From 5616c96b2171be85c4a7e2e8bd3b209b369eb53a Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 21 Sep 2026 15:08:50 +0000 Subject: [PATCH 1/4] fix(wallet-toolbox): remove unused WERR_NETWORK_CHAIN and ProcessSyncChunkResult.error WERR_NETWORK_CHAIN was defined and deserialized but never thrown, and no processSyncChunk producer or consumer set or read result.error. Remove the dead surface instead of inventing new chain-mismatch or chunk-error semantics. Historical JSON with that error name still deserializes as a generic WalletError. Closes #541 Closes #542 Co-authored-by: deggen --- docs/reference/package-api-migrations.md | 18 +++---- governance/package-release-notes.json | 12 ++--- packages/wallet/wallet-toolbox/CHANGELOG.md | 16 ++++++ packages/wallet/wallet-toolbox/docs/client.md | 54 +++++++------------ packages/wallet/wallet-toolbox/docs/wallet.md | 46 ++++++---------- .../wallet-toolbox/src/sdk/WERR_errors.ts | 9 ---- .../src/sdk/WalletErrorFromJson.ts | 4 -- .../src/sdk/WalletStorage.interfaces.ts | 2 - .../src/sdk/__test/WalletError.test.ts | 6 +-- specs/wallet/storage-adapter.yaml | 2 - 10 files changed, 68 insertions(+), 101 deletions(-) diff --git a/docs/reference/package-api-migrations.md b/docs/reference/package-api-migrations.md index d7663a0155..cb78e0edc9 100644 --- a/docs/reference/package-api-migrations.md +++ b/docs/reference/package-api-migrations.md @@ -54,9 +54,9 @@ and clean-consumer tests remain the executable type authority. | `@bsv/verifast` | `0.3.6` | `0.3.7` | patch | [API and usage](../packages/sdk/verifast.md) | Valid typed verification calls and worker protocols remain compatible. Custom module factories and WASM adapters must return the exact documented binary and boolean shapes; coercive network, height, flag, byte, batch, verdict, lifecycle, or disposed-instance values now fail closed. Keep THIRD_PARTY_NOTICES.md and LICENSES/ with every JavaScript and WebAssembly distribution. SDK consumers may retain ^2.1.8 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. | | `@bsv/wallet-helper` | `0.1.8` | `0.1.9` | patch | [API and usage](../packages/helpers/wallet-helper.md) | getAddress now derives with forSelf: true and returns the caller-owned side of the bilateral relationship. Applications that stored or coordinated the previous peer-owned result must regenerate and exchange the corrected address before sending value. Amount must be an integer from 1 through 1,000 and counterparties must be valid public keys. Valid canonical transaction-builder flows remain supported; malformed, ambiguous, or wallet-mutated results now fail closed. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. | | `@bsv/wallet-relay` | `0.5.1` | `0.5.2` | patch | [API and usage](../packages/wallet/wallet-relay.md) | Enable signed QR codes and distribute only HTTPS pairing origins and relay API URLs. Root-relative API paths and loopback HTTP remain supported. Configure onApprovalRequired for every method not deliberately listed in autoApproveMethods; unsigned pairing URIs and implicit approval are no longer accepted. Existing relay sessions, custom RPC method names, and supported wallet RPC byte encodings remain valid, and host applications continue to provide their matching Express runtime and type graph. Version 0.5 defaults to two missed pongs; set maxMissedHeartbeats to 1 to retain the prior heartbeat policy. Heartbeat intervals must fit the Node timer range. Preserve Cache-Control: no-store at proxies, prefer the stable bsv-wallet-relay plus token WebSocket subprotocols over the legacy token query parameter, and configure edge rate limiting in addition to the bounded in-process defaults. The 24-hour connected-session lifetime no longer renews on reconnect, malformed wallet calls fail with code 400, and WalletRelayClient retains at most 100 log entries unless maxLogEntries is configured. The QR remains a short-lived bearer invitation: keep it private and require explicit operation approval. Relay envelopes, cryptographic framing, and wallet RPC encodings remain unchanged. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. | -| `@bsv/wallet-toolbox` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. | -| `@bsv/wallet-toolbox-client` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox-client.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. | -| `@bsv/wallet-toolbox-mobile` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox-mobile.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. | +| `@bsv/wallet-toolbox` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. | +| `@bsv/wallet-toolbox-client` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox-client.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. | +| `@bsv/wallet-toolbox-mobile` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox-mobile.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. | | `create-bsv-app` | `1.1.2` | `1.1.2` | none | [API and usage](../packages/helpers/create-bsv-app.md) | Existing CLI flags, network choices, and generated project structure are unchanged. Regenerate or update dependencies after the patched packages are published. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. | `none` means the source manifest matches the recorded npm baseline. Any other @@ -515,8 +515,8 @@ CLI entry points: `{"wallet-relay":"./bin/init.mjs"}`. - Package documentation: [docs/packages/wallet/wallet-toolbox.md](../packages/wallet/wallet-toolbox.md) - Source: [packages/wallet/wallet-toolbox](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox) -- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. -- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. +- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read). +- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. | Public subpath | Runtime target(s) | Declaration target(s) | | ---------------- | ---------------------------------------------------- | -------------------------- | @@ -529,8 +529,8 @@ CLI entry points: `{"wallet-relay":"./bin/init.mjs"}`. - Package documentation: [docs/packages/wallet/wallet-toolbox-client.md](../packages/wallet/wallet-toolbox-client.md) - Source: [packages/wallet/wallet-toolbox/client](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/client) -- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. -- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. +- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read). +- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. | Public subpath | Runtime target(s) | Declaration target(s) | | ---------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | @@ -541,8 +541,8 @@ CLI entry points: `{"wallet-relay":"./bin/init.mjs"}`. - Package documentation: [docs/packages/wallet/wallet-toolbox-mobile.md](../packages/wallet/wallet-toolbox-mobile.md) - Source: [packages/wallet/wallet-toolbox/mobile](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/mobile) -- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. -- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. +- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read). +- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. | Public subpath | Runtime target(s) | Declaration target(s) | | ---------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | diff --git a/governance/package-release-notes.json b/governance/package-release-notes.json index 18a26d5ee5..93e4d0826c 100644 --- a/governance/package-release-notes.json +++ b/governance/package-release-notes.json @@ -210,22 +210,22 @@ "name": "@bsv/wallet-toolbox", "publishedVersion": "2.14.5", "releaseType": "patch", - "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage.", - "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite." + "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read).", + "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field." }, { "name": "@bsv/wallet-toolbox-client", "publishedVersion": "2.14.5", "releaseType": "patch", - "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage.", - "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite." + "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read).", + "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field." }, { "name": "@bsv/wallet-toolbox-mobile", "publishedVersion": "2.14.5", "releaseType": "patch", - "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage.", - "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite." + "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read).", + "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field." }, { "name": "create-bsv-app", diff --git a/packages/wallet/wallet-toolbox/CHANGELOG.md b/packages/wallet/wallet-toolbox/CHANGELOG.md index eb1946f69c..08983ca51c 100644 --- a/packages/wallet/wallet-toolbox/CHANGELOG.md +++ b/packages/wallet/wallet-toolbox/CHANGELOG.md @@ -6,6 +6,14 @@ attention to changes that materially alter behavior or extend functionality. ## wallet-toolbox 2.14.6 +- Remove unused `WERR_NETWORK_CHAIN` and unused `ProcessSyncChunkResult.error`. + The error class was defined and deserialized but never thrown, and no producer + or consumer of `processSyncChunk` set or read `error`. Cross-chain live sync + is still unguarded; portable BRC-38 import continues to throw a generic + `Error`. Historical JSON with name `WERR_NETWORK_CHAIN` still deserializes as + a generic `WalletError`. No runtime, wire, or database migration is required + unless an application imported the unused class or read the unused field. + - UMP support pins anchor verified update lineage. Password and token updates supersede the pinned predecessor, including multi-hop updates and recovery-hash continuity. Unrelated historical continuations cannot override the anchor. @@ -117,6 +125,14 @@ was not issued by this permissions manager.` ## wallet-toolbox (unreleased) +- Remove unused `WERR_NETWORK_CHAIN` and unused `ProcessSyncChunkResult.error`. + The error class was defined and deserialized but never thrown, and no producer + or consumer of `processSyncChunk` set or read `error`. Cross-chain live sync + is still unguarded; portable BRC-38 import continues to throw a generic + `Error`. Historical JSON with name `WERR_NETWORK_CHAIN` still deserializes as + a generic `WalletError`. No runtime, wire, or database migration is required + unless an application imported the unused class or read the unused field. + - Raise the `@bsv/sdk` peer dependency floor to `^2.8.0` in `@bsv/wallet-toolbox`, `@bsv/wallet-toolbox-client`, and `@bsv/wallet-toolbox-mobile`. Value imports used by the built mobile/client bundles and by internal helpers diff --git a/packages/wallet/wallet-toolbox/docs/client.md b/packages/wallet/wallet-toolbox/docs/client.md index 2bb3949b9f..55734bb996 100644 --- a/packages/wallet/wallet-toolbox/docs/client.md +++ b/packages/wallet/wallet-toolbox/docs/client.md @@ -7065,11 +7065,10 @@ export interface ProcessSyncChunkResult { maxUpdated_at: Date | undefined; updates: number; inserts: number; - error?: WalletError; } ``` -See also: [SyncCheckpoint](./client.md#interface-synccheckpoint), [WalletError](./client.md#class-walleterror) +See also: [SyncCheckpoint](./client.md#interface-synccheckpoint) ###### Property nextCheckpoint @@ -12187,24 +12186,24 