source's hash-pinned MIT provenance and notices. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No API migration is required for valid consumers: raw callbacks remain the default and decoding is opt-in with decodeMessages: true. Configuration arrays and callbacks are snapshotted at construction, boolean controls must be literal booleans, and malformed or duplicate topics, addresses, keys, and unsupported properties now fail closed. usePrivateDHT: false now actually omits the DHT service. The published mainnet PNET value is transport compatibility data, not a publisher credential; decoded sender and payload fields remain untrusted and security-critical claims require independent validation. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.js` `./dist/index.js`	`./dist/index.d.ts`
`./package.json`	`./package.json`	—

@bsv/verifast

Package documentation: docs/packages/sdk/verifast.md
Source: packages/verifast
Release note: Hardens JavaScript, worker, and WebAssembly verification boundaries with exact network and height validation, literal consensus verdicts, uint32 flags, dense bounded byte and signature inputs, bounded batches, exact verdict shapes, and deterministic preload and disposal lifecycle handling. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: Valid typed verification calls and worker protocols remain compatible. Custom module factories and WASM adapters must return the exact documented binary and boolean shapes; coercive network, height, flag, byte, batch, verdict, lifecycle, or disposed-instance values now fail closed. Keep THIRD_PARTY_NOTICES.md and LICENSES/ with every JavaScript and WebAssembly distribution. SDK consumers may retain ^2.1.8 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/mod.browser.js` `./dist/mod.js` `./dist/cjs/mod.cjs` `./dist/mod.js`	`./dist/mod.browser.d.ts` `./dist/mod.d.ts` `./dist/mod.d.cts`
`./umd`	`./dist/umd/verifast.js` `./dist/umd.js` `./dist/umd/verifast.cjs` `./dist/umd.js`	`./dist/umd.d.ts` `./dist/umd.d.cts`
`./wasm/bdk-core.umd.js`	`./dist/src/wasm/bdk-core.umd.js`	—
`./wasm/bdk-core.umd.wasm`	`./dist/src/wasm/bdk-core.umd.wasm`	—
`./wasm/bdk-core.wasm`	`./dist/src/wasm/bdk-core.wasm`	—

@bsv/wallet-helper

Package documentation: docs/packages/helpers/wallet-helper.md
Source: packages/helpers/bsv-wallet-helper
Release note: Corrects caller-owned bilateral address derivation and hardens address generation, transaction building, prevout binding, P2PKH, Ordinal, OrdLock, preimage, sighash, OP_RETURN, script, amount, output, and final-wallet-transaction validation. Adds an SDK3 peer alternative while preserving the existing SDK2 lower bound; clean packed SDK2.8.11 and SDK3 candidate consumers are documented in the identity/DID/VC migration guide. Adds an SDK4 peer alternative while preserving the existing SDK2 and SDK3 ranges. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: getAddress now derives with forSelf: true and returns the caller-owned side of the bilateral relationship. Applications that stored or coordinated the previous peer-owned result must regenerate and exchange the corrected address before sending value. Amount must be an integer from 1 through 1,000 and counterparties must be valid public keys. Valid canonical transaction-builder flows remain supported; malformed, ambiguous, or wallet-mutated results now fail closed. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. Consumers may keep their current SDK or install @bsv/sdk 4.0.1; no migration is required for this package. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.mjs` `./dist/index.cjs`	`./dist/index.d.mts` `./dist/index.d.cts`

@bsv/wallet-relay

Package documentation: docs/packages/wallet/wallet-relay.md
Source: packages/wallet/ts-wallet-relay
Release note: Adds allowLocalNetworkHttp, a development opt-in that defaults to false, on WalletRelayService, WalletRelayClient and useWalletRelayClient, WalletPairingSession, parsePairingUri, buildPairingUri, and verifyPairingSignature. When enabled it accepts plain http: origins and API URLs and ws: relay URLs on private-network IP addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, IPv6 fc00::/7), so a phone on the same LAN can pair with a development backend. HTTP origins cannot be authenticated, so the option must stay off in production. Every side now treats localhost, *.localhost, 127.0.0.0/8, and [::1] as loopback. Public hosts, all other hostnames (including *.local and wildcard-DNS names), and IPv4-mapped IPv6 literals still require https:/wss: with or without the option. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound.
Migration: No API migration is required for allowLocalNetworkHttp: the default transport policy is unchanged, except that all of 127.0.0.0/8 and, on the mobile pairing boundary, *.localhost now count as loopback. To pair a phone with a development backend on a LAN IP address, set allowLocalNetworkHttp: true on WalletRelayService, on WalletRelayClient or useWalletRelayClient, and in the wallet's parsePairingUri and WalletPairingSession calls, for example behind a developer setting; a wallet without it rejects such QR codes. Never enable it in production: an on-path attacker can rewrite the plaintext session lookup and relay URL of an HTTP origin. The WalletPairingSession and WalletRelayClient transport errors are reworded to 'Pairing origin must be HTTPS, except for loopback development' and 'Relay API URL requires HTTPS, except for loopback development.', and a server or desktop private-network rejection names allowLocalNetworkHttp; callers that matched the previous text must update the match. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

