ckb-session-kit 2.1.0 → 2.2.0

package/CHANGELOG.md

@@ -3,6 +3,67 @@
 This project follows [semantic versioning](https://semver.org/). The session lock is
 deployed on CKB **testnet only**; there is no mainnet deployment yet.
 
+## 2.2.0 (2026-11-07)
+
+### Added
+- `minConfirmations` on `verifyAccess`, `verifySubscription` and (as a new
+  fifth argument, `{ minConfirmations }`) `subscriptionStatus` (review, tracker
+  #47 point 5). Default 0: committed is enough, exactly as before, with no
+  extra RPC call. Confirmations are `tip - block + 1` (the payment's own block
+  is the first). A payment valid in every other way but short of the depth
+  gives `{ ok: false, code: "unconfirmed", reason, confirmations,
+  minConfirmations }`; one whose block is no longer on the main chain (the
+  node's header at that height, read without cache, has another hash) gives
+  `code: "reorged"`. The tip is read once per call. In `subscriptionStatus` an
+  opening short of the depth is refused that way, and a charge short of it does
+  not renew yet: it shows as `status.unconfirmedThroughBlock`.
+- `MAX_MIN_CONFIRMATIONS` (10000) and the `ConfirmationFault` type. A
+  `minConfirmations` that is negative, fractional, not a number or bigint, or
+  past the maximum throws a `RangeError` before any RPC call.
+- Build pinning for type-id owner locks (review, tracker #47 point 2).
+  `openSession` and `openSubscription` read the live code cell of an Omnilock,
+  JoyID or Nostr owner lock referenced by type id and compare `ccc.hashCkb` of
+  its data with the new `REVIEWED_OWNER_LOCK_BUILDS` (type `OwnerLockBuild`):
+  mainnet Omnilock `0x768f3066…118d`, JoyID `0x4af7d832…1ebe`, Nostr lock
+  `0x2effea19…9795`, and the builds deployed on testnet. A build not listed
+  raises a `SessionWarning` with code `"owner-lock-build-unreviewed"` and the
+  observed `dataHash`; a code cell that cannot be read raises
+  `"owner-lock-build-unresolved"`. Neither refuses: throw from `onWarning` to
+  stop. One indexer query per opening for these three locks; none for others.
+  `checkOwnerLockBuild(lock, client, reviewed?)` runs the check alone.
+  `openSubscription` takes `onWarning` too.
+
+### Changed
+- `AccessCheck`, `SubscriptionCheck` and `subscriptionStatus`'s result add the
+  `ConfirmationFault` variant; the plain `{ ok: false, reason }` variant has
+  `code?: undefined`, so `r.code === "unconfirmed"` narrows. Callers that only
+  read `ok` and `reason` need no change.
+
+### Docs
+- `docs/design/owner-locks.md` (review, tracker #47 point 2): every unlocking
+  path of each owner lock `assertSigningLock` accepts, what it signs, and
+  whether it is accepted, from the deployed code (Omnilock `cd764d7`, the
+  genesis secp256k1 and multisig scripts, nostr-lock `eef134e`; JoyID from its
+  documentation only). No accepted path signs less than the whole transaction;
+  the mainnet Omnilock has no CoBuild/open-transaction code. README, "Which
+  wallets can own a session": never sign a partial transaction with a lock that
+  owns sessions, and type-id upgrades of Omnilock, JoyID and the Nostr lock
+  apply to open sessions.
+- `docs/design/subscriptions.md`, "How a payment history is reconstructed"
+  (review, tracker #47 point 4): which transactions renew a period (the proven
+  opening, or a charge, and either must pay `payTo` the prices of the cells it
+  creates), why cells a third party creates under the same lock add no period,
+  how the scan and history budgets refuse rather than answer from a partial
+  read, and what a forced refusal costs and how it is cleared, with file:line
+  and test references. New test: a stranger's transaction that pays `payTo`
+  and carries the account memo in its own witness is refused as an opening.
+- README, "If the page is compromised" (tracker #47 point 5): the session key
+  is raw hex in JavaScript memory and IndexedDB, so same-origin script can read
+  it and sign within the lock's scope; what the lock still bounds on chain, what
+  browser expiry does not, and what an app should do (CSP, small budgets,
+  recipient and rate limit, server-side checks with `minConfirmations`, sweep
+  on suspicion).
+
 ## 2.1.0 (2026-11-05)
 
 ### Added

package/README.md

@@ -44,7 +44,7 @@ The problem is not specific to that application.
 npm install ckb-session-kit
 ```
 
-[ckb-session-kit on npm](https://www.npmjs.com/package/ckb-session-kit) (v2.1.0, ESM, Node 20 or later
+[ckb-session-kit on npm](https://www.npmjs.com/package/ckb-session-kit) (v2.2.0, ESM, Node 20 or later
 and browsers). The API is in [docs/API.md](docs/API.md); the walkthrough in
 [docs/WALKTHROUGH.md](docs/WALKTHROUGH.md).
 
@@ -514,6 +514,28 @@ await assertSigningLock(ownerLock, owner.client); // the kit's own check; openSe
 await openSession(owner, session, deployment, { budget });
 ```
 
+Owner-mode safety rests on the deployed code of the owner's lock, not only on
+this kit. Every unlocking path of each accepted lock, and what it signs, is
+listed in [docs/design/owner-locks.md](docs/design/owner-locks.md): in the
+accepted configurations every path signs the whole transaction, and the mainnet
+Omnilock build has no CoBuild or open-transaction mode. Two things follow:
+
+- **Never sign an open or partial transaction with a lock that owns sessions.**
+  Anyone holding that piece could spend your sessions with it.
+- **Omnilock, JoyID and the Nostr lock are deployed under type ids**, which
+  their deployers can upgrade. The review covers the code deployed on 5 Nov
+  2026; an upgrade that added a partial-signing mode would also apply to
+  sessions that are already open.
+
+`openSession` and `openSubscription` read the live code cell of an Omnilock,
+JoyID or Nostr owner lock and compare its data hash with
+`REVIEWED_OWNER_LOCK_BUILDS`, the builds reviewed above (mainnet and testnet).
+A build not in that list is reported as a warning (`"owner-lock-build-unreviewed"`,
+with the observed hash, to `onWarning` or `console.warn`), not refused, so a
+vendor upgrade does not stop sessions from opening; if the code cell cannot be
+read, the warning is `"owner-lock-build-unresolved"`. This covers new sessions
+only: one already open follows the type id.
+
 ## The on-chain session lock
 
 [`contracts/session-lock`](contracts/session-lock/src/main.rs) is a CKB lock script in
@@ -614,6 +636,44 @@ session](#which-wallets-can-own-a-session).
 A session-lock cell occupies 121 CKB (153 CKB with a recipient), so its balance
 and its change must stay above that.
 
