Yangjunjie-Lin · Sep 13, 2026 · Sep 12, 2026 · Sep 13, 2026 · Sep 13, 2026 · Sep 13, 2026
diff --git a/.gitattributes b/.gitattributes
@@ -27,5 +27,6 @@ release/stable/v*/artifacts/android/*.aar binary
 release/stable/v*/artifacts/npm/*.tgz binary
 release/stable/v2.1.0/evidence/** text eol=lf
 release/stable/v2.1.0/artifacts/provenance/*.json text eol=lf
+release/stable/v2.1.0/publication-recovery/** text eol=lf
 device-lab/test-targets/sha256.json text eol=lf
 fixtures/alpha5/external-open-license/pdf417/ZXING-APACHE-2.0.txt text eol=lf
diff --git a/.github/workflows/v2.1-artifact-qualification.yml b/.github/workflows/v2.1-artifact-qualification.yml
@@ -2,10 +2,11 @@ name: v2.1 Artifact Qualification
 
 on:
   pull_request:
-    branches: [develop]
+    branches: [develop, main]
     paths:
       - .github/workflows/v2.1-artifact-qualification.yml
       - scripts/prepare-v2.1-npm-artifacts.mjs
+      - scripts/npm-provenance-identity.mjs
   workflow_dispatch:
     inputs:
       source_commit:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,7 @@ All notable changes follow semantic versioning.
 - Added explicit privacy modes and a default-disabled demo, with a same-origin rate/size/time-limited backend.
 - Existing barcode decoding remains local and independent of network analysis. Published 2.0.0 and 2.0.1 artifacts and historical evidence are unchanged.
 - Added source-bound independent npm and Native artifact rebuilds, detached CI provenance for the new package's 2FA-protected first publication, and immutable versioned qualification records. Actual publication is verified separately from qualification.
+- Completed all 11 npm 2.1.0 publications with exact downloaded-byte and cryptographic provenance verification. Preserved the initial Registry provenance rejection and its independently rebuilt, additive correction without changing the signed tag or frozen artifacts; appended the actual publication record.
 
 ## 2.0.1 — Scanner lifecycle and runtime hardening
 

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,6 +1,6 @@
 # Contributing
 
-Thank you for helping maintain Scanly's focused, local-first barcode scanning SDK scope. The public v2.0.1 format set is QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E.
+Thank you for helping maintain Scanly's focused, local-first barcode scanning SDK scope. The public v2.1.0 format set is QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E.
 
 ## Setup
 

diff --git a/README.md b/README.md
@@ -13,7 +13,7 @@ Privacy-first, local-only barcode scanning SDK for Web, Node.js, React, iOS, and
 
 ## Install
 
-The 2.1.0 release line is software-qualified. Registry publication is finalized separately through the signed release workflow; see the [release notes](docs/releases/v2.1.0.md) and versioned release records below.
+All 11 public SDK packages are published at 2.1.0 with verified provenance and exact frozen artifact hashes. See the [release notes](docs/releases/v2.1.0.md) and [immutable publication record](release/stable/v2.1.0/v2.1.0-publication-record.json).
 
 Choose the package for your runtime. Browser, Node, and React packages already include their required Scanly workspace dependencies.
 
@@ -181,6 +181,8 @@ Detailed Alpha, Beta, and RC development evidence is preserved in [development h
 
 - [v2.1.0 release notes](docs/releases/v2.1.0.md)
 - [v2.1.0 qualification manifest](release/stable/v2.1.0/v2.1.0-manifest.json)
+- [v2.1.0 publication record](release/stable/v2.1.0/v2.1.0-publication-record.json)
+- [v2.1.0 additive provenance correction](release/stable/v2.1.0/v2.1.0-provenance-recovery.json)
 - [v2.1.0 checksums](release/stable/v2.1.0/checksums.sha256)
 - [v2.1.0 SBOM](release/stable/v2.1.0/sbom.cdx.json)
 - [v2.0.1 release notes](docs/releases/v2.0.1.md)

diff --git a/SECURITY.md b/SECURITY.md
@@ -2,15 +2,16 @@
 
 ## Supported versions
 
-v2.0.1 is the current Stable release.
+v2.1.0 is the current Stable release.
 
