From 3e243d0cd2316c42edd035fe654c9bb3f49e498e Mon Sep 17 00:00:00 2001 From: benk10 Date: Wed, 7 Oct 2026 12:42:59 -0500 Subject: [PATCH] chore: update paykit to rc70 --- docs/pubky.md | 5 +++++ gradle/libs.versions.toml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/pubky.md b/docs/pubky.md index a6b66350f5..5837751a55 100644 --- a/docs/pubky.md +++ b/docs/pubky.md @@ -30,6 +30,11 @@ Delegates Pubky operations to `PaykitSdkService`, which uses: Paykit derives the delegated Paykit key from the active Pubky identity secret and the App Registry's current key generation. Authorized apps share encrypted Pubky-hosted Paykit state; Bitkit retains wallet-owned address reservations and pending payment proofs locally. +Shared-state deployments require Homeserver 0.15 or newer on every serving instance. +The Paykit dependency does not upgrade the homeserver or verify its version. +Uncertain-write recovery still retains pending markers and the five-minute +cooldown; Homeserver 0.15 does not eliminate every uncertain-publication case. + The Android dependency is `com.synonym:paykit-android` from GitHub Packages, pinned in `gradle/libs.versions.toml`. Paykit is excluded from Maven-local resolution. Companion authorization and key-sharing consent are described in [Pubky Auth companion claims](pubky-auth-companion-claims.md). Session, state, key and publishing calls are serialized by `PaykitSdkService`'s operation lock. The public reads — `fetchFile()` (`fetchPubkyFileBounded()`), `fetchPubkyProfile()`, `fetchPubkyFollows()`, `resolveContactProfile()`, and the receiver reads `discoverRelevantReceiverPaths()`, `privateReceiverPathSelection()` and `paymentRequestReceiverPaths()` (`paykitReceiverPaths()` and `paykitReceiverMarker()`) — run outside that lock, at most 6 at once, and are cancelled with their caller. Only unauthenticated public reads may use that path. Reading or saving a contact record stays under the lock, so a caller that discovers receiver paths and then saves them takes the lock only for the save. A wallet wipe still applies to the public reads: one that needs an SDK instance builds it under the lock, one that starts during the wipe fails the way a locked call does, and one that the wipe overtakes fails instead of returning its result, while the wipe's own cleanup can still read. diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index b2e471418a..667d2568ba 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -22,7 +22,7 @@ appcompat = { module = "androidx.appcompat:appcompat", version = "1.7.1" } barcode-scanning = { module = "com.google.mlkit:barcode-scanning", version = "17.3.0" } biometric = { module = "androidx.biometric:biometric", version = "1.4.0-alpha05" } bitkit-core = { module = "com.synonym:bitkit-core-android", version = "0.5.18" } -paykit = { module = "com.synonym:paykit-android", version = "0.1.0-rc69" } +paykit = { module = "com.synonym:paykit-android", version = "0.1.0-rc70" } bouncycastle-provider-jdk = { module = "org.bouncycastle:bcprov-jdk18on", version = "1.83" } camera-camera2 = { module = "androidx.camera:camera-camera2", version.ref = "camera" } camera-lifecycle = { module = "androidx.camera:camera-lifecycle", version.ref = "camera" }