+### If the page is compromised
+
+The session key is a raw secp256k1 private key, held as a hex string in
+JavaScript memory (`Session.privateKey`) and saved as such in IndexedDB by
+`indexedDbStore` (or kept in memory by `memoryStore`). Web Crypto has no
+secp256k1 keys, so it cannot be held as a non-extractable key. Any script
+running on the same origin (an XSS bug, a compromised dependency, an injected
+script) can read it, copy it off the device, and sign with it. Treat that as a
+leaked key: everything in [If a session key leaks](#if-a-session-key-leaks)
+applies. Such a script can also ask the connected wallet to sign; the wallet
+shows that prompt to the user.
+
+What still holds, because the lock enforces it on chain and not the page:
+
+- at most `max_per_tx` shannons leave the session per transaction, fees
+  included (and, in a token session, at most its token limit);
+- with a recipient, only to that recipient (or to the miner as fee); the key
+  cell may not grow;
+- with `min_interval`, once per interval per session cell;
+- the session's balance and the 62–64 CKB key cell are the most it can lose;
+  the owner's other cells are out of reach, since owner mode needs the owner's
+  own signature;
+- the owner can sweep at any time with `closeSession` or `recoverSessions`.
+
+What does not help: browser expiry (`expiresAt`) and clearing the store revoke
+nothing on chain; a copied key stays valid until the owner's sweep is confirmed.
+
+What an app should do:
+
+- serve a strict Content Security Policy and keep third-party scripts off the
+  origin that holds sessions (the demo's headers are in `demo/next.config.ts`);
+- keep budgets small, and set a recipient and `min_interval` where the app has
+  one payee;
+- check paid access on the server, from the chain (`verifyAccess`,
+  `subscriptionStatus`), never from what the page says, and pass
+  `minConfirmations` for anything valuable;
+- sweep at once on any suspicion, and sweep again if a spend raced it.
+
 ### Enforced by the real network
 
 Deployed on testnet: code hash `0xab419466…4c08ce` (`data2`, [deploy tx](https://testnet.explorer.nervos.org/transaction/0xf3098bdb9a7bb1c500990be0f1159b7e66f507fef6b7a4f904046024284877f2)),
@@ -716,9 +776,15 @@ What has and has not been shown on testnet is in
   lost key.
 - **An owner sweep can be raced.** A key holder can replace a pending sweep by
   paying a higher fee. Sweep early and sweep again.
-- **Paid access is checked at zero confirmations.** `verifyAccess` accepts a
-  payment once it is committed in a block; a reorg could undo it after the
-  content was released. Fine for articles and pixels, not for anything costly.
+- **Paid access needs no confirmations unless you ask.** By default
+  `verifyAccess`, `verifySubscription` and `subscriptionStatus` accept a payment
+  once it is committed in a block; a reorg could undo it after the content was
+  released. Fine for articles and pixels. For anything costly, pass
+  `minConfirmations` (e.g. `verifyAccess(client, proof, { ...expect,
+  minConfirmations: 6 })`): the payment's own block counts as the first
+  confirmation, a payment short of the depth comes back as `code:
+  "unconfirmed"` (ask again later; it is not unpaid), and one whose block left
+  the main chain as `code: "reorged"`. See docs/API.md, "Confirmation depth".
 - **An access proof does not expire.** It is a bearer token for one article:
   whoever holds the signed proof can fetch that article again. It cannot be
   used for another article or by another payment.

package/dist/confirmations.d.ts

@@ -0,0 +1,46 @@
+import { ccc } from "@ckb-ccc/core";
+/**
+ * Confirmation depth for the checks that accept a payment as proof of access
+ * (`verifyAccess`, `verifySubscription`, `subscriptionStatus`).
+ *
+ * Counting: a transaction in block `b` has `tip - b + 1` confirmations when the
+ * tip is block `tip`. The block that includes it is the first confirmation, as
+ * in the usual (Bitcoin) count; a payment in the tip block has 1.
+ * `minConfirmations` 0 (the default) checks no depth at all: committed is
+ * enough, exactly as before the option existed, and nothing more is fetched.
+ * 1 is the same depth as 0 plus the main-chain check below.
+ *
+ * A payment with enough confirmations must also still be on the main chain: the
+ * node's header at its block number must be the block the node said holds it
+ * (read without CCC's cache). Otherwise it is not counted (`"reorged"`).
+ */
+/** The largest `minConfirmations` accepted: about a day of CKB blocks. Anything past it is taken for a mistake. */
+export declare const MAX_MIN_CONFIRMATIONS = 10000;
+/** Why a payment that is otherwise valid does not count yet, or no longer counts. */
+export type ConfirmationFault = {
+    ok: false;
+    /** Committed, but not yet `minConfirmations` deep: ask again later. */
+    code: "unconfirmed";
+    reason: string;
+    /** `tip - block + 1`, or 0 when the node gave no block (or a block past the tip read). */
+    confirmations: bigint;
+    minConfirmations: bigint;
+} | {
+    ok: false;
+    /** Its block is no longer on the main chain: not counted. */
+    code: "reorged";
+    reason: string;
+};
+/** `minConfirmations` checked: a non-negative integer up to `MAX_MIN_CONFIRMATIONS`; undefined is 0. */
+export declare function minConfirmationsFrom(value: unknown): bigint;
+/** Confirmations of a transaction in block `block` with the tip at `tip`: `tip - block + 1`, never below 0. */
+export declare const confirmationsAt: (tip: bigint, block: bigint) => bigint;
+/**
+ * Why the committed transaction `res` (from `getTransactionNoCache`) does not
+ * count at `minConfirmations` with the tip at `tip`; undefined when it does.
+ * `what` names it in the reason ("payment", "the opening", …).
+ */
+export declare function confirmationFault(client: ccc.Client, tip: bigint, res: {
+    blockNumber?: ccc.NumLike | null;
+    blockHash?: ccc.HexLike | null;
+}, minConfirmations: bigint, what: string): Promise<ConfirmationFault | undefined>;

