Version Packages (#3198)

This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to master, this PR
will be updated.


# Releases
## @endo/bytes@1.0.0

### Major Changes

- [#3257](#3257)
[`dd45f4a`](dd45f4a)
Thanks [@kriskowal](https://github.com/kriskowal)! - Add `@endo/bytes`
package providing `concatBytes`, `bytesEqual`, `bytesFromText`,
`bytesToText`, `bytesToImmutable`, and `bytesFromImmutable` for
platform-neutral byte handling.
Built on `Uint8Array` with `TextEncoder`/`TextDecoder` captured once at
module load.
`bytesToImmutable` and `bytesFromImmutable` cross between mutable views
and the immutable `ArrayBuffer` shape produced by the
proposal-immutable-arraybuffer shim, so passable bytes can be carried
across vat boundaries.
    Hardened, SES-safe; usable across Node, XS, and browser realms.

The release is the first publish, going out as `1.0.0` from the `0.1.0`
workspace floor (major bump from a `0.x.y` baseline lands at `1.0.0`).

## @endo/base64@1.1.0

### Minor Changes

- [#3216](#3216)
[`7325bbe`](7325bbe)
Thanks [@kriskowal](https://github.com/kriskowal)! - `@endo/base64`'s
named exports (`encodeBase64`, `decodeBase64`, `atob`, `btoa`)
    are now frozen.
Consumers that previously assigned to or extended these exports will see
a
    `TypeError` under SES; read-only consumers are unaffected.

The shim entry point `@endo/base64/shim.js` (which `@endo/init/pre.js`
uses to
install `globalThis.atob` / `globalThis.btoa` before `lockdown()`) is
unchanged
    and continues to be safe to load pre-lockdown.

### Patch Changes

- [#3216](#3216)
[`7325bbe`](7325bbe)
Thanks [@kriskowal](https://github.com/kriskowal)! - `encodeBase64` and
`decodeBase64` now dispatch to the native
`Uint8Array.prototype.toBase64` and `Uint8Array.fromBase64` intrinsics
(TC39
proposal-arraybuffer-base64, Stage 4) on platforms that ship them,
falling back
    to the existing pure-JavaScript implementation otherwise.
Existing call sites pick up the speedup with no API change, and
`decodeBase64`'s
error messages (including any caller-supplied `name` and the failing
offset) are
    unchanged.

## @endo/compartment-mapper@2.2.0

### Minor Changes

- [#3150](#3150)
[`75253ad`](75253ad)
Thanks [@boneskull](https://github.com/boneskull)! - This adds a new
option, `additionalLocations`, to `mapNodeModules`. This option enables
addition of arbitrary packages to the resulting Compartment Map. It
enables execution of packages which need to dynamically load files from
Compartments which would otherwise not appear in the map. Specific
use-cases include tooling like Webpack and ESLint.

### Patch Changes

- [#2901](#2901)
[`69ca27c`](69ca27c)
Thanks [@kriskowal](https://github.com/kriskowal)! - Sweep
`makeFunctorFromMap` in `bundle.js` and `bundle-lite.js` to use
optional chaining and nullish coalescing for the alias lookup now that
[#1514](#1514) has completed. The
"unable to locate module" diagnostic now
distinguishes the alias-resolved case from the direct-key case, naming
    both the alias's resolved key and the original import key when the
    miss occurs via an alias.

- [#3201](#3201)
[`67ed1ce`](67ed1ce)
Thanks [@boneskull](https://github.com/boneskull)! - Compatibility fix
for passthrough-style wildcards in subpath exports.