CLI entry points: {"wallet-relay":"./bin/init.mjs"}.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.js` `./dist/index.cjs`	`./dist/index.d.ts` `./dist/index.d.cts`
`./client`	`./dist/client.js` `./dist/client.cjs`	`./dist/client.d.ts` `./dist/client.d.cts`
`./react`	`./dist/react.js` `./dist/react.cjs`	`./dist/react.d.ts` `./dist/react.d.cts`
`./package.json`	`./package.json`	—

@bsv/wallet-toolbox

Package documentation: docs/packages/wallet/wallet-toolbox.md
Source: packages/wallet/wallet-toolbox
Release note: The Arcade broadcaster treats HTTP 401 and 403, which bsv-blockchain/arcade's API-key authorization returns for a missing-but-required, invalid, revoked or expired key before it reads the transaction, as service errors. A refused key previously counted as a transaction rejection, so a mistyped or revoked arcadeApiKey marked broadcasts invalid and failed their transactions; the wallet now fails over or keeps the transaction queued for retry, and the history note says whether the configured key was refused or the endpoint requires one. ARC classification is unchanged. WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Optional local SQLite controllers additionally retain exact two-phase noSend allocation/signing state and atomically reconcile one BRC-29 funding output with wallet ownership, deferred monitor work and a durable receipt. The new deep imports do not add root exports or BRC-100 RPC methods. Private recovery JSON and binary encoding now use separate internal modules with unchanged accepted bytes, exports and bounds. Recoverable noSend finalization accepts an optional synchronous current-authority guard for new signing; an existing exact final remains recoverable after expiry. The native recoverable action controller adds a synchronous read-only configuration descriptor for binding an opt-in original-payment adapter to its actual wallet, storage, network and originator; existing action behavior and RPC contracts are unchanged. Local recovery JSON ownership is factored into an internal call-local scalar, array and record context, preserving the original byte, depth, item, Unicode, descriptor and cycle rules. Adds an explicitly selected local BRC-197 fixed-child intake capability and complete existing signer/storage pipeline; ordinary BRC-29 validation, BRC-100 wire behavior, schema and defaults remain unchanged. This reference capability remains under native and end-to-end qualification. Explicit funding-recovery capacity values are typed as numbers, matching the existing configurable runtime limits. Retained-record representation and native ownership rejection regressions preserve original tests, runtime guards, defaults and stored formats. The opt-in fixed-child recipient validator also requires an exact compressed public-key round trip, rejecting noncanonical field coordinates before ownership. Native lifecycle tests retain existing transaction accounting on merges and use distinct fixture references; ordinary internalization is unchanged. BRC-177 anchors fund both the protected action and an economic reclaim. Protected actions pay the bounded reclaim allowance surplus as fee and produce no automatically generated wallet change; ordinary change planning and its positive output cap remain unchanged. BEEF request data and schema-declared storage response bytes use the existing negotiated compact binary JSON encoding. Legacy peers retain numeric-array JSON, existing authentication and payload bounds, and byte-for-byte transaction/proof content. IndexedDB treats empty certificate certifier/type, transaction status and output-tag ID arrays as unrestricted optional filters, matching Knex. Nonempty filters, partial predicates and user ownership remain enforced. Internalizing an unproven transaction new to a user attempts broadcast before storing recipient outputs, including a sender's no-send transaction already known to shared storage. A failed broadcast rejects the internalization; transactions backed by a mining proof are not rebroadcast. Confirmed internalizeAction resolves the block header before the storage writer opens, so IndexedDB stores a valid mined AtomicBEEF after an asynchronous header lookup. Invalid proofs and missing or malformed headers still reject with no partial proven-transaction, transaction, or output records. Preserves the existing empty attempted-TXID sentinel when storage detects an explicit-input double spend before constructing an action. Requires one doubleSpend result, empty send results, no constructed transaction fields and bounded nonempty competing evidence; other empty identifiers remain invalid. Adds restart-safe WAB registration checkpoints that preserve the original root across interrupted faucet redemption and UMP publication; retries recover the prior faucet action instead of creating a second root. CWIStyleWalletManager commits added or deleted profiles only when the replacement UMP token is published. Failed factor retrieval or publication preserves the previous profile list and permits retry; failed active-profile deletion attempts to restore that profile while preserving the update error. Pending case-insensitive profile names are reserved until creation settles, preventing overlapping duplicate names. A failure restoring the active wallet after publication retains the committed token and profile list. internalizeAction stores basket customInstructions with one metadata encryption when encryptWalletMetadata is enabled, including a normal basket on a call that also carries a registered permission-module label. Adds a regtest Chain for Teranode regression-network deployments: the canonical regtest genesis header, ChainTracks clients that accept the service's 'regtest' chain name, REGTEST_ARCADE_URL and REGTEST_CHAINTRACKS_URL endpoint configuration, and no WhatsOnChain provider; WhatsOnChain now refuses every request on networks without a WhatsOnChain service (tstn, regtest), and hashToHeader no longer falls back to it there. Header proof-of-work and chain-work checks take an optional chain, and proofOfWorkLimitBits(chain) reports its limit: only 'regtest' raises it to 0x207fffff; every other chain, and every check that names no chain, keeps the mainnet limit of 0x1d00ffff, so no existing validation is relaxed. Live syncToWriter/syncFromReader throw WERR_NETWORK_CHAIN when reader and writer TableSettings.chain differ, before any chunk moves. Custom processSyncChunk writers may set ProcessSyncChunkResult.error; both live-sync loops throw that error and stop. First-party providers still throw. Public exports and JSON round-trip remain. Local funding recovery and the opt-in fixed-child profile share SQL user/TXID receipt fencing with ordinary internalization. Funding-journal and SQL receipt completion commit with the same ownership write; a superseded ordinary writer cannot credit or finalize again. Acquires the local funding SQL receipt fence within the atomic journal/ownership transaction, preserving immediate post-crash recovery and independent-process coordination. Adds a transaction-bound backend receipt companion with fail-fast external-owner refusal; ordinary leases and wire behavior stay unchanged. Preserves the historical storage internalizeAction receipt argument and exposes opt-in funding recovery through the separate internalizeActionWithRecovery deep import. createAction sizes a caller-provided hex unlockingScript by its byte length when it hands the input to storage. It used the hex string's length, twice the bytes, so storage funded and priced the transaction as if that script appeared twice and overpaid the fee by the script's size at the fee rate. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound. Known bulk-header reseeding awaits each persistent insert before releasing its write lock and propagates storage errors. Grouped permission flows await their released queue tail before cleanup. Adds optional StorageClientOptions.authFetchOptions in the existing third constructor argument, forwarding the installed SDK's options across Node, browser and mobile without changing defaults, RPCs or retries.
