chore: sync SDK from sbv3

SDK_RELEASE_NOTES.md

@@ -8,6 +8,45 @@ The newest release batch should stay at the top.
 - Follow `SDK_RELEASE_FLOW.md`; release from canonical `sbv3`, not from the `switchboard-sdk` mirror.
 - Before publishing, confirm each release-note version matches the canonical `sbv3` manifest version, the final `switchboard-sdk` release-branch manifest version, and the latest published registry version.
 
+## 2026-08-11 Rust Pyth SDK Release Prep
+
+### `switchboard-protos@0.2.7`
+
+Status: prepared.
+
+- Publishes the Pyth push-feed task fields and legacy Pyth Core API-key configuration already present in the canonical schema.
+- Extends the shared Rust/JavaScript conformance fixture to cover the request-scoped `${PYTH_API_KEY}` placeholder without changing the legacy control identity.
+
+### `switchboard-on-demand-client@0.6.1`
+
+Status: prepared.
+
+- Requires `switchboard-protos` 0.2.7 or newer on the compatible 0.2 line so Pyth fields cannot be discarded during decode and re-encode.
+- Adds request-scoped variable overrides to Crossbar simulation, every gateway signature route, and classic PullFeed update helpers while preserving existing method signatures.
+- Redacts override values from Crossbar and gateway error/log text exposed to callers without mutating results, feed hashes, or signatures.
+- Pins the legacy client crate to the Solana 1.18 SDK line it supports and fixes compatibility with its module paths.
+- Preserves exact on-chain `max_variance` values and rejects malformed or identity-mismatched gateway responses before instruction construction.
+
+### `switchboard-on-demand@0.13.1`
+
+Status: prepared.
+
+- Requires `switchboard-protos` 0.2.7 or newer on the compatible 0.2 line.
+- Adds the same backward-compatible request-scoped override APIs as the legacy client crate for Solana 2.x and 3.x consumers.
+- Keeps the Solana 2.x support floor at 2.1 and the Solana 3.x support ceiling below 4.x.
+- Preserves exact on-chain `max_variance` values, rejects malformed or identity-mismatched gateway responses, and safely decodes unaligned classic PullFeed accounts.
+
+### `sb-on-demand-schemas@0.1.4`
+
+Status: prepared.
+
+- Requires `switchboard-protos` 0.2.7 or newer and preserves Pyth push/API-key fields across V1 job and V2 feed decoding.
+- Aligns its Solana bounds with the supported `switchboard-on-demand` 0.13 release line.
+
+Publish in dependency order: `switchboard-protos@0.2.7`,
+`switchboard-on-demand-client@0.6.1`, `switchboard-on-demand@0.13.1`, then
+`sb-on-demand-schemas@0.1.4`.
+
 ## 2026-08-07 Release Prep
 
 ### `@switchboard-xyz/sui-sdk@0.1.17`
@@ -89,34 +128,6 @@ Status: prepared; package dry-run blocked by the existing CLI lint baseline.
 - Uses the Subscriber State feed for subscription oracle updates.
 - Adds a cluster-aware, authority-checked SWTCH feed migration command.
 
-## 2026-06-27 Release Prep
-
-### `switchboard-on-demand-client@0.6.1`
-
-Status: prepared; dry-run verified.
-
-- Pins the legacy client crate to the Solana 1.18 SDK line it supports.
-- Fixes compatibility with Solana SDK module paths used by 1.18-era consumers.
-- Sends the exact on-chain `max_variance` integer through classic PullFeed gateway requests instead of truncating it to a whole percentage.
-- Rejects unexpected response hashes, malformed signatures, and malformed gateway payloads before constructing update instructions.
-
-### `switchboard-on-demand@0.13.1`
-
-Status: prepared; dry-run verified.
-
-- Sets the Solana 2.x support floor to 2.1 and keeps Solana 3.x support below 4.x.
-- Fixes Solana 3 client feature compilation, including lookup-table message types and shared client dependencies.
-- Sends the exact on-chain `max_variance` integer through classic PullFeed gateway requests instead of truncating it to a whole percentage.
-- Rejects unexpected response hashes, malformed signatures, and malformed gateway payloads before constructing update instructions.
-- Decodes legacy PullFeed accounts with unaligned-safe reads and returns a clean parse error for malformed account sizes.
-
-### `sb-on-demand-schemas@0.1.4`
-
-Status: prepared; dry-run pending.
-
-- Aligns schema crate Solana 2.x bounds with the supported 2.1+ SDK range.
-- Keeps the schema crate on the compatible `switchboard-on-demand` 0.13 release line.
-
 ## 2026-06-08 Release Prep
 
