Skip to content

Record verified Toolbox 2.14.1 publication #618

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ty-everett merged 1 commit into from
Sep 25, 2026
Merged

Record verified Toolbox 2.14.1 publication #618

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/reference/package-api-migrations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,9 +55,9 @@ and clean-consumer tests remain the executable type authority.
| `@bsv/verifast` | `0.3.6` | `0.3.6` | none | [API and usage](../packages/sdk/verifast.md) | Valid typed verification calls and worker protocols remain compatible. Custom module factories and WASM adapters must return the exact documented binary and boolean shapes; coercive network, height, flag, byte, batch, verdict, lifecycle, or disposed-instance values now fail closed. Keep THIRD_PARTY_NOTICES.md and LICENSES/ with every JavaScript and WebAssembly distribution. |
| `@bsv/wallet-helper` | `0.1.8` | `0.1.8` | none | [API and usage](../packages/helpers/wallet-helper.md) | getAddress now derives with forSelf: true and returns the caller-owned side of the bilateral relationship. Applications that stored or coordinated the previous peer-owned result must regenerate and exchange the corrected address before sending value. Amount must be an integer from 1 through 1,000 and counterparties must be valid public keys. Valid canonical transaction-builder flows remain supported; malformed, ambiguous, or wallet-mutated results now fail closed. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. |
| `@bsv/wallet-relay` | `0.5.1` | `0.5.1` | none | [API and usage](../packages/wallet/wallet-relay.md) | Enable signed QR codes and distribute only HTTPS pairing origins and relay API URLs. Root-relative API paths and loopback HTTP remain supported. Configure onApprovalRequired for every method not deliberately listed in autoApproveMethods; unsigned pairing URIs and implicit approval are no longer accepted. Existing relay sessions, custom RPC method names, and supported wallet RPC byte encodings remain valid, and host applications continue to provide their matching Express runtime and type graph. Version 0.5 defaults to two missed pongs; set maxMissedHeartbeats to 1 to retain the prior heartbeat policy. Heartbeat intervals must fit the Node timer range. Preserve Cache-Control: no-store at proxies, prefer the stable bsv-wallet-relay plus token WebSocket subprotocols over the legacy token query parameter, and configure edge rate limiting in addition to the bounded in-process defaults. The 24-hour connected-session lifetime no longer renews on reconnect, malformed wallet calls fail with code 400, and WalletRelayClient retains at most 100 log entries unless maxLogEntries is configured. The QR remains a short-lived bearer invitation: keep it private and require explicit operation approval. Relay envelopes, cryptographic framing, and wallet RPC encodings remain unchanged. |
| `@bsv/wallet-toolbox` | `2.14.0` | `2.14.1` | patch | [API and usage](../packages/wallet/wallet-toolbox.md) | No BRC-100 application, wire, persisted-data, BRC-39 or account-recovery migration. Upgrade the wallet host and permission manager together to 2.14.1. Hosts already removing internal metadata at their JSON bridge are unaffected by the binary response defect. A failed response from an older affected host can occur after a transaction was created; reconcile wallet history before retrying the action. Earlier provider and storage migration guidance remains in the package changelog and operator guides. |
| `@bsv/wallet-toolbox-client` | `2.14.0` | `2.14.1` | patch | [API and usage](../packages/wallet/wallet-toolbox-client.md) | No BRC-100 application, wire, persisted-data, BRC-39 or account-recovery migration. Upgrade the wallet host and permission manager together to 2.14.1. Hosts already removing internal metadata at their JSON bridge are unaffected by the binary response defect. A failed response from an older affected host can occur after a transaction was created; reconcile wallet history before retrying the action. Earlier provider and storage migration guidance remains in the package changelog and operator guides. |
| `@bsv/wallet-toolbox-mobile` | `2.14.0` | `2.14.1` | patch | [API and usage](../packages/wallet/wallet-toolbox-mobile.md) | No BRC-100 application, wire, persisted-data, BRC-39 or account-recovery migration. Upgrade the wallet host and permission manager together to 2.14.1. Hosts already removing internal metadata at their JSON bridge are unaffected by the binary response defect. A failed response from an older affected host can occur after a transaction was created; reconcile wallet history before retrying the action. Earlier provider and storage migration guidance remains in the package changelog and operator guides. |
| `@bsv/wallet-toolbox` | `2.14.1` | `2.14.1` | none | [API and usage](../packages/wallet/wallet-toolbox.md) | No BRC-100 application, wire, persisted-data, BRC-39 or account-recovery migration. Upgrade the wallet host and permission manager together to 2.14.1. Hosts already removing internal metadata at their JSON bridge are unaffected by the binary response defect. A failed response from an older affected host can occur after a transaction was created; reconcile wallet history before retrying the action. Earlier provider and storage migration guidance remains in the package changelog and operator guides. |
| `@bsv/wallet-toolbox-client` | `2.14.1` | `2.14.1` | none | [API and usage](../packages/wallet/wallet-toolbox-client.md) | No BRC-100 application, wire, persisted-data, BRC-39 or account-recovery migration. Upgrade the wallet host and permission manager together to 2.14.1. Hosts already removing internal metadata at their JSON bridge are unaffected by the binary response defect. A failed response from an older affected host can occur after a transaction was created; reconcile wallet history before retrying the action. Earlier provider and storage migration guidance remains in the package changelog and operator guides. |
| `@bsv/wallet-toolbox-mobile` | `2.14.1` | `2.14.1` | none | [API and usage](../packages/wallet/wallet-toolbox-mobile.md) | No BRC-100 application, wire, persisted-data, BRC-39 or account-recovery migration. Upgrade the wallet host and permission manager together to 2.14.1. Hosts already removing internal metadata at their JSON bridge are unaffected by the binary response defect. A failed response from an older affected host can occur after a transaction was created; reconcile wallet history before retrying the action. Earlier provider and storage migration guidance remains in the package changelog and operator guides. |
| `create-bsv-app` | `1.1.2` | `1.1.2` | none | [API and usage](../packages/helpers/create-bsv-app.md) | Existing CLI flags, network choices, and generated project structure are unchanged. Regenerate or update dependencies after the patched packages are published. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. |

