v0.11.10

What's Changed

This release includes the changes shipped in v0.11.9 (which was published to npm but not tagged on GitHub) as well as the v0.11.10 changes.

Features

• Default to the edge.provable.com/api gateway (#1407). Every https://api.provable.com default becomes https://edge.provable.com/api, which serves the same routes. This covers the Rust DEFAULT_URL, live tests, CI, create-leo-app templates, the website, guides, and the generated API reference. Edge is key-optional with no JWT route, while api.provable.com remains the JWT gateway.
• Auth normalization for a lone apiKey (#1407). A string apiKey on its own now selects api-key mode and is sent as X-API-Key with no JWT mint. Previously it fell into jwt mode, which could never mint without a consumerId, so it only warned and sent nothing. A key paired with a consumerId, or a bare jwtData, still selects jwt mode for the legacy gateway.
• Reusable multi-program prepared processes (#1396). Adds ProgramManager.prepareProcess() and PreparedProcess, so one snarkVM process can be warmed once with multiple programs (plus an optional superset of dynamic-dispatch imports) and then serve buildAuthorization, buildAuthorizationUnchecked, and provingRequest for any function in any loaded program via the new preparedProcess option. Program sources, editions, static imports, and transitive dependencies are resolved once during preparation. PreparedProcess.supports() and per-program metadata are exposed for compatibility checks, and supplied sources, editions, functions, and imports are validated before a process is reused. The existing function-scoped PreparedProgram API is unchanged.
• Fee estimation reuses the prepared process (#1396). Private-fee proving requests now estimate fees on the already-resolved process instead of materializing import sources through JavaScript and constructing a second process.

Bug Fixes

• Honor injected JWTs on the legacy api.provable.com paths (#1409). AleoNetworkClient no longer discards a directly assigned jwtData: a token with no recorded mint scope is treated as injected and sent as before, while tokens the client mints itself keep consumer and origin scoping. RecordScanner.setJwtData() now rebuilds auth like setApiKey and setConsumerId, flipping into jwt mode when a token is supplied and back when it is cleared. A new api.provable.com legacy compatibility test suite pins the pre-edge wire behavior.
• Send session-injected JWTs in the none auth mode (v0.11.9). A scanner built with no credentials normalizes to none mode, which previously returned no headers even when a caller injected a token through setJwtData. none mode now sends an injected token and still never mints.
• Serialize prepared-context WASM access (#1396). Concurrent calls on the same prepared context are now queued instead of rejected, and the queue state is isolated per context, so a shared context can no longer trigger a WASM RefCell borrow panic.
• Accept built-in credits.aleo in prepared processes and validate the canonical source (#1396).

Templates and CI

• The loyalty template drops its hand-rolled /jwts minting, lets the SDK handle both gateways, and no longer hard-requires an API key for delegated or scanner mode (#1407).
• The loyalty and record scanner live suites run in the default none mode against edge; the scanner suite defaults to the edge scanner when RECORD_SCANNER_URL is unset (#1407).

Dependencies

• Bump next from 15.5.21 to 15.5.24 (#1408)
• Bump browserslist from 4.28.1 to 4.28.9 (#1406)
• Bump js-yaml from 4.3.1 to 4.3.2 (#1405)
• Bump baseline-browser-mapping from 2.9.5 to 2.11.21 (#1403)
• Bump svgo from 4.0.2 to 4.1.0 (#1402)
• Bump colord from 2.9.3 to 2.10.0 (#1401)
• Bump @humanfs/node from 0.16.7 to 0.16.8 (#1399)
• Bump fast-uri from 3.1.5 to 3.1.7 (#1398)
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 (#1397)
• Bump brace-expansion from 1.1.16 to 1.1.18 (#1388)

Full Changelog: v0.11.8...v0.11.10