@bopen-io/wallet-toolbox 2.1.21-parity-fix.2 → 2.6.2-brc153.2

package/docs/authentication-observability.md

@@ -0,0 +1,106 @@
+# Authentication observability and account continuity
+
+Wallet Toolbox authentication uses the SDK's generic `TelemetryConfig`. The
+same sink can correlate SDK overlay resolution, UMP account lookup, WAB HTTP,
+wallet snapshot, and authentication state-transition events.
+
+```ts
+import {
+  LookupResolver,
+  TelemetryConfig
+} from '@bsv/sdk'
+import {
+  OverlayUMPTokenInteractor,
+  WABClient
+} from '@bsv/wallet-toolbox'
+
+const telemetry: TelemetryConfig = {
+  minimumSeverity: 'info',
+  sink: {
+    capture: event => supportReporter.capture(event)
+  },
+  beforeSend: event => ({
+    ...event,
+    attributes: {
+      ...event.attributes,
+      applicationVersion: '4.7.0',
+      operatingSystem: 'ubuntu'
+    }
+  })
+}
+
+const resolver = new LookupResolver({ telemetry })
+const ump = new OverlayUMPTokenInteractor(resolver, undefined, telemetry)
+const wab = new WABClient('https://wab.example.com', { telemetry })
+```
+
+Pass the same `telemetry` configuration in
+`WalletAuthenticationManagerOptions` when constructing the manager. Correlation
+IDs then connect the WAB start/complete requests to account-continuity events
+without exposing authentication payloads.
+
+## Privacy boundary
+
+Telemetry is opt-in and no-op by default. Wallet Toolbox reports operation
+names, result categories, host counts, HTTP status, durations, format versions,
+and correlation IDs. It never reports:
+
+- private, presentation, recovery, or password-derived keys;
+- passwords, phone numbers, OTPs, auth tokens, or request payloads;
+- UMP token fields, Shamir shares, ciphertext, or transaction material;
+- wallet snapshots or decrypted profile data.
+
+The SDK sanitizes events before and after consumer enrichment. Sink failures do
+not affect authentication or wallet behavior.
+
+## Account-state rules
+
+`authenticationFlow` starts as `unknown`. A password cannot create a wallet
+until account lookup has completed.
+
+UMP account lookup prefers usable evidence over peer unanimity. Exactly one
+verified token matching the requested presentation or recovery hash means
+`existing-user`, regardless of empty, malformed, rejected, or unavailable peer
+responses. When no token verifies, one host's valid empty output list is enough
+to mean `new-user`; malformed and unavailable peers cannot veto that result.
+Multiple distinct verified UMP tokens resolve on on-chain proof alone. A token
+update spends its predecessor's outpoint, so a candidate spent anywhere in
+another candidate's transaction ancestry (walked through each candidate's BEEF,
+with evidence merged across hosts serving different depths) is superseded.
+Forked candidates with no spend relationship resolve only when exactly one of
+them provably consumed a same-identity UMP token — spending a token requires
+the account's keys, so this demonstrates continuity of control, whereas an
+independently minted competitor is typically the residue of an erroneous
+re-onboarding. A resolved conflict reports `supersededTokens` in the completed
+event. Anything less decisive — true forks, competing proven continuations, or
+candidates without examinable evidence — remains ambiguous, and a lookup with
+neither a verified token nor a clean empty response raises
+`UMPTokenLookupError`. Applications should present retry and account-recovery
+options for these errors, never a new-password prompt.
+
+WAB completion uses an explicit `accountStatus` or `existingUser` response when
+available. For older WAB servers it derives the status from the established
+protocol: a new account returns the temporary presentation key, while an
+existing account returns its stored key. If WAB identifies an existing account
+but UMP lookup returns no verified token, `WABAccountContinuityError` prevents
+new-wallet creation even when an overlay host returned a clean empty result.
+
+Temporary WAB authentication state expires after ten minutes by default and is
+cleared when authentication is cancelled, completed, or destroyed.
+
+Snapshot initialization is also fail-closed. Awaiting `manager.ready` rejects
+when a supplied snapshot cannot be loaded instead of silently resetting the
+manager into onboarding.
+
+## WAB transport
+
+Every WAB endpoint uses one transport with:
+
+- HTTPS enforcement, with plain HTTP limited to localhost development;
+- a hard wall-clock timeout;
+- bounded JSON request and response sizes;
+- rejected redirects and omitted ambient credentials;
+- typed, privacy-safe failures and correlated telemetry.
+
+Configure `timeoutMs`, `maxRequestBytes`, and `maxResponseBytes` in `WABClient`
+options when the defaults of 10 seconds and 1 MiB are not appropriate.

