AVM SDK 0.6.2: Linux x86_64

• Add synchronous BLAKE3, SHA-256 and strict Ed25519 verification through the single avm.precompile host import. The safe Rust helpers are crypto::blake3, crypto::sha256 and crypto::ed25519_verify; verification uses the supplied message directly, without an implicit prehash. See contract crypto helpers.
• Charge PROVISIONAL compute FUEL before native work: BLAKE3 costs 2,048 + 8 per input byte, SHA-256 costs 2,048 + 4 per input byte, and ed25519_verify_strict costs 300,000 + 12 per input byte, including the 96-byte public-key/signature prefix. WASM instructions are charged separately. These prices may change after validator calibration; existing compute allowances and memory payment are unchanged.
• Add the safe signature verifier example. Its WASM is 29,183 bytes, down from 88,780 bytes when cryptography was compiled into the guest.
• The bundled profile's memory_page_price, memory_class_maxima_bytes, signals_based_traps and pooling_linear_memory_keep_resident remain provisional development values; changing them changes the profile identity.

Compatibility

• Contracts using these crypto helpers require a node with avm.precompile support. The minimum runtime source is 4eb0f4dd4a52f3e69d1dcb549a59835e233364ca; earlier runtimes reject the import during admission. Contracts that do not use the helpers remain import-free.
• Use this release's matching tools and profile together, and create fresh local stand state for its changed profile identity. Existing deployments keep their WASM until rebuilt and redeployed.
• The guest crate remains version 0.1.1; guest builds require Rust/Cargo 1.99.1 and native tools use 1.98.0. Linux x86-64-v3 and Python 3.11+ are required. Examples are educational; this release does not establish production-network or performance acceptance.

AVM SDK 0.6.1: Linux x86_64

• Use relative schedules in vesting-streams: start, cliff and end are offsets from the first execution, zero start is allowed, late deployment and funding are accepted, and cancellation after end preserves the full earned amount with no refund entitlement. The time event field now reports elapsed seconds from the first execution. State grows from 3592 to 3600 bytes; the new schema id is 252aa2507344852d6703cbe2d53e2020230641e4c6938a93e3ca2f5599af63a5.
• Use a relative deadline in bounty-escrow, measured from its first execution. Deployment and exact one-time funding are accepted after the offset; late submission and approval acknowledge expiry without creating approved rights, and unapproved funds become refundable. Zero offset is valid. Late submission and approval emit escrow.expired; status 2005 is returned only for a refund before the offset. State grows from 2864 to 2872 bytes; the new schema id is 611387b8821a94e71fe7a21553d177ef902715f238624b464ba94ec81999b8a7.
• Store Revenue Hub governance times as wide elapsed offsets from the first execution. A zero governance delay is allowed; expired votes and executions succeed with hub.expired and apply no vote or action. Expiry status 3013 is reserved and is no longer returned by votes or executions. Proposal times are now 8 bytes each, expanding the proposal record from 48 to 64 bytes and moving member records from byte 2504 to byte 2520. Vault state grows from 4168 to 4192 bytes; the new schema id is 9b29bb574f1cbe12d9904f2e1c40ea1fade8285ef49566d274b5195ce6a9335f.
• Deploy a module above 1 MiB, up to max_code_size, on the network and on the local stand: the input of a deploy that carries code is bounded only by its own max_code_deploy_input_bytes (3276800 bytes). SDK 0.6.0 also applied the general 1048576-byte input limit and rejected such deploys; every other input keeps that general limit.
• The init of a deploy that carries code receives the whole deploy message, module included, so the contract's arena_bytes must hold that input and the init output together. Measure both deploy forms, a deploy that carries the code and a deploy from a committed selection, with production-sized init_data, salt, ui_name and deploy_meta, and remeasure avm-memory.json after any source, dependency, toolchain or supported-input change; see contract memory.
• Keep a deploy's salt, ui_name and all deploy_meta field names and values within 235 bytes together: the mandatory avm.account.init event must fit max_event_value_bytes (500 bytes), and a larger deploy fails its init with status 44 (VM_ABI_OUTPUT_MALFORMED) on the network and on the local stand. Put larger deploy data into init_data.
• Admit an external deploy, on the network and on the local stand, only when the funding already committed at its address covers its whole pre-execution charge: its fuel_fee_shells, the account initialization fee and, for a deploy that introduces a new selection, the Code Library publication fee; see code publication fee. A zero fuel_fee_shells is not admitted. Both rules also hold for a deploy of already published code that would complete at once. A refused deploy is not charged and its nonce stays unused, so a funded and paid deploy can reuse it; the reason is cannot pay the external: InsufficientBalance for insufficient funding and cannot pay the external: RouteRequiresFee for a zero fee.
• Check on the local stand that an external call or deploy can be paid where the network checks it, after the owner key and before the time, nonce and signature checks, and refuse it with the network's reason: an unpaid call now reports cannot pay the external: RouteRequiresFee instead of local call charge failed: RouteRequiresFee.
• Commit on the local stand, as on the network, an external call that reached WASM execution and then failed: its charge and its spent nonce are committed and none of its effects are kept; see runtime limits.
• AccountBatch execution is not supported by the node yet; a message to such code ends with status 21. The local stand ends it the same way, and the bundled contract-batch-patch example and the Revenue Hub audit ledgers are now message-isolated contracts.
• The bundled profile's memory_page_price, memory_class_maxima_bytes, signals_based_traps and pooling_linear_memory_keep_resident are provisional development values: they can change before network acceptance, and a bundle with other values has a different profile identity.
• Compatibility and upgrade notes