`none` means the source manifest matches the recorded npm baseline. Any other
Expand Down
12 changes: 6 additions & 6 deletions governance/package-release-notes.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,22 +215,22 @@
},
{
"name": "@bsv/wallet-toolbox",
"publishedVersion": "2.14.0",
"releaseType": "patch",
"publishedVersion": "2.14.1",
"releaseType": "none",
"summary": "Keeps exact action-spend accounting in a shared local WeakMap instead of adding Symbol keys to public createAction results. Preserves storage service charges through permission-module response transforms and separately loaded bundles. Consumes legacy local Symbol metadata before returning permission-managed results, restoring completed and two-step binary BRC-100 responses without relaxing SDK validation.",
"migration": "No BRC-100 application, wire, persisted-data, BRC-39 or account-recovery migration. Upgrade the wallet host and permission manager together to 2.14.1. Hosts already removing internal metadata at their JSON bridge are unaffected by the binary response defect. A failed response from an older affected host can occur after a transaction was created; reconcile wallet history before retrying the action. Earlier provider and storage migration guidance remains in the package changelog and operator guides."
},
{
"name": "@bsv/wallet-toolbox-client",
"publishedVersion": "2.14.0",
"releaseType": "patch",
"publishedVersion": "2.14.1",
"releaseType": "none",
"summary": "Keeps exact action-spend accounting in a shared local WeakMap instead of adding Symbol keys to public createAction results. Preserves storage service charges through permission-module response transforms and separately loaded bundles. Consumes legacy local Symbol metadata before returning permission-managed results, restoring completed and two-step binary BRC-100 responses without relaxing SDK validation.",
"migration": "No BRC-100 application, wire, persisted-data, BRC-39 or account-recovery migration. Upgrade the wallet host and permission manager together to 2.14.1. Hosts already removing internal metadata at their JSON bridge are unaffected by the binary response defect. A failed response from an older affected host can occur after a transaction was created; reconcile wallet history before retrying the action. Earlier provider and storage migration guidance remains in the package changelog and operator guides."
},
{
"name": "@bsv/wallet-toolbox-mobile",
"publishedVersion": "2.14.0",
"releaseType": "patch",
"publishedVersion": "2.14.1",
"releaseType": "none",
"summary": "Keeps exact action-spend accounting in a shared local WeakMap instead of adding Symbol keys to public createAction results. Preserves storage service charges through permission-module response transforms and separately loaded bundles. Consumes legacy local Symbol metadata before returning permission-managed results, restoring completed and two-step binary BRC-100 responses without relaxing SDK validation.",
"migration": "No BRC-100 application, wire, persisted-data, BRC-39 or account-recovery migration. Upgrade the wallet host and permission manager together to 2.14.1. Hosts already removing internal metadata at their JSON bridge are unaffected by the binary response defect. A failed response from an older affected host can occur after a transaction was created; reconcile wallet history before retrying the action. Earlier provider and storage migration guidance remains in the package changelog and operator guides."
},
Expand Down
Loading