@bopen-io/wallet-toolbox 2.6.2-brc153.5 → 2.14.5

package/CHANGELOG.md

@@ -4,8 +4,751 @@ This document captures the history of significant changes to the wallet-toolbox
 The git commit history contains the details but is unable to draw
 attention to changes that materially alter behavior or extend functionality.
 
+## wallet-toolbox 2.14.5
+
+- `WalletPermissionsManager` retires no-send transaction ownership and reference
+  aliases when `createAction` or `signAction` reports them as `sending` or
+  `unproven`, including sendWith-only calls and successful members of an
+  undelayed batch's review error. Failed or unreported actions retain their
+  originator binding for retry or abort. Cleanup visits only the retired
+  transaction's references instead of scanning the session's history.
+
+## wallet-toolbox 2.14.4
+
+- `discoverByIdentityKey` and `discoverByAttributes` keep each certificate's
+  `certifierInfo.description` within BRC-100's 5-50 UTF-8 bytes. The default
+  SocialCert (56 bytes) and Metanet Trust Services (55 bytes) descriptions
+  exceeded it, so `@bsv/sdk` 2.8.8+ rejected every discovery result from one of
+  them with `Invalid discoverByAttributes result
+certificates[n].certifierInfo.description: expected 5–50 UTF-8 bytes`, which
+  broke `IdentityClient.resolveByAttributes` and `resolveByIdentityKey`. Both
+  defaults are shortened. Trust settings still accept descriptions of up to 500
+  bytes so stored settings stay readable; a longer one is cut at a code point
+  boundary when the result is built, and one under 5 bytes becomes
+  `Trusted certifier`.
+- A non-admin `createAction` with `noSend` that `WalletPermissionsManager`
+  signs internally returned `noSendChange` outpoints on the unsigned txid next
+  to the signed `txid`, so `@bsv/sdk` 2.8.8+ rejected it with `Invalid
+createAction result noSendChange[0]: expected an outpoint of the returned
+transaction`. The outpoints now name the signed transaction (vouts are
+  unchanged by signing).
+- That same no-send action could not be released: the caller only gets its
+  `txid`, and `abortAction` from a non-admin originator accepted only references
+  the manager had issued, which it drops once it signs. The originator that
+  created a no-send action can now abort it by that `txid`; other originators
+  still cannot, and a broadcast action is never abortable this way. The same
+  applies when the caller signs a `signAndProcess: false` no-send action itself
+  with `signAction`: it can then abort it by the `reference` it signed or by the
+  signed `txid`, where before `abortAction` failed with `The action reference
+was not issued by this permissions manager.`
+- `discoverByIdentityKey` and `discoverByAttributes` return the requested
+  `limit`/`offset` page (limit 10 when omitted). They returned every trusted
+  match, and `@bsv/sdk` rejects a page longer than the limit. `totalCertificates`
+  still counts every trusted match.
+- `ChaintracksServiceClient`, `BHServiceClient` and `GoChaintracksServiceClient`
+  called `fetch` as a method of the client, which browsers refuse ("Failed to
+  execute 'fetch' on 'Window': Illegal invocation" in Chrome, "Can only call
+  Window.fetch on instances of Window" in WebKit). Any in-page wallet verifying
+  a merkle proof through them failed, for example `internalizeAction` of a BRC-29
+  payment. They now call the default or supplied `fetch` with no receiver.
+
+## wallet-toolbox 2.14.3
+
+- Surplus change shaping no longer splits change into outputs below the dust
+  floor. Baskets still on the legacy 32-sat `minimumDesiredUTXOValue` produced
+  split outputs that were later folded away, leaving a fee sized for the larger
+  transaction and failing with `generateChangeSdk error: required fee error`.
+  Each split output now gets at least `max(dustFloor, changeInitialSatoshis)`.
+- `WalletPermissionsManager.abortAction` lets the admin originator abort any of
+  the wallet's actions, including signed `noSend` actions and actions from an
+  earlier session, which the in-memory pending-reference map no longer holds.
+  Other originators still need a reference this manager issued to them.
+
+## wallet-toolbox 2.14.2
+
+- Match complete English text tokens and default stopwords consistently with SDK 2.8.7; preserve quoted and excluded phrases. Scan ordered literal tokens without a combined wildcard expression. Direct filtering ignores inherited attributes and rejects non-string requested values without coercion.
+
+- `discoverByAttributes` no longer drops every overlay result for `any`
+  searches. `filterCertificatesByAttributes` treated the identity overlay's
+  all-fields `any` search as a literal field name, so no certificate matched.
+  It now accepts a certificate when searchable decrypted fields satisfy the requested text terms,
+  and named attributes use the overlay's fuzzy matching (`userName` stays
+  exact). `any` follows the overlay's MongoDB text search: case- and
+  diacritic-insensitive, quoted phrases required, `-term` excluded, and
+  `profilePhoto`/`icon` not searched. Word stemming is not reproduced, so a
+  stem-only overlay match can still be dropped. Blank named attributes are
+  ignored, as on the overlay; a query with no usable attribute matches nothing.
+  Results are still bound to the query they answered.
+
+## wallet-toolbox 2.14.1
+
+- Keep exact action-spend metadata in a shared local WeakMap, preserving storage
+  service-charge authorization across permission-module transforms and separately
+  loaded core, client and mobile bundles without adding keys to public results.
+- Consume the legacy internal Symbol before returning permission-managed results.
+  Completed and two-step `createAction` responses now pass the existing strict
+  binary BRC-100 codec. No app, wire, database, BRC-39 or recovery migration is
+  required; upgrade the wallet host and permission manager together. Reconcile
+  history before retrying an older host's failed response because the transaction
+  may already exist.
+
 ## wallet-toolbox (unreleased)
 
+- Raise the `@bsv/sdk` peer dependency floor to `^2.8.0` in `@bsv/wallet-toolbox`,
+  `@bsv/wallet-toolbox-client`, and `@bsv/wallet-toolbox-mobile`. Value imports
+  used by the built mobile/client bundles and by internal helpers
+  (`TransactionEvidenceCoordinator`, `TransactionEvidenceError`,
+  `completeBoundAction`, `createPublicHTTPSFetch`, `decodeCanonicalPushDrop`,
+  `defaultTransactionEvidenceLimits`, `toUTF8Strict`,
+  `MAXIMUM_SEND_WITH_TRANSACTIONS`) do not exist in `@bsv/sdk` 2.4.1 through
+  2.7.1 despite the prior `^2.4.1` peer range; confirmed against the published
+  tarballs for each version.