package/docs/client.md

@@ -5628,6 +5628,7 @@ export interface SetupClientWalletArgs {
     active?: WalletStorageProvider;
     backups?: WalletStorageProvider[];
     taalApiKey?: string;
+    scriptVerifier?: SpendVerifierInterface;
 }
 ```
 
@@ -5660,6 +5661,15 @@ Defaults to undefined.
 privilegedKeyGetter?: () => Promise<PrivateKey>
 ```
 
+###### Property scriptVerifier
+
+Optional high-performance verifier for internal wallet and locally hosted
+storage validation. This does not alter the BRC-100 interface.
+
+```ts
+scriptVerifier?: SpendVerifierInterface
+```
+
 ###### Property rootKeyHex
 
 The non-privileged private key used to initialize the `KeyDeriver` and determine the `identityKey`.
@@ -6499,6 +6509,7 @@ export interface StorageProviderOptions extends StorageReaderWriterOptions {
     feeModel: StorageFeeModel;
     commissionSatoshis: number;
     commissionPubKeyHex?: PubKeyHex;
+    scriptVerifier?: SpendVerifierInterface;
 }
 ```
 
@@ -6523,6 +6534,15 @@ A value of zero disables commission fees.
 commissionSatoshis: number
 ```
 
+###### Property scriptVerifier
+
+Optional verifier for server-side action-batch script checks. This Wallet
+Toolbox extension leaves the BRC-100 interface unchanged.
+
+```ts
+scriptVerifier?: SpendVerifierInterface
+```
+
 Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables)
 
 ---
@@ -7566,6 +7586,8 @@ export interface WalletArgs {
     settingsManager?: WalletSettingsManager;
     lookupResolver?: LookupResolver;
     makeLogger?: MakeWalletLogger;
+    actionBatchMode?: ActionBatchMode;
+    scriptVerifier?: SpendVerifierInterface;
 }
 ```
 
@@ -7585,6 +7607,24 @@ Aggregate tracing and control over capturing all logged output in one place:
 makeLogger?: MakeWalletLogger
 ```
 
+###### Property actionBatchMode
+
+Optional action-batch negotiation mode. `auto` uses the provider capability
+when available; `legacy` preserves per-action persistence.
+
+```ts
+actionBatchMode?: ActionBatchMode
+```
+
+###### Property scriptVerifier
+
+Optional high-performance verifier used by Wallet Toolbox's internal
+transaction checks. This does not alter the BRC-100 interface.
+
+```ts
+scriptVerifier?: SpendVerifierInterface
+```
+
 Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables)
 
 ---
@@ -14383,8 +14423,9 @@ See also: [BlockHeader](./client.md#interface-blockheader)
 
 ###### Method asyncSetup
 
-TODO: This is a temporary incomplete solution for which a full chaintracker
-with new header and reorg event notification is required.
+This task intentionally polls for new headers. Reorganization notification is
+outside this task's current contract and requires a chaintracker event source
+before it can be added without changing monitor behavior.
 
 New header events drive retrieving merklePaths for newly mined transactions.
 This implementation performs this function.
@@ -15184,7 +15225,7 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](
 ##### Class: WERR_REVIEW_ACTIONS
 
