BYOK SDK 0.28.3 · keys 0.28.3

0.28.3 publication record

Date: 2026-10-22 (UTC).
Status: all nine packages are published on npm latest. The complete registry readback passed.

Changes

The owner selected 0.28.3 as one more one-release exception to the pre-1.0 MINOR rule. The 0.29.0 schedule does not change.

• Security (client): a CommonJS bundle of the Pi host no longer lets Pi's own undici copy take the process-wide fetch dispatcher (#700).
• Client and keys: HermesAdapter.prepare() runs on Windows. On Windows, the stale-profile sweep keeps a profile when the gateway pipe check fails for any reason other than "file not found" (#712).
• Client: a single-pass esbuild CommonJS bundle loads the Pi host (#701). SDK code in a CommonJS bundle no longer reads import.meta.resolve (#724).
• Client: durable Pi sets mcp on tool_use and tool_result events (#633). An opt-in Grok option for user-level instructions, and a fix for the resumed Grok memory reader (#634).
• Client: on reconnect, the daemon outbox keeps one copy of each held reliable record (#698). The private OAR source moves to 0.70.0.
• Cloud dataplane: a threat model of the hosted surface and a test that keeps the plaintext inventory current (#654).
• Windows CI: the Grok fixture contract, the memory helper tests and the Hermes suites run in routine CI.

See the CHANGELOG and the release notes for the full scope. The release tracker is #715.

Source and accepted artifacts

• Source commit: 9ca1f3ea13fc2c71e15a1f0440989437ec2e3eb4 on main, the merge of #742.
• Push CI: run 39817307092 completed with success.
• Release matrix: run 39817395474, dispatched with release_sha equal to the source. It completed with success: 31 jobs passed and 1 job was skipped as expected.
• Artifact: release-pack-9ca1f3ea13fc2c71e15a1f0440989437ec2e3eb4, id 12443052621. Manifest SHA-256: 5573d880f3e08d1f5bfe21f92afd0a44890d1905baf9b906b5087040cd320612.
• Downstream acceptance (AiphaBee) passed on macOS. Its local pack is byte-identical to the nine CI tarballs.
• After publication, the npm dist.integrity of all nine packages was compared with the tarballs in this artifact. All nine are equal.

npm execution

The account is ancienttwo, with auth-and-writes 2FA. Uploads used browser authentication. This local route has no provenance attestation. The dist-tag is latest.

One run uploaded all nine packages from 17:35:03 to 17:55:32 UTC. That run then stopped in the readback on a network timeout (ETIMEDOUT). A rerun of the same command uploaded nothing, read back all nine packages and created the tag. No upload was repeated.

Tag

The annotated tag v0.28.3 points to 9ca1f3ea. The tag object is ca4b410835db6199e86237ec217a8eb56ae42671. Its message is v0.28.3, a blank line, then sourceGitSha 9ca1f3ea13fc2c71e15a1f0440989437ec2e3eb4. It was created after the readback passed, on 2026-10-22 at 17:58:40 UTC.

Accepted tarballs

Package	Version	SHA-256
@byok-sdk/core	0.28.3	a846f9d194b496c225ec74219ed33649ee39df8eeef13402728ba259c0c11f14
@byok-sdk/protocol	0.28.3	1e1e69a77a061893101e99b7742e9d4bb3037a3d2b6736009591b014d5b52aac
@byok-sdk/server	0.28.3	32be4157660c04c7cb8cadf30737bbb78fd32729ce965506467b255d499b9d99
@byok-sdk/cloud	0.28.3	b195eebcf4dce6e7ce8d408d85a94bd797d880f204b12b9196835500da73ed3c
@byok-sdk/client	0.28.3	cde3b071b3b2c6d596515c757c8169b1853e5b282b50df5d2480a8de72bd2d4e
@byok-sdk/cloud-dataplane	0.28.3	8c7722a59c27527fb0c24ef3f9cbbb24e180d82928e2a5a5389987abd160f081
@byok-sdk/cloud-do	0.28.3	a04c40255b760c9da209ba313ee3b143ef8dd116ee7affeac2442790dd818f83
@byok-sdk/ui-runtime	0.28.3	78717959088529e1b54d93c4c0a411eb2a4d60a42c1bc9a0a25ba7a1fbe0303c
@byok-sdk/keys	0.28.3	2c0a3dc295f9a286ac6a8b7f7161524b512d3c3b3252e63ac63505b81c162bb5

Release boundary

AiphaBee accepted this release on macOS only. Windows code relies on the required windows-latest CI. Live provider runs were not part of this release: Hermes and Grok on real Windows (#608, #609) and the submit_result success rate (#610). Agent memory on Windows (P2-win, #605) moves to 0.29.0. npm publication does not deploy a Host.