Migration: None. Arcade API keys are configured as before, through createDefaultWalletServicesOptions arcadeApiKey or arcadeConfig.apiKey. No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. For ordinary callers, no public API, wire, database, or consumer migration is required. Recovery adoption requires SDK 3.3.0, explicit auxiliary schema installation in the active local SQLite wallet, stable operation IDs and a committed workspace. Reopen retained state after restart; never silently reinstall a missing journal. These journals are outside legacy entity snapshots, BRC-38/39 export, ordinary sync, IndexedDB and remote providers. Back up the whole consistent wallet database plus keys and test restoration. For rollback, stop new adoption and reconcile outstanding operations with the original controller before removing it; preserve journals and keys. Local receipts do not establish quote-time capacity, settlement, domain authority or protected delivery. The private encoder extraction requires no caller or stored-format migration; complete canonical mutation qualification covers every helper. Existing callers can omit checkNewSigning. The optional callback returns void synchronously or throws, and cannot undo or timestamp already-started storage effects; reconcile the original operation after uncertainty. This internal ownership refactor changes no accepted bytes, public action API, stored schema, errors or caller defaults; no additional migration is required and context is never retained between calls. BRC-197 integrations must explicitly select getBrc197InternalizationCapabilities and internalizeBrc197Action with the literal fixed remittance fields; do not Base64-encode them or route them through ordinary internalizeAction. Validate every recipient and the complete protected activation/signing, lineage, chain, fee and resource prerequisites before funding a listing. See docs/guides/brc197-fixed-child-wallet.md for the local-only boundary and outstanding qualification gates. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply. No API, wire or schema migration is required for the IndexedDB filter fix. Empty optional arrays now behave like omitted filters. Applications still receive only records allowed by their user and partial predicates; nonempty arrays retain their restrictions. No public API, wire or database migration is required for internalization broadcast. Upgrade the active storage implementation. Recipients receive a review-actions error when broadcast is rejected and must inspect that result before retrying; no recipient outputs are stored on rejection. Existing proven transactions retain their no-rebroadcast path. No API, wire, or schema migration is required for the IndexedDB confirmed-internalize fix. Upgrade the active storage implementation, including the browser client. An invalid proof, or a missing or malformed header, still rejects before any proven transaction, transaction, or output is stored. No API, wire or database migration. Upgrade the wallet parser with an application SDK that validates pre-construction review evidence against requested inputs. Use the existing JSON error transport for recovery; binary framing is unchanged. Parsing alone does not authorize retry or prove competing transaction validity. For restart-safe WAB registration, persist token bytes through pendingRegistrationTokenSaver before funding, load them with loadPendingRegistrationToken before authentication after restart, and retain them until an authenticated snapshot is saved and hasPendingRegistrationToken returns false. Recover older pending registrations without checkpoints using the original wallet state; do not redeem again with a new root. Upgrade the wallet manager package used by the host. This fixes failed-update bookkeeping, not the underlying factor-decryption error. After a post-publication profile-restoration error, inspect listProfiles before retrying: the profile change has already committed. A failed restoration may leave the default profile active. Newly internalized normal-basket customInstructions are encrypted once, matching createAction. Values already stored under the previous double encryption remain ciphertext after one listOutputs decrypt. Chain gains the 'regtest' member, so a consumer with an exhaustive switch over Chain needs a case for it. Header validation helpers gain an optional trailing chain parameter; omitting it keeps the mainnet limit, and the 'tstn' chain is unchanged. No API or schema migration is required. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. No additional caller or schema migration: the local journal passes only optional provisional-header retry classification through its commit callback, retains ownership of the SQL fence, and commits acquisition, ownership and both completion receipts in one transaction. Existing ordinary internalization keeps its lease and retry controls. Existing three-argument and fourth-argument receipt-fence internalizeAction calls require no migration. PR-local funding recovery callers use internalizeActionWithRecovery(storage, auth, args, recovery, receipt?) instead. No API, wire, or schema migration for provided unlocking-script sizing; unlockingScriptLength already meant bytes. Upgrade the signer package; storage is unchanged. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. No public API, wire or database migration for promise ownership fixes; failed bulk-file persistence is now reported to the caller. No migration is required for remote-storage timeout configuration; omission preserves the SDK defaults and all existing SDK peer alternatives. The responseTimeoutMs option requires the SDK release containing it; configure it alongside requestTimeoutMs for a longer authenticated operation. Other certificate, session and operation deadlines remain independent. Reconcile an ambiguous financial request before resubmission.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./out/src/index.js` `./out/src/index.js`	`./out/src/index.d.ts`
`./out/src/sdk`	`./out/src/sdk/index.js` `./out/src/sdk/index.js`	`./out/src/sdk/index.d.ts`
`./out/src/*`	`./out/src/*.js`	`./out/src/*.d.ts`
`./package.json`	`./package.json`	—