+- `Monitor`'s scheduler no longer stops running every task when the optional
+  Chaintracks header/reorg push subscription setup fails or is unimplemented.
+  `runOnce`/`startTasks` previously awaited `ready` directly, so any
+  `chaintracksWithEvents` failure (e.g. the built-in HTTP-polling
+  `ChaintracksServiceClient`, which documents `supportsReorgEvents: false` and
+  throws `Method not implemented.` from `subscribeHeaders`/`subscribeReorgs`)
+  rejected the whole task loop and permanently stopped `startTasks()`. Monitor
+  now skips the subscription attempt entirely when an event source declares
+  `supportsReorgEvents: false`, and otherwise retries subscription setup
+  opportunistically on the next tick, logging a `chaintracksEventsError`
+  monitor event, while every other scheduled task keeps running. A genuine
+  configured-chain mismatch still fails closed: subscriptions are never
+  registered against a `chaintracksWithEvents` source reporting the wrong
+  chain.
+- Confirm `relinquishOutput`'s `basket` argument against the output's actual
+  current basket (looked up inside the same transaction) before clearing
+  `basketId`, instead of clearing it unconditionally. Rejects a basket that
+  does not contain the output, a basket name that does not exist, and an
+  already-unbasketed output, each with `WERR_INVALID_PARAMETER`. Without this,
+  `WalletPermissionsManager.relinquishOutput` (which only checks the
+  originator's access to the _claimed_ basket) let an app with permission on
+  any basket relinquish any output by outpoint, including another app's basket
+  output or the admin `default` change basket.
+- Reject `internalizeAction` basket-insertion merges that would reclassify an
+  existing output out of a different basket it already occupies, closing a gap
+  where `validateBasketMerges()` only rejected reclassifying wallet-managed
+  change. An app with insertion permission on basket X could previously
+  internalize an already-known transaction and move another app's output from
+  basket Y into X, then spend it. Idempotent re-internalization into the same
+  basket, and inserting a currently unbasketed (non-managed-change) output —
+  including the documented default-basket legacy-recovery sweep — keep
+  working. The requested basket is resolved with a plain lookup so a rejected
+  request never creates it.
+- Fix `WalletPermissionsManager` rejecting every sendMax `createAction` call.
+  `verifyRequestedOutputsPresent` now matches fixed-amount outputs first by
+  exact (script, satoshis), then matches any output requested with the
+  `maxPossibleSatoshis` sentinel by locking script alone against whatever is
+  left unused, and returns the resolved real amount per requested output.
+  `computeNetSpend` bills that resolved amount instead of the sentinel, so
+  spending authorization reflects the real funded value (previously ~21
+  million BSV) instead of throwing `The transaction returned for signing does
+not contain caller-requested output ...`.
+- Additively export `WalletMonitorTask`, `attemptToPostReqsToNetwork` (with its
+  `PostReqsToNetworkResult` type), `parseJsonRpc`/`stringifyJsonRpc`, and
+  `verifyUnlockScripts` (with its `UnlockScriptVerificationResult` type) from
+  `src/index.mobile.ts` and `src/index.client.ts`. The published
+  `@bsv/wallet-toolbox-mobile` and `@bsv/wallet-toolbox-client` bundles do not
+  support deep imports, so hosts implementing a custom `Monitor.addTask` task,
+  posting signed requests to the network directly, exchanging the storage
+  remoting wire format, or verifying unlock scripts previously could not reach
+  these symbols at all.
+- Keep cold raw-transaction reads on the caller's transaction, including SQLite
+  with one connection; do not cache uncommitted settings or start background
+  work. Accept missing optional inputBEEF when returning stored raw bytes.
+- Reject unresolved output-basket mappings before sync writes. Apply valid newer
+  basket assignments/removals, preserving equal/older local relinquishment and
+  transaction rollback/retry. Included in unpublished 2.13.2; no schema migration.
+- Restore transactional SQLite migrations in the unpublished 2.13.2 candidate.
+  DDL, migration journal and lock changes roll back after an interrupted attempt;
+  foreign-key enforcement is restored after success or failure. Existing stores
+  with unjournaled partial schema need operator-reviewed recovery; this change
+  does not delete or automatically reconcile historical wallet data.
+
+- Implement `BHServiceClient.findChainTipHash()` by delegating to its existing
+  `findChainTipHeader()` call against `/api/v1/chain/tip/longest`, instead of
+  throwing `Not implemented`. `ChaintracksChainTracker.getVerificationContextToken()`
+  calls `findChainTipHash()` on every verification attempt, so any wallet
+  configured with a `BHServiceClient` as `options.chaintracks`, or as a
+  `LocalChainTracker` participating source, previously failed on every
+  attempt. No `ChaintracksClientApi` contract change; no migration required.
+
+- Preserve valid compound proofs with multiple marked transactions. Rotate
+  unresolved proof repairs behind waiting heights across monitor restarts, and
+  retain retries that become temporarily ineligible after the chain tip
+  retreats. Existing checkpoints remain compatible; no migration is required.
+
+- Validate every newly acquired and replacement Merkle proof against the active
+  ChainTracks root before persistence, continue to later providers when an
+  earlier provider returns an orphan proof, and retain unresolved reorg heights
+  for bounded per-run retries without stopping the forward review cursor. No
+  schema or consumer migration is required.
+
+- Require mutually authenticated responses from remote wallet storage, pin the
+  authenticated server identity for each client instance, optionally accept an
+  independently validated `serverIdentityKey`, and bind the distinct advertised
+  storage identity to that channel, with an optional independent
+  `storageIdentityKey` pin. Strictly correlate JSON-RPC version and request ID,
+  require one unambiguous result or error, keep remote response details out of
+  transport diagnostics, and preserve an explicit null result for void server
+  methods.
+
+- Complete WAB faucet funding through one exact wallet-owned BRC-29 output.
+  Fee-adjusted output amounts are bounded without weakening exact script
+  binding, real Wallet Toolbox symbol metadata remains accessor-safe, and the
+  redemption is staged and labeled before broadcast. Interrupted retries
+  recover the same transaction from its dedicated basket or recognize the
+  already-internalized action instead of signing the faucet input again.
