Changelog
Concise release summary. Full notes: CHANGELOG.md.
v2.0.0-rc.3 - 2026-08-16 - Keyed-Read Correctness
Fixed A keyed read whose query legitimately matched nothing — a composite key whose second value does not match (TransactionMetadata(id=721,tx_hash='…') for a label the transaction does not carry), or a $filter that excludes the row — fell back to the row found for the entity’s main key and returned it with 200. Such requests now return 404. Affects all keyed reads of Blocks, Epochs, Pools, Accounts, Dreps, Assets, Addresses, Transactions and TransactionMetadata.
v2.0.0-rc.2 - 2026-08-15 - Keyed $expand / $select
Fixed GET Transactions('<hash>')?$expand=inputs,outputs (and every other keyed read on the index-on-miss entities) returned the bare row and silently dropped the query options; only the collection form honoured them. Keyed reads now index on a miss and then run the client’s own query, so they behave exactly like the collection form — for temporal entities the handler widens the request’s validity window so the slice written during the request is visible (expired slices stay hidden). Composite-key reads honour both keys.
Fixed cds watch no longer logs ERR_MODULE_NOT_FOUND at startup: the boot-time re-drive of interrupted deferred submissions used an extensionless dynamic import() that tsx cannot resolve, so it never ran from TypeScript sources (compiled builds were unaffected).
v2.0.0-rc.1 - 2026-08-14 - CAP 10, Chain Crawler / Pre-Sync, Wallet Worker
Release candidate of the 2.0 line, published as npm latest — a plain npm i @odatano/core installs it. ^2.0.0 does not match a pre-release, so pin @odatano/core@2.0.0-rc.3; to stay on 1.x pin @odatano/core@^1.11.0.
Breaking Peer dependency is now @sap/cds >=10 (was ^9) and Node.js ≥ 22.5 (@cap-js/sqlite v3 / node:sqlite). CAP 10 serializes Decimal, Int64 and $count as JSON strings — clients parsing them as numbers must adapt. XSUAA: the $XSAPPNAME.Admin scope moves out of CardanoUser into a new CardanoAdmin role template (crawler / worker control). Database redeploy required — four new tables (CardanoSyncState, CardanoReorgLog, CardanoWorkerWallets, CardanoWalletJobs) plus a dedupKey column with unique constraint on the jobs table; without cds deploy the new services answer no such table.
Added Chain crawler / pre-sync (opt-in, CRAWLER_ENABLED / cds.requires.odatano-core.crawler): streams the chain forward from a configured start block into Blocks / Transactions (+ inputs, outputs, assets, metadata) so reads hit local data. Ogmios chain-sync with Blockfrost / Koios pagination fallback, parent-hash reorg recovery (intersection ladder recovers from forks slept through across a restart), cursor + audit log, cluster-safe via DB lease. New CardanoIndexerService (/odata/v4/cardano-indexer/): SyncState + ReorgLog, getStatus / pauseCrawler / resumeCrawler. Wallet worker (opt-in, WALLET_WORKER_ENABLED): asynchronous per-wallet queue build → sign → submit → confirm with software / HSM signers, DB-enforced idempotency (UNIQUE(walletId, kind, dedupKey)), durable pre-submit submitting state (a crash around submit can never double-pay — the exact stored CBOR is re-submitted, never rebuilt), lease heartbeat for the whole execution, exponential retry, confirmation tracker with rollback re-submit. New CardanoWorkerService (/odata/v4/cardano-worker/): SubmitWalletJob / CancelJob / GetJobStatus / GetWorkerStatus / PauseWorker / ResumeWorker; HSM-backed jobs require the configured signing role (403 ODATANO_FORBIDDEN). CAP events on both services (blockIndexed, reorg, jobConfirmed, jobFailed) — emitted after commit, fire-and-forget, no broker needed. KoiosBackend.getDrep on the new Koios schema.
Changed Test suite migrated from Jest to Vitest 4 — 1908 tests across 58 files, plus real-CAP integration suites for wallet worker and crawler. HarmonicLabs stack bumped (buildooor 0.2.9, cardano-ledger-ts ^0.5.6, cardano-costmodels-ts ~1.6.1, Plutus V3 cost model at 350 params); vendored keep-relevant.ts / auxiliary-data-patch.ts removed (fixed upstream). Dependency security pass — npm audit clean.