@bsv/wallet-toolbox-client

Package documentation: docs/packages/wallet/wallet-toolbox-client.md
Source: packages/wallet/wallet-toolbox/client
Release note: The Arcade broadcaster treats HTTP 401 and 403, which bsv-blockchain/arcade's API-key authorization returns for a missing-but-required, invalid, revoked or expired key before it reads the transaction, as service errors. A refused key previously counted as a transaction rejection, so a mistyped or revoked arcadeApiKey marked broadcasts invalid and failed their transactions; the wallet now fails over or keeps the transaction queued for retry, and the history note says whether the configured key was refused or the endpoint requires one. ARC classification is unchanged. WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. The coordinated 2.15.0 candidate retains the browser/mobile-safe API while core adds optional Node SQLite recovery through separate deep imports. Installing this wrapper does not expose those local recovery controllers or storage adapters. BRC-177 anchors fund both the protected action and an economic reclaim. Protected actions pay the bounded reclaim allowance surplus as fee and produce no automatically generated wallet change; ordinary change planning and its positive output cap remain unchanged. BEEF request data and schema-declared storage response bytes use the existing negotiated compact binary JSON encoding. Legacy peers retain numeric-array JSON, existing authentication and payload bounds, and byte-for-byte transaction/proof content. IndexedDB treats empty certificate certifier/type, transaction status and output-tag ID arrays as unrestricted optional filters, matching Knex. Nonempty filters, partial predicates and user ownership remain enforced. Internalizing an unproven transaction new to a user attempts broadcast before storing recipient outputs, including a sender's no-send transaction already known to shared storage. A failed broadcast rejects the internalization; transactions backed by a mining proof are not rebroadcast. Confirmed internalizeAction resolves the block header before the storage writer opens, so IndexedDB stores a valid mined AtomicBEEF after an asynchronous header lookup. Invalid proofs and missing or malformed headers still reject with no partial proven-transaction, transaction, or output records. Preserves the existing empty attempted-TXID sentinel when storage detects an explicit-input double spend before constructing an action. Requires one doubleSpend result, empty send results, no constructed transaction fields and bounded nonempty competing evidence; other empty identifiers remain invalid. Adds restart-safe WAB registration checkpoints that preserve the original root across interrupted faucet redemption and UMP publication; retries recover the prior faucet action instead of creating a second root. CWIStyleWalletManager commits added or deleted profiles only when the replacement UMP token is published. Failed factor retrieval or publication preserves the previous profile list and permits retry; failed active-profile deletion attempts to restore that profile while preserving the update error. Pending case-insensitive profile names are reserved until creation settles, preventing overlapping duplicate names. A failure restoring the active wallet after publication retains the committed token and profile list. internalizeAction stores basket customInstructions with one metadata encryption when encryptWalletMetadata is enabled, including a normal basket on a call that also carries a registered permission-module label. Adds a regtest Chain for Teranode regression-network deployments: the canonical regtest genesis header, ChainTracks clients that accept the service's 'regtest' chain name, REGTEST_ARCADE_URL and REGTEST_CHAINTRACKS_URL endpoint configuration, and no WhatsOnChain provider; WhatsOnChain now refuses every request on networks without a WhatsOnChain service (tstn, regtest), and hashToHeader no longer falls back to it there. Header proof-of-work and chain-work checks take an optional chain, and proofOfWorkLimitBits(chain) reports its limit: only 'regtest' raises it to 0x207fffff; every other chain, and every check that names no chain, keeps the mainnet limit of 0x1d00ffff, so no existing validation is relaxed. Live syncToWriter/syncFromReader throw WERR_NETWORK_CHAIN when reader and writer TableSettings.chain differ, before any chunk moves. Custom processSyncChunk writers may set ProcessSyncChunkResult.error; both live-sync loops throw that error and stop. First-party providers still throw. Public exports and JSON round-trip remain. createAction sizes a caller-provided hex unlockingScript by its byte length when it hands the input to storage. It used the hex string's length, twice the bytes, so storage funded and priced the transaction as if that script appeared twice and overpaid the fee by the script's size at the fee rate. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound. Adds optional StorageClientOptions.authFetchOptions in the existing third constructor argument, forwarding the installed SDK's options across Node, browser and mobile without changing defaults, RPCs or retries.
