mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-29 17:41:22 +00:00
thePR0M3TH3ANandClaude Fable 5
c3e55add16
The Phase D surface from vault-ux.md, scoped to NWC and honest about its
boundary: an embedded same-origin widget cannot broker (§CV12.3), so the
API reveals, says so in its consent copy, and leans on the wallet-side
budget as the real security boundary.
One public call owns the whole ceremony. If nobody is signed in, the
sign-in flow runs first and the request resumes via the goto("dashboard")
hook exactly once; if the account has a connection bound to the
requesting origin, the user gets the one-tap approval screen the vault
exists for; otherwise a guided import -- Bitcoin Connect's wallet
chooser or a pasted URI. The BC integration lifts Satisfied's
production discipline verbatim: chooser only, lazy chunks (never
downloaded unless the flow opens), no numeric budget in
authorizationUrlOptions (the unit is not interoperable), disconnect and
clear bc:config so no plaintext copy outlives the ceremony.
The worker holds the vault root (never the sudo key -- wiped on
arrival) and gains vaultStatus/List/SaveNwc/FindForOrigin/RevealNwc/
SetBinding/Delete actions; the root rides the encrypted session cache
so restored sessions keep working, with a vaultEnabled marker so a
stale cache says "sign in again" instead of falsely claiming the
account has no vault. Publishing failures are loud -- a connection that
reached no relay is not saved anywhere and says so. The dashboard gains
Wallet connections management with "revoke app access" and "remove
from BitLogin" honestly separated from wallet-side revocation.
VaultSession gains buildDeletionRequest so the NIP-09 courtesy ask is
signed without exposing the signing key.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01CMr9Yt8SYmZcfgrg3CV2G1
41 lines
1.1 KiB
JSON
41 lines
1.1 KiB
JSON
{
|
|
"name": "@bitlogin/core",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"license": "MIT",
|
|
"type": "module",
|
|
"description": "BitLogin protocol core: crypto, capsules, Nostr relay I/O, account flows. Framework- and DOM-free.",
|
|
"main": "./dist/index.js",
|
|
"types": "./dist/index.d.ts",
|
|
"exports": {
|
|
".": "./dist/index.js",
|
|
"./crypto": "./dist/crypto/index.js",
|
|
"./nostr": "./dist/nostr/index.js",
|
|
"./capsules": "./dist/capsules/index.js",
|
|
"./account": "./dist/account/index.js",
|
|
"./storage": "./dist/storage/index.js",
|
|
"./vault": "./dist/vault/index.js"
|
|
},
|
|
"scripts": {
|
|
"build": "tsc -b",
|
|
"typecheck": "tsc -b --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"@noble/ciphers": "^2.2.0",
|
|
"@noble/curves": "^1.9.1",
|
|
"@noble/hashes": "^1.7.1",
|
|
"@scure/base": "^1.2.6",
|
|
"@scure/bip39": "^1.5.4",
|
|
"canonicalize": "^2.0.0",
|
|
"diceware-wordlist-en-eff": "^1.0.1",
|
|
"hash-wasm": "^4.12.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^22.10.0",
|
|
"@types/ws": "^8.18.1",
|
|
"typescript": "^5.7.3",
|
|
"vitest": "^3.0.5",
|
|
"ws": "^8.21.1"
|
|
}
|
|
}
|