Fixed Full-branch hardening: shared tx-request parsers for all job kinds, crawler reorg guards (null-slot fork point, Blockfrost CHAIN_POINT_MISMATCH, Koios partial-batch rejection), confirmation-depth correctness across rollbacks, crash recovery / lease CAS, idempotency-key release for cancelled jobs; a crashed crawler resumes on restart instead of latching desiredRunning: false.
v1.11.0 - 2026-08-08 - Coin-Selection + Error-Handling Improvements
Changed Enhanced coin-selection logic and error handling in the Buildooor transaction path; Plutus V3 cost-model handling updated to the current parameter count (N_COST_MODEL_PLUTUS_V3). Vendored keep-relevant.ts removed — buildooor 0.2.9 ships the fixed keepRelevant upstream.
v1.10.0 - 2026-07-16 - Deadlock Guard + Deferred Submit
Added detachedTx() nested-transaction guard: bookkeeping writes fail fast with 503 NESTED_TX_TIMEOUT instead of deadlocking on nested in-process CAP calls. New deferSubmit parameter on the submit flow — verify + claim run on the caller’s transaction, the network submit happens after its commit; boot-time redrive of stranded submissions via the new signedTxCbor column (submission-finalizer.ts).
v1.9.5 - 2026-07-08 - Stricter assetUnit Validation
Fixed assetUnit validation enforces the policyId prefix and rejects inputs that would silently truncate asset names.
v1.9.4 - 2026-07-05 - keepRelevant Coin Selection + Clearer Build Errors
Added keepRelevant coin-selection strategy (fixes several defects of the previous selection); extractTxCacheTargets derives input refs + output addresses from tx CBOR for targeted cache invalidation.
Changed InsufficientFundsError accepts a detail message; mapBuilderError surfaces the builder’s own message instead of generic “required 0, available 0” and appends build-flow context. Local Buildooor patch dropped.
v1.9.3 - 2026-06-28 - Backend-Init Resilience
Fixed Backend initialization hardened: timeout on Ogmios init (no more boot hangs on a dead socket), exponential-backoff retry for transient errors, HTTP keep-alive disabled on the Ogmios health probe. CI now tests Node 22/24 (Node 20 EOL removed).
v1.9.2 - 2026-06-26 - Typed Script Parameters
Added applyScriptParameters accepts typed entries { "uplc": "data" | "bytes" | "int" | "bool" | "unit", "value": … }, applied as native UPLC constants instead of always as Data — required for compilers that type scalar params natively (e.g. Pebble PubKeyHash). Bare PlutusData entries remain shorthand for data; existing scriptParamsJson inputs produce byte-identical scripts.
v1.9.1 - 2026-06-16 - CIP-30 signData Verification
Added VerifyDataSignature action on CardanoSignService — verifies CIP-30 signData COSE_Sign1 payloads (new cose-verifier.ts), including address binding checks.
v1.9.0 - 2026-06-14 - Hardening Pass: Resilience, Schema Correctness & Durable Signing
Changed All 20 read-service entity projections are now @readonly — external CREATE/UPDATE/DELETE return HTTP 405 instead of mutating the authoritative cache. Schema data-type corrections visible in $metadata: Unix-second timestamps (Epochs/Transactions/Assets/AssetHistory time + slot columns) Integer → Integer64 (fixes 2038 overflow), TransactionMetadata.id → Integer64, MetadataLabel String(5) → String(20), Assets.assetNameHex → String(64), key columns → bounded Bech32; Pools/Dreps/Assets now temporal. GetAssetHistory limit clamped 1-100; asset-name regex tightened to the 32-byte ledger cap; SubmitSignedTransaction now verifies its network param.
Added UTxO-only indexing fallback so an Ogmios-only deployment can serve GetUTxOsByAddress; SigningInstructions.cardanoCliCommand recipe; getStatus().backends; per-backend unsupportedMethods capability declarations.
Fixed Durable, crash-safe signing/submit (3-phase commit; atomic pending→signed claim; signature verification bound to the body’s required_signers + fee-payer key). Buildooor hardening: null-guarded protocol params, cost-model arrays converted to named-key form, datum preimages carried into witness set, smarter collateral selection, UTF-8-safe metadata chunking, UPLC V1/V2 scripts rejected instead of mis-hashed as V3. Backend pagination (Blockfrost ...All variants, Koios sort/batch) and Ogmios data-correctness fixes (Ratio parsing, account lovelace, no fabricated placeholders). Error-status corrections (404/400/503). All 4xx responses exempt from the circuit breaker; callWithResilience wraps single-backend paths (timeouts on evaluateTransaction).
Internal 35 suites (25 unit + 10 integration), 1549 tests, 96.58% statement coverage. Type-aware ESLint.
v1.8.0 - 2026-06-09 - Drop CSL; Buildooor Is the Sole TX Builder
Removed @emurgo/cardano-serialization-lib-nodejs (CSL) dropped entirely (−2806 lines, one fewer native WASM dep). Source csl-tx.ts + tx-builder-registry.ts and their tests removed.
Changed Buildooor (@harmoniclabs/buildooor) is now the only transaction builder — CardanoTransactionBuilder constructs BuildooorTxBuilder directly. The txBuilders config / TX_BUILDERS env var is still accepted for backward compatibility but is a no-op (any value resolves to Buildooor). No public OData action signatures changed. Tx-body hashing + Ed25519 signature verification ported onto @harmoniclabs/cbor + @harmoniclabs/crypto; the body hash is blake2b_256 over the original body bytes (no re-serialization), so it always matches what was signed.