package/dist/confirmations.js

@@ -0,0 +1,58 @@
+import { ccc } from "@ckb-ccc/core";
+/**
+ * Confirmation depth for the checks that accept a payment as proof of access
+ * (`verifyAccess`, `verifySubscription`, `subscriptionStatus`).
+ *
+ * Counting: a transaction in block `b` has `tip - b + 1` confirmations when the
+ * tip is block `tip`. The block that includes it is the first confirmation, as
+ * in the usual (Bitcoin) count; a payment in the tip block has 1.
+ * `minConfirmations` 0 (the default) checks no depth at all: committed is
+ * enough, exactly as before the option existed, and nothing more is fetched.
+ * 1 is the same depth as 0 plus the main-chain check below.
+ *
+ * A payment with enough confirmations must also still be on the main chain: the
+ * node's header at its block number must be the block the node said holds it
+ * (read without CCC's cache). Otherwise it is not counted (`"reorged"`).
+ */
+/** The largest `minConfirmations` accepted: about a day of CKB blocks. Anything past it is taken for a mistake. */
+export const MAX_MIN_CONFIRMATIONS = 10_000;
+/** `minConfirmations` checked: a non-negative integer up to `MAX_MIN_CONFIRMATIONS`; undefined is 0. */
+export function minConfirmationsFrom(value) {
+    if (value === undefined)
+        return 0n;
+    const ok = (typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= MAX_MIN_CONFIRMATIONS) ||
+        (typeof value === "bigint" && value >= 0n && value <= BigInt(MAX_MIN_CONFIRMATIONS));
+    if (!ok) {
+        throw new RangeError(`minConfirmations must be an integer from 0 to ${MAX_MIN_CONFIRMATIONS}, got ${String(value)}`);
+    }
+    return BigInt(value);
+}
+/** Confirmations of a transaction in block `block` with the tip at `tip`: `tip - block + 1`, never below 0. */
+export const confirmationsAt = (tip, block) => (tip >= block ? tip - block + 1n : 0n);
+/**
+ * Why the committed transaction `res` (from `getTransactionNoCache`) does not
+ * count at `minConfirmations` with the tip at `tip`; undefined when it does.
+ * `what` names it in the reason ("payment", "the opening", …).
+ */
+export async function confirmationFault(client, tip, res, minConfirmations, what) {
+    if (minConfirmations === 0n)
+        return undefined;
+    const known = res.blockNumber !== undefined && res.blockNumber !== null && res.blockHash !== undefined && res.blockHash !== null;
+    const block = known ? ccc.numFrom(res.blockNumber) : undefined;
+    const confirmations = block === undefined ? 0n : confirmationsAt(tip, block);
+    if (confirmations < minConfirmations) {
+        return {
+            ok: false,
+            code: "unconfirmed",
+            reason: `${what} has ${confirmations} of ${minConfirmations} confirmations`,
+            confirmations,
+            minConfirmations,
+        };
+    }
+    // The node's main chain now, not CCC's header cache.
+    const header = await client.getHeaderByNumberNoCache(block);
+    if (!header || header.hash !== ccc.hexFrom(res.blockHash)) {
+        return { ok: false, code: "reorged", reason: `${what}'s block is no longer on the main chain` };
+    }
+    return undefined;
+}

package/dist/index.d.ts

@@ -6,11 +6,13 @@ export { ScopeError, sendInScope, sessionAddress, sessionSigner } from "./transf
 export { relativeBlocksSince, SESSION_LOCK_ERRORS, sessionLockArgs, sessionLockCellDep, sessionLockErrorFrom, sessionLockScript, TESTNET_DEPLOYMENT, TESTNET_LEGACY_DEPLOYMENTS, } from "./lock.js";
 export type { SessionLockDeployment, SessionLockParams } from "./lock.js";
 export { assertCurrentDeployment } from "./deployment.js";
-export { assertPlainXudt, assertSigningLock, closeSession, createPayoutCells, DEFAULT_FUND_FEE_RATE, DEFAULT_RETRY, deadInputs, findOwnedSessionCells, findSessionCells, fundInSession, keyLockOf, matureCells, MAX_PAYOUT_CELLS, MAX_POOL_CHECKS, onchainRecipient, openSession, pickPayoutCell, poolConflict, recoverSessions, SendOutcomeUnknownError, sendWithSession, SessionBalanceError, sessionLockOf, spendInSession, tokenAmount, } from "./onchain.js";
-export type { FundedTransaction, FundOptions, OnChainBinding, RetryOptions, SendWithSessionOptions, SessionBalanceReason, SessionCells, SessionWarning, SigningLockOptions, } from "./onchain.js";
+export { assertPlainXudt, assertSigningLock, checkOwnerLockBuild, closeSession, createPayoutCells, DEFAULT_FUND_FEE_RATE, DEFAULT_RETRY, deadInputs, findOwnedSessionCells, findSessionCells, fundInSession, keyLockOf, matureCells, MAX_PAYOUT_CELLS, MAX_POOL_CHECKS, onchainRecipient, openSession, pickPayoutCell, poolConflict, recoverSessions, REVIEWED_OWNER_LOCK_BUILDS, SendOutcomeUnknownError, sendWithSession, SessionBalanceError, sessionLockOf, spendInSession, tokenAmount, } from "./onchain.js";
+export type { FundedTransaction, FundOptions, OnChainBinding, OwnerLockBuild, RetryOptions, SendWithSessionOptions, SessionBalanceReason, SessionCells, SessionWarning, SigningLockOptions, } from "./onchain.js";
 export { blocksForSeconds, cancelSubscription, chargeSubscription, clearPlantedCells, findSubscriptionCells, MAX_SUBSCRIPTION_CELLS, openSubscription, subscriptionLock, subscriptionMemo, subscriptionStatus, verifySubscription, } from "./subscription.js";
 export type { Subscription, SubscriptionCheck, SubscriptionStatus } from "./subscription.js";
 export { paymentMemo, signAccess, verifyAccess } from "./paywall.js";
 export type { AccessCheck, AccessProof } from "./paywall.js";
+export { MAX_MIN_CONFIRMATIONS } from "./confirmations.js";
+export type { ConfirmationFault } from "./confirmations.js";
 export { applyPlacements, checkPlacement, decodePlacement, encodePlacement, PLACE_BOARD, placementMemo, placementPrice, PlaceMemoError, } from "./place.js";
 export type { BoardState, Pixel, PlaceBoard, PlacedPixel, Placement, PlacementCheck } from "./place.js";

