fix(wallet-toolbox): StorageIdb empty array filters match everything, like StorageKnex

docs/packages/wallet/wallet-toolbox-client.md

@@ -77,6 +77,11 @@ negotiated compact binary JSON codec. Legacy peers retain numeric-array JSON
 and identical transaction/proof bytes. Authentication and payload ceilings
 remain unchanged; upgrade both clients and active storage for the savings.
 
+IndexedDB treats empty certificate certifier/type, transaction status and
+output-tag ID arrays like omitted optional filters, matching Knex. Nonempty
+arrays, partial predicates and user ownership remain enforced. No API, wire
+or database migration is required.
+
 ## Backup and recovery
 
 Recover both key material and wallet records; a manager snapshot or device

docs/packages/wallet/wallet-toolbox.md

@@ -24,6 +24,11 @@ negotiated compact binary JSON codec. Legacy peers retain numeric-array JSON
 and identical transaction/proof bytes. Authentication and payload ceilings
 remain unchanged; upgrade both clients and active storage for the savings.
 
+IndexedDB treats empty certificate certifier/type, transaction status and
+output-tag ID arrays like omitted optional filters, matching Knex. Nonempty
+arrays, partial predicates and user ownership remain enforced. No API, wire
+or database migration is required.
+
 ## Optional registry descriptions
 
 ProtoMap, BasketMap and CertMap supply descriptive metadata, not permission grants.

governance/package-release-notes.json

@@ -210,15 +210,15 @@
       "name": "@bsv/wallet-toolbox",
       "publishedVersion": "2.14.5",
       "releaseType": "patch",
-      "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. BRC-177 anchors fund both the protected action and an economic reclaim. Protected actions pay the bounded reclaim allowance surplus as fee and produce no automatically generated wallet change; ordinary change planning and its positive output cap remain unchanged. BEEF request data and schema-declared storage response bytes use the existing negotiated compact binary JSON encoding. Legacy peers retain numeric-array JSON, existing authentication and payload bounds, and byte-for-byte transaction/proof content.",
-      "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply."
+      "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Adds an SDK3 peer alternative while retaining the existing SDK2.8.0 floor. Public Argon2id declarations reference the typed hash-wasm package while retaining the same generic binary/string contract and emitted runtime bytes. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. BRC-177 anchors fund both the protected action and an economic reclaim. Protected actions pay the bounded reclaim allowance surplus as fee and produce no automatically generated wallet change; ordinary change planning and its positive output cap remain unchanged. BEEF request data and schema-declared storage response bytes use the existing negotiated compact binary JSON encoding. Legacy peers retain numeric-array JSON, existing authentication and payload bounds, and byte-for-byte transaction/proof content. IndexedDB treats empty certificate certifier/type, transaction status and output-tag ID arrays as unrestricted optional filters, matching Knex. Nonempty filters, partial predicates and user ownership remain enforced.",
+      "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply. No API, wire or schema migration is required for the IndexedDB filter fix. Empty optional arrays now behave like omitted filters. Applications still receive only records allowed by their user and partial predicates; nonempty arrays retain their restrictions."
     },
     {
       "name": "@bsv/wallet-toolbox-client",
       "publishedVersion": "2.14.5",
       "releaseType": "patch",
-      "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. BRC-177 anchors fund both the protected action and an economic reclaim. Protected actions pay the bounded reclaim allowance surplus as fee and produce no automatically generated wallet change; ordinary change planning and its positive output cap remain unchanged. BEEF request data and schema-declared storage response bytes use the existing negotiated compact binary JSON encoding. Legacy peers retain numeric-array JSON, existing authentication and payload bounds, and byte-for-byte transaction/proof content.",
-      "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply."
+      "summary": "WalletPermissionsManager retires signed no-send ownership and reference aliases after createAction or signAction reports sending or unproven, including sendWith-only calls and successful members of an undelayed review error. Failed or unreported actions retain their originator binding for retry or abort. Cleanup visits only the retired transaction's references and preserves aliases reused by newer actions. Fixes WAB faucet redemption for an empty wallet when storage adds a service charge. Local signer decisions for independently validated commission and derived change are retained privately through the permissions wrapper and bound by the SDK before signing. UMP pins anchor verified token-update lineage: password and token updates supersede their pinned predecessor, while unrelated historical continuations cannot override the anchor. Explicit overlay history is linked past confirmed Merkle anchors. Updates with missing pin ancestry remain indeterminate instead of selecting an unrelated continuation. Every retained token spend proves control through its unlocking script, including confirmed updates and hash rotation; funding paths do not establish token lineage. BRC-177 anchors fund both the protected action and an economic reclaim. Protected actions pay the bounded reclaim allowance surplus as fee and produce no automatically generated wallet change; ordinary change planning and its positive output cap remain unchanged. BEEF request data and schema-declared storage response bytes use the existing negotiated compact binary JSON encoding. Legacy peers retain numeric-array JSON, existing authentication and payload bounds, and byte-for-byte transaction/proof content. IndexedDB treats empty certificate certifier/type, transaction status and output-tag ID arrays as unrestricted optional filters, matching Knex. Nonempty filters, partial predicates and user ownership remain enforced.",
+      "migration": "No public API, wire, database, or consumer migration is required. Pending no-send actions and retryable failures retain the same originator-bound abort behavior; positively queued or broadcast actions no longer retain session ownership records. Upgrade the SDK to a release exposing completeBoundAction.outputAuthorizationVersion=1 alongside wallet-toolbox 2.14.6. SDK2 peers keep their existing strict behavior; they do not obtain this fee-bearing faucet fix. The main SDK3.1 candidate retains the separate SDK3 retirement migration; SDK2 hosts require a coordinated additive backport or that migration. Serialized or cross-package-instance result adapters discard local authority and fail closed. Signup interruption/retry persistence is unchanged; reconcile any previous faucet transaction before repeating a failed signup. No API or schema migration is required for pin continuity. Retire a support pin only after unpinned lookup independently returns the verified current token. Deploy overlay 2.6.4 plus overlay-topics 2.0.1 or an equivalent history decider for confirmed ancestry. Stored WAB pins remain lineage anchors; the client follows verified descendants without needing an administrative pin rewrite. No API, wire or database migration is required for the BRC-177 funding fix. A protected action can pay the difference between its delivery need and the reclaim floor as miner fee. Funding/reclaim fees remain the wallet owner's responsibility; upgrade the active storage implementation as well as client packages. No API, database or peer migration is required for compact BEEF transport. Upgrade clients and active storage to obtain both request and response savings; older peers retain ordinary JSON. Existing payload ceilings still apply. No API, wire or schema migration is required for the IndexedDB filter fix. Empty optional arrays now behave like omitted filters. Applications still receive only records allowed by their user and partial predicates; nonempty arrays retain their restrictions."
     },
     {
       "name": "@bsv/wallet-toolbox-mobile",