AVM SDK 0.6.0: Linux x86_64

• Authorize external calls by the owner key that a contract keeps in its own data: declare owner_key_offset in [descriptor] of avm-contract.toml. Only that key signs an external call; any other key, or an account without a key, is rejected with AccountKeyNotAllowed before any charge. Write, read and rotate the key with the guest helpers set_owner_key, owner_key and OWNER_KEY_BYTES; by the SDK convention init writes the deploy's owner_id; see owner key and external calls.
• Reject value on external messages with ExternalValueNotAllowed. Fund an account by an internal message or, on the local stand, with fund-user --extra-currencies.
• Add the owner wallet example, which turns one signed external call into one internal message with value and an optional callback, the way other people reach a contract; the token, escrow, Revenue Hub and vesting examples act through owner wallets; see the wallet example.
• Call and deploy contracts on a network with avm-local-stand network-call, network-deploy and network-status: they sign external messages with key files, send them to a node's POST /v2/avm/messages, follow its redirect to the destination's producer and wait for the outcome; see the network client.
• Allow a deploy that carries code a body of up to 3145728 bytes (max_code_deploy_body_size) and a module of up to 3145440 bytes (max_code_size); its init input has its own 3276800-byte cap (max_code_deploy_input_bytes), and every other message keeps the 65536-byte body limit; see runtime limits.
• On the network, a deploy that publishes new code completes in two phases: the block producer compiles the module within 120 seconds before its bytes enter a block, and init runs 120 seconds after the publishing block is final. A deploy over committed code completes at once; see contract deploy.
• Charge the Code Library publication fee of a deploy that carries code by the module's size and function count: 1000 SHELL for every started 40 KiB unit, with 256 functions included per unit; see code publication fee. Reusing a published selection still pays no publication fee.
• Declare the module's function count at deploy body offset 286 (function_count); the guest crate's input.deploy() accepts it.
• Sign a deploy that carries code without its code bytes, under a separate hash domain that still binds code_hash, code_len and function_count.
• Reject a br_table instruction with more than 65520 targets in code admission.
• Take the guest ABI arena's memory on demand and decode the entrypoint input in place; see contract memory.
• The stand configuration with these values has a 637-byte canonical encoding, and local stand state created with an earlier SDK is rejected with a configuration mismatch: create fresh local stand state for this bundle. Declare and write an owner key in every contract that takes external calls, then rebuild contracts with this guest crate and remeasure their stack and arena before deploying them with code.
• The bundled profile's memory_page_price, memory_class_maxima_bytes, signals_based_traps and pooling_linear_memory_keep_resident are provisional development values: they can change before network acceptance, and a bundle with other values has a different profile identity.
• Compatibility and upgrade notes

AVM SDK 0.5.1: Linux x86_64

• Run the local stand with the network execution FUEL limits: max_message_execution_fuel = 1031871955 and max_bucket_execution_fuel = 2063743910 instead of 10000000 and 100000000; see runtime limits.
• Keep the Core-WASM V2 instruction set, admission rules, operation prices, memory payment and the other runtime limits of SDK 0.5.0.
• Local stand state created with SDK 0.5.0 is rejected with a configuration mismatch; create fresh local stand state for this bundle.
• The bundled profile's memory_page_price, memory_class_maxima_bytes, signals_based_traps and pooling_linear_memory_keep_resident are provisional development values: they can change before network acceptance, and a bundle with other values has a different profile identity.
• Compatibility and upgrade notes