 When a `createAction` or `signAction` is completed in undelayed mode (`acceptDelayedBroadcast`: false),
-any unsucccessful result will return the results by way of this exception to ensure attention is
+any unsuccessful result will return the results by way of this exception to ensure attention is
 paid to processing errors.
 
 ```ts
@@ -15198,7 +15239,7 @@ See also: [ReviewActionResult](./client.md#interface-reviewactionresult), [Walle
 
 ###### Constructor
 
-All parameters correspond to their comparable `createAction` or `signSction` results
+All parameters correspond to their comparable `createAction` or `signAction` results
 with the exception of `reviewActionResults`;
 which contains more details, particularly for double spend results.
 
@@ -17944,12 +17985,12 @@ When the transaction already exists, the description is updated. The isOutgoing
 
 "basket insertion" Merge Rules:
 1. The "default" basket may not be specified as the insertion basket.
-2. A change output in the "default" basket may not be target of an insertion into a different basket.
-3. These baskets do not affect the wallet's balance and are typed "custom".
+2. Managed change may not be reclassified as a basket insertion.
+3. Basket insertions do not affect wallet balance and are typed "custom".
 
 "wallet payment" Merge Rules:
-1. Targetting an existing change "default" basket output results in a no-op. No error. No alterations made.
-2. Targetting a previously "custom" non-change output converts it into a change output. This alters the transaction's `amount`, and the wallet balance.
+1. Targeting existing managed change in the default basket is idempotent.
+2. Targeting a custom output promotes it to managed BRC-29 change only after the locking script is verified. This is the supported recovery path for a misclassified BRC-29 payment.
 
 ```ts
 export async function internalizeAction(wallet: Wallet, auth: AuthId, args: InternalizeActionArgs): Promise<StorageInternalizeActionResult> 
@@ -17980,12 +18021,12 @@ When the transaction already exists, the description is updated. The isOutgoing
 
 "basket insertion" Merge Rules:
 1. The "default" basket may not be specified as the insertion basket.
-2. A change output in the "default" basket may not be target of an insertion into a different basket.
-3. These baskets do not affect the wallet's balance and are typed "custom".
+2. Managed change may not be reclassified as a basket insertion.
+3. Basket insertions do not affect wallet balance and are typed "custom".
 