Fixed The long-standing Plutus V3 PPViewHashesDontMatch bug is resolved by construction — Buildooor computes the correct scriptDataHash for both mint and spend. Unsigned builds no longer abort on a local script-evaluation failure (on-chain validation at submit stays authoritative). Defensive witness-pair parsing; odd-length hex CBOR rejected with a clear error.
v1.7.9 - 2026-05-15 - Koios getCurrentSlot Wire-Shape Fix
Fixed Koios /block_info mapper read slot_no / epoch_slot_no — keys Koios has never returned; corrected to abs_slot / epoch_slot. This had made getCurrentSlot() throw on every Koios chain-tip query (cascading into x402 nonce checks and ttl-bounded tx builds).
Changed KoiosBackend.getCurrentSlot() rewritten to read /tip directly (one round-trip instead of two; avoids a read-replica race on freshly-minted tips).
v1.7.8 - 2026-05-13 - Slot + UTxO Convenience Methods
Added CardanoClient.getCurrentSlot() (non-null slot, throws ProviderUnavailableError on null) and CardanoClient.isUtxoUnspent(txHash, outputIndex) with per-backend implementations (Blockfrost consumed_by_tx, Koios /utxo_info, Ogmios queryLedgerState/utxo).
Changed Generic Error throws upgraded to typed ProviderUnavailableError / TransactionValidationError so the circuit breaker registers backend failures and builders surface HTTP 400 instead of 500.
v1.7.7 - 2026-05-06 - Self-Hosted Blockfrost-Compatible Backends
Added blockfrostCustomBackend config option / BLOCKFROST_CUSTOM_BACKEND env var to point the Blockfrost backend at a self-hosted node (Dolos MiniBF, Demeter Self-Hosted, or compatible proxy); API key becomes optional, 'self-hosted' sent as project_id.
Changed BLOCKFROST_API_KEY is not set warning fires only when both key and custom backend URL are empty.
v1.7.6 - 2026-05-02 - Inline Datums + Credential Queries + Asset Info
Added inline-datum hydration on AddressUTxOs (inlineDatumToHex normalizes across backends), GetUTxOsByCredential (UTxOs across all bech32 forms of a payment credential), Assets entity + GetAssetInfo, AssetHistory entity + GetAssetHistory, Addresses.utxoCount.
Changed inline-datum format harmonized across backends; removed Buildooor _parseInlineDatum dead code.
v1.7.5 - 2026-04-27 - CBOR Parsing + Script Address Utilities + Validity Bounds
Added ParseTransactionCbor, DeriveScriptAddress, ExtractPaymentKeyHash, lockOnScript on Plutus spend, validity-window bounds (validityStartMs / validityEndMs).
Fixed Buildooor input-side dataHash / scriptRef preservation, CSL forcedInputsUsed accuracy.
New module srv/cbor/.
v1.6.1 - 2026-04-18 - CIP-33 Reference Scripts + Buildooor 0.2.6
Added referenceScriptHex on all Build actions (incl. per-extraOutputsJson entry), input-side refScript preservation for Buildooor + Koios.
Changed Buildooor 0.1.28 → 0.2.6, costmodels-ts 1.4.0 API migration (removed .toBuffer() calls).
Known Hash-only scriptRef from Blockfrost / Ogmios; CSL still rejects __INPUT_IDX__.
v1.0 - 2026-03-12 - First Production Release
Added request coalescing, expanded test coverage.
Changed hardened error handling, protocol params refresh, Koios resilience, @requires: 'authenticated-user' on all 3 services.
v0.3-milestone3 - 2026-02-26 - External Signing & SAP Integration
Added CardanoSignService (3rd CDS service) with 8 actions, external signing module, CIP-30 wallet integration, HSM (PKCS#11) signing (SignWithHsm, SignAndSubmitWithHsm, GetHsmStatus), centralized App Context, BuildPlutusSpendTransaction, SetCollateral, parameterized validators (scriptParamsJson, requiredSignersJson, inlineDatumJson, lockOnScript, mintRedeemerJson, fingerprint).
v0.2-milestone2 - 2025-01-25 - Transaction Build & Submit
Added dual-builder architecture (CSL + Buildooor), 6 transaction actions (BuildSimpleAdaTransaction, BuildTransactionWithMetadata, BuildMintTransaction, BuildMultiAssetTransaction, SubmitTransaction, SubmitSignedTransaction), Ogmios live backend, transaction error classes.
v0.1-milestone1 - 2024-12-29 - OData Read Service
Added OData V4 read service, 18 entities, 15 read actions, multi-provider architecture (Blockfrost + Koios), lazy on-demand indexing, network-aware bech32 validation.