VaultKeepR v1.8.11 (SDK)

What's Changed

• ci(release): ship SLSA build provenance for the published SDK tarballs by @VaultKeepR in #76
• feat(sdk): sync packages from the private monorepo by @VaultKeepR in #80
• refactor(smart-account)!: remove the on-chain CID publish path by @VaultKeepR in #81
• fix(core)!: key the share PIN proof with the URL key by @0xJust1 in #82
• chore(deps): override patched transitive dev dependencies by @VaultKeepR in #83
• fix(core)!: key the share PIN proof with the URL key by @VaultKeepR in #84
• docs(release): publish SDK artifacts only by @VaultKeepR in #85

Full Changelog: v1.8.10...v1.8.11

v1.8.10

What changed in this release (private monorepo 1.8.10)

Mobile

• Android validated on device : native autofill (credential provider) and passkeys tested on a real phone — APK preview dc2a83b8
• iOS build 19 prepared (1.8.10)

Browser extension 1.8.10

• Save-prompt survives navigation : opens at submit, stays clickable, re-offers on the next page (MAIN-world auth hook + session-storage pending save)
• Form-anchored intent detection : the form's own evidence (autocomplete, submit verb, identity fields) beats page-level signals — fixes login-vs-signup misses (Gandi, Zoho, Proton, Stripe) and the GitHub "Go to file" false positive
• Clean toolbar : credentials counter removed from badge/tooltip/field icons (user-set)
• Field icons follow their field on scroll; keystrokes no longer dropped mid-typing

SDK / packages (this repo)

• core, smart-account, cloud, ui, sync, legacy, i18n, logger, recovery, ocr-native, ipfs, alias, wallet-messages, premium updated
• security: prototype-pollution guards on CRDT field assignments (CodeQL)
• pnpm workspace: internal specifiers reconciled to workspace:*, lockfile regenerated
• Vitest harness timeouts raised to 60 s for Argon2id/CRDT perf tests on CI runners

v1.8.5

What's Changed

• security: harden CI supply chain (CodeQL, Scorecard, Dependabot, pinning) by @VaultKeepR in #1
• docs: CONTRIBUTING.md + CHANGELOG.md (OpenSSF baseline-1 / passing readiness) by @VaultKeepR in #13
• docs: governance, design, security assessment, CVD policy (baseline-2 readiness) by @VaultKeepR in #14
• docs: add OpenSSF Best Practices + Baseline badges by @VaultKeepR in #15
• docs: secrets, SCA/SAST remediation + access review policies (baseline-3 readiness) by @VaultKeepR in #16
• docs: support policy (release lifecycle, security update window) by @VaultKeepR in #17
• docs+ci: silver badge readiness — CoC, roadmap, coverage gate by @VaultKeepR in #19
• fix: lint rollout + DCO enforcement (Signed-off-by) by @VaultKeepR in #20
• docs: fix OpenSSF Scorecard badge URL by @VaultKeepR in #21
• sync(packages): align public packages with private development branch by @VaultKeepR in #22
• feat(releases): minisign release integrity infrastructure by @VaultKeepR in #23
• fix(release): keep automated (non-TTY) signing working by @VaultKeepR in #24
• chore(releases): commit minisign release signing public key by @VaultKeepR in #25
• build(deps): bump actions/setup-node from 4.4.0 to 7.0.0 by @dependabot[bot] in #2
• build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #3
• build(deps): bump @sentry/browser from 9.47.1 to 10.73.0 by @dependabot[bot] in #7
• feat(fuzzing): jazzer.js targets for untrusted-input parsers by @VaultKeepR in #26
• fix(release): drop invalid gh --verify flag, preserve staging on failure by @VaultKeepR in #27
• fix(lint): clear eslint errors in cloud, smart-account, sync by @VaultKeepR in #28

New Contributors

• @VaultKeepR made their first contribution in #1
• @dependabot[bot] made their first contribution in #2
  Full Changelog: v0.1.0...v1.8.5

v0.1.0

First public release of the VaultKeepR SDK and contracts.

Packages (15)

• core: XChaCha20-Poly1305, Argon2id, ECIES envelopes, TOTP, passkeys, BIP-39, import/export
• sync: Automerge CRDT cross-device sync
• ipfs: content-addressed vault storage, multi-gateway fetching
• recovery: fragmented recovery with on-chain contract reads
• smart-account: ERC-4337 identity derivation and on-chain sync
• wallet-messages: EIP-4361 and delegation message schemas
• cloud: zero-knowledge encrypted cloud storage
• alias: Postfix/Dovecot email alias forwarding
• premium: license validation and tier limits
• logger: structured logging with key/CID/address redaction
• i18n: English and French
• ui: shared React components
• sentry: error tracking adapters
• legacy: digital inheritance types
• ocr-native: VisionKit and ML Kit OCR module

Contracts (Base L2)

• VaultKeeperCidRegistry: on-chain vault location pointers
• VaultKeeperFragments: on-chain recovery fragments
• VaultKeeperLegacy: time-locked inheritance

All contracts covered by Foundry tests.

Install

pnpm install
pnpm build
pnpm test