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions]( | [CWIStyleWalletManager](#class-cwistylewalletmanager) | [SdkWhatsOnChain](#class-sdkwhatsonchain) | [WERR_INVALID_PARAMETER](#class-werr_invalid_parameter) | | [CanonicalChangeSelector](#class-canonicalchangeselector) | [ServiceCollection](#class-servicecollection) | [WERR_INVALID_PUBLIC_KEY](#class-werr_invalid_public_key) | | [Chaintracks](#class-chaintracks) | [Services](#class-services) | [WERR_MISSING_PARAMETER](#class-werr_missing_parameter) | -| [ChaintracksChainTracker](#class-chaintrackschaintracker) | [SetupClient](#class-setupclient) | [WERR_NETWORK_CHAIN](#class-werr_network_chain) | -| [ChaintracksFetch](#class-chaintracksfetch) | [SimpleWalletManager](#class-simplewalletmanager) | [WERR_NOT_ACTIVE](#class-werr_not_active) | -| [ChaintracksFetchError](#class-chaintracksfetcherror) | [SingleWriterMultiReaderLock](#class-singlewritermultireaderlock) | [WERR_NOT_IMPLEMENTED](#class-werr_not_implemented) | -| [ChaintracksServiceClient](#class-chaintracksserviceclient) | [StaleSyncProofError](#class-stalesyncprooferror) | [WERR_REVIEW_ACTIONS](#class-werr_review_actions) | -| [ChaintracksStorageBase](#class-chaintracksstoragebase) | [StorageClient](#class-storageclient) | [WERR_UNAUTHORIZED](#class-werr_unauthorized) | -| [ChaintracksStorageIdb](#class-chaintracksstorageidb) | [StorageClientBase](#class-storageclientbase) | [WERR_UTXO_REVIEW_INCONCLUSIVE](#class-werr_utxo_review_inconclusive) | -| [ChaintracksStorageNoDb](#class-chaintracksstoragenodb) | [StorageIdb](#class-storageidb) | [Wallet](#class-wallet) | -| [DevConsoleInteractor](#class-devconsoleinteractor) | [StorageProvider](#class-storageprovider) | [WalletAuthenticationManager](#class-walletauthenticationmanager) | -| [EntityBase](#class-entitybase) | [StorageReader](#class-storagereader) | [WalletError](#class-walleterror) | -| [EntityCertificate](#class-entitycertificate) | [StorageReaderWriter](#class-storagereaderwriter) | [WalletLogger](#class-walletlogger) | -| [EntityCertificateField](#class-entitycertificatefield) | [StorageSyncReader](#class-storagesyncreader) | [WalletMonitorTask](#class-walletmonitortask) | -| [EntityCommission](#class-entitycommission) | [SyncPageBudget](#class-syncpagebudget) | [WalletPermissionsManager](#class-walletpermissionsmanager) | -| [EntityOutput](#class-entityoutput) | [TaskArcadeSSE](#class-taskarcadesse) | [WalletSettingsManager](#class-walletsettingsmanager) | -| [EntityOutputBasket](#class-entityoutputbasket) | [TaskCheckForProofs](#class-taskcheckforproofs) | [WalletSigner](#class-walletsigner) | -| [EntityOutputTag](#class-entityoutputtag) | [TaskCheckNoSends](#class-taskchecknosends) | [WalletStorageManager](#class-walletstoragemanager) | -| [EntityOutputTagMap](#class-entityoutputtagmap) | [TaskCleanupActionBatches](#class-taskcleanupactionbatches) | [WhatsOnChain](#class-whatsonchain) | -| [EntityProvenTx](#class-entityproventx) | [TaskClock](#class-taskclock) | [WhatsOnChainNoServices](#class-whatsonchainnoservices) | -| [EntityProvenTxReq](#class-entityproventxreq) | [TaskFailAbandoned](#class-taskfailabandoned) | [WhatsOnChainServices](#class-whatsonchainservices) | +| [ChaintracksChainTracker](#class-chaintrackschaintracker) | [SetupClient](#class-setupclient) | [WERR_NOT_ACTIVE](#class-werr_not_active) | +| [ChaintracksFetch](#class-chaintracksfetch) | [SimpleWalletManager](#class-simplewalletmanager) | [WERR_NOT_IMPLEMENTED](#class-werr_not_implemented) | +| [ChaintracksFetchError](#class-chaintracksfetcherror) | [SingleWriterMultiReaderLock](#class-singlewritermultireaderlock) | [WERR_REVIEW_ACTIONS](#class-werr_review_actions) | +| [ChaintracksServiceClient](#class-chaintracksserviceclient) | [StaleSyncProofError](#class-stalesyncprooferror) | [WERR_UNAUTHORIZED](#class-werr_unauthorized) | +| [ChaintracksStorageBase](#class-chaintracksstoragebase) | [StorageClient](#class-storageclient) | [WERR_UTXO_REVIEW_INCONCLUSIVE](#class-werr_utxo_review_inconclusive) | +| [ChaintracksStorageIdb](#class-chaintracksstorageidb) | [StorageClientBase](#class-storageclientbase) | [Wallet](#class-wallet) | +| [ChaintracksStorageNoDb](#class-chaintracksstoragenodb) | [StorageIdb](#class-storageidb) | [WalletAuthenticationManager](#class-walletauthenticationmanager) | +| [DevConsoleInteractor](#class-devconsoleinteractor) | [StorageProvider](#class-storageprovider) | [WalletError](#class-walleterror) | +| [EntityBase](#class-entitybase) | [StorageReader](#class-storagereader) | [WalletLogger](#class-walletlogger) | +| [EntityCertificate](#class-entitycertificate) | [StorageReaderWriter](#class-storagereaderwriter) | [WalletMonitorTask](#class-walletmonitortask) | +| [EntityCertificateField](#class-entitycertificatefield) | [StorageSyncReader](#class-storagesyncreader) | [WalletPermissionsManager](#class-walletpermissionsmanager) | +| [EntityCommission](#class-entitycommission) | [SyncPageBudget](#class-syncpagebudget) | [WalletSettingsManager](#class-walletsettingsmanager) | +| [EntityOutput](#class-entityoutput) | [TaskArcadeSSE](#class-taskarcadesse) | [WalletSigner](#class-walletsigner) | +| [EntityOutputBasket](#class-entityoutputbasket) | [TaskCheckForProofs](#class-taskcheckforproofs) | [WalletStorageManager](#class-walletstoragemanager) | +| [EntityOutputTag](#class-entityoutputtag) | [TaskCheckNoSends](#class-taskchecknosends) | [WhatsOnChain](#class-whatsonchain) | +| [EntityOutputTagMap](#class-entityoutputtagmap) | [TaskCleanupActionBatches](#class-taskcleanupactionbatches) | [WhatsOnChainNoServices](#class-whatsonchainnoservices) | +| [EntityProvenTx](#class-entityproventx) | [TaskClock](#class-taskclock) | [WhatsOnChainServices](#class-whatsonchainservices) | +| [EntityProvenTxReq](#class-entityproventxreq) | [TaskFailAbandoned](#class-taskfailabandoned) | | | [EntitySyncState](#class-entitysyncstate) | [TaskMineBlock](#class-taskmineblock) | | | [EntityTransaction](#class-entitytransaction) | [TaskMonitorCallHistory](#class-taskmonitorcallhistory) | | @@ -19454,21 +19453,6 @@ See also: [WalletError](./client.md#class-walleterror) Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) ---- -##### Class: WERR_NETWORK_CHAIN - -Configured network chain is invalid or does not match across services. - -```ts -export class WERR_NETWORK_CHAIN extends WalletError { - constructor(message?: string) -} -``` - -See also: [WalletError](./client.md#class-walleterror) - -Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) - --- ##### Class: WERR_NOT_ACTIVE diff --git a/packages/wallet/wallet-toolbox/docs/wallet.md b/packages/wallet/wallet-toolbox/docs/wallet.md index f5ab1d3482..092fd4b98b 100644 --- a/packages/wallet/wallet-toolbox/docs/wallet.md +++ b/packages/wallet/wallet-toolbox/docs/wallet.md @@ -4960,11 +4960,10 @@ export interface ProcessSyncChunkResult { maxUpdated_at: Date | undefined; updates: number; inserts: number; - error?: WalletError; } ``` -See also: [SyncCheckpoint](./client.md#interface-synccheckpoint), [WalletError](./client.md#class-walleterror) +See also: [SyncCheckpoint](./client.md#interface-synccheckpoint) ###### Property nextCheckpoint @@ -8723,20 +8722,20 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions]( | [ChaintracksFetch](#class-chaintracksfetch) | [ServiceCollection](#class-servicecollection) | [WERR_INVALID_PARAMETER](#class-werr_invalid_parameter) | | [ChaintracksFetchError](#class-chaintracksfetcherror) | [Services](#class-services) | [WERR_INVALID_PUBLIC_KEY](#class-werr_invalid_public_key) | | [ChaintracksServiceClient](#class-chaintracksserviceclient) | [SingleWriterMultiReaderLock](#class-singlewritermultireaderlock) | [WERR_MISSING_PARAMETER](#class-werr_missing_parameter) | -| [ChaintracksStorageBase](#class-chaintracksstoragebase) | [StaleSyncProofError](#class-stalesyncprooferror) | [WERR_NETWORK_CHAIN](#class-werr_network_chain) | -| [EntityBase](#class-entitybase) | [StorageProvider](#class-storageprovider) | [WERR_NOT_ACTIVE](#class-werr_not_active) | -| [EntityCertificate](#class-entitycertificate) | [StorageReader](#class-storagereader) | [WERR_NOT_IMPLEMENTED](#class-werr_not_implemented) | -| [EntityCertificateField](#class-entitycertificatefield) | [StorageReaderWriter](#class-storagereaderwriter) | [WERR_REVIEW_ACTIONS](#class-werr_review_actions) | -| [EntityCommission](#class-entitycommission) | [SyncPageBudget](#class-syncpagebudget) | [WERR_UNAUTHORIZED](#class-werr_unauthorized) | -| [EntityOutput](#class-entityoutput) | [TaskArcadeSSE](#class-taskarcadesse) | [WERR_UTXO_REVIEW_INCONCLUSIVE](#class-werr_utxo_review_inconclusive) | -| [EntityOutputBasket](#class-entityoutputbasket) | [TaskCheckForProofs](#class-taskcheckforproofs) | [Wallet](#class-wallet) | -| [EntityOutputTag](#class-entityoutputtag) | [TaskCheckNoSends](#class-taskchecknosends) | [WalletError](#class-walleterror) | -| [EntityOutputTagMap](#class-entityoutputtagmap) | [TaskCleanupActionBatches](#class-taskcleanupactionbatches) | [WalletMonitorTask](#class-walletmonitortask) | -| [EntityProvenTx](#class-entityproventx) | [TaskClock](#class-taskclock) | [WalletSettingsManager](#class-walletsettingsmanager) | -| [EntityProvenTxReq](#class-entityproventxreq) | [TaskFailAbandoned](#class-taskfailabandoned) | [WalletSigner](#class-walletsigner) | -| [EntitySyncState](#class-entitysyncstate) | [TaskMineBlock](#class-taskmineblock) | [WalletStorageManager](#class-walletstoragemanager) | -| [EntityTransaction](#class-entitytransaction) | [TaskMonitorCallHistory](#class-taskmonitorcallhistory) | [WhatsOnChain](#class-whatsonchain) | -| [EntityTxLabel](#class-entitytxlabel) | [TaskNewHeader](#class-tasknewheader) | [WhatsOnChainNoServices](#class-whatsonchainnoservices) | +| [ChaintracksStorageBase](#class-chaintracksstoragebase) | [StaleSyncProofError](#class-stalesyncprooferror) | [WERR_NOT_ACTIVE](#class-werr_not_active) | +| [EntityBase](#class-entitybase) | [StorageProvider](#class-storageprovider) | [WERR_NOT_IMPLEMENTED](#class-werr_not_implemented) | +| [EntityCertificate](#class-entitycertificate) | [StorageReader](#class-storagereader) | [WERR_REVIEW_ACTIONS](#class-werr_review_actions) | +| [EntityCertificateField](#class-entitycertificatefield) | [StorageReaderWriter](#class-storagereaderwriter) | [WERR_UNAUTHORIZED](#class-werr_unauthorized) | +| [EntityCommission](#class-entitycommission) | [SyncPageBudget](#class-syncpagebudget) | [WERR_UTXO_REVIEW_INCONCLUSIVE](#class-werr_utxo_review_inconclusive) | +| [EntityOutput](#class-entityoutput) | [TaskArcadeSSE](#class-taskarcadesse) | [Wallet](#class-wallet) | +| [EntityOutputBasket](#class-entityoutputbasket) | [TaskCheckForProofs](#class-taskcheckforproofs) | [WalletError](#class-walleterror) | +| [EntityOutputTag](#class-entityoutputtag) | [TaskCheckNoSends](#class-taskchecknosends) | [WalletMonitorTask](#class-walletmonitortask) | +| [EntityOutputTagMap](#class-entityoutputtagmap) | [TaskCleanupActionBatches](#class-taskcleanupactionbatches) | [WalletSettingsManager](#class-walletsettingsmanager) | +| [EntityProvenTx](#class-entityproventx) | [TaskClock](#class-taskclock) | [WalletSigner](#class-walletsigner) | +| [EntityProvenTxReq](#class-entityproventxreq) | [TaskFailAbandoned](#class-taskfailabandoned) | [WalletStorageManager](#class-walletstoragemanager) | +| [EntitySyncState](#class-entitysyncstate) | [TaskMineBlock](#class-taskmineblock) | [WhatsOnChain](#class-whatsonchain) | +| [EntityTransaction](#class-entitytransaction) | [TaskMonitorCallHistory](#class-taskmonitorcallhistory) | [WhatsOnChainNoServices](#class-whatsonchainnoservices) | +| [EntityTxLabel](#class-entitytxlabel) | [TaskNewHeader](#class-tasknewheader) | | | [EntityTxLabelMap](#class-entitytxlabelmap) | [TaskNoSendExpiry](#class-tasknosendexpiry) | | | [EntityUser](#class-entityuser) | [TaskPurge](#class-taskpurge) | | @@ -12799,21 +12798,6 @@ See also: [WalletError](./client.md#class-walleterror) Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) ---- -##### Class: WERR_NETWORK_CHAIN - -Configured network chain is invalid or does not match across services. - -```ts -export class WERR_NETWORK_CHAIN extends WalletError { - constructor(message?: string) -} -``` - -See also: [WalletError](./client.md#class-walleterror) - -Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) - --- ##### Class: WERR_NOT_ACTIVE diff --git a/packages/wallet/wallet-toolbox/src/sdk/WERR_errors.ts b/packages/wallet/wallet-toolbox/src/sdk/WERR_errors.ts index dde240bec1..96efe2ce35 100644 --- a/packages/wallet/wallet-toolbox/src/sdk/WERR_errors.ts +++ b/packages/wallet/wallet-toolbox/src/sdk/WERR_errors.ts @@ -168,15 +168,6 @@ export class WERR_BAD_REQUEST extends WalletError { } } -/** - * Configured network chain is invalid or does not match across services. - */ -export class WERR_NETWORK_CHAIN extends WalletError { - constructor(message?: string) { - super('WERR_NETWORK_CHAIN', message ?? 