 | Version | Security support |
 | --- | --- |
+| 2.1.x | Supported; current Stable line |
 | 2.0.x | Supported |
 | 1.x | Best-effort security fixes only |
 | Alpha, Beta, and RC builds | Unsupported historical development builds |
 
-Security fixes normally target the latest supported patch in the 2.0 line. Support does not expand the public API or physical-device qualification claims of a released version.
+Security fixes normally target the latest supported patch in the 2.1 line, with applicable fixes considered for supported 2.0.x releases. Support does not expand the public API or physical-device qualification claims of a released version.
 
 ## Reporting a vulnerability
 
@@ -34,4 +35,6 @@ Dependency audit results are recorded rather than hidden. Breaking forced upgrad
 
 The shipped SDK has no analytics, remote tracking, image upload, remote logging, or diagnostic endpoint. Image pixels and decoded content must not be logged by default. Any future diagnostics must be opt-in and redact both classes of data.
 
+The separate `@scanly/url-safety` module is disabled by default. Network analysis may share only an already-decoded HTTP(S) URL after explicit opt-in; scanner images and frames remain local. Remote inspection is server-only and SSRF-controlled. Provider secrets stay on the server, sensitive query values are redacted from diagnostics and LLM evidence, and LLM output cannot override authoritative threat intelligence. See [URL Safety security and privacy boundaries](docs/url-safety.md).
+
 See the [threat model](docs/security/threat-model.md) and [secure integration guide](docs/security/secure-integration.md).
diff --git a/docs/README.md b/docs/README.md
@@ -10,6 +10,7 @@
 ## API and capabilities
 
 - [Public API](sdk/public-api.md)
+- [Opt-in Link Intelligence / URL Safety](url-safety.md)
 - [API stability](sdk/api-stability.md)
 - [Error catalog](sdk/error-catalog.md)
 - [Cross-platform contract](sdk/cross-platform-contract.md)
@@ -36,10 +37,15 @@
 
 ## Migration, benchmarking, and release integrity
 
-- [Migrate from v1 to v2.0.1](migration/v1-to-v2.md)
+- [Migrate from v1 to v2.1.0](migration/v1-to-v2.md)
 - [Post-release Physical Device Validation](physical-device-validation.md)
 - [Benchmark methodology](benchmarking/methodology.md)
 - [Benchmark provenance](benchmarking/provenance.md)
+- [v2.1.0 release notes](releases/v2.1.0.md)
+- [v2.1.0 qualification manifest](../release/stable/v2.1.0/v2.1.0-manifest.json)
+- [v2.1.0 publication record](../release/stable/v2.1.0/v2.1.0-publication-record.json)
+- [v2.1.0 checksums](../release/stable/v2.1.0/checksums.sha256)
+- [v2.1.0 SBOM](../release/stable/v2.1.0/sbom.cdx.json)
 - [v2.0.1 release notes](releases/v2.0.1.md)
 - [v2.0.1 qualification manifest](../release/stable/v2.0.1/v2.0.1-manifest.json)
 - [v2.0.1 checksums](../release/stable/v2.0.1/checksums.sha256)

diff --git a/docs/maintenance.md b/docs/maintenance.md
@@ -1,6 +1,6 @@
 # Maintenance policy
 
-Scanly v2.0.1 is the current Stable SDK line. Maintenance prioritizes security, correctness, compatibility, performance, physical qualification, bug fixes, patch releases, and carefully scoped minor releases. New work must preserve the local-only privacy boundary and the public eight-format contract.
+Scanly v2.1.0 is the current Stable SDK line. Maintenance prioritizes security, correctness, compatibility, performance, physical qualification, bug fixes, patch releases, and carefully scoped minor releases. New work must preserve local barcode decoding, the separate opt-in URL Intelligence boundary, and the public eight-format contract.
 
 ## Supported toolchain
 
@@ -18,12 +18,12 @@ Scanly v2.0.1 is the current Stable SDK line. Maintenance prioritizes security,
 - Release qualification is recorded in versioned evidence committed through `develop`; only `main` and `develop` are retained as long-lived branches.
 - Immutable tags and evidence preserve released history; never move or rebuild a published tag.
 