package/dist/index.js

@@ -3,7 +3,8 @@ export { deserializeSession, indexedDbStore, memoryStore, serializeSession, Sess
 export { ScopeError, sendInScope, sessionAddress, sessionSigner } from "./transfer.js";
 export { relativeBlocksSince, SESSION_LOCK_ERRORS, sessionLockArgs, sessionLockCellDep, sessionLockErrorFrom, sessionLockScript, TESTNET_DEPLOYMENT, TESTNET_LEGACY_DEPLOYMENTS, } from "./lock.js";
 export { assertCurrentDeployment } from "./deployment.js";
-export { assertPlainXudt, assertSigningLock, closeSession, createPayoutCells, DEFAULT_FUND_FEE_RATE, DEFAULT_RETRY, deadInputs, findOwnedSessionCells, findSessionCells, fundInSession, keyLockOf, matureCells, MAX_PAYOUT_CELLS, MAX_POOL_CHECKS, onchainRecipient, openSession, pickPayoutCell, poolConflict, recoverSessions, SendOutcomeUnknownError, sendWithSession, SessionBalanceError, sessionLockOf, spendInSession, tokenAmount, } from "./onchain.js";
+export { assertPlainXudt, assertSigningLock, checkOwnerLockBuild, closeSession, createPayoutCells, DEFAULT_FUND_FEE_RATE, DEFAULT_RETRY, deadInputs, findOwnedSessionCells, findSessionCells, fundInSession, keyLockOf, matureCells, MAX_PAYOUT_CELLS, MAX_POOL_CHECKS, onchainRecipient, openSession, pickPayoutCell, poolConflict, recoverSessions, REVIEWED_OWNER_LOCK_BUILDS, SendOutcomeUnknownError, sendWithSession, SessionBalanceError, sessionLockOf, spendInSession, tokenAmount, } from "./onchain.js";
 export { blocksForSeconds, cancelSubscription, chargeSubscription, clearPlantedCells, findSubscriptionCells, MAX_SUBSCRIPTION_CELLS, openSubscription, subscriptionLock, subscriptionMemo, subscriptionStatus, verifySubscription, } from "./subscription.js";
 export { paymentMemo, signAccess, verifyAccess } from "./paywall.js";
+export { MAX_MIN_CONFIRMATIONS } from "./confirmations.js";
 export { applyPlacements, checkPlacement, decodePlacement, encodePlacement, PLACE_BOARD, placementMemo, placementPrice, PlaceMemoError, } from "./place.js";

package/dist/onchain.d.ts

@@ -60,10 +60,18 @@ export declare class SessionBalanceError extends Error {
  *   spend is held to `maxPerTx`, but the change of one spend can be spent again in
  *   the next block (with 1, a block later), so a leaked key can repeat spends until the
  *   session is empty.
+ * - `owner-lock-build-unreviewed`: the owner's lock is Omnilock, JoyID or the
+ *   Nostr lock under its type id, and its live code cell is not a build listed
+ *   in `REVIEWED_OWNER_LOCK_BUILDS` (`dataHash` is what it runs now). The
+ *   deployer may have upgraded it; the opening is not refused.
+ * - `owner-lock-build-unresolved`: the same locks, but the code cell could not be
+ *   read, so the build was not checked.
  */
 export interface SessionWarning {
-    code: "no-rate-limit";
+    code: "no-rate-limit" | "owner-lock-build-unreviewed" | "owner-lock-build-unresolved";
     message: string;
+    /** With `"owner-lock-build-unreviewed"`: the data hash of the owner lock's live code cell. */
+    dataHash?: ccc.Hex;
 }
 /**
  * The smallest key cell that can still be returned to the owner: a cell under the
@@ -259,6 +267,40 @@ export type SigningRole = {
 };
 /** `assertSigningLock` for any role: a subscription's charger lock is checked the same way (review M2), with its own opt-in. */
 export declare function checkSigningLock(lock: ccc.Script, client: ccc.Client, allowUnreviewed: boolean, role: SigningRole): Promise<void>;
+/** A build of a type-id owner lock: the data hash (ckb blake2b) of its code cell. */
+export type OwnerLockBuild = {
+    lock: "Omnilock" | "JoyID" | "Nostr lock";
+    network: "mainnet" | "testnet";
+    /** The type-id code hash owner locks reference (hash_type `type`). */
+    codeHash: ccc.Hex;
+    /** `ccc.hashCkb` of the code cell's data. */
+    dataHash: ccc.Hex;
+    /** What was checked, and when. */
+    review: string;
+};
+/**
+ * The builds of the type-id owner locks this kit has looked at. An owner lock
+ * hash binds the type id, not the binary, so the deployer can replace the code
+ * under every lock at once. `openSession` and `openSubscription` read the live
+ * code cell and warn (`"owner-lock-build-unreviewed"`) when its data hash is not
+ * listed here; they do not refuse. Data hashes read from the live code cells
+ * (resolved by type id, as CCC resolves them) on 7 Nov 2026.
+ */
+export declare const REVIEWED_OWNER_LOCK_BUILDS: readonly OwnerLockBuild[];
+/**
+ * For an owner lock that is Omnilock, JoyID or the Nostr lock referenced by type
+ * id: reads its live code cell and returns a warning unless the cell's data hash
+ * is in `reviewed` (default `REVIEWED_OWNER_LOCK_BUILDS`). `undefined` for every other lock (secp256k1,
+ * multisig, and any lock referenced by data hash, which already binds the binary).
+ *
+ * Never throws: if the code cell cannot be read (RPC error, or no live cell),
+ * the warning is `"owner-lock-build-unresolved"`. The pin is advisory, so a
+ * failed read cannot be stricter than an unknown build; and a client that cannot
+ * read cells will fail later in the opening anyway.
+ */
+export declare function checkOwnerLockBuild(lockLike: ccc.ScriptLike, client: ccc.Client, reviewed?: readonly OwnerLockBuild[]): Promise<SessionWarning | undefined>;
+/** Reports `checkOwnerLockBuild`'s warning, if any, to `onWarning` or `console.warn` (internal; not exported from the package). */
+export declare function warnOwnerLockBuild(lock: ccc.Script, client: ccc.Client, onWarning?: (warning: SessionWarning) => void | Promise<void>): Promise<void>;
 /**
  * Owner funds the session: one transaction, one signature from `owner`.
  * The on-chain recipient comes from `session.policy.scope.recipients`.

