thePR0M3TH3ANandClaude Fable 5 a7adef05f9 NIP-07 sign-in: delegate to an installed extension behind the same facade ...

Implements login-methods.md §LM4. New signers/ layer in the widget:
detectForeignNip07Provider never mistakes BitLogin's own provider for an
extension, and Nip07Signer wraps the snapshotted provider with capability
probing (typed SignerUnsupportedError instead of TypeErrors off missing
nip44), deadlines on every call (SignerTimeoutError -- no silent hangs),
pubkey validation, and unsigned-event normalization.

The element routes its public API through the active signer, so hosts get
the extension backend transparently. Extension sessions are thin (§LM7):
no capsule, no vault (requestNwcConnection resolves null), no persistence,
and window.nostr is left to the extension -- claimSigner stays reserved
for BitLogin-account sessions. bitlogin-login now carries method and
capabilities; publicKey is unchanged for existing hosts.

Password-first pinned (owner decision, §LM9.1): the extension option
renders as a secondary link under the primary sign-in, enforced in
securityPolicy.test.ts alongside a pin that the extension confirm path
never claims window.nostr or writes storage. 14 new signer tests.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-08-04 09:28:24 -04:00

..

core

Pin that pre-removal passwords still sign in

2026-07-31 22:04:01 -04:00

demo

Second-audit hardening: phrase-gated sudo key, deterministic migration, policy tests

2026-07-31 13:54:36 -04:00

widget

NIP-07 sign-in: delegate to an installed extension behind the same facade

2026-08-04 09:28:24 -04:00