- Updated dependencies
\[[`ad7a177`](ad7a177),
[`f2aa55a`](f2aa55a),
[`fa0b6a9`](fa0b6a9),
[`459347b`](459347b)]:
    -   @endo/hex@1.1.0
    -   ses@2.1.0

## @endo/eslint-plugin@2.5.0

### Minor Changes

- [#3255](#3255)
[`638306e`](638306e)
Thanks [@kriskowal](https://github.com/kriskowal)! - Migrate the bundled
`@endo/imports` ESLint config off the unmaintained
`eslint-plugin-import` and onto the actively-maintained
`eslint-plugin-import-x` soft fork.
This is done via a Yarn package alias (`eslint-plugin-import:
'npm:eslint-plugin-import-x@4.16.2'` in the `dev` catalog), so the
package on disk is still named `eslint-plugin-import` and ESLint
continues to register its rules under the existing `import/*` namespace.
The import-x implementation ships its own `unrs-resolver`, which
natively honours the `package.json` `exports` field, so the explicit
`import/resolver` settings block is no longer required and has been
removed.
Downstream consumers do not need to rename any `import/*` rule
references; existing `eslintrc` snippets continue to work.

### Patch Changes

- [#3274](#3274)
[`e153a5a`](e153a5a)
Thanks [@kriskowal](https://github.com/kriskowal)! - `harden-exports`
now collects export names from all binding pattern shapes
    that may appear on the left-hand side of `export const ... = ...`:
aliased object destructuring (`{ propName: aliasName }`), object and
array
rest, nested patterns, sparse holes, and default-value assignment
patterns.
A new `unknownBindingPattern` report surfaces any pattern type the
helper
    does not recognize, in place of silent passthrough.

## @endo/evasive-transform@2.2.0

### Minor Changes

- [#3131](#3131)
[`5c098c4`](5c098c4)
Thanks [@naugtur](https://github.com/naugtur)! - - Add `customVisitor`
option - a visitor function to be called on each node of the Babel
traverse, in addition to the standard transforms in evasive-transform.
Receives the same path argument as a normal Babel visitor.
- Add an evasion for a class or object method being named `import` or
`eval`

## @endo/hex@1.1.0

### Minor Changes

- [#3208](#3208)
[`ad7a177`](ad7a177)
Thanks [@kriskowal](https://github.com/kriskowal)! - Add `@endo/hex`
package providing `encodeHex` and `decodeHex` as a ponyfill for the TC39
`Uint8Array.prototype.toHex` and `Uint8Array.fromHex` intrinsics
(proposal-arraybuffer-base64, Stage 4).
Dispatches to the native intrinsics at module load when available,
falling through to a portable pure-JavaScript implementation elsewhere.

## @endo/marshal@1.10.0

### Minor Changes

- [#3265](#3265)
[`45d06cd`](45d06cd)
Thanks [@kriskowal](https://github.com/kriskowal)! - Add
`compareRankRemotablesTied` and `compareAntiRankRemotablesTied`,
which behave like `compareRank` and `compareAntiRank` except that they
treat all remotables as tied for the same rank instead of
short-circuiting
the comparison on encountering a remotable. Make the `compare` parameter
    optional on `isRankSorted`, `assertRankSorted`, `sortByRank`,
    `getIndexCover`, `unionRankCovers`, and `intersectRankCovers`,
    defaulting to `compareRankRemotablesTied`.

The following parameter orders change so the optional comparator lands
    at the end:

    -   `getIndexCover(sorted, compare, rankCover)` →
        `getIndexCover(sorted, rankCover, compare?)`
    -   `unionRankCovers(compare, covers)` →
        `unionRankCovers(covers, compare?)`
    -   `intersectRankCovers(compare, covers)` →
        `intersectRankCovers(covers, compare?)`

    These are breaking changes to helpers that have no known external
    callers within the Endo monorepo. Within the monorepo, the only
    callers of `unionRankCovers` and `intersectRankCovers` are in
    `@endo/patterns`'s `patternMatchers.js`, which has been updated to
    match the new parameter order.

    Salvaged from <#2871> so that the
codec-admission core of that PR (now in
[#3226](#3226)) can land
independently
    of this rank-comparison refactor.