 "wallet payment" Merge Rules:
-1. Targetting an existing change "default" basket output results in a no-op. No error. No alterations made.
-2. Targetting a previously "custom" non-change output converts it into a change output. This alters the transaction's `satoshis`, and the wallet balance.
+1. Targeting existing managed change in the default basket is idempotent.
+2. Targeting a custom output promotes it to managed BRC-29 change and increases wallet balance. This includes recovery of a legacy custom row incorrectly stored in the default basket.
 
 ```ts
 export async function internalizeAction(storage: StorageProvider, auth: AuthId, args: InternalizeActionArgs): Promise<StorageInternalizeActionResult> 
@@ -19607,7 +19648,7 @@ Indicates status of a new Action following a `createAction` or `signAction` in i
 When `acceptDelayedBroadcast` is falses.
 
 'success': The action has been broadcast and accepted by the bitcoin processing network.
-'doulbeSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the loosing transaction.
+'doubleSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the losing transaction.
 'invalidTx': The action was rejected by the processing network as an invalid bitcoin transaction.
 'serviceError': The broadcast services are currently unable to reach the bitcoin network. The action is now queued for delayed retries.
 
@@ -19705,7 +19746,7 @@ Indicates status of a new Action following a `createAction` or `signAction` in i
 When `acceptDelayedBroadcast` is falses.
 
 'success': The action has been broadcast and accepted by the bitcoin processing network.
-'doulbeSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the loosing transaction.
+'doubleSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the losing transaction.
 'invalidTx': The action was rejected by the processing network as an invalid bitcoin transaction.
 'serviceError': The broadcast services are currently unable to reach the bitcoin network. The action is now queued for delayed retries.
 

package/docs/managed-change-policy.md

@@ -0,0 +1,79 @@
+# Managed change, sweeping, and recovery
+
+The default basket is the wallet's funding pool. An output being physically
+stored in that basket is not, by itself, proof that the wallet can spend it.
+Automatic funding and wallet balance therefore use the managed-change policy
+below instead of trusting basket membership or the locking script alone.
+
+## Output classes
+
+A **managed change output** has all of the following metadata:
+
+- `type: 'P2PKH'`
+- `change: true`
+- `providedBy: 'storage'`
+- `purpose: 'change'`
+- non-empty `derivationPrefix` and `derivationSuffix`
+
+Here, `type: 'P2PKH'` is an operational signer type, not merely a description
+of the script. It selects the BRC-29 unlocking path. A raw P2PKH output without
+matching derivation metadata is not managed change and must not be selected by
+the wallet automatically.
+
+A **custom output** belongs to an application-defined protocol. It is normally
+stored outside the default basket with `type: 'custom'`, `change: false`, and
+`providedBy: 'you'`. Custom outputs are discoverable and may be explicitly
+spent by application logic, but are not wallet balance and are never automatic
+fee inputs.
+
+## Enforcement
+
+The same managed-change predicate is applied to:
+
+- change-input counting and allocation in Knex/SQLite/MySQL and IndexedDB;
+- the default wallet balance and `balanceAndUtxos()` results; and
+- validation of `noSendChange` inputs.
+
+Raw administrative `listOutputs({ basket: 'default' })` remains unfiltered on
+purpose. This makes incompatible legacy rows visible for diagnosis and recovery
+without allowing them into balance or automatic funding.
+
+## `internalizeAction` rules
+
+| Request | New output | Existing custom output | Existing managed change |
+| --- | --- | --- | --- |
+| `wallet payment` | Store as managed change in `default` | Promote to managed change after BRC-29 script verification | Idempotent when already in `default` |
+| `basket insertion` to a non-default basket | Store as custom | Move/update as custom; no wallet-balance adjustment | Reject; managed change cannot be reclassified |
+| `basket insertion` to `default` | Reject | Reject | Reject |
+
+The wallet signer verifies that `paymentRemittance` derives the transaction
+output's locking script before storage can promote it. This is the supported
+way to repair a genuine BRC-29 payment that was previously classified as
+custom. Merely recognizing a P2PKH locking script is not enough.
+
+## Sweeping and recovery
+
+"Sweep" means moving an incompatible custom row out of the default basket with
+a `basket insertion` into a named, non-default recovery basket. This is a
+metadata repair: the output remains custom and wallet balance does not change.
+
+There are two valid recovery choices for a legacy custom row in `default`:
+
+1. If it is a genuine payment to this wallet under BRC-29, internalize it as a
+   `wallet payment` with the correct derivation prefix, derivation suffix, and
+   sender identity key. Successful verification promotes it to managed change
+   and adds its value to wallet balance.
+2. Otherwise, sweep it to a non-default basket. The application can then apply
+   its own unlocking and lifecycle rules explicitly.
+
+Do not repair rows by directly changing `type`, `change`, or derivation fields.
+That bypasses the BRC-29 ownership check and can make balance appear spendable
+when the wallet does not possess the required key path.
+
+## BRC-29 remittance module
+
+`Brc29RemittanceModule` always accepts settlements through the `wallet payment`
+protocol. The deprecated `internalizeProtocol: 'basket insertion'` setting is
+rejected because it supplied no insertion remittance and would classify a
+recipient payment as a custom application output instead of spendable wallet
+balance.

package/docs/monitor.md

@@ -709,8 +709,9 @@ See also: [BlockHeader](./client.md#interface-blockheader)
 
 ###### Method asyncSetup
 
-TODO: This is a temporary incomplete solution for which a full chaintracker
-with new header and reorg event notification is required.
+This task intentionally polls for new headers. Reorganization notification is
+outside this task's current contract and requires a chaintracker event source
+before it can be added without changing monitor behavior.
 
 New header events drive retrieving merklePaths for newly mined transactions.
 This implementation performs this function.

package/docs/setup.md

@@ -58,6 +58,7 @@ export interface SetupClientWalletArgs {
     active?: WalletStorageProvider;
     backups?: WalletStorageProvider[];
     taalApiKey?: string;
+    scriptVerifier?: SpendVerifierInterface;
 }
 ```
 
@@ -90,6 +91,15 @@ Defaults to undefined.
 privilegedKeyGetter?: () => Promise<PrivateKey>
 ```
 
+###### Property scriptVerifier
+
+Optional high-performance verifier for internal wallet and locally hosted
+storage validation. This does not alter the BRC-100 interface.
+
+```ts
+scriptVerifier?: SpendVerifierInterface
+```
+
 ###### Property rootKeyHex
 
 The non-privileged private key used to initialize the `KeyDeriver` and determine the `identityKey`.
@@ -332,6 +342,7 @@ export interface SetupWalletArgs {
     privilegedKeyGetter?: () => Promise<PrivateKey>;
     active?: WalletStorageProvider;
     backups?: WalletStorageProvider[];
+    scriptVerifier?: SpendVerifierInterface;
 }
 ```
 