-For a normal v2.0.1 bug fix:
+For a normal bug fix to the 2.1 line:
 
 ```text
 develop -> fix branch -> PR to develop
 -> versioned qualification evidence -> PR from develop to main
--> signed v2.0.1 tag -> GitHub Release -> npm / Native publication
+-> signed next-patch tag -> GitHub Release -> npm / Native publication
 -> synchronize main back into develop
 ```
 
@@ -61,7 +61,7 @@ Dependabot opens small npm and GitHub Actions groups. Merge security patches pro
 
 ## Physical qualification
 
-Automated browser, simulator, and emulator coverage is not physical-device qualification. The v2.0.0 physical validation program remains `POST_RELEASE_VALIDATION_PENDING` under Issue #13; v2.0.1 does not claim physical PASS or reinterpret those zero evidence counts.
+Automated browser, simulator, and emulator coverage is not physical-device qualification. The v2.0.0 physical validation program remains `POST_RELEASE_VALIDATION_PENDING` under Issue #13; neither v2.0.1 nor v2.1.0 claims physical PASS or reinterprets those zero evidence counts.
 
 When that program completes, do not modify v2.0.0 binaries or the qualification/publication records. Add `release/stable/v2.0.0-physical-qualification-record.json` containing the released artifact hashes, real device matrix, 30/60-minute soak evidence, and false-positive gate. The release evidence chain is Qualification → Publication → Physical Qualification.
 

diff --git a/docs/migration/v1-to-v2.md b/docs/migration/v1-to-v2.md
@@ -1,6 +1,6 @@
-# Migrating from Scanly v1 to v2.0.1
+# Migrating from Scanly v1 to v2.1.0
 
-Scanly v2.0.1 is the current Stable SDK. Migrate by selecting the runtime package instead of importing repository-internal v1 modules.
+Scanly v2.1.0 is the current Stable SDK. Migrate by selecting the runtime package instead of importing repository-internal v1 modules.
 
 ## Install a public package
 
@@ -40,7 +40,7 @@ Camera composition uses `BrowserCameraSource` and the ScannerSession runtime. Ca
 
 ## Formats and scenarios
 
-v2.0.1 supports QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E. The default remains QR-only for compatibility; opt into additional formats explicitly or use a multi-format built-in scenario.
+v2.1.0 supports QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E. The default remains QR-only for compatibility; opt into additional formats explicitly or use a multi-format built-in scenario.
 
 ```ts
 const router = createNodeCaptureRouter({
@@ -52,7 +52,7 @@ The lower-level `decodePixelBuffer` adapter requires a caller-supplied engine ex
 
 ## Native availability
 
-- iOS 13+: `ScanlySDK` source package under `native/ios` at tag `v2.0.1`.
-- Android API 24+: `scanly-sdk-2.0.1.aar` from the v2.0.1 GitHub Release for `arm64-v8a` and `x86_64`.
+- iOS 13+: `ScanlySDK` source package under `native/ios` at tag `v2.1.0`.
+- Android API 24+: `scanly-sdk-2.1.0.aar` from the v2.1.0 GitHub Release for `arm64-v8a` and `x86_64`.
 
 See the [iOS](../native/ios-getting-started.md) and [Android](../native/android-getting-started.md) guides. Physical-device qualification remains pending under Issue #13 and is not implied by automated simulator/emulator coverage.
diff --git a/docs/native/android-getting-started.md b/docs/native/android-getting-started.md
@@ -1,20 +1,20 @@
-# Scanly SDK v2.0.1 for Android
+# Scanly SDK v2.1.0 for Android
 
-Scanly SDK v2.0.1 is distributed as `scanly-sdk-2.0.1.aar` on the [v2.0.1 GitHub Release](https://github.com/Yangjunjie-Lin/Scanly/releases/tag/v2.0.1). Maven Central is **not published and not required for v2.0.1**; do not use `implementation("io.scanly:scanly-sdk:2.0.1")`.
+Scanly SDK v2.1.0 is distributed as `scanly-sdk-2.1.0.aar` on the [v2.1.0 GitHub Release](https://github.com/Yangjunjie-Lin/Scanly/releases/tag/v2.1.0). Maven Central is **not published and not required for v2.1.0**; do not use `implementation("io.scanly:scanly-sdk:2.1.0")`.
 
 ## Install the AAR
 
-1. Download `scanly-sdk-2.0.1.aar` from the GitHub Release.
-2. Place it at `app/libs/scanly-sdk-2.0.1.aar`.
+1. Download `scanly-sdk-2.1.0.aar` from the GitHub Release.
+2. Place it at `app/libs/scanly-sdk-2.1.0.aar`.
 3. Add the file dependency:
 
