SDK pointers

Locked

Exchange integrations should pin the exact SDK artifact and testnet genesis they certify. The TypeScript and Rust implementations share protocol concepts, but their current versions and distribution are not lockstep.

Availability

Artifact	Current documented posture
`@monolythium/core-sdk`	Published to npm at `0.6.8`
`monolythium-core-sdk`	Pin an audited Git revision or workspace path; no crates.io release is claimed here

pnpm add --save-exact @monolythium/[email protected]

No Rust dependency snippet is published here: this repository does not continuously compile one against a released crates.io artifact. Any future source-pinned Rust example must be labeled unreleased and tested at its exact audited revision.

What to use the SDK for

typed address parsing and rendering for the documented mono* HRPs;
ML-DSA-65 signature and public-key handling;
the verified read-only RPC request and response types documented on this site;
wallet-auth-v1 verification where an exchange offers address-bound web sessions.

Always verify the exact exported symbol against the pinned package. Do not copy older examples that name transaction builders, provider adapters, fee fields, or submission methods without checking that they exist in the installed version and match the target node cohort.

Exchange trust boundary

An SDK install does not authenticate a node. Pin:

chain ID and full genesis hash from the chain registry;
node binary/runtime provenance;
SDK package version and integrity;
the exact deposit, withdrawal, receipt, and finality behavior exercised by your certification harness.

Wallet-auth v1 is not deposit or withdrawal authorization. A valid proof can create an application session, but it cannot approve a transfer or substitute for the exchange’s custody controls.

Unreleased surfaces

Do not treat generic commerce encoders/readers, RunbookPlanV1, Stele economic writes, or agent signing policies as part of an exchange integration until separately released and activated.