package/dist/onchain.js

@@ -569,6 +569,130 @@ export async function checkSigningLock(lock, client, allowUnreviewed, role) {
         return;
     return unreviewed("is not one this kit has reviewed: it may open without the owner's signature");
 }
+/**
+ * The builds of the type-id owner locks this kit has looked at. An owner lock
+ * hash binds the type id, not the binary, so the deployer can replace the code
+ * under every lock at once. `openSession` and `openSubscription` read the live
+ * code cell and warn (`"owner-lock-build-unreviewed"`) when its data hash is not
+ * listed here; they do not refuse. Data hashes read from the live code cells
+ * (resolved by type id, as CCC resolves them) on 7 Nov 2026.
+ */
+export const REVIEWED_OWNER_LOCK_BUILDS = Object.freeze([
+    {
+        lock: "Omnilock",
+        network: "mainnet",
+        codeHash: "0x9b819793a64463aed77c615d6cb226eea5487ccfc0783043a587254cda2b6f26",
+        dataHash: "0x768f306681da232ceb0b94f436c5f813377179762a831c5ad8797bd4fd2d118d",
+        review: "source: nervosnetwork/omnilock cd764d7, whose tests pin this hash; reviewed 5 Nov 2026",
+    },
+    {
+        lock: "JoyID",
+        network: "mainnet",
+        codeHash: "0xd00c84f0ec8fd441c38bc3f87a371f547190f2fcff88e642bc5bf54b9e318323",
+        dataHash: "0x4af7d832e7c328aa4ad6f2deb669743446aea7b9a2f0c25646897501ac4f1ebe",
+        review: "closed source: documentation and a string scan of this binary only; reviewed 5 Nov 2026",
+    },
+    {
+        lock: "Nostr lock",
+        network: "mainnet",
+        codeHash: "0x641a89ad2f77721b803cd50d01351c1f308444072d5fa20088567196c0574c68",
+        dataHash: "0x2effea19ff3024b5b0fb4c0c59c379e7610110e7e3fe7ae003247b1115e59795",
+        review: "source: cryptape/nostr-binding eef134e (strings consistent, not rebuilt); reviewed 5 Nov 2026",
+    },
+    {
+        lock: "Omnilock",
+        network: "testnet",
+        codeHash: "0xf329effd1c475a2978453c8600e1eaf0bc2087ee093c3ee64cc96ec6847752cb",
+        dataHash: "0x6b29b6f10346b43c540e53806ba88ba0fe3a0c3a29d7448ef555840c8f8318fa",
+        review: "the build live on testnet when read on 7 Nov 2026; its source is not identified (testnet funds only)",
+    },
+    {
+        lock: "JoyID",
+        network: "testnet",
+        codeHash: "0xd23761b364210735c19c60561d213fb3beae2fd6172743719eff6920e020baac",
+        dataHash: "0xd2c0f2f621a337007e046f0ed65f8fe29112c32a00ea1e43c2f8059fd42ca6d7",
+        review: "the build live on testnet when read on 7 Nov 2026, a different binary from mainnet; not examined, documentation review only",
+    },
+    {
+        lock: "Nostr lock",
+        network: "testnet",
+        codeHash: "0x6ae5ee0cb887b2df5a9a18137315b9bdc55be8d52637b2de0624092d5f0c91d5",
+        dataHash: "0x2effea19ff3024b5b0fb4c0c59c379e7610110e7e3fe7ae003247b1115e59795",
+        review: "the same binary as the mainnet Nostr lock",
+    },
+]);
+const BUILD_PINNED = [
+    [ccc.KnownScript.OmniLock, "Omnilock"],
+    [ccc.KnownScript.JoyId, "JoyID"],
+    [ccc.KnownScript.NostrLock, "Nostr lock"],
+];
+/**
+ * For an owner lock that is Omnilock, JoyID or the Nostr lock referenced by type
+ * id: reads its live code cell and returns a warning unless the cell's data hash
+ * is in `reviewed` (default `REVIEWED_OWNER_LOCK_BUILDS`). `undefined` for every other lock (secp256k1,
+ * multisig, and any lock referenced by data hash, which already binds the binary).
+ *
+ * Never throws: if the code cell cannot be read (RPC error, or no live cell),
+ * the warning is `"owner-lock-build-unresolved"`. The pin is advisory, so a
+ * failed read cannot be stricter than an unknown build; and a client that cannot
+ * read cells will fail later in the opening anyway.
+ */
+export async function checkOwnerLockBuild(lockLike, client, reviewed = REVIEWED_OWNER_LOCK_BUILDS) {
+    const lock = ccc.Script.from(lockLike);
+    if (lock.hashType !== "type")
+        return undefined;
+    let found;
+    for (const [known, name] of BUILD_PINNED) {
+        try {
+            const info = await client.getKnownScript(known);
+            if (info.codeHash === lock.codeHash && info.hashType === "type")
+                found = { info, name };
+        }
+        catch {
+            // not deployed on this network
+        }
+        if (found)
+            break;
+    }
+    if (!found)
+        return undefined;
+    const { info, name } = found;
+    const whose = `the owner's lock (${name}, type id ${lock.codeHash})`;
+    let dataHash;
+    try {
+        const type = info.cellDeps.map((d) => d.type).find((t) => t && t.hash() === lock.codeHash);
+        const cell = type && (await client.findSingletonCellByType(type, true));
+        if (cell && cell.cellOutput.type?.hash() === lock.codeHash)
+            dataHash = ccc.hashCkb(cell.outputData);
+    }
+    catch {
+        dataHash = undefined;
+    }
+    if (!dataHash) {
+        return {
+            code: "owner-lock-build-unresolved",
+            message: `${whose}: its live code cell could not be read, so its build was not checked against the reviewed builds`,
+        };
+    }
+    if (reviewed.some((b) => b.codeHash === lock.codeHash && b.dataHash === dataHash))
+        return undefined;
+    return {
+        code: "owner-lock-build-unreviewed",
+        dataHash,
+        message: `${whose} now runs code with data hash ${dataHash}, not a build this kit has reviewed: ` +
+            "the deployer may have upgraded it. Check that every way to unlock it still signs the whole transaction",
+    };
+}
+/** Reports `checkOwnerLockBuild`'s warning, if any, to `onWarning` or `console.warn` (internal; not exported from the package). */
+export async function warnOwnerLockBuild(lock, client, onWarning) {
+    const w = await checkOwnerLockBuild(lock, client);
+    if (!w)
+        return;
+    if (onWarning)
+        await onWarning(w);
+    else
+        console.warn(`ckb-session-kit: ${w.message}`);
+}
 /**
  * Owner funds the session: one transaction, one signature from `owner`.
  * The on-chain recipient comes from `session.policy.scope.recipients`.
@@ -595,6 +719,7 @@ export async function openSession(owner, session, deployment, opts) {
         relativeBlocksSince(opts.minInterval); // a spend must be able to meet it
     const ownerLock = (await owner.getRecommendedAddressObj()).script;
     await assertSigningLock(ownerLock, client, opts);
+    await warnOwnerLockBuild(ownerLock, client, opts.onWarning);
     const floor = keyCellFloor(ownerLock);
     const feeBudget = opts.feeBudget ?? floor + FEE_MARGIN;
     if (feeBudget <= floor) {

