Skip to content

BYOK SDK 0.26.1 · keys 0.11.1

Choose a tag to compare

View all tags
@Ancienttwo Ancienttwo released this 12 Oct 14:45
· 1262 commits to main since this release
v0.26.1
e7f3edf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.26.1 publication record

Date: 2026-10-12 (Asia/Singapore).
Status: all nine packages are published on latest. Complete registry
readback and isolated installation passed.

The owner authorized npm publication of 0.26.1 / keys 0.11.1 on latest.
This PATCH release includes all main updates through the preparation baseline
908338ef: startup and offer cleanup, the shared session close result,
prepared-offer race corrections, outbound local-path redaction, OAR 0.57.0
and the test repairs. It adds no public API or schema migration.

Source and artifact identity

  • Preparation PR: #381.
  • Source: e7f3edf29f8ad99a2f61d9c0b64843f40523eef2.
  • Artifact: release-pack-e7f3edf29f8ad99a2f61d9c0b64843f40523eef2 from
    push CI 38261561874.
  • That exact merge-commit run passed all 24 jobs.
  • All nine accepted tarballs match the reviewed preparation tarballs byte for byte.
  • The publisher dry run verifies the original schema-3 manifest and frozen hashes.
    No artifact was rebuilt or repacked for publication.

npm execution

The authenticated npm account is ancienttwo. The publisher verifies write
2FA before upload. This is a local publication and has no GitHub OIDC
provenance attestation.

The upload order was cloud-do, core, protocol, client, cloud, keys,
cloud-dataplane, server and ui-runtime. All nine uploads returned success.
The CLI requested browser authentication for each upload.

Publisher step 7 first returned E404 for ui-runtime. The driver therefore
stopped before tag creation. A standalone readback also returned E404 once.
No upload was repeated. The next standalone readback passed after registry
synchronization.

Registry closure

All nine exact versions are on latest. Their SHA-512 integrities and runtime
dependency maps match the frozen CI manifest. The isolated npm installation
closes to exactly nine SDK package versions. npm ls @byok-sdk/core --all --json
resolves only 0.26.1. The official Pi direct pins and tarball identity match
bun.lock.

After that complete readback, the operator created the missing annotated
v0.26.1 tag at e7f3edf2, with the publisher's exact source message.
The remote tag object is e70bb990; it peels to the verified source e7f3edf2.
The tag is pushed. The GitHub Release uses this same tag.

Accepted artifact hashes

Package Version SHA256
@byok-sdk/core 0.26.1 43863271555e50b970460f6dd35d7cd6e1d9c1635b6683addaf9f7fe0c005fac
@byok-sdk/protocol 0.26.1 bf9e1f61253ad8da819664fc70e74f7b03a57acae33c2cef272fbf6e3c560688
@byok-sdk/server 0.26.1 cba3c841367f46351b535297f488c777ed640c665fbaa081e47ee8211cd90ef3
@byok-sdk/cloud 0.26.1 7a108b02684521be89df97ddc247b7d1321e7a86fda35899607dd5d2878b3ac3
@byok-sdk/client 0.26.1 abea5d007e68a0102ad3652852eefd16817e33bfed252262f40be4a7fff30b89
@byok-sdk/cloud-dataplane 0.26.1 6cbc3e09070ac742307495776aef4d46f16dbc94c77bca4b9d518dd7e8160242
@byok-sdk/cloud-do 0.26.1 3f8432cce253f53d1408136fc38c05cc0bd8a8cc00de2a88fba97cb3f6a9d36e
@byok-sdk/ui-runtime 0.26.1 6f76e304cbf4b113a4f04204c128b93eebb42b0ab7f9b3821f4709618ac5e4bc
@byok-sdk/keys 0.11.1 0040001197c5c42471bafa83ebbb42623ba5537a2270f27250bcd2df8a3de586

Release boundary

npm publication does not perform live Host/provider qualification, device
rollout or a production migration. The preparation's local server time-bound
failure remains in its evidence. Its unchanged server suite passed on rerun,
and the final merge-commit Node CI full suites passed.

Assets 2
Loading