+
+- Make ChainTracks lifecycle and event delivery fail closed. Startup errors are
+  awaited and retryable, failed or cold instances can be fully destroyed,
+  long-running source promises are drained, subscriptions are bounded and
+  deleted rather than tombstoned, and every listener receives an isolated
+  header snapshot. Provider heights, bulk results, type guards, direct source
+  options, and diagnostics are now bounded and accessor-safe. WhatsOnChain
+  options and shared chain-info results cannot be mutated after validation.
+  Filesystem cache mutation is serialized per digest across processes, caller
+  metadata/bytes are snapshotted before awaits, and bulk revalidation takes the
+  writer lock. Bulk-file reconciliation and multi-record replacement are atomic
+  in Knex and IndexedDB, ordinary mutations reach durable storage before memory,
+  failed writes restore the prior manager state, and remote manifests cannot
+  supply local storage identities. Custom storage implementations must add the
+  optional atomic replacement method before performing multi-file changes.
+  Remote clients require complete live metadata and bounded event topology,
+  subscription state, timers, and single-line diagnostics. Destructive Knex
+  rollback failures now propagate. The wallet monitor independently binds its
+  event source to the configured network, authenticates and copies every
+  reorganization header, bounds and deduplicates deactivation retries,
+  coalesces prepared-proof invalidation, cleans up partial subscriptions, and
+  contains application callback failures without implicit console output.
+
+- Make Arcade transaction-status SSE a bounded, ordered durable stream. Client
+  options are snapshotted without accessors; credentials, cursors, payloads,
+  fields, queued count, and queued bytes have explicit ceilings; and event data
+  is validated and copied. Only one event reaches storage at a time, its cursor
+  advances only after processing and persistence succeed, and a malformed,
+  excessive, or failed event closes the stream without dispatching later queued
+  events. Logging is silent by default and transport errors never forward the
+  credential-bearing EventSource object. Monitor task setup retains one pending
+  event, retries storage/checkpoint failures, and closes on removal or teardown.
+
+- Repair monitor and daemon lifecycle ordering. Every scheduled or standalone
+  run now awaits retryable ChainTracks subscriptions, standalone runs initialize
+  every task, transient setup failures retry, and loop failures reset running
+  state. The daemon starts subscriptions before ChainTracks and tasks, can stop
+  after a successful start, and destroys monitor resources before storage even
+  when cleanup fails. Monitor event/task names and diagnostic text are bounded;
+  library logging is opt-in and dotenv loading is quiet.
+
+- Authenticate every ordinary Merkle-proof result before it can create a
+  `ProvenTx` or restore a failed transaction. Provider responses are copied and
+  structurally bounded, must contain a leaf matching the requested txid
+  (independently of the optional `txid` marker),
+  must compute the canonical header root at the same height, and must resolve
+  through a proof-of-work-valid wallet header. Monitor consumers additionally
+  require the local ChainTracks root verdict and bind the request's raw
+  transaction to its txid. WhatsOnChain, Bitails, and Arcade enforce the same
+  invariant when called directly; TSC conversion rejects malformed, sparse,
+  oversized, and unsafe-integer proofs. `TaskUnFail` uses a one-shot internal
+  authorization guard and re-reads its first mutating page so batches over 100
+  cannot be skipped. Existing wire formats and public method signatures remain
+  compatible; the optional root-validator argument is additive.
+
+- Authenticate external transaction-status results before they can influence
+  wallet state. Results must be uniquely bound to requested txids and have
+  consistent mined/known/unknown depth, terminal, and input-conflict fields;
+  provider attribution is local, while descriptions and competing txids are
+  copied and bounded. Malformed providers fail over instead of supplying
+  failure, quarantine, abort-protection, or double-spend evidence. Arcade also
+  validates and binds its complete transaction-data response before status
+  classification or proof parsing, and WhatsOnChain rejects impossible depth.
+  Monitor proof, no-send, and abandonment scans now preserve stable pagination
+  while rows leave their query, and a rejected proof counts as one attempt.
+
+- Bound raw-transaction and proof-provider envelopes before inspection.
+  Raw results are txid-bound, accessor-free owned byte arrays capped at 32 MiB;
+  malformed providers fail over and cannot forge local attribution or mutate
+  accepted bytes. Merkle provider notes are copied as bounded scalar data and
+  legacy custom services may supply at most eight dense proof candidates.
+  Monitor options, task work controls, persisted checkpoints, and polled block
+  headers are also validated and copied before they control background work.
+
+- Contain UTXO-oracle evidence and invalid-change review work. Provider results
+  are accessor-free, bounded, outpoint-consistent owned data with locally
+  configured attribution; malformed responses fail over and never become spent
+  evidence. Manual and admin review require canonical identities and exact
+  modes, booleans, pages, offsets, tags, and safe monetary totals. Whole-wallet
+  compatibility scans have a 10,000-candidate ceiling, and a release rebinds the
+  exact classified outpoint, value, basket, ownership, and allocation state
+  under the write lock before changing spendability.
+
+- Authenticate and bound script-history and transaction-broadcast provider
+  boundaries. History is hash/endian-bound, accessor-free, deduplicated, and
+  capped; all WhatsOnChain calls carry validated whole-request deadlines and
+  chain responses are copied before use. BEEF and direct raw submissions are
+  size- and txid-bound, providers receive isolated snapshots, result identities
+  and state invariants are enforced with local attribution, and sensitive or
+  excessive diagnostics are discarded. Malformed, throwing, or hung providers
+  fail over without forging the wallet's internal timeout marker. A broadcast
+  double-spend claim is terminal only after at least one exact input is
+  conclusively observed spent; unknown oracle evidence remains retryable.
+
+- Enforce one atomic `sendWith` resource invariant from SDK validation and
+  binary decoding through storage, action-batch commit, provider submission,
+  and delayed monitor retry. Broadcast sets contain at most 1,000 unique,
+  canonical transaction IDs, including the newly created or signed
+  transaction. Malformed storage flags cannot diverge from the actual list,
+  and an oversized legacy batch is reported and skipped as a whole rather than
+  partially broadcast or expanded without bound. If any member cannot be
+  resolved or assembled, no ready subset is scheduled or broadcast; members
+  already known by the network remain compatible with retrying the rest.