'Configured network chain is invalid or does not match across services.') - } -} - /** * Access is denied due to an authorization error. */ diff --git a/packages/wallet/wallet-toolbox/src/sdk/WalletErrorFromJson.ts b/packages/wallet/wallet-toolbox/src/sdk/WalletErrorFromJson.ts index 88fac31e9a..d3c5cff8ec 100644 --- a/packages/wallet/wallet-toolbox/src/sdk/WalletErrorFromJson.ts +++ b/packages/wallet/wallet-toolbox/src/sdk/WalletErrorFromJson.ts @@ -11,7 +11,6 @@ import { WERR_INVALID_PARAMETER, WERR_INVALID_PUBLIC_KEY, WERR_MISSING_PARAMETER, - WERR_NETWORK_CHAIN, WERR_NOT_ACTIVE, WERR_NOT_IMPLEMENTED, WERR_REVIEW_ACTIONS, @@ -186,9 +185,6 @@ export function WalletErrorFromJson(json: object): WalletError { case 'WERR_BAD_REQUEST': e = new WERR_BAD_REQUEST(obj.message) break - case 'WERR_NETWORK_CHAIN': - e = new WERR_NETWORK_CHAIN(obj.message) - break case 'WERR_UNAUTHORIZED': e = new WERR_UNAUTHORIZED(obj.message) break diff --git a/packages/wallet/wallet-toolbox/src/sdk/WalletStorage.interfaces.ts b/packages/wallet/wallet-toolbox/src/sdk/WalletStorage.interfaces.ts index 646393729d..44fa030514 100644 --- a/packages/wallet/wallet-toolbox/src/sdk/WalletStorage.interfaces.ts +++ b/packages/wallet/wallet-toolbox/src/sdk/WalletStorage.interfaces.ts @@ -37,7 +37,6 @@ import { } from '../storage/schema/tables' import { WalletServices } from './WalletServices.interfaces' import { Chain, Paged, ProvenTxReqStatus, TransactionStatus } from './types' -import { WalletError } from './WalletError' import { AbortActionBatchResult, ActionBatchManifest, @@ -715,7 +714,6 @@ export interface ProcessSyncChunkResult { maxUpdated_at: Date | undefined updates: number inserts: number - error?: WalletError } /** diff --git a/packages/wallet/wallet-toolbox/src/sdk/__test/WalletError.test.ts b/packages/wallet/wallet-toolbox/src/sdk/__test/WalletError.test.ts index 5035b5c603..c9bc683f86 100644 --- a/packages/wallet/wallet-toolbox/src/sdk/__test/WalletError.test.ts +++ b/packages/wallet/wallet-toolbox/src/sdk/__test/WalletError.test.ts @@ -8,7 +8,6 @@ import { WERR_REVIEW_ACTIONS, WERR_INSUFFICIENT_FUNDS, WERR_BROADCAST_UNAVAILABLE, - WERR_NETWORK_CHAIN, WERR_INVALID_OPERATION, WERR_MISSING_PARAMETER, WERR_BAD_REQUEST, @@ -221,13 +220,14 @@ describe('WalletError tests', () => { expect(werr2.message).toBe('Unable to broadcast transaction at this time.') }) - test('6 - WERR_NETWORK_CHAIN test', async () => { - const werr = new WERR_NETWORK_CHAIN('Chain mismatch') + test('6 - retired WERR_NETWORK_CHAIN name still deserializes as WalletError', async () => { + const werr = new WalletError('WERR_NETWORK_CHAIN', 'Chain mismatch') expect(werr.name).toBe('WERR_NETWORK_CHAIN') expect(werr.message).toBe('Chain mismatch') const json = WalletError.unknownToJson(werr) const werr2 = WalletErrorFromJson(JSON.parse(json)) + expect(werr2).toBeInstanceOf(WalletError) expect(werr2.name).toBe('WERR_NETWORK_CHAIN') expect(werr2.message).toBe('Chain mismatch') }) diff --git a/specs/wallet/storage-adapter.yaml b/specs/wallet/storage-adapter.yaml index e0186083f3..542b4c961b 100644 --- a/specs/wallet/storage-adapter.yaml +++ b/specs/wallet/storage-adapter.yaml @@ -1317,8 +1317,6 @@ components: done: type: boolean description: true if no more chunks are needed. - error: - type: string FindOrInsertSyncStateRequest: type: object From b69b8e09f7000da46265ab2cd08552a76ca82389 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 9 Oct 2026 12:05:27 +0000 Subject: [PATCH 2/4] chore(governance): renew wallet manual-suite inventory through 2026-10-16 The 2026-10-08 reviewBy date expired on main and blocks hosted CI. Static re-review confirms the same 30 dispositions; 29 source hashes are unchanged and the remaining suite matches the 2026-10-05 hash. No suite was executed. Co-authored-by: deggen --- .../wallet-manual-review-2026-10-09.md | 81 +++++++++++++++++++ .../wallet-toolbox-manual-suites.json | 4 +- .../wallet-toolbox-suite-disposition.md | 2 +- 3 files changed, 84 insertions(+), 3 deletions(-) create mode 100644 governance/test-quality/wallet-manual-review-2026-10-09.md diff --git a/governance/test-quality/wallet-manual-review-2026-10-09.md b/governance/test-quality/wallet-manual-review-2026-10-09.md new file mode 100644 index 0000000000..8243139ebb --- /dev/null +++ b/governance/test-quality/wallet-manual-review-2026-10-09.md @@ -0,0 +1,81 @@ +# Wallet manual inventory review — 2026-10-09 + +Owner: `ts-stack-maintainers` + +Review by: 2026-10-16 + +Source: `f77d672263a2d5218c787fe64c085a75aa08af78` (current `main`; the reviewed +manual-suite bytes are unchanged in this branch except as recorded below). + +This is a static inventory and disposition review of all 30 wallet +`*.man.test.ts` and `*.live.test.ts` suites. The tracked/discovered set matches +the exact case-insensitive inventory with no missing or duplicate paths. Every +retained suite still has an explicit assertion oracle; the existing extraction +destinations and retain-as-test decisions remain. No suite, assertion, skip, +runtime input, required gate, or execution classification rule is removed. + +No manual, public-network, remote-state, or funded suite was executed for this +review. This record does not establish runtime success, provider readiness, +restored funds, complete #544 qualification, or permission to run those +operations. Existing skipped manual cases remain unexecuted. The next review is +bounded to seven days. + +## What changed since 2026-10-01 + +Of the 30 source hashes recorded in +[wallet-manual-review-2026-10-01.md](./wallet-manual-review-2026-10-01.md), 29 +still match. The remaining suite, +`test/Wallet/action/internalizeAction.a.man.test.ts`, was already reviewed on +2026-10-05: it now conditionally copies a PostgreSQL wallet in addition to MySQL +and SQLite. Its real basket-insertion assertions and storage destruction remain, +and its `funded-state` disposition is retained. Current SHA-256: +`9dffe9d4d652993d53abd1c704b668df6648075a3c5e681a11ab81fb22c08e26`. + +The four funded-state description corrections from 2026-10-01 remain. No further +side-effect or purpose edits are required. + +## Exact reviewed source inventory + +Paths are relative to `packages/wallet/wallet-toolbox/`. SHA-256 binds the +reviewed bytes without copying credentials, transaction fixtures, or replay +payloads. + +| Suite | Side effects | SHA-256 | +| --------------------------------------------------------------------------------------- | ------------------ | ------------------------------------------------------------------ | +| `src/services/__tests/ARC.man.test.ts` | `funded-state` | `651ae1bf5c018cf136a421465df458ff078492e5ffa05fa4a6468bfecc9d60ba` | +| `src/services/__tests/ARC.timeout.man.test.ts` | `public-network` | `6bb23b55eef1b44a3ec5cecc6e98271c9cd71d61d373a8ad2987a4c9001fc4f9` | +| `src/services/__tests/ArcGorillaPool.man.test.ts` | `funded-state` | `389fb06ebc0d0e2988599903087f1a9b2ad678f37c6e0506a09861a105412a49` | +| `src/services/__tests/Arcade.man.test.ts` | `public-network` | `53dabf49dc9b52f168ba9c75b79417d73a260f7ea67d8832d4d673fa8a88db0d` | +| `src/services/__tests/ArcadeMainnet.man.test.ts` | `funded-state` | `2353db932b9141dbb5a14b9a1f52ab70fcddaef1684b7ad00983d2f3fc1ccea8` | +| `src/services/__tests/ArcadeProof.man.test.ts` | `public-network` | `5060ad7c87b210b04b8607317d4c2020f40351753c989490608dbed5495f33ad` | +| `src/services/__tests/StorageE2E.man.test.ts` | `funded-state` | `f91208b3847e89af15eb015892b38caccc07c8a71c72536c6fb143c80a8c7a4c` | +| `src/services/__tests/postBeef.man.test.ts` | `funded-state` | `cb31d8c772003d0c456812b6a9a00ce842d3c99cdc7bfb61782b0a789dccf22e` | +| `src/services/chaintracker/chaintracks/Ingest/__tests/WhatsOnChainServices.man.test.ts` | `public-network` | `5bf9f5a89c9dd211cb5b7067cfe9cbdb21ce01171c36520f174836547cb30251` | +| `src/services/chaintracker/chaintracks/__tests/Chaintracks.man.test.ts` | `public-network` | `edd7ea29579208caedaaa485455e6c2950dd2b535c8f670769a656d90a0a7ed9` | +| `src/services/chaintracker/chaintracks/util/__tests/ChaintracksFetch.man.test.ts` | `public-network` | `2678082fc38c5b50d18a610665d42d2701a1fdd71210df56416db732042ba985` | +| `src/services/providers/__tests/WhatsOnChain.man.test.ts` | `public-network` | `0ee5133324f2efb3ab8daeaf71b58b50fb50d90850e92432f7f9156c828913f6` | +| `src/storage/__test/adminStats.man.test.ts` | `read-only-remote` | `d3ad0c5a9848c6b149afa0c1622c8f669781e09a30d43e46803dec152f736eaa` | +| `src/storage/remoting/__test/StorageClient.man.test.ts` | `funded-state` | `8a62b93ed38dc695cf823e43790e3f2f485338bf1b6e8dd5db4d8f6778916824` | +| `src/wab-client/__tests/WABClient.man.test.ts` | `funded-state` | `147e0ff852c83e44279266f96f26031279ea89e1545c3cf74fc6518130099476` | +| `test/Wallet/StorageClient/storageClient.man.test.ts` | `remote-state` | `b636029a0a70b4bf88e15a89dc45d95a378e1d7c2b7dc58ded77a742da2659a2` | +| `test/wallet/action/createActionToGenerateBeefs.man.test.ts` | `funded-state` | `8f5629079a37335fedd03303bc001d9d52e1ac6bca9b05ff16c0a449b0e775d3` | +| `test/Wallet/action/internalizeAction.a.man.test.ts` | `funded-state` | `9dffe9d4d652993d53abd1c704b668df6648075a3c5e681a11ab81fb22c08e26` | +| `test/Wallet/certificate/acquireCertificate.man.test.ts` | `remote-state` | `ec07917964ec8d0c3b706f7b3ebe637d6d7874e41f70a94082dbbd4b8dc9a698` | +| `test/Wallet/live/walletLive.man.test.ts` | `funded-state` | `16b13b9683460cd6eef44b1362778b5a91c155f6046e52bb6d8cd7f01f67eb1b` | +| `test/Wallet/local/localWallet.man.test.ts` | `funded-state` | `c4562e5319edb63933d6dd3c86e9300eac6dd6f0e8f224c24e7f10cc4acc9090` | +| `test/Wallet/local/localWallet2.man.test.ts` | `funded-state` | `a8dccb910a93c4f010655877f2b4d765cf9de663263fbdc9a7ecdd96af08ae83` | +| `test/Wallet/signAction/mountaintop.man.test.ts` | `funded-state` | `caff05a77fce77ede7567e3e3949ffae7a2fab3ee74466cd048db1adfe4e13f4` | +| `test/Wallet/specOps/specOps.man.test.ts` | `remote-state` | `fb132ce9e7e92904f67e33ff760e54dc1498846eff4923ccf083e65d87d7911a` | +| `test/WalletClient/LocalKVStore.man.test.ts` | `funded-state` | `ab65d322ae9a2e32c6367116da38d3240f4f45ec9864299c5a471aaaeb44013b` | +| `test/WalletClient/WERR.man.test.ts` | `remote-state` | `d64e2164e87d0cdb1339dac516cf8d9c703b784e12e4364d0c69ec6e781512a4` | +| `test/WalletClient/staging.auth.man.test.ts` | `remote-state` | `b86a0891ed7a6bd1fe3ce9805370bd5afea32f25a123530f3bd78d1ebc58cd2b` | +| `test/examples/backup.man.test.ts` | `local-artifact` | `273fdc5044979c1f0e56d311c9198b832ccafb7757c8e63d73055b7e84dc8583` | +| `test/services/Services.man.test.ts` | `public-network` | `5b01e9d638d4116ef7a5267d888a760a28592381dd814f5d0e1fb865edd78cbb` | +| `src/services/chaintracker/chaintracks/__tests/GoChaintracksServiceClient.live.test.ts` | `public-network` | `bf4b4582d8e8496e056aa8eaaf82ea9687f835341c1ca500ccd0e843cd5e1b49` | + +Review