@@ -373,6 +384,15 @@ Defaults to undefined.
 privilegedKeyGetter?: () => Promise<PrivateKey>
 ```
 
+###### Property scriptVerifier
+
+Optional high-performance verifier for internal wallet and locally hosted
+storage validation. This does not alter the BRC-100 interface.
+
+```ts
+scriptVerifier?: SpendVerifierInterface
+```
+
 ###### Property rootKeyHex
 
 Optional. The non-privileged private key used to initialize the `KeyDeriver` and determine the `identityKey`.
@@ -570,8 +590,8 @@ MY_TEST_IDENTITY = '${testIdentityKey1}'
 MY_TEST_IDENTITY2 = '${testIdentityKey2}'
 MY_MAIN_IDENTITY = '${mainIdentityKey1}'
 MY_MAIN_IDENTITY2 = '${mainIdentityKey2}'
-MAIN_TAAL_API_KEY='mainnet_9596de07e92300c6287e4393594ae39c'
-TEST_TAAL_API_KEY='testnet_0e6cf72133b43ea2d7861da2a38684e3'
+MAIN_TAAL_API_KEY='replace-with-your-mainnet-api-key'
+TEST_TAAL_API_KEY='replace-with-your-testnet-api-key'
 MYSQL_CONNECTION='{"port":3306,"host":"127.0.0.1","user":"root","password":"your_password","database":"your_database", "timezone": "Z"}'
 DEV_KEYS = '{
     "${testIdentityKey1}": "${testPrivKey1.toString()}",
@@ -966,8 +986,8 @@ MY_TEST_IDENTITY = '${testIdentityKey1}'
 MY_TEST_IDENTITY2 = '${testIdentityKey2}'
 MY_MAIN_IDENTITY = '${mainIdentityKey1}'
 MY_MAIN_IDENTITY2 = '${mainIdentityKey2}'
-MAIN_TAAL_API_KEY='mainnet_9596de07e92300c6287e4393594ae39c'
-TEST_TAAL_API_KEY='testnet_0e6cf72133b43ea2d7861da2a38684e3'
+MAIN_TAAL_API_KEY='replace-with-your-mainnet-api-key'
+TEST_TAAL_API_KEY='replace-with-your-testnet-api-key'
 MYSQL_CONNECTION='{"port":3306,"host":"127.0.0.1","user":"root","password":"your_password","database":"your_database", "timezone": "Z"}'
 DEV_KEYS = '{
     "${testIdentityKey1}": "${testPrivKey1.toString()}",

package/docs/storage.md

@@ -838,6 +838,7 @@ export interface StorageProviderOptions extends StorageReaderWriterOptions {
     feeModel: StorageFeeModel;
     commissionSatoshis: number;
     commissionPubKeyHex?: PubKeyHex;
+    scriptVerifier?: SpendVerifierInterface;
 }
 ```
 
@@ -862,6 +863,15 @@ A value of zero disables commission fees.
 commissionSatoshis: number
 ```
 
+###### Property scriptVerifier
+
+Optional verifier for server-side action-batch script checks. This Wallet
+Toolbox extension leaves the BRC-100 interface unchanged.
+
+```ts
+scriptVerifier?: SpendVerifierInterface
+```
+
 Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables)
 
 ---
@@ -4798,12 +4808,12 @@ When the transaction already exists, the description is updated. The isOutgoing
 
 "basket insertion" Merge Rules:
 1. The "default" basket may not be specified as the insertion basket.
-2. A change output in the "default" basket may not be target of an insertion into a different basket.
-3. These baskets do not affect the wallet's balance and are typed "custom".
+2. Managed change may not be reclassified as a basket insertion.
+3. Basket insertions do not affect wallet balance and are typed "custom".
 
 "wallet payment" Merge Rules:
-1. Targetting an existing change "default" basket output results in a no-op. No error. No alterations made.
-2. Targetting a previously "custom" non-change output converts it into a change output. This alters the transaction's `satoshis`, and the wallet balance.
+1. Targeting existing managed change in the default basket is idempotent.
+2. Targeting a custom output promotes it to managed BRC-29 change and increases wallet balance. This includes recovery of a legacy custom row incorrectly stored in the default basket.
 