+
+- Make user provisioning and schema lifecycle failure-atomic. A newly inserted
+  user and its mandatory managed-change basket now share one transaction, and
+  creation-race retry restarts the whole transaction. Knex migration and
+  destructive rollback errors propagate, explicit empty-schema state is the
+  only rollback terminator, and SQLite foreign-key enforcement is restored in
+  `finally` after both successful and failed migration work.
+
+- Keep secrets and untrusted wallet material out of implicit process logs.
+  `Setup.makeEnv()` returns generated development keys without printing them;
+  invalid BEEF, identity/certificate parsing, permission batching, provisioning
+  races, migration failures, and IndexedDB orphan handling no longer emit raw
+  objects, transaction/proof data, database details, or row identifiers. The
+  existing explicit wallet logger receives only a generic BEEF-validation
+  message when a caller opts into it.
+
+- Preserve wallet write atomicity across metadata revival, entity insertion,
+  and abort-time chain checks. Soft-deleted baskets, labels, label mappings,
+  output tags, and tag mappings now revive in the caller's exact transaction;
+  new proof-request and sync-state entities retain that transaction as well.
+  `abortAction` queries external chain status before opening an IndexedDB write
+  scope, then rebinds the observation to the exact transaction ID and txid
+  under the write lock before committing its decision.
+
+- Keep shared-storage schema and process lifecycle under operator authority.
+  Authenticated remote migration requests are compatibility no-ops, matching
+  remote destroy requests, so a wallet tenant cannot contend on global DDL or
+  initialize shared storage metadata.
+
+- Bound authenticated proof-request reads before database and memory work.
+  Knex and IndexedDB apply wallet ownership in the same query/cursor scan as
+  status, partial, offset, and limit filtering. Custom providers retain a
+  bounded compatibility path and must supply exact txids or a provider-native
+  scoped query for wallets with more than 10,000 proof requests.
+
+- Bound caller-selected Wallet Storage RPC offsets as well as page sizes.
+  Top-level list offsets, nested find paging, and synchronization checkpoints
+  are rejected before database/cursor work when they exceed the selected
+  resource profile. Operators can raise the explicit ceiling for larger
+  histories without changing the wire format.
+
+- Redact internal Wallet Storage failures at every authenticated HTTP response
+  boundary. JSON-RPC and action-batch upload routes preserve explicit public
+  wallet errors, but generic exceptions and custom `WERR_INTERNAL` diagnostics
+  now return only the stable internal-error name and default message. Detailed
+  provider, database, and filesystem failures remain available through
+  explicitly configured operator logging and telemetry.
+
+- Clarify local-contact authority throughout SDK and Wallet Toolbox identity
+  documentation. A saved contact is an authoritative wallet-local trust anchor
+  based on the user's independent validation, analogous to accepting a
+  self-signed certificate. Its infinite trust is intentionally local—not a
+  third-party certification or transferable trust claim—and authenticated
+  contact storage proves retention of that decision rather than the underlying
+  real-world identity.
+
+- Re-bind cryptographically authenticated identity-overlay certificates to the
+  exact lookup they answer before applying trust thresholds. A dishonest lookup
+  host can no longer answer an identity-key or public-attribute query with a
+  different valid trusted certificate. Local contacts remain authoritative;
+  contact lookup matching continues to follow the caller-installed source's
+  explicit local trust contract.
+
+- Harden local ChainTracks persistence and legacy bulk tooling. Memory-backed
+  trackers no longer share state, IndexedDB and Knex require unique active
+  headers and consecutive parent linkage, reorganization walks are bounded and
+  fail atomically, direct admissions are authenticated, and Knex serializes tip
+  mutation through an internal state row. MySQL now stores 64-character hex
+  values as `VARCHAR(64)` and multi-megabyte header objects as `LONGBLOB`; the
+  additive migration clears the rebuildable legacy live-header cache before
+  widening fields that permissive MySQL could already have truncated. Bulk
+  manifests, local readers, exporters, filesystem operations, and lock queues
+  now have canonical path, byte, count, continuity, genesis, digest,
+  proof-of-work, and progress bounds. Filesystem cache reads are bounded before
+  allocation and authenticate writes, while the durable download budget now
+  serializes reservations across processes and fails closed on an abandoned
+  lock instead of silently resetting or losing allowance.
+
+- Fix the legacy `BHServiceClient` Merkle-root cache so rejected, stale, or
+  externally written roots can never become authoritative. Every verdict now
+  resolves a bounded canonical header, validates its computed hash and proof
+  of work, and binds it to the requested height or hash. Its HTTP reads reject
+  redirects and malformed endpoints, retain whole-body deadlines, and enforce
+  response and batch ceilings. ChainTracks core options are validated before
+  startup, and all library/factory logging is now silent unless the embedding
+  application supplies the existing optional logger.
+
+- Treat every remote ChainTracks HTTP/SSE and WhatsOnChain HTTP/CDN/WebSocket
+  response as untrusted input: retain the
+  deadline through bounded body consumption, bound and idle-timeout streams,
+  prohibit redirects and ambiguous endpoint URLs, validate canonical header
+  bytes and proof of work, and bind network, height, hash, and reorganization
+  results to each request before returning or queueing them. Submitted and live
+  header queues are copy-isolated, deduplicated where applicable, and bounded.
+  Service-discovered CDN links must remain credential-free public HTTPS with
+  DNS-pinned Node connections, legacy history streams are range-ordered and
+  chunked, and no declared target contributes to bulk chain selection before
+  its complete header and proof of work have been authenticated.
+
+- Authenticate every discovered permission token against its exact BEEF
+  outpoint, canonical signed PushDrop fields, locally derived locking key, and
+  signed grant content. Basket membership and tags remain selectors only. Bind
+  public partial actions and all token mint, renewal, coalescing, and revocation
+  flows to the exact authorized final transaction and actual input indexes.
+  Include signer-authenticated storage service charges in the exact spend sent
+  for permission approval, without changing the BRC-100 API or wire format, and
+  fail closed on inconsistent sources or unsafe monetary arithmetic. The exact
+  packed platform measurements are 2,184,519 / 520,753 / 397,289 bytes for Vite
+  and 1,704,383 / 471,571 / 370,439 for esbuild (raw/gzip/Brotli), with reviewed
+  ceilings of 2,230,000 / 535,000 / 410,000 and
+  1,740,000 / 485,000 / 380,000 respectively. Mobile measures
+  2,344,815 / 597,625 / 454,020 for Metro and
+  4,579,110 / 1,919,816 / 1,489,229 for optimized Hermes bytecode, with reviewed
+  ceilings of 2,400,000 / 610,000 / 465,000 and
+  4,675,000 / 1,960,000 / 1,520,000 respectively.