 ```kotlin
 dependencies {
-    implementation(files("libs/scanly-sdk-2.0.1.aar"))
+    implementation(files("libs/scanly-sdk-2.1.0.aar"))
 }
 ```
 
-Verify the AAR against `release/stable/v2.0.1/checksums.sha256` or the checksum attached to the GitHub Release before integration.
+Verify the AAR against `release/stable/v2.1.0/checksums.sha256` or the checksum attached to the GitHub Release before integration.
 
 ## CameraX quick start
 

diff --git a/docs/native/architecture.md b/docs/native/architecture.md
@@ -1,6 +1,6 @@
 # Native mobile architecture
 
-Scanly SDK v2.0.1 uses one shared ZXing-C++ decode implementation behind a
+Scanly SDK v2.1.0 uses one shared ZXing-C++ decode implementation behind a
 stable C ABI. The web runtime continues to use the pinned ZXing-C++ WASM
 adapter; Swift and Kotlin do not select independent decoder libraries.
 
@@ -29,7 +29,7 @@ and typed failures. Complex C++ types never cross the ABI.
 
 ## Session strategy
 
-v2.0.1 uses the platform-wrapper strategy for frame scheduling, lifecycle,
+v2.1.0 uses the platform-wrapper strategy for frame scheduling, lifecycle,
 latest-frame admission, repeat suppression, and stale-result discard. The
 portable C++ boundary remains decode-only. Cross-platform session behavior is
 constrained by deterministic contracts and may be converged further in a future minor release;

diff --git a/docs/native/compatibility.md b/docs/native/compatibility.md
@@ -1,21 +1,21 @@
 # Native compatibility
 
-Scanly Native SDK v2.0.1 is a Stable software release. Automated build and fixture coverage is verified; post-release physical qualification remains pending.
+Scanly Native SDK v2.1.0 is a Stable software release. Automated build and fixture coverage is verified; post-release physical qualification remains pending.
 
 | Target | Minimum / ABI | Distribution | Automated verification | Physical status |
 | --- | --- | --- | --- | --- |
-| iOS | iOS 13; Swift tools 5.9; current supported Xcode capable of Swift 5.9 packages | SPM source package at `native/ios` in tag `v2.0.1` | Swift build/test, simulator, unsigned device compilation | `POST_RELEASE_VALIDATION_PENDING` |
+| iOS | iOS 13; Swift tools 5.9; current supported Xcode capable of Swift 5.9 packages | SPM source package at `native/ios` in tag `v2.1.0` | Swift build/test, simulator, unsigned device compilation | `POST_RELEASE_VALIDATION_PENDING` |
 | Android | API 24; Java 17 | GitHub Release AAR | AAR, unit/lint, x86_64 emulator fixture smoke | `POST_RELEASE_VALIDATION_PENDING` |
 | Android ABI | `arm64-v8a`, `x86_64` | AAR native libraries | both `.so` entries required | `POST_RELEASE_VALIDATION_PENDING` |
 | `armeabi-v7a` | unsupported | not shipped | omission verified | `unsupported` |
 
 Supported public formats are QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E. Shared native fixtures cover all eight formats plus one two-symbol QR Code + Code 128 image.
 
-Distribution boundaries for v2.0.1:
+Distribution boundaries for v2.1.0:
 
 - Swift Package Manager source package: shipped under the immutable Git tag; use exact-tag checkout plus the local `native/ios` package path because the repository root has no Package.swift.
 - Android AAR: shipped through the GitHub Release.
 - CocoaPods and Maven Central: not published.
-- App Store, Google Play, React Native, and Flutter: not SDK distribution channels for v2.0.1.
+- App Store, Google Play, React Native, and Flutter: not SDK distribution channels for v2.1.0.
 
 Simulator or emulator PASS never implies physical iPhone or Android PASS. Any unavailable toolchain lane reports `NOT_RUN` or `NOT_TESTED`, not PASS. Physical validation continues under [Issue #13](https://github.com/Yangjunjie-Lin/Scanly/issues/13).
diff --git a/docs/native/cross-platform-wrapper-plan.md b/docs/native/cross-platform-wrapper-plan.md
@@ -1,6 +1,6 @@
 # React Native and Flutter wrapper plan
 
-Scanly v2.0.1 does not publish React Native or Flutter adapters. The Native APIs are
+Scanly v2.1.0 does not publish React Native or Flutter adapters. The Native APIs are
 kept wrapper-friendly by using immutable value results, typed platform errors,
 explicit decoder/session disposal, bounded multiple-result arrays, and the
 stable C ABI beneath both platforms.
@@ -16,4 +16,4 @@ with destroy and must copy borrowed result views before freeing the result set.
 
 Before either publication: freeze native API snapshots, run the unified shared
 fixture vectors, add wrapper lifecycle/memory soak, and complete physical
-validation. No wrapper publication is part of v2.0.1.
+validation. No wrapper publication is part of v2.1.0.
diff --git a/docs/native/ios-getting-started.md b/docs/native/ios-getting-started.md
@@ -1,13 +1,13 @@
-# ScanlySDK v2.0.1 for iOS
+# ScanlySDK v2.1.0 for iOS
 
-ScanlySDK v2.0.1 is a Stable Swift Package Manager source package for iOS 13+. CocoaPods is not a v2.0.1 distribution channel.
+ScanlySDK v2.1.0 is a Stable Swift Package Manager source package for iOS 13+. CocoaPods is not a v2.1.0 distribution channel.
 
 ## Install from the immutable tag
 
-The package manifest lives at `native/ios/Package.swift`, not the repository root. Swift Package Manager cannot resolve this repository as a remote versioned dependency using the root Git URL. For v2.0.1, check out the immutable tag and add the subdirectory as a local package:
+The package manifest lives at `native/ios/Package.swift`, not the repository root. Swift Package Manager cannot resolve this repository as a remote versioned dependency using the root Git URL. For v2.1.0, check out the immutable tag and add the subdirectory as a local package:
 