 ```ts
 export async function internalizeAction(storage: StorageProvider, auth: AuthId, args: InternalizeActionArgs): Promise<StorageInternalizeActionResult> 
@@ -5197,7 +5207,7 @@ Indicates status of a new Action following a `createAction` or `signAction` in i
 When `acceptDelayedBroadcast` is falses.
 
 'success': The action has been broadcast and accepted by the bitcoin processing network.
-'doulbeSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the loosing transaction.
+'doubleSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the losing transaction.
 'invalidTx': The action was rejected by the processing network as an invalid bitcoin transaction.
 'serviceError': The broadcast services are currently unable to reach the bitcoin network. The action is now queued for delayed retries.
 
@@ -5344,4 +5354,4 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](
 
 ---
 
-<!--#endregion ts2md-api-merged-here-->
+<!--#endregion ts2md-api-merged-here-->

package/docs/wallet.md

@@ -5628,6 +5628,7 @@ export interface SetupClientWalletArgs {
     active?: WalletStorageProvider;
     backups?: WalletStorageProvider[];
     taalApiKey?: string;
+    scriptVerifier?: SpendVerifierInterface;
 }
 ```
 
@@ -5660,6 +5661,15 @@ Defaults to undefined.
 privilegedKeyGetter?: () => Promise<PrivateKey>
 ```
 
+###### Property scriptVerifier
+
+Optional high-performance verifier for internal wallet and locally hosted
+storage validation. This does not alter the BRC-100 interface.
+
+```ts
+scriptVerifier?: SpendVerifierInterface
+```
+
 ###### Property rootKeyHex
 
 The non-privileged private key used to initialize the `KeyDeriver` and determine the `identityKey`.
@@ -6499,6 +6509,7 @@ export interface StorageProviderOptions extends StorageReaderWriterOptions {
     feeModel: StorageFeeModel;
     commissionSatoshis: number;
     commissionPubKeyHex?: PubKeyHex;
+    scriptVerifier?: SpendVerifierInterface;
 }
 ```
 
@@ -6523,6 +6534,15 @@ A value of zero disables commission fees.
 commissionSatoshis: number
 ```
 
+###### Property scriptVerifier
+
+Optional verifier for server-side action-batch script checks. This Wallet
+Toolbox extension leaves the BRC-100 interface unchanged.
+
+```ts
+scriptVerifier?: SpendVerifierInterface
+```
+
 Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables)
 
 ---
@@ -7566,6 +7586,8 @@ export interface WalletArgs {
     settingsManager?: WalletSettingsManager;
     lookupResolver?: LookupResolver;
     makeLogger?: MakeWalletLogger;
+    actionBatchMode?: ActionBatchMode;
+    scriptVerifier?: SpendVerifierInterface;
 }
 ```
 
@@ -7585,6 +7607,24 @@ Aggregate tracing and control over capturing all logged output in one place:
 makeLogger?: MakeWalletLogger
 ```
 
+###### Property actionBatchMode
+
+Optional action-batch negotiation mode. `auto` uses the provider capability
+when available; `legacy` preserves per-action persistence.
+
+```ts
+actionBatchMode?: ActionBatchMode
+```
+
+###### Property scriptVerifier
+
+Optional high-performance verifier used by Wallet Toolbox's internal
+transaction checks. This does not alter the BRC-100 interface.
+
+```ts
+scriptVerifier?: SpendVerifierInterface
+```
+
 Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables)
 
 ---
@@ -14383,8 +14423,9 @@ See also: [BlockHeader](./client.md#interface-blockheader)
 
 ###### Method asyncSetup
 
-TODO: This is a temporary incomplete solution for which a full chaintracker
-with new header and reorg event notification is required.
+This task intentionally polls for new headers. Reorganization notification is
+outside this task's current contract and requires a chaintracker event source
+before it can be added without changing monitor behavior.
 