+
+- Bind UMP renewal to an exact canonical, field-signed predecessor owned by the
+  local wallet and require one exact replacement token in the completed action.
+  Bind WAB faucet funding to its exact Atomic BEEF target, output-zero R-puzzle
+  commitment, actual wallet input index, and returned final transaction ID.
+
+- Bind legacy P2PKH funding imports to the exact atomic signing target and
+  final wallet transaction. Reject result-only transaction IDs, ambiguous
+  outpoints, oversized or redirected provider responses, and unbounded BEEF
+  recursion/source graphs before signing or allocation.
+
+- Atomically consume BRC-103 signed-message nonces across StorageServer replicas.
+  The additive `2026-09-16-001 add auth message replay claims` migration creates
+  `auth_message_nonces` with a composite session-or-identity scope/nonce
+  uniqueness constraint and expiry index. Signed follow-up and unsigned
+  initial-request replays are both rejected. Run the migration before deploying
+  the new runtime; otherwise authentication processing fails closed.
+
+- Integrate upstream security corrections without dropping the sync recovery contracts.
+  Record combined browser/mobile artifact costs and limits in the sync transfer guide.
+
+- Validate replacement proofs across providers before reconciling stale RPC sync metadata; preserve raw transactions and checkpoints on failure.
+
+- Start sync copies conservatively and adapt page work after committed responses.
+  Validate at most eight remote proofs concurrently, draining failure work before
+  rejecting the page. Preserve all proof and checkpoint checks. Record-transfer
+  candidates now use 2.13.0 to distinguish them from published 2.12.0.
+
+- Require an affirmative certifier-signature verification result before
+  storing directly acquired or issuer-returned certificates. Identity overlay
+  results are verified before decryption and trust scoring, so forged
+  certificates cannot become wallet-held or trusted discovered identities. The
+  synchronized browser Vite ceilings advance to 1,695,000 raw and 401,000 gzip,
+  covering measured 1,694,211-byte and 400,048-byte bundles; Brotli is unchanged.
+  The mobile Metro raw ceiling advances to 1,750,000 for the measured
+  1,748,892-byte bundle. The browser esbuild raw ceiling advances to 1,323,000
+  for the measured 1,321,768-byte bundle, its gzip ceiling advances to 365,000
+  for the measured 364,413-byte bundle, and the optimized Hermes gzip ceiling
+  advances to 1,442,000 for the measured 1,441,531-byte bytecode; remaining
+  compressed ceilings are unchanged.
+- Never cache, coalesce, or reuse spending approvals, give each prompt a
+  distinct request identity, and paginate the complete action history before
+  calculating an authorization token's prior spending.
+- Require HTTPS for credential-bearing remote storage and Arcade SSE outside
+  explicit loopback development, disable dependency debug output, and avoid
+  serializing credential-bearing transport errors. Snapshot formats remain
+  unchanged and are documented as wallet-equivalent secrets.
+- Make new WAB account creation resumable when wallet setup, funding, KDF, UMP
+  publication, or the final acknowledgement is interrupted. The manager accepts
+  a clean missing-token result only for a server-declared pending registration,
+  finalizes after successful publication, repairs a lost acknowledgement on the
+  next login, and preserves fail-closed continuity for active and legacy WABs.
+- Add optional bounded sync transfers for oversized records, authenticated pieces,
+  durable Knex staging, full-frame SHA-256 verification, and stale-checkpoint
+  rejection before merging. Add the two staging tables through migration
+  `2026-09-09-001`; reverse only that migration before restarting older code. Frames are limited
+  to 64 MiB and ordinary pages keep their existing transport. See
+  [the transport and migration guide](./docs/sync-transfer.md).
+
+- Upgrade IndexedDB to schema version 6 with a non-unique transaction-ID/user
+  index. Use existing reference, reclaim, commission, and relation keys for
+  sync lookups, avoiding repeated scans as a local wallet grows. Preserve
+  user filtering, pagination, existing bytes, and duplicate transaction IDs.
+  Proof-batch preflight checks resolve only requested transaction IDs through
+  the existing index, preserving proof validation and primary-key ordering.
+  Older clients requesting schema version 5 cannot open the upgraded database.
+
+- Add negotiated compact sync checkpoints, reusing committed page progress while
+  retaining complete writer-side ID mappings and the legacy provider fallback.
+  Avoid per-scalar reviver callbacks when decoding binary JSON pages without
+  changing marker escaping or byte semantics. Use the already negotiated binary
+  codec for large schema-defined sync response byte arrays, reducing wire and
+  authentication payload size while preserving legacy arrays and unrelated data.
+  Retain authenticated full-copy,
+  resume, malformed-input, and transport CPU/payload regression coverage.
+  Local packed measurements are 1,701,711 raw / 401,038 gzip / 314,272 Brotli
+  bytes (Vite), 1,327,368 / 364,550 / 293,224 (esbuild),
+  1,753,648 / 445,136 / 345,369 (Metro), and
+  3,557,663 / 1,426,740 / 1,121,821 (Hermes). The raw ceilings become
+  1,702,000, 1,327,500, 1,755,000, and 3,558,500 respectively.
+  Vite and esbuild gzip ceilings increase to 402,000 and 366,000 bytes.
+  Hosted Linux measures 365,818 esbuild gzip bytes and 1,445,624 Hermes gzip
+  bytes; the Hermes gzip ceiling becomes 1,446,500.
+  The esbuild Brotli ceiling is 293,750 bytes. Asynchronous platform hashing
+  for large SDK signature payloads brings the Vite Brotli ceiling to 314,500
+  bytes, the Hermes raw ceiling to 3,560,000 bytes, and its Brotli ceiling to
+  1,125,000 bytes (measured 1,124,446); other compressed ceilings remain unchanged.
+  The added portable sync/progress and decoding paths account for
+  the increase; no Node-only backend is introduced into portable bundles.