package/dist/paywall.d.ts

@@ -1,5 +1,6 @@
 import { ccc } from "@ckb-ccc/core";
 import type { Session } from "./session.js";
+import { type ConfirmationFault } from "./confirmations.js";
 /** The memo for a payment: a short UTF-8 label, e.g. `read:article-1`. */
 export declare function paymentMemo(label: string): ccc.Hex;
 /** Whether `lock` runs the standard secp256k1-blake160 sighash_all code (`code`: that script on this network). */
@@ -46,15 +47,24 @@ export type AccessCheck = {
 } | {
     ok: false;
     reason: string;
-};
+    code?: undefined;
+} | ConfirmationFault;
 /**
  * The server's side. `to` is the recipient that must have been paid, as a lock
  * script; `minAmount` in shannons. With `token` (an xUDT type script), the
  * payment is counted in that token's units instead, and `minAmount` is in units.
+ *
+ * With `minConfirmations` (default 0: committed is enough), a payment that is
+ * valid in every other way but fewer than that many blocks deep (counting its
+ * own block as 1) gives `code: "unconfirmed"` with its `confirmations`, and one
+ * whose block left the main chain `code: "reorged"` (src/confirmations.ts).
+ * Throws a `RangeError` for a `minConfirmations` that is not an integer from 0
+ * to `MAX_MIN_CONFIRMATIONS`.
  */
 export declare function verifyAccess(client: ccc.Client, proof: AccessProof, expect: {
     to: ccc.ScriptLike;
     minAmount: bigint;
     memo: ccc.HexLike;
     token?: ccc.ScriptLike;
+    minConfirmations?: number | bigint;
 }): Promise<AccessCheck>;

package/dist/paywall.js

@@ -1,6 +1,7 @@
 import { ccc } from "@ckb-ccc/core";
 import { tokenAmount } from "./onchain.js";
 import { sessionSigner } from "./transfer.js";
+import { confirmationFault, minConfirmationsFrom } from "./confirmations.js";
 /**
  * Paid access, checked against the chain with no database.
  *
@@ -88,8 +89,16 @@ export async function signAccess(session, txHash, memo) {
  * The server's side. `to` is the recipient that must have been paid, as a lock
  * script; `minAmount` in shannons. With `token` (an xUDT type script), the
  * payment is counted in that token's units instead, and `minAmount` is in units.
+ *
+ * With `minConfirmations` (default 0: committed is enough), a payment that is
+ * valid in every other way but fewer than that many blocks deep (counting its
+ * own block as 1) gives `code: "unconfirmed"` with its `confirmations`, and one
+ * whose block left the main chain `code: "reorged"` (src/confirmations.ts).
+ * Throws a `RangeError` for a `minConfirmations` that is not an integer from 0
+ * to `MAX_MIN_CONFIRMATIONS`.
  */
 export async function verifyAccess(client, proof, expect) {
+    const minConfirmations = minConfirmationsFrom(expect.minConfirmations);
     if (ccc.hexFrom(proof.memo) !== ccc.hexFrom(expect.memo))
         return { ok: false, reason: "memo does not match" };
     // Always the CKB secp256k1 scheme: a sign type chosen by the caller is not trusted.
@@ -171,5 +180,11 @@ export async function verifyAccess(client, proof, expect) {
         const shown = token ? `${paid} units` : `${ccc.fixedPointToString(paid)} CKB`;
         return { ok: false, reason: `paid ${shown}, below the price` };
     }
+    // Depth last: "unconfirmed" then means the payment is good, only too recent.
+    if (minConfirmations > 0n) {
+        const fault = await confirmationFault(client, await client.getTip(), res, minConfirmations, "payment");
+        if (fault)
+            return fault;
+    }
     return { ok: true, paid };
 }