## @endo/ocapn@1.1.0

### Minor Changes

- [#3256](#3256)
[`bdb9ddc`](bdb9ddc)
Thanks [@kriskowal](https://github.com/kriskowal)! - - Add a `framing`
option to `makeTcpNetLayer` (`@endo/ocapn/netlayer/tcp-testing`). The
default is `'syrup'`, which wraps each message in the
`<length>:<payload>` framing implemented by `@endo/syrup-frame`. This is
the framing the OCapN TCP-for-testing netlayer is moving toward (cf. the
2025-12-09 OCapN plenary,
<https://github.com/ocapn/ocapn/blob/main/meeting-minutes/2025-12-09.md>),
and is robust to TCP chunk boundaries that split a single OCapN message.
Pass `framing: 'none'` to interoperate with the existing
`ocapn/ocapn-test-suite` Python `testing_only_tcp` netlayer, which
writes a syrup-encoded record with `sendall` and reads one back with
`syrup.syrup_read` (no length prefix on the wire). The `'none'` option
exists only for that suite's sake and goes away once the suite either
adopts syrup framing or is retired.

- [#3192](#3192)
[`08b077d`](08b077d)
Thanks [@kumavis](https://github.com/kumavis)! - Sync `@endo/ocapn` with
[ocapn-test-suite](https://github.com/ocapn/ocapn-test-suite) at commit
[74db78f08a40efba1e2b975d809374ff0e7acf60](ocapn/ocapn-test-suite@74db78f)
(2026-02-25).

- GC operations use list payloads (`exportPositions` / `wireDeltas`,
`answerPositions`); wire labels `op:gc-exports` and `op:gc-answers`.
- Remove `op:deliver-only`; fire-and-forget delivery uses `op:deliver`
with `answerPosition` and `resolveMeDesc` set to `false`.
- Codec refactors: `makeOcapnFalseForOptionalCodec` for optional `false`
branches, homogeneous Syrup lists via `makeListCodecFromEntryCodec`, and
related cleanup in operations and peer location hints.

CI integration for the Python test suite is pinned to the same commit.

- [#3209](#3209)
[`20f9e21`](20f9e21)
Thanks [@kumavis](https://github.com/kumavis)! - - Add a WebSocket
netlayer exported as `@endo/ocapn/netlayer/ws`
(`makeWebSocketNetLayer`). Used for interop with Guile-Goblins peers and
for any other transport that prefers a framed WebSocket over the raw TCP
test netlayer.
- Add `@endo/ocapn/netlayer/tcp-testing` to the package's `exports` map
so consumers can import the existing test netlayer without reaching into
`src/`.
- The main entry (`@endo/ocapn`) now re-exports `makeClient` and the
swissnum helpers `swissnumFromBytes` / `swissnumToBytes` so consumers
don't need a deep `src/client/...` import for the common case.
- `makeClient` accepts a new `logger` option; when omitted the existing
console-based logger is used, so this is backwards-compatible.
- The CapTP version-mismatch log on `start-session` now includes both
the received and expected version strings.

### Patch Changes

- Updated dependencies
\[[`ad7a177`](ad7a177),
[`dd45f4a`](dd45f4a),
[`45d06cd`](45d06cd),
[`38fe678`](38fe678)]:
    -   @endo/hex@1.1.0
    -   @endo/bytes@1.0.0
    -   @endo/marshal@1.10.0
    -   @endo/syrup-frame@0.1.1

## ses@2.1.0

### Minor Changes

- [#3284](#3284)
[`f2aa55a`](f2aa55a)
Thanks [@boneskull](https://github.com/boneskull)! - Allows
`Map.prototype.getOrInsert`, `Map.prototype.getOrInsertComputed`,
`WeakMap.prototype.getOrInsert` and
`WeakMap.prototype.getOrInsertComputed`.

### Patch Changes

- [#3223](#3223)
[`fa0b6a9`](fa0b6a9)
Thanks [@gibson042](https://github.com/gibson042)! - Addresses
infidelities and inefficiencies of
[#3214](#3214)

- [#3214](#3214)
[`459347b`](459347b)
Thanks [@erights](https://github.com/erights)! - Fixes bug
[#3202](#3202) repairing momentary
breakage of setFloat16 and setFloat32

## @endo/bundle-source@4.3.1

### Patch Changes

- [#3261](#3261)
[`7309d69`](7309d69)
Thanks [@turadg](https://github.com/turadg)! - Replace `ts-blank-space`
with Amaro for TypeScript type erasure, matching the parser Node.js uses
for type stripping.

