@bopen-io/wallet-toolbox 2.1.8-spending-fix.1 → 2.1.21-parity-fix.0

package/CHANGELOG.md

@@ -4,6 +4,88 @@ This document captures the history of significant changes to the wallet-toolbox
 The git commit history contains the details but is unable to draw
 attention to changes that materially alter behavior or extend functionality.
 
+## @bopen-io/wallet-toolbox 2.1.21-parity-fix.0
+
+StorageIdb aligned with StorageKnex canon. Six functional divergences fixed.
+
+- **CRIT** `filterOutputTagMaps` user-scope filter was dead code (`&& r.txid` on a table with no txid field). `getOutputTagMapsForUser` leaked rows across accounts. Fixes cross-account sync chunk contamination.
+- **HIGH** `filterOutputs` / `filterTransactions` no longer treat an empty `txStatus` / `status` array as a reject-all filter. Matches Knex.
+- **HIGH** `filterX` methods now throw `WERR_INVALID_PARAMETER` on undefined values in `partial`. Matches Knex's `Undefined binding(s) detected`. Surfaces mergeFind bugs that used to present as misleading "Result must be unique."
+- **MED** Truthiness guards on integer-ID / string partial fields swept to `!== undefined` across every filter method (~106 replacements). Fixes silent filter skip for `lockTime=0`, `version=0`, empty strings.
+- **MED** `updateIdb` returns actual affected-row count instead of always `1`.
+- **LOW** `filterProvenTxReqs` drops the `&& r.txid` user-scope bypass (same shape as CRIT finding; latent unless a row lacks a txid).
+
+Based on 2.1.21 content; published to `@bopen-io` npm scope pending canonical review (PR bsv-blockchain/wallet-toolbox#151).
+
+## wallet-toolbox 2.1.21
+
+- Fix spending authorization bypass in querySpentSince, PR#150
+
+## wallet-toolbox 2.1.20
+
+- Update cdn.projectbabbage.com valid blockheaders file hash.
+- 
+## wallet-toolbox 2.1.19
+
+- Merge PR#146. GenerateChange change to better handle dust situations. Redundant trimInputBeef knownTxids safety check.
+- recovery-key-and-password fix
+
+## wallet-toolbox 2.1.18
+
+- fix provideRecoveryKey guard blocking recovery-key-and-password mode
+- set authenticationFlow to existing-user after recovery key token lookup
+
+## wallet-toolbox 2.1.17
+
+- add admin web server for visibility into storage and monitor by operations admin
+- add recentlyActiveUsers to StorageProvider with optimized override in StorageKnex
+
+## wallet-toolbox 2.1.16
+
+- update Services getStatusForTxids to internally handle provider batch limit
+
+## wallet-toolbox 2.1.15
+
+- audit fix
+ 
+## wallet-toolbox 2.1.14
+
+- fix update timestamp on all updated currencies
+
+## wallet-toolbox 2.1.13
+
+- update all supported currencies in single exchangeratesapi.io request.
+
+## wallet-toolbox 2.1.12
+
+- Add fundWalletFromP2PKHOutpoints
+
+## wallet-toolbox 2.1.11
+
+- Add UMP v3 token support with Argon2id password key derivation.
+- Introduce `derivePasswordKey()` abstraction that dispatches to Argon2id for v3 tokens and PBKDF2-SHA512 (7777 rounds) for legacy tokens.
+- Use `hash-wasm` for password-key derivation support in browser/webview-compatible contexts.
+- Extend `UMPToken` with optional `umpVersion` and `passwordKdf` metadata fields.
+- Update `buildAndSend` to write v3 KDF metadata fields (`umpVersion`, `kdfAlgorithm`, `kdfParams`) to on-chain tokens.
+- Update `parseLookupAnswer`, `serializeUMPToken`, and `deserializeUMPToken` to parse and round-trip v3 KDF metadata.
+- Export `ARGON2ID_DEFAULT_*` constants (`iterations`, `memoryKiB`, `parallelism`, `hashLength`).
+- Keep legacy token behavior unchanged.
+
+## wallet-toolbox 2.1.10
+
+- TaskReviewUtxos added
+- TaskReviewProvenTxs added
+- TaskReviewDoubleSpends added
+- exchangeratesapi.io api key removed from Services. Defaults changed to rely on public chaintracks service which has private api key.
+- Fix bugs in TaskSendWaiting
+- Add Task namespace with all monitor tasks exports.
+- adminStats now splits out abandoned transactions from failed.
+- admin site support changes.
+
+## wallet-toolbox 2.1.9
+
+- Fix batch sending bug in TaskSendWaiting 
+
 ## wallet-toolbox 2.1.8
 
 - Drop no longer required verifyAndRepairBeef method