ckb-session-kit 2.0.0 → 2.2.0

package/CHANGELOG.md

@@ -3,6 +3,99 @@
 This project follows [semantic versioning](https://semver.org/). The session lock is
 deployed on CKB **testnet only**; there is no mainnet deployment yet.
 
+## 2.2.0 (2026-11-07)
+
+### Added
+- `minConfirmations` on `verifyAccess`, `verifySubscription` and (as a new
+  fifth argument, `{ minConfirmations }`) `subscriptionStatus` (review, tracker
+  #47 point 5). Default 0: committed is enough, exactly as before, with no
+  extra RPC call. Confirmations are `tip - block + 1` (the payment's own block
+  is the first). A payment valid in every other way but short of the depth
+  gives `{ ok: false, code: "unconfirmed", reason, confirmations,
+  minConfirmations }`; one whose block is no longer on the main chain (the
+  node's header at that height, read without cache, has another hash) gives
+  `code: "reorged"`. The tip is read once per call. In `subscriptionStatus` an
+  opening short of the depth is refused that way, and a charge short of it does
+  not renew yet: it shows as `status.unconfirmedThroughBlock`.
+- `MAX_MIN_CONFIRMATIONS` (10000) and the `ConfirmationFault` type. A
+  `minConfirmations` that is negative, fractional, not a number or bigint, or
+  past the maximum throws a `RangeError` before any RPC call.
+- Build pinning for type-id owner locks (review, tracker #47 point 2).
+  `openSession` and `openSubscription` read the live code cell of an Omnilock,
+  JoyID or Nostr owner lock referenced by type id and compare `ccc.hashCkb` of
+  its data with the new `REVIEWED_OWNER_LOCK_BUILDS` (type `OwnerLockBuild`):
+  mainnet Omnilock `0x768f3066…118d`, JoyID `0x4af7d832…1ebe`, Nostr lock
+  `0x2effea19…9795`, and the builds deployed on testnet. A build not listed
+  raises a `SessionWarning` with code `"owner-lock-build-unreviewed"` and the
+  observed `dataHash`; a code cell that cannot be read raises
+  `"owner-lock-build-unresolved"`. Neither refuses: throw from `onWarning` to
+  stop. One indexer query per opening for these three locks; none for others.
+  `checkOwnerLockBuild(lock, client, reviewed?)` runs the check alone.
+  `openSubscription` takes `onWarning` too.
+
+### Changed
+- `AccessCheck`, `SubscriptionCheck` and `subscriptionStatus`'s result add the
+  `ConfirmationFault` variant; the plain `{ ok: false, reason }` variant has
+  `code?: undefined`, so `r.code === "unconfirmed"` narrows. Callers that only
+  read `ok` and `reason` need no change.
+
+### Docs
+- `docs/design/owner-locks.md` (review, tracker #47 point 2): every unlocking
+  path of each owner lock `assertSigningLock` accepts, what it signs, and
+  whether it is accepted, from the deployed code (Omnilock `cd764d7`, the
+  genesis secp256k1 and multisig scripts, nostr-lock `eef134e`; JoyID from its
+  documentation only). No accepted path signs less than the whole transaction;
+  the mainnet Omnilock has no CoBuild/open-transaction code. README, "Which
+  wallets can own a session": never sign a partial transaction with a lock that
+  owns sessions, and type-id upgrades of Omnilock, JoyID and the Nostr lock
+  apply to open sessions.
+- `docs/design/subscriptions.md`, "How a payment history is reconstructed"
+  (review, tracker #47 point 4): which transactions renew a period (the proven
+  opening, or a charge, and either must pay `payTo` the prices of the cells it
+  creates), why cells a third party creates under the same lock add no period,
+  how the scan and history budgets refuse rather than answer from a partial
+  read, and what a forced refusal costs and how it is cleared, with file:line
+  and test references. New test: a stranger's transaction that pays `payTo`
+  and carries the account memo in its own witness is refused as an opening.
+- README, "If the page is compromised" (tracker #47 point 5): the session key
+  is raw hex in JavaScript memory and IndexedDB, so same-origin script can read
+  it and sign within the lock's scope; what the lock still bounds on chain, what
+  browser expiry does not, and what an app should do (CSP, small budgets,
+  recipient and rate limit, server-side checks with `minConfirmations`, sweep
+  on suspicion).
+
+## 2.1.0 (2026-11-05)
+
+### Added
+- `fundInSession` and `sendWithSession`: fund a transaction the app built (its
+  own inputs, typed outputs, cell deps and witnesses) from a session without a
+  recipient, with no wallet prompt. The key cell pays the fee (default 2000
+  shannons/KB, `DEFAULT_FUND_FEE_RATE`, the same on every retry). Refused
+  before signing: a session with an on-chain recipient, an input under the
+  owner's lock (owner mode), an outflow over `maxPerTx`. `sendWithSession`
+  retries only when the node names one of the session's own cells as spent, and
+  rethrows any other refusal (the app's own cell taken, an RBF refusal) for the
+  app's loop. For CrowdCell pledges (CKBuilder-projects#6).
+- `deadInputs` exported, `FundedTransaction`, `FundOptions`,
+  `SendWithSessionOptions` types, and `SessionPolicyError` reasons
+  `"session-has-recipient"`, `"owner-lock-input"`, `"app-tx-shape"`.
+- CKB-VM tests of a session-funded pledge against CrowdCell's live testnet
+  scripts (`scripts/fetch-crowdcell.ts` saves them; not committed), and
+  `npm run smoke:fund-pledge`.
+- `npm run smoke:pool-lag`: how long `get_live_cell(include_tx_pool=true)`
+  still shows a just-spent input live, per answering node (mentor review,
+  tracker #47, 3 Nov). On one node (testnet.ckb.dev) the node that took the
+  send never showed the input live (158 polls); on testnet.ckbapp.dev (two
+  backends) only the other backend did, in 13 of 20 sends, for up to about
+  0.5 s. One kept-alive socket does not pin a backend there. Logs and table in
+  docs/SECURITY-EVIDENCE.md.
+
+### Documentation
+- JoyID is accepted as an owner lock but reviewed from its documentation only:
+  its contract is closed source. README and docs/API.md show how an app refuses
+  JoyID owners itself before `openSession` (no option in the kit; no behaviour
+  change).
+
 ## 2.0.0 (2026-11-03)
 
 ### Upgrading from 1.0.0