- [#3216](#3216)
[`7325bbe`](7325bbe)
Thanks [@kriskowal](https://github.com/kriskowal)! - `@endo/base64`'s
named exports (`encodeBase64`, `decodeBase64`, `atob`, `btoa`)
    are now frozen.
Consumers that previously assigned to or extended these exports will see
a
    `TypeError` under SES; read-only consumers are unaffected.

The shim entry point `@endo/base64/shim.js` (which `@endo/init/pre.js`
uses to
install `globalThis.atob` / `globalThis.btoa` before `lockdown()`) is
unchanged
    and continues to be safe to load pre-lockdown.

- [#3237](#3237)
[`b845f85`](b845f85)
Thanks [@kriskowal](https://github.com/kriskowal)! - Update
`BundleOptions` and the `powers` parameter types to reflect what
    `bundleSource` already accepts at runtime: `cacheSourceMaps` is now
    documented on `BundleOptions`, `commonDependencies` and `importHook`
    (only for the `endoZipBase64` format) are surfaced, and the optional
    `powers` parameter accepts the wider `BundlePowers` shape (including
    `pathResolve`, `userInfo`, `env`, `platform`, and `computeSha512`).
    This is a JSDoc/typings-only change; no runtime behavior changes.

- Updated dependencies
\[[`7325bbe`](7325bbe),
[`7325bbe`](7325bbe),
[`69ca27c`](69ca27c),
[`5c098c4`](5c098c4),
[`67ed1ce`](67ed1ce),
[`75253ad`](75253ad)]:
    -   @endo/base64@1.1.0
    -   @endo/compartment-mapper@2.2.0
    -   @endo/evasive-transform@2.2.0

## @endo/captp@4.5.1

### Patch Changes

- [#2901](#2901)
[`69ca27c`](69ca27c)
Thanks [@kriskowal](https://github.com/kriskowal)! - Sweep
`makeFinalizingMap`'s `get` operator to use optional chaining
(`keyToRef.get(key)?.deref()`) now that
[#1514](#1514) has completed,
replacing
    the prior explicit conditional. Behavior is unchanged.
- Updated dependencies
\[[`45d06cd`](45d06cd)]:
    -   @endo/marshal@1.10.0

## @endo/patterns@1.9.1

### Patch Changes

- [#3265](#3265)
[`45d06cd`](45d06cd)
Thanks [@kriskowal](https://github.com/kriskowal)! - Add
`compareRankRemotablesTied` and `compareAntiRankRemotablesTied`,
which behave like `compareRank` and `compareAntiRank` except that they
treat all remotables as tied for the same rank instead of
short-circuiting
the comparison on encountering a remotable. Make the `compare` parameter
    optional on `isRankSorted`, `assertRankSorted`, `sortByRank`,
    `getIndexCover`, `unionRankCovers`, and `intersectRankCovers`,
    defaulting to `compareRankRemotablesTied`.

The following parameter orders change so the optional comparator lands
    at the end:

    -   `getIndexCover(sorted, compare, rankCover)` →
        `getIndexCover(sorted, rankCover, compare?)`
    -   `unionRankCovers(compare, covers)` →
        `unionRankCovers(covers, compare?)`
    -   `intersectRankCovers(compare, covers)` →
        `intersectRankCovers(covers, compare?)`

    These are breaking changes to helpers that have no known external
    callers within the Endo monorepo. Within the monorepo, the only
    callers of `unionRankCovers` and `intersectRankCovers` are in
    `@endo/patterns`'s `patternMatchers.js`, which has been updated to
    match the new parameter order.

    Salvaged from <#2871> so that the
codec-admission core of that PR (now in
[#3226](#3226)) can land
independently
    of this rank-comparison refactor.