totals: 14 funded-state, 1 local-artifact, 9 public-network, 1 +read-only-remote, 5 remote-state. + +Real-date `node scripts/test-governance.mjs` now reports the same 30 exact +wallet dispositions. This renewal does not authorize public-network, funded, or +manual execution, merge, package publication, or deployment. diff --git a/governance/test-quality/wallet-toolbox-manual-suites.json b/governance/test-quality/wallet-toolbox-manual-suites.json index 6b789f5d4d..8b3d6b08b7 100644 --- a/governance/test-quality/wallet-toolbox-manual-suites.json +++ b/governance/test-quality/wallet-toolbox-manual-suites.json @@ -1,8 +1,8 @@ { "schemaVersion": 1, - "lastReviewed": "2026-10-01", + "lastReviewed": "2026-10-09", "owner": "ts-stack-maintainers", - "reviewBy": "2026-10-08", + "reviewBy": "2026-10-16", "suites": [ { "path": "packages/wallet/wallet-toolbox/src/services/__tests/ARC.man.test.ts", diff --git a/governance/test-quality/wallet-toolbox-suite-disposition.md b/governance/test-quality/wallet-toolbox-suite-disposition.md index 7940acf780..716e8a27fe 100644 --- a/governance/test-quality/wallet-toolbox-suite-disposition.md +++ b/governance/test-quality/wallet-toolbox-suite-disposition.md @@ -1,7 +1,7 @@ # Wallet Toolbox manual-suite disposition Extraction reviewed: 2026-08-30 -Inventory reviewed: [2026-10-01](./wallet-manual-review-2026-10-01.md) +Inventory reviewed: [2026-10-09](./wallet-manual-review-2026-10-09.md) Owner: `ts-stack-maintainers` This ledger records the manual-suite review that separates executable tests From fb06a7a77f5c145fc271a8f751246282b1b5cae7 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 9 Oct 2026 13:16:07 +0000 Subject: [PATCH 3/4] fix(wallet-toolbox): wire live-sync chain preflight and ProcessSyncChunkResult.error Keep WERR_NETWORK_CHAIN and ProcessSyncChunkResult.error as public surfaces. Compare reader/writer TableSettings.chain before any live-sync chunk moves and throw WERR_NETWORK_CHAIN on mismatch. Honor a custom writer's ProcessSyncChunkResult.error by throwing it and stopping the loop. First-party providers still throw. Addresses #541 and #542 without an API deletion. Co-authored-by: deggen --- docs/reference/package-api-migrations.md | 18 ++--- governance/package-release-notes.json | 12 ++-- packages/wallet/wallet-toolbox/CHANGELOG.md | 22 ++---- packages/wallet/wallet-toolbox/docs/client.md | 70 ++++++++++++++----- packages/wallet/wallet-toolbox/docs/wallet.md | 62 ++++++++++++---- .../wallet-toolbox/src/sdk/WERR_errors.ts | 13 ++++ .../src/sdk/WalletErrorFromJson.ts | 4 ++ .../src/sdk/WalletStorage.interfaces.ts | 13 ++++ .../src/sdk/__test/WalletError.test.ts | 8 ++- .../src/storage/WalletStorageManager.ts | 5 ++ .../src/storage/sync/liveSyncGuards.test.ts | 55 +++++++++++++++ .../src/storage/sync/liveSyncGuards.ts | 23 ++++++ .../src/storage/sync/liveSyncManager.test.ts | 65 +++++++++++++++++ specs/wallet/storage-adapter.yaml | 3 + 14 files changed, 306 insertions(+), 67 deletions(-) create mode 100644 packages/wallet/wallet-toolbox/src/storage/sync/liveSyncGuards.test.ts create mode 100644 packages/wallet/wallet-toolbox/src/storage/sync/liveSyncGuards.ts create mode 100644 packages/wallet/wallet-toolbox/src/storage/sync/liveSyncManager.test.ts diff --git a/docs/reference/package-api-migrations.md b/docs/reference/package-api-migrations.md index cb78e0edc9..b25b752796 100644 --- a/docs/reference/package-api-migrations.md +++ b/docs/reference/package-api-migrations.md @@ -54,9 +54,9 @@ and clean-consumer tests remain the executable type authority. | `@bsv/verifast` | `0.3.6` | `0.3.7` | patch | [API and usage](../packages/sdk/verifast.md) | Valid typed verification calls and worker protocols remain compatible. Custom module factories and WASM adapters must return the exact documented binary and boolean shapes; coercive network, height, flag, byte, batch, verdict, lifecycle, or disposed-instance values now fail closed. Keep THIRD_PARTY_NOTICES.md and LICENSES/ with every JavaScript and WebAssembly distribution. SDK consumers may retain ^2.1.8 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. | | `@bsv/wallet-helper` | `0.1.8` | `0.1.9` | patch | [API and usage](../packages/helpers/wallet-helper.md) | getAddress now derives with forSelf: true and returns the caller-owned side of the bilateral relationship. Applications that stored or coordinated the previous peer-owned result must regenerate and exchange the corrected address before sending value. Amount must be an integer from 1 through 1,000 and counterparties must be valid public keys. Valid canonical transaction-builder flows remain supported; malformed, ambiguous, or wallet-mutated results now fail closed. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. SDK consumers may retain ^2.1.6 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. | | `@bsv/wallet-relay` | `0.5.1` | `0.5.2` | patch | [API and usage](../packages/wallet/wallet-relay.md) | Enable signed QR codes and distribute only HTTPS pairing origins and relay API URLs. Root-relative API paths and loopback HTTP remain supported. Configure onApprovalRequired for every method not deliberately listed in autoApproveMethods; unsigned pairing URIs and implicit approval are no longer accepted. Existing relay sessions, custom RPC method names, and supported wallet RPC byte encodings remain valid, and host applications continue to provide their matching Express runtime and type graph. Version 0.5 defaults to two missed pongs; set maxMissedHeartbeats to 1 to retain the prior heartbeat policy. Heartbeat intervals must fit the Node timer range. Preserve Cache-Control: no-store at proxies, prefer the stable bsv-wallet-relay plus token WebSocket subprotocols over the legacy token query parameter, and configure edge rate limiting in addition to the bounded in-process defaults. The 24-hour connected-session lifetime no longer renews on reconnect, malformed wallet calls fail with code 400, and WalletRelayClient retains at most 100 log entries unless maxLogEntries is configured. The QR remains a short-lived bearer invitation: keep it private and require explicit operation approval. Relay envelopes, cryptographic framing, and wallet RPC encodings remain unchanged. SDK consumers may retain ^2.4.1 or install the proposed SDK3 candidate. The immutable SDK2.8.11 reference has nine pre-existing SDK cold-leaf/UMD import defects; all historical floor versions are not qualified by this matrix. SDK3 removes the obsolete DID token API; use the identity-key DID and optional BRC52 adapters described in docs/guides/identity-did-vc-migration.md. No other public API or wire migration is introduced by the peer alternative. | -| `@bsv/wallet-toolbox` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. | -| `@bsv/wallet-toolbox-client` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox-client.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. | -| `@bsv/wallet-toolbox-mobile` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox-mobile.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. | +| `@bsv/wallet-toolbox` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No additional consumer migration. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. | +| `@bsv/wallet-toolbox-client` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox-client.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No additional consumer migration. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. | +| `@bsv/wallet-toolbox-mobile` | `2.14.5` | `2.14.6` | patch | [API and usage](../packages/wallet/wallet-toolbox-mobile.md) | No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No additional consumer migration. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. | | `create-bsv-app` | `1.1.2` | `1.1.2` | none | [API and usage](../packages/helpers/create-bsv-app.md) | Existing CLI flags, network choices, and generated project structure are unchanged. Regenerate or update dependencies after the patched packages are published. Distributors must retain THIRD_PARTY_NOTICES.md and LICENSES/ with the package. | `none` means the source manifest matches the recorded npm baseline. Any other @@ -515,8 +515,8 @@ CLI entry points: `{"wallet-relay":"./bin/init.mjs"}`. - Package documentation: [docs/packages/wallet/wallet-toolbox.md](../packages/wallet/wallet-toolbox.md) - Source: [packages/wallet/wallet-toolbox](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox) -- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read). -- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. +- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Live syncToWriter/syncFromReader throw WERR_NETWORK_CHAIN when reader and writer TableSettings.chain differ, before any chunk moves. Custom processSyncChunk writers may set ProcessSyncChunkResult.error; both live-sync loops throw that error and stop. First-party providers still throw. Public exports and JSON round-trip remain. +- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No additional consumer migration. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. | Public subpath | Runtime target(s) | Declaration target(s) | | ---------------- | ---------------------------------------------------- | -------------------------- | @@ -529,8 +529,8 @@ CLI entry points: `{"wallet-relay":"./bin/init.mjs"}`. - Package documentation: [docs/packages/wallet/wallet-toolbox-client.md](../packages/wallet/wallet-toolbox-client.md) - Source: [packages/wallet/wallet-toolbox/client](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/client) -- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read). -- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. +- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Live syncToWriter/syncFromReader throw WERR_NETWORK_CHAIN when reader and writer TableSettings.chain differ, before any chunk moves. Custom processSyncChunk writers may set ProcessSyncChunkResult.error; both live-sync loops throw that error and stop. First-party providers still throw. Public exports and JSON round-trip remain. +- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No additional consumer migration. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. | Public subpath | Runtime target(s) | Declaration target(s) | | ---------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | @@ -541,8 +541,8 @@ CLI entry points: `{"wallet-relay":"./bin/init.mjs"}`. - Package documentation: [docs/packages/wallet/wallet-toolbox-mobile.md](../packages/wallet/wallet-toolbox-mobile.md) - Source: [packages/wallet/wallet-toolbox/mobile](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/mobile) -- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read). -- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field. +- Release note: WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Live syncToWriter/syncFromReader throw WERR_NETWORK_CHAIN when reader and writer TableSettings.chain differ, before any chunk moves. Custom processSyncChunk writers may set ProcessSyncChunkResult.error; both live-sync loops throw that error and stop. First-party providers still throw. Public exports and JSON round-trip remain. +- Migration: No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No additional consumer migration. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk. | Public subpath | Runtime target(s) | Declaration target(s) | | ---------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | diff --git a/governance/package-release-notes.json b/governance/package-release-notes.json index 93e4d0826c..4d82425897 100644 --- a/governance/package-release-notes.json +++ b/governance/package-release-notes.json @@ -210,22 +210,22 @@ "name": "@bsv/wallet-toolbox", "publishedVersion": "2.14.5", "releaseType": "patch", - "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read).", - "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field." + "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Live syncToWriter/syncFromReader throw WERR_NETWORK_CHAIN when reader and writer TableSettings.chain differ, before any chunk moves. Custom processSyncChunk writers may set ProcessSyncChunkResult.error; both live-sync loops throw that error and stop. First-party providers still throw. Public exports and JSON round-trip remain.", + "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No additional consumer migration. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk." }, { "name": "@bsv/wallet-toolbox-client", "publishedVersion": "2.14.5", "releaseType": "patch", - "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read).", - "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field." + "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Live syncToWriter/syncFromReader throw WERR_NETWORK_CHAIN when reader and writer TableSettings.chain differ, before any chunk moves. Custom processSyncChunk writers may set ProcessSyncChunkResult.error; both live-sync loops throw that error and stop. First-party providers still throw. Public exports and JSON round-trip remain.", + "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No additional consumer migration. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk." }, { "name": "@bsv/wallet-toolbox-mobile", "publishedVersion": "2.14.5", "releaseType": "patch", - "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Removes unused WERR_NETWORK_CHAIN (never thrown) and unused ProcessSyncChunkResult.error (never set or read).", - "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. Stop importing WERR_NETWORK_CHAIN; before: import { WERR_NETWORK_CHAIN } from the wallet-toolbox package and e instanceof WERR_NETWORK_CHAIN. After: omit the unused class. WalletErrorFromJson still reconstructs JSON with that name as a generic WalletError. Stop reading ProcessSyncChunkResult.error; before: if (result.error) .... After: processSyncChunk throws on failure and does not return an error field." + "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. Live syncToWriter/syncFromReader throw WERR_NETWORK_CHAIN when reader and writer TableSettings.chain differ, before any chunk moves. Custom processSyncChunk writers may set ProcessSyncChunkResult.error; both live-sync loops throw that error and stop. First-party providers still throw. Public exports and JSON round-trip remain.", + "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No additional consumer migration. Live sync now throws WERR_NETWORK_CHAIN on a reader/writer chain mismatch. Custom writers that populate ProcessSyncChunkResult.error are observed: WalletStorageManager throws that error and does not re-request the same chunk." }, { "name": "create-bsv-app", diff --git a/packages/wallet/wallet-toolbox/CHANGELOG.md b/packages/wallet/wallet-toolbox/CHANGELOG.md index 08983ca51c..05ef563b3b 100644 --- a/packages/wallet/wallet-toolbox/CHANGELOG.md +++ b/packages/wallet/wallet-toolbox/CHANGELOG.md @@ -6,13 +6,13 @@ attention to changes that materially alter behavior or extend functionality. ## wallet-toolbox 2.14.6 -- Remove unused `WERR_NETWORK_CHAIN` and unused `ProcessSyncChunkResult.error`. - The error class was defined and deserialized but never thrown, and no producer - or consumer of `processSyncChunk` set or read `error`. Cross-chain live sync - is still unguarded; portable BRC-38 import continues to throw a generic - `Error`. Historical JSON with name `WERR_NETWORK_CHAIN` still deserializes as - a generic `WalletError`. No runtime, wire, or database migration is required - unless an application imported the unused class or read the unused field. +- Live `syncToWriter` / `syncFromReader` compare reader and writer + `TableSettings.chain` before any chunk moves and throw `WERR_NETWORK_CHAIN` + on mismatch. The class remains a public sdk export with its deserializer and + JSON round-trip. Portable BRC-38 import still throws a generic `Error`. + Custom `processSyncChunk` writers may set `ProcessSyncChunkResult.error`; + both live-sync loops throw that error and stop. First-party providers still + throw. No API or schema migration is required. - UMP support pins anchor verified update lineage. Password and token updates supersede the pinned predecessor, including multi-hop updates and recovery-hash @@ -125,14 +125,6 @@ was not issued by this permissions manager.` ## wallet-toolbox (unreleased) -- Remove unused `WERR_NETWORK_CHAIN` and unused `ProcessSyncChunkResult.error`. - The error class was defined and deserialized but never thrown, and no producer - or consumer of `processSyncChunk` set or read `error`. Cross-chain live sync - is still unguarded; portable BRC-38 import continues to throw a generic - `Error`. Historical JSON with name `WERR_NETWORK_CHAIN` still deserializes as - a generic `WalletError`. No runtime, wire, or database migration is required - unless an application imported the unused class or read the unused field. - - Raise the `@bsv/sdk` peer dependency floor to `^2.8.0` in `@bsv/wallet-toolbox`, `@bsv/wallet-toolbox-client`, and `@bsv/wallet-toolbox-mobile`. Value imports used by the built mobile/client bundles and by internal helpers diff --git a/packages/wallet/wallet-toolbox/docs/client.md b/packages/wallet/wallet-toolbox/docs/client.md index 55734bb996..515ee36d17 100644 --- a/packages/wallet/wallet-toolbox/docs/client.md +++ b/packages/wallet/wallet-toolbox/docs/client.md @@ -7065,10 +7065,11 @@ export interface ProcessSyncChunkResult { maxUpdated_at: Date | undefined; updates: number; inserts: number; + error?: WalletError; } ``` -See also: [SyncCheckpoint](./client.md#interface-synccheckpoint) +See also: [SyncCheckpoint](./client.md#interface-synccheckpoint), [WalletError](./client.md#class-walleterror) ###### Property nextCheckpoint @@ -7079,6 +7080,18 @@ nextCheckpoint?: SyncCheckpoint ``` See also: [SyncCheckpoint](./client.md#interface-synccheckpoint) +###### Property error + +Optional non-throwing failure from a custom writer. First-party +`StorageProvider` implementations throw instead of setting this field. +`WalletStorageManager.syncToWriter` and `syncFromReader` throw `error` +immediately and do not request another chunk. + +```ts +error?: WalletError +``` +See also: [WalletError](./client.md#class-walleterror) + Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) --- @@ -12186,24 +12199,24 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions]( | [CWIStyleWalletManager](#class-cwistylewalletmanager) | [SdkWhatsOnChain](#class-sdkwhatsonchain) | [WERR_INVALID_PARAMETER](#class-werr_invalid_parameter) | | [CanonicalChangeSelector](#class-canonicalchangeselector) | [ServiceCollection](#class-servicecollection) | [WERR_INVALID_PUBLIC_KEY](#class-werr_invalid_public_key) | | [Chaintracks](#class-chaintracks) | [Services](#class-services) | [WERR_MISSING_PARAMETER](#class-werr_missing_parameter) | -| [ChaintracksChainTracker](#class-chaintrackschaintracker) | [SetupClient](#class-setupclient) | [WERR_NOT_ACTIVE](#class-werr_not_active) | -| [ChaintracksFetch](#class-chaintracksfetch) | [SimpleWalletManager](#class-simplewalletmanager) | [WERR_NOT_IMPLEMENTED](#class-werr_not_implemented) | -| [ChaintracksFetchError](#class-chaintracksfetcherror) | [SingleWriterMultiReaderLock](#class-singlewritermultireaderlock) | [WERR_REVIEW_ACTIONS](#class-werr_review_actions) | -| [ChaintracksServiceClient](#class-chaintracksserviceclient) | [StaleSyncProofError](#class-stalesyncprooferror) | [WERR_UNAUTHORIZED](#class-werr_unauthorized) | -| [ChaintracksStorageBase](#class-chaintracksstoragebase) | [StorageClient](#class-storageclient) | [WERR_UTXO_REVIEW_INCONCLUSIVE](#class-werr_utxo_review_inconclusive) | -| [ChaintracksStorageIdb](#class-chaintracksstorageidb) | [StorageClientBase](#class-storageclientbase) | [Wallet](#class-wallet) | -| [ChaintracksStorageNoDb](#class-chaintracksstoragenodb) | [StorageIdb](#class-storageidb) | [WalletAuthenticationManager](#class-walletauthenticationmanager) | -| [DevConsoleInteractor](#class-devconsoleinteractor) | [StorageProvider](#class-storageprovider) | [WalletError](#class-walleterror) | -| [EntityBase](#class-entitybase) | [StorageReader](#class-storagereader) | [WalletLogger](#class-walletlogger) | -| [EntityCertificate](#class-entitycertificate) | [StorageReaderWriter](#class-storagereaderwriter) | [WalletMonitorTask](#class-walletmonitortask) | -| [EntityCertificateField](#class-entitycertificatefield) | [StorageSyncReader](#class-storagesyncreader) | [WalletPermissionsManager](#class-walletpermissionsmanager) | -| [EntityCommission](#class-entitycommission) | [SyncPageBudget](#class-syncpagebudget) | [WalletSettingsManager](#class-walletsettingsmanager) | -| [EntityOutput](#class-entityoutput) | [TaskArcadeSSE](#class-taskarcadesse) | [WalletSigner](#class-walletsigner) | -| [EntityOutputBasket](#class-entityoutputbasket) | [TaskCheckForProofs](#class-taskcheckforproofs) | [WalletStorageManager](#class-walletstoragemanager) | -| [EntityOutputTag](#class-entityoutputtag) | [TaskCheckNoSends](#class-taskchecknosends) | [WhatsOnChain](#class-whatsonchain) | -| [EntityOutputTagMap](#class-entityoutputtagmap) | [TaskCleanupActionBatches](#class-taskcleanupactionbatches) | [WhatsOnChainNoServices](#class-whatsonchainnoservices) | -| [EntityProvenTx](#class-entityproventx) | [TaskClock](#class-taskclock) | [WhatsOnChainServices](#class-whatsonchainservices) | -| [EntityProvenTxReq](#class-entityproventxreq) | [TaskFailAbandoned](#class-taskfailabandoned) | | +| [ChaintracksChainTracker](#class-chaintrackschaintracker) | [SetupClient](#class-setupclient) | [WERR_NETWORK_CHAIN](#class-werr_network_chain) | +| [ChaintracksFetch](#class-chaintracksfetch) | [SimpleWalletManager](#class-simplewalletmanager) | [WERR_NOT_ACTIVE](#class-werr_not_active) | +| [ChaintracksFetchError](#class-chaintracksfetcherror) | [SingleWriterMultiReaderLock](#class-singlewritermultireaderlock) | [WERR_NOT_IMPLEMENTED](#class-werr_not_implemented) | +| [ChaintracksServiceClient](#class-chaintracksserviceclient) | [StaleSyncProofError](#class-stalesyncprooferror) | [WERR_REVIEW_ACTIONS](#class-werr_review_actions) | +| [ChaintracksStorageBase](#class-chaintracksstoragebase) | [StorageClient](#class-storageclient) | [WERR_UNAUTHORIZED](#class-werr_unauthorized) | +| [ChaintracksStorageIdb](#class-chaintracksstorageidb) | [StorageClientBase](#class-storageclientbase) | [WERR_UTXO_REVIEW_INCONCLUSIVE](#class-werr_utxo_review_inconclusive) | +| [ChaintracksStorageNoDb](#class-chaintracksstoragenodb) | [StorageIdb](#class-storageidb) | [Wallet](#class-wallet) | +| [DevConsoleInteractor](#class-devconsoleinteractor) | [StorageProvider](#class-storageprovider) | [WalletAuthenticationManager](#class-walletauthenticationmanager) | +| [EntityBase](#class-entitybase) | [StorageReader](#class-storagereader) | [WalletError](#class-walleterror) | +| [EntityCertificate](#class-entitycertificate) | [StorageReaderWriter](#class-storagereaderwriter) | [WalletLogger](#class-walletlogger) | +| [EntityCertificateField](#class-entitycertificatefield) | [StorageSyncReader](#class-storagesyncreader) | [WalletMonitorTask](#class-walletmonitortask) | +| [EntityCommission](#class-entitycommission) | [SyncPageBudget](#class-syncpagebudget) | [WalletPermissionsManager](#class-walletpermissionsmanager) | +| [EntityOutput](#class-entityoutput) | [TaskArcadeSSE](#class-taskarcadesse) | [WalletSettingsManager](#class-walletsettingsmanager) | +| [EntityOutputBasket](#class-entityoutputbasket) | [TaskCheckForProofs](#class-taskcheckforproofs) | [WalletSigner](#class-walletsigner) | +| [EntityOutputTag](#class-entityoutputtag) | [TaskCheckNoSends](#class-taskchecknosends) | [WalletStorageManager](#class-walletstoragemanager) | +| [EntityOutputTagMap](#class-entityoutputtagmap) | [TaskCleanupActionBatches](#class-taskcleanupactionbatches) | [WhatsOnChain](#class-whatsonchain) | +| [EntityProvenTx](#class-entityproventx) | [TaskClock](#class-taskclock) | [WhatsOnChainNoServices](#class-whatsonchainnoservices) | +| [EntityProvenTxReq](#class-entityproventxreq) | [TaskFailAbandoned](#class-taskfailabandoned) | [WhatsOnChainServices](#class-whatsonchainservices) | | [EntitySyncState](#class-entitysyncstate) | [TaskMineBlock](#class-taskmineblock) | | | [EntityTransaction](#class-entitytransaction) | [TaskMonitorCallHistory](#class-taskmonitorcallhistory) | | @@ -19453,6 +19466,25 @@ See also: [WalletError](./client.md#class-walleterror) Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) +--- +##### Class: WERR_NETWORK_CHAIN + +Configured network chain is invalid or does not match across services. + +Live `WalletStorageManager.syncToWriter` and `syncFromReader` throw this +before any sync chunk moves when the reader and writer `TableSettings.chain` +values differ. + +```ts +export class WERR_NETWORK_CHAIN extends WalletError { + constructor(message?: string) +} +``` + +See also: [WalletError](./client.md#class-walleterror) + +Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) + --- ##### Class: WERR_NOT_ACTIVE diff --git a/packages/wallet/wallet-toolbox/docs/wallet.md b/packages/wallet/wallet-toolbox/docs/wallet.md index 092fd4b98b..9cf0e904b1 100644 --- a/packages/wallet/wallet-toolbox/docs/wallet.md +++ b/packages/wallet/wallet-toolbox/docs/wallet.md @@ -4960,10 +4960,11 @@ export interface ProcessSyncChunkResult { maxUpdated_at: Date | undefined; updates: number; inserts: number; + error?: WalletError; } ``` -See also: [SyncCheckpoint](./client.md#interface-synccheckpoint) +See also: [SyncCheckpoint](./client.md#interface-synccheckpoint), [WalletError](./client.md#class-walleterror) ###### Property nextCheckpoint @@ -4974,6 +4975,18 @@ nextCheckpoint?: SyncCheckpoint ``` See also: [SyncCheckpoint](./client.md#interface-synccheckpoint) +###### Property error + +Optional non-throwing failure from a custom writer. First-party +`StorageProvider` implementations throw instead of setting this field. +`WalletStorageManager.syncToWriter` and `syncFromReader` throw `error` +immediately and do not request another chunk. + +```ts +error?: WalletError +``` +See also: [WalletError](./client.md#class-walleterror) + Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) --- @@ -8722,20 +8735,20 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions]( | [ChaintracksFetch](#class-chaintracksfetch) | [ServiceCollection](#class-servicecollection) | [WERR_INVALID_PARAMETER](#class-werr_invalid_parameter) | | [ChaintracksFetchError](#class-chaintracksfetcherror) | [Services](#class-services) | [WERR_INVALID_PUBLIC_KEY](#class-werr_invalid_public_key) | | [ChaintracksServiceClient](#class-chaintracksserviceclient) | [SingleWriterMultiReaderLock](#class-singlewritermultireaderlock) | [WERR_MISSING_PARAMETER](#class-werr_missing_parameter) | -| [ChaintracksStorageBase](#class-chaintracksstoragebase) | [StaleSyncProofError](#class-stalesyncprooferror) | [WERR_NOT_ACTIVE](#class-werr_not_active) | -| [EntityBase](#class-entitybase) | [StorageProvider](#class-storageprovider) | [WERR_NOT_IMPLEMENTED](#class-werr_not_implemented) | -| [EntityCertificate](#class-entitycertificate) | [StorageReader](#class-storagereader) | [WERR_REVIEW_ACTIONS](#class-werr_review_actions) | -| [EntityCertificateField](#class-entitycertificatefield) | [StorageReaderWriter](#class-storagereaderwriter) | [WERR_UNAUTHORIZED](#class-werr_unauthorized) | -| [EntityCommission](#class-entitycommission) | [SyncPageBudget](#class-syncpagebudget) | [WERR_UTXO_REVIEW_INCONCLUSIVE](#class-werr_utxo_review_inconclusive) | -| [EntityOutput](#class-entityoutput) | [TaskArcadeSSE](#class-taskarcadesse) | [Wallet](#class-wallet) | -| [EntityOutputBasket](#class-entityoutputbasket) | [TaskCheckForProofs](#class-taskcheckforproofs) | [WalletError](#class-walleterror) | -| [EntityOutputTag](#class-entityoutputtag) | [TaskCheckNoSends](#class-taskchecknosends) | [WalletMonitorTask](#class-walletmonitortask) | -| [EntityOutputTagMap](#class-entityoutputtagmap) | [TaskCleanupActionBatches](#class-taskcleanupactionbatches) | [WalletSettingsManager](#class-walletsettingsmanager) | -| [EntityProvenTx](#class-entityproventx) | [TaskClock](#class-taskclock) | [WalletSigner](#class-walletsigner) | -| [EntityProvenTxReq](#class-entityproventxreq) | [TaskFailAbandoned](#class-taskfailabandoned) | [WalletStorageManager](#class-walletstoragemanager) | -| [EntitySyncState](#class-entitysyncstate) | [TaskMineBlock](#class-taskmineblock) | [WhatsOnChain](#class-whatsonchain) | -| [EntityTransaction](#class-entitytransaction) | [TaskMonitorCallHistory](#class-taskmonitorcallhistory) | [WhatsOnChainNoServices](#class-whatsonchainnoservices) | -| [EntityTxLabel](#class-entitytxlabel) | [TaskNewHeader](#class-tasknewheader) | | +| [ChaintracksStorageBase](#class-chaintracksstoragebase) | [StaleSyncProofError](#class-stalesyncprooferror) | [WERR_NETWORK_CHAIN](#class-werr_network_chain) | +| [EntityBase](#class-entitybase) | [StorageProvider](#class-storageprovider) | [WERR_NOT_ACTIVE](#class-werr_not_active) | +| [EntityCertificate](#class-entitycertificate) | [StorageReader](#class-storagereader) | [WERR_NOT_IMPLEMENTED](#class-werr_not_implemented) | +| [EntityCertificateField](#class-entitycertificatefield) | [StorageReaderWriter](#class-storagereaderwriter) | [WERR_REVIEW_ACTIONS](#class-werr_review_actions) | +| [EntityCommission](#class-entitycommission) | [SyncPageBudget](#class-syncpagebudget) | [WERR_UNAUTHORIZED](#class-werr_unauthorized) | +| [EntityOutput](#class-entityoutput) | [TaskArcadeSSE](#class-taskarcadesse) | [WERR_UTXO_REVIEW_INCONCLUSIVE](#class-werr_utxo_review_inconclusive) | +| [EntityOutputBasket](#class-entityoutputbasket) | [TaskCheckForProofs](#class-taskcheckforproofs) | [Wallet](#class-wallet) | +| [EntityOutputTag](#class-entityoutputtag) | [TaskCheckNoSends](#class-taskchecknosends) | [WalletError](#class-walleterror) | +| [EntityOutputTagMap](#class-entityoutputtagmap) | [TaskCleanupActionBatches](#class-taskcleanupactionbatches) | [WalletMonitorTask](#class-walletmonitortask) | +| [EntityProvenTx](#class-entityproventx) | [TaskClock](#class-taskclock) | [WalletSettingsManager](#class-walletsettingsmanager) | +| [EntityProvenTxReq](#class-entityproventxreq) | [TaskFailAbandoned](#class-taskfailabandoned) | [WalletSigner](#class-walletsigner) | +| [EntitySyncState](#class-entitysyncstate) | [TaskMineBlock](#class-taskmineblock) | [WalletStorageManager](#class-walletstoragemanager) | +| [EntityTransaction](#class-entitytransaction) | [TaskMonitorCallHistory](#class-taskmonitorcallhistory) | [WhatsOnChain](#class-whatsonchain) | +| [EntityTxLabel](#class-entitytxlabel) | [TaskNewHeader](#class-tasknewheader) | [WhatsOnChainNoServices](#class-whatsonchainnoservices) | | [EntityTxLabelMap](#class-entitytxlabelmap) | [TaskNoSendExpiry](#class-tasknosendexpiry) | | | [EntityUser](#class-entityuser) | [TaskPurge](#class-taskpurge) | | @@ -12798,6 +12811,25 @@ See also: [WalletError](./client.md#class-walleterror) Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) +--- +##### Class: WERR_NETWORK_CHAIN + +Configured network chain is invalid or does not match across services. + +Live `WalletStorageManager.syncToWriter` and `syncFromReader` throw this +before any sync chunk moves when the reader and writer `TableSettings.chain` +values differ. + +```ts +export class WERR_NETWORK_CHAIN extends WalletError { + constructor(message?: string) +} +``` + +See also: [WalletError](./client.md#class-walleterror) + +Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Variables](#variables) + --- ##### Class: WERR_NOT_ACTIVE diff --git a/packages/wallet/wallet-toolbox/src/sdk/WERR_errors.ts b/packages/wallet/wallet-toolbox/src/sdk/WERR_errors.ts index 96efe2ce35..d2bfa88b56 100644 --- a/packages/wallet/wallet-toolbox/src/sdk/WERR_errors.ts +++ b/packages/wallet/wallet-toolbox/src/sdk/WERR_errors.ts @@ -168,6 +168,19 @@ export class WERR_BAD_REQUEST extends WalletError { } } +/** + * Configured network chain is invalid or does not match across services. + * + * Live `WalletStorageManager.syncToWriter` and `syncFromReader` throw this + * before any sync chunk moves when the reader and writer `TableSettings.chain` + * values differ. + */ +export class WERR_NETWORK_CHAIN extends WalletError { + constructor(message?: string) { + super('WERR_NETWORK_CHAIN', message ?? 'Configured network chain is invalid or does not match across services.') + } +} + /** * Access is denied due to an authorization error. */ diff --git a/packages/wallet/wallet-toolbox/src/sdk/WalletErrorFromJson.ts b/packages/wallet/wallet-toolbox/src/sdk/WalletErrorFromJson.ts index d3c5cff8ec..88fac31e9a 100644 --- a/packages/wallet/wallet-toolbox/src/sdk/WalletErrorFromJson.ts +++ b/packages/wallet/wallet-toolbox/src/sdk/WalletErrorFromJson.ts @@ -11,6 +11,7 @@ import { WERR_INVALID_PARAMETER, WERR_INVALID_PUBLIC_KEY, WERR_MISSING_PARAMETER, + WERR_NETWORK_CHAIN, WERR_NOT_ACTIVE, WERR_NOT_IMPLEMENTED, WERR_REVIEW_ACTIONS, @@ -185,6 +186,9 @@ export function WalletErrorFromJson(json: object): WalletError { case 'WERR_BAD_REQUEST': e = new WERR_BAD_REQUEST(obj.message) break + case 'WERR_NETWORK_CHAIN': + e = new WERR_NETWORK_CHAIN(obj.message) + break case 'WERR_UNAUTHORIZED': e = new WERR_UNAUTHORIZED(obj.message) break diff --git a/packages/wallet/wallet-toolbox/src/sdk/WalletStorage.interfaces.ts b/packages/wallet/wallet-toolbox/src/sdk/WalletStorage.interfaces.ts index 44fa030514..c6b79cb484 100644 --- a/packages/wallet/wallet-toolbox/src/sdk/WalletStorage.interfaces.ts +++ b/packages/wallet/wallet-toolbox/src/sdk/WalletStorage.interfaces.ts @@ -37,6 +37,7 @@ import { } from '../storage/schema/tables' import { WalletServices } from './WalletServices.interfaces' import { Chain, Paged, ProvenTxReqStatus, TransactionStatus } from './types' +import { WalletError } from './WalletError' import { AbortActionBatchResult, ActionBatchManifest, @@ -167,6 +168,11 @@ export interface WalletStorageSync extends WalletStorageWriter { setActive: (auth: AuthId, newActiveStorageIdentityKey: string) => Promise getSyncChunk: (args: RequestSyncChunkArgs) => Promise + /** + * Apply one sync page. First-party providers throw on failure. + * A custom writer may instead set `ProcessSyncChunkResult.error`; + * `WalletStorageManager` live-sync loops throw that error and stop. + */ processSyncChunk: (args: RequestSyncChunkArgs, chunk: SyncChunk) => Promise } @@ -714,6 +720,13 @@ export interface ProcessSyncChunkResult { maxUpdated_at: Date | undefined updates: number inserts: number + /** + * Optional non-throwing failure from a custom writer. First-party + * `StorageProvider` implementations throw instead of setting this field. + * `WalletStorageManager.syncToWriter` and `syncFromReader` throw `error` + * immediately and do not request another chunk. + */ + error?: WalletError } /** diff --git a/packages/wallet/wallet-toolbox/src/sdk/__test/WalletError.test.ts b/packages/wallet/wallet-toolbox/src/sdk/__test/WalletError.test.ts index c9bc683f86..0c8ee89618 100644 --- a/packages/wallet/wallet-toolbox/src/sdk/__test/WalletError.test.ts +++ b/packages/wallet/wallet-toolbox/src/sdk/__test/WalletError.test.ts @@ -8,6 +8,7 @@ import { WERR_REVIEW_ACTIONS, WERR_INSUFFICIENT_FUNDS, WERR_BROADCAST_UNAVAILABLE, + WERR_NETWORK_CHAIN, WERR_INVALID_OPERATION, WERR_MISSING_PARAMETER, WERR_BAD_REQUEST, @@ -220,14 +221,15 @@ describe('WalletError tests', () => { expect(werr2.message).toBe('Unable to broadcast transaction at this time.') }) - test('6 - retired WERR_NETWORK_CHAIN name still deserializes as WalletError', async () => { - const werr = new WalletError('WERR_NETWORK_CHAIN', 'Chain mismatch') + test('6 - WERR_NETWORK_CHAIN test', async () => { + const werr = new WERR_NETWORK_CHAIN('Chain mismatch') + expect(werr).toBeInstanceOf(WERR_NETWORK_CHAIN) expect(werr.name).toBe('WERR_NETWORK_CHAIN') expect(werr.message).toBe('Chain mismatch') const json = WalletError.unknownToJson(werr) const werr2 = WalletErrorFromJson(JSON.parse(json)) - expect(werr2).toBeInstanceOf(WalletError) + expect(werr2).toBeInstanceOf(WERR_NETWORK_CHAIN) expect(werr2.name).toBe('WERR_NETWORK_CHAIN') expect(werr2.message).toBe('Chain mismatch') }) diff --git a/packages/wallet/wallet-toolbox/src/storage/WalletStorageManager.ts b/packages/wallet/wallet-toolbox/src/storage/WalletStorageManager.ts index c603999a49..92dbf03aaf 100644 --- a/packages/wallet/wallet-toolbox/src/storage/WalletStorageManager.ts +++ b/packages/wallet/wallet-toolbox/src/storage/WalletStorageManager.ts @@ -9,6 +9,7 @@ import { validateRelinquishOutputArgs } from '@bsv/sdk/wallet/validationHelpers' import { SyncPageBudget } from './sync/SyncPageBudget' +import { assertLiveSyncChainsMatch, throwIfProcessSyncChunkError } from './sync/liveSyncGuards' import { validateSyncCheckpoint } from './sync/syncCheckpoint' import { AbortActionArgs, @@ -894,6 +895,7 @@ export class WalletStorageManager implements sdk.WalletStorage { log = await this.runAsSync(async sync => { const writer = sync const writerSettings = this.getSettings() + assertLiveSyncChainsMatch(readerSettings, writerSettings) log += `syncFromReader from ${readerSettings.storageName} to ${writerSettings.storageName}\n` @@ -915,6 +917,7 @@ export class WalletStorageManager implements sdk.WalletStorage { chunk.user.activeStorage = ((this._active as ManagedStorage).user as TableUser).activeStorage } const r = await writer.processSyncChunk(pageArgs, chunk) + throwIfProcessSyncChunkError(r) budget.committed(chunk, Date.now() - startedAt) inserts += r.inserts updates += r.updates @@ -949,6 +952,7 @@ export class WalletStorageManager implements sdk.WalletStorage { log = await this.runAsSync(async sync => { const reader = sync const readerSettings = reader.getSettings() + assertLiveSyncChainsMatch(readerSettings, writerSettings) log += progLog(`syncToWriter from ${readerSettings.storageName} to ${writerSettings.storageName}\n`) @@ -967,6 +971,7 @@ export class WalletStorageManager implements sdk.WalletStorage { const chunk = await reader.getSyncChunk(pageArgs) log += EntitySyncState.syncChunkSummary(chunk) const r = await writer.processSyncChunk(pageArgs, chunk) + throwIfProcessSyncChunkError(r) budget.committed(chunk, Date.now() - startedAt) inserts += r.inserts updates += r.updates diff --git a/packages/wallet/wallet-toolbox/src/storage/sync/liveSyncGuards.test.ts b/packages/wallet/wallet-toolbox/src/storage/sync/liveSyncGuards.test.ts new file mode 100644 index 0000000000..ed4d0b473a --- /dev/null +++ b/packages/wallet/wallet-toolbox/src/storage/sync/liveSyncGuards.test.ts @@ -0,0 +1,55 @@ +import { WERR_INTERNAL, WERR_NETWORK_CHAIN } from '../../sdk/WERR_errors' +import { assertLiveSyncChainsMatch, throwIfProcessSyncChunkError } from './liveSyncGuards' +import type { TableSettings } from '../schema/tables' + +function settings(chain: TableSettings['chain'], storageName: string): TableSettings { + return { + created_at: new Date(0), + updated_at: new Date(0), + storageIdentityKey: `${storageName}-key`, + storageName, + chain, + dbtype: 'SQLite', + maxOutputScript: 0 + } +} + +describe('live sync guards', () => { + test('throws WERR_NETWORK_CHAIN when reader and writer chains differ', () => { + expect(() => assertLiveSyncChainsMatch(settings('test', 'reader'), settings('main', 'writer'))).toThrow( + WERR_NETWORK_CHAIN + ) + try { + assertLiveSyncChainsMatch(settings('test', 'reader'), settings('main', 'writer')) + } catch (e) { + expect(e).toBeInstanceOf(WERR_NETWORK_CHAIN) + expect((e as Error).message).toContain("Reader 'reader' is 'test'") + expect((e as Error).message).toContain("writer 'writer' is 'main'") + } + }) + + test('accepts matching chains', () => { + expect(() => assertLiveSyncChainsMatch(settings('test', 'reader'), settings('test', 'writer'))).not.toThrow() + }) + + test('throws a custom ProcessSyncChunkResult.error and ignores a missing field', () => { + const error = new WERR_INTERNAL('custom writer failed') + expect(() => + throwIfProcessSyncChunkError({ + done: false, + maxUpdated_at: undefined, + updates: 0, + inserts: 0, + error + }) + ).toThrow(error) + expect(() => + throwIfProcessSyncChunkError({ + done: true, + maxUpdated_at: undefined, + updates: 0, + inserts: 0 + }) + ).not.toThrow() + }) +}) diff --git a/packages/wallet/wallet-toolbox/src/storage/sync/liveSyncGuards.ts b/packages/wallet/wallet-toolbox/src/storage/sync/liveSyncGuards.ts new file mode 100644 index 0000000000..a8d88697f5 --- /dev/null +++ b/packages/wallet/wallet-toolbox/src/storage/sync/liveSyncGuards.ts @@ -0,0 +1,23 @@ +import { WERR_NETWORK_CHAIN } from '../../sdk/WERR_errors' +import type { ProcessSyncChunkResult } from '../../sdk/WalletStorage.interfaces' +import type { TableSettings } from '../schema/tables' + +/** + * Live-sync handshake: compare reader and writer chain before any chunk moves. + */ +export function assertLiveSyncChainsMatch(readerSettings: TableSettings, writerSettings: TableSettings): void { + if (readerSettings.chain !== writerSettings.chain) { + throw new WERR_NETWORK_CHAIN( + `Configured network chain is invalid or does not match across services. Reader '${readerSettings.storageName}' is '${String(readerSettings.chain)}'; writer '${writerSettings.storageName}' is '${String(writerSettings.chain)}'.` + ) + } +} + +/** + * Honor a custom writer's non-throwing `ProcessSyncChunkResult.error`. + */ +export function throwIfProcessSyncChunkError(result: ProcessSyncChunkResult): void { + if (result.error != null) { + throw result.error + } +} diff --git a/packages/wallet/wallet-toolbox/src/storage/sync/liveSyncManager.test.ts b/packages/wallet/wallet-toolbox/src/storage/sync/liveSyncManager.test.ts new file mode 100644 index 0000000000..ddf407f890 --- /dev/null +++ b/packages/wallet/wallet-toolbox/src/storage/sync/liveSyncManager.test.ts @@ -0,0 +1,65 @@ +import 'fake-indexeddb/auto' +import { randomUUID } from 'node:crypto' +import { PrivateKey } from '@bsv/sdk' +import { StorageIdb } from '../StorageIdb' +import { StorageProvider } from '../StorageProvider' +import { WalletStorageManager } from '../WalletStorageManager' +import { WERR_INTERNAL, WERR_NETWORK_CHAIN } from '../../sdk/WERR_errors' + +async function makeStorage(chain: 'main' | 'test' = 'test'): Promise { + const storage = new StorageIdb(StorageProvider.createStorageBaseOptions(chain)) + storage.dbName = `live-sync-${chain}-${randomUUID()}` + await storage.migrate(`${chain} live sync fixture`, PrivateKey.fromRandom().toPublicKey().toString()) + await storage.makeAvailable() + return storage +} + +describe('WalletStorageManager live sync guards', () => { + test('throws WERR_NETWORK_CHAIN before any chunk when live-sync chains differ', async () => { + const reader = await makeStorage('test') + const writer = await makeStorage('main') + const identityKey = PrivateKey.fromRandom().toPublicKey().toString() + const manager = new WalletStorageManager(identityKey, reader) + try { + await manager.makeAvailable() + const getChunk = jest.spyOn(reader, 'getSyncChunk') + const process = jest.spyOn(writer, 'processSyncChunk') + await expect(manager.syncToWriter({ identityKey }, writer)).rejects.toBeInstanceOf(WERR_NETWORK_CHAIN) + const restoreManager = new WalletStorageManager(identityKey, writer) + await restoreManager.makeAvailable() + await expect(restoreManager.syncFromReader(identityKey, reader)).rejects.toBeInstanceOf(WERR_NETWORK_CHAIN) + expect(getChunk).not.toHaveBeenCalled() + expect(process).not.toHaveBeenCalled() + } finally { + await reader.destroy() + await writer.destroy() + await reader.dropAllData() + await writer.dropAllData() + } + }) + + test('throws ProcessSyncChunkResult.error from a custom writer and stops the live-sync loop', async () => { + const reader = await makeStorage() + const writer = await makeStorage() + const identityKey = PrivateKey.fromRandom().toPublicKey().toString() + const manager = new WalletStorageManager(identityKey, reader) + const customError = new WERR_INTERNAL('custom writer failed') + try { + await manager.makeAvailable() + const process = jest.spyOn(writer, 'processSyncChunk').mockResolvedValue({ + done: false, + maxUpdated_at: undefined, + updates: 0, + inserts: 0, + error: customError + }) + await expect(manager.syncToWriter({ identityKey }, writer)).rejects.toBe(customError) + expect(process).toHaveBeenCalledTimes(1) + } finally { + await reader.destroy() + await writer.destroy() + await reader.dropAllData() + await writer.dropAllData() + } + }) +}) diff --git a/specs/wallet/storage-adapter.yaml b/specs/wallet/storage-adapter.yaml index 542b4c961b..834c4b357c 100644 --- a/specs/wallet/storage-adapter.yaml +++ b/specs/wallet/storage-adapter.yaml @@ -1317,6 +1317,9 @@ components: done: type: boolean description: true if no more chunks are needed. + error: + type: string + description: Optional non-throwing failure from a custom writer. First-party providers throw instead. Live sync loops throw this error and stop. FindOrInsertSyncStateRequest: type: object From d9fdbd57f97c3ab41df41956e5210b28febe7810 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 9 Oct 2026 14:32:58 +0000 Subject: [PATCH 4/4] fix(deps): override handlebars 4.7.10 for ts-jest critical advisories Close GHSA-8r5x-fm3f-whwj and GHSA-p8wg-vrv2-v86f on the frozen ts-jest graph. 