Migration: None. Arcade API keys are configured as before, through createDefaultWalletServicesOptions arcadeApiKey or arcadeConfig.apiKey. No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. For ordinary callers, no public API, wire, database, or consumer migration is required. Existing SDK peer ranges and browser/mobile/remote provider capabilities remain unchanged. The core local SQLite recovery guides do not grant IndexedDB, mobile or remote recovery guarantees. Do not replace durable core recovery with wrapper retries or entity-only backups; preserve any core journals and keys through rollback. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply. No API, wire or schema migration is required for the IndexedDB filter fix. Empty optional arrays now behave like omitted filters. Applications still receive only records allowed by their user and partial predicates; nonempty arrays retain their restrictions. No public API, wire or database migration is required for internalization broadcast. Upgrade the active storage implementation. Recipients receive a review-actions error when broadcast is rejected and must inspect that result before retrying; no recipient outputs are stored on rejection. Existing proven transactions retain their no-rebroadcast path. No API, wire, or schema migration is required for the IndexedDB confirmed-internalize fix. Upgrade the active storage implementation, including the browser client. An invalid proof, or a missing or malformed header, still rejects before any proven transaction, transaction, or output is stored. No API, wire or database migration. Upgrade the wallet parser with an application SDK that validates pre-construction review evidence against requested inputs. Use the existing JSON error transport for recovery; binary framing is unchanged. Parsing alone does not authorize retry or prove competing transaction validity. For restart-safe WAB registration, persist token bytes through pendingRegistrationTokenSaver before funding, load them with loadPendingRegistrationToken before authentication after restart, and retain them until an authenticated snapshot is saved and hasPendingRegistrationToken returns false. Recover older pending registrations without checkpoints using the original wallet state; do not redeem again with a new root. Upgrade the wallet manager package used by the host. This fixes failed-update bookkeeping, not the underlying factor-decryption error. After a post-publication profile-restoration error, inspect listProfiles before retrying: the profile change has already committed. A failed restoration may leave the default profile active. Newly internalized normal-basket customInstructions are encrypted once, matching createAction. Values already stored under the previous double encryption remain ciphertext after one listOutputs decrypt. Chain gains the 'regtest' member, so a consumer with an exhaustive switch over Chain needs a case for it. Header validation helpers gain an optional trailing chain parameter; omitting it keeps the mainnet limit, and the 'tstn' chain is unchanged. No API or schema migration is required. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. No API, wire, or schema migration for provided unlocking-script sizing; unlockingScriptLength already meant bytes. Upgrade the signer package; storage is unchanged. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. No migration is required for remote-storage timeout configuration; omission preserves the SDK defaults and all existing SDK peer alternatives. The responseTimeoutMs option requires the SDK release containing it; configure it alongside requestTimeoutMs for a longer authenticated operation. Other certificate, session and operation deadlines remain independent. Reconcile an ambiguous financial request before resubmission.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./out/index.client.mjs` `./out/index.client.mjs` `./out/index.client.cjs`	`./out/index.client.d.mts` `./out/index.client.d.mts` `./out/index.client.d.cts`
`./package.json`	`./package.json`	—