+
+- Keep Argon2id-backed UMP v3 wallets available in React Native and other
+  runtimes without WebAssembly by falling back to an asynchronously yielding,
+  standards-compatible JavaScript implementation. The same KDF parameters and
+  derived bytes are preserved, so existing tokens require no migration and
+  WebAssembly-capable runtimes retain the faster path. The existing public
+  `hash-wasm`-compatible utility contract remains intact: secret-bearing,
+  non-binary-output, and non-byte-array requests stay on `hash-wasm` and are
+  never reinterpreted by a host backend or fallback. Native registration is
+  available from both mobile and client roots, concurrent cold callers share
+  one preload attempt, and both alternative implementations validate result
+  type and length. Unrelated validation errors propagate even without the
+  WebAssembly global. The current-main macOS
+  reference fixtures measure 1,690,925 raw / 398,461 gzip / 311,955 Brotli
+  bytes with Vite, 1,319,059 raw / 362,220 gzip / 291,206 Brotli bytes with
+  esbuild, 1,746,067 raw / 442,648 gzip / 343,342 Brotli bytes with Metro, and
+  3,542,034 raw / 1,419,515 gzip / 1,117,531 Brotli bytes as optimized Hermes
+  bytecode; hosted Linux measures 1,439,166 gzip bytes. Combined with the
+  interrupted-registration recovery path above, current measurements are
+  1,694,823 raw / 399,940 gzip / 312,528 Brotli bytes with Vite, 1,322,223 raw
+  / 364,260 gzip / 291,914 Brotli bytes with esbuild, 1,749,694 raw / 443,665
+  gzip / 344,059 Brotli bytes with Metro, and 3,549,495 raw / 1,441,622 gzip /
+  1,119,600 Brotli bytes as optimized Hermes bytecode. The reviewed ceilings
+  advance to 1,697,000 raw / 400,000 gzip Vite bytes, 1,324,000 raw / 365,000
+  gzip esbuild bytes, 1,752,000 raw Metro bytes, and 3,552,000 raw / 1,442,000
+  gzip Hermes bytes; Brotli ceilings remain unchanged.
+
+- Extend the BRC-98/99/111 permission-module interface with an optional semantic
+  `handleRequest` hook. A module can now return a conforming BRC-100 result
+  directly or invoke the underlying wallet operation at most once, while
+  existing `onRequest`/`onResponse` transformation modules remain compatible.
+  The companion `@bsv/ecpm-permission-module` uses this hook to implement
+  `p ecpm` point multiplication without adding a BRC-100 method or wire call.
+
+- Add opt-in prepared BEEF storage for Knex-backed normal `createAction`
+  funding. COOK (Create Once, Output Kept) stores a user-scoped, exact,
+  independently verified and checksummed proof closure, merges valid hits
+  without invoking the canonical builder, and treats every miss or cache
+  failure as the existing canonical path. Missing roots and newly finalized
+  managed-change transactions are queued only after foreground action work is
+  complete; bounded writes, reads, and gradual backfill are separately
+  controlled and default off. Reorganizations stale derived artifacts, a
+  database proof epoch fences in-flight cross-process writes, purge removes
+  unused rows, and prepared data remains outside wallet sync. The
+  Knex worker is excluded from portable bundles. Reviewed Vite ceilings advance
+  to 1,610,250 raw / 379,750 gzip / 298,000 Brotli bytes and esbuild ceilings
+  to 1,255,000 raw / 346,250 gzip / 278,000 Brotli, covering local measurements
+  of 1,609,783 / 379,492 / 297,253 and 1,254,603 / 344,792 / 277,384 bytes;
+  hosted Linux Vite Brotli and esbuild gzip measured 297,585 and 345,711 bytes.
+  The Hermes raw / gzip ceilings advance to 3,374,500 / 1,369,000 bytes,
+  covering local measurements of 3,372,554 / 1,348,354 and hosted Linux
+  measurements of 3,373,560 / 1,368,128 bytes; Metro and Hermes Brotli
+  ceilings remain unchanged.
+- Add the built-in BRC-177 `p nosend expiry` module for seconds, Unix timestamp,
+  and block-height deadlines. Protected actions are prefunded through an
+  accepted transaction, contain no wallet change, and retain a pre-signed
+  reclaim across restarts, synchronized storage, devices, and keyless remote
+  monitors. Atomic lifecycle transitions, active-storage ownership,
+  fail-closed status checks, backoff-controlled recovery of terminally rejected
+  reclaims, quarantined race outputs, and locally validated proof finality
+  prevent duplicate reclaim activation and unsafe state regression. Wallet
+  Permissions Manager authorizes module use and spending
+  before prefunding, attributes the funding fee to the requesting originator,
+  and rechecks the current monthly ledger before releasing the protected
+  action. Existing actions and ordinary `noSend` calls are unchanged. The
+  current-main macOS reference fixtures measure 1,662,220 raw / 388,763 gzip /
+  305,307 Brotli bytes with Vite, 1,297,621 raw / 355,579 gzip / 285,031 Brotli
+  bytes with esbuild, 1,710,494 raw / 430,613 gzip / 334,490 Brotli bytes with
+  Metro, and 3,474,604 raw / 1,406,878 gzip / 1,090,948 Brotli bytes as
+  optimized Hermes bytecode. The reviewed ceilings advance to 1,665,000 /
+  390,000 / 307,000 Vite bytes, 1,300,000 / 357,000 / 287,000 esbuild bytes,
+  1,712,000 / 455,000 / 360,000 Metro bytes, and 3,480,000 / 1,410,000 /
+  1,095,000 Hermes bytes.
+
+- Report `listOutputs` `totalOutputs` as the size of the whole result set on
+  every page, in both the IndexedDB and Knex storage providers. A short final
+  page previously returned only that page's length, so a client paging a large
+  basket saw the total collapse to the size of the last page; an offset at or
+  past the end now counts instead of inferring, and the managed-change spec-op
+  no longer discards the total it already computed. Full pages, first pages,
+  and empty result sets are unchanged, so no consumer migration is required.
+  `balanceAndUtxos` now terminates from page progress instead of relying on the
+  former collapsing total, preventing a zero-progress loop after the final page.
+  The reviewed Vite raw-size ceiling advances by 500 bytes to 1,607,500,
+  covering the hosted Linux measurement of 1,607,015 bytes; the Vite compressed
+  and esbuild ceilings remain unchanged.
+
+- Serialize typed AtomicBEEF and competing BEEF in wallet review errors as
+  portable JSON arrays, keeping HTTP and relay error recovery compatible with
+  both historical array wallets and current binary Wallet Wire wallets.