 ### `@switchboard-xyz/on-demand@3.10.4`

javascript/common/test/feedHashConformance.test.ts

@@ -56,7 +56,7 @@ describe('Rust-compatible feed-hash conformance', () => {
       [vectors.pythPush.job]
     ).toString('hex');
 
-    expect(bytes).toHaveLength(287);
+    expect(bytes).toHaveLength(304);
     expect(bytes.toString('hex')).toBe(
       vectors.pythPush.expectedLengthDelimitedHex
     );
@@ -76,6 +76,9 @@ describe('Rust-compatible feed-hash conformance', () => {
     expect(
       medianJob?.[1]?.tasks?.[0]?.oracleTask?.pythConfigs?.pushFeedShardId
     ).toBe(0);
+    expect(
+      medianJob?.[1]?.tasks?.[0]?.oracleTask?.pythConfigs?.apiKey
+    ).toBe('${PYTH_API_KEY}');
     expect(
       medianJob?.[2]?.tasks?.[1]?.divideTask?.job?.tasks?.[0]?.jupiterSwapTask
         ?.directRoutesOnly

javascript/common/test/packageRootCollision.probe.cjs

@@ -38,7 +38,7 @@ if (order === 'old-last') require('@switchboard-xyz/common-old');
 const after = computeIdentity();
 
 for (const identity of [before, after]) {
-  assert.equal(identity.bytes.length, 287);
+  assert.equal(identity.bytes.length, expectedBytesHex.length / 2);
   assert.equal(Buffer.from(identity.bytes).toString('hex'), expectedBytesHex);
   assert.equal(identity.hash, expectedHash);
   assert.ok(!rejectedHashes.has(identity.hash));

javascript/common/test/packageRootCollision.probe.mjs

@@ -38,7 +38,7 @@ if (order === 'old-last') await import('@switchboard-xyz/common-old');
 const after = computeIdentity();
 
 for (const identity of [before, after]) {
-  assert.equal(identity.bytes.length, 287);
+  assert.equal(identity.bytes.length, expectedBytesHex.length / 2);
   assert.equal(Buffer.from(identity.bytes).toString('hex'), expectedBytesHex);
   assert.equal(identity.hash, expectedHash);
   assert.ok(!rejectedHashes.has(identity.hash));

solana/rust/switchboard-on-demand-client/Cargo.toml

@@ -31,7 +31,7 @@ solana-sdk = ">=1.18.22, <2"
 tokio = { version = "^1.39", features = ["full"] }
 tokio-stream = ">=0.1.17, <0.2"
 switchboard-utils = "0.10.0"
-protos = { package = "switchboard-protos", version = "0.2.6" }
+protos = { package = "switchboard-protos", version = ">=0.2.7, <0.3" }
 
 [features]
 devnet = []

solana/rust/switchboard-on-demand-client/README.md

@@ -2,6 +2,43 @@
 
 This crate is designed to interact with Switchboard on-demand, the Crossbar service, and queue gateways.
 
+## Installation
+
+```toml
+[dependencies]
+switchboard-on-demand-client = "0.6.1"
+```
+
+## Request-scoped task variables
+
+Keep API keys and other credentials out of stored `OracleJob` definitions. Put a
+placeholder such as `${PYTH_API_KEY}` in the job, then supply its value only for
+the request that needs it:
+
+```rust
+use std::collections::HashMap;
+
+let pyth_api_key = std::env::var("PYTH_API_KEY")?;
+let overrides = HashMap::from([(
+    "PYTH_API_KEY".to_string(),
+    pyth_api_key,
+)]);
+
+let simulation = crossbar
+    .simulate_proto_with_variable_overrides(
+        &oracle_feed,
+        true,
+        Some("mainnet"),
+        overrides,
+    )
+    .await?;
+```
+
+The same override map is accepted by the `_with_variable_overrides` gateway
+signature helpers and by `PullFeed::fetch_update_ix_with_variable_overrides`
+and `PullFeed::fetch_update_consensus_ix_with_variable_overrides`. Existing
+methods remain available for requests that do not need overrides.
+
 ## Crossbar
 A middleman service to fetch oracle jobs from IPFS and to return feed price simulations. This is useful for updating a price constantly instead of sending requests directly to oracles.