4.7.10 is younger than the 7-day floor until 2026-10-12, so handlebars is temporarily age-excluded for this security install. Co-authored-by: deggen --- docs/reference/dependency-policy.md | 12 ++++++++---- governance/dependency-release-policy.json | 18 ++++++++++++------ governance/repository-health/exceptions.json | 18 ++++++++++++++++++ pnpm-lock.yaml | 11 ++++++----- pnpm-workspace.yaml | 7 +++++++ scripts/dependency-release-governance.test.mjs | 3 ++- 6 files changed, 53 insertions(+), 16 deletions(-) diff --git a/docs/reference/dependency-policy.md b/docs/reference/dependency-policy.md index 4d380ac514..c2a1b31c89 100644 --- a/docs/reference/dependency-policy.md +++ b/docs/reference/dependency-policy.md @@ -2,9 +2,9 @@ id: dependency-release-policy title: 'Dependency and Release Policy' kind: reference -version: '1.3.4' -last_updated: '2026-10-06' -last_verified: '2026-10-06' +version: '1.3.5' +last_updated: '2026-10-09' +last_verified: '2026-10-09' review_cadence_days: 30 status: stable tags: [reference, dependencies, security, releases] @@ -156,7 +156,7 @@ must be a dependency or peer, and clean packed consumers must typecheck it. This keeps build-only advisory trees out of consumer installs without shipping unresolvable public declarations. -The root workspace carries seven narrow audited dependency overrides: +The root workspace carries narrow audited dependency overrides: - Jest 30.4.2 and Stryker still constrain parts of their reporting and coverage graphs to minimatch releases with older `brace-expansion` ranges. @@ -183,6 +183,10 @@ The root workspace carries seven narrow audited dependency overrides: - Jest's Istanbul reporting chain and the standalone WAB server can still select `js-yaml` 3.15.1. The workspace and WAB lock select the compatible 3.15.2 security release until those parent ranges advance naturally. +- `ts-jest` still admits `handlebars` releases at or below 4.7.9. GHSA-8r5x-fm3f-whwj + and GHSA-p8wg-vrv2-v86f require 4.7.10, so the workspace selects that first + patched release. `handlebars` is also listed in `minimumReleaseAgeExclude` + until 2026-10-12T22:37:37Z because 4.7.10 is younger than the 7-day floor. These substitutions are verified through their affected Jest, mutation, documentation, and build paths and have owners, evidence, review dates, and diff --git a/governance/dependency-release-policy.json b/governance/dependency-release-policy.json index f7ff35585c..302aa89772 100644 --- a/governance/dependency-release-policy.json +++ b/governance/dependency-release-policy.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "lastReviewed": "2026-10-03", + "lastReviewed": "2026-10-09", "owner": "ts-stack-maintainers", "routineUpdates": { "dependabotConfig": ".github/dependabot.yml", @@ -144,11 +144,11 @@ "closeImplementationWaveAfterPublication": false }, "overrideRemovalReview": { - "reviewedAt": "2026-10-03", - "method": "Rechecked every registered substitution after the workspace brace-expansion floor moved from 5.0.9 to 5.0.11 and engine.io 6.6.10 was added. Jest and Stryker minimatch still admit brace-expansion below 5.0.11, and socket.io in authsocket still admits engine.io below 6.6.10. Both substitutions stay on the first release that clears the current high advisories. The other 23 selectors, including the Metro-scoped image-size 2.0.4 substitution, remain necessary against the frozen graph. On 2026-10-02 the lodash-es 4.18.1 selector was added because Mermaid 12 brings chevrotain 11.1.2, which pins vulnerable lodash-es 4.17.23. The yamux-scoped @libp2p/utils 7.4.1 selector was added so YamuxStream satisfies @libp2p/interface 3.3 readableEnded. Metro 0.87.1 replaced its image-size dependency with an in-tree parser, so the Metro-scoped image-size substitution was retired on 2026-10-02. On 2026-10-03, retain all existing 26 registrations unchanged and add only the exact Metro-file-map 0.87.1 micromatch removal, paired source/distribution patch and exact Picomatch 2.3.2 package extension. The unmodified installed published watcher independently reproduces all 1,120 frozen compatibility cases; qualify the new graph and native platform before merge.", - "retainedCount": 27, - "result": "All 26 retained overrides prevent a reproduced vulnerable transitive version, keep a stream type assignable, or preserve an isolated reproducible toolchain closure. The workspace brace-expansion selector is now 5.0.11, covering GHSA-6j4f-fj2g-mc7p and GHSA-qhr7-859c-m2p7. The engine.io 6.6.10 selector closes GHSA-2gc4-cqfq-p2gv on the authsocket socket.io path without an advisory exclusion. The lodash-es 4.18.1 selector closes GHSA-r5fr-rjxr-66jc on the Mermaid/chevrotain path. The yamux-scoped @libp2p/utils 7.4.1 selector supplies readableEnded for interface 3.3. The new 27th selector removes the unused micromatch/braces closure from Metro while preserving the existing matcher; it adds no advisory exclusion.", - "nextReview": "Rehearse removal monthly and immediately after upstream Google client, Jest/minimatch/brace-expansion/js-yaml, typed-rest-client, Redocly, AJV, express-rate-limit, Socket.IO/engine.io, Vite/PostCSS, remark-mdx-frontmatter/TOML, Metro, image-size, or Mermaid/chevrotain/lodash-es dependency changes." + "reviewedAt": "2026-10-09", + "method": "Rechecked every registered substitution after GHSA-8r5x-fm3f-whwj and GHSA-p8wg-vrv2-v86f published 2026-10-08T17:52Z against handlebars <=4.7.9. The frozen ts-jest graph still resolves handlebars 4.7.9. Retain the existing 27 registrations unchanged and add only the workspace handlebars@<4.7.10 -> 4.7.10 selector. The patched 4.7.10 release is younger than the 7-day minimumReleaseAge floor until 2026-10-12T22:37:37Z, so handlebars is temporarily listed in minimumReleaseAgeExclude for this security-urgent install only.", + "retainedCount": 28, + "result": "All 27 retained overrides still prevent a reproduced vulnerable transitive version, keep a stream type assignable, or preserve an isolated reproducible toolchain closure. The new 28th selector closes GHSA-8r5x-fm3f-whwj and GHSA-p8wg-vrv2-v86f on the ts-jest handlebars path without an advisory exclusion.", + "nextReview": "Rehearse removal monthly and immediately after upstream Google client, Jest/minimatch/brace-expansion/js-yaml/handlebars/ts-jest, typed-rest-client, Redocly, AJV, express-rate-limit, Socket.IO/engine.io, Vite/PostCSS, remark-mdx-frontmatter/TOML, Metro, image-size, or Mermaid/chevrotain/lodash-es dependency changes. Remove the handlebars minimumReleaseAgeExclude after 2026-10-12T22:37:37Z." }, "overrideRegistry": [ { @@ -317,6 +317,12 @@ "selector": "metro-file-map@0.87.1>micromatch", "value": "'-'", "exceptionId": "metro-file-map-picomatch-advisory-repair" + }, + { + "source": "pnpm-workspace.yaml", + "selector": "handlebars@<4.7.10", + "value": "4.7.10", + "exceptionId": "handlebars-ts-jest-advisory-override" } ], "scheduledVerification": { diff --git a/governance/repository-health/exceptions.json b/governance/repository-health/exceptions.json index 11b3bb45fb..1a2f8ab60c 100644 --- a/governance/repository-health/exceptions.json +++ b/governance/repository-health/exceptions.json @@ -428,6 +428,24 @@ "created": "2026-10-03", "reviewBy": "2026-11-02", "removeWhen": "Remove the patch, exact-version package extension and parent-scoped removal together when an official compatible Metro/file-map release removes the affected dependency path. Require the complete independent watcher oracle, frozen graph, full unexcluded audit and packed Metro/Hermes platform checks before retirement." + }, + { + "id": "handlebars-ts-jest-advisory-override", + "category": "override", + "target": "pnpm-workspace.yaml override for handlebars releases below 4.7.10, plus a temporary handlebars minimumReleaseAgeExclude until 2026-10-12T22:37:37Z", + "owner": "ts-stack-maintainers", + "reason": "ts-jest still admits handlebars <=4.7.9 through its istanbul/template graph. GHSA-8r5x-fm3f-whwj and GHSA-p8wg-vrv2-v86f, published 2026-10-08T17:52Z after main last passed CI, require 4.7.10. Selecting 4.7.10 is the first patched release and leaves the Handlebars compile API that ts-jest consumes unchanged. The patched release published 2026-10-05T22:37:37Z is younger than the 7-day minimumReleaseAge floor until 2026-10-12T22:37:37Z, so handlebars is temporarily excluded from that floor for this security-urgent install only.", + "evidence": [ + "pnpm-workspace.yaml#overrides", + "pnpm-workspace.yaml#minimumReleaseAgeExclude", + "pnpm-lock.yaml#overrides", + "governance/dependency-release-policy.json#overrideRegistry", + "https://github.com/advisories/GHSA-8r5x-fm3f-whwj", + "https://github.com/advisories/GHSA-p8wg-vrv2-v86f" + ], + "created": "2026-10-09", + "reviewBy": "2026-11-08", + "removeWhen": "Remove the minimumReleaseAgeExclude after 2026-10-12T22:37:37Z. Remove the version-bounded override when the supported ts-jest graph natively resolves handlebars 4.7.10 or newer and the frozen high-severity audit remains green without the substitution." } ] } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 6bf71e84ab..6d5ee98503 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -14,6 +14,7 @@ overrides: js-yaml@<3.15.2: 3.15.2 lodash-es@<4.18.0: 4.18.1 metro-file-map@0.87.1>micromatch: '-' + handlebars@<4.7.10: 4.7.10 packageExtensionsChecksum: sha256-j1ipTIriuh1r8NrHzy5rLoGNr081FjMxVoEY/IdY3mE= @@ -6094,8 +6095,8 @@ packages: hachure-fill@0.5.2: resolution: {integrity: sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg==} - handlebars@4.7.9: - resolution: {integrity: sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==} + handlebars@4.7.10: + resolution: {integrity: sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg==} engines: {node: '>=0.4.7'} hasBin: true @@ -13574,7 +13575,7 @@ snapshots: hachure-fill@0.5.2: {} - handlebars@4.7.9: + handlebars@4.7.10: dependencies: minimist: 1.2.8 neo-async: 2.6.2 @@ -16659,7 +16660,7 @@ snapshots: dependencies: bs-logger: 0.2.6 fast-json-stable-stringify: 2.1.0 - handlebars: 4.7.9 + handlebars: 4.7.10 jest: 30.5.1(@types/node@26.6.1)(ts-node@10.9.2(@types/node@26.6.1)(@typescript/typescript6@6.0.2)) json5: 2.2.3 lodash.memoize: 4.1.2 @@ -16680,7 +16681,7 @@ snapshots: dependencies: bs-logger: 0.2.6 fast-json-stable-stringify: 2.1.0 - handlebars: 4.7.9 + handlebars: 4.7.10 jest: 30.5.1(@types/node@26.6.1)(ts-node@10.9.2(@types/node@26.6.1)(@typescript/typescript6@6.0.2)) json5: 2.2.3 lodash.memoize: 4.1.2 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 9d326f0d38..a0d9b4d0c0 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -28,6 +28,10 @@ autoInstallPeers: false minimumReleaseAge: 10080 minimumReleaseAgeExclude: - '@bsv/*' + # Security-urgent: handlebars 4.7.10 published 2026-10-05T22:37:37Z is + # younger than the 7-day floor until 2026-10-12T22:37:37Z. Remove this + # exclude after that instant; keep the version-bounded override. + - handlebars # Jest 30's current coverage/reporting graph still constrains minimatch to # brace-expansion 1.x/2.x. Keep this narrow, tested substitution on the latest @@ -63,6 +67,9 @@ overrides: lodash-es@<4.18.0: 4.18.1 # Preserve Metro's existing Picomatch matcher while removing the unused braces closure. 'metro-file-map@0.87.1>micromatch': '-' + # ts-jest still admits handlebars <=4.7.9 via its istanbul/template graph. + # GHSA-8r5x-fm3f-whwj and GHSA-p8wg-vrv2-v86f require 4.7.10. + handlebars@<4.7.10: 4.7.10 strictDepBuilds: true trustPolicy: no-downgrade # Apply provenance downgrade checks to the recent supply-chain window. Older diff --git a/scripts/dependency-release-governance.test.mjs b/scripts/dependency-release-governance.test.mjs index 69ac5103c8..4d0639d3bd 100644 --- a/scripts/dependency-release-governance.test.mjs +++ b/scripts/dependency-release-governance.test.mjs @@ -28,7 +28,8 @@ test('dependency and release governance is internally complete', () => { assert.deepEqual(validateDependencyReleaseGovernance(), []) const overrides = collectOverrides() - assert.equal(overrides.length, 27) + assert.equal(overrides.length, 28) + assert.equal(overrides.find(entry => entry.selector === 'handlebars@<4.7.10')?.value, '4.7.10') assert.equal(overrides.filter(entry => entry.selector === 'gaxios').length, 8) assert.equal(overrides.filter(entry => entry.selector === 'uuid').length, 3) assert.equal(overrides.filter(entry => entry.selector === 'brace-expansion').length, 4)