thePR0M3TH3ANandClaude Fable 5 a7cf55ea84 window.bitlogin.activeMethod()/activeSession(): session state for every method ...

Hosts had no method-agnostic session check: isActiveSigner() answers who
backs window.nostr, which is deliberately false during a NIP-07 session
(the extension IS the signer and rightly owns the slot) even though the
user signed in through BitLogin. Sites using it as a login check
mis-read extension sessions.

A page-level registry (globalSession.ts, public data only -- method,
pubkey, npub) is written at the single dispatchLogin point and cleared
on logout and DOM removal, owner-scoped so one element's teardown can't
clear another's session. window.bitlogin gains activeMethod() and
activeSession(); the integration guide and llms.txt now spell out the
two-questions distinction and lead with the one-login-surface pattern.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-08-04 10:58:14 -04:00

..

public

window.bitlogin.activeMethod()/activeSession(): session state for every method

2026-08-04 10:58:14 -04:00

build.mjs

Second-audit hardening: phrase-gated sudo key, deterministic migration, policy tests

2026-07-31 13:54:36 -04:00

package.json

Add MIT license, CONTRIBUTING, and SECURITY docs for open-sourcing

2026-07-21 16:54:55 +00:00

serve.mjs

Implement BitLogin as a modular protocol library, embeddable widget, and demo site

2026-07-21 03:44:10 +00:00

swBuild.mjs

Second-audit hardening: phrase-gated sudo key, deterministic migration, policy tests

2026-07-31 13:54:36 -04:00