packages/wallet/wallet-toolbox/CHANGELOG.md

@@ -6,6 +6,10 @@ attention to changes that materially alter behavior or extend functionality.
 
 ## wallet-toolbox 2.14.7
 
+- IndexedDB empty certificate certifier/type, transaction status and output-tag
+  ID arrays mean no optional filter, matching Knex. Nonempty arrays, partial
+  predicates and user ownership remain enforced; no schema migration is required.
+
 - BEEF requests and schema-declared storage response bytes use the existing
   negotiated compact binary JSON codec. Legacy peers retain numeric-array
   JSON and identical transaction/proof bytes. Existing authentication and

packages/wallet/wallet-toolbox/src/storage/StorageIdb.ts

@@ -658,7 +658,7 @@ export class StorageIdb extends StorageProvider implements WalletStorageProvider
       args.paged?.offset ?? 0,
       args.paged?.limit,
       async r => {
-        if (args.tagIds != null && !args.tagIds.includes(r.outputTagId)) return false
+        if (args.tagIds != null && args.tagIds.length > 0 && !args.tagIds.includes(r.outputTagId)) return false
         if (!matchesOutputTagMapPartial(r, args.partial)) return false
         if (userId !== undefined) {
           const tagsForUser = await this.countOutputTags({
@@ -1614,8 +1614,8 @@ export class StorageIdb extends StorageProvider implements WalletStorageProvider
       args.paged?.offset ?? 0,
       args.paged?.limit,
       r => {
-        if (args.certifiers != null && !args.certifiers.includes(r.certifier)) return false
-        if (args.types != null && !args.types.includes(r.type)) return false
+        if (args.certifiers != null && args.certifiers.length > 0 && !args.certifiers.includes(r.certifier)) return false
+        if (args.types != null && args.types.length > 0 && !args.types.includes(r.type)) return false
         return matchesCertificatePartial(r, args.partial)
       },
       filtered
@@ -2014,7 +2014,7 @@ export class StorageIdb extends StorageProvider implements WalletStorageProvider
       async r => {
         if (args.from != null && r.created_at.getTime() < args.from.getTime()) return false
         if (args.to != null && r.created_at.getTime() >= args.to.getTime()) return false
-        if (args.status != null && !args.status.includes(r.status)) return false
+        if (args.status != null && args.status.length > 0 && !args.status.includes(r.status)) return false
         if (!matchesTransactionPartial(r, args.partial)) return false
         if (
           labelIds != null &&