@bsv/wallet-toolbox-mobile

Package documentation: docs/packages/wallet/wallet-toolbox-mobile.md
Source: packages/wallet/wallet-toolbox/mobile
Release note: The Arcade broadcaster treats HTTP 401 and 403, which bsv-blockchain/arcade's API-key authorization returns for a missing-but-required, invalid, revoked or expired key before it reads the transaction, as service errors. A refused key previously counted as a transaction rejection, so a mistyped or revoked arcadeApiKey marked broadcasts invalid and failed their transactions; the wallet now fails over or keeps the transaction queued for retry, and the history note says whether the configured key was refused or the endpoint requires one. ARC classification is unchanged. WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. The coordinated 2.15.0 candidate retains the browser/mobile-safe API while core adds optional Node SQLite recovery through separate deep imports. Installing this wrapper does not expose those local recovery controllers or storage adapters. BRC-177 anchors fund both the protected action and an economic reclaim. Protected actions pay the bounded reclaim allowance surplus as fee and produce no automatically generated wallet change; ordinary change planning and its positive output cap remain unchanged. BEEF request data and schema-declared storage response bytes use the existing negotiated compact binary JSON encoding. Legacy peers retain numeric-array JSON, existing authentication and payload bounds, and byte-for-byte transaction/proof content. Internalizing an unproven transaction new to a user attempts broadcast before storing recipient outputs, including a sender's no-send transaction already known to shared storage. A failed broadcast rejects the internalization; transactions backed by a mining proof are not rebroadcast. Confirmed internalizeAction resolves the block header before the storage writer opens, so IndexedDB stores a valid mined AtomicBEEF after an asynchronous header lookup. Invalid proofs and missing or malformed headers still reject with no partial proven-transaction, transaction, or output records. Preserves the existing empty attempted-TXID sentinel when storage detects an explicit-input double spend before constructing an action. Requires one doubleSpend result, empty send results, no constructed transaction fields and bounded nonempty competing evidence; other empty identifiers remain invalid. Adds restart-safe WAB registration checkpoints that preserve the original root across interrupted faucet redemption and UMP publication; retries recover the prior faucet action instead of creating a second root. CWIStyleWalletManager commits added or deleted profiles only when the replacement UMP token is published. Failed factor retrieval or publication preserves the previous profile list and permits retry; failed active-profile deletion attempts to restore that profile while preserving the update error. Pending case-insensitive profile names are reserved until creation settles, preventing overlapping duplicate names. A failure restoring the active wallet after publication retains the committed token and profile list. internalizeAction stores basket customInstructions with one metadata encryption when encryptWalletMetadata is enabled, including a normal basket on a call that also carries a registered permission-module label. Adds a regtest Chain for Teranode regression-network deployments: the canonical regtest genesis header, ChainTracks clients that accept the service's 'regtest' chain name, REGTEST_ARCADE_URL and REGTEST_CHAINTRACKS_URL endpoint configuration, and no WhatsOnChain provider; WhatsOnChain now refuses every request on networks without a WhatsOnChain service (tstn, regtest), and hashToHeader no longer falls back to it there. Header proof-of-work and chain-work checks take an optional chain, and proofOfWorkLimitBits(chain) reports its limit: only 'regtest' raises it to 0x207fffff; every other chain, and every check that names no chain, keeps the mainnet limit of 0x1d00ffff, so no existing validation is relaxed. Live syncToWriter/syncFromReader throw WERR_NETWORK_CHAIN when reader and writer TableSettings.chain differ, before any chunk moves. Custom processSyncChunk writers may set ProcessSyncChunkResult.error; both live-sync loops throw that error and stop. First-party providers still throw. Public exports and JSON round-trip remain. createAction sizes a caller-provided hex unlockingScript by its byte length when it hands the input to storage. It used the hex string's length, twice the bytes, so storage funded and priced the transaction as if that script appeared twice and overpaid the fee by the script's size at the fee rate. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound. Adds optional StorageClientOptions.authFetchOptions in the existing third constructor argument, forwarding the installed SDK's options across Node, browser and mobile without changing defaults, RPCs or retries.