- Updated dependencies
\[[`45d06cd`](45d06cd)]:
    -   @endo/marshal@1.10.0

## @endo/syrup-frame@0.1.1

### Patch Changes

- [#3256](#3256)
[`38fe678`](38fe678)
Thanks [@kriskowal](https://github.com/kriskowal)! - - New package
`@endo/syrup-frame`: a sibling of `@endo/netstring` that
    drops the trailing `,` separator, so each framed payload on the wire
    is literally a Syrup byte-string record (`<length>:<payload>`).
    -   Provides `makeSyrupReader` and `makeSyrupWriter` with the
        same shape as the netstring equivalents, including the `chunked`
        zero-copy writer mode.
    -   Intended for testing interoperability with the OCapN
        TCP-for-testing protocol, which has moved to adopt this framing.
        The framing is among the protocols under consideration in the
OCapN pre-standards group at time of writing; the 2025-12-09 OCapN
        plenary recorded the consensus that the TCP-for-testing netlayer
        should carry messages as length-prefixed Syrup byte strings

(<https://github.com/ocapn/ocapn/blob/main/meeting-minutes/2025-12-09.md>
        and the parallel discussion on ocapn/ocapn#104).

## @endo/daemon@3.0.0

### Major Changes

- [#3204](#3204)
[`291e224`](291e224)
Thanks [@gibson042](https://github.com/gibson042)! - Detect truncation
of Unix domain socket paths

### Patch Changes

- [#3171](#3171)
[`c372670`](c372670)
Thanks [@turadg](https://github.com/turadg)! - TypeScript 6 conformance:
public types in `types.d.ts` are now more precise.

- `Context.thisDiesIfThatDies` and `thatDiesIfThisDies` parameters
tightened from `string` to `FormulaIdentifier` (a branded string type).
- `RemoteControl.accept`/`connect` and
`RemoteControlState.accept`/`connect` take `remoteGateway:
ERef<EndoGateway>` (was `Promise<EndoGateway>`); `RemoteControl.connect`
now returns `ERef<EndoGateway>` (was `Promise<EndoGateway>`);
`RemoteControlState.connect` returns `{ state; remoteGateway:
ERef<EndoGateway> }`.
- `EndoInspector` generic type parameter renamed from `Record` to
`RecordT` to avoid shadowing the built-in `Record` utility type;
`lookup` and `list` now use method syntax so that `EndoInspector<'some
literal'>` remains assignable to `EndoInspector<string>` under
`strictFunctionTypes`.

TypeScript consumers implementing or calling these interfaces may need
to update their types accordingly.

- Updated dependencies
\[[`ad7a177`](ad7a177),
[`7325bbe`](7325bbe),
[`7325bbe`](7325bbe),
[`f2aa55a`](f2aa55a),
[`69ca27c`](69ca27c),
[`fa0b6a9`](fa0b6a9),
[`69ca27c`](69ca27c),
[`dd45f4a`](dd45f4a),
[`45d06cd`](45d06cd),
[`67ed1ce`](67ed1ce),
[`459347b`](459347b),
[`75253ad`](75253ad)]:
    -   @endo/hex@1.1.0
    -   @endo/base64@1.1.0
    -   ses@2.1.0
    -   @endo/captp@4.5.1
    -   @endo/compartment-mapper@2.2.0
    -   @endo/bytes@1.0.0
    -   @endo/marshal@1.10.0
    -   @endo/patterns@1.9.1

## @endo/cli@2.3.13

### Patch Changes

- Updated dependencies
\[[`ad7a177`](ad7a177),
[`7309d69`](7309d69),
[`7325bbe`](7325bbe),
[`b845f85`](b845f85),
[`c372670`](c372670),
[`291e224`](291e224),
[`dd45f4a`](dd45f4a),
[`45d06cd`](45d06cd)]:
    -   @endo/hex@1.1.0
    -   @endo/bundle-source@4.3.1
    -   @endo/daemon@3.0.0
    -   @endo/bytes@1.0.0
    -   @endo/patterns@1.9.1

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: kriskowal