package/dist/subscription.d.ts

@@ -1,6 +1,7 @@
 import { ccc } from "@ckb-ccc/core";
 import { type SessionLockDeployment } from "./lock.js";
-import { type SigningLockOptions, type RetryOptions } from "./onchain.js";
+import { type SigningLockOptions, type SessionWarning, type RetryOptions } from "./onchain.js";
+import { type ConfirmationFault } from "./confirmations.js";
 /**
  * Subscriptions (docs/design/subscriptions.md): the same session lock, with the
  * roles moved. The subscriber is the owner; the creator's charger key is the
@@ -126,6 +127,12 @@ export declare function openSubscription(subscriber: ccc.Signer, deployment: Ses
     beforeSend?: (sub: Subscription) => Promise<void>;
     /** Let an unreviewed charger lock through, with a warning (`allowUnreviewedOwnerLock` covers the subscriber's own lock only). */
     allowUnreviewedChargerLock?: boolean;
+    /**
+     * Called before anything is signed with a `SessionWarning` about the
+     * subscriber's lock (`"owner-lock-build-unreviewed"` or
+     * `"owner-lock-build-unresolved"`); throw to stop. Without it, `console.warn`.
+     */
+    onWarning?: (warning: SessionWarning) => void | Promise<void>;
 } & SigningLockOptions): Promise<{
     txHash: ccc.Hex;
     subscription: Subscription;
@@ -233,7 +240,8 @@ export type SubscriptionCheck = {
 } | {
     ok: false;
     reason: string;
-};
+    code?: undefined;
+} | ConfirmationFault;
 /**
  * The creator checks a subscription from the chain alone. Nothing in the request
  * is trusted but the out point. The cell at `outPoint` must be live, under this
@@ -257,6 +265,13 @@ export type SubscriptionCheck = {
  * type hash, `price` in token units as `max_per_tx_token`); `minBalance` is in token
  * units, and the payment counted is token units into `payTo`'s cells of the token.
  * Without `token`, a 160-byte cell is refused, and the reverse.
+ *
+ * With `minConfirmations` (default 0: committed is enough), the creating
+ * transaction must be that many blocks deep, its own block counting as 1: a cell
+ * valid in every other way gives `code: "unconfirmed"` until then, and
+ * `code: "reorged"` if that block left the main chain (src/confirmations.ts).
+ * Throws a `RangeError` for a `minConfirmations` that is not an integer from 0
+ * to `MAX_MIN_CONFIRMATIONS`.
  */
 export declare function verifySubscription(client: ccc.Client, deployment: SessionLockDeployment, outPoint: ccc.OutPointLike, expected: {
     charger: string;
@@ -266,6 +281,7 @@ export declare function verifySubscription(client: ccc.Client, deployment: Sessi
     minBalance?: bigint;
     account?: string;
     token?: ccc.ScriptLike;
+    minConfirmations?: number | bigint;
 }): Promise<SubscriptionCheck>;
 export interface SubscriptionStatus {
     /**
@@ -283,6 +299,11 @@ export interface SubscriptionStatus {
     chargesLeft: bigint;
     /** Blocks until the creator may charge again (0 = now). */
     nextChargeIn: bigint | undefined;
+    /**
+     * With `minConfirmations`: the block a charge still short of that depth will
+     * pay through once it has it, when that is past `paidThroughBlock`. Not access yet.
+     */
+    unconfirmedThroughBlock?: bigint;
 }
 /**
  * Where a subscription stands, for a creator's server that keeps no database:
@@ -298,17 +319,27 @@ export interface SubscriptionStatus {
  * `MAX_SUBSCRIPTION_CELLS` cells (or recent transactions) sit under the lock:
  * not a verdict on the subscription, so not an `ok: false`. A server should
  * answer it as a conflict the subscriber can clear by cancelling and opening again.
+ *
+ * With `minConfirmations` (default 0: committed is enough), only payments that
+ * many blocks deep count, their own block counting as 1, and still on the main
+ * chain. An opening short of it gives `code: "unconfirmed"` (or `"reorged"`); a
+ * charge short of it does not extend `paidThroughBlock` yet, and shows in
+ * `unconfirmedThroughBlock`. The tip is read once. Throws a `RangeError` for a
+ * `minConfirmations` that is not an integer from 0 to `MAX_MIN_CONFIRMATIONS`.
  */
 export declare function subscriptionStatus(client: ccc.Client, deployment: SessionLockDeployment, sub: Subscription, proof: {
     openTx: ccc.HexLike;
     account: string;
+}, options?: {
+    minConfirmations?: number | bigint;
 }): Promise<{
     ok: true;
     status: SubscriptionStatus;
 } | {
     ok: false;
     reason: string;
-}>;
+    code?: undefined;
+} | ConfirmationFault>;
 /**
  * About how many blocks `seconds` is, from the average block time over the last
  * `sample` blocks. Block time varies; round up when a period means "no more often than".