 New header events drive retrieving merklePaths for newly mined transactions.
 This implementation performs this function.
@@ -15184,7 +15225,7 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](
 ##### Class: WERR_REVIEW_ACTIONS
 
 When a `createAction` or `signAction` is completed in undelayed mode (`acceptDelayedBroadcast`: false),
-any unsucccessful result will return the results by way of this exception to ensure attention is
+any unsuccessful result will return the results by way of this exception to ensure attention is
 paid to processing errors.
 
 ```ts
@@ -15198,7 +15239,7 @@ See also: [ReviewActionResult](./client.md#interface-reviewactionresult), [Walle
 
 ###### Constructor
 
-All parameters correspond to their comparable `createAction` or `signSction` results
+All parameters correspond to their comparable `createAction` or `signAction` results
 with the exception of `reviewActionResults`;
 which contains more details, particularly for double spend results.
 
@@ -17944,12 +17985,12 @@ When the transaction already exists, the description is updated. The isOutgoing
 
 "basket insertion" Merge Rules:
 1. The "default" basket may not be specified as the insertion basket.
-2. A change output in the "default" basket may not be target of an insertion into a different basket.
-3. These baskets do not affect the wallet's balance and are typed "custom".
+2. Managed change may not be reclassified as a basket insertion.
+3. Basket insertions do not affect wallet balance and are typed "custom".
 
 "wallet payment" Merge Rules:
-1. Targetting an existing change "default" basket output results in a no-op. No error. No alterations made.
-2. Targetting a previously "custom" non-change output converts it into a change output. This alters the transaction's `satoshis`, and the wallet balance.
+1. Targeting existing managed change in the default basket is idempotent.
+2. Targeting a custom output promotes it to managed BRC-29 change and increases wallet balance. This includes recovery of a legacy custom row incorrectly stored in the default basket.
 
 ```ts
 export async function internalizeAction(storage: StorageProvider, auth: AuthId, args: InternalizeActionArgs): Promise<StorageInternalizeActionResult> 
@@ -17980,12 +18021,12 @@ When the transaction already exists, the description is updated. The isOutgoing
 
 "basket insertion" Merge Rules:
 1. The "default" basket may not be specified as the insertion basket.
-2. A change output in the "default" basket may not be target of an insertion into a different basket.
-3. These baskets do not affect the wallet's balance and are typed "custom".
+2. Managed change may not be reclassified as a basket insertion.
+3. Basket insertions do not affect wallet balance and are typed "custom".
 
 "wallet payment" Merge Rules:
-1. Targetting an existing change "default" basket output results in a no-op. No error. No alterations made.
-2. Targetting a previously "custom" non-change output converts it into a change output. This alters the transaction's `amount`, and the wallet balance.
+1. Targeting existing managed change in the default basket is idempotent.
+2. Targeting a custom output promotes it to managed BRC-29 change only after the locking script is verified. This is the supported recovery path for a misclassified BRC-29 payment.
 
 ```ts
 export async function internalizeAction(wallet: Wallet, auth: AuthId, args: InternalizeActionArgs): Promise<StorageInternalizeActionResult> 
@@ -19607,7 +19648,7 @@ Indicates status of a new Action following a `createAction` or `signAction` in i
 When `acceptDelayedBroadcast` is falses.
 
 'success': The action has been broadcast and accepted by the bitcoin processing network.
-'doulbeSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the loosing transaction.
+'doubleSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the losing transaction.
 'invalidTx': The action was rejected by the processing network as an invalid bitcoin transaction.
 'serviceError': The broadcast services are currently unable to reach the bitcoin network. The action is now queued for delayed retries.
 
@@ -19705,7 +19746,7 @@ Indicates status of a new Action following a `createAction` or `signAction` in i
 When `acceptDelayedBroadcast` is falses.
 
 'success': The action has been broadcast and accepted by the bitcoin processing network.
-'doulbeSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the loosing transaction.
+'doubleSpend': The action has been confirmed to double spend one or more inputs, and by the "first-seen-rule" is the losing transaction.
 'invalidTx': The action was rejected by the processing network as an invalid bitcoin transaction.
 'serviceError': The broadcast services are currently unable to reach the bitcoin network. The action is now queued for delayed retries.