 ```bash
-git clone --branch v2.0.1 --depth 1 https://github.com/Yangjunjie-Lin/Scanly.git
+git clone --branch v2.1.0 --depth 1 https://github.com/Yangjunjie-Lin/Scanly.git
 ```
 
 In Xcode choose **File → Add Package Dependencies → Add Local** and select `Scanly/native/ios`, then add the `ScanlySDK` product to the app target. A Package.swift-based host can use a local path:
@@ -18,7 +18,7 @@ dependencies: [
 ]
 ```
 
-The checked-out `v2.0.1` tag is the version pin. Standard remote root-URL resolution such as `.package(url: ..., from: "2.0.1")` requires a root package manifest and is not supported by this repository layout.
+The checked-out `v2.1.0` tag is the version pin. Standard remote root-URL resolution such as `.package(url: ..., from: "2.1.0")` requires a root package manifest and is not supported by this repository layout.
 
 ## Decode
 

diff --git a/docs/platform-compatibility.md b/docs/platform-compatibility.md
@@ -1,6 +1,6 @@
 # Platform compatibility matrix
 
-Scanly v2.0.1 is the current Stable software line. The physical matrix below remains the post-release v2.0.0 qualification program tracked by Issue #13, not a publication gate and not a physical PASS claim for v2.0.1.
+Scanly v2.1.0 is the current Stable software line. The physical matrix below remains the post-release v2.0.0 qualification program tracked by Issue #13, not a publication gate and not a physical PASS claim for v2.1.0.
 
 Allowed runtime statuses are `verified`, `partially-verified`, `unsupported`, `unavailable`, and `not-tested`. `verified` means automated evidence unless a row explicitly identifies an admitted physical session.