package/dist/subscription.js

@@ -1,8 +1,9 @@
 import { ccc } from "@ckb-ccc/core";
 import { relativeBlocksSince, sessionLockCellDep, sessionLockScript, } from "./lock.js";
-import { addTopUp, assertPlainXudt, assertSigningLock, checkSigningLock, isAnyoneCanPay, keyCellFloor, ownerSweep, ownOrigin, plainXudtFault, randomPick, completeFeeOrNoFeeCell, rebuildOnDeadInputs, SessionBalanceError, signAndSend, tokenAmount, tokenData, withoutDeadCached, withinU128, } from "./onchain.js";
+import { addTopUp, assertPlainXudt, assertSigningLock, checkSigningLock, isAnyoneCanPay, keyCellFloor, ownerSweep, ownOrigin, plainXudtFault, randomPick, completeFeeOrNoFeeCell, rebuildOnDeadInputs, SessionBalanceError, signAndSend, tokenAmount, tokenData, warnOwnerLockBuild, withoutDeadCached, withinU128, } from "./onchain.js";
 import { assertCurrentDeployment } from "./deployment.js";
 import { SessionPolicyError } from "./session.js";
+import { confirmationFault, minConfirmationsFrom } from "./confirmations.js";
 const tokenOf = (sub) => sub.token && ccc.Script.from(sub.token.type);
 export function subscriptionLock(deployment, sub) {
     const token = tokenOf(sub);
@@ -297,6 +298,7 @@ export async function openSubscription(subscriber, deployment, opts) {
     }
     const subscriberLock = (await subscriber.getRecommendedAddressObj()).script;
     await assertSigningLock(subscriberLock, client, opts);
+    await warnOwnerLockBuild(subscriberLock, client, opts.onWarning);
     const [chargerLock, payToLock] = await Promise.all([opts.charger, opts.payTo].map(async (a) => (await ccc.Address.fromString(a, client)).script));
     // A charger lock that signs nothing would let anyone trigger charges (review M2). Its own
     // opt-in: opting in for the subscriber's wallet does not waive review of the creator's lock (review W6 I1).
@@ -394,7 +396,9 @@ export async function findSubscriptionCells(client, deployment, sub) {
  * cell's creating transaction and age (undefined while not committed), so a
  * charge or a status fetches each of them once (review, 28 Oct).
  */
-async function subscriptionState(client, deployment, sub) {
+async function subscriptionState(client, deployment, sub, 
+/** The tip, when the caller already read it (one tip per call). */
+knownTip) {
     const lock = subscriptionLock(deployment, sub);
     const token = tokenOf(sub);
     const cells = await subscriptionCells(client, lock, token, MAX_SUBSCRIPTION_CELLS);
@@ -407,7 +411,7 @@ async function subscriptionState(client, deployment, sub) {
             byHash.set(h, client.getTransactionNoCache(h)); // the node's answer, not the cache's
         return byHash.get(h);
     };
-    const [tip, created] = await Promise.all([client.getTip(), Promise.all(cells.map((c) => creating(c.outPoint.txHash)))]);
+    const [tip, created] = await Promise.all([knownTip ?? client.getTip(), Promise.all(cells.map((c) => creating(c.outPoint.txHash)))]);
     const ages = created.map((res) => {
         const born = res?.blockNumber;
         return born === undefined || born === null ? undefined : tip - ccc.numFrom(born);
@@ -712,8 +716,16 @@ function chargesLeftOf(sub, lock, balance, tokenBalance) {
  * type hash, `price` in token units as `max_per_tx_token`); `minBalance` is in token
  * units, and the payment counted is token units into `payTo`'s cells of the token.
  * Without `token`, a 160-byte cell is refused, and the reverse.
+ *
+ * With `minConfirmations` (default 0: committed is enough), the creating
+ * transaction must be that many blocks deep, its own block counting as 1: a cell
+ * valid in every other way gives `code: "unconfirmed"` until then, and
+ * `code: "reorged"` if that block left the main chain (src/confirmations.ts).
+ * Throws a `RangeError` for a `minConfirmations` that is not an integer from 0
+ * to `MAX_MIN_CONFIRMATIONS`.
  */
 export async function verifySubscription(client, deployment, outPoint, expected) {
+    const minConfirmations = minConfirmationsFrom(expected.minConfirmations);
     const cell = await client.getCellLive(outPoint, true, false);
     if (!cell)
         return { ok: false, reason: "no live cell at that out point" };
@@ -795,6 +807,12 @@ export async function verifySubscription(client, deployment, outPoint, expected)
     if (expected.account !== undefined && !commitsToAccount(created, sub, expected.account)) {
         return { ok: false, reason: "the opening does not commit to this account" };
     }
+    // Depth last: "unconfirmed" then means the cell is good, only too recent.
+    if (minConfirmations > 0n) {
+        const fault = await confirmationFault(client, await client.getTip(), { blockNumber: created.block, blockHash: created.blockHash }, minConfirmations, "the transaction that created the cell");
+        if (fault)
+            return fault;
+    }
     return {
         ok: true,
         subscription: sub,
@@ -864,7 +882,7 @@ fetched) {
     const paid = out - amount(toPayTo(inputs.map((c) => ({ cellOutput: c.cellOutput, data: c.outputData }))));
     if (paid < owed)
         return notPaid;
-    return { tx, block: ccc.numFrom(created.blockNumber), inputs };
+    return { tx, block: ccc.numFrom(created.blockNumber), blockHash: created.blockHash, inputs };
 }
 /** Whether `p` carries `subscriptionMemo(account)` in the witness of an input under the subscriber's lock. */
 function commitsToAccount(p, sub, account) {
@@ -885,8 +903,16 @@ function commitsToAccount(p, sub, account) {
  * `MAX_SUBSCRIPTION_CELLS` cells (or recent transactions) sit under the lock:
  * not a verdict on the subscription, so not an `ok: false`. A server should
  * answer it as a conflict the subscriber can clear by cancelling and opening again.
+ *
+ * With `minConfirmations` (default 0: committed is enough), only payments that
+ * many blocks deep count, their own block counting as 1, and still on the main
+ * chain. An opening short of it gives `code: "unconfirmed"` (or `"reorged"`); a
+ * charge short of it does not extend `paidThroughBlock` yet, and shows in
+ * `unconfirmedThroughBlock`. The tip is read once. Throws a `RangeError` for a
+ * `minConfirmations` that is not an integer from 0 to `MAX_MIN_CONFIRMATIONS`.
  */
-export async function subscriptionStatus(client, deployment, sub, proof) {
+export async function subscriptionStatus(client, deployment, sub, proof, options = {}) {
+    const minConfirmations = minConfirmationsFrom(options.minConfirmations);
     try {
         assertTerms(sub);
         const token = tokenOf(sub);
@@ -912,7 +938,15 @@ export async function subscriptionStatus(client, deployment, sub, proof) {
         return { ok: false, reason: "the opening created no cell under this subscription's lock" };
     if (!commitsToAccount(opening, sub, proof.account))
         return { ok: false, reason: "the opening does not commit to this account" };
-    const { cells, balance, tokenBalance, nextChargeIn, tip, created, spent, ownerAfter } = await subscriptionState(client, deployment, sub);
+    // One tip for the whole call: the opening's depth, each charge's, and `active`.
+    const knownTip = minConfirmations > 0n ? await client.getTip() : undefined;
+    const depthFault = (p, what) => knownTip === undefined
+        ? Promise.resolve(undefined)
+        : confirmationFault(client, knownTip, { blockNumber: p.block, blockHash: p.blockHash }, minConfirmations, what);
+    const openingFault = await depthFault(opening, "the opening");
+    if (openingFault)
+        return openingFault;
+    const { cells, balance, tokenBalance, nextChargeIn, tip, created, spent, ownerAfter } = await subscriptionState(client, deployment, sub, knownTip);
     let paidThroughBlock;
     const renews = (p, txHash) => 
     // Only the proven opening or a charge renews; another payment to payTo that
@@ -924,14 +958,27 @@ export async function subscriptionStatus(client, deployment, sub, proof) {
     if (spent && !ownerAfter && !paying.some((c) => c.txHash === spent.txHash))
         paying.push({ txHash: spent.txHash, fetched: spent.fetched });
     const payments = await Promise.all(paying.map((c) => payment(c.txHash, c.fetched)));
+    let unconfirmedThroughBlock;
     for (const [i, { txHash }] of paying.entries()) {
         const p = payments[i];
         if (!renews(p, txHash))
             continue;
         const through = p.block + sub.periodBlocks;
+        // The opening's depth was checked above; a charge's is checked here.
+        const fault = txHash === openHash ? undefined : await depthFault(p, "a charge");
+        if (fault) {
+            // Too recent: it counts later. Reorged: it never does.
+            if (fault.code === "unconfirmed" && (unconfirmedThroughBlock === undefined || through > unconfirmedThroughBlock)) {
+                unconfirmedThroughBlock = through;
+            }
+            continue;
+        }
         if (paidThroughBlock === undefined || through > paidThroughBlock)
             paidThroughBlock = through;
     }
+    if (unconfirmedThroughBlock !== undefined && paidThroughBlock !== undefined && unconfirmedThroughBlock <= paidThroughBlock) {
+        unconfirmedThroughBlock = undefined;
+    }
     return {
         ok: true,
         status: {
@@ -942,6 +989,7 @@ export async function subscriptionStatus(client, deployment, sub, proof) {
             ...(sub.token && { tokenBalance }),
             chargesLeft: chargesLeftOf(sub, lock, balance, tokenBalance),
             nextChargeIn,
+            ...(unconfirmedThroughBlock !== undefined && { unconfirmedThroughBlock }),
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ckb-session-kit",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Browser-held self-custody sessions for CKB applications",
   "keywords": [
     "ckb",