@bsv/wallet-toolbox 2.4.1 → 2.4.2

package/CHANGELOG.md

@@ -6,6 +6,39 @@ attention to changes that materially alter behavior or extend functionality.
 
 ## wallet-toolbox (unreleased)
 
+- Release prep for `2.4.2`: transaction-pipeline, BEEF fetching, and binary transport
+  performance improvements described below, published in lockstep for Node, browser, and mobile.
+- Transaction pipeline performance: reuse parsed BEEF through `createAction`/`signAction`, retain
+  typed bytes internally until persistence compatibility boundaries, and avoid reparsing Atomic
+  BEEF during internalization and broadcast preparation.
+- Fetch independent BEEF ancestor frontiers and allocated-change proofs with bounded concurrency,
+  deterministic merge order, Set-based deduplication, and configurable `maxConcurrency`.
+- Negotiate compact base64 JSON-RPC binary values across Node, browser, and mobile clients while
+  preserving numeric-array requests and responses for old servers and clients. A 1 MiB payload is
+  62.7% smaller on the wire than legacy byte-array JSON.
+- Treat non-finite ancestor-fetch concurrency values as the safe default instead of silently
+  returning incomplete BEEF, reject malformed binary JSON base64, and decode deeply nested JSON
+  iteratively so hostile input cannot overflow the JavaScript call stack.
+- Keep binary JSON-RPC requests in the legacy numeric-array format by default so rolling deployments
+  cannot route a negotiated request to an older server instance. Homogeneous endpoints can opt in to
+  compact requests with `StorageClientOptions.binaryRequests`; compact responses remain negotiated.
+
+- Release prep for `2.4.2`: add a Knex-backed async BRC-103 session manager,
+  the shared-session schema migration, and `StorageServer.sessionManager`
+  injection so authenticated requests can move safely between replicas without
+  sticky routing. Session writes reject stale cross-replica state, expire after
+  a configurable TTL, and support explicit pruning. Also add an opt-out that
+  skips both per-RPC logging and request-parameter serialization, and add a
+  `monitor_events.created_at` index for production proof-latency correlation.
+  Declare the runtime `body-parser` and `dotenv` imports explicitly;
+  `auth-express-middleware@2.1.1` likewise declares its `mime-types` runtime
+  import so strict package managers do not fail when loading the built packages.
+
+- Release prep for `2.4.2`: proof completion now discovers every local
+   transaction row sharing the proven txid, repairs notification-set drift from
+   concurrent multi-user `internalizeAction` calls, and idempotently completes
+   any local copy omitted by a last-writer-wins notification update.
+
 - Release prep for `2.4.1`: define one managed-change policy across Knex and IndexedDB allocation,
   counting, default balance reporting, `balanceAndUtxos`, and `noSendChange`.
   Only complete BRC-29 signer metadata is eligible; custom rows remain visible

package/README.md

@@ -81,6 +81,47 @@ for the default-basket invariant, automatic funding policy, and supported
 
 The codebase has detailed JSDoc annotations throughout — these will surface inline in editors like VS Code.
 
+### Horizontal Storage scaling
+
+`StorageServer` uses an in-process BRC-103 session manager by default. Before
+running multiple processes or replicas behind a non-sticky load balancer, use
+the shared Knex implementation against the same migrated wallet database:
+
+```typescript
+import {
+  KnexSessionManager,
+  StorageKnex,
+  StorageServer
+} from '@bsv/wallet-toolbox'
+
+const storage = new StorageKnex(storageOptions)
+await storage.migrate(storageName, storageIdentityKey)
+await storage.makeAvailable()
+
+const sessionManager = new KnexSessionManager(storage.knex, {
+  ttlMs: 24 * 60 * 60 * 1000
+})
+
+const server = new StorageServer(storage, {
+  port: 3000,
+  wallet,
+  monetize: false,
+  sessionManager,
+  logRpcRequests: false
+})
+server.start()
+```
+
+Every replica must share the same database and session TTL. Run
+`sessionManager.pruneExpiredSessions()` from one scheduled maintenance worker;
+reads exclude expired rows even before they are physically pruned. Once every
+replica uses the shared manager, authenticated requests no longer require
+client-IP or cookie affinity.
+
+Run `StorageKnex.migrate(...)` before constructing the manager during an
+upgrade. `makeAvailable()` validates and loads an already-migrated database; it
+does not apply schema changes.
+
 ## Development
 
 ```bash