v2.26.0

Release date: July 22, 2025

New features

Support for optional `accepted` status for intents

Added support for additional status accepted in intent processing (2PC) flow. This status is placed between pending and prepared, right after debit preparation and is evaluated when there is at least one status policy of record intent that matches the intent.

(Opt-in) Global access control policies

Until now, an access policy being created was not enough for it to start being applied. It would have to be attached into the access rules of specific record(s). Now there is a ledger config option on path access.strategy with values record-based and policy-based (defaults to record-based). record-based - Retains current behaviour. Policies are only active once referenced from access rules of a record. policy-based - Policies that exist and are active are automatically applied.

When using the latest version of CLI, creating a new ledger will default to it being policy-based.

More details in:

Side navigation menu is now customizable through custom policies with schema navigation. This feature will allow menu items to be added, removed or changed in order to provide a customized experience when navigating through studio for each use case.

This feature is experimental and a user friendly editor will be added to studio. We don't recommend using it other than for testing.

Improvements

User-Facing

[studio] Added version info for studio in the nav bar.
[docs] Updated docs to describe policy-based and record-based access strategies, teach how to activate/deactivate access policies and migrate a ledger to policy-based access strategy.
[cli] Added option -y, --yes to ledger create command. This option ease the creation by skipping prompts and relying on default values for a ledger record.
[docs] Updated the documentation site with a custom theme, improved navigation, and better content structure.
[docs] Created new custom MDX components (Button, Card, Vertical Tabs, etc.) to allow for richer content.
[ledger] Allow custom schemas for policies other than the known ones (access, status, labels, schedule and layout). Validation for known schemas will still be performed, but custom schemas will not have built-in validation, only validation based on the content of the schema record.
[studio] Changed redirect to login when reset password token expires
[studio] Changed reset and sign-up schemas, increased required password length, and refactored a few processes
[ledger] Removed requirement of access in ledger record. It is now nullable and has no minimum length constraint.
[ledger-sdk] BREAKING! Removed secret client from the ledger SDK. It was not documented and was almost surely used only on studio.
[ledger] POST /secret/!reveal endpoint and its related API specs, types, entities and DTOs.

Internal

[studio-e2e] Added proper test cases for reset flow.
[studio] FlexId field component to be used in schema forms and generate random handle-safe flexids in forms instead of asking for user input. For now it's hardcoded in the report-form component, it will be handled in the schema once the UI Schema project is implemented.
[cache] Added traces to cache adapters multi, redis and memory. Main methods are covered with traces, such as: get, set, delete and invalidate.
[ledger] Added traces to cache dependents invalidation.
[logger] Added pino-pretty logger transport option as an alternative to pretty transport to resolve Vite compatibility issues in Studio dev environment. Uses simplified pino-pretty configuration with basic colorization.
[studio-e2e] Wrote README.md file with guidelines on how to run and write end to end tests for studio.
[studio-e2e] Proper tests cases for signup flow. Temporarily changed forgot to reuse auth ledger.
[studio-e2e] Added ledgersOwnerService to share ledgers between tests and improve overall performance.
[bridge-bqrb] Deployed to dev, stg and prd.
[ledger] Changed intent info resolution (wallets, bridge entries and candidate balance movements) to resolve from resolution proofs custom.status = 'resolved' - signed by the ledger. This feature is controlled by boolean flag dtc.intentInfoResolutionFromProofs that's initially disabled on all envs.
[ci] Removed NX from self-hosted runners. Changed publish-to-gcp-registry script to use npx nx instead of nx to run commands, so it works on machines without NX installed globally.
[ledger] Extracted resolveLocalhostSubdomains logic into a separate function to be reused in BridgeOauthService and AnchorsForwardingService. It was already in use by BridgesService. Now, localhost subdomains are resolved and modifying the host file of the local machine is no longer required. Monorepo's README.md file was updated to reflect this change.
[ledger] Renamed upsert_balances function to upsert_balances_with_hook to avoid conflicts with existing functions. New type upsert_balances_with_hook_result was also created to decouple it from the previous implementation.
[studio-e2e] Updated e2e tests for forgot cases according to notion.
[ledger] Add check for config access.strategy before extracting and setting owners into entities. Owners are not stored when it's set to policy-based.
[libs/db] Moved subscribers from @minka/db to @minka/db/subscribers subdirectory. Subscribers are no longer exported from @minka/db index file, this is because it uses decorators not supported by playwright causing issues with studio-e2e tests.
[studio] Enable unstable React Router middleware.
[studio] Removed custom MemoryDatabase implementation and node-cache dependency in favor of using @minka/cache library.
[studio] Resolve navigation menu from default policy values instead of having a hardcoded component.
[ledger] Added support for DB connection timeout configuration with 30 seconds default.
[studio] Change studio's deployment.yaml file to have only 1 pod (replica)
[bridge-bqrb] Removed database

Fixes

[studio] Changed browser history redirection with document redirection for login in order to fix a white screen issue when the user logs in for the first time in a new tab.
[studio] Added CSRF (Cross-Site Request Forgery) protection to prevent malicious websites from performing unauthorized actions. Includes middleware for token validation, enhanced fetcher hook that automatically includes CSRF tokens, and session-based token management. Developers can use the enhanced useFetcher hook or manually add CSRF tokens to forms.
[studio] Fixed bug when reading report assets after upgrading to React Router v7 and upgrading axios to 1.10.
[types] Registered authentication.twoFactor.enabled ledger config key as a valid value for the config property of ledger record.
[ledger] Prevent double ledger commit when intent committed quorum not achieved after ledger signs committed. Under feature flag dtc.committedProofDoubleSpendPrevention which is by default true everywhere.
[ledger] Ensured the following will be grouped together as one atomic operation (using the same DB transaction): Adding 'committed' proof (with optional movement of intent status to 'committed') & moving balances for all claims of intent
[studio] Fixed 2fa setup step to persist QR code even in case when you get it wrong the first time.
[layouts] studio policy in studio-setup layout had wrong access rule for revealing secrets from SignerFactorSecret record (It was wrongfully using SignerFactor record).
[ledger] Fixed bridge entry factory so that debit/credit calls are delivered to bridges of routed wallets, when applicable.