mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-27 08:31:21 +00:00
thePR0M3TH3ANandClaude Fable 5
d040c2f5af
Reliability, which is where most of these reach users: - The worker RPC had no message validation, no error/messageerror listener, no timeout, and terminate() left every pending promise unsettled. A malformed frame threw inside the listener (posting no response at all) and a dead worker stranded its callers -- the documented innerHTML-remount hazard manifested as a permanent freeze rather than an error. Both sides now validate the envelope, calls time out at 60s, and worker death rejects everything outstanding. - requestNwcConnection fired no pending event, so a host using the RECOMMENDED hidden-mount pattern navigated a hidden element to a consent screen nobody could see and waited forever. Now symmetric with bitlogin-offer-pending. Consent integrity: - vaultOfferCheck published an origin rebinding to relays -- a durable mutation of the user's account -- from a plain host API call before any consent screen existed. It is read-only now, and a wallet stored under a DIFFERENT origin no longer reports as already-saved, so the binding can only change through the consented path. - offerNwcConnection's guard sat above three awaits; two concurrent calls both passed it and the second dropped the first's promise. The slot is claimed synchronously. Vault reads fail closed: - listConnections threw rather than returning a relay-shaped subset when quorum is not met -- a short listing is indistinguishable from "you have no connections", and one relay should not get to say that. - The 500-record page limit is reported (truncated) instead of silently deciding which connections exist. Supply chain: - All eight crypto dependencies pinned to exact versions (they held users' keys behind caret ranges), and Bitcoin Connect with them. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CMr9Yt8SYmZcfgrg3CV2G1
41 lines
1.1 KiB
JSON
41 lines
1.1 KiB
JSON
{
|
|
"name": "@bitlogin/core",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"license": "MIT",
|
|
"type": "module",
|
|
"description": "BitLogin protocol core: crypto, capsules, Nostr relay I/O, account flows. Framework- and DOM-free.",
|
|
"main": "./dist/index.js",
|
|
"types": "./dist/index.d.ts",
|
|
"exports": {
|
|
".": "./dist/index.js",
|
|
"./crypto": "./dist/crypto/index.js",
|
|
"./nostr": "./dist/nostr/index.js",
|
|
"./capsules": "./dist/capsules/index.js",
|
|
"./account": "./dist/account/index.js",
|
|
"./storage": "./dist/storage/index.js",
|
|
"./vault": "./dist/vault/index.js"
|
|
},
|
|
"scripts": {
|
|
"build": "tsc -b",
|
|
"typecheck": "tsc -b --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"@noble/ciphers": "2.2.0",
|
|
"@noble/curves": "1.9.7",
|
|
"@noble/hashes": "1.8.0",
|
|
"@scure/base": "1.2.6",
|
|
"@scure/bip39": "1.6.0",
|
|
"canonicalize": "2.1.0",
|
|
"diceware-wordlist-en-eff": "1.0.1",
|
|
"hash-wasm": "4.12.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^22.10.0",
|
|
"@types/ws": "^8.18.1",
|
|
"typescript": "^5.7.3",
|
|
"vitest": "^3.0.5",
|
|
"ws": "^8.21.1"
|
|
}
|
|
}
|