+- Serialize real typed arrays portably in outbound WAB requests while
+  preserving arbitrary inbound WAB JSON objects exactly.
+
+- Accept legacy BRC-95 payment envelopes that include unrelated BEEF branches
+  by reducing them to the declared transaction and its dependency closure
+  before strict proof and BRC-29 validation. Malformed transactions, invalid
+  proofs, and incorrectly locked payment outputs remain rejected. The shared
+  helper adds 137 bytes to the local optimized Hermes fixture. The reviewed
+  ceilings advance by 1,000 bytes to 3,361,000 raw and 1,362,000 gzip, covering
+  the measured macOS raw size of 3,360,137 bytes and hosted Linux gzip size of
+  1,361,509 bytes; the Brotli ceiling remains unchanged.
+
+- Commit each received wallet-storage sync page and its durable checkpoint in
+  one provider transaction. Large IndexedDB replications avoid thousands of
+  transaction startup/commit cycles, failed pages roll back without advancing
+  the checkpoint, and abort cleanup preserves the original storage error.
+
+- Fill wallet-storage sync pages with adaptive, size-aware source queries and
+  add composite SQL indexes for user-scoped proof lookups. Sync clients may
+  request optional source record totals for exact progress and ETA displays;
+  older clients and providers remain wire-compatible and do not incur count
+  queries unless totals are requested. Remote clients also recover from a
+  provider's HTTP 413 response ceiling by retrying the read-only sync request
+  with a smaller chunk budget and reusing the working limit for later pages.
+  Runtime validation rejects malformed remote totals, and MySQL rollback
+  restores the foreign-key support index before removing the new composites.
+  The retained authenticated candidate-provider benchmark fills a 250-record
+  proof page with three source reads (`10, 80, 160`) on SQLite and MySQL.
+  Clean macOS fixtures measure Vite at 1,609,916 raw, 379,552 gzip, and 297,188
+  Brotli bytes; esbuild at 1,254,827 raw, 344,883 gzip, and 277,729 Brotli
+  bytes; Metro at 1,662,714 raw, 419,740 gzip, and 326,785 Brotli bytes; and
+  Hermes at 3,371,236 raw, 1,347,950 gzip, and 1,061,946 Brotli bytes. The
+  reviewed ceilings advance to 1,611,000/380,000/297,500 for Vite,
+  1,256,000/346,000/278,200 for esbuild, and 3,373,000/1,368,000 raw/gzip for
+  Hermes. Metro and the Hermes Brotli ceiling remain unchanged.
+
+- Make verified phone changes interruption-safe by staging the replacement key
+  in WAB, publishing the UMP rotation, and then finalizing WAB. Authentication
+  can recover an interrupted transition from the current or pending key and
+  idempotently finish it without creating a second UMP update.
+
+- Prune `inputBEEF` to the dependency closure of explicitly declared action
+  inputs before remote request serialization and repeat the pruning on the
+  server before verification and persistence. Unrelated proof branches no
+  longer consume transfer or validation work or cause an otherwise valid
+  action to fail; proof data required by a declared input is still fully
+  validated.
+
+- Add a local-first ChainTracks control plane for browser, mobile, and Node
+  wallets, including explicit local-primary/remote-only mode, independently
+  sourced consistency checks, quorum-backed exceptional fallback, local-clear
+  hooks, and opt-in divergence recovery. Add a portable packaged-checkpoint
+  cache contract and a Node filesystem implementation with validated reads and
+  atomic writes. Coalesce concurrent immutable-file misses, centralize bounded
+  fetch retries, enforce whole-response deadlines and byte ceilings, and expose
+  cache/download counters and an optional upstream-byte budget. Bulk and live
+  ingestion now enforce each header's declared proof-of-work target, and local
+  consistency checks detect both quorum-confirmed divergence and a
+  quorum-confirmed stuck height before optional recovery. The reviewed platform
+  service seam also accepts a composed SDK `chainTracker` directly while
+  retaining the existing client-wrapping default. The reviewed platform
+  ceilings advance to 1,601,000 Vite bytes, 1,249,000 esbuild bytes, and
+  3,358,000 Hermes bytes; their matching gzip/Brotli ceilings are
+  377,000/296,000, 344,000/276,000, and 1,360,000/1,070,000 bytes.
+- Keep ChainTracks availability independent of immutable-header verification:
+  stale heights now return immediately behind a single refresh, complete
+  digest/linkage/chain-work/proof-of-work validation can run in a bounded Node
+  worker pool, and historical reads release the manager lock before disk,
+  network, or worker waits. Filesystem caches use content-addressed objects,
+  quarantine rejected entries, and promote validated legacy files without
+  deleting the only retained copy. A crash-safe download ledger reserves every
+  physical retry before network I/O and survives restarts; failed objects back
+  off before another attempt. The reference server keeps probes local, applies
+  separate historical concurrency admission, and publishes complete CDN
+  generations behind an atomic pointer while retaining rollback generations.
+- Age proactive pending-transaction review from immutable request creation
+  time, so repeated proof polling cannot keep a rejected transaction below the
+  reconciliation threshold forever. A descendant of a locally terminal parent
+  now fails from that durable storage evidence; failed-parent outputs remain
+  quarantined while unrelated inputs are released for reuse. The shared change
+  adds about 1.1 kB to the Vite browser artifact and 3.8 kB to Hermes bytecode;
+  the reviewed raw ceilings advance to 1,585,000 and 3,322,000 bytes while all
+  compressed ceilings remain unchanged; the esbuild raw ceiling advances to
+  1,238,000 bytes.
+- Keep mainnet and testnet ChainTracks usable from browser and webview wallets:
+  browser runtimes temporarily select the CORS-enabled legacy service while
+  Node runtimes retain Arcade/go-chaintracks v2. `Services.getHeight` now falls
+  back to WhatsOnChain if ChainTracks is unavailable and preserves the original
+  ChainTracks error when both providers fail.
+- Route `ttn` wallets through the isolated `teratestnet` overlay preset and
+  enable the public TTN Arcade broadcaster/proof provider by default. TTN does
+  not register the incompatible legacy ARC BEEF fallback. Other chain defaults
+  are unchanged, and an empty Arcade URL explicitly disables Arcade.
