v0.2.2 — Typed availability and offline browser example

Typed availability and offline browser example

• Typed read-only health, service configuration and upstream relayer configuration responses; optional fields preserve unknown availability.
• Typed pass token metadata and expanded strict TypeScript acceptance/rejection fixtures.
• Loopback-only same-origin browser fixture server, requiring Node.js 22+ and no dependencies.
• Available, disabled, missing-field, HTTP 503 and invalid-JSON demonstrations; no wallet or remote provider requests.
• 38 offline tests passed locally and on Node.js 22/24 in pull-request CI.
• TypeScript strict no-emit fixture check passed locally.
• 23 allowlisted package files; extracted package browser/SDK smoke check passed.
• Source and archives scanned for configured credentials and operational material.

Try it

Extract the source archive, then run npm run example:browser and open http://127.0.0.1:8788/.
All displayed results are synthetic; this is not a funded mainnet demo.

Verification

Pull request: #6
PR CI: https://github.com/duskmoth-dev/duskmoth-sdk/actions/runs/43707367547
Main CI: https://github.com/duskmoth-dev/duskmoth-sdk/actions/runs/43707461517

Distribution and boundaries

GitHub Releases only. Verify SHA256SUMS before installing the attached .tgz. No npm registry publication.
No SDK HTTP behavior, production CORS, wallet signing, pass costs, payment execution or hosted deployment changed.
No new dependencies, security-audit claim or general MagicBlock availability claim.

v0.2.1 — Developer examples and secure release preparation

Changes

• Runnable offline, service-status and opt-in sanctions examples; no wallet signing or broadcasting.
• Package file allowlist checks and conservative failure-state examples.
• Node.js 22/24 CI, dependency review, Dependabot and OpenSSF Scorecard workflows.
• Manual tokenless npm publishing workflow with release verification and owner setup instructions.
• Developer Discussions, contribution guidance and private vulnerability reporting.

Verification

• 29 offline SDK tests passed on Node.js 22 and 24 in GitHub CI.
• TypeScript declaration fixtures passed locally.
• Packed package exports and included offline example passed.
• Source and extracted archives checked against configured credentials, credential patterns and operational material.
• Exact-commit CI: https://github.com/duskmoth-dev/duskmoth-sdk/actions/runs/43410608533

Install

Verify the attached SHA256SUMS file, then install duskmoth-dev-sdk-0.2.1.tgz.
npm registry publication is NOT complete: the npm account owner must bootstrap the package and configure the trusted publisher.
The publishing workflow does not establish a live npm release or provenance for this GitHub archive.

No runtime dependencies, funded mainnet tests, independent security audit, or new anonymity claims.

v0.2.0 — Moth Pass, AI Pack and Payroll API

What changed

• Moth Pass information, issuance for an existing burn, and split-withdraw pass redemption.
• AI Pack plan creation and Private Payroll batch authorization.
• Typed premium contracts, operation-specific timeouts, safe error metadata and exact-request recovery documentation.
• No automatic retries, pass substitution, wallet signing or blockchain transaction broadcasting.

Verification

• 24 offline SDK tests passed.
• TypeScript declaration checks passed.
• Offline contract round-trip through the application route handlers passed; issuer and AI were fixtures.
• Source and extracted release archives checked against configured secret values, credential patterns and operational workspace material.
• GitHub CI must pass for the exact commit before this draft is published.

Install the attached duskmoth-dev-sdk-0.2.0.tgz after verifying SHA-256 with the attached checksum file.
This release is not published to the npm registry. Premium POSTs can consume passes; the SDK does not create cryptographic proofs or execute payments.
No independent security audit or funded mainnet transaction verification is claimed.

v0.1.0

Initial MIT-licensed release. 6 offline tests passed. Includes an npm-compatible .tgz; not published to the npm registry. Does not sign or submit transactions.

Source and release archives were checked for configured secret values, credential-like patterns, and hosted-workspace material. Verify archive SHA-256 against the attached checksum. No funded mainnet execution or independent audit is claimed.