Migration: None. Arcade API keys are configured as before, through createDefaultWalletServicesOptions arcadeApiKey or arcadeConfig.apiKey. No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. For ordinary callers, no public API, wire, database, or consumer migration is required. Existing SDK peer ranges and browser/mobile/remote provider capabilities remain unchanged. The core local SQLite recovery guides do not grant IndexedDB, mobile or remote recovery guarantees. Do not replace durable core recovery with wrapper retries or entity-only backups; preserve any core journals and keys through rollback. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply. No public API, wire or database migration is required for internalization broadcast. Upgrade the active storage implementation. Recipients receive a review-actions error when broadcast is rejected and must inspect that result before retrying; no recipient outputs are stored on rejection. Existing proven transactions retain their no-rebroadcast path. No API, wire, or schema migration is required for the IndexedDB confirmed-internalize fix. Upgrade the active storage implementation, including the browser client. An invalid proof, or a missing or malformed header, still rejects before any proven transaction, transaction, or output is stored. No API, wire or database migration. Upgrade the wallet parser with an application SDK that validates pre-construction review evidence against requested inputs. Use the existing JSON error transport for recovery; binary framing is unchanged. Parsing alone does not authorize retry or prove competing transaction validity. For restart-safe WAB registration, persist token bytes through pendingRegistrationTokenSaver before funding, load them with loadPendingRegistrationToken before authentication after restart, and retain them until an authenticated snapshot is saved and hasPendingRegistrationToken returns false. Recover older pending registrations without checkpoints using the original wallet state; do not redeem again with a new root. Upgrade the wallet manager package used by the host. This fixes failed-update bookkeeping, not the underlying factor-decryption error. After a post-publication profile-restoration error, inspect listProfiles before retrying: the profile change has already committed. A failed restoration may leave the default profile active. Newly internalized normal-basket customInstructions are encrypted once, matching createAction. Values already stored under the previous double encryption remain ciphertext after one listOutputs decrypt. Chain gains the 'regtest' member, so a consumer with an exhaustive switch over Chain needs a case for it. Header validation helpers gain an optional trailing chain parameter; omitting it keeps the mainnet limit, and the 'tstn' chain is unchanged. No API or schema migration is required. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. No API, wire, or schema migration for provided unlocking-script sizing; unlockingScriptLength already meant bytes. Upgrade the signer package; storage is unchanged. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required. No migration is required for remote-storage timeout configuration; omission preserves the SDK defaults and all existing SDK peer alternatives. The responseTimeoutMs option requires the SDK release containing it; configure it alongside requestTimeoutMs for a longer authenticated operation. Other certificate, session and operation deadlines remain independent. Reconcile an ambiguous financial request before resubmission.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./out/index.mobile.mjs` `./out/index.mobile.mjs` `./out/index.mobile.cjs`	`./out/index.mobile.d.mts` `./out/index.mobile.d.mts` `./out/index.mobile.d.cts`
`./package.json`	`./package.json`	—

@bsv/webrtpay

Package documentation: docs/packages/messaging/webrtpay.md
Source: packages/messaging/webrtpay
Release note: Publishes the already merged React Native data-channel compatibility fix through the protected trusted-publisher workflow with SLSA provenance. The answerer accepts the native unlimited-retransmission sentinels -1 and 65535, as well as the DOM null value; other channel ordering and protocol checks remain unchanged. This also repairs the missing provenance on the earlier 0.2.1 registry artifact without weakening registry verification. Keeps an offer link open until the absolute whole-second expiry encoded in its offer code. An early timer wake checks the remaining time and reschedules rather than closing a still-valid offer. Completed handshakes and explicit cancellation continue to clear the active expiry timer. Requires the repaired SDK4.0.1 hotfix for the SDK4 peer alternative while retaining every existing SDK2/3 alternative and lower bound. Aligns the exported VERSION with package 0.2.3.
Migration: No consumer migration required. Public exports, dependency ranges, relay readiness and browser behavior remain unchanged. React Native answerers can accept unlimited reliable channels reported with native sentinel values. Use the attested 0.2.2 artifact for verified releases. No consumer migration required. Offer code bytes, encoded expiry, timeout errors and handshake behavior are unchanged. Offers remain available until their encoded expiry even when a timer wakes early. SDK4 consumers must use @bsv/sdk >=4.0.1 <5; SDK2/3 consumers retain their existing ranges. No application-wallet wire or data migration is required.