+- Reconcile Arcade broadcast outcomes as durable wallet state. Retryable
+  locktime and parent conditions remain pending, while validator failures fail
+  the request and explicit missing-input or conflict evidence atomically fails
+  every local transaction copy and quarantines its wallet-owned inputs without
+  depending on WhatsOnChain. Cached accepted/seen labels can no longer revive a
+  terminal conflict; only a mined event whose Merkle proof validates through
+  the configured chain tracker may repair it. Arcade also participates in the
+  shared transaction-status service so double-spend review remains conservative
+  on networks with no explorer. A scheduled paged pass also reconciles aged
+  pending requests from durable Arcade lifecycle state, including orphan-mempool
+  losers whose SSE event was missed; mined/known evidence wins over rejection.
+  Inconclusive or absent UTXO providers no longer
+  masquerade as a spent-output verdict in invalid-change release, stale-input
+  reconciliation, proof recovery, or storage diagnostics. Invalid-change review
+  returns conclusive read-only findings plus unknown diagnostics. Direct release
+  blocks atomically with machine-readable `WERR_UTXO_REVIEW_INCONCLUSIVE` when
+  any result is unknown. Monitor Admin uses bounded, five-second-deadline pages
+  and can explicitly release the confirmed-spent subset while retaining unknowns;
+  every mutation rechecks ownership/allocation under lock and records audit
+  evidence. Monitor Admin scans by default and requires explicit confirmation.
+  The
+  Arcade SSE cursor advances only after both event storage work and cursor
+  persistence succeed; either failure leaves the event queued for ordered retry.
+- Replace 32-satoshi default-basket fragments with a progressive liquidity
+  policy targeting 144 useful 5,000-satoshi outputs. New actions create at most
+  eight outputs from real surplus and migrate at most four fee-positive legacy
+  fragments, while a same-tier compatibility plan guarantees that optional
+  shaping cannot refuse an action the former planner could fund. Explicitly
+  funded actions materialize change from their existing surplus without
+  gathering pool inputs, and SQLite policy migrations use sync-compatible UTC
+  ISO timestamps.
+- Prefer completed, then unproven, then sending parents. Plans above 16 inputs
+  compare exact transaction-plus-BEEF bytes before accepting pending ancestry;
+  pending change remains an unconditional last-resort funding source. Align
+  action-batch reservation/planning and add a read-only Monitor liquidity
+  report. All work limits are configurable and accept `-1` for explicit
+  operator-selected unlimited behavior.
+- Restore delayed broadcast for durable permission-token persistence. Permission
+  grants no longer inherit network-broadcast latency; the managed-change policy
+  handles queued ancestry without hiding it or preferring it over settled funds.
+- Isolate each in-memory action batch by explicit staged-output or `sendWith`
+  membership, so unrelated immediate actions and `noSend` roots cannot be
+  captured by or commit a workspace. Add an exact-input resume protocol for
+  expired leases, structured lifecycle errors, and a provider-enforced
+  cumulative reservation limit that defaults to 256 outputs and can be
+  configured, including `-1` for operator-selected unlimited operation.
+- Keep the combined action-batch, managed-liquidity, browser-fallback, and
+  fail-safe reconciliation browser/mobile cost bounded by exact packed-artifact
+  contracts. Local verification measures 1,557,683 raw / 366,927 gzip / 287,337
+  Brotli bytes with Vite, 1,215,983 raw / 333,466 gzip / 268,497 Brotli bytes
+  with esbuild, 1,617,544 raw Metro bytes, and 3,271,146 raw / 1,302,110 gzip /
+  1,025,812 Brotli Hermes bytes. Reviewed raw ceilings are 1,561,000 Vite bytes,
+  1,220,000 esbuild bytes, 1,710,000 Metro bytes, and 3,275,000 Hermes bytes;
+  compressed ceilings remain independently governed.
+- Fix `WalletStorageManager.getStoreEndpointURL` / `getStores().endpointURL` to
+  duck-type provider `endpointUrl` instead of matching
+  `constructor.name === 'StorageClient'`. Production minifiers rename classes,
+  so the name check left remote stores with `endpointURL: undefined` while
+  sync still worked; clients that select a backup by URL (make primary) failed.
 - Let Storage Server operators select an explicit listener host while retaining
   the historical omitted-host behavior for existing callers. The official
   Wallet Infrastructure image uses this to bind direct-mode traffic on IPv4
@@ -222,7 +965,7 @@ attention to changes that materially alter behavior or extend functionality.
 
 ## wallet-toolbox 2.1.27
 
-- Add optional `contactSource` (and exported `ContactSource` / `ContactRecord` interfaces) on `WalletArgs` and the `Wallet` class. When provided, `Wallet.discoverByIdentityKey` consults the local contacts source **before** the in-process `_overlayCache` and before any network call; on a hit, the overlay is not queried at all. `Wallet.discoverByAttributes` consults the contact source's optional `findByAttributes` when present. Contact-source failures are swallowed and fall through to the existing network path so the network is never gated on a flaky contact store.
+- Add optional `contactSource` (and exported `ContactSource` / `ContactRecord` interfaces) on `WalletArgs` and the `Wallet` class. When provided, `Wallet.discoverByIdentityKey` consults the local contacts source **before** the in-process `_overlayCache` and before any network call; on a hit, the overlay is not queried at all. `Wallet.discoverByAttributes` consults the contact source's optional `findByAttributes` when present. Contact-source failures are swallowed and fall through to the existing network path so the network is never gated on a flaky contact store. A caller-installed contact source is an explicit personal trust anchor: its records are locally authoritative, not third-party certifier attestations. Synthetic contact results default to type `contact`, use empty certificate-proof fields, and receive infinite trust to express that local policy decision.
 - `Wallet.discoverByIdentityKey` and `Wallet.discoverByAttributes` accept `forceRefresh?: boolean`. When `true`, both the contacts short-circuit and the 2-minute `_overlayCache` are bypassed so the network is consulted fresh — useful for a manual refresh action.
 - `identityUtils.parseResults` now yields to the host runtime between certificates on UI runtimes (browser / React Native, detected at call time). On Node the yield is skipped to avoid timer overhead. Same total work; the JS thread no longer owns the frame for the duration of the loop, so menu taps and scroll keep working while a large identity result is parsed.
 - `identityUtils.parseResults$` — new async-iterable form that emits each successfully parsed `VerifiableCertificate` as soon as it's ready, for callers that want progressive rendering.