AVM SDK 0.5.0: Linux x86_64

• Run contracts on Wasmtime 48.0.8 LTS with Cranelift 0.135.8 and wasmparser 0.254.2, replacing Wasmtime 36.0.12, which lacks upstream security fixes.
• Build the native tools with Rust/Cargo 1.98.0; contract builds keep Rust/Cargo 1.99.1.
• Apply operation-specific FUEL prices and additional charges for requested memory bytes, table elements and memory-growth pages; see the charging rules.
• Keep the Core-WASM V2 instruction set, admission rules and configured runtime limits.
• Run the Revenue Hub guest ABI checks on Wasmtime 48.0.8.
• Produce byte-for-byte reproducible release bundles from identical build inputs.
• Record build paths in bundle provenance, license notices and the host commands' compiled-in source locations under fixed public roots instead of the build machine's directories; see package contents.
• Charge each paid call for the linear memory it ends with: its 64-KiB pages at the profile's memory_page_price, settled with compute FUEL in one rounding and outside every FUEL budget and cap; a paid reserve must also cover the initial memory before the call starts; see memory payment.
• Run contracts in ten pre-created memory classes selected by the declared maximum memory; a class changes neither FUEL nor the memory payment; see memory classes.
• Derive deployment stack, ABI arena and memory maximum from each contract's own tests, with explicit overrides, stack overflow traps and local peak/growth checks; see contract memory.
• The bundled profile's memory_page_price, memory_class_maxima_bytes, signals_based_traps and pooling_linear_memory_keep_resident are provisional development values: they can change before network acceptance, and a bundle with other values has a different profile identity.
• Compatibility and upgrade notes

AVM SDK 0.4.0: Linux x86_64

• Use Rust/Cargo 1.99.1 for validated wide-arithmetic contract builds; native tools remain on 1.93.0.
• Enable Core-WASM V2 wide arithmetic with a matching runtime profile.
• Record wide-arithmetic compiler warnings in build provenance.
• Update Revenue Hub and Vesting Streams optimizers for wide-arithmetic WASM.
• Optimize Revenue Vault deployment size to fit the existing 65,536-byte limit.
• Update example checks and build/install instructions for matching tool bundles.

AVM SDK 0.3.0: Linux x86_64

Changed

• Currencies: explicit ECC balances/transfers; removed ambiguous main-currency fields; enabled currency ID 0.
• Constructors: expose deployment data, salt and identities directly to init.
• Bindings: generate typed dispatch and method/error IDs instead of handwritten ABI glue.
• CLI: inspect ABI/account state and calculate deploy addresses before funding.
• Deploy callbacks: support internal-deploy success, failed-init settlement and rejection notifications.
• Diagnostics: report constructor errors, invalid timestamps and used/available FUEL.
• Build/install: fix relocated dependencies, reject stale generated sources and validate executable permissions.
• Examples: add bounty escrow, Revenue Hub, vesting, token and factory-child workflows.
• Revenue Hub checks: replace Node.js with Rust/Wasmtime.

Upgrade

• Breaking: encodings, ABI and profiles changed; rebuild contracts and create fresh local stand state.
• Match SDK/profile bytes; guest crate version 0.1.1 alone does not establish compatibility.
• Linux x86-64-v3 bundle; glibc ≥2.39, Python ≥3.11. Builds require Rust/Cargo 1.93.0, WASM target and rust-lld.
• Keep 0.2.0 tools/profile/state together for replay. Examples are educational, not audited applications.
• Full release notes.

AVM SDK 0.2.0 (guest SDK 0.1.1)

AVM SDK 0.2.0 / guest SDK 0.1.1

Contract results avoid an extra output copy, and the local stand now uses the updated AVM runtime.

What's Changed

• Guest execution: results encode directly into guest output memory; input copying is optimized. The public Rust API and contract wire format are unchanged.
• Local runtime: pooled allocation and deadline cancellation preserve fresh isolated contexts and FUEL. Message admission no longer truncates valid inputs by cumulative reserved FUEL; failed-batch charging is corrected.
• Build and install: builds enforce Rust/Cargo 1.93.0, rust-lld and a reviewed Cargo.lock. Installation verifies the complete package before activation.
• Upgrades: Contract A accepts your stand's owner key instead of the fixed test key, enabling owner-authorized upgrades.

Get Started

Requires Linux x86-64-v3, glibc >=2.39, Python >=3.11, Bash, gh, jq and the pinned compiler's wasm32-unknown-unknown target. Follow installation and setup.

Examples

• Upgrades: Contract A v1 and v2.
• Messages and events: Contract B.
• State patches: Batch patch.

Compatibility

Breaking: CompactV1 state trees and canonical List(Data) EventLog encoding change roots/commitments and profile identities. Old local state is not migrated: retain old tools for replay; initialize, fund and redeploy locally. This does not authorize a production reset. Rebuilding contracts can change code hashes and FUEL.

Guest internal-event reads remain unsupported; deploy callbacks remain unresolved (#13). No production-performance guarantee. See compatibility and unchanged license terms.

AVM SDK from avm-dev 335a0f09fdbc98eb7a1056c0f6b84cd4f39d889e

Private Linux x86-64 AVM developer distribution built and release-tested from gosh-sh/acki-nacki commit 335a0f09fdbc98eb7a1056c0f6b84cd4f39d889e.

AVM SDK from avm-dev f7414e20335dc740793491f85cd0af0cafce9392

Private Linux x86-64 AVM developer distribution built and release-tested from gosh-sh/acki-nacki commit f7414e20335dc740793491f85cd0af0cafce9392.