CLI entry points: {"webrtpay-relay":"dist/server/cli.js"}.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/src/index.js` `./dist/src/index.js`	`./dist/src/index.d.ts`
`./server`	`./dist/server/index.js` `./dist/server/index.js`	`./dist/server/index.d.ts`
`./package.json`	`./package.json`	—

create-bsv-app

Package documentation: docs/packages/helpers/create-bsv-app.md
Source: packages/helpers/create-bsv-app
Release note: New projects created through the interactive terminal flow or --ui now default to the full custom stack: React frontend, Express backend, and every capability selected, with None as the last option. The BSV helpers directory is no longer prompted (use --bsv-dir or the config file bsvDir), and the glue prompt is reworded for non-technical users. --ui now honours CLI flags, submits only visible fields, defaults the project name to the target directory, shows the actual configuration error, includes --dir and --name in the copied command, keeps per-mode values when switching between new and add, and rejects unknown --capabilities or an unsafe --bsv-dir before starting. Repository starters such as meter can now be generated from --ui. Both flows say when an existing project already has every capability. A generated full-stack project now builds: useWalletLogin imports requireIdentityKey and re-binds when the wallet identity changes, apiClient passes TypeScript 6's BodyInit check, the auth helpers type the server wallet as @bsv/auth ProofVerifierWallet instead of any, and the Express skeleton ships a .gitignore. Generated projects use @bsv/wallet-relay ^0.7.0 and @bsv/sdk ^2.4.1, and the server's own ws dependency is dropped because the relay ships it. A new SERVER_ORIGIN server setting (default http://localhost:, required and HTTPS in production, plain HTTP only on localhost names or loopback or private-network IP addresses) is the address a phone uses to reach the server: the generated GET /api/session embeds it in the pairing QR instead of the browser's localhost Origin, and the relay WebSocket URL is derived from it, so setting SERVER_ORIGIN=http://: lets a phone on the same network pair while the desktop browser keeps using localhost. LAN pairing over plain HTTP works in development only: the generated server passes allowLocalNetworkHttp to WalletRelayService unless NODE_ENV is production, and the generated client passes import.meta.env.DEV to useWalletRelayClient. The phone wallet must also enable local-network HTTP, or it rejects the QR. When a paired phone disconnects, the generated wallet context drops the relay wallet on the next relay poll (within 10 s by default) and shows the Connect button again; a desktop wallet is unaffected. SERVER_ORIGIN is also the origin the wallet shows the user at connect, so in production it should be the app's public HTTPS origin; with separate app and API hosts the wallet shows the API host. In add mode and with --no-glue, the manual server wiring in AGENTS.md now defines SERVER_ORIGIN and RELAY_URL itself instead of importing them from a config file those modes do not write.
Migration: No consumer migration is required. --yes and --file resolve exactly as before and still need --frontend or --backend for a new project. Interactive users who want the previous minimal project deselect the frontend, backend, or capabilities they do not need; scripts that set the helpers directory should pass --bsv-dir. The package exports no public API. Release order: generated projects depend on @bsv/wallet-relay ^0.7.0, so @bsv/wallet-relay 0.7.0 must be published before create-bsv-app 1.2.0. Projects generated before this release keep @bsv/wallet-relay ^0.2.0 until they update it themselves; newly generated production servers must set an HTTPS SERVER_ORIGIN. To pair a phone over LAN HTTP in development, enable the wallet's local-network HTTP option (for example a developer setting); generated production servers and client builds leave allowLocalNetworkHttp off. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package.

CLI entry points: {"create-bsv-app":"dist/index.js"}.

Public subpath	Runtime target(s)	Declaration target(s)
`.`	`./dist/index.js`	`./dist/index.d.ts`

Change procedure

Change the public package and select the SemVer impact from its packed API, runtime, wire, persistence, and declaration changes.
Bump only affected package manifests and first-party dependents whose packed contract changes.
Update the matching entry in governance/package-release-notes.json, including explicit migration guidance even when no consumer action is required.
Run pnpm docs:packages, pnpm docs:packages:check, pnpm check-versions, packed-consumer checks, and the full release gates.
After an authorized publication, update publishedVersion to the registry result and set releaseType to none only when source and npm match.

FilesExpand file tree

package-api-migrations.md

Latest commit

History